What we found
Roomba (Platform): DiRobot's privacy page said: "Images used for navigation are NOT sent to the Cloud." A Roomba J7 photographed a woman sitting on a toilet.
MIT Technology Review reported in December 2022 that a Roomba J7 series robot captured images of a woman sitting on a toilet. The images were shared with Scale AI, a data labeling company, where gig workers in Venezuela viewed and annotated them. Scale AI contractors then posted the intimate images on private Facebook groups and Discord servers. Additional leaked images included: a child's face in close-up and rooms showing personal belongings and living conditions. iRobot claimed the images came from "special development robots" given to employees and paid testers who signed consent forms. However, the consent forms did not mention that intimate images would be shared with overseas gig workers or posted on social media. The distinction between "development robots" and consumer robots is irrelevant to the woman whose toilet photo ended up on Discord.
Ecovacs Deebot X2: CHackers drove these around homes yelling racial slurs through the speaker. Camera accessible remotely.
The AI training disclosure (Schneier, 2024-10-04) reveals Ecovacs collects 2D/3D home maps, voice recordings, and photos/videos from device cameras for AI training. A 2020 Ecovacs engineering blog post admitted the company needed ground-level perspective images that robot vacuums capture — suggesting the program was designed specifically to harvest customer home data to solve their training data shortage
Ecovacs Deebot Platform: CYour robot vacuum took photos inside your home and sent them to China.
In 2023, ABC Australia reported that Ecovacs robot vacuums were capturing photos inside people's homes — including images of people, pets, and private spaces — and sending them to servers accessible by Ecovacs employees. Some images were used to train the company's AI models. Ecovacs' privacy policy at the time allowed users to "voluntarily" participate in a product improvement programme, but investigators found the opt-in was buried in setup and the data flow continued regardless. Photos from inside Australian homes were found on Ecovacs' training datasets, labelled by outsourced workers.
Roborock S8 MaxV Ultra: CCamera-equipped Beijing robot vacuum that maps your home in 3D and uploads it to Chinese servers.
The LidarPhone research (ACM SenSys 2020) demonstrated that Xiaomi Roborock vacuum LiDAR sensors can be repurposed for acoustic eavesdropping with 91%% digit classification accuracy. The S8 MaxV Ultra adds an RGB camera to the LiDAR, expanding surveillance potential from audio to video. Combined with hardcoded endpoints pointing to Chinese cloud infrastructure (api-cn.roborock.com) and Xiaomi cloud (awsusor0.fds.api.xiaomi.com), and China's Data Security Law requiring companies to cooperate with government data requests, the device creates a persistent surveillance capability inside homes with data flowing to servers subject to Chinese government access.
iRobot Roomba j7+: CRobot vacuum that photographed a woman on the toilet. Now owned by a Chinese company with your floor plans.
MIT Technology Review (Dec 2022) revealed that Roomba J7 development units captured intimate photos — including a woman on the toilet — and sent them to Scale AI for data labeling. Scale AI subcontractors in Venezuela shared images on Facebook and Discord. The j7 consumer units contain the same camera hardware as the development units.
Roborock Robot Vacuum Platform: CThe camera on your robot vacuum can identify your shoes, your pet, your cables, your socks.
The Roborock S8 MaxV and similar models include front-facing cameras for obstacle recognition. Roborock states camera images are processed on-device and not uploaded. However, the same researchers who exposed Ecovacs' photo uploads noted that verifying on-device processing claims is extremely difficult without a full firmware audit — and no such audit has been published for Roborock. The camera can recognise objects including shoes, cables, pet waste, and socks. A camera that can identify objects in your home has the technical capability to identify much more. The "processed on-device" claim is a policy choice, not a technical limitation, and can change with a firmware update.
V15 Detect: CDyson's robot vacuum camera captured a woman sitting on a toilet, and that image ended up with third-party contractors labeling training data.
In 2022, leaked images from Dyson's robot vacuum prototypes showed the onboard camera capturing a woman on a toilet — shared with data labeling contractors. Dyson confirmed the images were real but claimed they came from development units. Same sensor architecture planned for future products.
Roborock S7 MaxV: CCamera-equipped vacuum that maps your home in 3D. Data goes to Beijing Roborock servers.
Firmware analysis shows hardcoded endpoints including graph.facebook.com (Facebook Graph API), app-measurement.com (Google Analytics), and awsusor0.fds.api.xiaomi.com (Xiaomi cloud storage). The app includes Facebook Analytics, Facebook Login, and Facebook Share trackers with 5 total trackers embedded. While these may not transmit camera images directly, the presence of data pipelines to Facebook and Xiaomi contradicts the narrative that the device operates in a privacy-respecting manner with on-device-only processing.