Arlo says it does not use your data without consent. But lawsuits allege Arlo's cameras scan your face without proper permission, and that a third-party company secretly records your conversations when you chat with Arlo's customer support. Arlo promises it does not capture your data for advertising, but the Arlo app contains Google AdMob (an advertising toolkit) and requests permissions specifically designed for tracking you across apps to serve targeted ads.
What they claim: Arlo's Privacy Pledge states: "Arlo does not view or keep user data without consent."
What we found: A class action lawsuit (proceeding to trial) alleges Arlo's "person detection" AI feature scans and analyzes facial features — collecting biometric data — without proper consent under state biometric privacy laws. Separately, a California invasion of privacy lawsuit alleges Arlo allowed third-party company ADA to secretly intercept and store transcripts of customer chat conversations on arlo.com without any disclosure to users.
What they claim: Arlo is a security camera system. Its privacy pledge focuses on protecting camera data and user privacy.
What we found: The Arlo Secure app requests READ_CONTACTS (access to the user's entire contact list), GET_ACCOUNTS (access to accounts on the device), READ_PHONE_STATE (access to phone number, IMEI, carrier info), and USE_SIP (Session Initiation Protocol for VoIP). Arlo previously acknowledged that contact list access was added to satisfy Baidu SDK requirements for the Chinese market — meaning data collection infrastructure for the Chinese market is embedded in the app used by all global users.
What they claim: The Arlo Pro camera is a 720p battery-powered security camera with basic motion detection and night vision.
What we found: The companion app requests 48 permissions including: HIGH_SAMPLING_RATE_SENSORS (high-frequency accelerometer/gyroscope data from your phone), ACCESS_BACKGROUND_LOCATION (continuous GPS tracking even when app is closed), FOREGROUND_SERVICE_MEDIA_PROJECTION (screen recording capability), DETECT_SCREEN_CAPTURE (monitoring when screenshots are taken), and FOREGROUND_SERVICE_PHONE_CALL (phone call functionality). A simple security camera viewing app does not need to track your phone's physical movements, record your screen, or make phone calls.
What they claim: Arlo Privacy Pledge states: "Arlo does not capture user data for advertising or sell it to third parties."
What we found: The Arlo Secure app (v6.6.9) embeds Google AdMob — a dedicated advertising SDK that serves targeted ads and collects device identifiers for ad profiling. The app also requests ACCESS_ADSERVICES_AD_ID, ACCESS_ADSERVICES_ATTRIBUTION, and ACCESS_ADSERVICES_TOPICS permissions, which are specifically designed for advertising attribution and interest-based ad targeting. Additionally, Swrve (a location-based profiling and analytics tracker) is embedded in the app.
What they claim: Arlo Privacy Pledge states: "Arlo does not sell personal information" and "does not capture user data for advertising."
What we found: Arlo's own website (arlo.com) embeds Facebook Pixel (tracking ID 407024413306334), Google Ads conversion tracking, TikTok analytics, and Klaviyo marketing trackers. The website's consent management code references "sale_of_data" as a consent category. Arlo's privacy notice acknowledges sharing "identifiers and browsing activity with advertisers and analytics providers through cookies" — which under California, Colorado, Connecticut, and Virginia privacy laws constitutes "sharing" or "selling" of personal information.
What they claim: Arlo Privacy Pledge states: "Arlo does not volunteer user data to law enforcement."
What we found: Mozilla's Privacy Not Included review confirmed that Arlo will not notify users when disclosing footage to law enforcement due to legal requests. Arlo's law enforcement guidelines require a "legally enforceable search warrant" but the company will comply silently — users are never told their camera footage has been shared with police. This mirrors the approach Ring was criticized for, but at least Ring eventually committed to transparency reports.
What they claim: Arlo's privacy pledge positions the company as privacy-first, distinct from competitors like Amazon Ring.
What we found: The Arlo Secure app contains 6 trackers: Amplitude (behavioral profiling analytics), Google AdMob (advertising), Google CrashLytics (crash reporting), Google Firebase Analytics (usage analytics), OpenTelemetry (distributed tracing), and Swrve (location-based profiling and push notification targeting). By comparison, the Ring app contains only 2 trackers (Bugsnag and Firebase Analytics). Arlo — which markets itself as the privacy-conscious alternative to Ring — actually has 3x more trackers, including a dedicated advertising SDK that Ring lacks.
What they claim: Arlo is a cloud-dependent security camera — free tier offers 7-day cloud storage, paid Arlo Secure subscription required for full features.
What we found: The camera requires an internet connection to function (confirmed by Mozilla — no offline capability). Yet the app requests ACCESS_BACKGROUND_LOCATION for continuous location tracking even when the app is not in use. For a stationary security camera system, there is no legitimate reason to continuously track the user's GPS location in the background. This suggests the location data serves advertising or profiling purposes rather than camera functionality.
What they claim: Arlo markets itself as a secure home security system with a "Privacy Pledge" and meets Mozilla's minimum security standards (encryption, 2FA, bug bounty).
What we found: Tenable Research (TRA-2019-30) found the Arlo base station — the device ALL camera video passes through — had hardcoded default credentials (ngroot/ngbase) accessible via UART serial port (CVE-2019-3949, CVSSv2 8.3). The vzdaemon HTTP listener exposed a passthru endpoint allowing unauthorized file uploads/downloads from the LAN with root privileges (CVE-2019-3950, CVSSv2 7.2). The fwupgrade utility contained hardcoded RSA private keys making firmware decryption trivial. These are fundamental security failures in the device marketed to protect your home.
What they claim: Arlo cameras connect through a base station that bridges the camera network to the home LAN.
What we found: CVE-2019-3950 revealed the base station's vzdaemon HTTP listener had a passthru endpoint accessible from the LAN that allowed unauthorized file upload/download with root privileges. This means any device on the home network (a compromised smart TV, IoT device, or malware on a computer) could potentially access the camera network and exfiltrate video footage. The Tenable advisory noted the base station runs these services as root. Arlo's security advisory page does not list these CVEs or provide clear remediation guidance to affected customers.