Arlo says they need "valid legal process" to share your footage. That sounds like a warrant. It isn't. A subpoena works fine — no judge needs to approve it. Every clip your camera uploads to Arlo's cloud is one subpoena away from law enforcement. If you pay for 24/7 recording, congratulations: you're maintaining a police-accessible surveillance archive of your own property at your own expense. Hackers accessed Arlo cameras and started talking to people through their own security cameras. They panned cameras around, played audio, and watched live feeds. The attack vector was simple: try passwords from other breaches (credential stuffing). Arlo didn't require two-factor authentication, so a reused password gave a stranger full access to watch, listen, and speak through your home cameras. "Bank-level security" that any script kiddie with a password list could bypass.
What they claim: Arlo's privacy policy states user data is protected and only shared with law enforcement "in response to valid legal process" with references to warrants and court orders.
What we found: Arlo's transparency reports show the company complies with law enforcement data requests including subpoenas, which do not require a judge's approval (unlike warrants). Like other cloud camera companies, stored footage on Arlo's servers is accessible via subpoena under the Stored Communications Act with minimal judicial oversight. Users with always-recording subscriptions effectively maintain a police-accessible video diary of their home exterior.
What they claim: Arlo promises "bank-level security" for user accounts and emphasizes its commitment to protecting the privacy and security of customers' video footage.
What we found: In 2023, Arlo users reported unauthorized access to their cameras through credential stuffing attacks. Affected users saw their cameras moved, heard audio played through speakers, and found their cameras' views had been changed. Arlo lacked mandatory two-factor authentication, allowing compromised credentials from other breaches to grant full camera access including live viewing, audio communication, and camera repositioning.
What they claim: Arlo's privacy policy states user data is protected and only shared with law enforcement "in response to valid legal process" with references to warrants and court orders.
What we found: Arlo's transparency reports show the company complies with law enforcement data requests including subpoenas, which do not require a judge's approval (unlike warrants). Like other cloud camera companies, stored footage on Arlo's servers is accessible via subpoena under the Stored Communications Act with minimal judicial oversight. Users with always-recording subscriptions effectively maintain a police-accessible video diary of their home exterior.
What they claim: Arlo promises "bank-level security" for user accounts and emphasizes its commitment to protecting the privacy and security of customers' video footage.
What we found: In 2023, Arlo users reported unauthorized access to their cameras through credential stuffing attacks. Affected users saw their cameras moved, heard audio played through speakers, and found their cameras' views had been changed. Arlo lacked mandatory two-factor authentication, allowing compromised credentials from other breaches to grant full camera access including live viewing, audio communication, and camera repositioning.
What they claim: Arlo sells cameras as long-term security investments with marketing emphasizing durability, weather-resistance, and reliability. No prominent disclosure at purchase that cameras will be remotely disabled.
What we found: In 2023, Arlo announced end-of-life for several camera models including the original Arlo and Arlo Pro, shutting down cloud services and effectively bricking cameras that users had purchased and relied on. The cameras became unable to record, stream, or alert — converted from functional security hardware to plastic shells. Users who paid hundreds of dollars were told to buy new cameras.
What they claim: Arlo prominently advertises "end-to-end encryption" for video streams, positioning this as a key differentiator from competitors and implying even Arlo cannot access footage.
What we found: Arlo's "end-to-end encryption" is an opt-in feature (not default) that disables most smart features when enabled — no person detection, no activity zones, no cloud AI processing. This means the vast majority of users never enable it because it defeats the purpose of the subscription they're paying for. Arlo's standard mode sends unencrypted video to their cloud servers for AI processing, meaning Arlo and any breach of their systems exposes all footage.
What they claim: Arlo sells cameras as long-term security investments with marketing emphasizing durability, weather-resistance, and reliability. No prominent disclosure at purchase that cameras will be remotely disabled.
What we found: In 2023, Arlo announced end-of-life for several camera models including the original Arlo and Arlo Pro, shutting down cloud services and effectively bricking cameras that users had purchased and relied on. The cameras became unable to record, stream, or alert — converted from functional security hardware to plastic shells. Users who paid hundreds of dollars were told to buy new cameras.
What they claim: Arlo prominently advertises "end-to-end encryption" for video streams, positioning this as a key differentiator from competitors and implying even Arlo cannot access footage.
What we found: Arlo's "end-to-end encryption" is an opt-in feature (not default) that disables most smart features when enabled — no person detection, no activity zones, no cloud AI processing. This means the vast majority of users never enable it because it defeats the purpose of the subscription they're paying for. Arlo's standard mode sends unencrypted video to their cloud servers for AI processing, meaning Arlo and any breach of their systems exposes all footage.
What they claim: Arlo positions itself as a premium security brand focused on protecting homes and families, with marketing centered on safety, peace of mind, and reliability.
What we found: Arlo's app uses persistent notifications and increasingly urgent language to pressure free-tier users into subscribing. After eliminating the free cloud tier, Arlo's notifications warn users their cameras are "not protected" and create urgency about "missing events." The app treats the un-subscribed state as an error condition rather than a valid choice, using dark patterns to convert users into recurring revenue.
What they claim: Arlo positions itself as a premium security brand focused on protecting homes and families, with marketing centered on safety, peace of mind, and reliability.
What we found: Arlo's app uses persistent notifications and increasingly urgent language to pressure free-tier users into subscribing. After eliminating the free cloud tier, Arlo's notifications warn users their cameras are "not protected" and create urgency about "missing events." The app treats the un-subscribed state as an error condition rather than a valid choice, using dark patterns to convert users into recurring revenue.
What they claim: Arlo markets cameras as standalone security products at premium price points ($129-499), implying full functionality at purchase. Product pages emphasize features like person detection, package detection, and cloud storage.
What we found: Without an Arlo Secure subscription ($7.99-17.99/month), cameras lose virtually all useful features: no cloud recording, no smart notifications (person/package/vehicle detection), no activity zones, 7-day library reduced from 30 days. In 2023 Arlo eliminated the free 7-day cloud tier for new cameras entirely, making purchased hardware dependent on perpetual subscription for basic recording functionality.
What they claim: Arlo markets cameras as standalone security products at premium price points ($129-499), implying full functionality at purchase. Product pages emphasize features like person detection, package detection, and cloud storage.
What we found: Without an Arlo Secure subscription ($7.99-17.99/month), cameras lose virtually all useful features: no cloud recording, no smart notifications (person/package/vehicle detection), no activity zones, 7-day library reduced from 30 days. In 2023 Arlo eliminated the free 7-day cloud tier for new cameras entirely, making purchased hardware dependent on perpetual subscription for basic recording functionality.