← Robot Vacuums
D

V15 Detect

Serious concerns
Dyson · 🇬🇧 United Kingdom · WiFi
PolicyApp PermissionsNetwork TrafficFirmwareRegulatory
Technical details
Manufacturer: Dyson

⚠️ The bottom line

Dyson's robot vacuum camera captured a woman sitting on a toilet, and that image ended up with third-party contractors labeling training data. Dyson's defense: "development units" — as if the camera becomes more respectful of privacy once it ships to consumers. The same camera hardware, the same AI pipeline, the same company. Development or production, someone's bathroom ended up in a stranger's dataset. Dyson says it needs your data to make the vacuum work better. But your vacuum already knows how to suck. What Dyson is actually building is a minute-by-minute map of your domestic life — which rooms you clean, how often, what's on your floors, and when you're home. That's not product improvement. That's lifestyle surveillance sold as customer service.

Legal jurisdiction
🇬🇧 United Kingdom (headquarters)
Investigatory Powers Act read more →
Govt can bulk-intercept internet traffic and force companies to remove encryption
Online Safety Act read more →
Ofcom can require scanning of private messages for illegal content
Spying
2/4 MODERATE
Is someone spying on me?
Data Sharing
3/4 HIGH
Who gets my data?
Security
3/4 HIGH
Is it actually secure?
Honesty
1/4 LOW
Can I trust what they say?
CONFIGURE High-risk areas that can be partially mitigated with settings changes.
4Contradictions
1Critical
2High
1Medium
2Sources
Findings by concern
Spying 2/4 MODERATE 1 finding
⚡ highpolicy claims vs app permissions
Dyson says it needs your data to make the vacuum work better. But your vacuum already knows how to suck. What Dyson is actually building is a minute-by-minute map of your domestic life — which rooms you clean, how often, what's on your floors, and when you're home. That's not product improvement. That's lifestyle surveillance sold as customer service.

What they claim: Dyson says the MyDyson app collects data to improve your machine's performance.

What we found: The app collects dust particle counts, floor type, suction mode, cleaning duration, frequency, and room-by-room patterns — building a detailed profile of home layout, cleanliness habits, and daily routine.

Data Sharing 3/4 HIGH 1 finding
⚫ mediumpolicy claims vs app permissions
Your vacuum cleaner now knows you clean the kitchen every night at 7pm, skip the guest bedroom on weekdays, and deep-clean on Saturdays. It knows which rooms have carpet and which have hardwood. It knows when the house is empty. A burglar would love this data. An insurance company would pay for it. A divorce lawyer could subpoena it. None of this makes your floors cleaner.

What they claim: Dyson says it collects data to provide and improve its products.

What we found: The app requests Bluetooth, WiFi, location, and camera permissions. Cleaning patterns reveal occupancy, household size, and daily routines. This behavioral data has commercial value for insurance, real estate, and advertising.

Security 3/4 HIGH 1 finding
⚠️ criticalpolicy claims vs firmware analysis
Dyson's robot vacuum camera captured a woman sitting on a toilet, and that image ended up with third-party contractors labeling training data. Dyson's defense: "development units" — as if the camera becomes more respectful of privacy once it ships to consumers. The same camera hardware, the same AI pipeline, the same company. Development or production, someone's bathroom ended up in a stranger's dataset.

What they claim: Dyson states it uses data responsibly and protects user privacy.

What we found: In 2022, leaked images from Dyson's robot vacuum prototypes showed the onboard camera capturing a woman on a toilet — shared with data labeling contractors. Dyson confirmed the images were real but claimed they came from development units. Same sensor architecture planned for future products.

Honesty 1/4 LOW 1 finding
⚡ highpolicy claims vs regulatory findings
James Dyson spent years campaigning for Brexit, telling the British public they needed sovereignty from EU regulation. Then he moved Dyson's headquarters to Singapore, where data protection fines max out at about $740,000 — what Dyson makes in roughly 45 minutes. He wanted Britain free from EU rules, then freed himself from British ones. Your vacuum's data now lives under the legal regime he chose, not the one he sold you.

What they claim: Dyson positions itself as a premium British technology company with strong privacy values.

What we found: Dyson moved its headquarters from the UK to Singapore in 2019, a jurisdiction with weaker data protection. James Dyson was a prominent Brexit campaigner who argued for British sovereignty, then relocated to avoid EU regulation. Singapore PDPA max penalties: S$1 million — about 45 minutes of Dyson revenue.

Sources