Privacy & security · beginner

Are home robots controlled by humans, and who sees inside your home?

When a person at the maker guides a home robot, what its cameras, microphones and maps send, what went wrong with robot vacuums and which EU rules apply.

In a dark office at night, an operator wearing a VR headset holds two controllers; on his monitor, seen through the robot's camera, a woman sits on her sofa looking warily at the robot hands reaching towards her

AI-generated image: Internet of Things News / Google Gemini

After reading this article you will be able to:

  • Explain what a home robot's cameras, microphones and maps collect, and what makers say leaves the home
  • Describe how remote operator sessions work on the 1X NEO, using only what 1X publishes
  • Check the settings and EU rules that matter before a robot with cameras moves into your home
By IoT News Editorial Published October 23, 2026 Updated October 23, 2026 Sources checked October 23, 2026 7 min read
On this page
  1. What does a home robot sense and send?
  2. Why do makers use remote operators?
  3. What has gone wrong before?
  4. What can you check or change?
  5. What do EU rules say?
  6. Where to go next

Some are, in certain situations. A few home robots are designed so that a person working for the maker can guide them from a distance when they meet a task they cannot do alone. 1X, which takes orders for its NEO humanoid with US deliveries due to start in 2026, says on its order page that “an Expert from 1X can remotely supervise its actions at scheduled times” (checked on 23 October 2026). Who can see inside your home through a robot depends on the sensors it carries, how you set it up and what the maker’s data policy allows.

This guide relies on makers’ own documents, published security research and the text of the law, and names makers only as the source of a statement.

What does a home robot sense and send?

Many robot vacuums build a floor plan while they clean, using SLAM (simultaneous localization and mapping) with a lidar sensor, cameras or both. Humanoids carry more: 1X lists two stereo fisheye cameras and “4 beamforming microphones” for NEO, which connects over 5G or home Wi-Fi.

Where a home robot's data goes, and where you can step in Four stages from left to right. In your home: the robot's sensors (cameras, microphones, lidar), then the robot itself (a floor map built with SLAM; on some camera models, photos of obstacles). Outside your home: the maker's cloud (the saved floor map, images shared to improve the product, data retention rules) and the remote operator (as 1X describes it for NEO, a session booked and accepted by the owner, with a visible signal on the robot while it runs). During a session the operator sees through the robot's sensors and guides it. Where you can step in: switch the camera or microphone off; mark no-go rooms and delete the map, including the server copy; opt in or out of the use of your data for training; accept or refuse each session. Before selling, remove the robot from your account and reset it, keeping in mind that a reset can leave data behind. During a session the operator sees through the robot's sensors and guides it IN YOUR HOME OUTSIDE YOUR HOME Sensors Cameras Microphones Lidar On the robot Floor map built with SLAM Obstacle photos (on some models) Maker's cloud Saved floor map Images shared to improve the product Data retention rules Remote operator As 1X describes NEO: session booked and accepted by the owner; visible signal on the robot while it runs WHERE YOU CAN STEP IN Switch the camera or microphone off Mark no-go rooms; delete the map, server copy too Use for training: opt in or opt out Accept or refuse each session Before selling: remove the robot from your account and reset it (a reset can leave data behind)
Where a home robot’s data can go: sensors and processing in your home, the maker’s cloud and a remote operator outside it, with the settings where you can step in at each stage. What actually leaves the home differs from maker to maker.

What stays on the robot and what leaves it is something only the maker can answer, and answers differ:

  • 1X’s FAQ on the same page says that in autonomous mode “limited sensor data may be sent to our servers to fulfill a request; it isn’t stored”, and that data from real-world tasks improves NEO unless the owner opts out. 1X says it does not use this data to build a profile of the owner or sell it.
  • iRobot’s support article on camera-equipped Roombas describes Obstacle Image Review, an optional feature that photographs obstacles and their surroundings for review in the app. iRobot says it cannot view those images unless the owner contributes them, and deletes the others from its servers after 30 days.

The floor plan deserves the same attention as the camera: it shows how your home is laid out and when the robot runs, and it may sit on the maker’s servers under its own data retention rules. Check which document speaks for the robot: 1X’s privacy policy, updated on 27 October 2025, covers the website, orders and communications, while its robot data statements are in the FAQ.

Why do makers use remote operators?

Teleoperation means a person drives a robot from somewhere else, seeing through its sensors. It gets done a job the software cannot yet handle, and each session becomes a demonstration that can teach the robot the task. 1X puts both in one phrase: the Expert guides NEO, “helping NEO learn while getting the job done”. What is embodied AI? explains how demonstrations train robot models.

This is what 1X’s FAQ says about Experts, as of 23 October 2026:

  • NEO “works autonomously by default”; for chores it does not know, the owner can schedule an Expert.
  • An Expert cannot connect at any time: “owners have to actively schedule a time for an Expert to support with their chores and accept them into their robot using voice or mobile.” NEO’s “emotive ear rings” change color while an Expert is active, and 1X says owners “have full control over each session”.
  • Experts are “1X employees physically present in the USA.”
  • Separately, the owner can “pilot” NEO remotely through the mobile app and a VR device.

The FAQ does not say what an Expert sees or hears, whether sessions are recorded or for how long, whether people or rooms can be hidden from view, or how the training opt-out applies to session data. Ask 1X in writing before paying a deposit.

What has gone wrong before?

The documented cases come from robot vacuums. They show what can happen to such data, not what every robot does.

In December 2022 MIT Technology Review reported that images taken in 2020 by Roomba J7-series robots, one of them showing a woman on the toilet, had been posted in closed social media groups by contract workers in Venezuela who labeled them for Scale AI. iRobot said the images came from “special development robots with hardware and software modifications” never sold to consumers, used by paid collectors and employees who had agreed to send their data to iRobot, and that it was ending its relationship with the provider that leaked them. iRobot has since changed owner: on 23 January 2026 it announced the completion of a court-supervised transaction that ended its Chapter 11 process and left it “a privately held company wholly owned by Picea”, which the release describes as “a global manufacturer and service provider of robotic vacuum cleaners”. Roomba owners’ data is therefore held today by a company with different owners from those of 2022; the same release says a separate US-based subsidiary, iRobot Safe, is responsible for protecting US consumer data. Images collected to train a model can pass through human labelers at other companies.

In August 2024, at DEF CON 32, researchers Dennis Giese and Braelynn Luedtke presented findings on Ecovacs robots. Their slides describe a flaw in the Bluetooth setup channel of some models that let an attacker run code on the robot, a camera-access warning sound that an attacker with access to the robot could silence, and maps that appeared to stay on the maker’s servers after a factory reset or account deletion. The slides also say the researchers make no claim that any vendor misuses the sensors. Ecovacs told TechCrunch on 22 August 2024 that it had “initiated targeted improvements”. In May 2025 Ecovacs published a security advisory, also published by the US agency CISA, on three further flaws in the link between some Deebot robots and their base stations, credited to the same researchers and Chris Anderson, and pushed fixed firmware to users.

What can you check or change?

Not every robot offers all of these. Look in the app, the manual and the privacy notice for:

  • Remote sessions: whether anyone at the maker can connect, who starts a session, whether you accept each one, and whether the robot signals it visibly.
  • Cameras and microphones: whether you can switch them off, whether live view needs a PIN, and whether remote video uses end-to-end encryption or can be read on the maker’s servers.
  • The map: whether you can mark rooms the robot must not enter, and delete the map, including the copy on the server.
  • Training data: whether sharing images or recordings is opt-in or opt-out.
  • Local processing: which features work offline.
  • Updates: how long the maker promises security fixes, the security support period.
  • Selling it: remove the robot from your account and reset it, keeping in mind that the DEF CON slides found a reset can leave data behind.

What do EU rules say?

The GDPR does not apply to a person processing data “in the course of a purely personal or household activity” (Article 2(2)(c)), but Recital 18 says it still applies to the companies that provide the means for it. Your household exemption does not cover the maker.

Italy’s data protection authority, the Garante, has written about home cameras rather than robots. Its videosurveillance FAQ (question 12) says cameras at home used only for personal monitoring and security fall outside the GDPR, but employees such as a babysitter or housekeeper must be told, places like bathrooms should not be monitored, internet-connected cameras need adequate security and the footage must not be made public. Whether a robot with cameras is treated the same way depends on the case: ask a lawyer.

The Cyber Resilience Act, Regulation (EU) 2024/2847, sets security requirements for connected products sold in the EU. Annex I asks makers to process only the data a product needs, protect it with means such as encryption, deliver security updates and let users “remove on a permanent basis all data and settings”; Article 13 sets a support period of at least five years unless the product is expected to be used for less. Reporting obligations apply from 11 September 2026 and the product requirements from 11 December 2027, so robots sold before then may not be built to it. IoT security regulation has the details.

Where to go next

Corrections and updates
  • October 23, 2026: added iRobot's January 2026 change of owner to Picea after Chapter 11, with the primary source

How corrections are handled: editorial policy.

Topics: robotics, privacy, teleoperation, robot vacuums, home robots

Diagram