Does your robot vacuum have a camera? What it maps, what it sends, and who can see it

Many robot vacuums draw a map of your home while they clean, and some also carry a camera, usually pointed at the floor in front of them to recognize obstacles such as cables and socks. Whether the map and the pictures stay on the robot or go to the maker’s servers depends on the model and on your settings, and makers describe it in different ways. The people who can see them are you and anyone you share the app with, the maker and the companies it works with as far as its privacy policy allows, and, when security fails, people who should not.

This page relies on makers’ own documents, published security research and EU authorities, and names makers only as the source of a statement. Robots guided by remote operators are covered in Home robots, cameras and remote operators.

Which robot vacuums have a camera, and why?

A robot vacuum needs some way to see the room. There are three common kinds of sensor, and many robots combine them:

A laser scanner. Lidar, often in a small turret on top, measures the distance to walls and furniture with a laser. It produces distances, not pictures.
A camera for navigation. Some robots look up at the ceiling and use what they see there to work out where they are.
A camera for obstacles. A camera at the front, with software that recognizes objects (computer vision), tells a cable from a sock or a pet’s mess so the robot can steer around it. Some models also stream live video to your phone.

What happens to the images is up to each maker. Three examples, in the makers’ own words:

Xiaomi. Its privacy page for the Mi Robot Vacuum says “all the image data collected from top or front cameras will not be saved locally or uploaded to the server. It will be discarded after processing on device.” The same page says the floor map is uploaded to the server, encrypted before it is sent, unless you turn on a “local mode” that keeps the map and cleaning records “on the device only”. The page carries no date (its copyright notice runs to 2022).
Ecovacs. In a blog post of 14 August 2023, Ecovacs says its Deebot robots encrypt “all data gathered by the device”, that the Video Manager feature for watching the home “can be password-protected” on certain models, and that videos and images are gathered for research and development only with the customer’s agreement, for example by joining its product improvement plan.
iRobot. Its article on camera-equipped Roombas says an optional feature, Obstacle Image Review, photographs obstacles for you to check in the app, and that turning it off still leaves the robot “able to avoid obstacles with its detection capabilities”.

These are the makers’ statements; the site has not checked them on any robot.

What is in the map, and where is it stored?

A mapping robot uses SLAM (simultaneous localization and mapping): it draws the floor plan and works out where it stands on it at the same time. The map shows the layout and size of your home; once you name the rooms (“bedroom”, “baby’s room”) and draw no-go zones, it also shows how you use them, and the cleaning history shows when the robot runs, which can hint at when nobody is in.

The map can sit in two places: on the robot, and on the maker’s servers so that the app can show it while you are away. Both can hold more than the map. In their slides for DEF CON 32, in August 2024, researchers Dennis Giese and Braelynn Luedtke list the data they saw Ecovacs robots send, including “live coordinates of robot location in home” and nearby Wi-Fi networks, and write that maps “seem to remain on servers” after a factory reset or account deletion. How long a maker keeps each kind of data, its data retention, should be in its privacy notice.

Who can see it?

Four groups, depending on the model and the maker’s policy:

You and the people you share the robot with. If the app lets you share the robot with family members, they see what you see. The DEF CON slides warn that devices “can be weaponized for stalking” and advise removing shared access and changing passwords when someone leaves the home.
The maker and the companies it hires. The maker processes data under its privacy policy, and it may store it with cloud providers. The same slides, for example, found Ecovacs robots using Amazon’s cloud for remote camera access outside China and Alibaba’s inside China.
People who label training images. When a maker uses pictures to improve its obstacle recognition and you agree to share them, as in iRobot’s image database or Ecovacs’s product improvement plan, those pictures may be looked at by people. The 2022 case of Roomba test images that leaked from contract labelers is told, with iRobot’s answer, in the guide on home robot privacy.
Outsiders, when security fails. The next section describes two documented cases.

What has gone wrong?

Two documented cases, each about one maker. They show what happened, not what every robot does.

DJI Romo, February 2026. The Verge reported on 14 February 2026 that Sammy Azdoufal, a DJI Romo owner, was building an app to steer his own robot with a PS5 gamepad when he found that DJI’s servers answered him for roughly 7,000 robot vacuums around the world. He says he used only his own robot’s private token, the key that tells the servers who owns it. He told the publication that he could control the robots and look and listen through their cameras, and in a demonstration watched by a Verge editor his laptop listed 6,700 DJI devices in 24 countries in nine minutes. Both he and The Verge reported the flaw to DJI. In a statement to The Verge, DJI said it had found the vulnerability “through internal review in late January”, that the first patch “had not been applied universally across all service nodes”, and that automatic updates on 8 and 10 February fixed it. In a post of 6 March 2026, DJI described “a backend validation issue involving the DJI Home app that affected our new ROMO product and some DJI power stations”, said two independent researchers had reported the same flaw through its bug bounty program, and wrote that it “did not identify evidence that user data was misused”. The post says ROMO is certified to the ETSI EN 303 645 consumer IoT security standard, among others, and will undergo further independent audits.

Ecovacs, DEF CON 32, August 2024. The same DEF CON slides describe a flaw in the Bluetooth setup channel of some Ecovacs robots that let an attacker run code on them, and a warning sound for camera access that an attacker with access to the robot could silence. The researchers add that they do not claim that any vendor misuses the sensors. Ecovacs’s reply, its later security advisory and the fixes it pushed are in the home robot privacy guide.

Both makers cited security certifications. A certificate shows that a product met a standard when it was checked; the researchers’ slides note that, in the Ecovacs case, certifications “did not help to prevent” the problems they found.

What you can check or change

If your model offers it, these settings are usually in the app, under privacy or the robot’s settings:

No-go zones for rooms you would rather the robot never enters or photographs.
The camera. Whether obstacle photos, image review or live video can be switched off, and whether live video asks for a PIN or password.
Sharing images for training. Whether it is off by default, and how to turn it off.
Local mode. Whether the map can stay on the robot, and which features still work without the internet.
Deleting the map, and asking the maker whether the copy on its servers is deleted too.
The account. A password used nowhere else and two-step verification, so a leaked password from another site does not open your robot’s app. Remove people who no longer live with you.
Updates. Keep automatic updates on, and check how long the maker promises security fixes, its security support period.
Before selling or giving the robot away, remove it from your account, delete the map and reset it; the DEF CON slides warn that “even a factory-reset leaves data behind”.

What do EU rules say?

The GDPR, the EU data protection law, applies to the maker when it handles data about you. The European Commission’s page on your data protection rights lists what a company must tell you, among other things who it is, why it processes your data and how long it keeps it, plus your right to see that data and to have it erased. The same page says you can ask for deletion when the data is no longer needed or “has been used unlawfully”, with exceptions such as a legal obligation to keep it. A request to delete your map and images goes to the contact in the maker’s privacy notice.

Italy’s data protection authority, the Garante, has written about home cameras, not robots. Its videosurveillance FAQ (question 12) says smart cameras used at home only for personal control and security fall outside the GDPR, but a babysitter or housekeeper working there must be told, places such as bathrooms must not be filmed, connected cameras need adequate security, and what they record must not be spread around or made public. Whether a robot vacuum’s camera is treated the same way depends on the case: ask a lawyer.

The Cyber Resilience Act sets security rules for connected products sold in the EU, including handling vulnerabilities and providing updates over the product’s life. According to the European Commission, its reporting obligations apply from 11 September 2026 and its main obligations from 11 December 2027, so robots on sale today may not yet be built to it.

Where to go next

Robots at home: the complete guide covers every robot you can have at home today, from vacuums and lawn mowers to the humanoids still on pre-order.
Which robot vacuum is best?: what independent testers found in 2026, by price and by job.
How to choose a robot vacuum and mop: navigation, cameras, stations, running costs and updates.
Home robots, cameras and remote operators: who sees inside your home?: remote operators, the Roomba images and the full Ecovacs story.
SLAM: how a robot draws a map and finds itself on it.
Robot vacuum: sensors, apps, Matter and how to keep one secure.

Common questions

Do robot vacuums have cameras?

Some do, others do not. Robots that find their way with a spinning laser and their bumpers take no pictures. Others carry a camera at the front to recognize obstacles on the floor, a camera that looks at the ceiling to help them navigate, or both, and a few let you watch a live video of your home from your phone. The product page and the manual say which sensors a model has.

Do robot vacuums spy on you?

The cases documented on this page are security flaws and leaked images, not robots built to watch their owners, and the researchers who presented flaws in Ecovacs robots in 2024 wrote that they do not claim any maker uses the sensors that way. What a robot collects is a map of your home and, on models with a camera, pictures of the floor. Where that goes depends on the model and your settings, and security flaws have at times let outsiders reach it, as in the DJI Romo case of February 2026.

Do robot vacuums need Wi-Fi?

It depends on the model. The app, and with it the map, rooms, no-go zones, schedules set from the phone and software updates, usually works through your home Wi-Fi and the maker's servers, so the manual is the place to check what the robot can still do without it, for example when started from a button. Some makers describe a local mode in which the map stays on the robot, as Xiaomi does for its robot vacuums.

Can a robot vacuum be hacked?

Yes, flaws have been documented. In February 2026 a DJI Romo owner found that DJI's servers let him reach thousands of other Romo robots, and DJI fixed the issue with updates on 8 and 10 February. At DEF CON in 2024, researchers showed a flaw in the Bluetooth setup of some Ecovacs robots. Keeping the robot updated and protecting the account with a unique password reduce the risk.

Can I delete the map my robot vacuum made of my home?

Look in the app for an option to delete saved maps, and ask the maker whether the copy on its servers is deleted too. In the EU you can ask a company to erase personal data it no longer needs, under the GDPR.

Topics: robotics, robot vacuum, privacy, everyday questions