Most of us already have phones, computers and perhaps a few smart speakers collecting information about our lives. I’ve more or less accepted that, although I’m not particularly happy about it.
But a humanoid robot feels different.
It could follow me around the house, see what’s on the table, hear private conversations and potentially recognise everyone who visits. It might even need some of that information to do its job properly.
Would I feel comfortable having one in the bedroom? What about when friends come over? And would I have to warn them that a robot might be recording?
Then there’s the question of who can access all this information. If a company can remotely operate the robot, what exactly can its employees see?
I quite like the idea of a robot doing my housework. I’m just not sure I want to give it a front-row seat to my entire life.
What we found: home robots fall on a spectrum. At one end, a few machines process camera data on the robot and keep it there. At the other, 1X’s NEO humanoid is built around the idea that a human employee may, with the owner’s approval, look through its cameras and steer it, with that footage used to train its AI. In between are robots with useful off switches and no-go zones but cloud features that send video off-site. Real-world incidents, from leaked development images to hijacked robot vacuums, show the risk is not theoretical.
Remote operators: what NEO’s “Expert” sessions mean for your living room
1X Technologies opened pre-orders for NEO in October 2025 at $20,000, or $499 a month, with first US deliveries promised for 2026 and other markets from 2027, according to its launch announcement. At the time of writing we found no independent report of completed customer deliveries.
The privacy question is teleoperation. When NEO meets a task it cannot do, owners can schedule a “1X Expert”, a remote human operator, to guide it, and 1X says this also helps NEO learn. When the Wall Street Journal’s Joanna Stern tested it in October 2025, most tasks were teleoperated by a person wearing a virtual reality headset.
1X’s chief executive, Bernt Børnich, told Engadget that owners must agree to let operators see inside their home, and that “if we don’t have your data, we can’t make the product better.” He described three safeguards: operators cannot take control without the owner’s approval, sessions are scheduled through an app, and 1X can blur people from the operator’s view, with owners able to mark no-go zones. 1X’s FAQ, quoted by TechRadar, says the company does not build profiles of users or sell the data, and that owners can opt out of helping improve NEO.
What we could not find is just as important: a published retention period for video captured during Expert sessions, details of who at 1X can view stored footage, or how deletion requests work for data already used to train a model. As the technology lawyer Kathleen McGee told TechRadar, once an AI model is trained on sensitive data, it is virtually impossible to fully unwind. Our 1X NEO review covers what the robot can do on its own.
How home robots compare on privacy
| Robot | Cameras and microphones | Physical privacy control | Remote human access | Where data is processed | Deletion controls published |
|---|---|---|---|---|---|
| 1X NEO | Yes (sensor details not published) | Not specified in launch materials | Yes, owner-approved Expert sessions | Cloud, used for AI training (opt-out offered) | Not found |
| Amazon Astro | Cameras, microphones, depth sensors | Button cuts power to mics, cameras and sensors | Owner live view; no remote operator service found | Navigation and face ID on device; maps and some video to cloud | Yes: voice, map, face ID, photos |
| Matic vacuum | Five cameras | Not specified | Optional encrypted remote access; debug access only with consent | On device; raw camera data discarded | Self-reported, not audited |
| Loona (KEYi) | 720p camera, four microphones, 3D sensor | Not specified | Not stated | “As much as possible” on device; GPT features | Not found on product page |
| Unitree G1 | Cameras, microphones, LiDAR | Not specified | Not stated | Researchers found telemetry to servers in China | Not found |
| Casio Moflin | One microphone, no camera | n/a | No | Not stated | Not found |
Amazon Astro: the most detailed controls
Amazon’s Astro privacy page is the most complete we found. A “Microphones/Cameras Off” button cuts power to the microphones, cameras and navigation and depth sensors, with a red light to show it, and Astro then cannot move or record. Owners can set out-of-bounds zones, close doors to rooms during setup and put it in Do Not Disturb. Navigation data and the facial templates used for visual ID are processed and stored on the robot, and visual ID is deleted automatically if a face is not seen for 18 months. Video does leave the home for live view, video calls and Ring patrol clips, which are stored under the owner’s Ring plan.
Matic: privacy by keeping it local
Matic, a US robot vacuum maker, says its intelligence runs entirely on the robot: five cameras feed an onboard computer, raw camera data is discarded immediately, and the 3D map stays on the device, according to Matic’s own explanation. Remote access is optional and end-to-end encrypted, and the company says it only asks for temporary debug data with consent. These are company claims with no independent audit cited, but the design shows what is possible.
Loona and the talking companions
KEYi’s Loona product page lists a 720p camera, four microphones and a 3D time-of-flight sensor, says the robot recognises family members, and describes its conversation as GPT-powered. Its only privacy statement there is that “as much data processing as possible is done by Loona directly”. It does not say which data leaves the robot for its AI features. Casio’s Moflin, by contrast, has a single microphone and no camera, which is the simplest privacy safeguard of all. We compare both in our AI companion robots guide.
When robot privacy goes wrong
Leaked development images. In 2022 MIT Technology Review obtained 15 images taken by development versions of iRobot’s Roomba J7, including one of a woman on the toilet, which gig workers labelling data for Scale AI had posted in private online groups. iRobot said the units were special development robots used by paid testers who had signed consent forms, not customers’ machines. The lesson for robots trained on home footage is that human reviewers sit somewhere in the chain.
Hijacked robot vacuums. At DEF CON in August 2024, researchers Dennis Giese and Braelynn Luedtke showed that some Ecovacs robots could be taken over over Bluetooth from up to 50 metres away, exposing camera and microphone feeds, and that a PIN meant to protect the video feed was checked only in the app, Kaspersky reported. That October, Deebot X2 owners in several US states reported their robots moving on their own and shouting abuse through the speakers.
Robots that phone home. In 2025, Alias Robotics researchers reported that the Unitree G1 humanoid sends telemetry, including data from its sensors, to servers in China every five minutes without notifying users, and that a Bluetooth flaw allowed root access, Help Net Security reported. Earlier that year, a remote-access backdoor was disclosed in Unitree’s Go1 robot dog, Axios reported. We look at those robots in our Unitree G1 vs R1 comparison.
Robots switched off remotely. Privacy includes control. When Amazon ended Astro for Business in July 2024, the robots stopped working, Engadget reported. A cloud-dependent robot ultimately answers to its maker’s servers.
What the law says in the UK and EU
UK GDPR applies to manufacturers collecting your data, which must be processed lawfully, transparently and kept no longer than necessary. The Information Commissioner’s Office published draft guidance on consumer Internet of Things products in June 2025. It says users must be told clearly what is processed, consent must be freely given without manipulative prompts, erasure requests should be honoured, and it warns that deleting an app or account does not necessarily erase the data. UK GDPR includes an exemption for purely personal or household activity, which covers you, not the robot’s maker.
The Product Security and Telecommunications Infrastructure (PSTI) regime, in force since 29 April 2024, bans guessable default passwords on connectable consumer products sold in the UK, requires a published way to report security flaws, and requires manufacturers to state how long they will provide security updates, techUK explains.
In the EU, the AI Act’s prohibitions have applied since February 2025, and its transparency duties since 2 August 2026. The Digital Omnibus on AI, in force since 27 July 2026, pushed back high-risk rules to 2 December 2027 for stand-alone systems and 2 August 2028 for AI built into regulated products, and took AI in machinery out of the Act’s direct high-risk rules, according to Lewis Silkin.
Before a robot moves in: a privacy checklist
- Read the retention policy. If the maker does not say how long video is kept, assume it is kept.
- Look for a hardware off switch that physically cuts cameras and microphones, as Astro’s does.
- Set no-go zones for bedrooms and bathrooms, and use them.
- Ask who can see through its eyes. Remote operator access should be opt-in, per session, with a visible indicator.
- Opt out of training data where offered, knowing it may not undo data already used.
- Check the security update period, which PSTI requires UK sellers to publish.
- Put it on a separate Wi-Fi network from your laptops, and change any default credentials.
- Tell your guests. It is courteous, and they may want the camera off.
For your wider home network, our Bitdefender review and NordVPN review cover tools that help.
Home Robot Security in 2027: New Rules for Machines That Move
This year the EU’s Machinery Regulation has replaced the old Machinery Directive, applying from 20 January 2027 and adding safety requirements for machines with self-evolving behaviour, such as AI-driven robots. The Digital Omnibus on AI has taken AI built into machinery out of the AI Act’s direct high-risk rules, and the Cyber Resilience Act applies in full from 11 December 2027, after its duty to report actively exploited vulnerabilities began in September 2026.
In the UK, the PSTI security rules remain the baseline for any connected robot sold here. Samsung’s Ballie never reached shops, and the robots that did, from 1X’s NEO to Unitree’s humanoids, are judged as much on who can reach them remotely as on what they can do.
Home Robot Privacy Questions
Can 1X NEO’s remote operators see inside my home?
Yes, during Expert sessions you approve. 1X says operators cannot take control without the owner’s approval, that it can blur people from view and that owners can set no-go zones. Footage from those sessions is used to train 1X’s AI, and owners can opt out of that.
Do robot vacuums with cameras send pictures to the cloud?
Some do and some do not. Matic says raw camera data never leaves its robot, while other brands upload images for remote viewing or object recognition. Check the privacy policy for the words “images”, “video” and “retention”.
Can a home robot be hacked?
Yes. Researchers have shown camera and microphone access on some Ecovacs robots and root access on the Unitree G1. Choose brands that publish a security update period and a vulnerability reporting process, as UK PSTI rules require.
Do I have to tell visitors my robot is recording?
UK GDPR’s household exemption generally covers personal recording inside your own home, but it is good manners to tell guests and switch off cameras if they prefer. The manufacturer remains responsible under data protection law for anything it collects.
Which home robot is the most private?
Among those we compared, a robot with no camera, such as Casio’s Moflin, collects least. Of camera-equipped robots, Amazon Astro has the most detailed published controls and Matic claims the most on-device processing. NEO asks for the most trust, because remote humans are part of the design.
