whirrwork
Insights

Robots are cameras with wheels: a privacy guide for buyers and neighbours

Security robots, drones, robot vacuums and home humanoids all collect video and data. What the rules say in the EU, UK, US and India, real enforcement cases, and the questions to ask before a robot films anyone.

By The Whirrwork team7 min read
  • privacy
  • data protection
  • GDPR
  • cameras
  • facial recognition
  • drones
  • security robots
  • home robots

The short version

  • Almost every useful robot carries cameras, microphones and location sensors. Legally, a security robot is often just CCTV that moves, and a drone is CCTV that flies. The usual data protection rules apply.
  • Europe is strict about retention (think days, not months), signage and purpose. Workplace emotion recognition and untargeted face scraping are now banned under the EU AI Act.
  • In the US, it's a patchwork: Illinois' biometric law carries $1,000–$5,000 per-person damages, and the FTC has banned a retailer from using facial recognition for five years.
  • In the cases we reviewed, the worst privacy failures weren't robots going rogue. They were people inside the supply chain seeing footage they shouldn't have.
  • This isn't legal advice. Data protection depends on where you are and what you collect.

Robots don't need to be evil to be a privacy problem. They just need to be switched on. Here's how to buy, deploy and live next to them without collecting footage you'll regret.

What robots actually collect

RobotTypical dataWho it can capture
Security patrol robot360° video, sometimes audio, number plates, thermalStaff, visitors, passers-by
Inspection or photo droneHigh-res video and photos, GPS trackNeighbours' gardens, windows, people outdoors
Robot vacuumFloor maps, front camera images, Wi-Fi detailsEveryone at home, at floor level
Home humanoidVideo, audio, maps, routinesYour household and guests
Retail loss preventionVideo, sometimes face matchingCustomers

Robots also produce operational logs: where they went, what they saw, when they stopped. Those logs are invaluable after an incident (see liability), and they're also personal data if they can identify people.

What went wrong, in practice

We only include cases we've checked against primary sources or reputable reporting.

  • Rite Aid (US, 2023). The FTC said the retailer used facial recognition in hundreds of stores from 2012 to 2020, generating thousands of false matches that led employees to follow, search and accuse customers, with people of colour disproportionately affected. Rite Aid was banned from using facial recognition for surveillance for five years and ordered to delete the images and any algorithms built from them (FTC). The FTC also said Rite Aid never tested the system's accuracy before deploying it.
  • Ring (US, 2023). The FTC said Ring let any employee or contractor access customers' private videos, and failed to stop hackers taking over accounts. Ring agreed to pay $5.8 million in refunds and to delete data products derived from videos it unlawfully reviewed (FTC). It's a camera company, not a robot company, but home robots carry the same kind of cameras into the same rooms.
  • Robot vacuum images (2022). MIT Technology Review reported that images captured in 2020 by development versions of iRobot's Roomba J7, including intimate household scenes, were sent to Scale AI for labelling, and gig workers posted some of them in closed social media groups. iRobot said the images came from special development robots used by paid collectors and employees who had signed agreements, not from consumer products, and that it ended its relationship with the service provider that leaked them (MIT Technology Review).

The common thread: humans reviewing robot data. That's not a reason to panic. It's a reason to ask who can see the footage.

The rules by region

European Union

  • GDPR applies to video of people. The EU's top court ruled in Ryneš (2014) that a home camera filming part of a public footpath isn't covered by the "household" exemption (CJEU, C-212/13). A robot that films outside your private space is likely in the same position.
  • Retention: the EDPB's video guidelines say footage should usually be deleted after a few days, and that keeping it longer than 72 hours needs more justification. They also expect a warning sign with key information before people enter the monitored area (EDPB Guidelines 3/2019).
  • AI Act bans, since 2 February 2025: among others, AI that infers emotions in workplaces and schools (except for medical or safety reasons), AI that builds face databases by untargeted scraping of the internet or CCTV, and real-time remote biometric identification in public spaces for law enforcement, with narrow exceptions (AI Act, Article 5). If a supplier pitches "mood detection" for your warehouse robots, that's a conversation to end early.
  • Your robot's data: since 12 September 2025, the EU Data Act gives users of connected products a right to access the data those products generate (European Commission).

United Kingdom

  • The ICO says organisations using drones are data controllers for what they capture. Its checklist includes a data protection impact assessment, telling people you're using a drone where possible, and not recording continuously without strong justification. It gives the example of a roof surveyor who only starts recording at altitude and doesn't record other private property (ICO). The ICO notes the guidance is under review after the Data (Use and Access) Act, so check for updates.

United States

  • No single federal privacy law for robots or drones. The FTC polices unfair and deceptive practices (see Rite Aid and Ring above).
  • Biometrics: Illinois' BIPA lets people sue for $1,000 per negligent violation or $5,000 per intentional or reckless one (Illinois General Assembly). A 2024 amendment limited recovery to one per person rather than per scan (Reuters). Face matching on a robot in Illinois without written consent is a serious exposure.
  • Drones: at least 44 states have enacted drone laws, many touching privacy, trespass or surveillance (NCSL). Privacy also runs the other way: FAA Remote ID broadcasts the drone's location and the location of its control station or take-off point (FAA), so the public can find the pilot.

India

  • The Digital Personal Data Protection Rules were notified on 13 November 2025, with most obligations taking effect on 13 May 2027 (MeitY). If you're deploying camera robots in India, plan for consent and notice now.

Elsewhere

Some places add security rules for cameras. In the UAE, for example, the GCAA asks for security clearance for drone operations that use a camera (GCAA). Check local rules before anything that films leaves the ground.

Home robots: the new frontier

Home robots raise a new question: who else is in the room? 1X's NEO humanoid, for example, offers a "Scheduled Expert Mode" in which "an Expert from 1X can remotely supervise its actions at scheduled times" for tasks it doesn't yet know (1X). That's an honest feature, clearly labelled and scheduled. It also means a stranger may see inside your home. Many home robots will likely work this way for years. In our view, that's acceptable only if you control when it happens, can see when it's happening, and know what's recorded.

A privacy-first deployment plan

  1. Write down the purpose. "Deter after-hours intrusion" is a purpose. "Collect everything, just in case" isn't.
  2. Collect less. Turn off audio unless you need it. Mask neighbouring windows and gardens. Plan drone routes away from homes.
  3. Retain briefly. Set automatic deletion; keep incident clips separately.
  4. Signal clearly. Signs at entrances; visible lights on robots; notices for staff.
  5. Control access. Name who can view footage, including at the supplier. Log access and use multi-factor authentication.
  6. Say no to face matching unless you've taken legal advice and can justify it.
  7. Tell your staff what the robot records before it arrives, not after.

Bot or Not?

Fine to proceed when…Pause when…
The supplier can tell you exactly who sees footage"Our team may review data to improve the service" with no limits
Retention is configurable and shortFootage is stored "indefinitely" in the cloud
You can switch off audio and face featuresFace recognition is on by default
Remote operation is scheduled and visibleRemote access can happen at any time without notice

What to ask

  1. What data does the robot collect, where is it stored (country), and for how long?
  2. Who at your company or your subcontractors can view video, and is access logged?
  3. Is our data used to train your AI? Can we opt out?
  4. Can we turn off audio, face detection and cloud upload?
  5. How do we export or delete our data when the contract ends?
  6. What happens to our data if your company is sold or shuts down? (See how robot jobs go wrong.)

This isn't legal advice. If your robot films people, especially staff, customers or the public, talk to a data protection professional in your jurisdiction.

Sources

All accessed October 2026.

More Insights