Mexico. Since their emergence as an option for household cleaning, robotic vacuum cleaners advanced fast and are increasingly efficient at vacuuming every corner without suffering shocks. To avoid obstacles, they are equipped with sensors, GPS or even cameras, just as they are increasingly effective at vacuuming up dust, they are also effective at something else: collecting personal data.

Cases like leaked images of a woman sitting on the toilet raise questions about how much these types of devices know about their users and, more importantly, what the increasingly commonly used appliance is sending someone else. ESET, a proactive threat detection company, analyzes the risk of data leaks and the benefits of proper configuration.

In early 2022, MIT Technology Review acquired personal photos of homes and intimate photos captured from low angles that, according to the publication, were taken by a development version of the Roomba J7 series from iRobot, one of the world's most prominent robot vacuum cleaner suppliers.

iRobot confirmed that these images were captured by its Roombas in 2020 as part of a research and development process for its product: the images were sent to Scale AI, to nurture the artificial intelligence that would help iRobot recognize more objects and obstacles. Unfortunately, in this case, several Scale AI workers did not respect their privacy agreements and shared the photos taken by the vacuum cleaners in private groups on social media.

In August 2022, Amazon announced its intention to acquire iRobot, raising concerns about market competition and privacy regulations in the agreement between these two companies. The main question was about what data the company could collect and for what purposes to use it. The European Commission this month announced an official investigation into the deal to determine whether it would become an advantage for Amazon's business. Could the collected images be used to improve organic shopping suggestions and better-tailored ads based on real personal data?

"For example, robotic vacuums can learn your daily routine based on the cleaning schedule you set. Similarly, floor maps of saved houses reveal the size and layout of a house, which can suggest income levels and other information about living conditions. And, of course, a data leak could reveal images, including ways to identify the owner and where he lives," said Camilo Gutierrez Amaya, Head of Research Lab at ESET Latin America.

Recent versions of robotic vacuums usually keep a map of the house and can be operated via a smartphone app. Many of these models also feature voice control, usually compatible with Amazon Alexa or Google Assistant. Most smart features come from cameras, sensors, and microphones.

"If you plan to buy a robot vacuum cleaner and privacy is a concern, you should consider buying those that rely on inertial measurement that combines gyroscopes and accelerometers, as they do not need cameras, lasers or mapping to operate. However, the downside is that they move less effectively than their high-end counterparts and can repeatedly run around some areas of your home," adds the ESET researcher.

ESET shares how to protect data and points to consider before buying a new smart vacuum:
- Some models can work offline without some features like remote control or programming. Others must be specifically configured not to send data to the manufacturer's server.
- Many cleaners may also be banned from certain rooms, such as a bedroom or bathroom. This can be done through setup or by using virtual wall barriers.
- Before buying, choose those manufacturers that favor data encryption and require two-factor authentication to access the robot's mobile applications.
- Choose a vendor that offers regular updates for the mobile app and vacuum cleaner firmware.
- Verify the shelf life of the product and how long it is expected to receive support from the manufacturer.

"The evolution of smart vacuums is an example of people trading privacy for convenience. The more capable our smart devices are, and the more data they are allowed to collect, the more it intrudes into our lives; Therefore, there is less guarantee that someone will keep their privacy completely intact. However, if robotic vacuums are considered too convenient to avoid, then it is important to be selective with their configuration and the data points they can collect is a way to maintain some semblance of control over your privacy," says Camilo Gutiérrez Amaya, Head of the Research Laboratory at ESET Latin America.