A Roomba registered a woman on the toilet. How did the screenshots end up on Facebook?

Brookman explains that the legal hurdles that companies must cross to collect data directly from consumers are quite low. The FTC, or state attorneys general, can step in if there are “unfair” or “deceptive” practices, he notes, but those are narrowly defined: unless a privacy policy doesn’t specifically say, “Hey, we’re not going to let entrepreneurs look at your data” and they share it anyway, says Brookman, companies are “probably okay with deception, which is the main way” for the FTC of “enforcing confidentiality historically”. Proving that a practice is unfair, meanwhile, entails additional charges, including proof of harm. “The courts have never really ruled on this,” he adds.

Most company privacy policies don’t even mention captured AV data, with a few exceptions. iRobot’s privacy policy states that it only collects audio-visual data if an individual shares images through its mobile app. LG’s privacy policy for the camera-enabled and AI-enabled Hom-Bot Turbo+ explains that its app collects audio-visual data, including “audio, electronic, visual, or similar information, such as profile pictures, voice recordings and video recordings”. And the privacy policy of Samsung’s Jet Bot AI+ robot vacuum cleaner with lidar and Powerbot R7070, both of which have cameras, will collect “information you store on your device, such as photos, contacts, text logs , touch interactions, settings and calendar information”. and “recordings of your voice when you use voice commands to control a service or contact our customer service team”. Meanwhile, Roborock’s privacy policy makes no mention of audio-visual data, although company representatives tell MIT Technology Review that consumers in China have the ability to share it.

iRobot co-founder Helen Greiner, who now runs a startup called Tertill that sells a garden weeding robot, points out that by collecting all this data, companies are not trying to violate the privacy of their customers. They’re just trying to make better products or, in iRobot’s case, “do better cleaning,” she says.

Yet even the best efforts of companies like iRobot clearly leave gaps in privacy protection. “It looks less like malice and more like incompetence,” says Giese, the IoT hacker. “Developers are traditionally not very good [at] security stuff. Their attitude becomes “Try to get the feature, and if the feature works, ship the product.”

“And then the scandals break out,” he adds.

Robot vacuums are just the start

The appetite for data will only increase in the years to come. Vacuum cleaners are just a small subset of the connected devices that proliferate in our lives, and the biggest names in robot vacuums, including iRobot, Samsung, Roborock and Dyson, express far bigger ambitions than automated floor cleaning. . Robotics, including home robotics, has long been the real prize.

Consider how Mario Munich, then senior vice president of technology at iRobot, explained the company’s goals in 2018. In a presentation on the Roomba 980, the company’s first computer vision vacuum cleaner, he showed images from the device’s perspective, including one of a kitchen with a table, chairs and stools, alongside how they would be labeled and perceived by the robot’s algorithms. “The challenge is not to vacuum. The challenge is with the robot,” Munich explained. “We would like to know the environment so that we can modify the operation of the robot.”

This larger mission is evident in what Scale’s data annotators were asked to label – not items on the floor that should be avoided (a feature iRobot promotes), but items like “cabinet”, “counter kitchen” and “shelf”, which together help the Roomba J series device recognize the entire space in which it operates.