The 12-question companion robot privacy check
What to ask before placing always-listening microphones, cameras, accounts, and cloud personalities in a private space.
Products, prices, policies, and evidence change. Verify the current primary sources for the exact model and region before acting.
Map what the robot can sense
List every camera, microphone, touch sensor, location signal, account identifier, and inferred profile. A privacy policy may describe data categories without making the physical sensing system obvious, so compare both the hardware documentation and the policy.
Can cameras and microphones be physically disabled?
Is wake-word detection local or cloud-based?
Are recordings stored, and for how long?
Can household guests use the robot without an account?
Can data be exported and deleted?
Does a child profile change collection or retention?
Who can review interaction history or remotely contact the robot?
Does the robot identify faces, voices, moods, or household routines?
Understand failure modes
Ask what remains functional without internet access and what happens if the manufacturer closes the service. Also check whether security updates, account deletion, and repair support have stated end dates.
Privacy is not a single score. A camera-free robot may still send voice data to the cloud; a camera-equipped robot may process some vision locally. Prefer concrete disclosures over broad assurances.
Which features stop when the internet or paid plan ends?
How long are security updates promised?
Check household and caregiver access
Companion robots often sit in shared rooms. The account holder, the person living with the robot, household guests, visiting children, and remote family members may have different expectations. Document who can see photos, call through the device, change routines, or receive activity summaries.
For a care setting, consent is not a one-time checkbox. Provide a visible way to pause sensing, revisit consent when cognition or circumstances change, and avoid making unrelated care contingent on accepting the robot.
Can remote access be limited by person and feature?
Is there a clear indicator when audio, video, or a call is active?
Plan deletion before setup
Find the factory-reset instructions, account deletion route, export process, and support contact before creating the account. Record whether deletion also removes cloud memories, media albums, voice history, caregiver summaries, and third-party integrations.
If the robot is sold, donated, returned, or inherited, remove household data and revoke app access first. Keep proof of the request when the service does not provide an immediate deletion confirmation.
Framework sources
These sources shape the questions in this guide. They do not certify any listed robot.