← IoT Privacy Database

Arlo Smart Home Security

Arlo Technologies · Camera / Doorbell

Staff Reviewed — a person at DeSpy reviewed this rating.

3.6Surveillance
Index
Policy — what its policy permitsC
Evidence — what research provesC

Arlo cameras and video doorbells continuously capture video and two-way audio of your home's exterior and interior, storing clips in Arlo's cloud tied to a required account (IP address, device IDs, Wi-Fi network name, account/payment data, and usage telemetry). Arlo publishes a Privacy Pledge saying it does not sell personal data for marketing, but its own notice concedes it shares identifiers (device ID, cookie ID, IP) and network-activity data with advertisers, ad networks, analytics providers and social networks through tracking technologies that some U.S. state laws classify as 'selling' or 'sharing.'

Why this rating

Policy: audio/video collection (-15) and sharing of device identifiers/IP with ad networks and analytics that state privacy law treats as 'sharing/selling' (-15), plus unilateral-change, forced-arbitration and loose law-enforcement disclosure clauses; partially offset by a public Privacy Pledge / data-minimization stance and optional local (base-station/SD) storage. Evidence: no confirmed breach or regulatory action, but independent scrutiny is limited to a single mixed civil-society review, and a pending BIPA class action (Tibbs v. Arlo Technologies, N.D. Cal.) over 'Person Detection' facial-scanning survived a motion to dismiss in 2024 - an unadjudicated concern that keeps the evidence axis from scoring higher.

What it is

Manufacturer
Arlo Technologies
Category
Camera / Doorbell
Model years
2018-present
Market status
Current
Companion app
Arlo Secure

The evidence 1

Independent research, regulatory action, lawsuits and journalism about how this device handles personal data — the "what actually happens" axis. Each links to its source.

  1. S2Arlo Security Cams - Privacy Not Included review
    Ngo review · Mozilla Foundation · 2023-11

    Mozilla's *Privacy Not Included team found Arlo meets its Minimum Security Standards but can collect and share a fair amount of user data, including identifiers used for advertising.

    Why it matters here: Independent civil-society assessment of this specific product line's data-collection and sharing practices.

Are you the maker? Respond to this finding

Free. There is no paid or faster path, and nothing about a rating is for sale. Prove you control your company's domain with one DNS record; a person then reads your statement beside our finding and decides whether to publish it.

An email is encrypted at rest and opened only to answer you; it is erased 30 days after we resolve this (or 180 days if still open), and you can erase it sooner. Unproven filings are deleted after 14 days.

Think something here is wrong?

Evidence and research improve when people push back. Tell us what to re-check — a misattributed domain, an outdated classification, a claim about your own app — and a human will review it. Responses can take up to 30 days.

If you leave an email it is encrypted at rest and opened only to answer you — never shared, never used for anything else. It is erased 30 days after we resolve this (or 180 days if it is still open) without you asking, and you can erase it sooner at any time; either way your correction stays, anonymously. Leave it blank and your request is fully anonymous from the start (we store no IP address either way).

Descriptive, cited, not legal advice; ratings are versioned and corrections create a new version. Data from the IoT Info Grabber DB research project, CC BY-SA 4.0.

← Back to the IoT Privacy Database