← IoT Privacy Database

Blink Home Security Cameras

Blink (Amazon) · Camera / Doorbell

Staff Reviewed — a person at DeSpy reviewed this rating.

4.0Surveillance
Index
Policy — what its policy permitsD
Evidence — what research provesC

Blink is Amazon's budget camera and video-doorbell line. It captures motion-triggered video and audio, requires an Amazon-linked account, and processes footage and account data (IP, device IDs, email, motion events, and optional cloud clips) under Amazon's broad privacy policy, which shares data across Amazon companies for personalization and advertising. Local USB storage is possible via the Sync Module 2, but setup, remote viewing and most features remain cloud-tied. As an Amazon camera product it falls under the same law-enforcement-disclosure framework Amazon has used to hand police footage without user consent in claimed emergencies.

Why this rating

Policy: audio/video capture (-15), broad Amazon-wide data sharing for personalization/ads (-15), indefinite retention (-8), a vague umbrella policy (-7), plus arbitration and emergency law-enforcement disclosure clauses; local USB storage via Sync Module 2 earns a small local-processing bonus. Evidence: Tenable disclosed seven severe Blink XT2 vulnerabilities in 2019 (command injection / RCE as root, camera hijack, botnet risk), since patched, so counted at reduced weight; separately, Amazon has admitted disclosing camera footage to police without consent under 'emergency' requests, the framework Blink operates within.

What it is

Manufacturer
Blink (Amazon)
Category
Camera / Doorbell
Model years
2016-present
Market status
Current
Companion app
Blink Home Monitor

The evidence 2

Independent research, regulatory action, lawsuits and journalism about how this device handles personal data — the "what actually happens" axis. Each links to its source.

  1. Blink XT2 Sync Module Multiple Vulnerabilities (TRA-2019-51)
    Major breach · Tenable · 2019-12

    Tenable found seven vulnerabilities in Amazon's Blink XT2 sync module enabling command injection and remote code execution as root, letting attackers view camera feeds, listen to audio, and hijack devices; Amazon issued patched firmware.

    Why it matters here: Device-specific security flaws in Blink camera hardware demonstrating real exposure of video/audio feeds.

  2. S3Amazon handed Ring doorbell footage to police without user consent
    Journalism · PBS NewsHour · 2022-07

    Amazon confirmed to Senator Markey that it gave camera footage to police without user consent multiple times in 2022 under 'emergency' requests.

    Why it matters here: Blink is an Amazon camera product covered by the same emergency law-enforcement disclosure policy the confirmed disclosures relied on; demonstrates the parent's willingness to share footage without consent.

Are you the maker? Respond to this finding

Free. There is no paid or faster path, and nothing about a rating is for sale. Prove you control your company's domain with one DNS record; a person then reads your statement beside our finding and decides whether to publish it.

An email is encrypted at rest and opened only to answer you; it is erased 30 days after we resolve this (or 180 days if still open), and you can erase it sooner. Unproven filings are deleted after 14 days.

Think something here is wrong?

Evidence and research improve when people push back. Tell us what to re-check — a misattributed domain, an outdated classification, a claim about your own app — and a human will review it. Responses can take up to 30 days.

If you leave an email it is encrypted at rest and opened only to answer you — never shared, never used for anything else. It is erased 30 days after we resolve this (or 180 days if it is still open) without you asking, and you can erase it sooner at any time; either way your correction stays, anonymously. Leave it blank and your request is fully anonymous from the start (we store no IP address either way).

Descriptive, cited, not legal advice; ratings are versioned and corrections create a new version. Data from the IoT Info Grabber DB research project, CC BY-SA 4.0.

← Back to the IoT Privacy Database