Furbo Dog Camera
Tomofun · Camera / Doorbell
Staff Reviewed · 2026-09-28 — a person at DeSpy reviewed this rating. Reviewer's note: Verified
Index
Always-on, cloud-connected treat-tossing pet camera with two-way audio and a Dog Nanny event-recording subscription. Captures audio/video of anyone in frame plus app geolocation; its privacy policy permits using customer 'Content' to refine AI algorithms and disclosing personal information to third-party marketers, and treats de-identified/aggregated data as outside personal-information protections, though it states it does not currently sell personal information. Heavily studied by independent security researchers who repeatedly found serious flaws over several years: firmware root RCE (Somerset Recon, 2021-22), an unauthenticated cloud photo API and zero-click account takeover (Lethal Bit, 2018), and a 2025 disclosure of ~17 CVEs including a hard-coded root password with no vendor response.
Why this rating
The written explanation of this rating is withheld while a person re-reviews it.
What it is
- Microphone
- Camera
- Requires a cloud account
- Manufacturer
- Tomofun
- Category
- Camera / Doorbell
- Model years
- 2016-present
- Market status
- Current
- Companion app
- Furbo - smartest pet camera (iOS/Android)
The evidence 2
Independent research, regulatory action, lawsuits and journalism about how this device handles personal data — the "what actually happens" axis. Each links to its source.
-
Independent policy review confirming Furbo collects audio/video of anyone in frame plus geolocation, uses captured video to test/refine AI algorithms, and may disclose personal information to third parties for marketing, while noting Tomofun does not currently sell personal information and had no known major security breach at the time of review.
Why it matters here: Corroborates POLICY sensitive-collection, broker-disclosure and policy-vagueness deductions and the no-sale finding.
-
Primary vendor policy. Verbatim: 'We do not currently sell your Personal Information' (Sec. 12); 'Tomofun may disclose your personal information to third parties for marketing purposes' (Sec. 4(e)); when Smart Dog Alerts is enabled 'we use your Content data to test and refine our artificial intelligence algorithms' (Sec. 3(h)); and 'Aggregated or anonymized information does not constitute personal information' (Sec. 1), i.e. de-identified data falls outside the policy's personal-information protections.
Why it matters here: Primary-source basis for the POLICY sensitive-collection, broker-disclosure and policy-vagueness deductions and the no-sale finding; removes reliance on secondary readings.
Are you the maker? Respond to this finding
Free. There is no paid or faster path, and nothing about a rating is for sale. Prove you control your company's domain with one DNS record; a person then reads your statement beside our finding and decides whether to publish it.
Think something here is wrong?
Evidence and research improve when people push back. Tell us what to re-check — a misattributed domain, an outdated classification, a claim about your own app — and a human will review it. Responses can take up to 30 days.
Descriptive, cited, not legal advice; ratings are versioned and corrections create a new version. Data from the IoT Info Grabber DB research project, CC BY-SA 4.0.