Litter-Robot
Whisker · Pet Tracker
Staff Reviewed · 2026-09-26 — a person at DeSpy reviewed this rating.
Index
App-connected automatic litter box (Whisker). Logs cat weight, visit frequency, and cycle history — data that reveals household presence and routines — surfaced via cloud "Whisker+" insights and the Whisker app (account required). Current Litter-Robot 4 / 5 Pro models add in-box cameras that record video and audio, whose recordings are used to train Whisker's ML/AI models (48h default retention). Whisker states it does not sell personal data for money but shares it with advertising/analytics partners (Facebook, Google, Amazon, Microsoft, Pinterest) for targeted ads (opt-out available; GPC honored). Binding arbitration (JAMS) + class-action waiver. Independently reviewed once (Mozilla *Privacy Not Included, LR3 Connect): met Minimum Security Standards, rated "Somewhat creepy"; newer camera/audio models untested. No breach, regulatory action, or confirmed data sale on record.
Why this rating
POLICY 58 = 100 −15 broker-disclosure (shares personal data with advertising/analytics partners for targeted ads; discloses this may count as "sale/sharing" under state law, though no monetary sale) −15 sensitive-collection (LR4/LR5 Pro capture in-box video AND audio used to train ML/AI; app collects phone location and pet weight/visit-frequency exposing household routines) −7 policy-vagueness (general retention "as long as reasonably necessary"; policy is exceptionally long per Mozilla) −5 forced-arbitration (binding arbitration + class-action waiver, via JAMS). No deduction for opt-out (Privacy Rights Portal + GPC honored, both verified in policy text), deletion (offered), or indefinite-retention (camera footage 48h default). No bonuses (no local-processing mode, no data-minimization pledge; the Mozilla security-standards pass is not credited as a formal independent audit). EVIDENCE 80 = studied, clean incident record. NOT unstudied — Mozilla *Privacy Not Included independently reviewed the device (Nov 2021), confirming it meets Mozilla's Minimum Security Standards (encryption, security updates, vuln management) while rating it "Somewhat creepy" for ad-sharing, so the unstudied ≤60 cap does not apply. No confirmed breach, regulatory action, or data sale found on independent search (only an unrelated commercial IP suit, Whisker v. Smarty Pear). Held below A (not 100) because that review covers only the older LR3 Connect (no camera, no microphone); the current camera/audio LR4/LR5 Pro models — which drive the biggest privacy concerns — have no independent security testing.
What it is
- Microphone
- Camera
- Requires a cloud account
- Manufacturer
- Whisker
- Category
- Pet Tracker
- Model years
- 2019–present
- Market status
- Current
- Companion app
- Whisker
The evidence 2
Independent research, regulatory action, lawsuits and journalism about how this device handles personal data — the "what actually happens" axis. Each links to its source.
-
Independent privacy/security review: meets Mozilla's Minimum Security Standards (encryption, strong passwords, security updates, vulnerability management); no known incidents in the last 3 years; rated 'Somewhat creepy' for personalized-advertising data sharing across Facebook/Google/Amazon/Microsoft/Pinterest; camera in-app, location tracking in-app, no microphone on the reviewed LR3 Connect.
Why it matters here: Sole independent review; establishes the device is studied (not unstudied) and anchors the evidence score with a security-positive but privacy-critical verdict. Verified: URL resolves and supports every stated claim.
-
Primary source (effective 2025-10-31): no monetary sale but shares data with advertising/analytics partners (may be 'sale/sharing' under state law; opt-out via portal/GPC honored); LR4/5 camera models record video and concurrent audio used to train ML/AI, footage kept 48h; binding arbitration via JAMS + class-action waiver; deletion and opt-out rights offered.
Why it matters here: Documents the POLICY-axis deductions (broker-disclosure, sensitive-collection, forced-arbitration, vagueness) and the credited opt-out/deletion rights. Verified: URL resolves and policy text confirms each cited term, including the JAMS administrator.
Are you the maker? Respond to this finding
Free. There is no paid or faster path, and nothing about a rating is for sale. Prove you control your company's domain with one DNS record; a person then reads your statement beside our finding and decides whether to publish it.
Think something here is wrong?
Evidence and research improve when people push back. Tell us what to re-check — a misattributed domain, an outdated classification, a claim about your own app — and a human will review it. Responses can take up to 30 days.
Descriptive, cited, not legal advice; ratings are versioned and corrections create a new version. Data from the IoT Info Grabber DB research project, CC BY-SA 4.0.