Litter-Robot
Whisker · Pet Tracker
✓ Reviewed
Index
App-connected automatic litter box (Whisker). Logs cat weight, visit frequency, and cycle history — data that reveals household presence and routines — surfaced via cloud "Whisker+" insights and the Whisker app (account required). Current Litter-Robot 4 / 5 Pro models add in-box cameras that record video and audio, whose recordings are used to train Whisker's ML/AI models (48h default retention). Whisker states it does not sell personal data for money but shares it with advertising/analytics partners (Facebook, Google, Amazon, Microsoft, Pinterest) for targeted ads (opt-out available; GPC honored). Binding arbitration (JAMS) + class-action waiver. Independently reviewed once (Mozilla *Privacy Not Included, LR3 Connect): met Minimum Security Standards, rated "Somewhat creepy"; newer camera/audio models untested. No breach, regulatory action, or confirmed data sale on record.
Why this rating
POLICY 58 = 100 −15 broker-disclosure (shares personal data with advertising/analytics partners for targeted ads; discloses this may count as "sale/sharing" under state law, though no monetary sale) −15 sensitive-collection (LR4/LR5 Pro capture in-box video AND audio used to train ML/AI; app collects phone location and pet weight/visit-frequency exposing household routines) −7 policy-vagueness (general retention "as long as reasonably necessary"; policy is exceptionally long per Mozilla) −5 forced-arbitration (binding arbitration + class-action waiver, via JAMS). No deduction for opt-out (Privacy Rights Portal + GPC honored, both verified in policy text), deletion (offered), or indefinite-retention (camera footage 48h default). No bonuses (no local-processing mode, no data-minimization pledge; the Mozilla security-standards pass is not credited as a formal independent audit). EVIDENCE 80 = studied, clean incident record. NOT unstudied — Mozilla *Privacy Not Included independently reviewed the device (Nov 2021), confirming it meets Mozilla's Minimum Security Standards (encryption, security updates, vuln management) while rating it "Somewhat creepy" for ad-sharing, so the unstudied ≤60 cap does not apply. No confirmed breach, regulatory action, or data sale found on independent search (only an unrelated commercial IP suit, Whisker v. Smarty Pear). Held below A (not 100) because that review covers only the older LR3 Connect (no camera, no microphone); the current camera/audio LR4/LR5 Pro models — which drive the biggest privacy concerns — have no independent security testing.
What it is
- Microphone
- Camera
- Requires a cloud account
- Manufacturer
- Whisker
- Category
- Pet Tracker
- Model years
- 2019–present
- Market status
- Current
- Companion app
- Whisker
The evidence 2
Independent research, regulatory action, lawsuits, breaches and journalism about this device — the "what actually happens" axis. Each links to its source.
-
Independent privacy/security review: meets Mozilla's Minimum Security Standards (encryption, strong passwords, security updates, vulnerability management); no known incidents in the last 3 years; rated 'Somewhat creepy' for personalized-advertising data sharing across Facebook/Google/Amazon/Microsoft/Pinterest; camera in-app, location tracking in-app, no microphone on the reviewed LR3 Connect.
Why it matters here: Sole independent review; establishes the device is studied (not unstudied) and anchors the evidence score with a security-positive but privacy-critical verdict. Verified: URL resolves and supports every stated claim.
-
Primary source (effective 2025-10-31): no monetary sale but shares data with advertising/analytics partners (may be 'sale/sharing' under state law; opt-out via portal/GPC honored); LR4/5 camera models record video and concurrent audio used to train ML/AI, footage kept 48h; binding arbitration via JAMS + class-action waiver; deletion and opt-out rights offered.
Why it matters here: Documents the POLICY-axis deductions (broker-disclosure, sensitive-collection, forced-arbitration, vagueness) and the credited opt-out/deletion rights. Verified: URL resolves and policy text confirms each cited term, including the JAMS administrator.
Descriptive, cited, not legal advice; ratings are versioned and corrections create a new version. Data from the IoT Info Grabber DB research project, CC BY-SA 4.0.