, 4 May 2021

In addition to learning how to keep your home clean, here's what your smart mop does with your data

Oh, robot mop. Let me count the ways that I love thee. You keep my home free of pet dander. You clean while I’m away. You simultaneously scare and fascinate my kitty. Plus, you have very beautiful eyes.

All odes aside — I love my iRobot (which is the same brand as Roomba) mop. It’s a “smart” device that’s actually smart, knowing when to avoid things like stairs and carpets and controllable with my phone. Maybe it’s because robot vacuums and mops have been around longer than a lot of other IoT devices or maybe it’s easier to engineer but whatever the reason: I’m an iRobot stan.

Which, of course, made me nervous to look closer at the potential security and privacy risks of iRobot/Roomba. In the back of my mind, I felt like maybe I’d heard something bad about it in my Time Before Writing About Online Security. So, with trepidation, for this installment of What Does the Internet Know About Me?, I took a look at iRobot/Roomba.

What does iRobot know about me?

First things first: What does iRobot know about me? According to their Privacy Policy, they know all of the things you’d expect: name, email address, username and password, shipping address, billing information, and phone number. They needed all of that to set up my account and send me my bot, so all of that’s legit. They also know stuff about my robot, including it’s serial number and product code. 

They also say that if I’d signed up with a third party app like Facebook or Google (I didn’t — and don’t, as a rule), then they would exchange information with that company. They also say that they share info with other companies that are “owned by or under common ownership” with iRobot, service providers, third parties if requested by the user (me), and law enforcement. 

There’s also info that the robot itself collects, including how much dirt it detects, how strong my Wi-Fi is, and mapping info of my apartment, so the robot knows where to go. It also stores the name I gave it (it’s Jim — because our cat’s name is Dwight and the robot loves to antagonize him) and the names of any rooms or designated zones.

Finally, there’s an option to connect the iRobot app with “iRobot smart home partners,” which would let it scan my phone for other smart home apps that it could connect with. I didn’t opt into this service, but it’s good to know it’s an option. 

If I lived in Europe, I’d have all of the rights granted under the GDPR, which basically boil down to any and all info I might want about my data and how it’s used; the right to correct it if it’s wrong; and in some cases, even the right to delete it or the right to not have collected in the first place.

What could iRobot figure out about me?

iRobot has a map of my home, so they theoretically could figure out a lot about me, right? How big my apartment is, at least, and maybe some information about my furniture. But I’m not sure there’d ever be a reason for it to want to access that data. 

What does iRobot do with my data?

As far as my digging — and the digging done by the team over at Mozilla in their Privacy Not Included Guide — could tell, they pretty much just use it to help me keep my apartment clean! They don’t sell data and I can choose to not send them any data at all. Plus, I can delete it when/if I ever decide to break up with my robot helper. (Not gonna happen. We’re in this for life.) 

What am I getting in exchange for my data? What are the tradeoffs?

I think by now it’s pretty clear what I’m getting from my robot. My partner is allergic to my kitty and I live in a fairly large loft. That means lots of floor space — and lots of corners for cat hair and dander to get stuck in. My iRobot mop makes it easier for all three of us to cohabitate and breath without sniffling, even if it does drive the kitty a little crazy. 

Considering they seem to be pretty good about collecting only data they actually need and giving users the right to opt out and delete, I’d say the iRobot is very worth it from both a consumer and a privacy perspective.