China’s data protection measures remain weak in its technological advancements, fueling persistent concerns over personal data leaks linked to Chinese products and technologies. Security vulnerabilities in robot vacuums and home cameras have recently come under heightened scrutiny.
Privacy policies from Chinese robot vacuum manufacturers Roborock and Ecovacs reveal that both companies share user data with their affiliates and partners in China. Ecovacs has been transmitting voice recordings captured by its devices' microphones to Chinese tech giant Baidu. A company representative stated that the voice data is used exclusively for control functions and is encrypted before being sent to the Chinese internet giant Baidu.
Roborock, the leading robot vacuum brand in South Korea by market share, also discloses in its policy that user data may be transmitted to its Beijing headquarters. In response to concerns, a Roborock representative clarified that only data necessary for troubleshooting and error analysis is sent, and only with user consent.
Meanwhile, BYD, China’s largest electric vehicle manufacturer, which recently entered the South Korean market, collects data through its app, including digital key usage, vehicle speed, and battery status. According to the company’s terms of service, this data is shared with third-party Chinese IT firms HUSH Technology and Bangcle.
Concerns over data leaks involving Chinese products are not new. Overseas, Ecovacs robot vacuums have been hacked, with some incidents reportedly involving devices verbally abusing users. In South Korea, a widely publicized case involved a Chinese-made home security camera installed for child monitoring being hacked, leading to thousands of video recordings being leaked onto pornography websites. Similar incidents have been reported elsewhere. Last year in the United Kingdom, a consumer rights group found that an app linked to a Chinese-manufactured air fryer was eavesdropping on user conversations and sharing the data with TikTok. While the app’s terms indicated that it collected user data during account registration and could share it with third parties for marketing purposes, it failed to specify how the data would be used.
