Eufy Security Cams

In 2021 your intrepid *Privacy Not Included researcher decided she needed some indoor security cams to help keep an eye on her beloved kitty while away on a trip for a couple of nights. Being a privacy researcher, the one feature I demanded in my security cams was that all video be stored locally where I had control over it, not out on the internet in the less secure cloud. So I bought Eufy’s security cams for their local storage and because at the time they seemed to do a pretty good job protecting my personal data. Unfortunately, taking a look back at Eufy’s (actually, their parent company Anker’s) privacy policy in 2022 leaves me a bit worried about my decision.

And this is a common problem with connected products. Companies reserved the right to update their privacy policy at any time. And so overnight a company’s privacy policy can go from good to bad, or from OK to not-so-OK at least. That seems to be what happened with Eufy. A company I felt pretty OK with in the past now earns our *Privacy Not Included warning label. Boo!

Eufy says they can collect a good deal of personal information on you -- things like name, email, gender, birth date, location, device information, and more. And while Eufy says they don’t sell your personal information -- which is good -- they say they can use that information to show you ads from them and third party advertisers, which isn’t so good (but also pretty standard on the internet these days). They also say they can collect personal information on you from third parties who provide it to them, such as law enforcement authorities. This worries us a bit because the way that line in their privacy policy is written is rather vague and seems like it could leave open the possibility they could collect information on users from a variety of third parties, for example, data brokers.

Eufy’s security cameras still do some really good privacy-related things. We really like that your security cam footage is stored locally where only you can access and control it, not in the much less secure cloud (there is a cloud option though). You can access your videos at any time through the Eufy app, and that footage is protected by strong end-to-end encryption. This is all very cool. Eufy's AI provides human, pet, and crying detection for what your security cams see. One key value of Eufy's local storage is that all AI analysis of humans and crying babies is done locally, which ensures privacy and is usually much quicker than cloud-based AI analysis. One other advantage of Eufy’s local storage of video is it makes it harder for law enforcement to get their hands on it without your consent, which is a good thing.

Unfortunately, Eufy has also had some significant security vulnerabilities. In June 2022, security experts found three security vulnerabilities in Eufy's Homebase 2 video storage and management device that could have allowed hackers to take control of the hub, control it remotely, or steal video footage. Eufy/Anker developed fixes for these security vulnerabilities and released them to users in a timely manner. And in May 2021, Eufy was forced to apologize for a bug that exposed the camera feeds of 712 users to strangers. Eufy said the glitch happened during a software update and “users were able to access video feeds from other users’ cameras.” Eufy said in a statement the glitch was fixed an hour after it was discovered. So, the bad news is, Eufy’s security cameras have had some serious security issues. The good news is, Eufy seems to have stepped up and immediately fixed these bugs and to get them out to their users quickly.

What’s the worst that could happen with Eufy’s security cameras? Well, strangers getting access to the video feeds of cameras in and around your home is pretty dang awful. That is always a concern with security cameras in your home. And while it is great that Eufy has local storage to help keep those videos of you and your cat kissing under your control, it’s not so great that Eufy has a history of security vulnerabilities that could leave those cat kissing video open to hackers.