America just blacklisted foreign-made robot vacuums. Should Australian buyers be worried?

The headline is true, but it needs three large qualifications

The United States has placed “foreign-produced advanced robotic devices” on the Federal Communications Commission's Covered List. The technical definition covers mobile ground robots that operate away from a human operator, weigh more than 4.4 pounds (about 2 kilograms, including a dock where applicable), sense their environment, have network connectivity of at least 200 kbps and use software to control navigation, perception, data collection or remote operation. That captures many modern robot vacuums, as well as some robotic lawnmowers and pool cleaners.

Qualification one: the FCC did not publish a blacklist of robot-vacuum brands. The entry is based on where a qualifying device is produced, not whether the logo on it belongs to a Chinese, American, Korean, European or Australian company. A foreign-produced device can also seek a Conditional Approval from the US Department of War.

Qualification two: this is an equipment-authorisation restriction, not a raid on retail shelves. Covered equipment cannot receive a new FCC authorisation. The FCC's FAQ says the change does not prohibit the import, sale or use of an existing device model that it authorised before 28 July 2026. Owners are not being told to switch their robots off.

Qualification three: it is a US rule. Australia has not added the same category to a local prohibited-products list. An Australian retailer can continue selling a compliant robot vacuum under Australian law, regardless of whether a future version can obtain a new US authorisation.

Why did the US include ordinary cleaning robots?

The national-security determination behind the listing argues that networked robots create attack paths that can alter both data and physical operation. It says collected information could be used for surveillance, foreign-intelligence purposes or remote control of a robot. It also treats dependence on foreign robotics supply chains as a risk to US economic and national security.

That reasoning is much broader than the privacy risk inside one lounge room. A warehouse robot, patrol robot and autonomous floor cleaner share a basic architecture: sensors observe the environment, software decides where to move, radios connect the device to other systems and remote services can issue commands. The FCC chose one technical category that reaches consumer and industrial machines rather than naming only military-looking robots.

The determination does not prove that every foreign-made robot vacuum spies on its owner. It is a risk-based US supply-chain decision. Conflating it with a finding of misconduct against every affected manufacturer would be inaccurate. The important consumer lesson is that a robot able to map and view a home is a connected computer with wheels, not that a country of manufacture automatically tells us whether it is secure.

Existing robots can continue receiving important updates

A separate FCC waiver released on the same day allows previously authorised covered robots to keep receiving software and firmware changes that mitigate consumer harm until at least 1 January 2029. The notice specifically includes vulnerability patches and changes needed to maintain compatibility with operating systems.

That matters because an update freeze would have made already-sold products less secure. It also exposes the long-term question for US buyers: the waiver is not an open-ended promise, and a hardware revision or replacement model may need a new authorisation. Manufacturers that cannot obtain conditional approval or meet the US domestic-content test may have to change production, delay models or skip that market.

For Australians, I would treat predictions of immediate shortages as speculation. Global brands may continue producing Australian and Asian variants even if the US route narrows. On the other hand, the American market is large enough to influence global hardware platforms, app development and support budgets. The practical effect will become clearer when 2027 product launches reach certification rather than from the stock already sitting in Australian stores today.

What can a robot vacuum actually see and collect?

Not every robot has the same sensors. A LiDAR-only model measures distance with laser light and builds a geometric floor plan; it does not produce an ordinary colour photograph. Camera-equipped models can use RGB or depth images to recognise shoes, cables and pet waste, and some offer live remote viewing. Microphones may support voice assistants or two-way audio. Cliff sensors, wheel encoders and bumper sensors reveal less about a home but still contribute to a detailed map of rooms and routes.

The app adds another layer. A vendor may process account details, device identifiers, network information, cleaning history, maps, room labels, no-go zones, fault logs and customer-support uploads. If obstacle-photo improvement or remote video is enabled, image data may enter the flow too. “Processed locally” is valuable, but it should be read carefully: one feature can run on the robot while maps, commands, logs or optional photos still use a cloud service.

A floor plan is not the same as a family photo, but it is not meaningless telemetry. Room names, cleaning schedules and repeated routes can reveal how a home is organised and when routines occur. A camera low to the floor can capture people, children, documents, screens and private spaces that were never intended to be part of a vacuum-cleaner account.

What the major brands publicly say about privacy

I checked current official privacy and security material from four large robot-vacuum brands sold in Australia. All four publish some useful information, but the disclosures are not directly comparable and they do not replace an independent security test. Claims also vary by model, app region and optional feature.

ECOVACS publishes a product-security reporting channel and security advisories. Its Australian privacy explainer says DEEBOT-to-phone data is encrypted and server-stored, camera-equipped robots indicate when the camera is active, and Video Manager is password protected. Its own advisories are worth reading too: the company disclosed and patched issues in 2024 and 2025 affecting live-video PIN validation, TLS certificate validation and remote code execution on affected products.

Roborock's Trust Center says regional data centres are used, TLS protects communications and obstacle-photo and video functions have additional controls. Some model pages state that obstacle images are not stored. Roborock also publishes a vulnerability-disclosure policy and a model-code table with security-update end dates; its stated minimum for robot vacuums is two years, which is transparent but not especially long for an appliance costing four figures.

Dreame's privacy policy says regional servers include Singapore for applicable users and explains access, deletion and cross-border transfer. An official support response says live video is opt-in, protected by an activation code, accompanied by a non-disableable voice announcement and not collected or stored by Dreame, while deliberately captured media stays on the phone. Buyers should confirm those controls on the exact Australian model.

iRobot says product data is encrypted in transit and at rest. Its privacy policy says users can choose not to transmit map data and can separately choose whether to send obstacle images to improve object recognition. That distinction—navigation can work while an optional improvement upload remains off—is the kind of granular control I want every brand to explain clearly.

Australia now has a security baseline—but it is not a privacy star rating

Australia's mandatory Security Standards for Smart Devices took effect on 4 March 2026. Most consumer smart devices manufactured from that date must avoid universal default passwords, provide a way for security researchers to report vulnerabilities, and publish the minimum period during which security updates will be supplied. Manufacturers and suppliers must also provide a statement of compliance.

That is useful progress and directly relevant to a newly manufactured connected robot vacuum. It gives Australian buyers a concrete question that did not previously have a mandatory answer: when does security support end? Products manufactured before the commencement date are not retrospectively required to comply, so old warehouse stock can sit beside a newer compliant production run.

The baseline does not certify that a device has no vulnerabilities, guarantee a long support period or tell you whether cloud image processing is appropriate for your home. A manufacturer can comply by declaring a relatively short support window. Nor is the statement of compliance the same as an independent penetration test. It is a starting point for comparison, not the end of it.

My camera-robot buying checklist

Start with the exact model, not the brand's corporate privacy page. Two robots from the same range may use very different obstacle sensors, and a camera that only classifies objects locally presents a different risk from one offering remote live view and cloud photo albums.

I would favour a model that can clean normally without live-view activation, makes optional image uploads genuinely optional and shows a visible or audible warning whenever a person accesses the camera. If the app cannot explain how to delete maps, recordings and the account, I would not put that camera inside my home.

• Identify every sensor: RGB camera, depth camera, LiDAR, microphone and remote-view capability.
• Ask whether obstacle images are processed locally, uploaded by default, retained, used for training or viewable by support staff.
• Check whether live view requires a separate PIN or activation code and whether the robot announces camera access.
• Find the Australian statement of compliance and the model's published security-update end date.
• Use a unique app password and enable multi-factor authentication where the brand offers it.
• Install firmware and app updates promptly and keep automatic updates enabled if available.
• Place the robot on a separate IoT or guest network when the router supports isolation, while checking that the app still works correctly.
• Keep cameras out of bedrooms, bathrooms and spaces where confidential work or documents are regularly visible.
• Delete maps, recordings, device sharing and the cloud account, then factory-reset the robot before resale or disposal.

Should Australian buyers be worried?

Concerned enough to ask better questions, yes. Worried enough to avoid every foreign-made robot, no. The US decision is evidence that governments now see networked robots as part of the communications and supply-chain security problem. It is not evidence that every product caught by its definition has been compromised.

I would not rank privacy by flag. I would rank it by verifiable behaviour: limited data collection, local processing where practical, strong authentication, clear camera indicators, accessible deletion, a published vulnerability process and a support period that matches the life of the appliance. A brand that documents and fixes a vulnerability can be a better bet than one that has never published an advisory because it does not invite scrutiny.

The strongest consumer response is not to panic-buy a current model before a supposed ban reaches Australia. It is to make privacy and security part of the comparison beside navigation, mopping, dock maintenance and price. If a company wants a camera to travel through my home for the next five years, it should be willing to tell me exactly what that camera does and how long the company will keep the computer behind it secure.