[Exclusive] Roborock's Information Security 'Gap'... Controversy Over Unauthorized Sharing with Affiliates

Comparison of Robot Vacuum Cleaner Privacy Policies
Roborock: "Disclosure to Affiliates and Third Parties Possible"
DeepSeek Controversy Spreads to Chinese Home Appliance Companies
Domestic Companies Emphasize 'Security' as Differentiation Strategy

Roborock, the leading domestic market share holder among Chinese robot vacuum cleaner companies, has been confirmed to specify in its product terms and conditions that personal information can be provided to affiliates and third parties without consumer consent. The information security issue, which arose when the Chinese generative artificial intelligence (AI) DeepSeek collected personal information in its entirety and handed it over to ByteDance, is gaining traction as a potential risk spreading to Chinese home appliance companies entering the domestic market.

On the 19th, Asia Economy compared the 'Privacy Policies' related to robot vacuum cleaners of four companies: Chinese robot companies Roborock and Ecovacs, and domestic Samsung Electronics and LG Electronics. The comparison revealed that the standards regarding the possibility of sharing and distributing personal information, the specification of providers, and security measures differ between Chinese and Korean companies.

According to Roborock's privacy policy, customer personal information can be shared with affiliates or other service providers. While Ecovacs, Samsung Electronics, and LG Electronics require customer consent when sharing personal information, Roborock states that it can collect and use personal information without customer consent within the scope permitted by the data protection laws of the respective country. Additionally, Roborock did not specifically disclose the affiliates and third-party service providers with whom personal information can be shared.

Roborock's Robot Vacuum Cleaner Products, Photo by Roborock

On the other hand, Samsung Electronics allows sharing personal information only in cases such as ▲settlement of fees for paid services ▲processing into a form that cannot identify specific individuals for statistical or academic research purposes ▲when the user has given prior consent. The companies receiving personal information are also specifically listed in the guidelines. LG Electronics clearly discloses the companies that can receive information, the purposes, items, and retention periods through its ‘ThinQ’ application.

Chinese companies are showing strong performance in the domestic robot vacuum cleaner market. As of the first half of 2024, Roborock holds a 46.5% market share, ranking first. Especially in the premium market for robot vacuum cleaners priced over 1.5 million KRW, it holds a 65.7% share, demonstrating strength in the premium segment as well. Given its high market share, concerns about personal information protection issues are growing more serious.

Experts point out that the lack of clarity regarding the providers of personal information and the possibility of using information without customer consent could act as security risk factors. Robot vacuum cleaners have functions to recognize indoor environments through cameras and sensors and learn the internal structure and furniture layout of homes, which poses a risk of external intrusion such as hacking. If such data is arbitrarily shared with affiliates or third parties, there is a risk of violating consumers' privacy.

Professor Park Chunsik of the Department of Information Security at Seoul Women’s University said, "Chinese companies may follow local laws, but our country's laws prohibit collecting and sharing information without consumer consent," adding, "It should not be regulated that way internationally." He continued, "Guidelines to protect Korean consumers need to be established," and emphasized, "It is necessary to clearly inform users in our country about the possibility of personal information leakage and collection."

Cases of camera hacking of Chinese-made robot vacuum cleaners have already been reported. In 2022, a hacker remotely manipulated the vacuum cleaner’s camera to leak photos of the user's home interior, continuously raising security concerns about Chinese-made Internet of Things (IoT) devices.

There is also a possibility that the Fair Trade Commission (FTC) or the Personal Information Protection Commission (PIPC) will review Roborock’s terms and conditions. If refund or after-sales service (AS) policies disadvantage domestic consumers or if personal information protection regulations are violated, the FTC or PIPC may intervene. Previously, the FTC corrected Apple and Google's mandatory in-app payment clauses and unfair AS terms of Samsung and LG Electronics. Roborock, which uses smart home devices, could also be subject to regulation if it collects user data without permission or provides it to third parties.

A Roborock representative explained regarding the terms, "Personal information is stored and processed through a data center in the United States and is not transmitted to China." They added, "However, since there is currently no separate notice regarding personal information management, we are considering adding additional notations."

Domestic companies are emphasizing enhanced security as a differentiating factor. This trend is expected to strengthen further as consumers’ security awareness increases. Samsung Electronics highlights its proprietary security system 'Knox' as a strength. A company representative said, "We pay a lot of attention to security every time we launch a product," and added, "We have a competitive edge over Chinese companies in terms of security."

LG Electronics also applies its proprietary security systems 'LG-SDL' and 'LG Shield' to its products. An LG Electronics representative explained, "We apply security processors throughout the product lifecycle, from development to post-launch," and added, "We have strict regulations, including obtaining security certifications from nationally accredited certification bodies."

An industry insider advised, "Since robot vacuum cleaners freely roam inside homes and collect data, security issues are even more important," and recommended, "Consumers should now consider security as an important purchasing criterion alongside price and performance."