Personal Information Protection Commission

Press Release

The PIPC Issues Recommendations on Robot Vacuum Makers 

- The PIPC conducted fact-finding reviews of personal data processing practices done by five major robot vacuums 

- The PIPC issued recommendations on the areas requiring improvement identified during its fact finding reviews

September 14, 2026

(This is an unofficial translation of a press release, originally prepared in Korean.)

The Personal Information Protection Commission (PIPC) said that personal information processed by major robot vacuum brands available in Korea, including video, voice, photos, and map information, is generally handled safely during collection and transfer, based on its fact-finding reviews. Under Article 63-2 of the Personal Information Protection Act (PIPA), where a data controller fails to comply with the PIPA, the PIPC may have its public officials enter the relevant premises and inspect the status of business operations, particularly for personal data processing practices. If the PIPC identifies violations during such inspections, it issues recommendations for correction. The PIPC may also issue recommendations for improvement in areas where it identifies practices that should be improved.

However, the reviews identified some areas that require improvement as stipulated in the PIPA, including:

● How to collect and use personal information and obtain user consent 

● Providing information on cross-border transfers and relevant notification 

● Designating a domestic agent, an obligation for foreign business operator who have established a corporation in Korea 

● Putting safeguards in place

The PIPC guided robot vacuum makers to voluntarily improve the identified areas, and most have addressed the privacy concerns raised during the fact-finding reviews, though some have not taken the necessary measures.

A robot vacuum provides remote controls, obstacle recognition, video check, voice commands, and other various features. When providing these services, its camera, mic, or sensors can collect or use video feeds, voices within the house, floor maps, and other information closely connected to living spaces, requiring careful management.

The reviews covered the latest models sold in Korea by Roborock, Samsung Electronics, LG Electronics, ECOVACS, and Xiaomi, as of March 2025 to see how video, voice, photographs and floor map information are collected, transferred, and used and focus on examining whether they pose any privacy risks.

The PIPC's fact-finding reviews found no significant privacy risks in the collection, transfer, or storage of the video, voice, photo, and floor map information examined, but they identified areas for improvement related to user notifications and compliance.

The following explains the PIPC's recommendations on five major robot vacuums available in the Korean market. 

1. Clarifying information on the legal basis for data processing in an easy-to understand manner

Some robot vacuum makers did not clearly distinguish between personal information processed without consent, such as when it is necessary to enter into a contract or perform a contract. The PIPC guided businesses to revise their privacy policies to clearly distinguish the legal basis of each type of processing to ensure a better understanding for users. 

2. Greater user choice in the collection and use of personal information for service improvement purposes

In some cases, personal information was collected and used for service development without giving users other choices. The businesses have improved their practices to allow users to decide whether to give consent to the collection and use of their personal information for such purposes in advance.

3. More specific information on cross-border data transfers and retention periods 

In some privacy policies, businesses failed to disclose cross-border data transfers despite using overseas data centers. Some businesses describe the retention period too broadly by saying " until the purpose for which it was collected has been fulfilled". The businesses were asked to provide specific information about cross-border data transfers and how long they retain users' personal information.

4. Designating a domestic agent and notifications 

The reviews identified cases in which foreign business operators had not properly designated a domestic agent or had designated an agent that has no establishment in Korea. To meet PIPA requirements, the PIPC requires businesses to designate agents with an establishment in the jurisdiction and disclose the name, address, contact information, and other necessary information of a domestic agent in their privacy policies.

5. Stronger access controls and other security measures

The PIPC also reviewed procedures for granting, changing, and revoking access authority for those who handle personal information, as well as the management of access logs, and required businesses to improve these practices. Some businesses fell short in implementing access controls and encrypting data in transit. The latest models have addressed these shortcomings, and other models are in development to further improve them. 

*The retention period for granting access authority has been extended from 200 days to 3 years, and access logs from 90 days to 2 years. 

The PIPC plans to issue recommendations for areas that still require improvement and monitor the results of the measures taken. The PIPC will also assess privacy risks around new features in the latest robot vacuum models available in the domestic market in the second half of this year.

Moreover, rapid advancements in artificial intelligence (AI) and the Internet of Things (loT) have expanded the scope and types of personal information being processed by home appliances. Against this backdrop, the PIPC will establish a Technical Analysis Center designed to demonstrate and analyze privacy threats posed by new and emerging services and products. Building on the center's establishment, the PIPC will take a prevention focused approach to products and services closely related to people's day-to-day lives by preemptively examining and improving personal data processing practices.

* A PDF file, formatted for better readability, is attached.