Roborock’s privacy policy fuels data leak fears over Chinese goods

A new personal data processing policy from Chinese robot vacuum maker Roborock is raising fears that consumer data could be leaked to or misused by China, whose companies are rapidly expanding their footprint in the country.

On March 31, Roborock, short for Beijing Roborock Technology Co., added a line to its personal data processing policies, stating that data collected through its smartphone app may be processed in China.

The update also removed prior references to collecting Korean customer data at its US data center.

The change may not seem like a big deal. But it reverses its earlier stance.

Until February, the company, which commands about half of South Korea’s robot vacuum market, said no Korean customer data was transmitted to China to allay fears of data leaks.

DATA STORED ON SMARTPHONE APPS



Its vacuum cleaner users must install its app on smartphones and create an account to fully operate its wireless cleaning features, which would allow the Chinese consumer brand to collect their personal data.

If they do not agree to the contract or certain conditions, they must immediately stop using the app.

DATA SHARING WITH CHINESE INTERNET OF THINGS PLATFORM

The change has prompted Korean consumers to question whether their sensitive personal information is vulnerable to access by Chinese authorities.

They are also anxious that their private data could be shared under China’s Data Security Law, which requires companies to cooperate with government data requests made in the name of national security.

Roborock’s vacuums equipped with cameras may capture video footage from inside the home, aggravating privacy concerns.

According to Roborock’s latest privacy policy, the company may continue to retain data even if it is processed for purposes unrelated to its original collection, including activities for the public interest, scientific or historical research, or statistical analysis.

The policy also states that the company may share users’ personal information — including ID numbers, IP addresses and device details — with Tuya Smart, an Internet of Things cloud platform headquartered in Hangzhou, China.

Tuya, backed by Tencent Holdings, has become a target of increased scrutiny in the US.

In 2021, three US senators asked the Treasury Department to sanction Tuya, calling the Chinese company a national security threat that undermines US privacy.

To ease privacy concerns among Korean consumers, Roborock said its Chinese headquarters oversee data collection, but customer data is actually stored at Amazon data centers in the US.

The company added that sensitive data such as video footage and mapping information collected by its robot vacuums is encrypted and stored on the devices themselves, not on external servers.

Roborock vacuum, priced at 1 million won ($735 ) on average per unit, accounts for 46.5% of South Korea’s robotic vacuum cleaner market, which expanded to 500 billion won in market size in 2024.

In the high-end segment, or robot cleaners priced at 500,000 won or more, the Chinese brand controls 60-70% in the country.

Underscoring concerns over privacy violations by Chinese companies, AliExpress was fined 2 billion won, along with an additional penalty of 7.8 million won, for breaching South Korea’s privacy laws in 2024.

In May, Temu, another Chinese e-commerce platform, was penalized 1.37 billion won (about $1 million) in fines and an additional 17.6 million won penalty for transferring user data without consent, an investigation by South Korea’s Personal Information Protection Commission found.

NO DATA CENTERS IN KOREA


Korean privacy advocates urge the government to tighten personal data protection laws by making it mandatory for foreign companies operating in South Korea to store personal data on Korean customers at home.  

Industry observers say concerns over data privacy are likely to grow as more Chinese firms enter the Korean market. Most of them, like Roborock, do not operate data centers in South Korea.

Xiaomi established a Korean subsidiary in January, and BYD, the world’s largest electric vehicle maker, announced its official entry into Korea this year.

Huawei is also expanding its presence in the country's smartwatch and premium earphone markets.

Write to Ui-Myung Park, Jeong-Soo Hwang and Chae-Yeon Kim at uimyung@hankyung.com

Yeonhee Kim edited this article.