What spyware is
The Federal Trade Commission describes spyware, also called stalkerware, as an app someone installs on your phone or another device without your knowledge. Once it's there, it can track your location, turn on the microphone, read your messages and see your photos and videos (FTC).
NIST, the US standards agency, gives two definitions. The main one is software secretly installed to gather information on people. An older one is broader: a program that collects information and “periodically communicates back to its home site”.
A cloud camera does that second thing all day long, so it's fair to ask where the line is.
- Track your location
- Turn on the microphone and record calls
- Read your texts and emails
- See your photos and videos
- Watch what you do online
“A program embedded within an application that collects information and periodically communicates back to its home site.”
A cloud camera does exactly this: it collects video and sends it back to the maker's servers.
What isn't spyware: the four-question test
A camera you bought, installed and can switch off doesn't match the FTC's description, because you know it's there. Whether it can be turned against you depends on who else gets the video. Ask these four questions about yours:
- 1
Did everyone know it was recording?
You did. Guests, neighbors and delivery drivers usually didn't.
- 2
Who holds the key?
If the maker can unlock your video on its servers, so can anyone who gets into those servers.
- 3
Where does the video go?
The maker picks the servers, and the country they sit in decides who can demand the video.
- 4
Can you see and change who has access?
Look for settings for shared users, face recognition and deleting clips. An app that hides them is a warning sign.
-
Spyware
Someone installs it on your device without your knowledge, and it reports to them. That's the FTC's description.
-
Camera with open staff access
Before September 2017, every Ring employee and hundreds of contractors could watch any customer video, the FTC says.
-
Standard cloud camera
The maker can unlock your video on its servers to run features like person alerts and face recognition.
-
End-to-end encrypted
Only your enrolled phones can open the video. The maker still sees when events happen.
-
Local only
The video stays on a memory card or recorder inside your home.
How your live video reaches your phone
Pick a setup to see the path your video takes and where it can be read on the way.
Standard cloud camera
Most cloud cameras out of the box. The video is encrypted on the way and in storage, and the maker holds the keys.
Your camera
Records and compresses the video, then sends it out of the house.
Your router
Blocks connections that start on the internet, so the camera keeps a line open to the maker.
The maker's servers
Relay, cloud recordings and AI features such as person alerts and face recognition.
Video can be unlocked hereYour phone
Anywhere in the world. It asks the servers for your camera by its device ID.
Who else can reach it: Anyone who can get into those servers can reach readable video: staff and contractors with access, hackers who break in, police with a legal request, and the government of the country the servers sit in.
End-to-end encrypted
An option on some cameras, such as Ring, and how Apple HomeKit Secure Video works. Only your own devices hold the key.
Your camera
Locks each clip before it leaves the house.
Your router
Same as before: the camera keeps a line open to the maker.
The maker's servers
Still relay and store the video, but only as locked files. Cloud AI features stop working.
Locked video, but timing is visibleYour phone
Holds the only key. Ring says no one else, including Ring services, can view the video.
Who else can reach it: Anyone who gets into those servers finds locked files. The maker still sees when motion happened, when you changed modes and when you opened the app.
Local only
Cameras that record to a memory card or a recorder in your home and work without the cloud.
Your camera
Records inside your home network.
Recorder or memory card
Keeps the clips in your house, not on a company server.
Your phone, at home
Watches over your own Wi-Fi.
The maker's servers
Not needed at home. Watching from outside often goes back through the maker’s relay, so check how yours connects.
No copy on a company serverWho else can reach it: Nothing is stored on a company server, so there is nothing there to hand over. Someone with access to your recorder, or your home network, can still reach it.
The camera calls out
Home routers block connections that start on the internet. So the camera opens a connection to the maker's server and keeps it open, waiting.
Your phone asks for it by ID
Every camera has a device ID, often printed on a sticker. The app sends that ID to the server, which finds your camera's open line.
The server connects you, or carries the video
Sometimes the server introduces your phone and camera so they talk directly, called peer-to-peer. When that fails, the video passes through the server, called a relay.
Clips go to the cloud
Motion clips are uploaded and kept for as long as your plan allows, so the video sits on the maker's servers long after you watched it live.
The AI runs on those servers
Person alerts, video descriptions and face recognition need the server to see the picture. Ring's own page lists 16 features that stop working when you turn on end-to-end encryption, including Familiar Faces, Video Search and Smart Alerts (Ring, its own page).
When a device ID is the only lock
NIST's vulnerability database says devices using iLnkP2P, a connection service from Shenzhen Yunni Technology, got device IDs that were predictable enough for remote attackers to connect directly to any of them. In 2021, the US cybersecurity agency CISA warned that a flaw in ThroughTek's Kalay P2P software, supplied to IP camera makers, could expose camera audio and video feeds.
“Encrypted” can mean two things
“Encrypted in transit and at rest” protects your video from outsiders on the way and in storage, while the company keeps the keys. “End-to-end” means only your devices hold them. Apple says HomeKit Secure Video analyzes clips on your home hub and encrypts them before upload, without exposing the video to Apple. Ring offers end-to-end encryption as an option you have to turn on.
Can your stream end up on a server in China?
Yes. The camera maker, or the company that runs its app and relay service, decides where the servers are, and some of those companies are in China. The iLnkP2P service in NIST's warning comes from a company in Shenzhen.
The US National Counterintelligence and Security Center points to two Chinese laws from 2017. It says the Cybersecurity Law “requires data stored in the PRC to be accessible to its intelligence services”, and the National Intelligence Law says citizens and private organizations must assist the Ministries of Public Security and State Security in intelligence work (NCSC bulletin).
In 2022, the FCC banned new authorizations for Chinese telecommunications and video surveillance equipment it judged an unacceptable risk to national security. Its Covered List still names the camera makers Hikvision and Dahua, for uses such as public safety, government buildings and critical infrastructure (FCC Covered List).
So if your camera's video passes through a server in China, every face that walks up to your door can be stored in a country whose government can demand it. Nobody there may ever open your clips, and you would have no way to know if they did.
Who can reach a video once it's on a server
These have all happened to real camera owners. Ring settled the FTC's case in 2023, agreeing to pay $5.8 million for customer refunds (FTC).
- 1
The company’s own staff
Between June and August 2017, a Ring employee viewed thousands of recordings belonging to at least 81 women, picking cameras with names like “Master Bedroom” and “Master Bathroom”, the FTC says. A co-worker reported him. Ring had no technical way to catch it.
- 2
Contractors abroad
Before September 2017, Ring gave hundreds of third-party contractors in Ukraine full access to every customer video, and all of it was stored unencrypted on Ring’s network, according to the FTC.
- 3
Hackers
From January 2019 to March 2020, attackers got into the Ring devices of more than 55,000 US customers using stolen and guessed passwords (FTC). New York’s attorney general found that some eufy live streams could be opened by anyone with the right web address, without logging in.
- 4
Police
In December 2025, 2,723 law enforcement agencies were on Ring’s platform for requesting footage from its users. In 2022, Ring said it had given police video without the owner’s consent 11 times that year, under an emergency exception (Senator Markey).
- 5
A government
When the servers are in China, US counterintelligence says Chinese law requires data stored there to be accessible to the country’s intelligence services (NCSC).
Your face is in every clip
Everyone who comes up your path gets recorded: delivery drivers, neighbors, friends and strangers. Each clip holds a clear picture of their face, and you're on other people's cameras in exactly the same way.
In December 2025, Ring released Familiar Faces, which recognizes people and names them in alerts. Ring says it's off by default and the face profiles are stored in its cloud, not on the doorbell. Once it's on, anyone whose face is clearly visible gets added automatically, and unnamed faces are deleted after 30 days without a match.
What a Senate probe found
- Ring's privacy protections cover device owners, not the people walking past.
- Someone who wants their face data deleted has to ask each doorbell's owner, one home at a time.
- Owners can keep tagged face scans indefinitely.
Senator Edward Markey, December 10, 2025
Where the law switches it off
- Illinois
- Texas
- Portland, Oregon
- Quebec
Ring says Familiar Faces isn't offered in these places “due to specific legislation”. Illinois and Texas have biometric privacy laws.
The backlash
In February 2026, after a Super Bowl ad showed Ring cameras finding lost pets, Senator Markey asked Amazon again to drop face recognition from Ring doorbells. That same week, Ring said it would end its partnership with Flock Safety. Ring's support pages still describe Familiar Faces today.
A clip that someone posts publicly, on a neighborhood app or social media, is out of the camera company's hands from then on. Public photos are what face search engines collect, and keeping your face out of those engines is the part FacePrivacy works on.
Is your camera telling the company when you're home?
Yes, and mostly because you told it. Ring's privacy notice, last updated June 5, 2026, lists what it collects. Read in order, it works like a schedule of your day:
- You tell them where you live. Your postal address, and the location where you install the camera.
- Your phone tells them where you are. The geolocation of your mobile device, if you allow it.
- Your camera tells them what happens. Motion and other events, plus your Wi-Fi network and its signal strength.
- Your settings tell them when you’re out. Ring’s modes include Home and Away. Its paid Virtual Security Guard, where outside agents watch your live view, only runs in those modes.
- Your recordings show the rest. Video and audio recordings, live streams and images.
A day in your event log
An example, not a real customer's history
- Front DoorMotion, person detected
You leave for work.
- ModeChanged to Away from your phone
The house is now marked empty.
- Front DoorPackage delivered, person detected
A driver’s face is saved in your history.
- BackyardMotion
Nobody is home to check.
- ModeChanged to Disarmed
You’re back.
- Living RoomLive view opened
You look around before bed.
Put those entries side by side and anyone with access to the account or the servers can see when the house is empty, every day of the week.
Who else can get that record
Ring says it shares data when the law or legal process requires it, such as a court order or a subpoena. Police can also ask owners for footage through Ring's platform, and in emergencies Ring has handed video over without asking the owner.
What encryption leaves visible
End-to-end encryption locks what the video shows. The company still sees when events happen, when you change modes and when you open the app.
Who can see your video, setup by setup
| Setup | Where the video goes | Can the company watch it? | Worth knowing |
|---|---|---|---|
| Ring, standard settings | Ring's cloud | Its servers can read it to run AI features, which stop once you turn on end-to-end encryption | Familiar Faces (face recognition) is available |
| Ring, end-to-end encryption on | Ring's cloud, locked | No. Ring says only your enrolled phones can view it | Turns off 16 features, including Familiar Faces, Video Search and Shared Users |
| Apple HomeKit Secure Video | Your home hub, then iCloud, locked | No. Apple says clips are analyzed on the hub and encrypted before upload | Needs an Apple home hub and an iCloud+ plan |
| Local-only camera | A card or recorder in your home | Only if you connect it to the maker’s cloud | Viewing from outside may still go through a relay |
| Unknown cheap camera | Wherever its app and relay company chose, which can be China | You can’t tell without the privacy policy | Read the policy and check the developer first |
Ring and Apple details are from each company's own support pages, checked November 7, 2026.
How to keep your camera working for you
- 1
Keep cameras out of bedrooms and bathrooms.
The worst cases in the FTC's Ring complaint came from cameras in those rooms.
- 2
Turn on end-to-end encryption.
On Ring it is an option in the app, and it switches off cloud features such as Familiar Faces and Video Search. HomeKit Secure Video works this way already.
- 3
Prefer local storage.
A camera that records to a memory card or a recorder keeps clips off someone else’s servers.
- 4
Check who runs the app before you buy.
The App Store or Google Play listing names the developer. Read the privacy policy for where video is stored, and look the maker up on the FCC Covered List.
- 5
Lock the account.
Use a password you use nowhere else and turn on two-factor authentication. The 2019 to 2020 Ring break-ins used stolen and guessed passwords.
- 6
Switch off what you don’t use.
Face recognition, location access and old shared users. Check the list every few months.
- 7
Update or replace.
Install firmware updates, and retire cameras the maker no longer supports.
- 8
Keep clips for less time.
If your app or plan lets you choose how long clips are kept, pick the shortest period that still works for you, and clear old event history.
Common doubts
“So is my Ring doorbell spyware?”
Not by the FTC's description, because you installed it knowingly. With standard settings, though, Ring's servers can unlock your video to run its AI features. With end-to-end encryption on, Ring says only your enrolled phones can view it.
“Is every cheap camera sending video to China?”
No. Some do, through apps and relay services run from there. Check the developer named in the app store and the privacy policy before you buy, and skip any brand that won't say where your video is stored.
“Does end-to-end encryption hide when I'm home?”
No. It hides what the video shows. The company still sees when events happen and when you switch between modes like Home and Away.
“Can FacePrivacy remove my face from someone else's camera?”
No. Clips on a private camera are up to the person who owns it. We file opt-out requests with the face search engines we support and re-file them as necessary, so those engines are asked to stop showing your face in their results. Results depend on each engine.
Keep your face out of face search.
Upload two photos. We file opt-out requests with the face search engines we support and re-file them as necessary. US$9.99 a month, or US$7.99 a month billed annually, and you can cancel from your dashboard whenever you like. Web payments made through Stripe carry a 30-day money-back guarantee.
Opt my face out of face search →Facts in this post come from the Federal Trade Commission (its 2023 complaint against Ring, the settlement and its guidance on stalkerware), NIST (its spyware definitions and the National Vulnerability Database entry CVE-2019-11219), CISA (advisory ICSA-21-229-01), the National Counterintelligence and Security Center, the Federal Communications Commission (its November 2022 order and the Covered List as of November 6, 2026), the New York Attorney General (January 2025 eufy settlement) and Senator Edward Markey's office (July 2022, December 2025 and February 2026). How Ring's encryption, Familiar Faces, Virtual Security Guard and data collection work comes from Ring's own support pages and privacy notice, and the HomeKit Secure Video details come from Apple's Platform Security guide. All were checked on November 7, 2026.