Privacy Tools Guide

Smart Doorbell Privacy Risks and Mitigations

Smart doorbells record every person who approaches your home, analyze their movements, and upload that footage to vendor cloud servers. Ring, Google Nest Hello, and similar devices have become household-scale surveillance infrastructure with a well-documented history of data sharing with police, security researchers, and their own employees. This guide breaks down the specific privacy risks and gives you actionable mitigations.

The Data That Smart Doorbells Collect

A typical cloud-connected smart doorbell captures:

Law Enforcement Access

Ring’s history with law enforcement is the most thoroughly documented case of video doorbell surveillance creep:

Google Nest Hello has a similar policy structure. Eufy was found in 2022 to upload facial recognition data and video stills to AWS despite claiming all data was local.

The Neighbors App Problem

Ring’s Neighbors app aggregates footage and crime reports from your Ring device along with your neighbors’ devices. By using the doorbell, you’re opting into:

This cannot be fully opted out of while using Ring’s cloud infrastructure.

How Vendor Employees Have Accessed Footage

In 2019, a Ring security team in Ukraine was found to have had access to customer camera footage. This was framed as a quality assurance access but operated without meaningful oversight. Multiple Ring engineers were fired for accessing ex-partners’ camera footage.

This is not unique to Ring — any cloud-stored video has an access control problem that only end-to-end encryption can solve.

Mitigations

Option 1: Replace with a Local-Storage Device

The cleanest mitigation is replacing a cloud device with one that stores locally:

Recommended devices:

Configure local NVR storage:

# Example: Add a camera to a local NVR via RTSP
# Using Frigate (open-source NVR) with Home Assistant

# /opt/frigate/config/config.yml
cameras:
  front_door:
    ffmpeg:
      inputs:
        - path: rtsp://admin:password@192.168.1.50:554/h264Preview_01_main
          roles:
            - detect
            - record
    detect:
      width: 1920
      height: 1080
      fps: 5
    record:
      enabled: true
      retain:
        days: 14
        mode: motion

Option 2: Block Cloud Uploads at the Router

If you’re keeping a cloud doorbell, firewall it from phoning home:

# On OpenWrt router — block Ring cloud endpoints
# First, identify Ring's server IP ranges
# Ring uses Amazon CloudFront and AWS US-East-1

# Create a firewall rule for the doorbell's IP (e.g., 192.168.1.100)
uci add firewall rule
uci set firewall.@rule[-1].name='Block Ring Cloud'
uci set firewall.@rule[-1].src='lan'
uci set firewall.@rule[-1].src_ip='192.168.1.100'
uci set firewall.@rule[-1].dest='wan'
uci set firewall.@rule[-1].target='REJECT'
uci commit firewall
/etc/init.d/firewall restart

Note: blocking cloud access disables real-time alerts, remote viewing, and voice assistant integration. You get privacy but lose functionality.

Option 3: VLAN Isolation for IoT Devices

Isolate all smart home devices on a separate VLAN that cannot communicate with the rest of your network:

# Assuming you have a managed switch (e.g., TP-Link TL-SG108E)
# Create VLAN 20 for IoT devices
# Tag the uplink port with VLAN 20
# Untagged VLAN 20 on IoT device ports

# On pfSense/OPNsense router — create firewall rules:
# IoT VLAN -> LAN: BLOCK all
# IoT VLAN -> WAN: ALLOW only required ports (443 for basic function)
# LAN -> IoT VLAN: BLOCK (no internal access to IoT devices from your PC)

VLAN isolation means even if the doorbell is compromised, it can’t reach your NAS, computers, or other devices.

Option 4: Audit What Your Doorbell Sends

Monitor actual traffic to understand the data flow:

# Use tcpdump to capture doorbell traffic
# Assign the doorbell a static IP first (192.168.1.100)

sudo tcpdump -nn -i eth0 src host 192.168.1.100 \
  and not dst net 192.168.0.0/16 \
  -w /tmp/doorbell-traffic.pcap

# Let it run for 30 minutes including a doorbell press

# Analyze unique destinations
tcpdump -nn -r /tmp/doorbell-traffic.pcap | \
  awk '{print $5}' | \
  sort -u | \
  grep -v "^192\." | \
  while read addr; do
    host "${addr%.*}" 2>/dev/null | grep "domain name"
  done

In many jurisdictions, recording audio in two-way conversations without notice is a wiretapping violation. Two-way smart doorbells that record audio of visitors without posting a notice may violate:

A visible notice (“Video and audio recording in use”) is the minimum compliance step. This doesn’t change the data practices — it’s a legal CYA.

Built by theluckystrike — More at zovo.one

Explore Our Developer Guides

© 2026 theluckystrike Developer Guides