Arlo

Is Arlo safe?

Arlo is a solid camera system from a security point of view, with a privacy catch that depends on whether you pay. Every account needs two-step verificationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary, Arlo pays researchers on Bugcrowd to find bugs, and no regulator has fined or ordered it. But Arlo's App Store label is one of the few among home camera apps that admits using identifiers to track you, and its privacy notice says people without a subscription get interest-based ads inside the app. We score Arlo 60/100, level with eufy and above Ring at 57.

Arlo Technologies, listed on the New York Stock Exchange, was spun off from the router maker Netgear in 2018. By the end of 2025 it had about 12.1 million registered accounts, 5.7 million of them paid, its annual report says.

Does Arlo track you and show ads?

Yes, more than its rivals. Apple's label lists identifiers under "Data Used to Track You" and links identifiers to you for third-party advertising. Contact info, identifiers and usage data are linked for Arlo's own marketing, and location, contact info, user content and identifiers for app functions. Google Play's data safety section says device IDs, app interactions, user IDs, crash logs and approximate location may be shared with other companies.

The privacy notice, last updated in September 2024, explains why. Arlo works with "first-party and third-party advertisers, ad-networks, and analytics providers" that use SDKs and cookies to target ads "on our apps, on our website, and across the internet". For cross-context advertising it may share account, device, usage, location and billing information, and it accepts that under some state laws this "may be considered a 'sale'". Paying subscribers are opted out of interest-based in-app ads automatically. Everyone else has to opt out in the Privacy Center or by email, and may still see general ads.

How secure are Arlo cameras?

Accounts are well protected. Arlo says it requires two-step verificationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary, by push notification to a trusted phone, text message or email. A trusted browser stays signed in for up to 14 days, and you can keep up to five trusted devices or contacts. There is no authenticator app option, but push approval is stronger than an SMS code.

Video is protected with AES encryption and TLS between the camera, base station and cloud, according to Arlo's help pages. Those pages do not claim end-to-end encryptionEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary, the kind that keeps the company out of your footage, which Ring offers as an option.

The hardware record is mixed but old. Early Netgear-era base stations and Arlo Q cameras had a default password of 12345678 (2016). In 2019 researchers found a network misconfiguration and a hard-coded root login on base stations, and in 2021 Arlo fixed hard-coded SSH credentials on the Q Plus that needed physical access. Arlo's advisory page lists six notices since 2018, the latest about the 2021 Log4j bug, and its 2025 annual report concedes it has "not always been able in the past" to find and fix every vulnerability. We found no breach of customer accounts.

Face recognition and AI training

Arlo's Person Recognition, where available, collects face images and face prints to tell you who is at the door. It is off unless you turn it on, and the notice warns that some places require you to tell people your camera may recognise them and get their consent, including parents' consent for under-18s. Separately, you can donate individual recordings to Arlo, which may view them and use them to train its AI. Neither happens without your choice, but the people filmed have no say.

How to set up Arlo more privately

1. If you do not pay for Arlo Secure, open the Privacy Center and opt out of interest-based in-app advertising.
2. Use push approval on a trusted phone for two-step verificationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary instead of text messages, and remove old trusted devices.
3. Leave Person Recognition off unless everyone your camera records has agreed to it.
4. Do not donate videos that show other people's faces, children or the inside of your home.
5. Point cameras away from neighbours' windows and gardens, and delete recordings you no longer need.

How we scored it

The regulatory record (86) is Arlo's strongest factor: no regulator has acted against it, though none has examined it closely either. Privacy (45) is its weakest, because the App Store label admits tracking and the policy shares data for cross-context ads, with targeted in-app ads switched on for free users. Security (60) credits required two-step login and a paid bug bounty, but there is no end-to-end option and the hardware has a history of default and hard-coded passwords.