Is Aqara safe? Privacy, police requests & security record
Facts last verified · Every claim is linked to its source · Methodology
Answer: Aqara: 2 qualifying incidents in our tracker since Oct 2021; police requests: discretionary; privacy policy: qualified. Highest-scoring device we track: Aqara Smart Video Doorbell G4 (43/100).
Aqara devices we track
| Device | Score | Offline | Local storage | Home Assistant | RTSP/ONVIF | Subscription | Account |
|---|---|---|---|---|---|---|---|
| Aqara Smart Video Doorbell G4Doorbell · Battery or wired | 43 | Partial | Yes | Community only | No | Not needed | Unverified |
| Aqara Camera Hub G3Camera · Plug-in (USB-C), Wi-Fi | 43 | Partial | Yes | Community only | Unverified | Not needed | Unverified |
Police & law-enforcement requests
Discretionary US privacy policy: discloses to law enforcement "if required or permitted to do so by law or legal process", and may disclose to prevent physical harm. No warrant requirement or user notice stated.1 Compare companies
Privacy policy: selling or sharing data
Qualified App policy: "We do not sell any personal information to third parties"; the US website policy shares data with advertising providers for personalized ads (opt-out offered).21
Security incidents, vulnerabilities & regulator actions
What counts is set by our incident inclusion rule; entries before Oct 2021 are listed but not scored.
| Date | Company | What happened | Type |
|---|---|---|---|
| Jun 2026 | Aqara | runZero published CVE-2026-50083 (NVD CVSS 9.8) and related flaws in Aqara's cloud login and API services, including hardcoded OAuth credentials that could be chained to take over accounts and devices. Aqara said the issues were fixed in April 2026.34 | Serious vulnerability |
| Dec 2025 | Aqara | CVE-2025-65294 (CVSS 9.8): researchers documented an undocumented remote command-execution mechanism in Aqara hubs and camera hubs. Their regression testing reports it removed from the Camera Hub G3 but still present in the G4 doorbell firmware they tested.56 | Serious vulnerability |
Informational only, not legal advice. Found an error? Tell us.
Sources
- Aqara US Privacy Policy · checked Oct 22, 2026
- Aqara Home app privacy policy (non-EU) · checked Oct 22, 2026
- NVD: CVE-2026-50083 (Aqara cloud hardcoded OAuth credential) · checked Oct 22, 2026
- runZero advisory: Aqara hardcoded OAuth client credentials · checked Oct 22, 2026
- NVD: CVE-2025-65294 (Aqara hubs undocumented remote execution) · checked Oct 22, 2026
- Researcher write-up: Aqara undocumented remote execution (CVE-2025-65294) · checked Oct 22, 2026