Companion Robot Guest Mode Checklist: 17 Household Consent and Privacy Tests
A practical framework for introducing a camera- and microphone-equipped companion robot to guests, children, carers and shared households without hidden recording or uncontrolled access.
Quick answer
A safe guest mode should clearly announce when cameras, microphones and cloud services are active; disable personal memories and purchases; limit movement and permissions; and let a guest decline interaction without losing access to the room. Before visitors arrive, test the indicators, network isolation, emergency stop and data retention. If the product cannot explain or constrain recording, power it down or move it out of the shared space.
This independent guide provides general consumer safety and privacy information. The manufacturer, qualified service provider and relevant authorities control decisions for a specific device.
1. Map the people and spaces affected
List household members, children, visitors, carers, cleaners, contractors and remote participants who may enter the robot’s sensor range. Mark bedrooms, bathrooms, changing areas, work calls and other spaces where observation would be unexpected. Consent from the purchaser does not automatically cover everyone nearby. A useful map states when the robot is present, which sensors can reach each area and who can pause or remove it without asking the account owner.
2. Identify every active sensor and indicator
Use the manual and a physical inspection to inventory cameras, microphones, depth sensors, thermal sensors, touch inputs, presence detection, speakers and remote-operation channels. Test each recording or streaming indicator in daylight, darkness and mute states. Decorative lights are not meaningful disclosure unless the documentation defines them. If a sensor can operate without a visible or audible cue, treat that as a design limitation and compensate with placement, shutters, power isolation or non-use.
3. Write a plain-language household rule
Create a short notice describing what the robot senses, why it is used, whether information leaves the home, how long it remains and who can review it. Avoid legalistic acceptance screens that guests never see. Place the notice before the sensor boundary, not after a person is recorded. Include an easy alternative: another room, a physical cover, local-only mode or shutdown. Consent must remain meaningful when someone declines.
4. Build a minimal guest profile
A guest profile should not expose the owner’s conversation history, contacts, calendar, purchases, location routines or biometric preferences. Disable personalization unless the guest actively requests it. Use temporary identifiers and automatic expiry where available. Never create face or voice recognition templates merely to make a short visit more convenient. Record exactly what the vendor means by “guest”; some products only change the interface while continuing cloud collection under the owner account.
5. Separate the robot from trusted household systems
Connect the robot or demonstration device to an isolated IoT or guest network when the router supports it, following the product’s requirements. Do not expose file shares, printers, cameras or administrative interfaces to a visitor profile. CISA recommends separating guest and smart-device access from primary household activity. Network isolation does not replace product updates or strong credentials, but it limits the damage from a compromised app or careless pairing request.
6. Disable purchases and consequential actions
Turn off shopping, subscription changes, door controls, calls, messages, vehicle commands and account recovery from guest mode. Require the owner’s separate confirmation for any high-impact action. Voice similarity, background television and playful commands can trigger unexpected behavior. A guest should not be able to spend money, reveal a schedule, unlock a door or change a safety setting simply because the robot recognizes natural language.
7. Constrain movement and physical interaction
Define a safe operating zone, low-energy mode and clear stop command before guests enter. Demonstrate the physical emergency stop to adults responsible for the room. Do not assume a child, older visitor or pet interprets robot motion like a trained owner does. Disable autonomous following or touching unless everyone affected understands and accepts it. Keep charging docks, cables and moving joints away from walkways and mobility aids.
8. Test microphone mute and camera covers
Activate hardware mute or shutters, then verify through the app and a real interaction test that audio, video, wake-word processing and remote viewing are unavailable. Software icons alone may show preference rather than physical isolation. If the product lacks hardware controls, document that limitation and use a switched outlet or remove the device for sensitive conversations. Never promise privacy that the available controls cannot demonstrate.
9. Control remote access and teleoperation
Review every administrator, paired phone, web session and support channel that can view sensors or move the robot. Require strong authentication and remove stale access. Tell guests when a remote operator or support technician is present; a moving machine may appear autonomous when a person is actually controlling it. Save logs of authorized remote sessions without retaining intimate room content. Unexpected remote movement should trigger shutdown and an account review.
10. Set retention and deletion before the visit
Choose the shortest available retention for guest interactions, diagnostic logs and media. Know whether deletion removes local copies, cloud copies, transcripts, model-training contributions and backups. Provide a route for a guest to request deletion and record completion. NIST’s IoT privacy guidance emphasizes lifecycle risks; waiting until after an uncomfortable event makes it harder to distinguish what was captured and where it traveled.
11. Protect children and people needing assistance
Use adult supervision and age-appropriate explanations. Do not ask a robot to keep secrets, provide sole supervision, make medical decisions or pressure a child to continue interacting. Disable contacts, purchases and unrestricted web responses. For a carer or supported person, identify who can consent, who can pause the device and how recordings intersect with dignity and professional duties. Product entertainment features do not convert a companion robot into a qualified caregiver.
12. Run a refusal and failure drill
Ask one person to decline interaction, mute the device, leave sensor range and request deletion. Test loss of internet, a wrong wake word, an unknown face, an unauthorized pairing attempt and emergency stop. Record whether guest mode fails closed or quietly falls back to the owner profile. A feature is trustworthy only when its limits are visible under imperfect conditions, not merely during a scripted demonstration.
13. Close the guest session completely
At the end, sign out temporary users, expire pairing codes, remove shared media, review purchases and integrations, clear retained interactions and return sensors to the household’s documented baseline. Tell the guest what was deleted and what the vendor may still retain. If something cannot be verified, state that plainly and open a support request. Do not leave a temporary account active because another visit might occur later.
How to record the result
Use a dated worksheet with one owner for each unresolved item. Mark every check pass, fail, not applicable or unknown; never convert unknown into pass. Attach the exact model, hardware revision, software version, source links and support references. Keep intimate recordings, passwords and access tokens out of the worksheet. Restrict the robot whenever battery condition, emergency stop, account control, privacy indicators or remote access cannot be verified.
This process does not certify a product or promise that every vendor implements the named controls. Its purpose is to turn vague confidence into an auditable decision and to reveal where model-specific evidence is missing. Recheck after repairs, account transfers, major updates or a change of household.
Evidence boundaries and an independent second review
This checklist can establish that a careful process was followed, but it cannot independently prove how a vendor handles encrypted backups, replicated cloud records, model-training datasets, dormant administrator access or undisclosed hardware behavior. A local screen, a support email and an account dashboard each describe only part of the system. Record which layer produced every piece of evidence and avoid broad conclusions such as “all data is gone” or “the robot is safe” when the check covered only one device, one account or one moment.
Use a second reviewer for any handover, restart or storage decision involving children, shared households, remote operators, damaged batteries, disputed ownership or intimate recordings. The reviewer should be able to reproduce the critical checks from the written record without using the original operator’s memory. Ask that person to confirm the exact model, inspect the physical condition, compare the documented settings with the current interface, test the stop and privacy controls where safe, and identify every unresolved item. Independence matters more than seniority: the purpose is to catch assumptions, missing locations and ambiguous vendor language before the device returns to normal use or leaves the owner’s control.
Close the review with a decision that is narrower than the evidence. “Approved for supervised local testing on an isolated network” is more defensible than “safe for use.” “Local user profiles removed; vendor cloud deletion pending under ticket 123” is more accurate than “factory reset complete.” Name the person who accepts each residual risk, set a deadline for vendor responses, and keep the robot restricted if a safety, account or privacy control remains unknown. If a later update, repair, transfer, battery event or vendor-policy change invalidates the evidence, reopen the checklist instead of treating the old result as permanent.