Robot Vacuums: A Factory Reset Is Not Proof of Erasure

Some robot vacuums can be reset in two different ways. A dedicated button on the device clears only the Wi-Fi connection, so the robot can quickly join a new network. A full wipe runs through the app or through a button combination described in the user manual. When the device arrives at goods-in, nothing tells you which of the two the previous owner used.

What stays on the device is not trivial. In its consumer guidance (in German), the BSI, Germany's Federal Office for Information Security, explains that robot vacuums may use cameras for object recognition, map the floor area and store part of the resulting data, including in the manufacturer's cloud. Add to that the credentials of the Wi-Fi network the device was running on.

In July we described how IMEI screening, data erasure and certificates work together for smartphones, tablets and notebooks in Making Electronics Returns Legally Safe. Robot vacuums, smart home devices and other connected electronics usually have no dedicated erasure tool. There is the reset, and everything rides on it.

Device, account, cloud: three places where data lives

Any discussion of erasure on connected devices has to keep three levels apart.

The device holds what it needs to operate. In a 2019 talk at DEF CON, security researcher Dennis Giese listed what used smart home devices retain: Wi-Fi credentials, nearby access points, cloud communication log files and maps.

The account in the manufacturer's app links the device to a person. As long as that pairing exists, the robot still belongs digitally to its previous user, even if it has long been sitting on a workbench at our service center in Heiligenhaus, Germany.

The cloud holds maps, history and settings the device has uploaded. Having the device in hand gives you no access to that data. Only the account holder or the manufacturer can delete it.

A service provider can therefore only process and document the first level. For account and cloud, it can record whether a pairing was still visible on arrival and flag this to the client.

What a factory reset actually does

The factory reset is the obvious step, and on many devices the only one the manufacturer offers. The BSI's IT-Grundschutz Compendium explicitly requires it for IoT devices. Directly after that, however, it states that all credentials stored on the device must then be changed. So the BSI does not rely on the reset alone.

Giese's examination of used devices shows why. He found them in three states: not reset at all, only Wi-Fi reset, fully wiped. Even the third state was no guarantee. On one robot vacuum that the previous owner had reset to factory settings, Giese still found fragments of log files, keys, maps and Wi-Fi credentials in the extracted flash memory. Data remnants were still readable after three further resets. On another model, the reset formatted the data partition but did not overwrite it.

For current smartphones, by contrast, the BSI considers a factory reset sufficient, because encryption and access protection are in place. For older smartphones it may be enough, but not necessarily. What matters is how the device is built. If user data is encrypted and the reset destroys the key, the reset is effective. If it only marks files as deleted, it is not. From the outside, you cannot tell the difference.

The US guideline NIST SP 800-88 classifies the manufacturer reset accordingly. It counts as "Clear", the weakest of three levels, and only if no data can be retrieved through the normal user interface. "Clear" protects against simple recovery through the same interface the user has. It does not stop anyone who desolders the memory chip and reads it out.

What changed with NIST SP 800-88 Rev. 2

In September 2025, NIST published Revision 2 of the guideline. It replaces the 2014 version. Four changes matter for manufacturers, retailers and refurbishers:

• The tables listing sanitization methods by media type are gone. For specific techniques, NIST now refers to IEEE 2883 and other standards. Cryptographic erase is the only technique the guideline still covers itself.
• The focus is on an organization's sanitization program, with a policy, assigned responsibilities, training, tool maintenance and record-keeping requirements.
• Verification and validation are now separate steps. Verification checks whether the process ran without errors. Validation decides whether the result is adequate for the sensitivity of the data.
• Multiple overwrite passes are not necessary. On modern storage they add little protection, and on flash memory they shorten its lifespan.

A certificate that simply says "according to NIST 800-88" therefore tells you little unless it states which level was reached with which tool.

Define the erasure scope before the repair

Whether data should be erased depends on where the device goes next. A customer who gets their repaired robot vacuum back may want to keep their maps. If the device is swapped or resold as B-grade stock, the previous owner's data has to go. This belongs in the contract before the first device lands on the workbench. The BSI advises consumers to back up their data before a repair anyway.

At a minimum, your agreement should answer these questions:

• Which device groups are erased, and which stay untouched?
• Which method applies to which group?
• What happens to devices that no longer boot and therefore cannot be reset at all? The options are removing and destroying the storage, or a documented exception.
• Who initiates the unlinking from the user account?

For anyone responsible for data protection, there is also the question of proof. The GDPR requires appropriate security of personal data (Art. 5(1)(f) and Art. 32) and obliges the controller to be able to demonstrate compliance (Art. 5(2)). The BSI's IT-Grundschutz requires external service providers to use an erasure process that is "sufficiently secure and traceable". Which obligations apply in your case, for example whether a data processing agreement is needed, is a question for your data protection advisor. This article is not legal advice.

At PST, the erasure scope is defined and documented with the client before work begins.

What an erasure record should contain

An erasure record is one data set per device. The minimum fields follow the list in NIST SP 800-88 Rev. 2. For connected devices, account pairing and exceptions are added.

An entry reading "reset to factory settings" covers exactly one of these rows.

If you hand returns or service devices with their own storage to a service provider, it pays to go through this table together before the first order. We are glad to discuss erasure scope and records for your device groups. The quickest way to reach us is our contact page. What PST handles in the reverse process is described on the Returns Management page.