Camera Privacy Settings: Who Can See What

Section 1: Why is the camera account the real security risk? (Introduction)

The account is the camera: whoever can log in can watch, download and share. Lock the account with two-factor authentication, review who has access, set retention, and prefer local storage if the footage is sensitive or shared with a landlord.

A security camera has two parts: the lens in your hallway and the account that can see through it. Most people spend their time on the first and almost none on the second, which is backwards. The lens cannot be accessed without the account, and the account is usually the weaker of the two.

That matters because the account is shared more often than people remember. A partner, a roommate, a pet sitter, a parent checking on the house: each one is a login with a set of permissions that most owners never review. Add a cloud plan with a retention window, an app that defaults to recording audio, and a camera pointed at a neighbor’s window, and the privacy problem is no longer theoretical. For whether the analysis happens on the camera or in the cloud, see Local AI vs Cloud.

This guide covers the settings that decide who can watch, who can download, how long clips stay, what happens to audio, and what to do before you sell or return a camera. For the device-level picture, start with Smart Cameras 101; for the network, the network security guide is the companion piece. For the rest of the pillar, see the Security & Privacy hub.

Section 2: Who can watch, download and share your footage?

Every camera platform has at least two kinds of users: the owner and everyone else. The gap between them is where privacy leaks.

Owner versus shared user

Ring’s privacy documentation is unusually clear about the split. Shared Users can answer alerts, view live video, and download recordings. They cannot delete videos, delete devices, or change device settings. Only the owner can. The owner can remove a shared user at any time, and the removal should be immediate.

That is a sensible default, but it still means a shared user can download a clip and keep it. Access is not the same as control. If a clip should not leave the house, do not give someone the ability to download it.

Google and Apple use a different model: home members share the home rather than the camera, and their access level decides whether they can change settings or only view. That is easier to manage for a family and harder to audit for a guest, because membership belongs to the home rather than to one device.

Check the same distinction on your platform. The labels differ — Google uses home members and access levels, Wyze and Eufy use their own terms — but the question is identical: can this person only watch, or can they also export, delete, and invite others?

The worst pattern is one account shared by everyone. It feels convenient and it destroys accountability: every view, download, and setting change looks like the owner. If two people need access, add two users.

Sharing links

Many apps let you share a single recording by link. That is convenient and permanent in a way people forget: the link works for anyone who has it, and forwarding it is trivial. Ring’s documentation notes that unsharing a video deletes the shared copies and makes them inaccessible, but the original stays in your account until you delete it or the plan’s storage period expires.

Treat a share link like a password. Send it to one person, not a group chat, and unshare it when the conversation is over.

The access audit

Once a year, open the user list and ask three questions about each name:

• Do I still know this person?
• Do they still need access to this camera?
• Can they download or share, or only view?

Remove anyone you hesitate on. Re-adding is easy; un-sharing a clip that has already been forwarded is not.

Section 3: How should you lock down the camera account?

The camera account is a login like any other, and it deserves the same treatment as email.

• A unique password. Not the Wi-Fi password, not the one you use for three other sites. A password manager makes this practical.
• Multi-factor authentication. Ring says two-step verification is mandatory on its accounts, which is the right default. Turn on the strongest factor the platform offers — an authenticator app or passkey over SMS where possible.
• A secure email account. Password resets flow through your email. If that account is compromised, the camera is too.
• Session review. Sign out of devices you no longer use, and change the password after a breakup, a roommate move, or a phone sale.
• Recovery details. Check the recovery email and phone number on the account. An attacker who controls those can reset the password and lock you out.

Most camera apps list the devices signed in to the account under security or account settings. Open that list, and sign out anything you do not recognize. A device you sold two years ago should not still be logged in.

CISA’s guidance for connected devices applies here as much as anywhere: change default credentials, apply patches, and disconnect anything that no longer receives updates. A camera that has not been patched in two years is a camera with a known front door.

Section 4: How long is your footage kept, and how do you delete it?

Where the video goes and how long it stays are the two settings that most affect privacy, and they are often buried.

Cloud retention

A cloud plan stores clips for a fixed window, usually 14 to 60 days, and deletes them automatically after that. Ring’s documentation says recordings are permanently deleted from its servers according to the storage period in your plan, and that you can delete them manually at any time.

A quick comparison of retention, checked October 2026:

The practical steps:

• Find the retention setting and set it to the shortest window you actually use. If you review events within a week, a 30- or 60-day archive is just data you are storing for someone else.
• Delete the sensitive clips yourself. Doorbell footage of a neighbor, a family argument, a child: delete it rather than waiting for the timer.
• Download before you cancel. If you cancel a plan, the clips tied to it may become inaccessible. Export anything you need first.

Cloud plans usually store more than the clip: event times, device names, thumbnails, and account activity. Deleting a video removes the recording, but the event list can persist until the retention window closes. If the goal is to erase a sensitive moment, delete the clip and check the event list too.

Local storage

Local storage changes the equation. Eufy, for example, says its security products are designed to operate locally wherever possible, storing footage on the device or a HomeBase and running face recognition on the chip, with encryption in transit by default. That is a stronger privacy posture than a cloud plan, with two caveats: a stolen camera takes the card with it, and the app still has an account.

If local storage is the priority, read Local Video Storage before buying. If you use both, treat the cloud copy as the backup and the local copy as the primary.

Before you sell, return, or recycle

Factory-reset the camera and remove it from the account. A reset without removal can leave the device tied to your login; a removal without a reset can leave the previous network and clips on the device. Do both, and delete the cloud recordings first.

Section 5: What can zones, audio settings and physical controls keep out?

Software settings control what the camera records. Physical choices control what it can see and hear in the first place.

Zones and framing

Every serious camera app has activity zones, and most have privacy zones that black out part of the frame. Use them:

• Block the neighbor’s window, the shared hallway, and the street. A wide lens captures more than your property, and the neighbor did not consent to being recorded.
• Frame your own threshold. The useful field of view is the door and the path to it, not the whole block.
• Check the edges. Wide lenses distort, and a face at the edge is often unrecognizable anyway.

Audio

Many cameras record audio by default. In some states, recording a conversation without consent can carry criminal and civil penalties, and a doorbell or porch camera can pick up conversations you are not part of. If you do not need audio, turn it off. If you do, know your state’s rule and put a sticker on the camera.

The physical off switch

Indoor cameras should have a physical or software way to point the lens away, close a shutter, or turn the camera off. Use it when the camera is not needed. A camera that watches the living room all day is a camera that records your guests, your family, and you.

Before guests arrive

Decide whether the indoor camera is on. A camera in the living room records conversations, faces, and children who are not yours; turning it off is a courtesy, and in an all-party-consent state it may be the law. The same rule applies to a nanny cam or a pet camera that covers a shared space.

Firmware and network

Audio is the setting people forget. Federal law is one-party consent, but about 11 states require all-party consent, and a porch camera can capture a conversation on the sidewalk. If you do not need sound, turn it off; if you do, know the rule and put a sticker on the camera.

Keep the firmware current, and put the camera on a guest network or an isolated VLAN if your router supports it. The short version is that a compromised camera should not be able to reach your laptop.

Section 6: What should you check in a ten-minute privacy audit? (Conclusion)

Run this once, then again when someone moves in or out — and after a move, a breakup, or a death in the household, do it that same week. Access outlives relationships more often than people expect.

1. List every user. Remove anyone you do not recognize or no longer need.
2. Turn on MFA. Use an authenticator app or passkey if offered.
3. Set retention to the shortest window you use. Delete the clips you would not want forwarded.
4. Check the share links. Unshare anything still active from an old conversation.
5. Draw the zones. Block neighbors, shared halls, and the street.
6. Decide on audio. Off unless you have a reason.
7. Update the firmware. Then put the camera on the guest network.
8. Test the off switch. Know how to disable it in a hurry.

Some homes cannot do all of this. A cloud-only camera with no local option gives you less control, and a landlord-provided system may not let you change the account at all. In those cases, the minimum is a unique password, MFA, and asking who else has access.

Write down the account owner, the shared users, and where the footage lives. The next person who needs to change something will not have to guess.

A camera is a window into your home that you install on purpose. The settings decide how wide that window opens, who else can look through it, and how long the view is kept. Ten minutes of configuration is a small price for knowing the answer.

Where to buy

Related reading

• Smart Cameras 101 — resolution, night vision, storage and the buying decision.
• Video Doorbells 101 — the doorbell on your network, and the recording-law basics.
• Local Video Storage — keeping footage on your own hardware.
• Smart Home Network Security 101 — isolating cameras from everything else.

Sources

• Privacy — Ring, shared-user permissions, manual deletion, plan storage periods and mandatory two-step verification checked October 2026
• Privacy Commitment — eufy, local processing, on-device recognition and default encryption checked October 2026
• Google Privacy Policy — Google, account security and activity controls checked October 2026
• Securing the Internet of Things (IoT) — CISA, default credentials and patching checked October 2026