Wyze Labs, Inc. is a privately held Seattle-based smart home company founded by three former Amazon employees, best known for low-cost Wi-Fi cameras and a broader line of locks, sensors, scales, and wearables. Its privacy policy states that its services collect video and images from cameras that may include images of individuals, optional facial data that could be considered biometric information, and health metrics from its scale and wearable products. Wyze says it does not sell data for money, but acknowledges that disclosures to advertising partners may constitute a "sale" or "sharing" under state privacy laws, and its app has shipped with third-party cookies, pixels, ad beacons, and SDKs that match user activity to email addresses through an online data partner. The company has a repeated incident history documented in its own disclosures: a 2019 exposed database, camera vulnerabilities reported in 2019 but publicly disclosed only in 2022 (with the original Wyze Cam v1 retired unpatched), a 2023 web-portal caching error, and a February 2024 event in which about 13,000 users briefly received camera thumbnails belonging to other users. Wyze mandates two-factor authentication and runs a public bug bounty program.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
14 ON FILE
[2026-05-19] · COLLECTION
Wyze's privacy statement (effective May 19, 2026) states that its services collect video and images from users' cameras per their storage settings, which may include images or videos of individuals; it separately notes that optional Friendly Faces facial data "could be considered biometric information" and that Watch, Band, and Scale products collect height, weight, heart rate, and incoming SMS and call information.
Wyze's own company-history page states the company was started in Seattle by three founders who previously worked at Amazon headquarters. Wyze is privately held and publishes no ownership or investor disclosures on its site.
In its 2019 data-leak FAQ, Wyze disclosed its corporate footprint: headquarters in Seattle, Washington, plus a Beijing office with developers, hardware QA staff, and product managers, stating that production servers holding customer information run on US-based AWS infrastructure.
Wyze's privacy statement identifies the operating legal entity as Wyze Labs, Inc. and states the company is based in the United States, processing and storing information in the U.S. and other countries.
On its security page, Wyze states it does not sell user data for money, while acknowledging that it discloses data points such as website and app activity to interest-based advertising services and business partners, and that making this information available may be considered a "sale" under the CCPA and other state privacy laws.
Wyze's privacy statement acknowledges that its targeted advertising and analytics practices — which involve advertising partners translating email addresses or phone numbers into cross-site identifiers — may legally constitute "targeted advertising," "sharing," or "selling" of personal information under certain state privacy laws.
Wyze's security page states the company mandated two-factor authentication for all customers and lists third-party security attestations including ioXt certification for its iOS and Android apps, Google MASA certification for Android, and NCC Group penetration testing.
Wyze disclosed that a copied production dataset was left exposed from December 4 to December 26, 2019 after an employee removed its security protocols; per Wyze, the data included customer emails, camera nicknames, Wi-Fi SSIDs, device information, body metrics for some beta testers, and limited Alexa tokens — affecting users who created accounts before December 26, 2019 — and the company forced logouts, refreshed API tokens, and unlinked third-party integrations in response.
In its response to the Bitdefender report, Wyze acknowledged that it and Bitdefender jointly withheld details of the vulnerabilities until fixes shipped — roughly three years after notification — and that the original Wyze Cam v1 (last sold March 2018) could not support the necessary security updates and was end-of-lifed without a patch due to limited camera memory.
On March 29, 2022, Bitdefender published research identifying Wyze Cam vulnerabilities tracked under 2019 CVE identifiers — an authentication bypass (CVE-2019-9564), a remote code execution flaw (CVE-2019-12266), and unauthenticated access to SD card contents — that could let an outside attacker access the camera feed or run malicious code.
Wyze disclosed that on September 8, 2023, a wrong CloudFront caching setting selected during a bug fix on its view.wyze.com web portal meant that, for about 40 minutes, up to 2,300 logged-in web users may have seen camera feeds belonging to 10 affected users; Wyze said the Wyze app itself was not affected and took the portal down to remediate.
By Wyze's own numbers, as cameras recovered from a February 16, 2024 AWS-related outage, a third-party caching client library under unprecedented load mixed up device ID and user ID mappings, and about 13,000 users received event thumbnails from cameras that were not their own; 1,504 users tapped them and in some cases an Event Video could be viewed. Wyze notified all users and added a verification layer before users connect to Event Videos.
Wyze's privacy statement describes using cookies, pixels, ad beacons, and SDKs with "online data partners or vendors" to associate user activity with information those partners hold, including email addresses — an email-based identity-matching technique — with the stated opt-out hosted at app.retention.com.