Doorbell · Aqara
Aqara Smart Video Doorbell G4 privacy & local-first review
Battery or wired · List price: Unverified
Last verified · 1 unverified item
43Local-First Score
how we score
how we score
At a glance
| Works without internet | Partial Partial: on-device face recognition and automations keep working if internet is down1 Whether live view works with no internet is unverified. |
|---|---|
| Local storage | Yes microSD in indoor chime repeater (up to 512 GB)12 |
| Home Assistant | Community only Unofficial · via HomeKit Device integration (community guide)34 |
| Open protocols | No HomeKit Secure Video; no RTSP (per Aqara community thread)32 |
| Subscription needed? | Not needed No (7 days free cloud clips; iCloud+ only for HomeKit Secure Video)15 |
| Cloud account required? | Unverified |
| End-to-end encryption | Optional Only when used with HomeKit Secure Video16 |
Score breakdown
| Works without internet | Partial | 8 / 20 |
|---|---|---|
| Local video storage | Yes | 15 / 15 |
| Home Assistant, locally | Community only | 6 / 15 |
| Open protocol (RTSP / ONVIF / Matter) | No | 0 / 10 |
| No cloud account required | Unverified | 0 / 10 |
| No subscription for core recording | Not needed | 8 / 8 |
| End-to-end encryption | Optional | 4 / 7 |
| Privacy policy: does not sell your data (brand) | Qualified App policy: "We do not sell any personal information to third parties"; the US website policy shares data with advertising providers for personalized ads (opt-out offered).78 | 2 / 5 |
| Police requests: warrant or no access (brand) | Discretionary US privacy policy: discloses to law enforcement "if required or permitted to do so by law or legal process", and may disclose to prevent physical harm. No warrant requirement or user notice stated.8 | 0 / 5 |
| No incidents in our tracker, last 5 years (brand) | Incident found 2 in our tracker since Oct 2021 | 0 / 5 |
| Total | 43 / 100 |
Privacy notes
- Aqara US privacy policy: may share data with advertising providers for personalized ads on third-party sites, and lists an opt-out of targeted advertising. The Aqara Home app policy says Aqara does not sell personal information and lists data centers in mainland China, Germany, South Korea, Singapore, Russia and the US.87
Firmware & phoning home (not scored)
- A researcher's CVE-2025-65294 write-up (CVSS 9.8) reports an undocumented remote command-execution mechanism in G4 firmware from 4.0.6 and classifies the G4 as "not fixed" in the firmware versions they tested.9
Police & law-enforcement requests (Aqara)
Discretionary US privacy policy: discloses to law enforcement "if required or permitted to do so by law or legal process", and may disclose to prevent physical harm. No warrant requirement or user notice stated.8 Compare companies
Security incidents & settlements (Aqara)
| Date | Company | What happened | Type |
|---|---|---|---|
| Jun 2026 | Aqara | runZero published CVE-2026-50083 (NVD CVSS 9.8) and related flaws in Aqara's cloud login and API services, including hardcoded OAuth credentials that could be chained to take over accounts and devices. Aqara said the issues were fixed in April 2026.1011 | Serious vulnerability |
| Dec 2025 | Aqara | CVE-2025-65294 (CVSS 9.8): researchers documented an undocumented remote command-execution mechanism in Aqara hubs and camera hubs. Their regression testing reports it removed from the Camera Hub G3 but still present in the G4 doorbell firmware they tested.129 | Serious vulnerability |
Similar doorbells compared
| Device | Score | Offline | Local storage | Home Assistant | RTSP/ONVIF | Subscription | Account |
|---|---|---|---|---|---|---|---|
| Ubiquiti UniFi G4 Doorbell ProDoorbell · Wired (doorbell wiring or PoE kit) | 90 | Yes | Yes | Local push | Yes | Not needed | Not required |
| Reolink Video Doorbell (PoE / WiFi)Doorbell · Wired (PoE or 12–24 VAC) | 82 | Yes | Yes | Local push | Yes | Not needed | Not required |
| Amcrest AD410 Video DoorbellDoorbell · Wired (doorbell wiring) | 73 | Yes | Yes | Local polling | Yes | Not needed | Unverified |
| Aqara Smart Video Doorbell G4Doorbell · Battery or wired | 43 | Partial | Yes | Community only | No | Not needed | Unverified |
Reolink RTSP/ONVIF setup note (added Oct 22, 2026): on many current Reolink models, RTSP and ONVIF (and on some, HTTP) ship switched off. Reolink says to enable them once in the Reolink App or desktop Client under Network > Advanced > Server Settings, or in the web interface where it is reachable1314. For cameras attached to a Reolink NVR or Home Hub, enable the ports on the NVR/hub instead13. The App and Client can manage a camera as a "Local Device" using only its UID, username and password, so no Reolink account is needed for this step15. Home Assistant users report the same out-of-the-box behavior on recent firmware16.
More from this company: Is Aqara safe? Policies and incident record. Have a question about this device? Ask us or suggest a device.
Spotted an error? See our corrections policy. Informational only, not legal advice.
Sources
- Aqara: Smart Video Doorbell G4 · checked Oct 22, 2026
- TechRadar: Aqara Video Doorbell G4 review · checked Oct 22, 2026
- Aqara forum: Switching G4 to Home Assistant (community guide) · checked Oct 22, 2026
- Home Assistant: HomeKit Device integration · checked Oct 22, 2026
- Apple: Store encrypted camera footage with HomeKit Secure Video · checked Oct 22, 2026
- Apple Platform Security: HomeKit camera security · checked Oct 22, 2026
- Aqara Home app privacy policy (non-EU) · checked Oct 22, 2026
- Aqara US Privacy Policy · checked Oct 22, 2026
- Researcher write-up: Aqara undocumented remote execution (CVE-2025-65294) · checked Oct 22, 2026
- NVD: CVE-2026-50083 (Aqara cloud hardcoded OAuth credential) · checked Oct 22, 2026
- runZero advisory: Aqara hardcoded OAuth client credentials · checked Oct 22, 2026
- NVD: CVE-2025-65294 (Aqara hubs undocumented remote execution) · checked Oct 22, 2026
- Reolink: How to configure Reolink ports settings · checked Oct 22, 2026
- Reolink: Reolink Home Assistant integration (prerequisites) · checked Oct 22, 2026
- Reolink: Local Device vs Account Device · checked Oct 22, 2026
- Home Assistant Community (user report): Reolink cameras ship with open-protocol ports off · checked Oct 22, 2026