eufy Local-Storage Security Cameras in 2026: The No-Subscription Math, and the Trust Problem Anker Owes You

The cost case is the strongest argument, so start there

Every major cloud camera brand sells you hardware once and video storage forever. eufy sells you hardware once. Over the life of a camera system, that difference is not marginal — it is usually larger than the hardware itself.

Here is what the subscriptions actually cost at US prices listed in August 2026. Google renamed Nest Aware to Google Home Premium; Ring renamed its Home plans to Ring Protect, with Solo, Multi and Pro replacing Basic, Standard and Premium. The money is what matters.

A four-camera household on Ring Protect Multi pays roughly $500 over five years purely for storage. On Arlo Secure Plus Unlimited it is closer to $1,080. Google raised Nest Aware prices by 25 to 33 percent in August 2025, which is the part people underestimate: you are not locking in today’s price, you are accepting whatever the vendor charges later, on hardware you already bought.

The eufy column is genuinely $0 for the core product. That is the real argument, and it does not depend on trusting anyone’s marketing.

Check eufy HomeBase 3 (S380) on Amazon

How the local storage actually works

Cameras pair to a HomeBase hub, which does the recording and keeps the footage. The current HomeBase 3 (model S380) ships with 16GB of built-in storage and is expandable to 16TB with a drive you supply. eufy describes the encryption as AES-128 with RSA-1024, and runs its BionicMind facial recognition on the hub itself rather than in the cloud, which is what lets it do named-person alerts without a subscription.

Retention is a function of your drive, not a plan tier. With 16TB you are into months of event-based recording on a four-camera setup rather than the 30 or 60 days a cloud plan rations out.

Two honest caveats. Notifications with a preview thumbnail still route through Anker’s servers — that is how push works on iOS and Android, and eufy confirmed it in December 2022. And the eufy web portal, which lets you view cameras away from home, is a cloud service by definition. “Local storage” describes where video lives, not that no packet ever leaves your house.

The 2022 incident, stated plainly

On November 23, 2022, security researcher Paul Moore published video showing that a eufy doorbell uploaded event thumbnails to Amazon Web Services even with cloud storage off and no cloud subscription. He also showed that a camera’s live stream could be opened in VLC without authentication.

Anker’s representatives initially told The Verge this was not possible. The Verge tested it anyway, on two eufy cameras, and watched live footage from across the United States in VLC. Reporting at the time described streams protected by AES-128 with a key that could be derived from the camera serial number plus a four-digit hex value — a keyspace of 65,536, which is not a meaningful barrier.

eufy’s first public statement, posted to its community forum on December 19, 2022, admitted the thumbnail uploads to AWS and the web-portal live-view flaw, and committed to requiring login for portal streams and moving Video Doorbell Dual image sharing to the local network. It denied that facial recognition data left the device. It contained no apology, and no commitment to an audit.

The real admission came six weeks later. After sustained questioning, in reporting published January 31 and February 1, 2023, Anker conceded that eufy cameras were not natively end-to-end encrypted, that web-portal streams had gone out without encryption or authentication, and that the VLC access was real. It then committed to pushing encryption to all cameras, commissioning external security audits and penetration testing, obtaining an independent expert assessment, and launching a bug bounty program.

That sequence is the problem, and it is worth naming: the company denied it, then partially admitted it, then fully admitted it only under press pressure. The product was sold on a privacy promise that the vendor could not substantiate when asked.

What a regulator made them do

Promises made to a reporter are not enforceable. What followed was.

On January 28, 2025, New York Attorney General Letitia James announced a $450,000 settlement with Fantasia Trading LLC, Power Mobile Life LLC and Smart Innovation LLC, the entities distributing eufy cameras. The AG’s findings were specific: video sent over the internet “was not protected by end-to-end encryption, and at least a portion of the connection did not use any type of encryption at all”; an active video stream “could be accessed by anyone with the relevant URL, without authentication”; and it may have been possible to deduce that URL without getting it from a user. The companies also lacked processes to test their own safeguards.

The settlement requires a comprehensive information security program, secure development with third-party vulnerability testing, regular penetration testing, and encryption of video both in storage and in transit — with third-party audits over a five-year period.

This is the most useful fact in the whole story. eufy in 2026 operates under audit obligations that Ring, Nest and Arlo are not subject to, because eufy is the one that got caught. That is a genuine argument in its favor and an indictment at the same time.

Check eufyCam S3 Pro on Amazon

Where the record is still incomplete

We found no FTC enforcement action against Anker over the 2022 incident. The consequential action was the state-level New York settlement.

Separately, on March 2, 2026, Rep. Elise Stefanik and Sen. Rick Scott sent a letter to the FCC and the Commerce Department requesting a formal investigation into Anker, citing the company’s ownership structure, concerns about data reaching servers in China, and promotions aimed at US military personnel. That is a request for an investigation, not a finding, and no outcome has been reported. It is a different question from the 2022 encryption failure, and we are not treating one as evidence for the other.

The audit reports Anker commissioned have not been published in full for public inspection. So the accurate 2026 position is: the specific flaws were fixed, binding obligations are in force, and independent verification exists but is not something you can read yourself.

What local storage cannot do

Local is not automatically private, and it is not automatically safe.

• Theft removes your evidence. A burglar who takes the HomeBase takes the footage of themselves. Cloud systems survive this by design. If this is your threat model, optional cloud backup is worth its $30 a year.
• Remote access reintroduces a cloud. Viewing cameras from work means a relay service. The convenience and the exposure are the same feature.
• Local does not mean encrypted. That is precisely the 2022 lesson. Footage on a hub can be readable to anyone who obtains the hub or the traffic unless the vendor actually implemented encryption.
• You own the reliability problem. No RAID, no offsite copy, no support ticket. A dead drive is a dead archive.

Genuinely local-first alternatives

Reolink PoE cameras with a local NVR are the closest direct substitute — no account needed for recording, ONVIF and RTSP support, footage on a box you control. The apps and AI are less polished than eufy’s.

UniFi Protect records to a console you own with no per-camera cloud licensing; cameras run roughly $159 to $599. Best if you already have Ubiquiti networking, overkill if you do not.

Synology Surveillance Station turns a NAS you may already own into an NVR, with two camera licenses included and more sold in packs. Strong if the NAS exists; expensive if bought for this alone.

Home Assistant plus Frigate is the maximum-control option: open source, fully local object detection, no vendor at all. It demands the most — an Intel i5-class machine or better plus a detection accelerator for multi-camera use, and real setup time.

Check Reolink PoE NVR systems on Amazon

Summary

The hardware is good and the cost case is strong: $0 in subscriptions against $500 to $1,080 over five years from Ring, Nest or Arlo, with 16TB of local retention instead of a 30-day cloud window. That case stands on its own.

But this company marketed local-only privacy, was shown not to have it, denied it to reporters, admitted it only under pressure, and now operates under a state settlement requiring five years of third-party audits. If you buy eufy, buy it because the economics work and because it is currently the most externally supervised vendor in the category — not because you believe the original marketing. If that history is disqualifying for you, that is a reasonable conclusion, and Reolink or a Home Assistant plus Frigate build will get you there without the asterisk.

Check eufy camera systems on Amazon

For a look at building a smart home you can take with you rather than one you install permanently, see our guide to renter-friendly smart home setups, or browse all our English gadget guides.