Cybersecurity researchers found that if attackers could monitor the data uploaded by internet protocol (IP) security cameras, they could predict if people were at home.
They could do this without seeing the video.
It could give burglars a new way to work out if properties are unoccupied, or even predict times in the week when owners are likely to be out.
The global market for internet-connected cameras is predicted to reach $1.3 billion (£1 billion) by 2023.
Researchers from the Chinese Academy of Science and Queen Mary University of London tested showed that the traffic from cameras could be monitored and used to predict whether a house was occupied or not.
They found that highly private information – such as whether people were moving inside a house – could be inferred simply from the amount of data transmitted by the camera.
Dr Gareth Tyson, senior lecturer at Queen Mary University of London, said: "Once considered a luxury item, these cameras are now commonplace in homes worldwide.
“As they become more ubiquitous, it is important to continue to study their activities and potential privacy risks.
“Whilst numerous studies have looked at online video streaming, such as YouTube and Netflix, to the best of our knowledge, this is the first study which looks in detail at video streaming traffic generated by these cameras and quantifies the risks associated with them.
“By understanding these risks, we can now look to propose way to minimise the risks and protect user privacy.”
Patterns in the data generated by the cameras could even be used to detect if people inside were sitting or running, the researchers found.
The researchers even found that future activity in the house could be predicted based on past traffic generated by the camera, which could leave users more at risk of burglary by discovering when the house tends to be unoccupied.
The findings were published at the IEEE International Conference on Computer Communications.