Matter 1.5 cameras: local WebRTC streaming and keeping video private

Security cameras have been the smart-home device with the least common ground: every brand has its own app and its own cloud. Matter 1.5, announced by the Connectivity Standards Alliance on 20 November 2025, brings cameras into the standard for the first time, and 1.5.1 (31 March 2026) improves streaming. This article explains how the mechanism works and, as the person who owns the house, what to set so video from inside your home stays there.

Facts checked against the CSA announcements for Matter 1.5 and 1.5.1, RFC 8827 and Espressif’s developer blog, as of October 2026. The full specification is available to CSA members only, so this article does not quote attribute-level detail. (Matter 1.6 shipped on 17 June 2026, but its announcement does not mention cameras, so camera behaviour here is 1.5/1.5.1.)

What 1.5 and 1.5.1 add for cameras

Version	Date	Camera features
1.5	20 Nov 2025	WebRTC audio + video, two-way communication, local and remote access via STUN/TURN, multi-stream, pan-tilt-zoom, detection and privacy zones, continuous or event-based recording to local or cloud destinations
1.5.1	31 Mar 2026	several differently optimised streams in one session (high-res recording, low-res mobile, analysis), HEIC snapshots, HLS/DASH clip upload via CMAF, PTZ fix for a home position at the edge of the range, chimes can play a chosen sound

1.5 also adds a full TCP transport for large payloads such as firmware and images, which cameras benefit from directly. The rest of that release (closures, soil sensors, energy) is out of scope here.

On the hardware side, Espressif’s Matter camera SDK pairs an ESP32-P4, which does hardware H.264 at 1080p 30 fps, with an ESP32-C5 or C6 for Wi-Fi and the Matter stack. A Matter camera does not need expensive silicon; microcontroller-class chips can do it.

How the video travels: WebRTC, STUN and TURN

Per Espressif, stream setup is standard WebRTC, driven through Matter clusters:

1. The controller (an app or hub) sends an SDP offer to the camera through the WebRTC Transport Provider cluster
2. The camera checks it has resources (Camera AV Stream Management cluster), allocates audio and video streams and returns an SDP answer
3. Both sides exchange ICE candidates, the list of addresses each can be reached at
4. Once ICE finds a path, media flows peer to peer

Step 3 decides where your video goes:

• Same LAN: host candidates (home IPs) work, and the video never leaves the house
• Phone outside: STUN tells each side its public address and they try to punch through NAT directly
• NAT cannot be punched (carrier-grade NAT on mobile data, for example): a TURN server relays every packet

Espressif notes that the controller configures STUN/TURN on the camera, so camera makers do not implement NAT traversal themselves. The question for the owner is whose TURN server: the hub maker’s, a cloud service’s, or one you run.

WebRTC encrypts every media channel (DTLS-SRTP, RFC 8827). A TURN relay can forward your video but not decode it; it does see who talked to whom, when, and how much.

Worked example: recording all day vs on events

The bitrate below is an assumption for the arithmetic, not a figure from the specification. Use your camera’s spec sheet.

Assume a 1080p camera sending H.264 at 2 Mbps.

Continuous, 24 hours

1. 2 Mbit/s × 86,400 s = 172,800 Mbit
2. ÷ 8 = 21,600 MB ≈ 21.6 GB per camera per day
3. Seven days kept = 151.2 GB per camera; four cameras ≈ 605 GB

Event-based, 40 events a day at 30 seconds each

1. 40 × 30 = 1,200 s
2. 2 Mbit/s × 1,200 s = 2,400 Mbit = 300 MB per day

A 72× difference. If the destination is a cloud, that number is also how much footage of your home sits on someone else’s machines. Upload matters too: each remote viewer pulls 2 Mbps from your home connection, so three people watching through TURN at once is a steady 6 Mbps. This is where 1.5.1’s multi-stream helps: a low-res stream for phones, separate from the recording stream.

Keeping video at home: an owner’s checklist

1. Decide on recording before buying. The standard allows local and cloud destinations, but a given camera or hub may support only one. Ask plainly: can it record to a NAS or hub at home, and what stops working with the cloud off?

2. Use privacy zones for what should not be seen. Matter 1.5 has privacy zones (Zone Management cluster) to mask parts of the image: a neighbour’s window, a bathroom, a bedroom door. Test that the masked area is gone from every stream and from recorded clips, not just the app’s preview.

3. Put cameras on their own network. A VLAN or IoT SSID where cameras can reach only the hub/controller and the NAS, with no direct internet if you do not use a cloud. IoT devices that change IP on reboot covers DHCP reservations, which make firewall rules easier to write.

4. Watch remotely without opening ports. Never port-forward a camera or NVR to the internet. If you do not want to rely on someone else’s TURN server, bring your phone home over a VPN and view as if on the LAN; setup is in the Tailscale/WireGuard article.

5. Check who has access. Matter’s multi-admin lets one device work with several controllers at the same time, and 1.6 adds Joint Fabric, where several controllers co-administer one network. Convenient in a mixed-ecosystem home, but every connected controller is someone who can request a stream. Open the camera’s settings, review the connected ecosystems and remove the ones you no longer use, especially after replacing a hub or selling the house.

6. Firmware. 1.5.1 fixes a number of 1.5 issues (including validation of invalid recording setups). Update both camera and controller to versions that support 1.5.1.

Common mistakes

• Assuming the Matter logo means no cloud. Matter is a common language between devices; it does not dictate where video lives
• Setting a privacy zone without checking recordings. The recording stream and preview stream may be different streams; check both
• Port-forwarding the camera for remote viewing. That puts the camera’s login page on the internet. Use a VPN
• Forgetting an old controller. A retired hub that is still connected can still request streams
• Cameras on the same network as work machines. If a camera is compromised, everything else in the house is in reach

Three questions before mounting any camera: where are recordings stored, which path does remote viewing take, and how many controllers can request video?

Sources

• Matter 1.5 Introduces Cameras, Closures, and Enhanced Energy Management Capabilities — CSA
• Matter 1.5.1: Enhancing Camera Performance and Expanding Device Flexibility — CSA
• All about choice: Multi-Admin in Matter — CSA and Matter 1.6 — CSA
• RFC 8827: WebRTC Security Architecture — IETF
• Introducing Matter Cameras — Espressif Developer Portal