ICO issues data protection guidance for smart products manufacturers

From smart speakers and fitness trackers through to Wi-Fi fridges and interconnected air fryers, smart products often collect large amounts of personal information from users including sensitive information. That being so, manufacturers and developers must ensure their products are designed with data protection in mind.  

For the first time, the ICO has published draft guidance on Internet of Things products and services, which will provide regulatory certainty to the industry, outlining clear expectations to comply with data protection law and use people’s personal information on a responsible basis.

Last year, the ICO asked members of the public for their views on smart products in a series of workshops. Subsequently, individuals shared their concerns that products collect too much information and said that they feel powerless to control how their personal information is used and shared.

These concerns are addressed in the guidance, which covers areas such as how to ask for informed consent, how to provide transparent privacy information and what tools need to be available for people to exercise their rights over their data.

Greater expectation

Stephen Almond, executive director for regulatory risk at the ICO, said: “People rightly have a greater expectation of privacy in their own homes so they must be able to trust that smart products are using their personal information responsibly and only in ways they would expect. This is not just about compliance. It’s about building a fair and transparent online world where people are given meaningful control over how their data is used.”

Almond continued: “Our guidance provides clear recommendations and examples to support manufacturers and developers to understand their legal responsibilities and provide their customers with trusted smart products that respect their privacy. By clarifying our expectations, we can empower organisations to plan and invest in the use of information on a responsible basis. We want to help organisations ensure that everything’s right from the start, but we are closely monitoring compliance and ready to act where we believe corners are being cut or personal information is being collected recklessly.”    

The guidance builds on the ICO’s online tracking strategy for 2025, which aims to give people meaningful choice and confidence in terms of how their information is used, while enabling businesses to operate fairly and responsibly.

The ICO is hosting an event alongside consumer group Which? whereby representatives from the tech industry will gather to discuss the guidance and hear from a panel of experts from organisations including the Mozilla Foundation, the British Standards Institution and Beko plc.

Excessive data 

An investigation conducted by Which? found that smart products were able to collect excessive data from users, often without being transparent.

Manufacturers, developers and the wider tech industry are now invited to share their views on the ICO’s draft guidance, which will be open for consultation over the next twelve weeks.

*Read the ICO’s draft guidance and respond to the consultation online