The Information Commissioner’s Office (ICO) has published its finalised guidance on consumer Internet of Things (IoT) products and services, setting out clear expectations for manufacturers and developers on how to use people’s personal information responsibly.

The guidance reflects feedback from both the public and industry following a 12-week consultation last year. It provides regulatory certainty on areas such as how to ask for informed consent, how to provide transparent privacy information and what tools need to be available for people to exercise their rights over their data.

“Connected devices process some of the most sensitive data about people’s lives, from data about health to daily routines and family life,” William Malcolm, ICO Executive Director for Regulatory Risk and Innovation, said.

“Product and device innovation holds huge potential to make a positive impact in so many areas of people’s lives, but that innovation must work for everyone. It is vital that product developers put privacy at the centre of product design and use data fairly and transparently.

“We’ve welcomed the constructive engagement from industry during the consultation process and now we are calling for action – data protection by design is a legal requirement, not a suggestion.

“We encourage organisations making and developing smart products to review the guidance and ensure they are meeting the standards the public expect.”

The ICO is now turning its attention to connected TVs and how they use people’s personal information. Found in 70% of UK households, smart TVs can collect a large amount of data and use this information to serve targeted advertising – but this must be done transparently and with genuine consent.

The regulator will be engaging with connected TV manufacturers this year to assess whether they are complying with the law and offering consumers meaningful choice over how their data is used.

“For years, Which? investigations have shown that many connected products collect far more personal data than is needed to provide their service, so it’s good that the ICO has incorporated some of our recommendations into its final guidance, helping to set clearer expectations for manufacturers and developers,” Andrew Laughlin, Which? Tech Expert, said.

Recommended reading

• Smart Devices Leave UK Households Vulnerable
• New Smart Devices Secure-By-Design Laws Come Into Effect
• The 12 Most Popular UK Smart Home Devices
• 70% of UK People Consider Data Collection ‘Immoral’

“The guidance should mark a turning point for the sector. Businesses need to be upfront about the data they collect, explain why they need it and give consumers meaningful control over how it’s used. The challenge now is ensuring the guidance is backed by effective regulation and meaningful industry action.”

The ICO has released expectations for IoT manufacturers and developers:

• Privacy must be built in from the start, not bolted on afterwards – with protective settings on by default and data collection limited to what is strictly necessary.
• Consent must be real, specific and freely given via a clear opt-in – and it must be just as easy to withdraw.
• Genuine transparency is more than a privacy notice – users must be clearly informed about how their data is used, in plain language and at relevant points across the whole product.
• Most firms will have to do a Data Protection Impact Assessment – due to the sensitive nature of the data they collect, with an even higher bar if children may use the product.
• Security is an ongoing legal obligation, not a one-time consideration – it requires regular updates, encryption, and multifactor authentication throughout the product’s lifetime.