WIREDGOV

We are calling on all manufacturers and developers of smart products to prioritise people’s privacy with new guidance published yesterday (16 June). 

From smart speakers and fitness trackers to Wi-Fi fridges and interconnected air fryers, smart products often collect large amounts of personal information from users – including sensitive information – so manufacturers and developers must ensure their products are designed with data protection in mind.  

For the first time, we have published draft guidance on Internet of Things (IoT) products and services, which will provide regulatory certainty to the industry, outlining clear expectations to comply with data protection law and use people’s personal information responsibly. 

Last year, we asked the public for their views on smart products in a series of workshops. People shared concerns that products collect too much information, and said that they feel powerless to control how their personal information is used and shared.  

These concerns are addressed in the guidance, which covers areas such as how to ask for informed consent, how to provide transparent privacy information and what tools need to be available for people to exercise their rights over their data.

Stephen Almond, Executive Director for Regulatory Risk at the ICO, yesterday said:

“People rightly have a greater expectation of privacy in their own homes so they must be able to trust that smart products are using their personal information responsibly and only in ways they would expect. This is not just about compliance – it’s about building a fair and transparent online world where people are given meaningful control over how their data is used. 

“Our guidance provides clear recommendations and examples to support manufacturers and developers to understand their legal responsibilities and provide their customers with trusted smart products that respect their privacy. By clarifying our expectations, we can empower organisations to plan and invest in the use of information responsibly. We want to help organisations get it right from the start – but we are closely monitoring compliance and ready to act where we believe corners are being cut or personal information is being collected recklessly.”    

The guidance builds on our online tracking strategy for 2025, which aims to give people meaningful choice and confidence in how their information is used, while enabling businesses to operate fairly and responsibly. 

We are hosting an event alongside consumer group Which? this evening, where representatives from the tech industry will gather to discuss the guidance and hear from a panel of experts including Mozilla Foundation, British Standards Institution and Beko PLC. 

An investigation by Which? previously found that smart products were able to collect excessive data from users, often without being transparent.

Manufacturers, developers and the wider tech industry are invited to share their views on the ICO’s draft guidance which will be open for consultation over the next twelve weeks. 

Read the draft guidance and respond to the consultation here.

Notes to Editors

1. The Information Commissioner’s Office (ICO) is the UK’s independent regulator for data protection and information rights law, upholding information rights in the public interest, promoting openness by public bodies and data privacy for individuals.  
2. The ICO has specific responsibilities set out in the Data Protection Act 2018 (DPA2018), the United Kingdom General Data Protection Regulation (UK GDPR), the Freedom of Information Act 2000 (FOIA), Environmental Information Regulations 2004 (EIR), Privacy and Electronic Communications Regulations 2003 (PECR) and a further five acts and regulations.  
3. The ICO can take action to address and change the behaviour of organisations and individuals that collect, use and keep personal information. This includes criminal prosecution, non-criminal enforcement and audit.    
4. To report a concern to the ICO telephone our helpline 0303 123 1113 or go to  ico.org.uk/concerns.