The ICO is consulting on new guidance for smart products.
It points out that from smart speakers and fitness trackers to Wi-Fi fridges and interconnected air fryers, smart products often collect large amounts of personal information from users, including sensitive information, so manufacturers and developers must ensure their products are designed with data protection in mind.
The ICO has now published draft guidance on Internet of Things (IoT) products and services, which aims to provide regulatory certainty to the industry, outlining clear expectations to comply with data protection law and use people’s personal information responsibly.
Last year, the ICO consulted on smart products in a series of workshops. People shared concerns that products collect too much information, and said that they feel powerless to control how their personal information is used and shared.
The ICO has tried to address these concerns in the guidance, which covers areas such as how to ask for informed consent, how to provide transparent privacy information and what tools need to be available for people to exercise their rights over their data.
The guidance builds on the ICO’s online tracking strategy for 2025, which aims to give people meaningful choice and confidence in how their information is used, while enabling businesses to operate fairly and responsibly.
The consultation ends on 7 September 2025.
The ICO has also published an impact assessment.
