Cybersecurity Policy Report, U.K. Publishes Guidance on IoT Privacy, (Jun 15, 2026)
By Tony Foley
The United Kingdom’s Information Commissioner’s office (ICO) published final guidance last week on consumer Internet of things (IoT) products and services, setting out clear expectations for manufacturers and developers on responsible use of people’s personal information.
The updated guidance reflects feedback from the public and industry following a 12-wek consultation period launched in 2025 (CPR, June 16, 2025). The guidance provides regulatory certainty on areas like how to ask for informed consent, how to provide transparent privacy information, and what tools must be provided to enable people to exercise their privacy rights, the ICO said in a news release.
The guidance focuses on several expectations that the ICO said it would monitor with respect to IoT manufacturers and developers, including the following:
Privacy must be built in from the start, not bolted on afterward;
Consent must be real, specific, and freely given via a clear opt-in;
Genuine transparency is more than just a privacy notice and must include elements like clear information in plain language;
Most firms will have to do a data protection impact assessment, particularly with respect to sensitive information and information involving children; and
Security is an ongoing legal obligation, not a one-time consideration.
“Connected devices process some of the most sensitive data about people's lives, from data about health to daily routines and family life,” said William Malcolm, the ICO’s executive director–regulatory risk and innovation. “Product and device innovation holds huge potential to make a positive impact in so many areas of people’s lives, but that innovation must work for everyone. It is vital that product developers put privacy at the centre of product design and use data fairly and transparently.”
News: InternationalLegislation DataPrivacy DataSecurity