What to include in disclaimer and privacy policy of IoT devices and services?
<p><a href="https://en.wikipedia.org/wiki/Internet_of_things" rel="nofollow">IoT</a> allows any devices to connect to a server which collect sensitive privacy data such as whether or not you are at home etc.</p>

<p><strong>What are the main consent of users that need to be addressed when it comes to IoT devices?</strong></p>

<p>I've just started reading about privacy in IoT therefore I thought I might give you some pointers (my day to day work is spent on making privacy policies and their management for websites and apps easier at <a href="https://www.iubenda.com" rel="nofollow noreferrer">iubenda</a>).</p>

<p>I think reading through any <a href="https://www.ipc.on.ca/wp-content/uploads/2013/09/pbd-primer.pdf" rel="nofollow noreferrer">privacy by design principles</a> might be the best start.</p>

<p>I'm citing from a worksheet published by a Pan-European entity called the Article 29 Working Party (which I will link to at the bottom of this answer): </p>

<blockquote>
  <p>In particular, users must remain in complete control of their personal
  data throughout the product lifecycle, and when organisations rely on
  consent as a basis for processing, the consent should be fully
  informed, freely given and specific.</p>
</blockquote>

<p>Consent on IoT devices isn't really a simple matter.</p>

<p>For example, displaying a privacy policy document on your site is not sufficient. The <a href="https://www.ftc.gov/system/files/documents/reports/federal-trade-commission-staff-report-november-2013-workshop-entitled-internet-things-privacy/150127iotrpt.pdf" rel="nofollow noreferrer">FTC recommends</a> (relevant for US based activities) that you find a way to present privacy notices and multiple choices of levels to customers, including in the set-up or purchase of the IoT device itself. </p>

<p>Again, here is the Art 29 WP</p>

<blockquote>
  <p>In addition, classical mechanisms used to obtain individuals’ consent
  may be difficult to apply in the IoT, resulting in a “low-quality”
  consent based in a lack of information or in the factual impossibility
  to provide fine-tuned consent in line with the preferences expressed
  by individuals. In practice, today, it seems that sensor devices are
  usually designed neither to provide information by themselves nor to
  provide a valid mechanism for getting the individual’s consent. Yet,
  new ways of obtaining the user’s valid consent should be considered by
  IoT stakeholders, including by implementing consent mechanisms through
  the devices themselves.</p>
</blockquote>

<p>There is no one-size-fits-all approach. Users must be able to access, view and remove the data you collect from them. Users should be able to disconnect their IoT devices when they want to do so.</p>

<p>Another issue deserving of your attention is "<strong>sensitive data</strong>", again quoted from the Art 29 WP document: </p>

<blockquote>
  <p>Applications in the IoT may process personal data that can reveal
  racial or ethnic origin, political opinions, religious or
  philosophical beliefs, trade-union membership, health or sex life,
  which actually qualify as “sensitive data”, deserving special
  protection in the sense of Article 8 of Directive 95/46/EC. In
  practice, the application of Article 8 to sensitive data in the IoT
  requires that data controllers obtain the user’s explicit consent,
  unless the data subject has made himself the data public.</p>
</blockquote>

<p>This type of data needs explicit consent.</p>

<p>Beyond the requirement of fair collection of the data, you must communicate
specific information about the product: the identity of the controller,
the purposes of the processing, the recipients of the data, the existence of their rights of access and right to oppose (which includes information about how to disconnect the object to prevent disclosure of further data).</p>

<p>Hopefully this helps to get started and here are some resources:</p>

<p><a href="https://www.ftc.gov/system/files/documents/reports/federal-trade-commission-staff-report-november-2013-workshop-entitled-internet-things-privacy/150127iotrpt.pdf" rel="nofollow noreferrer">https://www.ftc.gov/system/files/documents/reports/federal-trade-commission-staff-report-november-2013-workshop-entitled-internet-things-privacy/150127iotrpt.pdf</a></p>

<p><a href="http://ec.europa.eu/justice/data-protection/article-29/documentation/opinion-recommendation/files/2014/wp223_en.pdf" rel="nofollow noreferrer">http://ec.europa.eu/justice/data-protection/article-29/documentation/opinion-recommendation/files/2014/wp223_en.pdf</a></p>

<p><a href="http://www.internet-of-things-research.eu/pdf/IERC_Position_Paper_IoT_Governance_Privacy_Security_Final.pdf" rel="nofollow noreferrer">http://www.internet-of-things-research.eu/pdf/IERC_Position_Paper_IoT_Governance_Privacy_Security_Final.pdf</a></p>

privacy disclaimers