Written by: Haim Ravia, Dotan Hammer
The UK Information Commissioner’s Office (ICO) has published finalized guidance on consumer Internet of Things (IoT) products and services, setting out clear expectations for manufacturers and developers on how to use people’s personal information responsibly. Announced on 11 June 2026, the guidance reflects feedback from the public and industry following a 12-week consultation and provides regulatory certainty on matters such as how to obtain informed consent, how to provide transparent privacy information, and what tools must be available for people to exercise their data rights.
The ICO sets out a series of expectations for IoT manufacturers and developers: privacy must be built in from the start rather than bolted on afterwards, with protective settings on by default and data collection limited to what is strictly necessary; consent must be real, specific, and freely given through a clear opt-in, and just as easy to withdraw; genuine transparency goes beyond a privacy notice, requiring plain-language information at relevant points across the whole product; most firms will need to carry out a Data Protection Impact Assessment, with an even higher bar where children may use the product; and security is an ongoing legal obligation requiring regular updates, encryption, and multi-factor authentication throughout the product’s lifetime.
The guidance covers the full range of consumer IoT products—including smart speakers, connected TVs, fitness trackers, smart doorbells, home hubs, and domestic appliances—but does not cover smart meters, connected and autonomous vehicles, or IoT products used in enterprise and industrial settings. It forms part of the ICO’s wider online tracking strategy, and the regulator has signaled that it will next turn its attention to connected TVs and how they use personal information to serve targeted advertising.
Click here to read the ICO’s announcement.
