On 16 June 2025, the UK’s Information Commissioner’s Office (ICO) published its first guidance for the developers and manufacturers of household smart products. The move comes as research shows four in five UK residents now own at least one such device, and public workshops have revealed significant consumer concern over excessive data collection and a lack of control.
The new guidance clarifies how data protection law applies to these products and sets out clear expectations for companies.
Key Principles for Manufacturers:
- Be Transparent: Organisations must be clear with users about how their personal information is being collected and used.
- Data Minimisation: Only the information that is necessary for the product to function should be collected.
- Uphold User Rights: Companies must make it easy for people to exercise their data protection rights, such as the right to have their data deleted from the product.
- Consent for Advertising: Personal information should only be used for personalised advertising if the user has given their consent.
The ICO's Executive Director for Regulatory Risk, Stephen Almond, stated that while the goal is to help organisations get privacy right from the start, the ICO is "ready to take action if necessary to protect people from harm." This guidance signals a clear intent to monitor the rapidly growing smart device market and enforce compliance.
