Quick answer

Start with the data flow, not the legal label. List what the device collects, what the app sends, what the cloud stores, which SDKs receive data and which cookies or pixels run on the website.

Then decide whether GDPR, UK GDPR, EU Data Act, US state privacy laws, children's rules, app-store policies or a regulated-sector rule actually applies. Do not assume every conditional law applies to every product.

Why IoT compliance is different

Each evidence item should have an owner, a document location and a test date.

  • One product has multiple surfaces: device firmware, mobile app, cloud account, support portal and marketing website.
  • Device identifiers, Wi-Fi details, precise location, video, audio and occupancy patterns can be sensitive in combination.
  • Analytics, crash reporting, advertising, payments and customer-support SDKs often receive more data than the product team expects.
  • Apple and Google disclosures are not law, but an inconsistent privacy label can trigger rejection, removal or trust damage.
  • Firmware support, security updates and incident response are part of the product promise, especially for cameras, locks, children's devices and health products.

2026 rule map

  • EU/EEA GDPR: personal data, household identifiers, account data, app analytics, cloud logs and support records. Check lawful basis, rights, retention, transfers and processor contracts.
  • EU ePrivacy and national cookie rules: website cookies, pixels, local storage and electronic marketing. Strictly necessary storage is not treated like optional tracking.
  • EU Data Act: connected-product and related-service data access, sharing and switching. The regulation applies from 12 September 2025; scope and role need a case-by-case review.
  • EU AI Act: possible transparency, documentation and risk-management duties when AI features are present. Not every AI feature is high-risk; the use case determines the route.
  • UK GDPR, PECR and the Data (Use and Access) Act 2025: UK users, cookies, marketing and data rights. The 2025 reforms are being commenced in phases, so verify the current commencement date.
  • US state privacy laws and CCPA/CPRA: thresholds, consumer rights, opt-outs and disclosures vary by state. There is no single federal comprehensive privacy statute.
  • COPPA, FTC Act and children's platform rules: toys, baby monitors, kids' watches and family accounts need age, parental-consent and marketing review.
  • Apple App Privacy Details, ATT, Google Play Data Safety and Families policies: platform requirements that must match the privacy notice and actual SDK behavior. Conditional rules such as DSA, DMA, NIS2 or DORA apply only after confirming the role.

Eight checks to run before launch

  1. 01. Data-flow map: record every field collected by the device, app, SDK, cloud, support tool and website, including purpose, recipient, storage location and retention.
  2. 02. Roles and vendors: decide who is controller, processor or joint controller for each flow; attach data-processing terms and sub-processor lists to the evidence pack.
  3. 03. SDK and tracker inventory: document purpose, initialization trigger, data sent, consent flag and opt-out path for analytics, ads, crash, payments and social SDKs.
  4. 04. Consent design: test the actual screens. Optional tracking must not start before the required choice, and refusing must be as easy as accepting.
  5. 05. Minimization and retention: remove fields the product does not need, set deletion schedules and check backups, logs, analytics and support tickets as well as the primary database.
  6. 06. Account and device deletion: test in-app deletion, device unlinking, cloud backup removal, third-party deletion and the response users receive after the request.
  7. 07. Transfers and security: identify international transfers, confirm a valid transfer mechanism, enforce least privilege and keep an incident runbook with breach-assessment steps.
  8. 08. Labels and notices: compare the privacy notice, Apple privacy answers, Google Data Safety form, in-app permission text, SDK behavior and website tracking description. Resolve every mismatch.

App-store disclosures are a consistency test

  • List the data categories actually linked to the user or device, not every field the app is technically capable of collecting.
  • Explain the purpose in plain language: pairing, account management, analytics, advertising, diagnostics, support or personalization.
  • Check ATT and tracking definitions carefully; do not describe a third-party advertising identifier as anonymous analytics if it can be used to track the user.
  • Test the delete-account route that the store requires and keep a dated screenshot of the flow.

The website is part of the IoT data chain

  • Map cookies, local storage, pixels, chat widgets and tag-manager events before writing the cookie notice.
  • Make the privacy notice reflect the actual app, device and cloud data flows; do not copy the app policy without checking the website stack.
  • Review price, compatibility, certification and performance claims against evidence; unsupported IoT claims can become consumer-protection or advertising issues.
  • Check checkout, subscriptions, renewals, cancellation, reviews and UGC in the markets where they are offered, and keep accessibility and contact information usable.

Build an evidence pack

Data inventory and flow diagram, with owners and systems.
SDK inventory, data-processing agreements and sub-processor list.
Consent screenshots, event logs and a record of SDKs blocked before consent.
A dated account-and-device deletion test, including cloud and third-party deletion.
Retention schedule, transfer assessment, access-control review and incident runbook.
Copies of app-store privacy answers, website cookie scan and the current privacy notice version.

A 30-day starting plan

Days 1–7: map data, SDKs, vendors, user journeys and the markets where the product is offered.
Days 8–18: fix high-risk gaps first: consent timing, sensitive data, deletion, transfers, children and incident response.
Days 19–30: align the privacy notice, app-store labels and website disclosures; run one end-to-end evidence test and schedule the next review.

Common IoT compliance mistakes

  • Treating one generic privacy policy as the whole compliance program.
  • Loading advertising or analytics SDKs before the required consent choice.
  • Offering account deletion without deleting or unlinking device, cloud and backup records.
  • Answering app-store privacy questions from memory instead of the data map and SDK tests.

Frequently asked questions

Which laws usually apply to an IoT app?

There is no single answer. It depends on the user location, data categories, product function, customer type and company role. GDPR or UK GDPR, consumer and ePrivacy rules, app-store policies and sector rules are common starting points.

Is a privacy policy enough?

No. A policy explains the framework; it does not prove consent, deletion, access control, retention, vendor contracts or app-store label accuracy. Those need operational evidence.

Does the EU Data Act apply to every connected product?

No. It is a conditional regulation for connected products and related services, with specific definitions, roles and timelines. It is separate from GDPR and does not replace personal-data obligations.

When is consent needed for cookies or SDKs?

Under EU rules, non-essential tracking generally requires consent, while strictly necessary storage may be exempt. App tracking and advertising SDKs need a separate analysis of GDPR, ePrivacy and platform rules; the exact answer depends on the market and implementation.

What is the highest-risk IoT data?

Video, audio, precise location, health and biometric data, children's data, access credentials and occupancy patterns deserve early review. Risk increases when these data are linked to a household, account or device over time.

Official sources and verification

This guide is an editorial research tool for product, app, security and operations teams. It is not legal advice. Confirm the applicable law and facts with qualified counsel in each target market.