Much has been made of the security risks inherent to the “Internet of Things,” or IoT, the vast (and growing) universe of connected products ranging from fitness trackers and smart TVs to self-driving vehicles and virtual assistants. Last week, news broke that an Amazon Echo recorded a family’s conversation and sent the audio to someone in their contacts list. Other headlines have told of hackers illegally accessing data from “smart” teddy bears, baby monitors, cardiac implants and other devices; last month, the governments of the United States and Britain issued an ominous joint warning that Russian hackers could use the IoT to siphon data from individuals and organizations alike.

Yet for all the cases of hackers illegally accessing data from IoT products, few consumers are aware that many IoT devices are designed to collect and share potentially private data as part of their normal operation. The stakes are enormous: as more products come equipped with cameras and microphones — not to mention thermal sensors, accelerometers, facial and biometric analysis, and GPS — we are quietly building a sensor fabric that may soon be inescapable, even inside private spaces like the home.

ADVERTISEMENT

As “smart” becomes the new default setting for devices, the privacy risks are not always clear, especially as companies combine data from multiple sources to infer an individual’s habits, movements, and emotional states.

As research shows, makers of IoT devices too often fail to properly disclose to consumers what data they are capturing and how and where it may be shared. Many products’ privacy policies are difficult to find and nearly impossible to understand. Once installed, many IoT devices operate silently in the background and, unlike computers or mobile devices, do not have interfaces that allow users to view or change their privacy settings. Even people who never purchase an IoT product will be subject to IoT surveillance, as public spaces are increasingly peppered with security cameras, smart billboards, in-store retail tracking systems, and other technologies. Even Madison Square Garden is quietly using face recognition on audiences, according to the New York Times.

In late 2017, a consumer advocacy group published research on a range of patents secured by Google and Amazon relating to potential future functions of their digital home assistant products. In one of these, Amazon patented a method for extracting keywords from ambient speech which would then trigger targeted advertising. In another patent, Google describes a smart home in which “mischief may be inferred based upon observable activities” by children.

This spooky future is avoidable, if key actions are taken. First, makers of web-connected products must be held more accountable for disclosing how users’ data are shared, stored, and analyzed. IoT products should provide periodic notifications about what they are capturing, not just at setup, but throughout their life cycle. Device makers should also commit to only collecting data for which they have specific uses, rather than hoard it for some unknown, future use, and they should delete data when it is no longer needed. Makers of IoT products should incorporate “Do Not Collect” switches or software toggles (e.g., a microphone mute button) to enable users to limit or kill data collection, and they should enable selective sharing to let consumers share data with this person but not that person.

Regulators, meanwhile, should set better standards for how data can be collected and shared. Federal lawmakers in the U.S. can start by clarifying which agency (or agencies) are responsible for enforcement of privacy regulations for different IoT products, and they should move toward adopting an omnibus privacy law to fill gaps left by ineffective industry self-regulation. A single regulatory framework, similar to Europe’s General Data Protection Regulation, would provide users and manufacturers with necessary clarity, and establish a better baseline for citizen’s privacy expectations.

All devices introduced to the IoT should meet basic security requirements, such as encrypting data, strong authentication, and automatic security updates. But in addition to staving off hackers, IoT devices should protect individuals’ privacy as part of their design. Otherwise, before we know it, the relentless data-tracking practices that have become business as usual online will migrate to the offline world, and the concept of a private space where we can retreat, be anonymous, and avoid the gaze of commercial companies and other people will become a quaint relic of the past.