On Tuesday morning at the annual State of the Net conference in Washington DC, Federal Trade Commission Chairwoman Edith Ramirez gave a keynote address announcing the FTC's latest initiative: watching the Internet of Things for privacy violations. The commission recently voted four to one to issue a report pointing out a number of best practices that the FTC expects the nascent Internet of Things industry to follow. The report, released today (PDF), included some softer recommendations as well.

Although the report largely reiterates most of the statements Ramirez made at CES three weeks ago , the official backing from the FTC's commissioners is an important step toward keeping a more watchful eye on companies out to make a quick buck without a corresponding consumer protection plan.

"I think it's important to understand how an Internet of Things world changes the landscape,” Ramirez told the audience this morning. “You're now in a world where data is being collected all the time... we're bringing these devices into our homes, into what used to be private sphere.”

“We believe that by adopting the best practices we’ve laid out, businesses will be better able to provide consumers the protections they want and allow the benefits of the Internet of Things to be fully realized,” Ramirez added.

The FTC defined Internet of Things (or IoT) devices as any gadgets or sensors that transmit information about the owner over an Internet connection—excluding gadgets like computers, smartphones, or tablets. Smart fridges, connected movement sensors, and devices that connect blood glucose levels are all things that would qualify under the IoT umbrella. In its report, the FTC also noted that Apple's HealthKit, Microsoft Health, and other platforms that accept data about a person's well-being could make it easier for third-party device makers to join the data-collection game.

Although the FTC isn't yet asking for its guidelines to be backed by specific legislation, its report does make clear a few security practices that the commission will be watching growing IoT companies for. Some of these directives ask companies to:

Build security into devices at the outset rather than as an afterthought in the design process

Train employees about the importance of security and ensure that security is managed at an appropriate level in the organization

Ensure that when outside service providers are hired, that those providers are capable of maintaining reasonable security and provide reasonable oversight of the providers

When a security risk is identified, consider a “defense-in-depth” strategy whereby multiple layers of security may be used to defend against a particular risk

Consider measures to keep unauthorized users from accessing a consumer’s device, data, or personal information stored on the network

Monitor connected devices throughout their expected life cycle, and where feasible, provide security patches to cover known risks

One of the FTC's tools to ensure compliance is bringing civil litigation against companies that seem to be engaging in unfair practices or using customer data in ways the customer might not be aware of. As recently as this December, the FTC issued an order against SnapChat for misrepresenting “the extent to which [SnapChat] or its products or services maintain and protect the privacy, security, or confidentiality of any covered information." In that settlement, SnapChat had to agree to rewrite its marketing to make sure customers weren't led to believe the platform was completely private, and SnapChat now has to submit to an independent privacy monitor for the next 20 years.

How much data do companies need to collect?

Still, the FTC admitted in a press release that its report “takes a flexible approach to data minimization.”

“Under the recommendations, companies can choose to collect no data, data limited to the categories required to provide the service offered by the device, less sensitive data; or choose to de-identify the data collected,” the FTC wrote.

That approach might be considered wishy-washy to more aggressive privacy advocates, but at today's State of the Net conference, Ramirez noted that she still wants companies to think about data collection from a security standpoint. “I think that it's important in today's world to have companies be mindful of the data you're collecting,” she said, adding that the more data a company collects on its customers, the better a target it is for malicious hackers. “If you have data that you don't really need, that's an unnecessary risk,” she said.

Ramirez also said that the FTC's report is very concerned with at least making sure customers know what they're giving up before they start letting themselves be tracked. “The volume of data being generated is exponentially greater now,” Ramirez said. If she were, for instance, tracking how many calories she was eating, she wouldn't want to have that information shared with her insurance company. “It's really, in my mind, fundamental that consumers continue to be in the driver's seat. A lot of these devices don't have any consumer interface,” she said, using an example of a pedometer-enabled sock that was recently announced. “These companies need to be innovative in the way they communicate with consumers.”

Of course, not everyone is behind the FTC's new report. Commissioner Joshua D. Wright was the only FTC member to issue a dissenting opinion, in which he said that he thought the FTC should do a more detailed look into the IoT industry to make sure that the Commission's "policy recommendations are more likely to foster competition and innovation than to stifle it." There is a bit of nervousness that if the FTC comes on too strong with guidelines and implied obligations, that will scare innovators away from starting IoT companies.

Still, as Ramirez told Ars three weeks ago, “There’s a way to approach these issues that’s going to be thoughtful and going to be balanced. I also think that [pushing for privacy and security is] going to engender consumer trust and will only help new industries like the Internet of Things to flourish.”