Assessing Privacy Policies of Internet of Things Services

Abstract

This paper provides an assessment framework for privacy policies of Internet of Things Services which is based on particular GDPR requirements. The objective of the framework is to serve as supportive tool for users to take privacy-related informed decisions. For example when buying a new fitness tracker, users could compare different models in respect to privacy friendliness or more particular aspects of the framework such as if data is given to a third party. The framework consists of 16 parameters with one to four yes-or-no-questions each and allows the users to bring in their own weights for the different parameters. We assessed 110 devices which had 94 different policies. Furthermore, we did a legal assessment for the parameters to deal with the case that there is no statement at all regarding a certain parameter. The results of this comparative study show that most of the examined privacy policies of IoT devices/services are insufficient to address particular GDPR requirements and beyond. We also found a correlation between the length of the policy and the privacy transparency score, respectively.

SoK

“…We categorize the content in each facet according to a taxonomy of privacy policies. Several taxonomies have been proposed to categorize the content of privacy policies [77,96,109]. We use a slight variation of [109].…”

The neoliberal perils of yoga and self-care on apps and platforms

“…Requiring Yoga-Go users to read and understand multiple privacy policies in order to grasp the extent to which their data are used and potentially compromised, creates an unreasonable expectation and burden for Yoga-Go users. Privacy policies are, in theory, essential for establishing data-handling practices and transparency; yet, as researchers have shown, privacy policies tend to be neglected (Fabian et al, 2017;Paul et al, 2018). While a number of reasons factor into the general neglect of reading privacy policies, trust and readability are two of the most commonly cited factors.…”

“…On average, not only are privacy policies lengthy to read, they "are difficult to comprehend as a whole" (Fabian et al, 2017: 21). The complexities of legal jargon that are present in many privacy policies obfuscate the ways in which user data are collected, sold or used for advertising revenue (Paul et al, 2018).…”

‘They’re all about pushing the products and shiny things rather than fundamental security’:Mapping socio-technical challenges in securing the smart home

“…Indeed, work by Kelley et al (2009) and Cranor (2012) speaks of a "privacy nutrition label", which draws on food nutrition labelling regimes with a view to informing the design of similarly standardised labels or icons. It has been empirically proved that privacy notices for IoT products are poorly accessible, making it hard for consumers to make meaningful use of them (Paul et al, 2018;Perez et al, 2018;Emami-Naeini et al, 2019). As such, making information available to consumers of IoT products in a truly legible and usable manner should be a priority for policymakers.…”