DRAFT: IoTAB Privacy Recommendations September 2023 

R9 to R12

The recommendations below are based on the presentations made to the IoTAB 

regarding Data Privacy and IoT: 

Andrea Amico, Privacy 4 Cars

Topic - Privacy in automobiles

IoTAB subgroup - privacy

Jeff Jockisch (Avantis Privacy), Colby Scullion (Avantis Privacy)

Topic - Location data privacy

IoTAB subgroup - privacy

R09 - Include IoT Privacy Information on New Car Automobile “Monroney Stickers” 

● Description of recommendation to the US government: 

a. Include IoT Privacy Information on “Monroney Stickers” for New Car 

Automobiles Sold in the US

● Justification for the recommendation:

a. Monroney Stickers already offer crucial information like fuel efficiency and 

safety ratings, making them a logical platform for additional disclosures

b. Providing IoT privacy information helps consumers make informed 

decisions regarding their personally identifiable information, including 1) 

data collection, 2) data retention, and 3) data sale 

c. Aligns with broader initiatives to enhance consumer protection and data 

privacy

d. Addresses growing public concern about how personal data is used and 

shared by IoT devices in automobiles

e. Additional Statistics From the Racent Mozilla Automoble Privacy Report:
DRAFT: IoTAB Privacy Recommendations September 2023 

R9 to R12

i. 100% of the 25 car brands reviewed by The Mozilla Foundation 

collect personal data 

ii. 84% of car brands share or sell your data

iii. 92% give drivers little to no control over their personal data

iv. 68% of the car brands earn the “bad track record” ding for leaks, 

hacks, and breaches that threatened their drivers’ privacy

v. 0% of car brands that are part of the ALLIANCE FOR AUTOMOTIVE 

INNOVATION follow voluntary Consumer Protection Principles and 

pledges to provide consumers with privacy-preserving principles 

such as “data minimization,” “transparency,” and “choice.

● Implementation Considerations that the US government needs to consider:

a. Standardization Privacy Information: The language used for IoT privacy 

statements should be clear, concise, and standardized to prevent 

confusion.

b. Regulatory Alignment: Existing privacy laws must be reviewed to ensure 

that the sticker amendments align with current legal frameworks.

c. Periodic Updates: As IoT technologies evolve, the criteria for what must be 

disclosed should also be updated periodically.

● Potential implementation barriers to the US government:

a. Resistance from Automakers: Automakers may resist this change due to 

the costs of modifying Monroney Stickers.
DRAFT: IoTAB Privacy Recommendations September 2023 

R9 to R12

b. Consumer Education: There's a possibility that consumers may not fully 

understand the added IoT information.

c. Complex Regulatory Environment: The landscape of IoT and privacy is 

complex, making standardization challenging.

● Possible participating agencies in the US government who could assist or 

champion this recommendation:

a. Federal Trade Commission (FTC)

b. National Highway Traffic Safety Administration (NHTSA)

c. Federal Communications Commission (FCC)\Department of 

Transportation (DOT)

d. Cybersecurity and Infrastructure Security Agency (CISA)

● Things that the US Federal government should consider when implementing this 

recommendation:

a. Automobile Information Disclosure Act of 1958, 15 U.S.C. §§ 1231–1233 

(Public Law 85-506)

R10 - Mandate NIST Sanitization Standards for Used Automobiles Before Resell

● Description of recommendation to the US government:

a. Before reselling, the government should require that car seller organizations 

adhere to NIST's media sanitization guidelines.

● Justification for the recommendation:
DRAFT: IoTAB Privacy Recommendations September 2023 

R9 to R12

a. Aligns with the e-Stewards Standard, supported by the Environmental 

Protection Agency (EPA) Recycling Program.

b. Proper data sanitization can protect consumer privacy and prevent 

unauthorized access to sensitive information stored in modern vehicle 

systems.

● Implementation Considerations that the US government needs to consider:

a. Cost of implementation for car sellers

b. Training and awareness programs for the car sellers about NIST 

guidelines

c. Technology infrastructure required to support the sanitization processes 

d. Monitoring and compliance mechanisms

● Potential implementation barriers to the US government:

a. Resistance from car-selling organizations due to increased operational 

costs

b. Potential technological limitations in older vehicle models

c. Legal challenges concerning data privacy and compliance

● Possible participating agencies in the US government who could assist or 

champion this recommendation:

a. National Institute of Standards and Technology (NIST)

b. Department of Transportation (DOT)

c. Federal Trade Commission (FTC)

d. Environmental Protection Agency (EPA)
DRAFT: IoTAB Privacy Recommendations September 2023 

R9 to R12

● Things that the US Federal government should consider when implementing this 

recommendation:

a. Use National Cybersecurity Strategy Implementation Plan July 2013 - 

Initiative Number: 1.1.3 Initiative Title: Increase agency use of frameworks 

and international standards to inform regulatory alignment

b. Use NIST Cybersecurity Framework - PROTECT - Secure Data - 800-88 Rev. 

1 - Guidelines for Media Sanitization

c. Use The EPA’s Implementation (Electronics Recycling Standards: R2 and 

e-Stewards)

R11 - Endorse Universal Opt-Out Signals for IoT Devices and Companion Apps

● Description of recommendation to the US government:

a. The government should endorse adopting and recognizing Universal OptOut Signals for Internet of Things (IoT) devices and any associated 

applications.

● Justification for the recommendation:

a. The recommendation aims to strengthen user privacy and data protection, 

which are growing concerns in an increasingly interconnected world.
DRAFT: IoTAB Privacy Recommendations September 2023 

R9 to R12

b. Universal Opt-Out Signals would streamline the user experience, making it 

easier for consumers to manage their privacy settings across multiple IoT 

devices and companion apps.

● Implementation Considerations that the US government needs to consider:

a. The technical feasibility of implementing Universal Opt-Out Signals across 

a wide range of IoT devices and companion apps.

b. Costs associated with setting up the infrastructure to recognize and

enforce these Opt-Out Signals.

c. Developing standardized guidelines or legislation to mandate the adoption 

of Universal Opt-Out Signals.

● Potential implementation barriers to the US government:

a. Resistance from IoT manufacturers and app developers who may not

want to incur the cost or complexity of implementing Universal Opt-Out 

Signals.

b. Technological constraints in harmonizing Opt-Out Signals across diverse 

platforms and devices.

c. Potential legislative hurdles if this conflicts with existing data protection 

or privacy laws.

● Possible participating agencies in the US government who could assist or 

champion this recommendation:

a. Federal Trade Commission (FTC)

b. National Institute of Standards and Technology (NIST)
DRAFT: IoTAB Privacy Recommendations September 2023 

R9 to R12

c. Federal Communications Commission (FCC)

d. Department of Commerce

● Things that the US Federal government should consider when implementing this 

recommendation:

a. Use National Cybersecurity Strategy Implementation Plan July 2013 

Initiative Number: 3.2.2 - Initiative Title: Initiate a U.S. Government IoT 

security labeling program (Cyber Trustmark)

b. UOO - The California Consumer Privacy Act (CCPA), as amended by the 

California Privacy Rights Act (CPRA) - Law Passed: January 1, 2023 - 

Provision Enforcement starts: June 2024

c. UOO - Colorado Privacy Act (CPA) - Law Passed: July 1, 2023 - Provision 

Enforcement starts: July 1, 2024

d. UOO - Connecticut Data Privacy Act (CTDPA) - Law Passed: July 1, 2023 - 

ProvisionEnforcement starts: July 1, 2024

R12 - Add "Location Tracking Enabled" notice to U.S. Cyber Trust Mark IoT devices

● Description of recommendation to the U.S. government: 

a. Include as part of the proposed privacy transparency system for IoT devices, 

using the “U.S. Cyber Trust Mark”, the following statement regarding the privacy 

of location data, if applicable: Proposed Statement for Inclusion: "Notice: Precise 

location tracking is enabled by default on this device."
DRAFT: IoTAB Privacy Recommendations September 2023 

R9 to R12

● Justification for the recommendation:

a. Transparency: Consumers have a right to know if their location data is 

being collected and shared. This statement provides immediate and clear 

information regarding this aspect.

b. Informed Consent: For ethical data collection and use, consumers should 

be aware of what data is being collected without needing to delve into 

complex privacy policies.

c. Regulatory Alignment: This recommendation aligns with various data 

protection regulations advocating transparency and informed consent.

● Implementation Considerations that the US government needs to consider:

a. Standardization: The statement's wording, visibility, and placement should 

be standardized across all IoT devices that receive the U.S. Cyber Trust 

Mark.

b. Technical Feasibility: How will the notice be displayed? Will it be part of 

the physical label, on a website, or listed in an app for user awareness?

c. Audits and Compliance: Systems need to be in place to verify that the 

companies adhere to the notification requirement.

● Potential implementation barriers to the US government:

a. Industry Resistance: Manufacturers may resist the implementation due to 

perceived negative impacts on sales or added complexity.

b. Consumer Education: There is the risk that consumers may fail to 

understand the importance of the notice.
DRAFT: IoTAB Privacy Recommendations September 2023 

R9 to R12

c. Legal Challenges: Companies may argue that this constitutes an unfair 

labeling or notice burden.

● Possible participating agencies in the US government who could assist or 

champion this recommendation:

a. Federal Trade Commission (FTC)

b. National Institute of Standards and Technology (NIST)

c. Federal Communications Commission (FCC)

● Things that the US Federal government should consider when implementing this 

recommendation:

a. Use National Cybersecurity Strategy Implementation Plan July 2013 - 

Initiative Number: 4.6.1 Initiative Title: Publish a National Cyber Workforce 

and Education Strategy