DRAFT: IoTAB Privacy Recommendations_April 2023 1 to 6

1. Simplifying Privacy Policies for Reading Accessibility

Description of recommendation to the US government:

● Advocate for the simplification of privacy policies, privacy notices, and data use

policies to enhance accessibility and comprehension for users.

● Promote the adoption of the "Plain Writing Act of 2010" (Public Law 111-274) as

a means for the government to enforce this recommendation on organizations

that provide IoT technology to the government.

Justification for the recommendation:

● Improved understanding of data privacy policies for users, leading to more

informed decisions when using IoT devices.

● Enhanced public trust in IoT devices and related technologies.

● Simplified policies may lead to increased compliance and reduced legal disputes.

Implementation Considerations that the US government needs to consider:

● Develop guidelines and best practices for organizations to follow when

simplifying privacy policies.

● Establish high-level guidance for evaluating and assessing the readability of

privacy policies

● Coordinate with relevant stakeholders, including the private sector and consumer

advocacy groups, to ensure widespread adoption.

Potential implementation barriers to the US government:

● Resistance from organizations that may perceive simplification as a limitation on

their legal protections.

● Possible challenges in defining the appropriate level of simplification while

maintaining accuracy and comprehensiveness.

Possible participating agencies in the US government who could assist or champion

this recommendation:

● Federal Trade Commission (FTC)

● National Institute of Standards and Technology (NIST)

● Department of Commerce (DoC)
DRAFT: IoTAB Privacy Recommendations_April 2023 1 to 6

● Federal Communications Commission (FCC)

● The Office of Management and Budget (OMB) is responsible for overseeing the

implementation of the Act and ensuring that each agency has a Plain Writing

program in place.

Things that the US Federal government should consider when implementing this

recommendation:

● Ensuring that simplification efforts do not inadvertently lead to the omission of

critical information in privacy policies.

● Recognizing that simplified language may not resolve all issues related to data

privacy and that additional efforts to educate the public on IoT and data privacy

may be necessary.

● Continuously monitoring and updating the simplification guidelines to account

for technological advancements and emerging privacy concerns.

2. Establish “data use” basics for privacy policies

Create a set of "data use" basics that must be included in privacy policies for IoT devices

Ensure that these policies are designed with the consumers' needs and understanding in

mind

Justification for the recommendation:

● Provides consumers with a standardized baseline of information regarding data use,

making it easier for them to compare and understand different policies

● Enhances trust in IoT technology by ensuring transparency and consistent

communication of data practices

Implementation Considerations that the US government needs to consider:

● Create guidelines on how to effectively communicate these basics in privacy policies

● Encourage or require IoT device manufacturers to adopt these "data use" basics in their

privacy policies

Potential implementation barriers to the US government:
DRAFT: IoTAB Privacy Recommendations_April 2023 1 to 6

● Ensuring broad adoption and compliance with the established "data use" basics across

different industries and sectors

● Balancing the need for standardized information with the unique characteristics and

data practices of individual IoT devices and services

Possible participating agencies in the US government who could assist or champion this

recommendation:

● Federal Trade Commission (FTC)

● Department of Commerce (DoC)

● National Institute of Standards and Technology (NIST)

● Federal Communications Commission (FCC)

Things that the US Federal government should consider when implementing this

recommendation:

● The potential impact on market competition and innovation if new regulations are

perceived as burdensome or restrictive

● Providing resources and support to companies in adopting and implementing the "data

use" basics in their privacy policies

● Regularly reviewing and updating the "data use" basics to ensure they remain relevant

and effective as IoT technology evolves and new data privacy concerns emerge

3. Learning from CCPA, GDPR, and other Privacy Regulations

Description of recommendation to the US government:

● Analyze and learn from existing privacy regulations, such as the California

Consumer Privacy Act (CCPA), General Data Protection Regulation (GDPR), and

others

● Develop a high level privacy framework for IoT devices, incorporating successful

elements and lessons learned from these regulations

Justification for the recommendation:

● Leveraging the experience and knowledge gained from implementing existing

privacy regulations can help create a more effective and efficient IoT privacy

framework
DRAFT: IoTAB Privacy Recommendations_April 2023 1 to 6

● Provides a foundation for a harmonized approach to privacy in the IoT sector,

reducing confusion and fragmentation for both consumers and businesses

Implementation Considerations that the US government needs to consider:

● Conduct a thorough analysis of the CCPA, GDPR, and other privacy regulations to

identify best practices, potential improvements, and lessons learned

● Ensure that the IoT privacy framework is adaptable and scalable to

accommodate the rapidly evolving nature of IoT technology and the data privacy

landscape

Potential implementation barriers to the US government:

● Achieving consensus among stakeholders on the most effective elements and

practices to incorporate into the IoT privacy framework

● Overcoming potential resistance from industry participants who may perceive

new regulations as burdensome or restrictive

● Ensuring compatibility with existing privacy regulations at the state and

international level

Possible participating agencies in the US government who could assist or champion

this recommendation:

● Federal Trade Commission (FTC)

● Department of Commerce (DoC)

● National Institute of Standards and Technology (NIST)

● Federal Communications Commission (FCC)

Things that the US Federal government should consider when implementing this

recommendation:

● The need for a balance between protecting consumers' data privacy and

fostering innovation in the IoT sector

● The importance of providing resources, guidance, and support to businesses for

the adoption and implementation of the IoT privacy framework

● Regularly reviewing and updating the IoT privacy framework to ensure it remains

relevant and effective in addressing emerging data privacy challenges and

technological advancements
DRAFT: IoTAB Privacy Recommendations_April 2023 1 to 6

4. Create a National Privacy Framework for Innovation and Data Protection

● Develop a National Privacy Framework for Innovation and Data Protection

specifically tailored to the unique challenges posed by IoT devices

● Ensure that the framework balances the need for data privacy and security with

fostering innovation in the IoT sector

Justification for the recommendation:

● Provides a consistent, unified approach to data privacy and security in the IoT

sector, reducing confusion and fragmentation for both consumers and

businesses

● Encourages innovation by providing clear guidelines and expectations for IoT

device manufacturers, fostering a competitive and growth-oriented environment

Implementation Considerations that the US government needs to consider:

● Incorporate lessons learned from existing privacy regulations, such as the CCPA

and GDPR, to create a more effective and efficient framework

● Ensure that the framework is adaptable and scalable to accommodate the rapidly

evolving nature of IoT technology and the data privacy landscape

Potential implementation barriers to the US government:

● Achieving consensus among stakeholders on the most effective elements and

practices to incorporate into the National Privacy Framework

● Overcoming potential resistance from industry participants who may perceive

new regulations as burdensome or restrictive

● Ensuring compatibility with existing privacy regulations at the state and

international level

Possible participating agencies in the US government who could assist or champion

this recommendation:

● Federal Trade Commission (FTC)

● Department of Commerce (DoC)

● National Institute of Standards and Technology (NIST)

● Federal Communications Commission (FCC)
DRAFT: IoTAB Privacy Recommendations_April 2023 1 to 6

Things that the US Federal government should consider when implementing this

recommendation:

● The need for a balance between protecting consumers' data privacy and

fostering innovation in the IoT sector

● The importance of providing resources, guidance, and support to businesses for

the adoption and implementation of the National Privacy Framework

● Regularly reviewing and updating the National Privacy Framework to ensure it

remains relevant and effective in addressing emerging data privacy challenges

and technological advancements

5. Implementing US Federal Privacy Regulation

● Develop and implement a comprehensive US Federal Privacy Regulation that

addresses data privacy concerns for IoT devices and services

● Create a unified legal framework that supersedes state-level regulations,

providing clarity and consistency for both consumers and businesses

Justification for the recommendation:

● Streamlines and harmonizes data privacy regulations across the nation, reducing

fragmentation and confusion

● Ensures that IoT device manufacturers adhere to a consistent set of privacy

standards, enhancing consumer trust and protection

● Facilitates innovation by providing clear guidelines and expectations for IoT

businesses, fostering a competitive and growth-oriented environment

Implementation Considerations that the US government needs to consider:

● Use information gathered from stakeholders, including IoT device manufacturers,

privacy experts, and consumer advocacy groups, on the development of the

Federal Privacy Regulation

● Consider state-level regulations to ensure a unified federal regulation

● Regularly review and update the Federal Privacy Regulation to address emerging

data privacy challenges and technological advancements

Potential implementation barriers to the US government:
DRAFT: IoTAB Privacy Recommendations_April 2023 1 to 6

● Overcoming potential resistance from industry participants who may perceive

new regulations as burdensome or restrictive

● Achieving consensus among stakeholders and state-level regulators on the most

effective elements and practices to incorporate into the Federal Privacy

Regulation

● Ensuring compatibility with existing international privacy regulations, such as the

GDPR, for businesses operating in global markets

Possible participating agencies in the US government who could assist or champion

this recommendation:

● Federal Trade Commission (FTC)

● Department of Commerce (DoC)

● National Institute of Standards and Technology (NIST)

● Federal Communications Commission (FCC)

Things that the US Federal government should consider when implementing this

recommendation:

● The need for a balance between protecting consumers' data privacy and

fostering innovation in the IoT sector

● The importance of providing resources, guidance, and support to businesses for

the adoption and implementation of the Federal Privacy Regulation

● Collaborating with international partners to ensure global alignment and

interoperability of privacy regulations, fostering global trust and cooperation in

IoT data privacy and security

6. Privacy Label Creation for IoT

Description of recommendation to the US government:

● Develop and implement a privacy label system for IoT devices, similar to nutrition

labels on food products (similar to the White House initiative for cybersecurity

labeling)

● Display essential privacy information in an easily understandable format for

consumers, enhancing transparency and trust

Justification for the recommendation:
DRAFT: IoTAB Privacy Recommendations_April 2023 1 to 6

● Empowers consumers to make informed decisions about IoT devices based on

their privacy features and practices

● Encourages IoT device manufacturers to prioritize privacy, fostering competition

and innovation in privacy-enhancing technologies

● Enhances overall cybersecurity and data protection by promoting greater

consumer awareness of privacy practices

Implementation Considerations that the US government needs to consider:

● Consider input from privacy experts, industry stakeholders, and consumer

advocacy groups to develop the privacy label system, including content and

design

● Develop guidelines and standards for privacy labels, including required

information, format, and placement on packaging or product information

● Encourage or require IoT device manufacturers to adopt privacy labels and

provide resources to help them comply with the new requirements

Potential implementation barriers to the US government:

● Ensuring broad adoption and compliance with the privacy label system across

different industries and sectors

● Overcoming resistance from IoT device manufacturers who may perceive privacy

labels as burdensome, costly, or restrictive

● Balancing the need for comprehensive privacy information with simplicity and

ease of understanding for consumers

Possible participating agencies in the US government who could assist or champion

this recommendation:

● Federal Trade Commission (FTC)

● Department of Commerce (DoC)

● National Institute of Standards and Technology (NIST)

● Federal Communications Commission (FCC)

Things that the US Federal government should consider when implementing this

recommendation:

● The potential impact on market competition and innovation if privacy labels are

perceived as overly restrictive or burdensome
DRAFT: IoTAB Privacy Recommendations_April 2023 1 to 6

● The need to educate consumers about the importance of privacy labels and how

to use them effectively when making purchasing decisions

● Regularly reviewing and updating the privacy label system to ensure it remains

relevant and effective as IoT technology evolves and new data privacy concerns

emerge