DRAFT: IoTAB Privacy Recommendations August 2023 

Two Recommendations

Yellow means the text is new.

1. Include IoT in US Federal Privacy Regulation Proposal

Description of recommendation to the US government:

● Add IoT Data Retention Transparency: Establish guidelines for manufacturers to 

establish clear policies on how long business, government, and consumer data is 

retained

● Supports US Federal Privacy Legislation

Justification for the recommendation:

● Supports contemplated federal legislation, e.g., American Data Privacy and 

Protection Act (ADPPA) H. R. 8152 legislation

● Adds IoT-specific language to the ADPPA related to IoT Data Retention 

Transparency

● Ensures that IoT device manufacturers share a consistent set of privacy 

standards, enhancing business, government, and consumer data trust and 

protection

● Facilitates innovation by providing clear guidelines and expectations for IoT 

businesses, fostering a competitive and growth-oriented environment

Implementation Considerations that the US government needs to consider:

● Update the American Data Privacy and Protection Act (ADPPA) H. R. 8152 

legislation to address emerging Data Privacy challenges and technological 

advancements related to IoT

Potential implementation barriers to the US government:

● Achieving consensus among stakeholders and state-level regulators on the most 

effective elements and practices to incorporate into the Federal Privacy 

legislation

● Ensuring compatibility with existing national and international privacy regulations
DRAFT: IoTAB Privacy Recommendations August 2023 

Two Recommendations

● Balancing between protecting business, government, and consumer Data 

Privacy and fostering innovation in the IoT sector

● Providing resources, guidance, and support to businesses for the adoption and 

implementation of the IoT specific requirements

Possible participating agencies in the US government who could assist or champion 

this recommendation:

● Congress

● Department of Commerce (DoC)

● National Institute of Standards and Technology (NIST)

● Federal Trade Commission (FTC)

Things that the US Federal government should consider when implementing this 

recommendation:

● Legislation: Support IoT addition to contemplated Federal Data Privacy 

legislation (e.g., the American Data Privacy and Protection Act, or ADPPA)

2. Privacy By Design for IoT 

Description of recommendation to the US government:

● The U.S. government should support the implementation of Privacy-Enhancing 

Technologies (PETs) in IoT systems by investing in research, standardizing 

privacy protection, and fostering public-private collaboration for widespread 

adoption.

Justification for the recommendation:

● Aligns with the US National Strategy To Advance Privacy-Preserving Data

● Sharing And Analytics (PPDSA), March 2023 

● Supports broader U.S. goals of leveraging technology for societal benefits

● Fosters trust and promotes widespread acceptance of IoT solutions

● Minimizes data privacy risk and minimizes associated legal ramifications

Implementation Considerations that the US government needs to consider:
DRAFT: IoTAB Privacy Recommendations August 2023 

Two Recommendations

● Ensuring robust security measures for PETs to improve data security

● Enhancing public understanding and trust in PETs

● Encouraging interoperability between different PETs systems

Potential implementation barriers to the US government:

● The need for more funding, research, and development to ensure PETs are 

reliable and secure

● Possible resistance from private sectors due to perceived risks or costs

● The complexity of developing universally accepted privacy standards for IoT

Possible participating agencies in the US government who could assist or champion 

this recommendation:

● The Office of Science and Technology Policy (OSTP)

● National Institute of Standards and Technology (NIST)

● Federal Trade Commission (FTC)

Things that the US Federal government should consider when implementing this 

recommendation:

● Coordination among various agencies and departments is critical for a unified 

approach.

● Balancing the economic implications of implementation with the public benefit.

● Education and awareness initiatives should be conducted to promote 

understanding and trust in PETs among the public.

● Use National Cybersecurity Strategy Implementation Plan July 2013 -Initiative 

Number: 1.2.1 Scale public-private partnerships to drive development and 

adoption of secure-by-design and secure-by-default technology