EUROPEAN COMMISSION Brussels, 20.1.2022 COM(2022) 19 final REPORT FROM THE COMMISSION TO THE COUNCIL AND THE EUROPEAN PARLIAMENT Final report - sector inquiry into consumer Internet of Things {SWD(2022) 10 final}



1Introduction and main steps of the sector inquiry (1)On 16 July 2020, the Commission launched a sector inquiry into the consumer Internet of Things (IoT) in the EU. The aim was to gain a better understanding of the consumer IoT sector, its competitive landscape, emerging trends and potential competition issues. While the consumer IoT sector is still developing, the sector inquiry was prompted by indications of company behaviour that may be conducive to distortion of competition in this sector. (2)As the use of consumer IoT products is increasingly becoming part of everyday life for Europeans, the consumer IoT sector is expected to grow significantly in the coming years. It is predicted that overall consumer IoT revenue worldwide will grow from EUR 105.7 billion in 2019 to approximately EUR 404.6 billion by 2030. European smart home revenue will also more than double between 2020 and 2025 (from approximately EUR 17 billion to approximately EUR 38.1 billion). (3)For the purposes of the sector inquiry, requests for information (‘questionnaires’) were sent to stakeholders in July 2020. Different questionnaires were addressed to companies active in four consumer IoT segments in the EU: (i) the manufacturing of smart home devices; (ii) the provision of voice assistants; (iii) the provision of consumer IoT services; and (iv) the manufacturing of wearable devices. A fifth questionnaire was sent to standard-setting and industry organisations. (4)The type and number of questions varied across the five questionnaires, but focused on the following topics of particular interest in examining possible competition issues in the consumer IoT sector: a.The characteristics of respondents’ consumer IoT products and services; b.The main features of competition in the consumer IoT sector, including potential barriers to entry and the role of various business strategies; c.The role of standards in the consumer IoT sector, including the importance of standards and standard-setting organisations (access conditions and competition among standards); d.The interaction between devices, services and voice assistants in the consumer IoT sector, including questions on interoperability, pre-installation and default settings, exclusivity and other preferential treatment; e.The role of data in terms of the consumer IoT sector, including questions on the collection of data, how it flows between parties, how it is used and potentially monetised by companies, and the interoperability and portability of data. (5)While the selection of addressees was not intended to correspond to a statistically representative sample of the EU consumer IoT sector, it covered a variety of consumer IoT products and services and represented different types of companies in terms of size, activities and range of products offered. (6)The Commission received responses to the questionnaires from more than 200 companies active in the manufacturing of smart devices, the provision of voice assistants and/or the provision of consumer IoT services, as well as from 14 standard-setting and industry organisations. These responses constituted the main source of information for the preliminary report on the sector inquiry, which was published on 9 June 2021 and presented the Commission’s preliminary findings. (7) The publication of the preliminary report was followed by a public consultation open to all interested stakeholders. It ended on 1 September 2021, with 26 submissions received. (8)This report is accompanied by a staff working document that summarises the main findings of the Consumer IoT sector inquiry and incorporates comments submitted by stakeholders during the public consultation. 2Characteristics of consumer IoT products and services (9)The findings of the sector inquiry confirm that, overall, an increasing number of devices and services are becoming ‘smart’. This enables users to access a progressively wider range of interconnected devices and services in and outside their homes. The respondents’ replies also point towards a trend of further increasing the overall number of consumer IoT services available on smart home and wearable devices and via voice assistants. In addition, the respondents indicate a trend towards greater availability of voice assistants as a user interface enabling interaction with smart devices and consumer IoT services. (10)The leading voice assistants in the EU are Amazon’s Alexa, Google’s Google Assistant, and Apple’s Siri. They are general-purpose voice assistants as they enable users to access a broad range of features such as playing music, listening to the radio, news or podcasts, controlling smart home devices, providing information or helping in planning and executing daily routines. (11)Other voice assistants are considered specialised voice assistants as they have more limited functionalities. They mostly allow access to and interaction with the provider’s own smart devices and/or services. (12)Despite the growing popularity of voice assistants, smart mobile applications or companion apps remain the most popular user interfaces to access smart devices and consumer IoT services. In that sense, smart mobile devices and their operating systems also play an important role in the consumer IoT sector. Google’s Android and Apple’s iOS are the leading operating systems for smart mobile devices.

3Main features of competition (13)The majority of respondents point to the cost of the technology investment and the competitive situation as the main barriers to entry or expansion in the consumer IoT sector, alongside various interoperability issues, the lack of access to data as well as regulatory barriers. (14)The cost of the technology investment is seen as a particularly important barrier to entry and/or expansion in the market for voice assistants. In fact, respondents find it unlikely that there would be new entrants in the market for general-purpose voice assistants in the short term, given that the costs of developing and operating new general-purpose voice assistants are seen as almost prohibitively high. (15)As a result, most respondents’ business strategies for the near future focus on expanding their consumer IoT offering, in particular the accessibility of their smart devices and consumer IoT services, via the leading general-purpose voice assistants. The general expectation is one of continued or increasing growth in the consumer IoT services, the smart home device and the wearable device segments. (16)On the competitive situation, a large number of respondents consider the inability to compete effectively with the leading providers of smart (mobile) device operating systems and voice assistants to be the main obstacle to developing new products and services. This is because these companies are vertically integrated and have built their own ecosystems within and beyond the consumer IoT sector by combining their own and integrating third-party products and services into an offering with a large number of users. 4Interoperability in consumer IoT ecosystems (17)The ability to interconnect and communicate with the different components of an ecosystem, that is interoperability among smart devices, voice assistants and consumer IoT services, is essential for the full deployment of functionalities that a consumer IoT ecosystem can offer to users. Interoperability between different brands is equally important as it allows users to build consumer IoT ecosystems with heterogeneous products, thereby improving consumer choice and preventing lock-in into a certain provider’s products. (18)Two important nodes for connecting the different hardware and software components of a consumer IoT ecosystem are a) the operating system, which runs on the smart devices or their user interfaces and b) voice assistants, through which users can access different consumer IoT services and devices. Both are consumer IoT technology platforms, enabling communication between those hardware and software components and increasing their complementarity. These consumer IoT technology platforms also allow for centralised access to and control of the products and services that they integrate and as such have played a significant role in advancing technology integration. (19)Access to leading consumer IoT technology platforms and good performance on them is considered essential to compete. The findings of the sector inquiry show that, in practice, integration processes that enable interoperability between different components of a consumer IoT ecosystem are largely driven by the leading providers of smart (mobile) device operating systems and voice assistants, namely Amazon, Google and Apple. These providers govern integration with their products by imposing certification processes, which they control unilaterally in most cases. The various specifications and types of software that enable interoperability with the leading operating systems and/or voice assistants are typically made available to third parties subject to the conclusion of agreements. Such agreements are usually standardised terms and conditions, and are generally not open to negotiation with counterparties, with the exception of prominent players with strong negotiating power. 5Standards and the standard-setting process (20)Standards in the consumer IoT sector include those needed to integrate and connect devices and applications, as well as standards that ensure the quality and security of the IoT communications. (21)An important number of formal Standards Developing Organisations (SDOs), such as the European Committee for Standardization (CEN), the European Committee for Electrotechnical Standardization (CENELEC), the European Telecommunications Standards Institute (ETSI), as well as private partnerships/independent alliances, are currently active in the development of technologies that consumer IoT devices and services may rely on to ensure and facilitate interoperability in the sector. The leading players in the consumer IoT sector are typically involved in formal SDOs as well as in private partnerships/independent alliances such as Matter or the Voice Interoperability Initiative. (22)These SDOs and private partnerships/independent alliances apply different intellectual property rights (IPR) policies for the licensing of the specifications they develop. While many organisations, including the formal SDOs, stick to high-level definitions, typically limited to a general FRAND licensing commitment, a number of SDOs have developed their IPR policies further. Some of them commit themselves to the outcome (for instance warranting a royalty-free outcome), while others introduce different rules without committing to a specific outcome, for instance by offering an optional choice (typically (F)RAND commitment or royalty free or non-assertion covenant). (23) The findings of the sector inquiry indicate that the consumer IoT sector is a highly heterogeneous environment when it comes to standards: devices and services rely on a combination of open standards, protocols, and proprietary and open source technologies. The combination of standards, proprietary and open source technologies largely varies depending on the different technology layers incorporated in devices and software programmes. (24)Typically, standardised technologies in the consumer IoT sector still prevail at the level of basic enabling technologies (such as connectivity standards like WiFi or Bluetooth), while formal standards are currently not in a position to effectively compete with proprietary technologies of the leading providers of operating systems and voice assistants for other types of technologies such as device definitions, application layers and user interfaces. Moreover, certain proprietary technologies in the areas covered by the sector inquiry have been highlighted as de facto standards, including certain voice assistants, smart home devices and wearable devices. Nearly all respondents find full interoperability with these technologies and ecosystems essential to compete. (25)However, the owners of these ‘must-have’ technologies generally stress that their proprietary nature does not mean that any IP rights would prevent third parties from developing and/or implementing technologies with comparable functionality. (26)In terms of the future evolution of standards in the consumer IoT sector, stakeholders’ views differ. Some call for further standardisation, while others argue that standardisation is not necessarily the best solution for interoperability in this sector. 6Consumer IoT data: user- and business-related aspects (27)Manufacturers and providers of consumer IoT products and services collect a wide range of data, through the manual input of a user, in the context of the use of a specific device or service, or automatically, for example as part of them functioning in the background. (28)The types of data collected vary per consumer IoT segment. This data can include personal or other user data, whether in the form of information input by users, or of user behaviour information collected by operating the device or accessing the service. In addition, smart devices and consumer IoT services gather data about how they function themselves and about their surroundings. For example, a smart thermostat or heating system can collect data on household temperature and air quality, movement, the heating system being switched on and off, and can register when users leave and arrive home. In many cases, the data collected falls under the definition of personal data for the purposes of the EU General Data Protection Regulation (GDPR).The collection of data from terminal equipment, that is a device connected to a public communications network, is subject to the rules of Article 5(3) of the ePrivacy Directive.

(29)The findings of the sector inquiry show that companies give users access to their data in different ways (for example via user accounts, user interfaces, or via specific tools or technology), depending on factors such as the type of smart device or consumer IoT service that the company provides and its intended use. The majority of consumer IoT service providers and smart device manufacturers surveyed indicate that they allow users to access and download their personal data so they can port them to other service providers and device manufacturers under Article 20 GDPR. (30)A few providers of consumer IoT services also state that their data could be ported directly from one service provider to another by automatically transferring the data between the applications of the two service providers, in line with Article 20(2) GDPR. However, such direct portability of data between different companies (or data controllers) is not common. (31)In particular, data portability possibilities appear to be more limited for data collected via voice assistants. One reason put forward is that voice commands may not be easily imported into other voice assistants. Moreover, several respondents explain that voice assistant providers are part of their own ecosystem and limit the transfer and portability of data outside of this ecosystem. (32)With regard to business-related aspects of consumer IoT data, the sector inquiry findings indicate that data flows between the different parts of a consumer IoT ecosystem typically have a very functional nature. They are designed to make the system work properly for the user, for example by processing and executing a voice command. (33)Other types of data that may be shared between companies include non-aggregated data in relation to errors and aggregate performance data. When data collected by one company can be accessed by a third party, this data is usually made available via central dashboards. When personal data is shared, for example by linking several user accounts, the consent of that user is required. (34)Even in the absence of active data sharing, some consumer IoT players have access to data in relation to a third party’s activities. These are typically the smart device operating system provider and/or the voice assistant provider, which are able to collect certain information about a user’s interaction with for example a consumer IoT service by virtue of their position in a consumer IoT ecosystem. (35)There are no industry-wide standardised formats for collecting and sharing data between consumer IoT companies. Data is typically processed either in a company-specific proprietary format or in a non-standardised but commonly used non-proprietary file format. The APIs and/or SDKs of one company (for example the voice assistant provider) often determine which data formats should be used and may also contain relevant data processing and data sharing provisions. (36)Several contractual provisions seem to govern business-related aspects of consumer IoT data. Such agreements may include clauses in relation to personal data protection, processing, storage and use. Each company’s privacy policy is also relevant for data (flow) management. Overall, the findings of the sector inquiry indicate that certain consumer IoT players, in particular the leading voice assistant providers, can impose standard terms and conditions that limit data access and use for third parties, while themselves having extensive data access and associated use possibilities. (37)In relation to data use cases within consumer IoT companies, respondents report that they use the data collected for: (i) the normal functioning of consumer IoT products and services; (ii) the personalisation of the user experience; (iii) business analytics; (iv) product maintenance and development; and (v) various other use cases (for example marketing communication, safety and fraud prevention). (38)Respondents report that they do not charge third parties for making data available. However, they refer to digital advertising and user profiling as monetisation possibilities. Using consumer IoT data for digital advertising purposes may be of particular value for those leading consumer IoT players with an existing digital advertising business. The pervasiveness of smart devices and consumer IoT services in users’ homes and personal lives can increase the value of consumer IoT data for user profiling purposes. However, respondents indicate that this business opportunity is not very advanced yet and would need to comply with data protection rules. 7Main competition-related and other concerns identified (39)The responses to the sector inquiry point to a variety of concerns about practices that could potentially have a negative impact on competition, innovation and consumer choice in the consumer IoT sector in the EU. (40)First, in relation to interoperability, respondents have raised specific concerns in relation to two main issues. Firstly, integration processes are largely determined by the presence of a few providers of leading proprietary voice assistants and operating systems relevant for the consumer IoT sector. These companies are able to determine independently the requirements needed to achieve interoperability with their proprietary technology through unilaterally governed terms and conditions, technical requirements and certification processes. Secondly and in relation to this, by unilaterally governing the interoperability and integration processes, they may also be able to limit the functionalities of third-party smart devices and consumer IoT services, compared to their own, by imposing technical constraints, such as limited APIs. (41)Second, respondents to the various questionnaires identified concerns in relation to standardisation. These relate in particular to the standardisation process, SDOs’ rules on membership and participation, standard essential patent declarations, IPR policies and licensing terms. While these concerns are not specific to the segments covered by the sector inquiry, the complex standardisation landscape together with a similarly fragmented landscape of proprietary technologies is reported to adversely affect the growth potential of consumer IoT segments. Overall, respondents express the view that major technology companies mostly take the lead when it comes to technology solutions. This may enable them to leverage their market power as patent owners into downstream markets and may lock users into proprietary ecosystems. This may lead to a perpetuation of a fragmented technology landscape and increase the barriers to inter-system communication. In addition, many respondents suggest that such a perpetuation of parallel ecosystems would allow large ecosystems a significant margin of control over the level and quality of inter-system interoperability. (42)Third, in relation to data, smart device manufacturers and consumer IoT service providers express concerns about the position of voice assistants at the centre of data collection in the consumer IoT. One particular concern is that voice assistant providers can control not only data flows and user relationships, but are also able to leverage these advantages into adjacent markets, that is the provision of other consumer IoT products and services. Moreover, third-party manufacturers and service providers consider that the limits on the data they receive from the leading voice assistant providers hinder them in their own business development. (43)In terms of data sharing, it is important to take privacy considerations into account as a means to maintain consumer trust, confidentiality, access to and integrity of data. However, privacy protection claims may also be used by market players to justify ‘locking up’ certain data for themselves. (44)In addition, this privileged access to huge data volumes might enable leading voice assistant providers to improve the quality of their voice assistant/voice recognition technology more easily via algorithmic training and machine learning. Not having access to such data can raise barriers to new entrants on the voice assistant market and hinder the development of smaller competitors on that market. As a final data-related concern, a number of respondents indicated that the identified data monetisation opportunities are expected to benefit the leading consumer IoT technology platform providers and, in particular, the few consumer IoT players that are already present in the digital advertising market. According to some respondents, the data collected from consumer IoT products and services allow these companies to attribute advertising space to third-party advertisers in a more accurate manner taking into account user preferences. (45)Fourth, some respondents have raised a number of potential competition concerns in relation to the out-of-the-box features that are available to users. The findings of the sector inquiry reveal the existence of practices regarding pre-installation, default-setting and prominent placement of consumer IoT services on smart devices or in relation to voice assistants. While such practices may have potential benefits for users (for example in terms of convenience), they may also determine to a large extent the discoverability, visibility and findability of a consumer IoT service, and give competitive advantages to the provider of a service that is pre-installed, set as a default, or otherwise given prominent placement. The services allegedly favoured in this way are often the proprietary services of the leading providers of consumer IoT technology platforms, or those of large international creative content service providers, to the detriment of smaller and/or local players. (46)Fifth, concerns have been raised over attempts by leading voice assistant providers to secure exclusivity of their voice assistant on certain smart devices or to prevent the concurrent use of voice assistants. Some smart device manufacturers also report that voice assistant providers will only license their voice assistants together with other types of software, technology or applications and not on a stand-alone basis. (47)Sixth, respondents have raised several concerns over the role of the leading providers of voice assistants and smart device operating systems as intermediaries between the user and the smart devices or consumer IoT services that are controllable and accessible through the voice assistant and/or operating system. A first set of concerns relates to the control these providers have over the user relationship and user experience. As a result, respondents fear that they will lose their brand recognition and their direct relationship with users. A second set of concerns relates to how these providers control the access to consumer IoT services and related data. A third set of concerns relates to technical performance and processes. For example, respondents indicate that they are dependent on the technical support provided by voice assistants and operating system providers as well as the timely advance notice of software updates and other updates. By contrast, the leading providers of consumer IoT technology platforms fully control the experience relating to their first-party products and services from the very beginning of the user interaction, collect relevant user data and in most cases do not depend on a third party to solve technical issues.