# Data Privacy in the Internet of Things: A Perspective of Personal Data Store-Based Approaches
## 1 Introduction  
We have observed increasing generation and collection of large amounts of data on the Web. This trend has enabled the growth of Big Web companies that exploit data while offering users free services in return. For example, 61.4% of the world's population uses social media, and 69.4% have a mobile phone, generating a considerable volume of data daily [1]. A small number of companies concentrate most of these data and services. This movement toward an unplanned centralized Web enables collecting, storing, processing, sharing, and often negotiating personal data without the owners' knowledge and/or consent. Their magnitude, accuracy, and usage details are unknown by citizens and governments [2]. Sharing data with social networks, devices, and websites may lead users to lose control over their data storage and dissemination, making it difficult to manage or modify the information they have shared [3]. Moreover, personal data are vulnerable to privacy issues in this centralized structure. For instance, the exploitation of individuals' data without their consent has become news with scandals such as Cambridge Analytica, which used personal data for political purposes; Polar's fitness app that revealed the location of US military and security personnel; and Google Plus, which exposed the names, email addresses, occupations, and ages of 52.5 million users [4]. Likewise, IoT technologies have enriched our daily lives by enabling interconnected devices to generate and collect data. We now live in a world with more devices than people. The number of devices is greater than 16 billion [5], equivalent to more than twice the worldwide population, which is approximately 8 billion [6]. This scenario represents a substantial leap compared with the early days of the Internet of Things (IoT), which initially saw only 0.8 billion connected devices [7]. It is halfway to the projected 30 billion by 2030 [8]. IoT has fueled a rapid digitalization of daily life, both public and private, leading to an increase in the generation and collection of large amounts of data, encompassing personal and non-personal information. Moreover, it represents a stimulus for transforming various sectors such as the economy, health, agriculture, and education, constituting a burgeoning market valued at approximately USD 1 trillion [9]. For instance, smart thermostats automatically adjust home temperature, wearables track health data in real time, and voice assistants respond to commands and gather behavioral data. IoT devices monitor the elderly remotely, detecting falls, irregular heart rates, or medication adherence [10]. In smart cities, IoT systems control traffic lights, monitor air quality, and manage energy consumption [11]. Even in agriculture, sensors regulate irrigation and monitor soil conditions [12]. These exemplify how the IoT has become critical to our lives. Its ubiquity and data collection potentially amplify privacy issues, highlighting a trade-off between the services' convenience and user privacy concerns. This dilemma, known as the \"privacy paradox\", reflects individuals' hesitation to oppose data collection despite expressing concerns driven by the desire to utilize technology services [13]. It is crucial to balance privacy protection and service quality, as restrictions on information access can affect service usefulness. We cannot understand privacy protection as a barrier to innovation. Instead, we need to promote privacy by fomenting user data control. This way, control is more than a desire; it is a necessary pathway toward ensuring personal data privacy. Balancing privacy protection with service quality is a requirement for maintaining the usefulness of services, as excessive restrictions on information access can affect them. Privacy should not be viewed as a barrier to innovation. Instead, we must foster privacy by empowering users with control over their data. In this context, user control is not just a preference; it is a necessary pathway toward ensuring personal data privacy.