GDPR and IoT Devices: Privacy Obligations for Connected Product Manufacturers

Smart home sensors that log when you leave for work. Fitness trackers that infer your menstrual cycle from heart rate data. Connected cars that build a map of everywhere you drive. Smart plugs that reveal home occupancy patterns precise enough to determine when a property is empty. Industrial sensors that monitor individual workers' movements and productivity. The Internet of Things is, in many ways, the largest personal data collection apparatus ever built — operating continuously, invisibly, and in the most intimate spaces of people's lives. For manufacturers and product companies building these devices, GDPR creates a set of obligations that differ meaningfully from those facing web businesses. The stakes are higher, the technical constraints are different, and the regulatory expectations have evolved significantly. This guide covers what GDPR actually requires from connected product manufacturers — from device design through data sharing, firmware updates, and the intersecting requ