UX Design · Study deck

IoT Privacy: User Rights and Privacy by Design

A user agreed to a clear purpose and the product collects only what it needs.

UX Uma is your guide for this deck.

privacyuserconsent
UX Uma, the module guide, in a scene from this chapter.
iotclass.org

After studying this chapter

Learning objectives

You will be able to:

  • Explain: the battery explained: "Sammy, imagine if someone followed YOU around writing down everything you did -- where you went at recess, who you talked to, what you ate for lunch.
  • Explain: Scenario: A smart baby monitor startup must implement GDPR-compliant consent for their video/audio streaming product sold in the EU.
  • Explain: You now know why access, erasure, portability, restriction, and objection need workflows across device, gateway, cloud, backup, and processor systems.
  • Explain: Portability is achieved when the record can move and retain its meaning, not merely when a download button produces bytes.
iotclass.org

Major section

User Rights in IoT Systems

IoT systems must implement mechanisms to fulfill these rights.

  • Portability is achieved when the record can move and retain its meaning, not merely when a download button produces bytes.
User rights request workflow showing intake, identity verification, scope, review, fulfill, respond, evidence, and follow-up trigger.
User rights request workflow showing intake, identity verification, scope, review, fulfill, respond, evidence, and follow-up trigger.
iotclass.org

Major section

Checkpoint: Rights Handling

You now know why access, erasure, portability, restriction, and objection need workflows across device, gateway, cloud, backup, and processor systems.

  • You now know why deletion must cover production records, backup rotation, third-party processors, device caches, and user-visible timelines.
  • Rights workflows prove whether privacy controls survive beyond the dashboard.
  • The next design question is how to embed those controls before launch instead of bolting them on after complaints.
iotclass.org

Major section

Checkpoint: Privacy by Design

You now know how proactive design, privacy defaults, embedded controls, transparency, and user-centric choices translate into IoT architecture.

  • You now know why a Privacy Impact Assessment must challenge sensors, data flows, necessity, risks, mitigations, and documentation before release.
  • Privacy by Design sets the architecture.
  • The next section stress-tests that architecture against the ambient, inferential, and multi-party realities of connected spaces.

Why it matters

You now know why aggregate goals should use technical controls that prevent unnecessary individual tracking capability.

iotclass.org

Major section

GDPR Consent for Baby Monitors

Freely Given: Each optional feature has independent checkbox (not bundled).

  • Scenario: A smart baby monitor startup must implement GDPR-compliant consent for their video/audio streaming product sold in the EU.
  • Setup screen shows: "To use BabyCam Pro, you agree to our Privacy Policy and Terms of Service. [Continue]".
  • Sleep insights will stop.

Why it matters

Easy withdrawal prevents lock-in resentment.

iotclass.org

Major section

GDPR Consent for Baby Monitors (continued)

Sends confirmation email: "Your data has been deleted as of [timestamp]".

  • Not Freely Given: Consent bundled with service—can't use monitor without agreeing to everything.
  • Not Specific: Single "agree to all" for 4 different data uses.
  • Informed: Plain language explains what, who, how long.
  • This change takes effect immediately.".
iotclass.org

Major section

GDPR Consent for Baby Monitors (continued)

Easy withdrawal prevents lock-in resentment.

  • Account will be closed.".
  • Risk Avoided: €20M (4% of revenue) or €10M GDPR fine (whichever is higher).
  • Granular consent controls respect user autonomy.
  • The cost of compliance ($80K) is tiny compared to the cost of non-compliance (€10-20M fine + reputational damage).
iotclass.org

Major section

Deep dive: Lawful Basis for IoT Data

GDPR requires one of six lawful bases for processing personal data.

  • Using Legitimate Interest for Surveillance: ✗ "We have legitimate interest to record all your conversations for product improvement".
  • Using Contract Performance for Marketing: ✗ "You bought our thermostat, so we can email you ads".
  • Problem: Marketing is NOT necessary to fulfill the contract.
iotclass.org

Major section

For Kids: Meet the Sensor Squad!

"No way!" said Sammy. "That would be creepy!".

  • The Sensor Squad had built an amazing classroom helper that tracked how much each student participated.
  • "Hey!" said student Maya. "I didn't say you could watch me all day!
  • If Maya says no, she should still get the same education.
iotclass.org

Major section

For Kids: Meet the Sensor Squad! (continued)

Temperature Terry was confused. "But I'm helping the teacher know who needs more encouragement!".

  • the battery explained: "Sammy, imagine if someone followed YOU around writing down everything you did -- where you went at recess, who you talked to, what you ate for lunch.
  • the LED added the most important rule: "And 'No' must be a real option!
  • Consent means you have a REAL choice, not 'agree or else!'".
iotclass.org

Deck summary

Key takeaways

IoT systems must implement mechanisms to fulfill these rights.

  • You now know why access, erasure, portability, restriction, and objection need workflows across device, gateway, cloud, backup, and processor systems.
  • You now know how proactive design, privacy defaults, embedded controls, transparency, and user-centric choices translate into IoT architecture.
  • Freely Given: Each optional feature has independent checkbox (not bundled).
  • Sends confirmation email: "Your data has been deleted as of [timestamp]".
iotclass.org

Retrieval practice

Recall check 1 of 5

UX Uma says: answer from memory, then check your reasoning.

Q1A user exercises their GDPR right to erasure ('right to be forgotten') with a smart home company. The company deletes their account data from the production database. Three months later, the user discovers their data still exists in the company's backup systems and was shared with a cloud analytics provider. What should the company have done?

AThe company complied correctly - backup retention for disaster recovery is a legitimate exception to the right to erasure
BDelete from production database, retain backups for maximum legal retention period, but inform the user of the backup retention timeline
CDelete from all systems including backups within a reasonable timeframe, and notify all third-party processors to delete the user's data
DOnly delete from production - third-party processors are responsible for their own GDPR compliance
Show answer

Answer: C Correct!

iotclass.org

Retrieval practice

Recall check 2 of 5

UX Uma says: answer from memory, then check your reasoning.

Q2A user wants to switch from SmartWatch Brand A to Brand B. They request their fitness data under GDPR's data portability right. Brand A provides a download containing: step counts, heart rate measurements, and sleep data. However, Brand A's proprietary 'wellness score' algorithm output is not included. Is this compliant with data portability requirements?

ANo - all data derived from the user's activity must be included, including algorithmic outputs
BYes - data portability covers raw data provided by the user, not derived insights or algorithmic outputs
CNo - Brand A must also provide the algorithm so Brand B can calculate the same score
DYes, but only if Brand A uses an open data format that Brand B can import
Show answer

Answer: B Correct!

iotclass.org

Retrieval practice

Recall check 3 of 5

UX Uma says: answer from memory, then check your reasoning.

Q3During a Privacy Impact Assessment for a smart city traffic monitoring system, the team identifies that license plate recognition could enable tracking individual vehicles across the city. The project manager argues: 'We're only using it for aggregate traffic flow analysis, not individual tracking.' How should the privacy team respond?

AAccept the explanation - if the stated purpose is aggregate analysis, individual tracking capability is not a concern
BReject license plate recognition entirely - any capability for individual identification is unacceptable
CRequire technical controls that prevent individual tracking capability, such as immediate hashing and aggregate-only queries
DDocument the risk and proceed - traffic optimization benefits outweigh privacy concerns
Show answer

Answer: C Correct!

iotclass.org

Retrieval practice

Recall check 4 of 5

UX Uma says: answer from memory, then check your reasoning.

Q4A research team publishes a dataset of 'anonymized' smart meter readings from 5,000 homes. They removed all customer IDs and addresses, keeping only timestamps and energy consumption values. A privacy researcher claims this data can be re-identified. Which attack is most likely to succeed?

ADictionary attack - trying common names and addresses against the dataset
BCorrelation attack - matching unique consumption patterns to outside facts
CSQL injection - exploiting database vulnerabilities to extract hidden customer information
DMan-in-the-middle attack - intercepting the data transfer to capture customer IDs before anonymization
Show answer

Answer: B Correct!

iotclass.org

Retrieval practice

Recall check 5 of 5

UX Uma says: answer from memory, then check your reasoning.

Q5Place each consent element where it lives so you can connect the user promise to a real control and an auditable record.

APurpose
BNotice
CChoice
DEnforcement
EEvidence
Show answer

Answer: A Separate what the user is told, the choice they can make, and system enforcement and evidence so you can detect consent that is only interface copy.

Q6Complete the consent form validation for an IoT privacy dashboard:

Aconst optionalBoxes = [...form.querySelectorAll('[data-purpose="optional"]')];
Bconst optionalBoxes = form.querySelector('[data-purpose="optional"]');
Cconst optionalBoxes = form.optionalOnly();
Dconst optionalBoxes = document.cookies;
Show answer

Answer: A GDPR consent requires an affirmative action, so optional consent boxes must start unchecked and be selected by the user.

iotclass.org

Print reference

Answers

Answer key.

  1. C · Correct!
  2. B · Correct!
  3. C · Correct!
  4. B · Correct!
  5. A · Separate what the user is told, the choice they can make, and system enforcement and evidence so you can detect consent that is only interface copy.
  6. A · GDPR consent requires an affirmative action, so optional consent boxes must start unchecked and be selected by the user.
iotclass.org