A Study of the Landscape of Privacy Policies of Smart Devices

TL;DR

This study provides a comprehensive analysis of smart device privacy policies, revealing gaps in transparency and communication of data practices, and introduces a methodology tailored to the unique challenges of this domain.

Contribution

It presents a novel methodology for analyzing smart device privacy policies and provides the first large-scale assessment of their landscape and transparency issues.

Findings

Over 1,167 manufacturers lack privacy policies.

Smart devices access highly intrusive data.

Significant improvements needed in policy communication.

Abstract

As the adoption of smart devices continues to permeate all aspects of our lives, user privacy concerns have become more pertinent than ever. Privacy policies outline the data handling practices of these devices. Prior work in the domains of websites and mobile apps has shown that privacy policies are rarely read and understood by users. In these domains, automatic analysis of privacy policies has been shown to help give users appropriate insights. However, there is a lack of such an analysis in the domain of smart device privacy policies. This paper presents a comprehensive study of the landscape of privacy policies of smart devices. We introduce a methodology that addresses the unique challenges of smart devices, by finding information about them, their manufacturers, and their privacy policies on the Web. Our methodology utilizes state-of-the-art analysis techniques to assess readability and privacy of smart device policies and compares it policies of e-commerce websites and mobile applications. Overall, we analyzed 4,556 smart devices, 2,211 manufacturers, and 819 privacy policies. Despite smart devices having access to more intrusive data about their users (using sensors such as cameras and microphones), more than 1,167 of the analyzed manufacturers did not have policies available. The study highlights that significant improvement is required on communicating the data management practices of smart devices.