Data about consumers has long been a prized asset of organizations. As Paul Schwartz has observed, the “monetary value” of consumer data continues to grow significantly and companies eagerly profit from consumer data.1 The IoT will foster an exponential growth in the volume, quality, and variety of consumer-generated data. As a result, there will be more of our data available for companies to analyze, exploit, and extract value from. As we have seen in previous chapters, several legal scholars have highlighted the limits of companies’ privacy policies and conditions of use, and the role of these documents in enabling data disclosures.

As we have seen so far in this book, the IoT comprises various connected devices, services, and systems. Connecting regular devices to the Internet has made it much easier for companies to protect their interests in consumer transactions. New technologies allow companies to continue to wield significant control over us and our devices beyond the point of sale, license, or lease. As Aaron Perzanowski and Jason Schultz have observed, the IoT “threatens our sense of control over the devices we purchase.”1 Of chief concern is companies’ use of technology to control our devices and actions and digitally restrain our activities in lending transactions.

Unlike privacy law discourse, which has primarily explored questions related to others’ knowledge, access, and use of information about us, commercial law’s central focus has been on issues related to trade involving persons, merchants, and entities. In the commercial law context, questions about knowledge and information are primarily connected to the exchange and disclosure of information needed to facilitate transactions between parties.1 This distinct historical focus has likely contributed to commercial law’s failure to adequately account for and address privacy, security, and digital domination harms. In some cases, commercial law also defers to corporate commercial practices as well.

Most of the existing privacy and security legal frameworks at both the federal and state level provide incomplete safeguards against many of the privacy and information security harms highlighted in earlier chapters. Many of these frameworks have long been critiqued by privacy law experts for their lack of effectiveness. The IoT amplifies these inadequacies as it compounds existing privacy and security challenges.

At the state level, the patchwork of privacy and security legislation creates varying obligations for businesses without consistently ensuring that individuals receive adequate privacy and cybersecurity protection. State legislation also suffers from several shortcomings and is often replete with gaping privacy and security holes. Even the CCPA, the first privacy statute of its kind in the United States, has several limitations. Further, varying state privacy and security legislation also enables unequal access to privacy and security between citizens of different states.

There are various definitions of privacy, and for some time now, privacy harms have been characterized as intractable and ambiguous. In this chapter, I argue that regardless of how one conceptualizes privacy the ubiquitous nature of IoT devices and the data they generate, together with corporate data business models and programs, create significant privacy concerns for all of us. The brisk expansion of the IoT has increased “the volume, velocity, variety and value of data.”1 The IoT has made new types of data that were never before widely available to organizations more easily accessible. IoT devices and connected mobile apps and services observe and collect many types of data about us, including health-related and biometric data.

The IoT allows corporate entities to colonize and obtain access to traditionally private areas and activities while simultaneously reducing our public and private anonymity.

The IoT raises several questions germane to traditional products liability law and the UCC’s warranty provisions. These include how best to evaluate and remedy consumer harms related to insecure devices, malfunctioning devices, and the termination of services and software integral to a device’s operations. Consider that the modern IoT vehicle with an infotainment system generates massive quantities of data about drivers, and that mobile applications can be used to impact the operations of these vehicles.

In 2015, the US Senate passed a resolution recommending the adoption of a national strategy for IoT development (IoT Resolution).1 Currently, the proposed Developing Innovation and Growing the Internet of Things Act (DIGIT) would establish a federal working group and a steering committee within the Department of Commerce.2 If the act is adopted, the working group, under the guidance of the steering committee, would be charged with evaluating and providing a report containing recommendations to Congress on multiple IoT aspects.3 These areas include identifying federal statutes and regulations that could inhibit IoT growth and impact consumer privacy and security.4

Privacy and information security are distinct but related fields.1 Security focuses on questions surrounding the extent to which related products, systems, and processes can effectively defend against “attacks on confidentiality, integrity and availability of code and information.”2 The field of information security often involves inquiries about the legal consequences of security failures.3 In 2018, The Economist reported that “more than ninety percent of the world’s data appeared in just the past two years.”4 In the last decade there have been multiple large-scale data breaches and inadvertent data exposures that have resulted in the disclosure of millions of our data.

We now live in a world where we can obtain current information about a global pandemic from our smartphones and Internet of Things (IoT) devices.1 The recent novel coronavirus (COVID-19) outbreak is not just a public health emergency. The pandemic has forced us to further evaluate the extent to which privacy should give way to public health threats and resulting technological innovations.2 It directly raises questions about whether legal frameworks governing our privacy should be relaxed to address public health concerns, and if any such relaxation will continue post pandemic to permanently undermine our privacy.3

As we have seen, the law wields considerable influence over the rights and remedies available to us as consumers. Several areas of commercial law are ill-equipped to sufficiently protect our consumer interests in the IoT age. This is because various legal frameworks governing commercial practices have not been sufficiently reformulated to account for the growing connections between the world of privacy and the world of commercial law. As earlier sections of this book have demonstrated, there are multiple legal frameworks impacting commercial practices at the federal and state level that are ripe for significant legal reform. These sources of law include contract law, the FAA, products liability law, the CDA, debt collection law, the Bankruptcy Code, and secured financing laws.