The Internet of Things, a giant web of connected devices, is ever expanding and it's predicted there will be 8.4 billion connected items online by the end of this year. Fridges, toothbrushes, trashcans and even horses are being given the capability to connect to the internet. Every time another device comes online, more data can be harvested by its creators.
Read more: What is the Internet of Things? WIRED explains
For customers, what's done with this data is largely unknown. iRobot, the company that makes the adorable Roomba robots that trundle around your home sucking up everything in their path, has revealed its plans to sell maps of living rooms to the world's biggest tech companies.
Using onboard cameras, sensors, and software, Roombas are able to accurately create a picture of the environment they work in and where they're positioned. Colin Angle, the chief executive of Roomba has revealed, in an interview with Reuters, that the firm hopes to make money from this information.
Angle said the firm is planning to sell the maps of homes Roomba has generated to Amazon, Apple and Google's parent company Alphabet. He expects a deal with at least one of the firms in the next two years. The decision has been met with scepticism but Roomba won't be the only company with an IoT device that's looking at this option.
"Roomba classically has a product business model – you buy the product for cash and it does what you tell it to do," Pilgrim Beart, the founder of IoT management service DevicePilot, tells WIRED. "That's been the classic business model for things for hundreds of years".
"But now as the things get connected to the internet they become services and there's a lot of potential value in that ongoing service," he says. "You think you've bought a product not a service, yet there is this ongoing service element".
The IoT brings with it the possibility of new types of data that haven't been collected before. Health devices and wearables are able to gather detailed metrics about a person's health and wellbeing, for instance. Beart says products being turned into data collecting machines include autonomous vehicles and other smart home products, such as thermostats. The potential for monetising this data is huge. Advertisers are always looking for more insights about potential customers and their behaviours.
Selling customer data to make money isn't a new process. Many free online services – such as Google's Gmail and Facebook – use customer data for their own purposes. And the data market for personal information is booming.
"The implications of all of the data that can be gathered from IoT networks is only just starting to be thought about," John Skipper, PA Consulting Group's cybersecurity expert, tells WIRED. "The ideas of informed consent are challenging. How do you know what information your vacuum cleaner may be picking up while it is hovering around your house?"
Customer data collection from IoT devices is slowly coming to the attention of those in charge of protecting consumers. In September 2016 the Information Commissioner's Office (ICO), the UK's data protection regulator, along with other authorities from around the world, issued a statement saying six in ten IoT companies don't properly tell customers how their personal information is being used.
Following a Freedom of Information request from WIRED the ICO published the full six-page report the statement was based on. "Privacy communications relating to IoT devices are generally poor, and fail to fully inform users about what happens to the personal data collected by their device," the report says.
Read more: Madhumita Venkataramanan: My identity for sale
The ICO's report continues to say that privacy policies from IoT firms are "often not specific to devices" and in many cases "provided examples of data that may be collected" rather than listing everything that was gathered. "Some devices collected sensitive personal data (particularly health related and medical devices), yet did not give special mention to this in their privacy policies," it adds.
"This is not surprising since IoT technologies rely on the exploitation of data," Giulio Coraggio, the co-chair of law firm DLA Piper's IoT group tells WIRED, speaking about Roomba's plans. He explains that customers should be "fully informed and provide explicit consent" in cases where their data is being sold. Coraggio adds that Europe's new data protection rules will give users more access to data that's held about them.
Angle's vision for Roomba is that regularly updated maps can be used to improve smart homes. In theory, knowing more about the shape and size of a room can help improve acoustics from speakers and smart lighting can automatically adjust based on where windows are.
The chief executive said his company wouldn't sell customer data without their consent. However, the current position is unclear. As noted by Gizmodo, its current privacy policy may allow for data to be sold on to other firms. However, that's not to say the company wouldn't give users notice if it were to do so.
For Beart, the solution for Roomba and other IoT companies that are planning on harvesting your data is openness. "When you're buying something, you really do want transparency on what the business model is," he says. "If the company has a second side to its business model then it should be upfront about that – so everyone should understand how the cash and the benefits get spread around".
This article was originally published by WIRED UK
