Marketing, IoT, and Privacy

IoT is positioned as a key transition from “omni-channel marketing” to “everywhere marketing,” enabling companies to stay connected with consumers beyond screens and across otherwise “analog” moments in the customer journey. The consumer IoT landscape centers on smart devices—watches, home appliances, entertainment systems, health and sports devices, and connected cars—typically justified by added value such as convenience, communication, and utility. In retail, IoT solutions like self-checkouts, interactive shelves, and smart mirrors can simultaneously improve user experience and strengthen consumer tracking, intensifying both opportunity and risk.

The central tension is privacy: IoT devices sit inside daily life, making data use more sensitive than in many other channels. A critical distinction must be maintained between collecting personally identifiable information (PII) to deliver a service and repurposing the same PII for marketing. While GDPR applies, IoT raises heightened complexity around granular consent (especially when devices lack interfaces), profiling constraints and impacts, multi-party data sharing that can trigger joint controllership, and the coupling prohibition that limits tying core service access to non-essential marketing consent.

IoT frequently operates at household level rather than individual level, complicating consent and processing, and future scenarios may involve autonomous device-to-device interactions with third parties. Additional uncertainty comes from the timing and scope of the planned E-Privacy Regulation, including rules affecting machine-to-machine communication and non-PII data. IoT and AI mutually reinforce each other—IoT feeds model training and ML enables device features—blurring the line between core service and marketing. Success ultimately depends on whether perceived user benefit outweighs tracking and targeting, and on earning trust through clear purpose definition and strong governance.

• Consumer IoT primarily involves smart devices such as watches, home appliances, entertainment systems, healthcare devices, sports equipment, and connected cars.
• Smart retail IoT examples include self-checkouts, interactive shelves, and smart mirrors in dressing rooms.
• IoT can enable advanced and permanent tracking and communication with consumers described as “everywhere marketing.”
• A major IoT privacy concern is distinguishing service-required PII collection from PII use for marketing purposes.
• GDPR topics requiring extra attention in IoT include granular consent, profile building, obligations for data controllers and processors, and coupling prohibition.
• Obtaining consent can be difficult because some IoT devices lack a suitable interface for consent management.
• Guiding users to a web portal via mechanisms such as a QR code is presented as a way to register, accept privacy statements, and manage consent.
• GDPR coupling prohibition prevents making contract performance dependent on consent to process further non-essential PII.
• IoT often involves households with multiple users rather than single-user contexts, complicating consent and PII processing.
• The timing of the E-Privacy Regulation coming into effect is described as unclear, with planned rules including machine-to-machine communication and non-PII data.

• “IoT can be an essential stepping stone on the way from ‘omni-channel marketing’ to ‘everywhere marketing’”
• “In the end, consumers will decide which concepts and products will succeed.”
• “IoT devices can help bridge such gaps, as companies can stay connected with their customers even when they are not sitting in front of a computer or using a smartphone.”
• “On the other hand, ‘everywhere’ implies the risk that consumers’ privacy might be jeopardized when IoT comes into play.”
• “In general, privacy regulations such as GDPR apply equally for IoT as for any other application.”
• “Gathering consent in the first place can be difficult, because some smart devices do not have a suitable interface to do so.”
• “A typical use case when collecting PII is profile building, which GDPR restricts.”
• “The borders between service and marketing-oriented activities blur when IoT comes into play”
• “An IoT concept will succeed only if user benefit and added value outweigh marketing activities such as tracking and targeting.”
• “This will lead to trust — and trust is the best marketing.”