If your business sells or operates connected devices, smart home products, wearables, industrial IoT systems, or any hardware that communicates with a cloud platform, your terms of service face a set of legal requirements that do not apply to pure software companies. The physical nature of your product, the data it collects in people’s homes and on their bodies, the security vulnerabilities it creates, and the international regulations now targeting connected devices all mean your terms and conditions cannot be a slightly modified version of a standard SaaS agreement.
California, the United Kingdom, and the European Union have all enacted or are enforcing IoT-specific regulations. The FTC has taken enforcement action against connected device companies under Section 5 of the FTC Act for deceptive practices around data collection and security. And the EU Data Act, which took effect in September 2025 and is being enforced through 2026, created new rights for users of connected products to access and share the data their devices generate. Ignoring any of these frameworks in your agreements creates legal exposure that a well-drafted terms of service should prevent.
This article covers what your terms of service must address for IoT and connected device businesses, which regulations apply and what they require, and why a generic terms of service template creates specific legal risk in this sector.
1. Why Standard Terms of Service Don’t Work for IoT
A standard SaaS terms of service is built around a simple model: user creates account, user accesses software, software processes data, user pays subscription. The terms address acceptable use, payment, data processing, and liability. This model breaks down for IoT companies for several reasons.
First, IoT devices collect data continuously, often without active user engagement. A connected thermostat, security camera, health wearable, or industrial sensor is generating data 24 hours a day. The data may include location, behavior patterns, health metrics, home occupancy, or proprietary process information. Your terms need to address each category of data collection with specificity, because courts and regulators are skeptical of broad “we collect information to improve our services” language when the device in question is recording temperature in someone’s bedroom every 90 seconds.
Second, IoT devices are updated via firmware, often without the user actively participating. Your right to push firmware updates, change device functionality, end support for older hardware, or discontinue a product line must be addressed in your terms. Users who buy hardware have different expectations than SaaS subscribers, and a terms of service that gives your company unconstrained discretion to alter or brick a device creates consumer protection risk under FTC Section 5 and equivalent state laws.
Third, the attack surface of a connected device creates security obligations that software-only companies do not face in the same way. California’s IoT security law (SB-327), effective since 2020, requires that connected devices be equipped with reasonable security features appropriate to the nature and function of the device and the data it collects. Your terms must address security responsibilities in a way that aligns with your actual security posture, because misrepresenting your security practices is a deceptive trade practice.
2. California’s IoT Security Law and What It Requires
California Civil Code § 1798.91.04 (SB-327) applies to any manufacturer of connected devices sold or offered for sale in California. The law requires that the device be equipped with a “reasonable security feature or features” appropriate to the nature of the device and the information it collects, contains, or transmits.
Specifically, if the device uses authentication outside a local area network, it must either: use a unique password per device, or require users to set a new password before the device can be used. The law targets default passwords, one of the most common vulnerabilities in IoT deployments.
Your terms of service should reflect your compliance with SB-327 by clearly stating your authentication requirements, your password policies, and your commitment to security updates. If you are not compliant with SB-327, your terms should not contain representations that could be read as claiming compliant security features, because that creates a deceptive practice claim independent of the security law itself.
3. The EU Data Act: New Rights That Change Your Terms
The EU Data Act, which became fully applicable in September 2025, is the most significant new IoT regulation for businesses selling connected products to European users. The Data Act creates three broad rights for users of connected products:
The right to access data generated by their use of the product. This means users have a right to receive, in real time or upon request, the data their connected device generates, in a commonly used, machine-readable format. If your terms of service give your company exclusive ownership of all device-generated data without acknowledging user access rights under the Data Act, those terms are unenforceable as applied to EU users.
The right to share that data with third parties, including competitors. A user of your connected device can require you to share their data directly with a third-party service of their choosing. This right cannot be contractually waived under the Data Act. If your terms contain exclusivity provisions that purport to prevent users from sharing device data with third parties, those provisions do not survive as written for EU users.
Data portability rights. Users must be able to take their data with them if they switch products or services. Your terms need to address how users can export their data and in what format, and your platform must support this technically.
If you sell connected products in Europe, your terms and conditions need a separate section addressing Data Act rights, and your privacy policy must be updated to reflect the data access mechanisms you provide. A terms of service that was drafted before September 2025 and has not been updated for the Data Act is legally deficient for EU commerce.
4. What Your IoT Terms of Service Must Cover
Data Collection Disclosures
Your terms and accompanying privacy policy must identify every category of data your device collects, the purpose for which it is collected, how long it is retained, and with whom it is shared. For consumer IoT devices, this includes: device identifiers, usage patterns, location data (if applicable), sensor readings, user interaction logs, and any derived or inferred data your platform generates from raw sensor data.
For health wearables and fitness devices, your data practices are subject to additional scrutiny. The FTC has taken action against connected health companies for sharing health data with third parties without adequate disclosure. If your device collects any information that could be used to infer a user’s health status, sleep patterns, exercise habits, or reproductive health, your agreements must address this data with heightened disclosure and consent standards.
Firmware Updates and Modification Rights
Your right to push firmware updates, modify device functionality, or change the features accessible on a device must be clearly stated in your terms. Users need to know whether updates are automatic or optional, whether updates can remove features they purchased for, and what happens to the device if they decline a mandatory security update. Courts have scrutinized terms that give companies the right to substantially alter a purchased product without clear disclosure, particularly where those alterations affect functionality the user paid for.
End of Life and Product Discontinuation
One of the most significant legal risks for IoT companies is what happens when you stop supporting a device. If your hardware requires a connection to your cloud platform to function, and you shut down that platform or discontinue the product line, users may be left with non-functional devices they paid for. Your terms must address: the minimum period of software support you commit to, what happens to user data upon product discontinuation, and whether users will receive any notice or compensation when support ends.
The UK’s Consumer Rights Act and the EU’s Sale of Goods Directive both create implied warranties regarding the functionality of digital products, including connected devices. Terms that waive all obligations upon product discontinuation may not be enforceable in these markets. Your technology attorney should review your end-of-life provisions for enforceability in each market where you operate.
Security Obligations and Vulnerability Disclosure
Your terms should clearly state your security update practices: how frequently you patch known vulnerabilities, whether security updates are pushed automatically, and how users can report security vulnerabilities. Many IoT companies are now expected to maintain a coordinated vulnerability disclosure program, and your terms can reference this program as a signal that you take security obligations seriously.
Your terms should also include a clear warranty disclaimer and limitation of liability for security incidents that result from user modification of the device, use of the device outside its intended purpose, or failure to accept mandatory security updates. These provisions need to be specific and conspicuous to be enforceable.
Third-Party Integrations and Data Sharing
If your connected device integrates with third-party platforms such as Amazon Alexa, Google Home, Apple HomeKit, IFTTT, or similar ecosystems, your terms must address the data-sharing implications of those integrations. When a user activates a third-party integration, data about their device usage may flow to the third-party platform under that platform’s terms and privacy policy, not yours. Your terms need to disclose this clearly and direct users to review the relevant third-party policies.
5. Privacy by Design in IoT Agreements
Both the EU’s GDPR and California’s CPRA include principles of data minimization and privacy by design. For IoT products, this means your terms and data practices should reflect that you collect only the data necessary for the device to function, rather than collecting broadly and deciding later what to do with it. Terms that accurately reflect a minimized data collection approach are more defensible under regulatory scrutiny than terms that disclaim liability for broad data collection.
Your privacy policy for an IoT product should be written at a level of specificity that matches the data your device actually collects. A privacy policy that lists generic data categories without addressing the specific sensors, communication protocols, and data streams your device uses is inadequate under GDPR’s specificity requirements and creates a mismatch between your legal documents and your technical reality, which regulators and plaintiffs’ attorneys treat as evidence of deceptive practices.
6. Arbitration and Class Action Waiver Considerations
Many IoT companies include mandatory arbitration clauses and class action waivers in their terms of service. These provisions are generally enforceable in the United States under the Federal Arbitration Act, but enforcement depends on the clarity and conspicuousness of the provision and the method by which the user agreed to the terms.
For physical products, terms of service are often presented as “in the box” terms, packaging inserts, or accessible via QR code. Courts have been skeptical of arbitration provisions in “in the box” terms when there is no mechanism to verify that the user actually read and agreed to the terms before using the product. Your agreement should include a clear opt-in mechanism, either through the device setup process or through the companion app, to ensure you have documented user agreement before asserting arbitration rights.
Frequently Asked Questions
Does my IoT company need different terms of service for US and EU customers?
Yes. The EU Data Act, GDPR, and the UK’s PSTI Act create obligations that differ from US requirements under the FTC Act and state IoT security laws. Your core terms can share a common structure, but you need jurisdiction-specific sections addressing Data Act rights for EU users, GDPR consent and data portability provisions, and the UK’s security and transparency requirements. A single global terms of service that ignores these differences creates legal deficiencies in most markets you operate in.
What is the minimum period of software support I must offer for a connected device?
There is no single answer, but the UK’s PSTI Act (effective April 2024) requires manufacturers to state the minimum period for which security updates will be provided. The EU’s Cyber Resilience Act, which applies from late 2027, will require security support for the expected product lifetime. In the absence of a legally mandated minimum, your terms should commit to a realistic period that reflects your actual business practices, because courts will evaluate whether your practices matched your representations.
Can I retain all data generated by my IoT device under my terms of service?
Not for EU users under the Data Act. EU users have a right to access and share the data their devices generate, and you cannot contractually waive this. For US users, your data ownership provisions are more flexible, but FTC enforcement of deceptive practices applies if your data retention and use practices conflict with your stated policies. Your terms should accurately reflect how you treat device-generated data.
Do I need a separate privacy policy for my IoT device or can I use my existing website privacy policy?
You need a privacy policy that addresses the specific data your IoT device collects, including sensor data, usage patterns, and any health or location data. A website privacy policy that addresses email addresses and analytics cookies is not sufficient. If your device collects data that requires heightened protection (health data, children’s data, home occupancy data), those categories must be specifically addressed.
What happens legally if I discontinue my IoT product and shut down the companion app?
If your device requires the app or cloud platform to function, shutting down the cloud service renders the device non-functional. Consumer protection laws in the EU and some US states treat this as a potential breach of implied warranty of functionality. Your terms must address this scenario clearly, including any notice period, data export opportunity, and the device’s status after the service ends. This is one of the highest-risk areas in IoT product terms of service.
Get Your IoT Terms of Service Right Before Regulators Do It For You
Connected device businesses face a regulatory environment that is moving faster than most legal templates can keep up with. The EU Data Act, California’s IoT security law, the UK’s PSTI Act, and FTC enforcement all create specific requirements that must appear in your agreements to avoid liability, enforcement action, and consumer litigation. A standard SaaS agreement modified to mention hardware is not sufficient.
Contact Hansen Tong at TOSLawyer.com to get IoT-specific terms of service and privacy agreements that address the regulatory environment your connected device business actually operates in.