Toward Transparent IoT Purchases: Understanding User Preferences for Privacy and Security Properties of IoT Devices
Authors: Lindrit Kqiku (University of Göttingen), Delphine Reinhardt (University of Göttingen)
Volume: 2026
Issue: 3
Pages: 505–522
DOI: https://doi.org/10.56553/popets-2026-0093
Abstract: The rapid proliferation of Internet-of-Things (IoT) devices raises privacy concerns, as these devices collect extensive information about both users and bystanders. Yet users often remain uninformed of how such devices handle their data. In response, various privacy labels have been proposed, but although many designs have undergone user evaluation, we still lack a clear understanding of which privacy-related features users consider important to be informed about, and how these priorities differ across user profiles. Addressing this gap is essential for developing privacy communication mechanisms that genuinely align with users’ preferences. This paper reports a study (N = 565) examining how users prioritize different privacy features in IoT devices and why. Our findings reveal which properties users value most, how these priorities differ across gender, age, technical affinity, and privacy concern, and which features are interpreted as baseline expectations rather than choices (e.g., encryption and updates). We also identify context-dependent features, such as multi-user management, that are rejected by numerous single-household users. Moreover, we show that users’ privacy concerns predict preferences more strongly than demographics. Notably, open-source property elicits polarized reactions, serving as a sign of trust for some and a perceived security risk for others. Drawing on these insights, we advocate for adaptive privacy labels that automate security baseline privacy expectations (e.g., features like operational security, secure defaults, and updates) while foregrounding user sovereignty (e.g., features like data storage location, cloud provider, jurisdiction) and contextual factors (e.g., living alone), moving beyond one-size-fits-all privacy labels toward dynamic decision-support solutions.
Keywords: Internet of Things, privacy, security, labels, transparency, user preferences
Copyright in PoPETs articles are held by their authors. This article is published under a Creative Commons Attribution 4.0 license.
