California Bill Mandates Privacy by Design for IoT Devices (natlawreview.com)

They're passing a law.

Problem solved!

Perfect. Everything should be privacy first with an opt-in for sharing in exchange for services.

I applaud the bill for the security requirements but it seems to be lacking in privacy protections. Assuming this summary is accurate they've left out the provision that would give the bill real teeth. As it stands all this will do is add a screen that says, "accept the privacy policy to start using your device."

* The user must be given the option to refuse or withdraw consent at any time without penalty or loss of device functionality.

The burden must be place on the manufacturer to argue that data collection is necessary for the function of the device.

Definitions are so abstract that they make any enforcement pointless

The bill would mean requiring strong cryto. That's interesting to defend cryto in the future...