Privacy Compliance Game
Privacy Compliance Game
Navigate GDPR, CCPA, and IoT Privacy Regulations
Privacy Compliance Game
Audit realistic IoT product launches and distinguish lawful design evidence from privacy violations.
Reference Material
Use these collapsible notes when you need a regulation refresher or want to check why an audit choice matters.
Learning Objectives
By playing this game, you will be able to:
- Identify common privacy violations in IoT products and services
- Apply privacy regulation requirements (GDPR, CCPA, HIPAA, COPPA) to real scenarios
- Evaluate consent mechanisms for validity and compliance
- Recognize when Privacy Impact Assessments are required
- Analyze data minimization, purpose limitation, and retention policies
- Assess third-party data sharing and cross-border transfer requirements
For Beginners: What is Privacy Compliance?
Privacy compliance means following laws and regulations that protect people's personal information.
Think of it like rules for borrowing someone's belongings:
| Privacy Principle | Real-World Analogy |
|---|---|
| Consent | Asking permission before borrowing |
| Data Minimization | Only borrowing what you actually need |
| Purpose Limitation | Using borrowed items only for the agreed purpose |
| Right to Deletion | Returning items when asked |
| Data Portability | Giving back items in good condition |
In IoT, devices collect lots of personal data (location, health, habits). Privacy laws ensure companies: - Establish an applicable lawful basis and obtain consent when required - Protect the data - Don't misuse it - Let people control their information
How to Play
- Choose Difficulty Level:
- Consumer IoT: Smart home, wearables, consumer products
- Healthcare: Medical devices, patient monitoring, health apps
-
Smart City: Public infrastructure, municipal services, urban IoT
-
Read the Scenario: Each case describes an IoT product/service planning to launch
-
Review Product Details: Examine what data is collected, how it's stored, and who it's shared with
-
Identify ALL Violations: Select every privacy compliance issue you can find
-
Submit Your Audit: See which violations you found, missed, or incorrectly identified
-
Learn from Feedback: Understand why each violation matters and which regulations it breaks
-
Complete All Cases: Work through all scenarios in your chosen difficulty level
Common Privacy Violations Reference
Consent Issues
Invalid Consent Patterns
Bundled Consent: Conditioning basic features on consent to unnecessary optional processing - ✗ "Accept all data sharing or you can't use the app" - ✓ Where relying on consent, provide specific choices for distinct optional purposes
Pre-Selected Checkboxes: Defaults cannot establish active consent where consent is required - ✗ Boxes pre-checked for marketing emails or data sharing - ✓ Users must actively check boxes
Vague Consent: Unclear what users are consenting to - ✗ "We may share your data with partners" - ✓ "We share your email with XYZ Company for newsletter delivery"
Data Minimization Failures
Only collect data that is necessary and proportionate to your stated purpose:
| Scenario | Excessive Data | Minimized Approach |
|---|---|---|
| Smart thermostat | Collect room-by-room occupancy, photos, voice | Collect temperature readings only |
| Fitness tracker | Access all photos, contacts, location 24/7 | Access GPS only during workouts |
| Parking sensor | Link to vehicle owner identity, track all trips | Detect occupancy state only |
User Rights Violations
| Right | Requirement | Common Violation |
|---|---|---|
| Deletion | GDPR: respond within one month, extendable by two; CCPA: generally 45 days, extendable by 45. Grounds and exceptions apply. | No request route or unjustified retention |
| Portability | GDPR Art. 20 applies to provided data processed automatically on consent/contract; HIPAA access is a different right. | No usable copy where the applicable right requires one |
| Access | Provide access/copies under the applicable law, scope and exceptions | No applicable access mechanism |
| Opt-Out | CCPA covered businesses: effective sale/share opt-out, subject to scope and exemptions | Hidden or ignored opt-out |
Special Category Data
Extra protection required for:
- Children's data: COPPA generally covers under-13s on child-directed services or services with actual knowledge. GDPR Art. 8 concerns consent-based information society services offered directly to children: national age is 13–16.
- Health data: HIPAA applies to covered entities and business associates, not all apps. Authorization is needed unless a permitted route applies; assess Security Rule safeguards and applicable BAAs.
- Biometric identification: GDPR requires an Art. 6 basis and an Art. 9 condition; explicit consent is one possible condition.
- Location data: Identify the applicable basis, purpose, safeguards and rights; continuous sensing does not universally require repeated consent.
Privacy by Design Principles
- Default to minimal collection: disable unnecessary sensors and fields before launch.
- Separate purposes: assess each purpose and lawful basis; where consent is used, provide specific choices for distinct optional uses.
- Keep applicable rights operational: deletion, access, portability, amendment and opt-out differ by law and have conditions and exceptions.
- Document decisions: review applicable DPIAs, vendor agreements, retention schedules and data maps when processing changes.
Regulation Quick Reference
GDPR (EU/EEA)
Scope: Check Art. 3 territorial scope and applicable national provisions.
Key Requirements: - Establish an Art. 6 lawful basis; special-category processing also needs an Art. 9 condition. - Conduct a DPIA for processing likely to result in high risk (Art. 35). - Designate a DPO for public bodies (with the court exception), or core large-scale systematic monitoring or special-category/criminal-data processing (Art. 37). - Notify the supervisory authority of a personal-data breach without undue delay and, where feasible, within 72 hours of awareness, unless unlikely to risk individuals' rights; explain delay (Art. 33). - Facilitate qualified access, erasure, portability and objection rights (Arts. 12–22). - Use an applicable Chapter V transfer route: adequacy, appropriate safeguards such as SCCs, or a limited derogation (Arts. 44–49).
Penalty framework: Art. 83 has tiers. The higher ceiling is €20 million or, for undertakings, 4% of worldwide annual turnover for the preceding financial year, whichever is higher; it is not the fine for every infringement.
CCPA/CPRA (California)
Scope: Covered businesses and non-exempt data; check Civil Code 1798.140 and 1798.145–146. California presence alone does not establish coverage.
Key Requirements: - Provide effective sale/share opt-out methods; a clear “Do Not Sell or Share My Personal Information” link has statutory/regulatory alternatives (1798.120, 1798.135). - Respect applicable limits on secondary sensitive-information uses (1798.121); there is no blanket adult sensitive-data opt-in requirement. Additional-purpose consent and minors' rules may apply. - Cybersecurity audits apply to qualifying businesses under 11 CCR 7120, with phased deadlines; not every business has an immediate annual filing duty. - Respond to covered access, correction and deletion requests generally within 45 days, with a permitted 45-day extension and notice (1798.130; 11 CCR 7021). Opt-out/limit timing is different. - Disclose collection, purposes and applicable sale/sharing practices; collect only reasonably necessary and proportionate information (1798.100).
Penalty framework: Civil Code 1798.155 distinguishes ordinary, intentional and specified minors' violations. Monetary amounts are inflation-adjusted; check the current CPPA schedule rather than relying on an undated dollar ceiling.
HIPAA (USA - Healthcare)
Scope: Covered entities and business associates handling PHI; health data or a medical-device label alone does not establish HIPAA coverage (45 CFR 160.103).
Key Requirements: - Obtain valid authorization for uses/disclosures that are not otherwise permitted or required (164.502, 164.506–512). - Obtain applicable business-associate assurances/agreements, subject to exceptions (164.502(e), 164.504(e)). - Assess encryption in storage and transmission as addressable specifications; implement appropriate safeguards and document justified alternatives where appropriate (164.306(d), 164.312). - Designate required privacy and security responsibility (164.530(a), 164.308(a)(2)); one person may hold both roles. - Notify affected individuals after a breach of unsecured PHI without unreasonable delay, no later than 60 calendar days after discovery, subject to applicable exceptions and law-enforcement delay (164.404, 164.412). - Apply minimum necessary requirements where applicable, with exceptions including treatment disclosures; train staff and implement access/audit controls (164.502(b), 164.514(d), 164.530, 164.308, 164.312). - Provide qualified access/copies and amendment rights; HIPAA has no general right to erase medical records (164.524–526).
Penalty framework: Civil monetary penalties have culpability tiers and annual caps by identical requirement/prohibition, adjusted for inflation (160.404; 45 CFR part 102). A fixed $1.5 million ceiling is not a reliable current universal maximum.
COPPA (USA - Children)
Scope: Under-13s on child-directed online services or general services with actual knowledge (16 CFR 312.2–312.3); not all teens or all data.
Key Requirements: - Provide notice and obtain verifiable parental consent for collection, use or disclosure of children's personal information, subject to 312.5(c) exceptions. - Obtain separate consent for non-integral third-party disclosures (312.5(a)(2)); advertising disclosure is not categorically prohibited. - Publish a clear parental privacy notice; parental download of an app alone does not establish consent (312.4). - Enable parental review, deletion and refusal of further use/collection under 312.6. - Do not condition participation on unnecessary personal information; maintain reasonable security and purpose-limited retention/deletion policies (312.7–312.10).
Penalty framework: Civil penalties arise under the FTC Act and are adjusted for inflation (15 USC 45(m); 16 CFR 1.98). Do not use an undated $50,120 figure as the current maximum.
IoT-Specific Privacy Challenges
Unique IoT Compliance Issues
Always-On Sensing: Establish a lawful basis and proportionate collection; if using consent, enable withdrawal as easily as giving consent.
Limited User Interfaces: Difficult to obtain meaningful consent on devices without screens
Data Aggregation: Individual sensor readings may seem harmless, but aggregated data reveals sensitive patterns
Edge vs Cloud Processing: Where processing occurs affects regulatory compliance
Device Lifecycle: What happens to data when devices are sold, gifted, or discarded?
Firmware Updates: Privacy policies may change via OTA updates without clear user notification
Third-Party Ecosystem: IoT platforms often involve multiple data processors requiring proper agreements
Scoring System
- +10 points for each correctly identified violation
- -5 points for each false positive (incorrect selection); each case has a zero-point floor
- 0 points for missed violations (no penalty, but no credit)
Perfect Audit: Find all violations with no false positives. Each case is scored once. Each domain has four cases and a 160-point target. Score / Target includes missed violations and false-positive penalties; final labels use this percentage (Expert: at least 80%, Analyst: at least 50%).
Real-World Case Studies
Ring LLC - FTC Complaint and Proposed Order (May 31, 2023)
FTC allegations: In FTC v. Ring LLC, No. 1:23-cv-01549, the May 31, 2023 complaint alleges unnecessary employee/contractor video access (paragraphs 13–16), inadequate notice and consent for human review (25–29), and failures to address credential-stuffing and brute-force attacks (30–43). FTC complaint.
Proposed terms: The May 31, 2023 proposed order specifies $5.8 million (IX(A)), a privacy/security program (II), and consumer-redress provisions (X(E)). Its findings paragraph 3 says Ring neither admits nor denies the allegations, apart from specified matters. These are proposed terms, not adjudicated GDPR findings. FTC proposed order.
Lesson: Restrict internal access, explain video uses and maintain security controls.
Musical.ly - FTC/DOJ COPPA Case (February 27, 2019)
Agency allegations: In United States v. Musical.ly, No. 2:19-cv-01439, DOJ filed on behalf of the FTC on February 27, 2019. The complaint alleges actual knowledge of collecting children's information (paragraphs 24, 28) and failure to obtain parental consent (31(c), citing 16 CFR 312.5(a)(1)). FTC-hosted complaint.
Proposed terms: Section III(A) of the February 27, 2019 proposed stipulated order specifies a $5.7 million civil penalty. This describes the filed proposal, without asserting a contested finding. FTC-hosted proposed order.
Lesson: Apply COPPA's scope, notice, parental-consent and deletion rules; do not infer a universal age-verification mandate for every service.
Hidden Microphone - Design Review Exercise
Fictional design question (non-legal): A product contains a microphone that its documentation does not explain. What does the sensor do, and what should the documentation tell the user? This exercise asserts no legal violation or enforcement outcome.
Review actions: Inventory sensors, check whether audio is captured or transmitted, and document purposes, activation controls and data flows.
Lesson: A microphone's presence alone does not establish that it is active or recording. Inspect the implementation before making claims about its behavior.
Summary
Privacy compliance is not just about avoiding fines—it's about building user trust and designing ethical IoT systems. Key takeaways:
- Where Consent Is Used: Make it freely given, specific, informed and affirmative; other lawful bases may apply
- Minimize Data Collection: Only collect what you truly need
- Respect Applicable Rights: Access, erasure, amendment, portability and opt-out depend on the law, processing and exceptions
- Conduct Impact Assessments: GDPR requires a DPIA for processing likely to result in high risk
- Sensitive Contexts Need Extra Care: Children, health data and biometric identification trigger different legal protections
- Document Decisions: Maintain records and compliance measures as required by the applicable law
Key Takeaway: Privacy compliance is an ongoing process, not a one-time legal review. As your IoT system evolves, continuously reassess privacy risks and update your compliance measures.