As 2021 comes to a close, we will be sharing the key legislative and regulatory updates for artificial intelligence (“AI”), the Internet of Things (“IoT”), connected and automated vehicles (“CAVs”), and privacy this month. Lawmakers introduced a range of proposals to regulate AI, IoT, CAVs, and privacy as well as appropriate funds to study developments in these emerging spaces. In addition, from developing a consumer labeling program for IoT devices to requiring the manufacturers and operators of CAVs to report crashes, federal agencies have promulgated new rules and issued guidance to promote consumer awareness and safety. We are providing this year-end round up in four parts. In this post, we detail IoT updates in Congress, the states, and federal agencies.
Part IV: Internet of Things
This quarter’s IoT-related Congressional and regulatory updates ranged from promoting consumer awareness to bolstering the security of connected devices. In particular, the Federal Communications Commission (“FCC”) has taken a number of actions to promote the growth of IoT while the National Institute of Standards and Technology (“NIST”) continues to work to fulfill its obligations under President Biden’s May Executive Order on Improving the Nation’s Cybersecurity (“EO”). The IoT Cybersecurity Improvement Act of 2020 (H.R.1668) additionally tasked NIST with developing security standards and guidelines for the federal government’s IoT devices. This year NIST put out a number of reports to carry out this mandate, including guidance documents to assist federal agencies with evaluating the security capabilities required in their IoT devices (NIST SP 800-213).
States considered their own range of related proposals, which centered on IoT device data collection and consumer rights. For example, California introduced a bill (A.B.1262) that would require manufacturers of smart speakers to inform users of voice recognition features, as well as prohibit recordings from being used for advertising purposes or from being shared with third parties without first obtaining the user’s “affirmative consent.” New Jersey similarly introduced the Consumer Electronic Voice Recognition Information Act (A.B.3072), which would prohibit the use of voice recognition features on a connected device unless the device first informed users of the feature. Illinois also introduced the Automatic Listening Exploitation Act (S.B.2080), which would prohibit an entity from recording users from smart speakers or sharing such recordings without first obtaining the user’s “express informed consent.”
On the agency front, the FCC has taken a number of actions to support the growth of IoT. As detailed in an earlier blog post, the FCC adopted a Notice of Inquiry (“NOI”) in its September meeting regarding actions it could take to promote IoT deployment. The NOI sought comment on a range of issues, including how to ensure adequate spectrum is available for IoT, the requirements regarding IoT services provided by satellites, and what regulatory barriers may exist to providing needed spectrum access for IoT. Additionally, the FCC adopted a Notice of Proposed Rulemaking (“NPRM”) in July to expand the permissible uses for short-range radar in the 57 to 64 GHz band, which could impact a wide range of applications, including IoT technologies for smart home appliances and factory automation.
NIST has been engaging in a number of IoT-related projects as well to carry out its obligations under the cybersecurity EO. For example, NIST sought feedback at an initial workshop in September on developing a cybersecurity labeling program for IoT devices and hosted a second event in December to provide an update on its activities. By February 2022, in coordination with the FTC, NIST is required by the EO to finalize its IoT cybersecurity criteria for the program and consider ways to incentivize manufacturers and developers to participate.
We will continue to update you on meaningful developments in these updates and across our blogs. To learn more about our IoT team and work, please visit Covington’s Internet of Things website. For more information on developments related to AI, CAV, and data privacy, please visit our AI Toolkit and our Connected and Autonomous Vehicles and Data Privacy and Cybersecurity websites.