Advice to business on connected products (IoT)

1.1 What is IoT?

More and more of the things we surround ourselves with are connected to the internet in some way. These products are often called IoT devices, where IoT is an acronym for the Internet of Things. Here, we have chosen to call them connected products, because our supervisory work is particularly relevant for the consumer products in the Internet of Things.

Connected products for consumers include everything from smart phones and smart toys, wearable technology such as fitness trackers and GPS watches, to smart home products such as thermostats, alarm systems and other forms of connected gadgets and services.

The Consumer Authority sees that such products can entail several consumer challenges. We also note an increasing need among traders for guidance on the regulations that apply to connected products. We are working to increase knowledge and provide guidance in relation to problems that can arise when offering connected products to consumers, as well as on how to comply with the regulations and thereby avoid enforcement action from authorities and disputes with consumers.

1.2 Law and target group

Traders in all parts of the sales chain must have appliccable law in mind, whether they are a developer, manufacturer, importer, service provider or seller. The Consumer Authority supervises all marketing targeting consumers, regardless of what part of the sales chain the marketing originates from, including marketing directly from manufacturers, importers or service providers. When we supervise contract terms and conditions, we can involve traders that import and offer the product in Norway, but also developers, manufacturers and service providers.

This document describes three stages of the relationship between you as a trader and the consumers: Marketing, precontractual information, and contract terms and conditions that apply after the contract has been concluded. For each of these stages, we provide information about special challenges associated with connected consumer products that you as a trader must be aware of to avoid acting in breach of the Marketing Control Act. The general requirements of the Marketing Control Act also apply, and you can find more information about them in our other guidelines.

2.1 Give the right impression of the product’s functionality

Connected products are often developed for the purpose of being able to meet practical needs in the consumers’ everyday lives and are marketed as such. The consumer’s impression of what the product can be used for can be decisive to the consumer taking an interest in the product and wanting to buy it. It is therefore important that the consumer has a correct picture of the product’s functionality and limitations.

You must ensure that the impression the consumer is left with due to your marketing corresponds with the product’s actual functionality. You must provide correct and adequate information about what the product can and cannot do. You must also ensure that the consumers understand both the product’s advantages and the less attractive aspects of the product.

Marketing that gives an incorrect impression of the product’s functionality may be illegal pursuant to the Marketing Control Act Section 7 first paragraph letter b) concerning misleading marketing of the main characteristics of a product. Factual claims on functionality must be possible to substantiate upon request, cf. the Marketing Control Act Section 3.

2.2 Be clear about what you are selling: both a product and a service

It is very important to consumers to have a correct overall picture of the product and, if relevant, services. For connected products, it is especially important that the consumers understand if their purchase entails both a product and a service contract, and how they work together and function in practice.

The information you provide in your marketing must give consumers a correct and complete picture of what they are buying. If the product depends on one or more services to function, or to function optimally, you must ensure that the consumers understand that the product cannot be used without the service. They must also understand all the rights and obligations purchasing the product entails.

If any material information is omitted, hidden or presented in an unclear, unintelligible, ambiguous or unsuitable manner, the marketing may be misleading or unfair pursuant to the Marketing Control Act Section 7 or Section 8.

2.3 Be careful about playing on fear or security needs

Many connected products have functions that can give the consumer a sense of security in their everyday lives. Examples include home security systems and GPS tracking of children or animals, but there are also other products and functions that can give people a sense of security.

You must avoid marketing messages that can give the consumer a false sense of security. Such marketing may be incorrect and misleading and falls under the scope of the Marketing Control Act Section 7.

When marketing such products, you must avoid using claims in the marketing that unfairly play on fear, security needs or a guilty conscience. Marketing that uses such strong means may raise questions about good marketing practice pursuant to the Marketing Control Act Section 2. You must therefore be careful about what means you use in the marketing of connected products with functions that can give consumers a sense of security in their everyday lives. You must avoid using extreme or dramatic means such as worst-case scenarios with claims that your product could have saved the day.

You must also be aware that the assessment of good marketing practice is more stringent in relation to marketing vis-à-vis children, cf. the Marketing Control Act Section 21. For more information, see Forbrukertilsynets veiledning om handelspraksis overfor barn og unge (‘The Consumer Authority’s guidelines on commercial practices targeting children and young people’ – in Norwegian only).

2.4 Price marketing must include all costs

Connected products are often sold together with services that are necessary in order for the product to work. One consumer challenge is that the consumer may not notice that the costs of the service come in addition to the price of the product.

You must ensure that all costs are included when you market price, including information about e.g. subscriptions for the service and, if relevant, lock-in-periods. All marketing that mentions prices must therefore provide the minimum total price that the consumer must pay if he or she signs the contract. If the service is a continuous subscription, you must also provide information about this, and about the fixed and variable costs of the subscription. When services are marketed that are contingent on a lock-in period, you must provide clear and prominent information about the duration of the lock-in period and the total price for the whole lock-in period. If the product is sold with an introductory offer, or the price or terms and conditions will change after an introductory period, you must provide information about this and any changes in the terms and conditions that will apply after the introductory period.

You must state the total price in a way that is not likely to deceive consumers, cf. the Marketing Control Act Section 7 first paragraph letter (d).

Checklist:

Does the price marketing contain information about:

• the price of the product?
• monthly costs?
• other costs?
• the total price?
• lock-in periods?

2.5 Information about processing of personal data

Many connected products require the collection and processing of personal data. Examples of such products include smart home solutions or home security systems that register whether the residents are at home or not.

The processing of personal data is primarily regulated by the Personal Data Act, which is supervised by the Norwegian Data Protection Authority. When purchasing connected products where the processing of personal data is an important part of the product, questions can also be raised pursuant to the Marketing Control Act. Violations of the Personal Data Act can also be emphasised when violations of the Marketing Control Act are being considered.

The fact that a connected product processes personal data can be such an important part of the product that, pursuant to Sections 7 and 8 of the Marketing Control Act, you must provide clear information about the processing already at the marketing stage. Examples include if the product’s processing of personal data otherwise would come as a surprise to the consumer, or if your business model is completely or partly based on commercial use of the consumer’s personal data.

3.1 The consumer shall be given mandatory information before entering into the contract

3.1.1 All sales channel

It can be difficult for the consumers to obtain an overview of the product and the contractual relationship before signing a contract to purchase a connected product. When the consumer is close to purchasing a product, he or she must be given detailed information about the product and any services they are purchasing before entering into the contract.

You are obliged to give the consumers certain types of information regardless of the sales channel and regardless of which part of the sales chain you represent. Additional requirements apply to off-premises sales (e.g. e-commerce). A consequence of failure to comply with the duty of disclosure may be that a binding contract is not concluded, and that you cannot demand payment from the consumer for any services delivered.

The duty of disclosure pursuant to the Cancellation Act Section 8 applies to off-premises sales, and the duty of disclosure pursuant to Section 38 (b) of the Contract Act applies to on-premises sales. The Consumer Council guidance on the Cancellation Act is available in Norwegian here.

3.1.2 What information

The Cancellation Act and the Contract Act set out a number of conditions concerning what information the consumer must be given before making a purchase. You must consider what information is relevant to your product, and provide all mandatory information before the purchase contract is concluded.

Information that typically is particularly relevant for connected products:

• the main characteristics of the product or service
• the total price
• the length of the contract and, if relevant, the minimum lock-in period
• the conditions for cancelling a continuing contract
• the functionality of digital content, and the digital content’s ability to interact with hardware and software

The first point on the list means that you must provide information about what the product or service can be used for, and whether additional services such as a subscription or a specific app are required in order for the product to function as intended. The consumer must also be informed about any important restrictions on use, e.g. any restrictions on the possibility of changing subscriptions or service provider (interoperability). If the functionality of the product depends on the consumer being a customer of a specific service provider, this will normally be material information that the consumer must be given before making the purchase. See more about the right to switch service providers in section 4.2.2 below.

As regards the final point on the list above, you must provide information if there is anything about the software the consumer needs to know, for example how long and at what cost their device will receive updates and security support, or whether personal data will be collected and processed over and above what the consumer has reason to assume. You must also provide information about compatibility with other digital and smart products where relevant, for example by providing access to lists of compatible devices from the same or other manufacturers.

The connected product’s processing of personal data can also be such an important part of the service that clear and understandable information must be provided about it before the time of the purchase. See section 2.5 above for more information.

For purchases not made on business premises, for example online or through an app, information must also be provided about the right to cancel, cf. the Cancellation Act Section 8.

3.2 Access to complete contract terms and conditions

The consumer shall have access to the complete contract terms and conditions that apply to the product and, if relevant, services. You must ensure that the complete contract terms and conditions are readily available to the consumer, both when the contract is concluded and in case the consumer wants to read them later. The consumer must also be able to save the contract terms and conditions. This applies both to electronic purchases, where you can include a link to the terms and conditions in a document that can be downloaded, and in physical shops, where the consumer can be given a hardcopy of or electronic access to the terms and conditions.

4.1 General information about guidelines on digital terms and conditions

Unfair contract terms and conditions may be prohibited. You should familiarise yourself with the general requirements for contract terms and conditions that are set out in the Consumer Authority’s guidelines on digital terms and conditions, and that apply to all types of digital services and products. The guidelines explain what ‘unfair contract terms and conditions’ are pursuant to the Marketing Control Act Section 22, and provide general tips on how to write terms and conditions. In addition, the following addresses the some special challenges associated with contract terms and conditions for connected products.

4.2 Special challenges associated with the terms and conditions for connected products

4.2.1 Several parties and several sets of terms and conditions

One of the challenges when purchasing connected products is that the consumer often purchases a product before they have familiarised themselves with all the terms and conditions of the contract. The consumer must often deal with several players, and each of them will normally have their own contract terms and conditions. For example, the consumer may have a purchase contract for the product, a subscription contract with the service provider, and contract terms and conditions for an app with which to control the product.

If the consumer has to deal with two or more sets of contract terms and conditions, it can be difficult to gain an overview of the most important terms. This also applies in cases where the conditions make cross-references to each other. It can be challenging for the consumers to know who they can contact for customer support if they need help with e.g. setting up or updating the product, and which player is responsible for which faults and defects.

You must also ensure that it is clearly stated what your terms and conditions regulate and the consumer’s rights and obligations pursuant to the terms and conditions. It must be easy for the consumer to identify the most important points and to understand the relationship between the different contracts, where relevant. You can do this by making a summary of the key terms and conditions and a short overview of who is responsible for what.

Unclear regulation of the parties’ rights and obligations may be in breach of Section 22 of the Marketing Control Act concerning unfair contract terms and conditions.

4.2.2 Optional service provider (interoperability)

Sometimes, questions arise as to whether the consumer can select their own service provider for the connected product or freely switch service provider after a certain period (interoperability). Some products will only function or function optimally with a specific service provider. The consumers are then forced to accept this provider’s terms and conditions and prices if the purchased product is to work as intended. This makes the consumers vulnerable, since it makes it more difficult for them to switch to a better or cheaper service provider.

Pursuant to Section 22 of the Marketing Control Act, the Consumer Authority can consider whether inadequate interoperability is an unfair contract term, and will place special emphasis on the balance between the parties. If your reasons for a lack of interoperability are not good enough, for example if the only reason is a wish to secure long-term earnings, it may constitute an unfair lock-in mechanism that creates an imbalance that is detrimental to consumers. Such terms and conditions may be prohibited by the Consumer Authority.

4.2.3 Changes of terms and conditions

Since connected products often depend on a service in order to function, changes or updates to the service may affect the use of the product. Terms and conditions that allow changes to the product, subscription or other additional services that are unfavourable to the consumers, for example terms that make it easy for you to discontinue or stop updating services that are necessary for using the product, can be unfair pursuant to Section 22 of the Marketing Control Act. Changes that make the product’s actual useful life shorter than assumed may also constitute a defect entitling the consumer to file a claim against you pursuant to the Consumer Purchases Act.

 

5.1 Protection of privacy – the Data Protection Authority

Connected consumer products often entail the processing of personal data. This means that you as a trader must meet the requirements of the Personal Data Act and the GDPR. The Data Protection Authority is charged with enforcing and supervising these regulations. www.datatilsynet.no.

5.2 Protection of privacy, data protection and product security – the Norwegian Communications Authority (Nkom)

Nkom works on protection of privacy and data in the Internet of Things, and supervises that the sale of radio equipment meets the requirements for e.g. frequencies and electrical safety. www.nkom.no.

Product safety – the Directorate for Civil Protection and Emergency Planning (DSB)

As a trader, the products you sell must be safe to use. In Norway, DSB is responsible for keeping an overview of risks and vulnerabilities in society, including in relation to products and consumer safety. www.dsb.no.