Cyberattacks may also compromise privacy, resulting in access to and exfiltration of identifying or other sensitive information about an individual. For example, an intrusion into a wearable device might permit exfiltration of information about the location, activities, or even the health of the wearer.

In addition to the question of whether security measures are adequate to prevent such intrusions, privacy concerns also include questions about the ownership, processing, and use of such data. With an increasing number of IoT objects being deployed, large amounts of information about individuals and organizations may be created and stored by both private entities and governments.

With respect to government data collection, the U.S. Supreme Court has been reticent about making broad pronouncements concerning society?s expectations of privacy under the Fourth Amendment of the Constitution while new technologies are in flux, as reflected in opinions over the last five years.

Congress may also update certain laws, such as the Electronic Communications Privacy Act of 1986, given the ways that privacy expectations of the public are evolving in response to IoT and other new technologies. IoT applications may also create challenges for interpretation of other laws relating to privacy, such as the Health Insurance Portability and Accountability Act and various state laws, as well as established practices such as those arising from norms such as the Fair Information Practice Principles.