The Netherlands Authority for Consumers and Markets (ACM) and the Dutch Authority for Digital Infrastructure (RDI) have jointly had a study carried out into the functioning and security of smart devices. The most important finding is that the information that consumers receive when purchasing their smart devices often leaves much to be desired. Despite some shortcomings, the technical security of these devices often proved to be in order. However, updates were not always provided.
This study marks the first time ACM and RDI have jointly had a study carried out. For both ACM and RDI, the study’s findings serve as the basis for their oversight over smart devices for consumers.
The study’s findings
The study focused on home automation devices (also known as domotica), which are smart devices in and around the house that are used by many consumers. Examples are smart thermostats, baby monitors, doorbells, or smart TVs. When purchasing such devices, consumers are entitled to a properly functioning device (including updates) as well as to all of the necessary information, for example about the policy regarding functionality and security updates, how long these will be provided, and what the consequences are if consumers fail to install updates. The study used a sample of fifteen commonly used devices.
Prior to, during, and after the purchase, sellers and manufacturers provided little information about what their device does, in what kind of digital environment it works, and with what other devices it can interact. For example, one in two sellers of devices purchased online failed to provide any information about the update policy. In some cases, manufacturers provided different information than sellers did. When making their purchases in brick-and-mortar stores, consumers receive less information than they purchase online.
Edwin van Houten, Director of ACM’s Consumer Department, adds: "This study gave us an overview of what information consumers receive prior to, during, and after their purchases of smart devices, and also of whether the purchased devices are safe, and will continue to work. We see that the information that is given still leaves much to be desired, and that the update policies have room for improvement, too. These findings are important for our oversight."
Apps
Many home automation devices can be controlled using apps. These apps often only work with certain versions of operating systems. With two devices, the minimum requirements for the operating system were mentioned. That means that, when purchasing smart devices, consumers often are not sure whether their devices will communicate properly with the version of their operating systems.
John Derksen, Director of RDI’s Devices Department, explains: "RDI conducts oversight over the availability, reliability, and integrity of the digital infrastructure. One crucial precondition in that context is the security (including cybersecurity) of smart devices. This study shows that many devices still have shortcomings. That is reason for concern, and therefore an important point of attention in our future regulatory efforts. In our own ‘IoT-lab’, we study the security of smart devices. In that context, the findings of this study offer us valuable information, and will ultimately help us further enhance the digital security of devices and, by extension, of the Netherlands itself."
See also

04-03-2024 Study into smart devices for consumers commissioned by ACM and RDI (in Dutch)
24-02-2022 ACM and AT to investigate security and information aspects in connection with smart devices

More in this case

04-03-2024 Study into smart devices for consumers commissioned by ACM and RDI (in Dutch)
15-04-2021 Feasibility and Enforceability Assessment (UHT) of bill on the implementation of directives on sale of goods and delivery of digital content (in Dutch)

Oversight of Smart Devices by ACM and RDI

The Netherlands Authority for Consumers and Markets (ACM) and the Dutch Authority for Digital Infrastructure (RDI) collaborated on a study focusing on the functioning and security of smart devices, particularly home automation devices. The study found that consumers often receive inadequate information when purchasing smart devices, leading to uncertainty about functionality and security updates. Sellers and manufacturers were found to provide limited information, with discrepancies between online and in-store purchases. The study emphasized the importance of consumers' entitlement to properly functioning devices with updates, as well as the need for clear information on update policies and device compatibility. The findings will inform ACM and RDI's oversight activities, aiming to enhance the digital security of devices and improve consumer protection in the smart devices market.

Oversight of Smart Devices by ACM and RDI

The Netherlands' ACM and RDI conducted a joint study on smart devices, revealing shortcomings in the information provided to consumers and the lack of consistent updates, highlighting the need for improved oversight.