Protecting users of the Internet of Things

The experience of California

(USA)

In October 2025, the US passed legislation to protect victims of Internet of Things devices. These devices include, for example, smart home technologies (automatic light sensors, temperature control, video surveillance cameras, etc.). Ninety-seven percent of domestic violence programs in the United States report that IoT devices can be misused as a tool for emotional or physical abuse and threats. For example, attackers hack the mobile apps to remotely control household items (e.g., turning lights on or off, changing the codes on digital¹ locks every day) and monitor their victims.

Under California law, companies that² manage IoT device accounts , must create a mechanism that allows them to block an attacker's access to an account (or reset it to factory settings) within two days if the victim submits a “device protection request.” Moreover, companies are prohibited from imposing any additional conditions on the victim (including payment/penalties). As part of the request, the victim must confirm ownership of the device and the fact that illegal acts were committed through the device.

Russia’s experience

Russia has adopted a number of preliminary national security standards for IoT, such as PNST No. 642–2022 (general provisions in the field of industrial Internet of Things), PNST No. 818–2023 (list of basic components of IoT systems), and others. In terms of damage caused by an IoT device, the general provisions of the Law “On Protection of Consumer Rights” apply. Liability lies with the device manufacturer unless the manufacturer can prove that the device was used contrary to the instructions and that the buyer was at fault.

The number of IoT devices in the world could grow by 69% by 2034 from 2025 (+20³ billion new devices). Current regulations in Russia do not take into account specific security risks (minimization of data collection; liability for damage caused by IoT devices). It can be predicted that in the future, both globally and in Russia, the regulation of IoT devices will expand to consider different types of eliminate risks, as well as legislative expansion of user protection measures.

From the monitoring issue No. 10 (22), October 2025. Download the full issue (PDF) · issue page at the Gaidar Institute