Do smart devices and app SDKs need consent?
Yes, even information that is not personal data can require PECR consent when stored on or accessed from a connected device. Consent depends on the purpose and whether an exemption applies, rather than the supplier calling it anonymous telemetry. Cambridge China Bridge can help buyers ask factories for the device and app evidence.
Check the operation, not the data label
PECR covers information, whether or not it is personal data. Its storage and access rules extend beyond browser cookies to connected devices and app components. If personal data is involved, UK GDPR requirements also apply.
Ask the supplier to list local storage, device fingerprinting, tracking pixels and embedded software development kits, known as SDKs. For each component, request its purpose, what it reads or writes, and who receives the information. Keep this review alongside the separate connectable-product security checks.
Map direct and indirect connections
A device can be terminal equipment whether it connects to the internet directly or through another connected device. Streaming rather than caching information does not remove it from scope.
The ICO distinguishes transmission from a smart bulb to its accompanying phone from the manufacturer's storage or access on that phone: the former falls outside PECR in its example, while the latter falls within it. Ask for a diagram showing the device, app, gateway and server, especially when sourcing security cameras.
Match each purpose to an exemption
Communication and strictly necessary exemptions concern transmission alone and what is essential to the service the user requests. A diagnostics label does not establish necessity. Ask the supplier to explain which requested function would fail without each collection activity.
Statistical analytics may qualify when used solely to improve the service, subject to the exemption's conditions. Appearance and emergency assistance have separate, narrow exemptions. Statistical and appearance uses need clear information and a simple, free objection mechanism. Advertising requires consent; do not accept an SDK-wide exemption covering mixed purposes.
Make consent visible in the sample
Unless an exemption applies, users need an explanation and prior consent. Non-exempt storage or access must wait until consent is given, and refusal must be as easy as acceptance.
Request a working sample with the intended firmware and app. Observe first launch, refusal, acceptance and withdrawal, then compare device activity with the supplier's inventory. Ask for optional components to remain inactive during refusal, and repeat the check after an app or firmware change.
Working out your own order? Send us the product on WhatsApp and we reply the same working day: WhatsApp us
Put the evidence in the purchase brief
Request a component inventory, purpose-by-purpose exemption assessment, screenshots of user choices and a record of sample behaviour. Name the party controlling each app component and ask who can change its configuration. Agree that changes to telemetry or embedded components need buyer review before release.
Record unresolved items before approving production. Cambridge China Bridge's staff in China can request supplier explanations and sample evidence; agree separately who will assess the legal conclusions. Product marking documentation belongs in the separate certification review.
Frequently asked questions
Does anonymous telemetry need consent?
It can. PECR covers information, not just personal data. Check whether the storage or access qualifies for an exemption.
Does connecting through a phone avoid PECR?
No blanket exclusion applies. The ICO distinguishes the device-to-phone transmission from subsequent storage or access on the connected phone.
Are diagnostic SDKs automatically exempt?
No. Ask what each collection activity is for and why it qualifies. Essential diagnostics and advertising need separate assessments.
Can app analytics run without consent?
Possibly, under the statistical purposes exemption and its conditions. It requires clear information and a simple, free way to object.