Responses of the European IoT Ecosystem to the European General Data Protection Regulation

With the proliferation of IoT devices in homes and industry, concerns have arisen about the security of the devices and the privacy of users. The General Data Protection Regulation (GDPR), which went into effect in 2018, aims to protect the rights of IoT (and other) users. One way for device manufacturers to address these rights is through firmware updates. However, the extent of the GDPR's impact on EU member states remains uncertain. This paper presents a comprehensive analysis that examines changes in firmware age, as well as the overall age of devices, following the implementation of GDPR in the EU. The analysis uses approximately 400 terabytes of real-world IoT data from Censys.io, spanning from 2015 to the end of 2021. Using grouped average age values, we perform and compare difference-in-differences analyses for devices deployed in all EU member states and regions. We show that devices deployed in Northern Europe tend to be the most up-to-date, while Eastern Europe lags behind. This work provides initial insights into the impact of the GDPR in the IoT ecosystem, and highlights the need for further research to gain a deeper understanding of the effects.