Beyond the EU Data Act: Value of IoT Data, Market Failures, and Consumer Choice in the B2C Sector

The recently enacted EU Data Act has introduced significant changes of the governance of IoT data (Internet of Things), which so far is dominated by IoT manufacturers. This includes new rights of users to access and share IoT data as well as a new contract which data holders (manufacturers) need for getting permission to use non-personal IoT data from the users. This article analyzes from an economic market failure perspective the problems that consumers face with regard to getting meaningful control over the generation, collection, use, and sharing of their non-personal and personal IoT data. It is shown that, in B2C contexts, serious market failures exist with regard to the terms of the "licensing" contracts of personal and non-personal IoT consumer data (buyout contracts, adverse selection), which can lead to a too large collection and sharing of IoT data as well as to not enough choice for the consumers. After presenting a broad overview about the current policy discussion about a minimum of choice for consumers in competition law and data protection law (German Facebook case, new Opinion of EDPB about "consent or pay" on online platforms, Art. 5(2) DMA and opt-out solutions in California privacy law), the last part of the article explores and analyzes a wide range of different policy options for granting consumers more choice about the collection, use, and sharing of their IoT data (consumer empowerment). One of these policy solutions would give consumers the right to use their IoT devices also without having to "license" to data holders IoT data that are not necessary for the functionality of these devices, which also might lead to "consent or pay" solutions in IoT governance. Other policy solutions would give consumers more direct de facto control over their IoT devices and their IoT data, which also might require more technical interoperability and standardisation.