%0 Conference Proceedings %T Assessing Privacy Policies of Internet of Things Services %+ Goethe University Frankfurt %+ Universität Bremen [Deutschland] = University of Bremen [Germany] = Université de Brême [Allemagne] %A Paul, Niklas %A Tesfay, Welderufael, B. %A Kipker, Dennis-Kenji %A Stelter, Mattea %A Pape, Sebastian %Z Part 2: Failures of Security Management %< avec comité de lecture %( IFIP Advances in Information and Communication Technology %B 33th IFIP International Conference on ICT Systems Security and Privacy Protection (SEC) %C Poznan, Poland %Y Lech Jan Janczewski %Y Mirosław Kutyłowski %I Springer International Publishing %3 ICT Systems Security and Privacy Protection %V AICT-529 %P 156-169 %8 2018-09-18 %D 2018 %R 10.1007/978-3-319-99828-2_12 %K Internet of Things %K General Data Protection Regulation %K GDPR %K ePrivacy Regulation %K ePR %K [0000−0001−8283−4751] %K Welderufael B Tesfay 1[0000−0002−1087−2019] %K Dennis-Kenji Kipker 2[0000−0003−1454−591X] %K Mattea Stelter 2[0000−0002−3627−8990] %K and Sebastian Pape 1()[0000−0002−0893−7856] Keywords: Internet of Things %K Privacy Policies %K General Data Protec-tion Regulation %Z Computer Science [cs]Conference papers %X This paper provides an assessment framework for privacy policies of Internet of Things Services which is based on particular GDPR requirements. The objective of the framework is to serve as supportive tool for users to take privacy-related informed decisions. For example when buying a new fitness tracker, users could compare different models in respect to privacy friendliness or more particular aspects of the framework such as if data is given to a third party. The framework consists of 16 parameters with one to four yes-or-no-questions each and allows the users to bring in their own weights for the different parameters. We assessed 110 devices which had 94 different policies. Furthermore, we did a legal assessment for the parameters to deal with the case that there is no statement at all regarding a certain parameter. The results of this comparative study show that most of the examined privacy policies of IoT devices/services are insufficient to address particular GDPR requirements and beyond. We also found a correlation between the length of the policy and the privacy transparency score, respectively. %G English %Z TC 11 %2 https://inria.hal.science/hal-02023740v1/document %2 https://inria.hal.science/hal-02023740v1/file/472722_1_En_12_Chapter.pdf %L hal-02023740 %U https://inria.hal.science/hal-02023740 %~ IFIP %~ IFIP-AICT %~ IFIP-TC %~ IFIP-TC11 %~ IFIP-SEC %~ IFIP-AICT-529