Billions of internet of things (IoT) devices — such as smart cameras, microphones and location trackers — hide in plain sight, monitoring everything from activities to our facial expressions. Fortunately, there's an app and corresponding digital infrastructure that helps users discover those devices, and learn about the data they collect and the privacy controls they offer.

The IoT Assistant app, developed by researchers in Carnegie Mellon University's CyLab, allows users to explore a map of IoT devices around them and learn about their data collection policies and practices.

"New laws like the California Consumer Privacy Act (CCPA) and the General Data Protection Regulation call for increased transparency about the types of data being collected about people, how that data is used and what options people are given," said CyLab's Norman Sadeh, a professor in the Institute for Software Research (ISR) and principal investigator on the Personalized Privacy Assistant Project. "Our app and infrastructure pave the way toward compliance, allowing people to take control of their privacy."

Once they have downloaded the app from the App Store or Google Play, users can immediately begin exploring a map of IoT devices around them. No account creation is required. By clicking on pins on the map, users can learn about a device's data practices, including the types of data collected, how long it retains the data, who it shares the data with and more. Users can also filter information to focus on certain types of data collection around them (e.g., video capture, audio recording or location tracking), and choose notification options.

The app is supported by the IoT Portal, which houses the database of devices and systems that appear in the app. The portal offers a collection of device templates that IoT creators and vendors can use to describe their devices, as well as a wizard to guide them through creating entries for new technologies that may not have a template.

"We want to make it easy for people who deploy IoT technologies to publicize the presence of their resources and their data practices," Sadeh said.

Volunteers who want to report devices they have spotted can also access the portal. Even if contributors don't know all the details about a device, they can enter partial descriptions of what they are confident they know.

"Even simple awareness is important," Sadeh said.

The IoT Assistant app gained more than 17,000 users the first week after its soft launch earlier this year. Nearly 200,000 IoT resources in North America, Europe and Australia have been registered in the IoT Portal.

The project is supported by a grant from DARPA and funding from the National Science Foundation' Secure and Trustworthy Cyberspace program.