ETSI EN 303 645 Telemetry evidence for consumer IoT products

EN 303 645 defines telemetry as data from a device that can help the manufacturer identify issues or information related to device usage. Provision 5.10-1 is conditional: if telemetry data is collected from consumer IoT devices and services, such as usage and measurement data, it should be examined for security anomalies.

The standard gives practical examples of the kind of security signal it expects teams to look for: deviations from normal device behaviour, such as an abnormal increase in failed login attempts, or telemetry across multiple devices showing that updates are failing because software update authenticity checks are invalid.

TS 103 701 turns the telemetry provision into IXIT 24-TelData evidence. The completed IXIT lists telemetry collected by the device and associated services, with an identifier, description, purpose, security examination, and references to any personal data processed in the telemetry data.

For provision 5.10-1, the test laboratory checks whether at least one security examination is provided in IXIT 24-TelData for examining security anomalies. It also assesses whether each associated telemetry description is suited to the described security examination.

EN 303 645 clause 6 is the relevant place to narrow privacy-facing telemetry statements. It says the document addresses personal-data protection from a strictly technical perspective, so teams should avoid broad legal-compliance claims unless they have separate legal grounding.

For collected telemetry, provision 6-4 says personal-data processing should be kept to the minimum necessary for the intended functionality. Provision 6-5 says consumers must be told what telemetry data is collected, how it is used, by whom, and for what purposes.