ETSI EN 303 645 Telemetry evidence for consumer IoT products

EN 303 645 defines telemetry as data from a device that can help the manufacturer identify issues or information related to device usage. Provision 5.10-1 is a recommendation that applies when telemetry is collected from the IoT product, including usage and measurement data. It does not require telemetry collection.

The standard gives practical examples of the kind of security signal it expects teams to look for: deviations from normal device behaviour, such as an abnormal increase in failed login attempts, or telemetry across multiple devices showing that updates are failing because software update authenticity checks are invalid.

TS 103 701 turns the telemetry provision into Implementation eXtra Information for Testing (IXIT) 24-TelData evidence. The completed IXIT lists telemetry collected by the device and associated services, with an identifier, description, purpose, security examination, and references to any personal data processed in the telemetry data.

For provision 5.10-1, the Test Laboratory checks whether IXIT 24-TelData describes at least one examination for security anomalies and whether the telemetry description is suitable for that examination. A TelData inventory is not enough by itself; the assessment needs the relationship between the signal and the stated anomaly check.

EN 303 645 clause 6 is the relevant place to narrow privacy-facing telemetry statements. It says the document addresses personal-data protection from a strictly technical perspective, so teams should avoid broad legal-compliance claims unless they have separate legal source support.

For collected telemetry, provision 6-4 recommends limiting personal-data processing to what is necessary for the intended functionality identified under provision 6-5. Provision 6-5 requires information for consumers on what telemetry is collected, how it is used, by whom, and for what purposes. These are distinct from the security-anomaly recommendation in 5.10-1.