Which statement best describes a privacy risk when IoT devices collect data?

• A. Combining de-identified datasets can reveal identity
• B. Data can only be stored locally and never shared
• C. Privacy is guaranteed with encryption
• D. IoT data collection reduces privacy protections

Answer: (A)

When data is de-identified, removing obvious names or IDs, there’s still a privacy risk because linking that seemingly anonymous data with other information can reveal who people actually are. IoT devices generate highly granular data—when multiple datasets from different sources are combined, the patterns, timestamps, and device identifiers can point to a real person even if each dataset on its own looks anonymous. This re-identification risk is exactly why the statement about combining de-identified datasets revealing identity best describes the privacy challenge in IoT.

Encryption helps keep data secure in storage and transit, but it doesn’t by itself prevent someone from linking separate de-identified datasets to identify a person, nor does it address how data is used or shared. The idea that data can only be stored locally and never shared is not realistic in IoT, where data often moves between devices, apps, and cloud services. Saying privacy is guaranteed with encryption overstates what encryption achieves, and claiming IoT data collection reduces privacy protections is too broad and imprecise.