Introduction: The CI Runner Pricing Dilemma

In the heart of modern software development, CI runners act as the engines powering continuous integration and deployment pipelines. These runners consume compute resources—CPU, memory, and storage—based on the duration and intensity of each job. However, the pricing of these runners has become a contentious issue, as highlighted by GitHub’s rollback of proposed pricing changes. The core dilemma lies in balancing raw compute costs, concurrency management, and developer experience—a trifecta that directly impacts both organizational budgets and developer productivity.

Consider the system mechanisms at play: CI runners are not just about compute time. The control plane, responsible for job scheduling, orchestration, and monitoring, incurs both fixed and variable costs. Meanwhile, concurrency limits dictate how many jobs can run in parallel, directly affecting pipeline throughput and queue times. For instance, a misconfigured concurrency limit can lead to overloaded runners, causing queue times to spike and developer frustration to mount. Conversely, underutilized resources result in unnecessary costs, a common failure in environments with fluctuating workloads.

The environment constraints further complicate this landscape. Cloud provider pricing models, such as spot vs. on-demand instances, introduce cost variability that must be factored into CI runner pricing. Developers are acutely sensitive to queue times and concurrency limits, as these directly impact their ability to iterate quickly. For example, a 10-minute reduction in queue time can save hours of developer wait time over a week, accelerating push-to-green times—the time from code commit to a successful build. However, achieving such reductions often requires trade-offs, such as investing in prioritization algorithms or elastic concurrency models, which can increase costs.

Third-party runners introduce another layer of complexity. While they may offer cost savings or performance improvements, they require integration effort that can offset potential benefits. For instance, a third-party runner optimized for specialized hardware might reduce compute time but demand additional setup and maintenance. The decision to adopt such runners hinges on a cost-benefit analysis, comparing the total cost of ownership (TCO) against the developer time saved and the acceleration of development cycles.

The stakes are high. A poorly designed pricing model can lead to inflated costs, reduced CI/CD efficiency, and slower development cycles, ultimately hindering innovation. For example, a pricing model that penalizes fluctuating workloads discourages experimentation and scalability, stifling growth in startups and open-source projects. Conversely, a model that neglects control plane costs can result in unexpected expenses in large-scale deployments, as the orchestration overhead scales with the number of jobs.

To address this dilemma, a fair and sustainable pricing model must consider the following:

• Compute resource utilization: Pricing should reflect the actual CPU, memory, and storage consumed, not just job duration.
• Concurrency management: Elastic models that dynamically adjust concurrency limits can balance cost efficiency and developer productivity.
• Queue time optimization: Investments in job prioritization and efficient scheduling algorithms should be factored into pricing, as they directly impact push-to-green times.
• Control plane costs: These should be transparently included in pricing to avoid hidden expenses in large-scale deployments.

In conclusion, the CI runner pricing dilemma is not just about cost—it’s about optimizing the entire CI/CD pipeline to maximize developer experience and organizational efficiency. A well-designed model must account for the interplay between compute resources, concurrency, and queue times, while remaining adaptable to diverse use cases. As CI/CD pipelines become central to software development, the pricing of CI runners will continue to shape the future of developer workflows and innovation.

Analyzing Pricing Scenarios and Trade-offs

Designing a fair pricing model for CI runners isn’t just about slapping a cost on compute time. It’s a delicate dance between resource utilization, concurrency management, and developer productivity. Let’s dissect six pricing scenarios, exposing their mechanics, trade-offs, and real-world implications.

Scenario 1: Pure Compute-Time Pricing

Here, you pay for raw compute resources—CPU cycles, memory, storage—based on job duration. Mechanically, this maps directly to cloud provider costs, but it ignores the control plane overhead (scheduling, monitoring) and concurrency bottlenecks.

• Pros: Simple, transparent, aligns with cloud pricing models.
• Cons: Overloaded runners spike queue times (e.g., 10x concurrency → 10x wait), while underutilization wastes resources. Developers face unpredictable delays, and organizations pay for idle capacity.
• Edge Case: A misconfigured pipeline with 50% idle runners still incurs full costs, while developers wait hours for builds.

Rule: Use pure compute-time pricing only if concurrency is fixed and predictable. Otherwise, queue times become a productivity killer.

Scenario 2: Bundled Compute + Control Plane

This model splits costs into compute (variable) and control plane (fixed + variable). The control plane scales with job volume, but its costs are opaque to users. Mechanically, orchestration overhead grows with concurrency, but users can’t optimize for it.

• Pros: Accounts for hidden costs in large deployments.
• Cons: Users pay for control plane inefficiency. A 20% increase in orchestration overhead (e.g., due to poor scheduling) inflates costs without developer benefit.
• Edge Case: A 1000-job pipeline with suboptimal prioritization pays 30% more due to redundant control plane scaling.

Rule: Bundle only if control plane costs are transparent and optimized. Otherwise, users subsidize provider inefficiency.

Scenario 3: Concurrency-Capped Pricing

Fix concurrency limits (e.g., 10 parallel jobs) and charge a flat fee. Mechanically, this prevents runner overload but caps pipeline throughput. Queue times skyrocket under load, and developers wait.

• Pros: Predictable costs, prevents overloading.
• Cons: A 50% increase in job volume (e.g., during a release) doubles queue times. Developers lose 2-3 hours daily waiting for builds.
• Edge Case: A startup with bursty workloads pays 2x more for additional concurrency, stifling experimentation.

Rule: Cap concurrency only if workloads are steady and predictable. For bursty pipelines, this model fails catastrophically.

Scenario 4: Elastic Concurrency with Queue Optimization

Dynamically adjust concurrency based on load, using prioritization algorithms to minimize queue times. Mechanically, this requires sophisticated scheduling (e.g., critical jobs bypass queues). Costs rise with elasticity, but developer productivity soars.

• Pros: Reduces push-to-green time by 40% (e.g., from 30 to 18 minutes). Developers save 10 hours weekly.
• Cons: A 25% increase in concurrency costs adds 15% to the bill. Small teams may opt for slower queues to save money.
• Edge Case: A misconfigured prioritization algorithm routes 30% of jobs to the wrong queue, negating elasticity benefits.

Rule: Use elastic concurrency if developer time is more valuable than compute costs. Requires robust scheduling to avoid waste.

Scenario 5: Third-Party Runner Integration

Leverage external runners (e.g., self-hosted or specialized hardware). Mechanically, this offloads compute to cheaper/faster resources but introduces integration overhead. Cost savings depend on workload fit.

• Pros: A GPU-intensive job runs 5x faster on a third-party runner, cutting push-to-green time from 2 hours to 20 minutes.
• Cons: Integration takes 40 hours, offsetting 3 months of cost savings. Pipeline failures due to misconfiguration delay 20% of builds.
• Edge Case: A team saves 30% on costs but loses 15% productivity due to maintenance overhead.

Rule: Use third-party runners for specialized workloads where integration costs are outweighed by performance gains. Avoid for generic pipelines.

Scenario 6: Tiered Pricing with Queue Time Guarantees

Offer tiers (e.g., Basic, Pro, Enterprise) with queue time SLAs. Mechanically, higher tiers allocate more concurrency and prioritization. Costs scale with guarantees, but developers gain predictability.

• Pros: An Enterprise tier guarantees <5-minute queues, saving 15 developer-hours weekly. *ROI is positive if developer time costs >$50/hour*.
• Cons: Basic tier users face 30-minute queues, stifling productivity. Teams may underinvest in CI due to cost fears.
• Edge Case: A startup upgrades to Pro, reducing queue times by 70%, but the 2x cost increase delays hiring.

Rule: Use tiered pricing if organizations value predictability over cost. Ensure lower tiers don’t become productivity traps.

Optimal Model: Hybrid Elastic Concurrency with Transparent Costs

Combine elastic concurrency, queue optimization, and transparent control plane pricing. Mechanically, this balances resource utilization and developer needs. Costs rise with demand, but productivity gains outweigh expenses.

• Why It Wins: Reduces push-to-green time by 40-60%, saves 10-15 developer-hours weekly, and adapts to bursty workloads. ROI is positive for teams where developer time exceeds $40/hour.
• Failure Condition: Breaks if scheduling algorithms are suboptimal (e.g., 20% of jobs misprioritized) or if control plane costs are hidden.
• Typical Error: Teams choose cheaper models, sacrificing 30% productivity. Mechanism: Underestimating the cost of developer wait time.

Final Rule: If developer productivity drives business value, use elastic concurrency with transparent costs. Otherwise, simpler models suffice—but expect slower iteration.

Recommendations and Future Directions

Designing a fair and sustainable pricing model for CI runners requires a delicate balance between compute resource utilization, concurrency management, and developer experience. Based on the analysis of system mechanisms, environmental constraints, and expert observations, the following recommendations emerge as the most effective solutions.

1. Adopt a Hybrid Elastic Concurrency Model with Transparent Costs

The optimal pricing model combines elastic concurrency with transparent control plane pricing. This approach dynamically adjusts concurrency limits based on workload, reducing push-to-green times by 40-60% while adapting to bursty workloads. For example, if a pipeline experiences a sudden spike in job submissions, elastic concurrency prevents runner overload by scaling resources, avoiding the queue time spikes seen in fixed concurrency models.

Rule: Use this model if developer productivity drives business value; otherwise, simpler models may suffice but risk slower iteration. Failure condition: Suboptimal scheduling (e.g., 20% misprioritized jobs) or hidden control plane costs negate benefits.

2. Benchmark Cost per Run Against Developer Time Saved

When evaluating pricing models, organizations must quantify the ROI of reduced queue times. For instance, a 10-minute queue reduction saves developers approximately 10-15 hours weekly, translating to thousands of dollars in productivity gains. This metric should outweigh raw compute costs in decision-making.

Rule: If developer wait time costs exceed compute savings, prioritize models that minimize queue times, even if they are more expensive.

3. Integrate Third-Party Runners Strategically

Third-party runners offer performance gains (e.g., 5x faster GPU-intensive jobs) but introduce integration overhead. A 40-hour integration effort may offset 3 months of cost savings if not managed properly. Teams should assess whether the performance benefits outweigh the maintenance burden.

Rule: Use third-party runners for specialized workloads where integration costs are justified by performance gains. Avoid for general-purpose pipelines unless cost savings are significant.

4. Implement Tiered Pricing with Queue Time Guarantees

A tiered pricing model (Basic, Pro, Enterprise) with queue time SLAs provides predictability for organizations. For example, an Enterprise tier guaranteeing <5-minute queues saves 15 developer-hours weekly, justifying higher costs. However, lower tiers must avoid becoming productivity traps with excessive queue times.

Rule: Use tiered pricing if predictability is valued over cost; ensure lower tiers maintain acceptable productivity levels.

5. Leverage Queueing Theory for Job Scheduling

Optimizing job prioritization algorithms reduces queue times by 40% in elastic concurrency models. Misconfigured prioritization, however, can route 30% of jobs wrongly, negating benefits. For instance, a poorly prioritized critical build can delay deployment, impacting business outcomes.

Rule: Invest in robust scheduling algorithms if using elastic concurrency; otherwise, simpler models may be more reliable.

Future Directions: Research and Innovation

• Dynamic Pricing Based on Workload Patterns: Explore models that adjust pricing in real-time based on pipeline load, incentivizing off-peak usage and reducing costs.
• AI-Driven Concurrency Optimization: Develop AI systems to predict optimal concurrency limits, minimizing queue times while avoiding overprovisioning.
• Cost-Benefit Analysis Tools: Create tools that help organizations compare the TCO of in-house vs. third-party runners, factoring in integration and maintenance costs.
• Behavioral Economics Studies: Investigate how developers perceive different pricing models to design more user-friendly and adoption-friendly structures.

By adopting these recommendations and exploring future innovations, stakeholders can create pricing models that optimize CI/CD pipelines, enhance developer productivity, and ensure sustainable cost management.

In all my time as a software engineer jumping between C# backends, SQL databases, and JavaScript frontends I’ve learned one undeniable truth: no matter how many edge cases you plan for, a user will inevitably do something that absolutely blows your mind.

You can design the most airtight architecture, and yet, sometimes the only thing that saves your system is a well-placed catch-all or an extra null check.

You know the one. It’s the exact check that a coworker flags in the PR review, asking: “What’s the point of this? The data should never be null here. I’ll still approve the PR, but this really isn’t needed.”

And then, a week later, it ends up being the single line of code that stops a massive crash because a user somehow managed to completely bypass Step 3 of a form, and half the expected model data was missing.

The Edna Mode Principle

As Edna Mode rightly says: “Luck favors the prepared, darling.”

You should always try to consider all the absurd angles from which someone might break your application. Users are incredibly creative at doing exactly what you didn’t anticipate. They will:
Poke directly at your API endpoints instead of using the UI you spent weeks building.

Paste an entire 50-character address into a PlaceName field, causing the database to silently truncate it and lose the actual location info.

Find a way to submit a payload that defies the laws of your frontend validation.

AI Assumes the “Happy Path”
This preparation is especially critical right now with how heavily we are integrating AI into our workflows.

Whether you are using Copilot, a local Ollama model, or another assistant, AI is fantastic at giving you exactly what you asked for. It will write the “happy path” beautifully. However, it very rarely considers the chaotic, human edge cases.

AI assumes the user will follow the rules. As engineers, we know they never do. If you are relying on AI to write your data handling or API logic, you have to be the one preparing for the unpredictable scenarios the model overlooked.

Trust Your Intuition

There are a million ways a system can break. As much as we all want to be perfectly “right” in our code and logic, you simply can’t be right 100% of the time.

Sometimes, your engineering intuition just has to kick in. When you feel the urge to drop in that extra validation step, that redundant fallback, or that seemingly pointless catch-all just do it.

It might seem entirely unnecessary right now, but it could be the exact thing that saves your system on a Friday afternoon.

While working on AllInOneTools, I’ve been thinking about FAQ sections from an SEO + AI perspective.

Earlier, the common advice was:

👉 Add FAQ schema to get rich results.

But now with AI Overviews and answer-based search, things feel different.

Because AI seems to care more about:

• clear questions
• simple answers
• structured content

Not just schema markup.

So now I’m wondering:

👉 Is the real value in the content itself, not the schema?

From what I’ve seen:

• FAQ content helps with understanding + context
• Schema helps with formatting + visibility

But AI might prioritize:

👉 clarity over markup

Now I’m curious 👇

What do you think matters more today?

• Well-written FAQ content
• FAQ schema markup
• Or both equally?

Have you seen any real difference in results?

Would love to hear real experiences.

TL;DR

• Hardcoded secrets (CWE-798) show up in roughly 2 out of 3 AI-generated repos
• It happens because AI models were trained on years of tutorial code, not production code
• A pre-commit hook with gitleaks catches this in under 5 seconds

I’ve been scanning repos for a few months now. Mostly side projects, a handful of production apps that founders shared with me directly. The pattern I keep seeing is secrets hardcoded directly into source files.

Not occasionally. Not in old projects. In code that was written last week, sometimes yesterday, by developers who absolutely know better.

Here’s the thing: they didn’t write it. Their AI did.

The Vulnerable Pattern

This is the exact snippet I’ve found in some variation across maybe 200 of the ~300 repos I’ve scanned:

// Generated by Cursor, March 2026
const jwt = require('jsonwebtoken');

const SECRET = 'my-super-secret-key-123';

function generateToken(userId) {
  return jwt.sign({ id: userId }, SECRET, { expiresIn: '7d' });
}

CWE-798, use of hardcoded credentials. The JWT secret is sitting in plaintext in a file that will get committed to version control. If this is a public repo, it’s already exposed. If it’s private, it’s one accidental visibility change away from being exposed.

I see variations with database connection strings containing passwords, Stripe secret keys, OpenAI API keys, and AWS access credentials. All in the source. All committed. Gitleaks flags them in about 2 seconds.

Why AI Keeps Doing This

AI code generators were trained on an enormous corpus of public code. A huge portion of that corpus is tutorial content, blog posts, README examples, Stack Overflow answers. That code almost universally hardcodes values. It’s easier to read. It makes sense for a demonstration.

The model learned from that. When it generates a JWT auth example, it reaches for the pattern it has seen thousands of times: const SECRET = 'some-string'. It’s not being lazy. It genuinely learned that this is how people write this code.

The problem compounds because AI tools are optimized to produce working code fast. A hardcoded secret works. The token generates. The tests pass. Nothing breaks until it breaks badly.

Cursor, Claude Code, Copilot, they all do this. Some do it more than others. None of them reliably stop themselves.

The Fix

Straightforward:

// Pull from environment variables
const SECRET = process.env.JWT_SECRET;

if (!SECRET) {
  throw new Error('JWT_SECRET environment variable is not set');
}

function generateToken(userId) {
  return jwt.sign({ id: userId }, SECRET, { expiresIn: '7d' });
}

Set JWT_SECRET in your .env file. Add .env to .gitignore. Done.

But catching it before commit is better than fixing it after. Here’s a gitleaks pre-commit hook:

# Install gitleaks
brew install gitleaks  # macOS
# or: go install github.com/gitleaks/gitleaks/v8@latest

# Add to .git/hooks/pre-commit
#!/bin/sh
gitleaks protect --staged --no-banner

That hook runs in about 2 seconds and catches hardcoded secrets before they ever hit your repo. For the whole project, not just staged files:

gitleaks detect --no-banner

Scan Your Own Codebase

I’ve been running SafeWeave for this. It hooks into Cursor and Claude Code as an MCP server and flags these patterns before I move on. That said, even a basic pre-commit hook with gitleaks will catch most of what’s in this post. The important thing is catching it early, whatever tool you use.

AI Agents Are Getting Credit Cards. The Fraud Stack Is Missing.

Visa announced AgentCard last month. Stripe built a machine payments protocol. World launched AgentKit for AI identity.

Everyone is racing to give AI agents spending power. Nobody is talking about what happens when agents commit fraud.

The Infrastructure Gap

We spent two years building AI agents that can reason, plan, and execute. Now we are giving them money to spend autonomously. But here is the problem: every payment system built in the last 50 years assumes a human on the other end.

Fraud detection systems look for:

• Device fingerprints (agents run headless)
• Behavioral patterns (agents are deterministic)
• Location anomalies (agents can be anywhere)
• Spending velocity (agents operate at machine speed)

All the signals that catch human fraud fail spectacularly against AI agents because agents are not trying to hide. They are just executing instructions at scale.

What Agent Fraud Looks Like

Picture this scenario:

An e-commerce company deploys a shopping agent to compare prices across suppliers. The agent finds a “deal” on a supplier website that is actually a clone site. The agent places a $50,000 order. The fraud detection system sees:

• Valid API credentials
• Normal purchase patterns
• Legitimate shipping address
• No device red flags (because there is no device)

The transaction goes through. No human reviewed it because that defeats the purpose of autonomous agents.

The Missing Layer

We need three things that do not exist yet:

1. Agent Identity Verification
World is trying with AgentKit, but it is opt-in. A fraudster can spin up an agent that does not participate in any identity framework.

2. Agent Reputation Scoring
Payment processors need a way to score agents, not just merchants. An agent with a history of disputed transactions should have limits.

3. Agent Liability Frameworks
When an agent commits fraud, who pays? The agent operator? The agent creator? The company that deployed it? Current payment terms of service do not cover this.

What Needs to Happen

The industry is moving fast. Visa, Stripe, and others are building agent payment infrastructure. But fraud prevention is an afterthought.

Before we give agents credit cards, we need:

1. Cryptographic agent identity – not just API keys, but verifiable agent certificates
2. Agent spending limits – agents should not have unlimited purchasing power
3. Human-in-the-loop for high-value transactions – autonomy does not mean zero oversight
4. Agent audit trails – every transaction should be traceable back to the instruction that triggered it

The Real Question

The question is not whether AI agents will commit fraud. They will. The question is whether we will have the infrastructure to detect it, attribute it, and recover from it.

Right now, we do not.

As we race to give agents spending power, let us make sure we are not building the same payment rails with none of the safety mechanisms.

The payments infrastructure for AI agents is being built right now. The fraud stack is what keeps me up at night.

Smart home sensors that log when you leave for work. Fitness trackers that infer your menstrual cycle from heart rate data. Connected cars that build a map of everywhere you drive. Smart plugs that reveal home occupancy patterns precise enough to determine when a property is empty. Industrial sensors that monitor individual workers’ movements and productivity.

The Internet of Things is, in many ways, the largest personal data collection apparatus ever built — operating continuously, invisibly, and in the most intimate spaces of people’s lives. For manufacturers and product companies building these devices, GDPR creates a set of obligations that differ meaningfully from those facing web businesses. The stakes are higher, the technical constraints are different, and the regulatory expectations have evolved significantly.

This guide covers what GDPR actually requires from connected product manufacturers — from device design through data sharing, firmware updates, and the intersecting requirements of the EU Cyber Resilience Act.

What IoT Devices Collect — and Why It’s Personal Data

The first compliance question for any IoT manufacturer is deceptively simple: what does our device collect, and does any of it constitute personal data under GDPR?

The answer is almost always yes — and often more extensively than initially apparent.

Location data is an obvious example. GPS-enabled devices — cars, fitness trackers, asset trackers — generate continuous location histories that are, by definition, personal data. But location can be inferred from devices that don’t have GPS. Smart home devices that connect to a home Wi-Fi network reveal the home address. Smart meters reveal not just energy consumption but, when analysed at sufficient granularity, occupancy patterns, appliance usage, and daily routines.

Behavioural data emerges from almost any IoT device. A smart plug records when specific appliances are switched on and off. A smart lock records entry and exit times. A connected coffee machine records when someone wakes up. Individually, each data point might seem trivial. Aggregated over weeks and months, these streams build a detailed picture of an individual’s daily life.

Health inferences are particularly sensitive. Smart scales don’t just measure weight — they calculate BMI, track trends, and increasingly infer metabolic health indicators. Fitness trackers measure heart rate variability, sleep stages, stress levels, and activity patterns. These devices generate health data that qualifies as special category data under GDPR Article 9, triggering significantly stricter processing requirements.

Voice data and ambient audio collected by voice assistants represents some of the most intimate data an IoT device can capture. Even devices that are theoretically “always listening only for the wake word” create significant privacy exposure — both because of the volume of audio inevitably captured and because recordings are often processed remotely.

Industrial IoT raises workplace privacy considerations. Sensors tracking individual worker movements, productivity metrics, or biometric data on a manufacturing floor are processing personal data, and the power imbalance between employer and employee means consent is rarely a valid legal basis.

Who Is the Data Controller?

For web services, the data controller question is usually straightforward. For IoT products, it can be genuinely complex — and getting it wrong has direct compliance consequences.

Consider a typical smart home device: the device itself is manufactured by one company, the companion app is operated by another (or by the same company’s software division), the cloud backend where data is processed and stored may be a third entity, and the device may integrate with third-party services like Google Home, Amazon Alexa, or Apple HomeKit.

Under GDPR, the data controller is the entity that determines the purposes and means of processing personal data. Where two or more parties jointly determine purposes and means, they are joint controllers under Article 26, with specific obligations around transparency and inter-controller arrangements.

In practice:

• If the manufacturer controls both the device firmware and the cloud backend, they are likely the sole controller for core processing activities.
• If the manufacturer’s app sends data to a third-party analytics platform, that platform is a data processor — and the manufacturer needs a valid data processing agreement.
• If the device integrates with a smart home ecosystem like Google Home, there may be joint controller arrangements to document and disclose.
• If a white-label device is sold under another brand’s name, the question of who controls the data requires careful legal analysis of the actual data flows.

Manufacturers often underestimate their controller responsibilities when they sell through retailers or license their technology to other brands. The data subject — the person using the device — will hold someone accountable when things go wrong. GDPR requires that accountability to be clearly allocated before that happens.

Purpose Limitation in AI-Enhanced IoT

One of the most significant compliance challenges for modern IoT products is purpose limitation. GDPR Article 5(1)(b) requires that personal data be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes.

The problem: IoT devices increasingly use machine learning to find secondary uses for the data they collect. A fitness tracker sold for activity monitoring might, in later firmware versions, add stress detection, sleep coaching, or fertility tracking. A smart home hub sold for energy management might add occupancy prediction. A connected car’s telematics system might be repurposed for insurance scoring.

Each of these secondary uses potentially requires a new legal basis. If the original consent was for fitness tracking, it may not cover health inferences. If the original legitimate interest assessment covered smart home automation, it may not cover marketing analytics derived from occupancy data.

Before launching secondary processing use cases, manufacturers need to ask:

1. Is the new purpose compatible with the original purpose (applying the Article 6(4) compatibility test)?
2. If not, what is the legal basis for the new processing?
3. If the new basis is consent, do users need to be re-asked — and what happens if they decline?
4. Have we updated our privacy notice to disclose the new processing?

This has real product consequences. You cannot simply ship a firmware update that adds new data processing capabilities and treat existing users as having consented by virtue of not opting out.

Firmware Updates and Consent

This brings us to one of the most practically challenging questions in IoT privacy compliance: can you update processing purposes through a firmware update?

The short answer is no — not without a valid legal basis for the new processing, appropriate disclosure, and, where consent is required, fresh consent.

When a manufacturer ships a firmware update that changes what data is collected or how it is used, they are potentially changing the purpose of processing. Users who consented to the original processing have not consented to the new processing. Legitimate interest claims for the new processing require a fresh balancing test.

Best practice for manufacturers:

• Version your privacy notices — each major release that changes data processing should be accompanied by an updated privacy notice, communicated to users via the app or email.
• Distinguish between functional and data-processing changes — a firmware update that fixes a security vulnerability does not require fresh consent. A firmware update that adds a new analytics feature does.
• Build consent infrastructure into the companion app — make it possible to present users with new consent requests when they open the app after a major update.
• Respect opt-outs — if a user declines new processing, the device should continue to function for its original purpose without the new data collection.

Voice Assistants and Ambient Data Collection

Voice-activated IoT devices — smart speakers, connected TVs, in-car voice systems — present unique GDPR challenges around ambient data collection.

The technical reality is that distinguishing “wake word detection” from “ambient listening” is difficult to explain to consumers and difficult to prove to regulators. Supervisory authorities across Europe have taken an increasingly sceptical view of claims that voice assistants only process audio after the wake word is detected, given the processing required to detect the wake word in the first place.

Key obligations for voice assistant manufacturers:

Transparency: Privacy notices must clearly explain what audio is captured, how long recordings are retained, whether recordings are reviewed by humans (even on an anonymised basis), and how users can request deletion.

Purpose limitation: Audio captured for wake word detection cannot be retained and used for advertising profiling without a separate legal basis. Multiple regulators have found this practice unlawful.

Access and deletion: Users have a right to access recordings made by their devices and to request deletion. Manufacturers need functional mechanisms for both.

Children: If a voice assistant is in a home with children (and they almost always are), the manufacturer should have considered the likelihood that the device captures children’s voices and addressed this in their DPIA.

Smart Home Data and Article 9: Health Inferences

Article 9 of GDPR provides heightened protection for “special categories” of personal data, including health data, data revealing racial or ethnic origin, and data concerning sex life or sexual orientation.

IoT devices can generate health data — or data from which health information can be inferred — without ever explicitly being health devices. This is one of the most legally unsettled areas of IoT privacy.

A smart scale that measures weight is arguably not processing health data in the Article 9 sense — weight is not inherently a health indicator. But a smart scale that tracks weight trends over time, calculates BMI, and correlates readings with activity data from a paired fitness tracker starts to cross into health data territory. A fitness tracker that detects irregular heart rhythms is plainly processing health data.

Home occupancy data from smart plugs or smart meters may reveal health information indirectly — irregular patterns might indicate illness, disability, or care needs. Supervisory authorities have not definitively ruled on when occupancy data becomes health data, but the risk is real.

For manufacturers of devices that collect or can infer health data:

• Conduct a DPIA before launch — Article 35 makes this mandatory for large-scale processing of special category data.
• Identify the correct legal basis under Article 9(2) — explicit consent is the most common, but explicit consent has a higher bar than standard consent.
• Implement data minimisation at the device level — if you do not need raw sensor data to deliver the feature, do not send it to the cloud.
• Restrict access to health data within your organisation — Article 9 processing should be limited to those who need it to deliver the service.

Children’s IoT Devices

Smart toys, educational tablets, children’s fitness trackers, and connected learning devices occupy a particularly sensitive regulatory position.

GDPR Article 8 sets the age of digital consent at 16 (member states can lower this to 13), meaning that consent from a child below this threshold requires parental authorisation. But beyond consent mechanics, the broader principle is that children deserve enhanced protection — the ICO’s Age Appropriate Design Code (Children’s Code) in the UK, and equivalent frameworks emerging across the EU, place additional obligations on services directed at children.

For children’s IoT manufacturers:

Verify age and parental consent. Simply asking users to confirm they are over 16 (or whatever the local threshold is) is not sufficient for services clearly directed at children. Robust age verification and parental consent mechanisms are expected.

Data minimisation is not optional. Collect the minimum data necessary to deliver the product’s core features. Do not build analytics or profiling capabilities based on children’s data.

Default to privacy-protective settings. All data processing beyond the core product function should be off by default for devices used by children.

No behavioural advertising. Do not use children’s data for advertising profiling — this is explicitly problematic under the Children’s Code and increasingly under GDPR interpretation.

Location data requires particular care. Smart toys and children’s devices that track location create obvious safeguarding risks if that location data is compromised. Apply strict security controls and avoid retaining precise location histories beyond what is technically necessary.

Data Minimisation in Device Design

Privacy by design, required under GDPR Article 25, means integrating privacy protections into the technical design of a product — not bolting them on afterward.

For IoT manufacturers, this translates into concrete hardware and firmware decisions:

Can processing happen on-device? Voice recognition, activity classification, and many sensor processing tasks can be performed locally, on the device itself, without sending raw data to the cloud. Edge processing is both a performance advantage and a privacy advantage — data that never leaves the device cannot be breached in transit.

Can you collect less? A fitness tracker that needs to detect step counts does not need to retain raw accelerometer data — it can calculate steps locally and discard the underlying data. A smart meter that needs to enable time-of-use billing does not need to retain minute-by-minute consumption data forever.

Can you aggregate before transmitting? Instead of streaming raw sensor data to a cloud backend, aggregate into hourly or daily summaries. This delivers the user value while significantly reducing the personal data footprint.

Can you design out certain data categories? If your device could theoretically collect voice data but your product does not require voice functionality, do not include a microphone. This “privacy by hardware design” approach is increasingly advocated by data protection authorities.

Data Sharing with Third-Party Integrated Services

IoT devices rarely operate in isolation. Most companion apps integrate with cloud services — IFTTT, Amazon Alexa, Google Home, Apple HomeKit, Spotify, weather services, delivery notifications. Each integration is a potential data sharing relationship that requires GDPR compliance.

Processor vs. controller: Where your device sends data to a third-party service that processes it on your behalf (e.g., a cloud analytics provider), that third party is a data processor and requires a Data Processing Agreement under Article 28. Where the third-party determines its own purposes for the data (e.g., an advertising platform), it becomes an independent controller — and you need to disclose this to users.

International transfers: Many IoT cloud services involve transferring data to the US or other third countries. Post-Schrems II and the EU-US Data Privacy Framework, this requires either an adequacy decision, Standard Contractual Clauses, or another valid transfer mechanism. For every third-party integration, manufacturers need to verify the transfer basis.

Disclosure in privacy notices: Every third party that receives data from your device — and the nature of that sharing — must be disclosed to users. Generic “we may share with partners” language does not satisfy GDPR’s transparency requirements.

Security Requirements: Encryption, Secure Updates, and Beyond

GDPR Article 32 requires data controllers to implement appropriate technical and organisational measures to ensure security appropriate to the risk. For IoT devices, this has specific implications.

Encryption at rest: Personal data stored on the device or in the cloud backend should be encrypted. For devices that store data locally (smart cameras, wearables with onboard storage), this means hardware-level encryption.

Encryption in transit: All communication between the device, the companion app, and the cloud backend should use TLS 1.2 or higher. Unencrypted IoT communications are a well-documented attack vector.

Secure boot and firmware integrity: Devices should verify the integrity of firmware before executing it. Compromised firmware that exfiltrates user data is a GDPR breach — and a product liability issue.

Secure update mechanisms: Firmware updates should be cryptographically signed. Update channels should be protected against man-in-the-middle attacks. The update infrastructure itself needs security hardening.

Access controls: Cloud backends processing personal data from IoT devices should implement role-based access controls, multi-factor authentication for privileged access, and audit logging.

Data breach response: Manufacturers need incident response procedures that can detect a device-level or backend compromise, notify users and supervisory authorities within the GDPR’s 72-hour window, and isolate affected devices if possible.

The EU Cyber Resilience Act and Its Intersection with GDPR

The EU Cyber Resilience Act (CRA), which entered into force in late 2024 with compliance obligations phasing in through 2027, adds a layer of security regulation that intersects significantly with GDPR for IoT manufacturers.

The CRA imposes mandatory cybersecurity requirements on products with digital elements — which covers virtually every connected device. Key requirements include:

• Products must be designed and manufactured with security by default.
• Manufacturers must provide security updates for the expected product lifetime (minimum five years for most consumer IoT).
• Known vulnerabilities must be addressed and updates made available without delay.
• Manufacturers must report actively exploited vulnerabilities to ENISA within 24 hours.
• A Software Bill of Materials (SBOM) must be maintained for products.

The overlap with GDPR is significant. A device that fails CRA security requirements — say, one that lacks encrypted storage or secure update mechanisms — is also likely failing GDPR Article 32. A vulnerability that is exploited and leads to personal data exfiltration triggers both CRA notification requirements (to ENISA) and GDPR breach notification requirements (to supervisory authorities and potentially to data subjects).

For IoT manufacturers, the practical consequence is that security compliance needs to be planned together — CRA and GDPR have complementary requirements that can be addressed through a unified technical programme rather than two separate compliance exercises.

A Practical Checklist for IoT Manufacturers

Before launch:

• Complete a DPIA for all personal data processing (mandatory for special category data and large-scale processing)
• Document every data flow: device to app, app to cloud, cloud to third parties
• Establish controller/processor roles for all third-party relationships
• Implement Data Processing Agreements with all processors
• Design privacy notice to be accessible in the companion app — not just on a website
• Implement privacy by design: edge processing where possible, data minimisation at source, encryption at rest and in transit
• Age-gate consent properly for products that may be used by children

Ongoing obligations:

• Maintain a Record of Processing Activities (Article 30)
• Version privacy notices with each processing change
• Obtain fresh consent or establish new legal basis before expanding data use
• Respond to access, deletion, and portability requests within one month
• Maintain 72-hour breach notification capability
• Ship security updates for the product’s supported lifetime

Third-party integrations:

• Audit all third-party services for their role (processor or independent controller)
• Verify transfer mechanisms for cross-border data flows
• Disclose all third-party sharing in the privacy notice

Where to Start

If you are building or operating connected products and want to understand your current privacy exposure, the most useful first step is often a scan of your companion app’s website and backend for visible compliance gaps.

Run a free scan at app.custodia-privacy.com/scan — it takes 60 seconds, requires no signup, and identifies trackers, consent issues, and privacy policy gaps on your public-facing web presence. It will not scan your device firmware or cloud backend, but it will give you a concrete starting point for the compliance work ahead.

The device-level and backend compliance work — DPIAs, data flow mapping, security architecture — requires deeper engagement. But understanding where your public-facing presence stands is a useful and quick first step.

Last updated: March 27, 2026. This post provides general information about GDPR obligations for IoT and connected product manufacturers. It does not constitute legal advice. Regulatory requirements vary by jurisdiction, product category, and specific data processing activities — consult a qualified privacy and data protection professional for advice tailored to your products and circumstances.

When I was on maternity leave, I noticed a funny dynamic in our household. Like any expectant mother, I downloaded a bunch of pregnancy tracking apps. But my husband—a dedicated gamer—completely boycotted them.

Why? Because the UI was always pastel pink, and the apps constantly compared our unborn child to fruits. He didn’t want to know his baby was the size of a “blueberry” or a “kumquat.” He felt entirely disconnected from the process, like a mere side character in a rom-com.

The Mission: A “Tacticool” Survival Guide

I realized there was a gap in the market: a pregnancy app that actually speaks a gamer’s language. So, during the baby’s nap times, I started learning to code.

My goal was to build a dark-mode, gamified survival guide purely for expectant dads. I called it Partner in Action.

Instead of standard tracking, I designed features that made sense to him:

Hardware over Fruit: Size comparisons use tools.

Recon Operator: Dads upgrade a tactical operator based on the pregnancy’s progress.

AWOL Status: If the app is ignored for 7 days, the dad’s status automatically changes to “Desertion” (this one was my personal revenge!).

Inventory Management: Tracking baby gear exactly like an RPG inventory system.

The Tech Stack: React + Capacitor

Since I was a solo mom-dev learning on the go, I needed a stack that would allow me to move fast and deploy to mobile without learning two different native languages.

I chose React for the frontend because of its massive community and component-based architecture. To get it onto mobile devices, I used Capacitor. It was amazing to see my web code turn into a real, installable Android app.

Of course, it wasn’t without its hurdles. Figuring out the mobile UI quirks, handling state management while sleep-deprived, and making sure the “Cry Detector” audio feature worked smoothly through Capacitor plugins tested my sanity. But seeing the app finally live on Google Play made every late-night coding session worth it.

What’s Next? (The Roadmap)

The app is out in the wild, but the mission isn’t over. I am currently working on a “Postpartum DLC” (a fourth-trimester expansion pack) and a medical jargon glossary to help dads decrypt hospital terminology.

If you are a dev, a gamer, or a dad-to-be, I would love for you to check it out and give me some harsh feedback on the architecture or UI.

Check out Partner in Action on Google Play: https://play.google.com/store/apps/details?id=com.partner_v_akci.app

Have you ever built an app just to prove a point to your partner? Let me know in the comments!