Beyond Smart Meters: The Expanding Regulatory Focus on Sensitive Consumer Data

Morgan Lewis reports that regulators are focused on the potential for connected vehicles, wearables, thermostats, smart TVs, and other Internet of Things products to collect data passively[1], which the firm says often happens "without consumers' awareness."The firm says regulators are increasingly asking whether consumers understand that connected products are collecting information, how that data may be used to build consumer profiles, and whether consumers have meaningful opportunities to control its collection and use.[1]According to Morgan Lewis, the smart meter proposal follows a familiar US pattern of imposing heightened protections on specific categories of information rather than relying on a comprehensive federal privacy framework.[1] The firm also notes that state privacy laws continue to expand the definition of "sensitive data,"[1] and that the FTC has likewise used its existing authority to analyze the collection and use of data that it considers to be "sensitive."[1] The firm says amendments to the state's privacy law will require covered controllers to provide a clear and conspicuous link on their websites or applications[1] so consumers can opt out.The firm writes that, regardless of whether the smart meter proposal becomes law, it emphasizes broader privacy risks that businesses across industries should consider[1]. Morgan Lewis advises that data inventories should account for information collected automatically through connected products, sensors, apps, websites, vehicles, and other technologies[1].A Morgan Lewis practice page lists FTCWatch coverage headlined "Smart Meter Privacy Bill Takes Aim at Foreign-Owned Utilities"[2], dated September 22, 2026.