>I’m fairly sure, at least in Europe, there will be legislation that prevents this without explicit positive content from the consumer. I suspect GDPR already covers it in fact.

Judging by the new CSAM legislation being pushed by EU bureaucrats, your fridge won't report to its maker but to EU commission and maybe to your own government.

The fridge couldn't contain CSAM ( unless people keeping kids in fridges becomes a massive problem somehow), so it's not really comparable.

Of course it could, it's a networked computer with storage. I'm guessing there's a 0% chance it's not running a webserver.

Extremely limited embedded storage, so not really.

But it is, at least on paper, to combat child sexual exploitation by preventively searching for any related content in communications. That's the stated goal, that's what it does. It has serious ramifications ( broken encryption is broken), can be abused for other things, etc. but that's the purpose.

So a fridge with very limited embedded storage doesn't really match.

> I’m fairly sure, at least in Europe, there will be legislation that prevents this without explicit positive content from the consumer. I suspect GDPR already covers it in fact.

I can't seem to find the relevant part of GDPR that would even attempt to cover that - beyond any tracking data sent back to the manufacturer.

IANAL but I think anything that can be potentially personally identifiable, with tracking associated, would be. If you have “registered” your appliance (for that extended warranty), you have given them your details which are then associated with the device.

Say you are Samsung, you have a fridge with a camera on it that keeps track of what’s in the fridge “for the user”, so they can see inside their fridge even when not at home. Now add in some image recognition, automatically tracking exactly what’s in the fridge, how often it’s used, when it’s running low. Now you have some of the most valuable consumer data possible to sell to data brokers. That is defiantly covered by GDPR.

Only in so far that they have to notify you what data is collected, for what imaginary purpose and who is managing it. It's not personal information according to GDPR, unless combined with something else that is.

I don't think GDPR is as relevant here either, but installing a transmitter in a car that you can't turn off would be irradiating someone against their will.

France doesn't even have WiFi in schools for this reason. Hard to imagine they would allow something like this in a vehicle.

Irradiation is usually taken to mean ionizing radiation, which isn't what anyone would transmit from a car.

Vehicles have built-in hotspots and LTE modems in Europe for years now. Pretty much any german luxury brand car these days will come with builtin LTE modem for navigation traffic and other similar systems.

Also, use of your home internet modem to transmit a ISP-only open wifi is also legal according to many EU laws.

At a minimum, the transmitter would need to comply with RF exposure limits.

they'll probably try to get people to positively opt in to a ToS and GDPR set of terms during the online purchase process, which we know people will aggressively click "yes/i accept/agree" in order to continue, if the price, product and marketing are sufficiently compelling.

Authorities are already cracking down on the use of dark patterns for tricking people into opting into tacking without explicit informed consent. So yes, they will try that, then they will be found out and fined. Then they will be forced to put a big warning screen on front of the fridge just like all those pop ups we now have on the web.

People will still buy it and click through, because they want their junk, no matter what it does with their data.

I can't count how many times my friends and family said "I don't care" when I tried to educate them on how their devices or software spy on them.

People who really care about privacy enough not to buy stuff that spies on them are rare, and becoming rarer every year as more and more kids grow up in a world where being spied upon is normal.

I bet that a sufficiently motivated ui designer could design a system that matched all the requirements of having people explicitly consent, such as scrolling all the way to the bottom of a ToS and typing "yes sell my data" into a box, but also get people to just do it in order to complete an order checkout process workflow.

That fails the explicit consent test for GDPR for what I understand. You can always opt out at any time to.