"We collect viewing data when you use our TV in order to recommend other content you might like" will probably not really move the needle for most consumers.
And if it doesn't and they accept that by genuine choice, that's fine, it's an informed decision.
But equally, maybe some people wouldn't be comfortable with, "This device contains a camera and microphone that are always on and an independent Internet connection that you cannot block. We cannot guarantee that the software in this device is 100% secure and we only guarantee to update that software for 12 months after the date of purchase. We do not control some online services used by this device and Internet-connected features of this device might break at any time with no way to fix them. There is a {regulator-imposed description/statistic} chance that someone will be able to hack your device, watch and listen to the area around it including other nearby rooms, and provide hackers with access to any other devices and activity on your home network. This device will upload information about what you watch and when to {names of business(es)}, which will use the data to profile you including guessing your family make-up, wealth, interests and vulnerability to advertising, and this information will be sold to {list of recipients} who may use it to {purposes}."
It seems to me like everything already comes with a license agreement and/or other mandated disclosures that are at least as bad as that, and it's too much text to put in large print in a prominent place.
That is part of the reason I like this approach. If it's too complicated to fit on the outside of the box, maybe the device is doing more shady stuff than it should be and needs to turn it down!
Hard to imagine how you can write a law that will express this viewpoint without a ton of unintended consequences. "if you can't exhaustively describe the drawbacks of using your service from every possible perspective in two sentences, it is illegal" will probably hit a lot of things you like as well as what you don't.
I think it's much more practical to simply ban fine print contracts that are not negotiated in favor of standard regulations that apply to everyone. You can't expect businesses to foresee everything that will go wrong, but you can force them to shoulder the risk of the unknown.
The point is that you don't try to cover all bases, just certain broad categories. Any product manufacturer that wants to avoid hassle can just not do shady things in those ways at all and then they don't need to worry about it at all.
The experience with GDPR in the EU so far seems to have been that the clear elements were generally felt to be reasonable, and businesses that weren't doing shady things would already have been in compliance with most of them anyway. The problems with GDPR have more been around ambiguity and the unnecessary and sometimes disproportionate red tape imposed even on "good actors". It was a similar story with the slightly earlier update to EU consumer protection rules.
I don't see why we couldn't learn from experiences like those and develop a reasonable regulatory regime for devices with embedded sensors and/or connectivity.
No external connectivity? Nothing to disclose. External connectivity? Do you use a customer-defined network connection or establish your own (and if so, how)? What's your policy on providing security updates? What guaranteed minimum support period are you offering, and what will happen to the device past the end of that period? Maybe if you or any of your business's officers or controlling interests have been responsible for a serious breach in the past, you also have to disclose that with prominence that reflects the recency and severity of the failure, so being careless about security becomes a sticky and toxic label rather than just a lawsuit that is a cost of doing business.
Not depending on outside services? No need to disclose. Depending on outside services? You need to state a minimum period where you guarantee your device/functionality will keep working, whether each outside service is under your control, what identifiable data is changing hands, what will happen to the device if each external service is changed or discontinued, etc.
Not including any sensors of defined categories (camera, microphone, location, etc.)? No need to disclose. Including sensors? You need to state how to tell whether they are in use, whether you provide a physical switch to disable them that software can't override, what they are used for, whether any data they collect could be transferred off the device, etc.
I don't see anything unreasonable about this, because anyone making such devices is going to be spending considerable time and money to include those sensors, that connectivity, or that use of outside services, so there's no credible claim that they don't (or shouldn't) know exactly what is going on. Requiring a few lines of specific details to be provided in a standardised format under the sorts of specific conditions I mentioned above doesn't seem either unrealistic or disproportionate as we move into a world where more and more devices do come with some or all of these three liabilities.
