Acceptable use policies need to be established in accordance with national, local, and industry regulation, as applicable.

Use of collected information refers to how different entities (that are being given access to the IoT data) will use data collected from different sources, in accordance with a privacy policy. In the case of the talking doll, the doll manufacturer itself owns and operates the internet services that interact with the doll and collect its owner's and user's information. Therefore, it alone will be the collector of information that may be useful for:

• Viewing the data
• Studies or analytics performed on the data for research purposes
• Analysis of the data for marketing purposes
• Reporting on the data to the end user
• Selling or onward transfer of the data
• Distillation and onward transfer of any processed metadata that originated from the user's raw data

Ideally, the manufacturer would not provide the data (or metadata) to any third party; the sole participants in using the data should be the doll owner and the manufacturer. The doll is configured by its owner, collects voice data from its environment, has its voice data converted to text for keyword interpretation by the manufacturer's algorithms, and provides usage history, voice files, and application updates to the doll owner.

Smart devices rely upon many parties, however. In addition to the doll manufacturer, there are suppliers that support various functions and benefit from analyzing portions of the data. In cases where data or transcribed data is sent to third parties, agreements between each party must be in force to ensure the third parties agree not to pass on or make the data available for anything other than agreed uses.