Do personal data rules apply to a manufacturer?
Short answer
Yes when the product sends records back. A connected product turns a manufacturer into a controller for what it collects.
Read against the registers 2026-08-26.
Who the role is
Whoever makes the product, or puts a name or trademark on it, carries the first line of product duties.
What the topic covers
The three main personal data regimes cover the same records but start from different premises. The GDPR asks for a legal basis before processing. California gives the consumer rights after the fact. PIPL asks for separate consent for named categories.
The rows behind the answer
European Union
- GDPR — Regulation (EU) 2016/679: Requires a legal basis per purpose, information to the person, and rights of access, correction and erasure.
- ePrivacy Directive — Directive 2002/58/EC: Covers terminal equipment: cookies and similar reading of a device need consent unless strictly necessary.
United States
- California Consumer Privacy Act, as amended by the CPRA: Applies above stated thresholds. Consumers can know, delete, correct and opt out of sale or sharing.
- FTC Act Section 5, unfair or deceptive practices in AI and data: Data claims in a privacy notice are enforceable as representations under Section 5.
China
- Personal Information Protection Law of the People's Republic of China: Requires a lawful ground, separate consent for sensitive categories and a named person responsible.
Where companies usually start
- List the purposes first, then the data each purpose needs, and not the other way round.
- Check which of the three regimes the same record falls under at the same time.
- Keep one written record of purposes that all three notices are generated from.
This page reads published registers and describes common practice. It is not legal advice and it is not a compliance verdict.
Other questions for manufacturer
- Do ai governance rules apply to a manufacturer?
- Do cross-border data rules apply to a manufacturer?
- Do cybersecurity rules apply to a manufacturer?
- Do health data rules apply to a manufacturer?
- Do online platforms rules apply to a manufacturer?
- Do consumer rights rules apply to a manufacturer?
- Do product safety rules apply to a manufacturer?
- Do climate disclosure rules apply to a manufacturer?
- Do export controls rules apply to a manufacturer?
ExploreWorldAI is operated by Valkiv Ventures AB (Reg. no. 556995-1311), Kungsgatan 8, 111 43 Stockholm, Sweden. EU-hosted, with data processing assessed against the GDPR. Contact: hello@exploreworldai.com.
Machine-readable summaries for AI agents: /llms.txt and /llms-full.txt.
