6: Data protection provisions for consumer IoT 6.1: The manufacturer shall provide consumers with clear and transparent information about what personal data is processed, how it is being used, by whom, and for what purposes, for each device and service. This also applies to third parties that can be involved, including advertisers. 6.2: Where personal data is processed on the basis of consumers' consent, this consent shall be obtained in a valid way. 6.3: Consumers who gave consent for the processing of their personal data shall have the capability to withdraw it at any time. 6.4: If telemetry data is R M M M server (backend) connections and services are considered to be out of scope. Supporting evidence shall describe how each of the provisions are fulfilled and show the following: 1. The mechanism(s) in which the user is provided with clear and transparent information on the processing of personal data and/or collection/processing of telemetry data. RC (7) MC (7) MC (7) MC (7) 2. The mechanism(s) used to obtain the user's consent on the processing of personal data. 3. The mechanism(s) available for user to withdraw consent for the processing of personal data. R M M M RC (6) RC (6) RC (6) RC (6) CLS Publication #2 | Page 42 of 49