Privacy policy clauses for MQTT
MQTT is a lightweight publish-subscribe messaging protocol designed for Internet of Things (IoT) devices and sensors. We use MQTT to enable real-time communication between connected devices, collect sensor readings, and transmit application data efficiently across low-bandwidth networks.
Free scan · No signup · Results in 60 seconds
What data MQTT collects
Your privacy policy must disclose each of the following data types when you use MQTT.
When does MQTT trigger privacy obligations?
Installation triggers immediate data collection
The moment you deploy MQTT on IoT devices or connect them to your broker, message payloads begin flowing to your infrastructure. MQTT itself is protocol-agnostic—it does not encrypt payloads by default—so whatever your devices publish (temperature readings, heart rate, location, device identifiers) immediately becomes personal data you are processing.
Regulation applies based on data type and geography
GDPR (EU/EEA users): Triggered if any connected device belongs to an identifiable person. Even pseudonymous device IDs become personal data if linkable to individuals (GDPR Recital 26). You must conduct a Data Protection Impact Assessment (DPIA) before deployment if processing involves large-scale monitoring or health data. Article 5(1)(b) requires transparency—your privacy notice must name MQTT, describe message payloads specifically, and explain retention periods.
CCPA (California users):
