Or it could be done like GDPR — requiring consent and explaining what addresses the device will communicate to, what data will be sent, when, and for what purpo

Or it could be done like GDPR — requiring consent and explaining what addresses the device will communicate to, what data will be sent, when, and for what purpose. GDPR requires that every purpose of personal data use is consented to and explained the same way — what data is collected, where it is processed, for how long it is retained, and for what purpose. New tech privacy laws could* definitely use something like this as a starting point. * Assuming no malicious lobbying.