As the number of Internet users grows, the increase in smart devices interconnected through the Internet of Things (IoT) have contributed to improvements in the functionality of everyday products and enhancement of user experience. Yet, they affect user privacy and render personal data more vulnerable. To foster a digital future fully aware of user privacy requirements, a line of design research emerges that focuses on balancing product innovation with user data protection. This matter relates to sociocultural, economic, and technological aspects, and its core is a human-centered design strategy. Still, there is a gap in academic research oriented towards guiding product developers on how to consider personal data privacy concerns when designing honest IoT devices. To define this gap and delve deeper into this relevant topic, this paper presents a systematic literature review of recent academic research using the Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) method. This review focuses on prevalent research topics such as data privacy, personal data, data surveillance, and user behaviour in IoT. The result is a state-of-the-art compilation of 45 scientific studies mapping the most relevant concepts and approaches for product development in the last ten years of research, aligned with some central research questions. The Discussion and Conclusion sections provide a deep understanding of the complexity of the fast-changing landscape of privacy and personal data management using IoT products. Finally, this study proposes future academic research directions devoted to providing product designer specific, specialised help from different (yet interconnected) scientific approaches.

[This corrects the article DOI: 10.1016/j.heliyon.2024.e30357.].

Privacy usability in IoT smart home companion applications remains an underexplored domain despite mounting regulatory requirements and accelerating user adoption. Heuristic evaluation offers a scalable pathway to privacy usability assessment, yet validated frameworks for applying such methods are scarce. This study presents the first empirical application of the ABCDE Privacy Framework, a ten-heuristic instrument grounded in Nielsen’s usability principles and Privacy by Design, to an IoT companion application developed with a major European home appliance manufacturer. A structured workshop was conducted with a multidisciplinary team of seven participants (five industry professionals and two researchers) following a two-round protocol: a qualitative heuristic discussion phase (Round 1) and an individual scoring phase (Round 2). Data were analysed through MAXQDA (VERBI Software, Berlin, Germany). Average heuristic scores ranged from 3.6 (H9: error recovery) to 4.8 (H6: recognition; H10: documentation), with an overall mean of 4.32. Six second-order themes were identified, including Transparency Asymmetry, Centralised but Decontextualised Privacy, and Shared Household Complexity. This first pilot application suggests that the ABCDE Privacy Framework is feasible, time-efficient, and analytically productive in this industrial context, generating design-relevant insights and enabling cross-role team alignment within a two-hour session. These preliminary findings indicate its potential as a tool for Privacy-by-Design practice in IoT product development and provide a basis for future replication and validation.

(1) Background: Privacy usability in IoT smart home companion applications remains an underexplored domain despite mounting regulatory requirements and accelerating user adoption. Heuristic evaluation offers a scalable pathway to privacy usability assessment, yet validated frameworks for applying such methods in real industrial settings are scarce. This study presents the first empirical application of the ABCDE Privacy Framework, a ten-heuristic instrument grounded in Nielsen’s usability principles and Privacy by Design, to an IoT companion application developed with a major European home appliance manufacturer. (2) Methods: A structured workshop was conducted with a multidisciplinary team of seven participants (five industry professionals and two researchers) following a two-round protocol: a qualitative heuristic discussion phase (Round 1) and an individual scoring phase (Round 2). Data were analysed through MAXQDA. (3) Results: Average heuristic scores ranged from 3.6 (H9: error recovery) to 4.8 (H6: recognition; H10: documentation), with an overall mean of 4.32. Six second-order themes were identified, including Transparency Asymmetry, Centralised but Decontextualised Privacy, and Shared Household Complexity. (4) Conclusions: The ABCDE Privacy Framework is feasible, time-efficient, and analytically productive in real industrial contexts, generating design-relevant insights and enabling cross-role team alignment within a two-hour session. These findings support its potential as a scalable tool for Privacy by Design practice in IoT product development.