EU online stores rarely say how long IoT devices get security updates, study finds

A connected camera or smart speaker is only as safe as its last firmware update, so the most useful security fact a buyer can have is how long those updates will keep coming. Regulators agree: the UK, the US labelling scheme and the EU’s new cybersecurity law all ask manufacturers to state a support period up front. A study presented at USENIX Security 2026 checked whether that information actually reaches the place where people buy devices, the online store.

The answer, across the European Economic Area, is mostly no. Where the information does appear, it often conflicts with what the manufacturer or the EU’s own product database says.

What problem does it address?

Security updates are the only way to fix vulnerabilities found after a device ships, and many consumer IoT products stop receiving them long before they stop working. Telling buyers the support period at the point of sale is meant to let them factor it into the purchase, much like a warranty, and to push manufacturers to compete on longer support.

Several rules now require this. The UK PSTI Act makes manufacturers state a minimum update period, the US Cyber Trust Mark puts it on the label, and the EU Cyber Resilience Act obliges manufacturers to disclose a support period for products with digital elements, with the full set of requirements applying from 11 December 2027 under Regulation (EU) 2024/2847. Two narrower measures were already in place when the study ran: the EU energy labelling rules require update information for smart TVs in the central EPREL product database, and since 2020 the Netherlands Authority for Consumers and Markets has required major Dutch online retailers to show it. The authors note there was little large-scale evidence that any of this reaches product pages.

What did the researchers do?

Swaathi Vetrivel, Michel van Eeten and Carlos H. Gañán of Delft University of Technology looked at five consumer device types: IP cameras, smart printers, smart speakers, smart TVs and smartwatches. They covered the 30 countries of the European Economic Area and, using popularity rankings, picked three kinds of store: popular local retailers, the Amazon storefronts used in those countries, and the regional versions of Temu.

According to the paper, the work had three steps. First, the team manually reviewed several thousand product pages to see which stores disclose update periods at all. Second, they scraped 29,587 pages from the stores that do, mainly six EU Amazon sites, two Dutch retailers and the smart TV listings of regional retailers, and recorded the stated durations. Third, for a smaller sample of devices sold by the Dutch retailers, they compared the retailer’s figure with the manufacturer’s website and, for smart TVs, with the EPREL entry. The abstract puts the total at 34,187 product pages. Data was collected between December 2024 and May 2025, and the authors have shared the dataset.

What did they find?

The abstract reports that disclosure varies sharply by store. Dutch retailers, which are subject to regulatory oversight, list update durations for up to 92% of devices. Amazon does so for fewer than 1%, and Temu for none. The paper adds that Amazon’s European product pages include a field for the update period, which is almost always left empty.

Smart TVs, the one category where EU rules mandate disclosure, have higher coverage, but it is still inconsistent. Stated support periods across all devices range from one to eight years, with smart TVs generally getting the longest.

The comparison across sources is the most striking result. For the same device model, the retailer, the manufacturer and the EU database often give different durations, and retailers often understate support relative to the manufacturer. The paper also reports that manufacturer websites themselves disclose a period for only a minority to half of the sampled devices, depending on type. When the researchers asked the two Dutch retailers where their figures came from, one did not reply and the other cited internal case studies it could not share. The authors read this as evidence that retailers are not simply passing on manufacturer data.

On policy, the paper finds the Dutch intervention and the smart TV rules associated with more disclosure, little visible effect from the UK PSTI Act on the UK Amazon site and manufacturer pages it checked, and little spillover beyond the jurisdictions that regulators actively watch. The authors conclude that regulation can improve visibility, but only robust enforcement and standardized disclosure make the information accurate and trustworthy.

Why it matters

For manufacturers, the support period is turning from a marketing choice into a legal statement, and this study shows that the number a company publishes is often not the number a buyer sees. Under the CRA the obligation sits with the manufacturer, while the authors note that under EU consumer law the buyer’s contract is with the retailer. A device sold with three different support periods on three different pages invites disputes about which one applies. One dated end of support per model, published on the product page and a central support page and given to retailers in a structured form, is cheaper than reconciling conflicting claims later.

For anyone buying devices at scale, for a building, a hotel or a smart home installation business, the practical lesson is to get the support period from the manufacturer in writing and record it per model. A blank field on a store page does not mean the device is unsupported, and a short period on a retailer page may understate the maker’s commitment. Teams that run fleets can track the end-of-support date alongside firmware versions as part of device lifecycle management, so that replacements are planned rather than discovered.

A promised period also has to be backed by working OTA updates. The study measures what is claimed, not what is delivered, and a long period means little without the update pipeline described in our guide to device management and OTA updates.

What it does not show yet

The study measures claims, not behavior. It does not check whether any device actually received updates for the period stated, and the authors note that this will take years to see.

There is no ground truth when sources conflict. The paper treats neither the retailer, the manufacturer nor the database as automatically correct.

The data predates the CRA’s main obligations. Collection ran from December 2024 to May 2025, so the results are a baseline, not a measure of CRA compliance.

The sample favors popular devices on popular stores, ranked by each platform’s own listings, and the cross-source comparison rests on a smaller sample of Dutch listings. The authors argue that less popular devices are unlikely to do better, but they cannot place their sample within the wider market.

Where to go next

• IoT security regulation compares the CRA, the UK PSTI regime and the US Cyber Trust Mark, including what each says about support periods.
• Device management and OTA updates covers how to deliver updates for the period you promise.
• IoT security fundamentals sets update support in the wider threat model.
• The October 2026 research roundup covers six more recent studies, including attacks that reach cellular modules through the SIM card.

Topics: research, IoT security, security updates, Cyber Resilience Act, smart home, regulation