Internet of Things (IoT) systems can often pose risk to users’ privacy via disclosure of personal information to third parties. In this paper, we argue that to assess privacy risks associated with IoT systems, an automated solution is required due to the increasing pervasiveness and complexity of deployed IoT systems. We propose requirements for an automated privacy risk assessment service and outline ourfuture plans for realising such a solution.