Human being has a natural and civil right to protect his health and life. His civil right also includes protection of personal data, including those data that could have an impact on his health. Such data are considered to be sensitive and have to be protected by law, government and all other stakeholders, including commercial companies. Personal data on tobacco habits belong to such datasets. Since May 25, 2018, any company that has processed personal data of European Union citizens is obliged to fulfill GDPR/RODO regulations related to personal data protection. There is no doubt that personal data on consumer's habits, including his tobacco behavior have to be protected by the law. The recent studies and reports warn the public that such novel tobacco products as iQOS (heated tobacco) are first tobacco products ever produced that can harvest personal data on users' tobacco habits and use them in tobacco marketing strategy. Technical reports prove that the iQOS is equipped with two microcontroller chips enable to store and transmit usage information to producer. Phillip Morris, that produces iQOS, is already building a mega database of iQOS customers who register with the company and is developing a software that strengthens these activities. Collected data include the number of puffs and average consumption per day which is crucial information for monitoring tobacco user's nicotine dependence and may help producer in manipulating with addiction potential. This paper collects available data on above risk and proposes on how to counter-act this challenge.