IoT devices nowadays become the target of cyber-attacks. Due to limited battery and computing capacity, IoT devices are constrained to employ effective security mechanisms. Among the security threats, the comprise to the IoT data privacy can lead to many implicit yet detrimental consequences such as object tracking and identity stealing. A widely advocated privacy protection framework is called privacy by design (PbD), which aims to integrates privacy protection from the system onset. Despite its promising vision, the engineering implementation of PbD principles is still in its infancy, particularly in the IoT applications. In light of it, this paper will discuss a new direction in IoT data privacy that is PbD using the intrinsic hardware memory noises. Existing works, open challenges, and future directions will be discussed.