Vizio Smart TVs Fail FTC Privacy Test

Vizio’s settlement with the FTC and the New Jersey Attorney General comes in at $2.2 million after a complaint that Vizio tracked consumer viewing data on 11 million smart TVs since 2014 without their knowledge and sold it to third parties. Vizio must also delete all data collected up until March 2016, disclose its data practices, and improve its privacy policies.

What Do You Need to Know?

According to the FTC’s complaint, the smart TVs captured “second-by-second” viewing information about what was displayed on the screen. The data collected allegedly chronicled viewer habits and content from cable, internet, set-top boxes, DVD players, broadcasts, and streaming devices in addition to IP addresses and metadata. In another twist, older TV models were retrofitted to collect this information through remote software installation, said the FTC.
 
The FTC claims that Vizio sold this information to third parties, including advertisers. Data aggregators could match information on sex, age, income, marital status, household size, education, and home ownership to that data, forming a very comprehensive look at Vizio TV consumers, according to the FTC.
 
The FTC also stated that Vizio allowed third parties to track and target its consumers without proper notification. The tracking occurred through a feature branded “Smart Interactivity,” a service that consumers likely used for the purpose of program offers and suggestions, not with the understanding that it would be tracking viewer habits. Vizio admits no wrongdoing.

What’s Next?

In the complaint, the FTC characterized the television viewing activity of consumers or households as “sensitive”—a departure from the standard definition.  Sensitive information typically involves financial, health, child, location, Social Security and government identification information. FTC appointee Maureen Ohlhausen made a separate statement to “highlight the implications” of characterizing the information as sensitive, writing, “[t]here may be good policy reasons to consider such information sensitive…But, under our statute, we cannot find a practice unfair based primarily on public policy.” She also said that the FTC will launch an effort to further examine what constitutes a “substantial injury” in the context of information about consumers.
 
Separately, last year, LeEco announced plans to acquire Vizio for $2 billion, which have not yet been finalized. As we have seen in other cases, such as Yahoo’s data breach and negotiations with Verizon, data issues are increasingly influential in merger & acquisition deals. It remains to be seen how this case may shape Vizio and LeEco’s relationship.

What’s the Takeaway?

According to the FTC, this case demonstrates “how established consumer protection principles apply to smart technology,” and serves as a reminder of regulatory monitoring and enforcement actions involving the Internet of Things. It also signals shifts within the FTC regarding different protections for different types of data. Drawing from this case, the FTC suggests four data privacy and protection tips for smart companies:

1. Explain your data collection practices up front.
2. Get consumers’ consent before you collect and share highly specific information about their entertainment preferences.
3. Make it easy for consumers to exercise options.
4. Established consumer protection principles apply to new technology.

As smart companies continue to evolve and innovate, regulators are keeping a keen eye on how their technology impacts consumers.