Beginning in 2014, consumer electronics company Vizio used its smart televisions to collect and later sell data on millions of its customers without their knowledge or consent, according to a new report by the Federal Trade Commission.
Vizio has agreed to settle the complaint, filed by the FTC and the state of New Jersey, for $2.2 million. The money will be split between the FTC and the New Jersey Division of Consumer Affairs. The settlement also orders Vizio to destroy all data gathered before March 1, 2016 within the next 120 days.
The complaint alleges that beginning in 2014, Vizio collected viewer data from more than 10 million of its smart TV sets, and sold it to analytics, media and advertising companies without consumers’ consent.
The company monitored both what their customers watched and how they were watching it, in subsequent years also tracking the effectiveness of advertising across devices, the complaint says. The FTC said that Vizio “provided consumers’ IP addresses to data aggregators, who then matched the address with an individual consumer or household.” Income, age, education and homeownership information was also sold to third parties, according to the complaint. And in 2016, the company began selling customer data to third parties who wanted to better target their advertising to consumers on their digital devices, based on their television habits.
With the growing number of smart devices — from cell phones and assistants like Alexa to refrigerators and thermostats — available to consumers, it can be hard to know what exactly happens to the data they collect. In early 2016, more than one in two American households had an internet-enabled television, and nearly half of those households use smart TVs, as reported by Variety.
But in a separate statement, FTC acting chair Maureen Ohlhausen said the settlement could help redefine what’s considered sensitive information.
“We have long defined sensitive information to include financial information, health information, Social Security Numbers, information about children, and precise geolocation information. We have also recommended that companies get opt-in consent before collecting and sharing the content of consumers’ communications,” she wrote. “But here, for the first time, the FTC has alleged in a complaint that “individualized television viewing activity falls within the definition of sensitive information.”
Vizio ran the tracking function through Smart Interactivity, a feature the company described on its website as a feature that can collect information about your device and suggest bonus features, polls and advertising “related to the content you’re viewing.”
The company’s website says customers can opt out of this feature at any time. But according to the complaint, marketing Smart Interactivity as a tool that enabled new features failed to disclose the tracking in consumer-friendly terms.
In a statement on the company’s website, a Vizio attorney admitted no wrongdoing in the case and said the company was not accused of disclosing any personal data.
“The ACR program never paired viewing data with personally identifiable information such as name or contact information,” Vizio general counsel Jerry Huang said.
The company also said in its statement that it updated webpages to make information about data collection more clear — highlighting not only how to disable the feature, but also what its purpose is.
Huang lauded the settlement as setting a new, higher standard for “privacy practices for the collection and analysis of data collected from today’s internet-connected televisions.”
Jennifer Lynch, senior staff attorney at the Electronic Frontier Foundation, said in an interview with PBS NewsHour that while the settlement is a win for consumers, it’s not clear whether this will hurt Vizio or encourage policy changes at other companies.
“A $2.2 million dollar settlement for a company that sold 11 million TVs is a slap on the wrist,” Lynch said.
Lynch also pointed out some of the data Vizio collected was being handed over to law enforcement officials. The settlement excludes data “requested by a government agency or required by law, regulation, or court order, including without limitation as required by rules applicable to the safeguarding of evidence in pending litigation” from the data deletion requirement.
Meanwhile, Ohlhausen said the Vizio settlement “demonstrates the need for the FTC to examine more rigorously what constitutes ‘substantial injury’ in the context of information about consumers,” she wrote, adding she’d launch an effort to do so in the coming weeks.