On February 6, the FTC and the New Jersey Office of the Attorney General announced a $2.2 million settlement with Vizio, Inc. over allegations the TV manufacturer installed software on its TVs to collect viewing data on 11 million consumers without their knowledge or consent.
According to the complaint, Vizio manufactured smart TVs that allowed the company to capture second-by-second information about video displayed on the device, including data from consumer cable, broadband, set-top box, DVD, over-the-air broadcasts, and streaming devices. The complaint indicated that since 2014 Vizio captured up to 100 billion data points each day from more than 10 million Vizio televisions. Vizio also periodically collected other information such as IP addresses, wired and wireless MAC addresses, WiFi access points, and other data, according to the complaint.
Vizio then provided consumers’ IP addresses to data aggregators, who matched the address with an individual consumer or household. Vizio’s contracts with third parties prohibited the re-identification of consumers and households by name but allowed identification using a host of other personal details, including consumers’ gender, age, income, marital status, household size, education, and home ownership. Furthermore, Vizio permitted these companies to track and target its consumers across multiple devices.
Vizio sold consumers’ television viewing history to third parties through licensing agreements, on a television-by-television basis. The data allegedly allowed other companies to determine customer viewing habits and advertising effectiveness, and to target advertisements to particular consumers on their digital devices based on their television viewing habits.
According to the FTC and the Attorney General, Vizio’s collection and sharing of sensitive data without consumers’ consent constituted an unfair act or practice, in violation of the FTC Act. Notably, the FTC and the Attorney General classified household or individual television activity as sensitive information and that sharing such viewing habits without consent causes or is likely to cause “substantial injury” under the FTC Act. The case marks the first (although likely limited) move by the FTC to broaden the definition of sensitive information beyond Social Security numbers, financial information, health data, and geolocation information.
Further, the FTC and AG asserted that Vizio’s failure to adequately disclose to customers how they were tracking and selling information constituted a deceptive practice in violation of the FTC Act. According to the complaint, Vizio televisions sold after August 2014 provided no onscreen notice to consumers of the collection of viewing data. Consumers who used Vizio televisions sold before 2014 that were updated to install tracking technology after purchase received an initial pop-up notice on the screen that indicated that “The Vizio Privacy Policy has changed.”
The FTC vote approving the complaint and proposed order was 3-0, with Acting Chairperson Maureen K. Ohlhausen issuing a concurring statement. Ohlhausen supported the FTC’s allegations that Vizio deceptively omitted information about its data collection and sharing program. However, she wrote separately to criticize the FTC and the AG’s allegation that individualized television viewing activity falls within the definition of sensitive information or that the practice was unfair.
“There may be good policy reasons to consider such information sensitive,” Ohlhausen wrote, “but, under our statute, we cannot find a practice unfair based primarily on public policy. Instead, we must determine whether the practice causes substantial injury that is not reasonably avoidable by the consumer and is not outweighed by benefits to competition or consumers.” Ohlhausen concluded, “This case demonstrates the need for the FTC to examine more rigorously what constitutes ‘substantial injury’ in the context of information about consumers. In the coming weeks I will launch an effort to examine this important issue further.”
Ohlhausen’s promise to examine what constitutes “substantial injury” hints that the use of the unfairness prong of the FTC Act could require a stronger demonstration of harm under her leadership over the coming years.
The FTC’s settlement with Vizio builds on the FTC’s settlement with InMobi in June 2016. There, the FTC accused InMobi of misrepresenting that its advertising software would only track consumers’ locations when they opted in and only in a manner consistent with their device’s privacy settings. However, the FTC alleged that InMobi actually tracked consumers’ locations whether or not the apps using InMobi’s software asked for consumers’ permission to do so, and even when consumers had denied permission to access their location information. According to the FTC, InMobi used the locations of consumers to serve them geo-targeted advertising.
Going forward, the Vizio and InMobi settlements demonstrate that clear disclosure and consent remain the most powerful defenses for businesses leveraging data collection and analytics. Even with the new administration, the FTC will likely continue to carefully assess the adequacy of disclosures and will likely continue to be more skeptical of the generalized disclosures that have historically dominated the market. When possible, businesses should try to be as specific as possible regarding their data practices.
Furthermore, businesses that leverage data collection and analytics need to take into consideration how disclosures and consent work throughout the user ecosystem and not just where the user interfaces with their product. Ultimately, a well-crafted user interface that tactfully obtains consent throughout the process should help businesses create a better record of individualized experiences and how different sets of data were actually collected and used.
We will continue to monitor the FTC’s approach to consumer privacy and other developments in this rapidly evolving area.