Regulators Tell Vizio to Get Smart(er)
The smart TV, once a novel device, has become a staple in many American homes. But, according to the FTC and the New Jersey Attorney General, Vizio smart TVs were doing more than displaying content. Behind the scenes and Vizio screens, without notifying consumers, regulators allege the company was tracking consumers’ second-by-second viewing habits from over air broadcasts, cable and broadband providers, set top boxes, and DVD players. Vizio then shared consumers’ IP addresses with data aggregators, who correlated that address to individual consumers or households. Vizio prohibited the re-identification by name, but aggregators appended other information such as gender, age, income, marital status, household size, education, and home ownership to that IP address.
Vizio then shared viewing data and the demographic data with third parties to:
- determine, on an aggregate basis, what consumers watch and how;
- analyze advertising effectiveness across devices, such as by determining if a consumer visited a website following a TV ad related to such site; and
- deliver targeted ads on other devices based on viewing data.
The FTC and NJ AG alleged that Vizio engaged in deceptive practices because neither the initial pop-up notification about its “Smart Interactivity” feature nor the TV’s settings provided detailed information about the collection and use of viewing data. The TV settings indicated it “enables program offers and suggestions” but regulators believe this disclosure provided insufficient information about the information that was collected and how it was going to be used. Moreover, Vizio apparently provided no such offers or content suggestions for over two years.
The regulators charged Vizio with engaging in unfair practices, alleging granular viewing data is “sensitive” and the collection and sharing of such data without permission has caused or is likely to cause substantial injury. The complaint did not describe the injury actually suffered by or likely to be experienced by consumers.
In a concurring statement, Acting Chairwoman Ohlhausen noted that this is the first time that the Commission has alleged granular TV viewing data is sensitive, a designation that the Commission has used for financial, health, geolocation, and children’s data. Ohlhausen indicated she would lead an effort by the FTC to reexamine what qualifies as substantial injury. Her statement suggests use of the unfairness prong of the FTC Act may be more limited in the future.
Still the case demonstrates that regulators are increasingly focused on 1) the collection and use of various types of consumer data, including data traditionally considered “non-PII”; 2) the use of data across multiple channels for various purposes such as ad optimization and analytics; and 3) how to implement reasonable consumer disclosures. In addition to paying $2.2 million, Vizio must 1) obtain affirmative express consent to collect viewing data; 2) delete date collected prior to March 2016; 3) maintain a comprehensive privacy program; and 4) undergo independent biennial privacy assessments.