Chances are, if you owned a VIZIO TV from February 2014 to late 2016 and the default “Smart Interactivity” feature was enabled, your TV was transmitting second-by-second information back to VIZIO about what you were watching–be it from your cable provider, external streaming device, or DVD player.[1]
According to a complaint filed by the Federal Trade Commission on February 6th, 2017, the “ACR software” that makes this transmission possible also periodically collected other information about VIZIO TVs “including IP address, wired and wireless MAC addresses, WiFi signal strength, nearby WiFi access points, and other items.”[2] And that’s not all. In May, 2014 VIZIO started providing viewing data to third parties for audience measurement purposes coupled with “a persistent identifier for each television . . . along with the content (programs and commercials) viewed, when it was viewed, how long it was viewed for, and what channels it was on.”[3] Furthermore, since May, 2015 VIZIO provided consumers’ viewing data to third parties to analyze advertising effectiveness and, starting in March, 2016, VIZIO even provided consumers’ data to third parties for targeted advertising purposes.[4]
In addition, VIZIO helped these third parties obtain demographic information about VIZIO TV viewers.[5] By providing a consumer’s IP address and a data aggregator that connects the IP address to an individual consumer or household, VIZIO allowed additional information to be appended to the viewing data, including “sex, age, income, marital status, household size, education, home ownership, and household value.”[6] Despite this mass collection of potentially sensitive information, consumers “received no onscreen notice of the collection of viewing data.”[7] Although consumers could disable the “Smart Interactivity” feature in the settings menu, neither the description in the menu nor in the manual mentioned anything about the collection of viewing data.[8] Instead, the description said the feature “[e]nables program offers and suggestions.”[9]
Since consumers had no reason to expect this data collection was happening and VIZIO did not provide sufficient notice, the FTC Complaint alleges that the activity was an unfair and deceptive act or practice,[10] in violation of Section 5(a) of the FTC Act[11] and the New Jersey Consumer Fraud Act.[12] According to the FTC Act, “Acts or practices are unfair under Section 5 of the FTC Act if they cause or are likely to cause substantial injury to consumers that consumers cannot reasonably avoid themselves and that is not outweighed by countervailing benefits to consumers or competition.”[13]
The details of VIZIO’s settlement with the FTC were released on February 6, 2017 when the United States District Court for the District of New Jersey issued its stipulated order.[14] While VIZIO “neither admit[s] nor den[ies] any of the allegations in the Complaint,” the federal court order prohibits VIZIO from further misrepresenting how they collect, use, and maintain consumer data, and requires them to (1) prominently disclose to the consumer the type of information that is collected and obtain the consumer’s prior affirmative express consent, (2) destroy viewing data collected before March, 2016, (3) establish a privacy program and obtain regular assessments by a third party for 20 years, and (4) pay fines totaling $2.2 Million – of this amount, $1.5 Million is to be paid to the FTC and $700,000 to the New Jersey Division of Consumer Affairs.[15]
The Commission voted unanimously to approve the Complaint, but a concurring statement issued by Chairman Maureen K. Ohlhausen expressed concern over the fact that this was the first time the FTC has said TV viewing activity is “sensitive information” and that sharing such information without consent is likely to cause “substantial injury.”[16] Ohlhausen explained, “[the FTC] ha[s] long defined sensitive information to include financial information, health information, Social Security Numbers, information about children, and precise geolocation information.”[17]
However, while the information at issue here is not Social Security Numbers or precise geolocation information, it is not clear that VIZIO’s data collection did not include financial information, health information, or information about children. First, the Complaint alleges that VIZIO provided third parties with a way to access information such as “income, marital status, household size, education, home ownership, and household value,”[18] which viewed in the aggregate potentially says a lot about a person’s financial information. Second, just as a short sequence of visited domain names can reveal sensitive health information,[19] so can a sequence of programming, such as consistently watching TV shows featuring stories about cancer patients or cancer treatments. Third, since VIZIO’s collection and use of data doesn’t discriminate by age, it is quite possible that VIZIO collected viewing data about children when the TV viewer was a child. Not to mention, the concern over the sensitivity of this data is heightened in VIZIO’s case because they also provided third parties with IP addresses so that they can monitor a household’s behavior across devices in order to see things like whether a consumer visited a particular website after a TV ad.[20]
With such “sensitive information” at stake, the FTC’s decision to approve the complaint and the proposed order was the right choice. By preventing companies like VIZIO from gaining revenue from the unauthorized disclosure of consumer data for advertising purposes, decisions like this one encourage companies to seek revenue through avenues with more positive externalities, such as gaining a competitive edge through better-quality TVs or bundling TVs with helpful and innovative apps. The danger in taking the alternate approach–allowing companies to usurp privacy regulation in the interest of raising revenue and leaving regulation of consumer data up to market forces–is that it would create “a transformation from a market where innovation rules to one where deal-making rules.”[21] Not only would such a market be less efficient, it would also be bad for consumers in ways that have potentially significant and yet-unknown cultural, social, and political implications.[22]
Michael Del Priore is a second-year law student at Cardozo, an editor on its Arts and Entertainment Law Journal, and a research assistant for Professor Brett M. Frischmann. Michael’s work focuses on data privacy and cybersecurity and, as president of Cardozo’s Law and Internet Club, he regularly hosts events to increase awareness of this evolving practice area.
[1] Complaint for Permanent Injunction and Other Equitable Relief, FTC v. VIZIO, Inc. and VIZIO Inscape Services, LLC, No. 2:17-cv-00758, (D. N.J. Feb. 6, 2017).
[2] Id.
[3] Id.
[4] Id.
[5] Id.
[6] Id.
[7] Complaint for Permanent Injunction and Other Equitable Relief, FTC v. VIZIO, Inc. and VIZIO Inscape Services, LLC, No. 2:17-cv-00758, (D. N.J. Feb. 6, 2017).
[8] Id.
[9] Id.
[10] Id.
[11] 15. U.S.C. §45(a).
[12] N.J. Stat. Ann. § 56:8-1 et seq.
[13] 15 U.S.C. § 45(n).
[14] IAPP, VIZIO to pay $2.2M to FTC, New Jersey for privacy violations, (Feb. 6, 2017),
https://iapp.org/news/a/vizio-to-pay-2-2m-to-ftc-new-jersey-for-privacy-violations/.
[15] Stipulated Order for Permanent Injunction and Monetary Judgment, FTC v. VIZIO, Inc. and VIZIO Inscape Services, LLC, No. 2:17-cv-00758, (D. N.J. Feb. 6, 2017).
[16] Concurring Statement of Acting Chairman Maureen K. Ohlhausen, In the Matter of VIZIO Inc., (Feb. 6, 2017), https://www.ftc.gov/system/files/documents/public_statements/1070773/vizio_concurring_statement_of_chairman_ohlhausen_2-6-17.pdf.
[17] Id.
[18] Complaint for Permanent Injunction and Other Equitable Relief, FTC v. VIZIO, Inc. and VIZIO Inscape Services, LLC, No. 2:17-cv-00758, (D. N.J. Feb. 6, 2017).
[19] For example – abortionfacts.com, plannedparenthood.org, dcabortionfund.org, maps.google.com. Aaron Rieke, David Robinson, & Harlan Yui, What ISPs Can See: Clarifying the Technical Landscape of the Broadband Privacy Debate, Upturn, (Mar. 2016), https://www.teamupturn.com/reports/2016/what-isps-can-see (Mar. 2016).
[20] Complaint for Permanent Injunction and Other Equitable Relief, FTC v. VIZIO, Inc. and VIZIO Inscape Services, LLC, No. 2:17-cv-00758, (D. N.J. Feb. 6, 2017).
[21] Tim Wu, Why You Should Care About Net Neutrality, Slate, http://www.slate.com/id/2140850/ (May 1, 2006).
[22] See generally Frank Pasquale, Beyond Innovation and Competition: The Need for Qualified Transparency in Internet Intermediaries, 104 NW. U. L. Rev. 105, 170 (2010).
