From Televisions to Telescreens: Video Viewing Habits Are Sensitive Information
Our living room television sets may not yet be an Orwellian “telescreen,” but it has become a rich source of information for marketers, political campaigns, and others eager to correlate TV viewing habits with real-world and online activities.
Last week, TV-maker Vizio found itself on the receiving end of a multimillion dollar settlement with the Federal Trade Commission (FTC) and the state of New Jersey for tracking user viewing behaviors in ways that were deceptive and unfair. The settlement exposed just how sophisticated the tracking practices deployed by smart televisions can be, and, more importantly, it offers an example of how seemingly innocuous data can be combined to create very sensitive information.
IP Addresses and Data Appending: The Whole Is Greater than the Sum of Its Parts
According to the FTC, Vizio developed an automated content recognition system that captured a selection of pixels on a user’s TV screen. Those pixels were then matched to a database of known TV, movie, and commercial content. It also collected second-by-second viewing data from cable providers, streaming services, and over-the-air broadcasts. In other words, whenever a user’s smart television was turned on, Vizio was watching.
Vizio was quick to claim that it “never paired viewing data with personally identifiable information such as name or contact information,” but this was at the same time as it touted a data analytics program that could provide “highly specific viewing behavior data” to third-party advertisers. Instead of passing off names, the company provided users’ IP addresses to third-party data brokers than then matched those addresses to individual consumers and households. While contracts prohibited these data brokers from “re-identifying” a given individual by name, all kinds of other information was allowed to be attached, or appended, to an individual’s IP address. Information such as a viewer’s gender, age, income, marital status, household size, education, homeownership, and household value.
This sort of data appending presents two key issues. First, Vizio’s suggestion that the information is collected and combined was not personally identifying is problematic. As the World Privacy Forum explains, a whole host of information now make up “the lynchpin of our identity,” such as technical identifiers to our biometrics.
And it’s not just about being identified. As we have seen in other contexts around advertising for employment or housing opportunities, an individual can be treated unfairly and discriminated against without a company having access to the person’s name or other common identifying information. Second, even as Vizio promised highly specific viewer profiles, the average television viewer would have no way of knowing whether the detailed viewer mosaics pieced together by Vizio and its partners were accurate or not.
What should be very disconcerting for consumers is that all of this was done by default. Consumers were not given a chance to consent, and information about these practices were poorly communicated to television viewers. They could review Vizio’s lengthy privacy policy to learn about how they were being tracked or chance upon their television’s presentation of a brief pop-up notification.
The settlement addresses some of this opacity. Now Vizio will be required to obtain a viewer’s opt-in consent and – this is key – provide “prominent” and “easily understandable” notices outside of a lengthy privacy policy or terms of service. FTC consent orders on data privacy generally include provisions around maintaining a privacy program and ceasing whatever deceptive statements triggered the FTC’s attention, but these rarely force companies to go above and beyond what they were already doing. Though this settlement may not lead to comprehensive reform for tracking user viewing, we can hope that other device manufacturers take the FTC’s suggestion to heart that consumers not be offered choices that are hard to find or hidden behind “plain-vanilla descriptors.”
Sensitivities Are Evolving and Users Must Not Be Left Behind
The FTC has generally taken the position that opt-in consent is only necessary for collecting and using a few select categories of sensitive information. This leads to the second big takeaway from this privacy enforcement effort.
Though the FTC argued that Vizio’s explanations and disclosures were deceptive to consumers, it also suggested that Vizio’s tracking activities were unfair under Section 5 of the FTC Act (and unconscionable under New Jersey state law). This claim rests on the FTC’s determination that the highly specific, second-by-second data collected via Vizio’s technology falls into the world of sensitive information. As Acting Chairman Ohlhausen noted, this is the first time the FTC has suggested individualized television viewing activity might be similarly sensitive to consumers. The Acting Chairman appeared skeptical that Vizio’s collection and use of this information was ultimately unfair to consumers, but conceded that “there may be good policy reasons to consider such information sensitive.” She’s right.
Both the Cable Privacy Act and the Video Privacy Protection Act reflect longstanding concerns by Congress about sharing video viewing behaviors without consent. These laws recognize that video viewing habits can reveal all manner of private details about our lives and identities. The Federal Communications Commission (FCC) recognized a similar concern when it defined web browsing and application usage history as sensitive information in its 2016 broadband privacy rule. Like television viewing data, web browsing history conveys the content users are viewing, which can reveal sensitive personal details such as health conditions, sexual orientation, and religious and political affiliations.
As CDT and other privacy advocates have explained, the sensitivity of personal information can be highly contextual. The FCC’s broadband privacy rule emphasized that one of the reasons that browsing history must be considered sensitive was due to the role that broadband providers play as gatekeepers to the internet. Vizio’s comprehensive window into its users’ viewing data place it in a similar situation: as a conduit through which users watch television, the company has access to everything its customers watch.
Users deserve to be kept in the loop about the widespread tracking and sharing of their television viewing habits, and given some control over it. The irony now is that Vizio finds itself in the position of being more transparent and forthright about its data collection practices than many of its competitors. Companies in the smart television ecosystem should take note: the FTC and your customers are paying attention.
