Podcast #778: Is Your TV Spying on You?

Is Your TV Spying on You? Much has been made about a recent complaint filed by the FTC and the New Jersey Attorney General alleging that while you've been watching TV on your Internet connected Vizio HDTV, unbeknownst to you, it has been watching you back. As Ara and Braden are both owners of Internet connected Vizio televisions, they are both victims of this snooping. But what did Vizio actually do? Is it a terrible invasion, or not really that big of a deal? Are other manufacturers doing the same thing? Let's dive in and find out. The Complaint According to ftc.gov (the below is a direct quote from their website): "VIZIO, Inc., one of the world's largest manufacturers and sellers of internet-connected "smart" televisions, has agreed to pay $2.2 million to settle charges by the Federal Trade Commission and the Office of the New Jersey Attorney General that it installed software on its TVs to collect viewing data on 11 million consumer TVs without consumers' knowledge or consent. The stipulated federal court order requires VIZIO to prominently disclose and obtain affirmative express consent for its data collection and sharing practices, and prohibits misrepresentations about the privacy, security, or confidentiality of consumer information they collect. It also requires the company to delete data collected before March 1, 2016, and to implement a comprehensive data privacy program and biennial assessments of that program. According to the agencies' complaint, starting in February 2014, VIZIO, Inc. and an affiliated company have manufactured VIZIO smart TVs that capture second-by-second information about video displayed on the smart TV, including video from consumer cable, broadband, set-top box, DVD, over-the-air broadcasts, and streaming devices. In addition, VIZIO facilitated appending specific demographic information to the viewing data, such as sex, age, income, marital status, household size, education level, home ownership, and household value, the agencies allege. VIZIO sold this information to third parties, who used it for various purposes, including targeting advertising to consumers across devices, according to the complaint. According to the complaint, VIZIO touted its "Smart Interactivity" feature that "enables program offers and suggestions" but failed to inform consumers that the settings also enabled the collection of consumers' viewing data. The complaint alleges that VIZIO's data tracking—which occurred without viewers' informed consent—was unfair and deceptive, in violation of the FTC Act and New Jersey consumer protection laws. The $2.2 million payment by VIZIO includes a payment of $1.5 million to the FTC and $1 million to the New Jersey Division of Consumer Affairs, with $300,000 of that amount suspended." Our Take When we first heard the news, we thought it was dire. There are, or have been, Vizio TVs with built-in support for video chat apps like Skype, so they have cameras built into them as well.  We thought that perhaps Vizio was using the camera to actually spy on you in your home. That might even be what you thought as well if you read the title of this segment without listening to the show or reading the text. But that isn't the case. That's just a sensationalized headline to attract attention. Yes we're guilty of that. Sorry. Ok, not Sorry. It turns out that Vizio wanted to suggest content for you to watch based on other things that you have chosen to watch yourself.  Seems harmless enough right?  Well, your HDTV doesn't actually know about everything that could possibly be suggested, or the relationships between different shows so it could make the recommendations on its own. To know that, it had to tell Vizio servers in the cloud what you were watching, so the servers could make the relationships and let the TV know what it should suggest for you. On a pure technical level, it sounds quite reasonable and we totally understand why Vizio would do something like that. But from a privacy level, it is super, super creepy.  Watching the news? OK cool, no problem. Vizio knows. Who cares? Watching some adult oriented content? Vizio knows that too. They know what you're into. Staying home all day to watch Anime when you should be at work? Yup, Vizio knows that as well. They were tracking everything. But that's not the worst part. If the data was anonymized and scrubbed after it was used, that would be one thing. Creepy sure, but not terrible. But they went a step further. In addition to tracking your viewing habits, they also had data on your sex, age, income, marital status, household size, education level, home ownership, and household value. How did they get that data? Because they had your IP address. They knew who you were. Oh, but wait, it gets worse. Not only were they tracking all this info, viewing habits and demographic data, but they were then turning around and selling this information to other third parties. And of course they would. It's valuable data. What are the viewing habits of millennials? Older dudes like the HT guys?  Young kids in grade school?  Valuable information. But who were the giving all your info to? You don't know. And they certainly didn't ask you before selling it off. Vizio's contracts with third parties prohibited the re-identification of consumers and households by name, but that wouldn't be a difficult relationship for anyone to make. Warning, this is where we put on our black helicopter, conspiracy theory hats and go a little crazy. But think about who could be consuming this information? What if you work for a large corporation with deep enough pockets to buy the data just because they wanted it. And that corporation wanted to know what you're watching at home on the TV. Or what if someone was trying to sue you or otherwise put a legal action against you and they wanted to know what you were watching. Or someone wanted to blackmail you for some reason. Or social engineer you to steal secrets or information. They just pay Vizio enough and they can immediately find out what you're into. Had Vizio simply used the information in an anonymous way to make show recommendations, and scrubbed the data when they no longer needed it, that would be one thing. And probably a minor thing - a non-event to be honest. But you tack on the demographic data, and the fact they were selling it to unknown entities (unknown to you the viewer at least) and that gets super creepy. We aren't accusing Vizio of being malicious or doing anything nefarious, but what they did and how they did it was a clear violation of their customers' privacy and trust. It was wrong. The funny thing is that the premise behind taking the data in the first place, the promise of content offers and suggestions, never worked. The suggestions never materialized. So the question is, if the so-called "Smart Interactivity" feature that needed the data never even provided the promised program offers and suggestions, was it ever even planned to, or was Vizio simply using that as cover to mine all of this juicy data from your HDTV?  Were they trying to get the suggestions to work and just never got it right, or did they just want the data, so they made up a bogus feature to give them an excuse to take it? Unfortunately for Vizio, they got caught. But looking at what they were doing, we wouldn't be surprised if a lot of other smart TVs, smart set top boxes or streaming players, and DVRs were doing the exact same thing. Hopefully they'll see this case and clean things up voluntarily before they get caught too. But if not, hopefully the FTC will dig a little deeper to see what each of those devices is tracking about you, and what they're doing with that information.