The FTC and the State of New Jersey recently announced a settlement with Vizio, Inc., in the amount of $2.2 million for tracking consumer behavior using its smart television devices.

The complaint alleged that Vizio acted unfairly by collecting, storing (indefinitely) and sharing consumer data with third parties without consent and in an unexpected manner. Further, the complaint alleged that Vizio had misrepresented the functionality of the feature in their smart televisions that collected such data (also known as “Smart Interactivity”). It was also alleged that these practices were an unconscionable commercial practice in violation of the New Jersey Consumer Fraud Act (N.J. Stat. Ann. § 56:8-2).

To elaborate further, the “Smart Interactivity” feature contained automated content recognition software. In other words, the software would continuously collect a selection of pixels on a consumer’s screen and match them against a database to identify the content being watched. The televisions were also uniquely identifiable with a persistent identifier. Through these uniquely identified televisions, Vizio also collected and shared other data elements like IP addresses, MAC addresses, WiFi signal strength and access points. In addition, the company supplemented such viewing data with demographic information such as sex, age, marital status, household size, education level, home ownership, and household value. Consumers were not informed that the television was collecting such data or that Vizio was sharing this data with third parties.

The stipulated federal court order required Vizio to refrain from making misleading representations with respect to the extent to which Vizio collects, uses, maintains, or protects the privacy, confidentiality, or security of personal information and the purposes of such collection or use. The order requires Vizio to obtain affirmative express consent before collecting “Viewing Data” (data about the content viewed on television, or any reports or data derived from it and any information combined with such data) going forward. Before collecting such data, Vizio is required to:

1. Prominently disclose (separate and apart from any “privacy policy,” “terms of use” page, or other similar document)
   i. the types of Viewing Data that will be collected and used;
   ii. the types of Viewing Data that will be shared with third parties;
   iii. the identity or specific categories of such third parties; and
   iv. all purposes for Vizio’s sharing of such information;
2. Obtain the consumer’s affirmative express consent when disclosure above is made and upon any material changes to the terms disclosed then.
3. At any time when affirmative express consent is sought, provide instructions on how to revoke consent.

The order defines “prominent disclosure” as requiring, inter alia:

1. An audible disclosure, including by telephone or streaming video, must be delivered in a volume, speed, and cadence sufficient for ordinary consumers to easily hear and understand it.
2. In any communication using an interactive electronic medium, the disclosure must be unavoidable (for context, the complaint referred to how Vizio’s disclosures would disappear within a minute or lesser and required no further interaction from the viewer).
3. The disclosure must use diction and syntax understandable to ordinary consumers and must appear in each language in which the triggering representation appears.
4. The disclosure must comply with these requirements in each medium through which it is received, including all electronic devices and face-to-face communications.

The order requires Vizio to destroy existing Viewing Data; introduce a mandated privacy program; obtain initial and biennial assessments of compliance with the order; submit compliance reports; and maintain records for twenty years after the order. The order also permits the FTC and the New Jersey State AG to monitor the company.

The Acting Chair of the FTC, Maureen K. Ohlhausen, in her concurring statement, highlighted how the FTC had alleged in the complaint that granular household or individual television viewing activity is sensitive information. This appears to be the first time that the FTC has expressly included such data within the definition of “sensitive information”. Chairwoman Ohlhausen further noted that a finding of unfairness requires the FTC to determine whether the practice causes substantial injury that is not reasonably avoidable by the consumer and is not outweighed by benefits to competition or consumers. To that end, she observed that the FTC needed to examine what constitutes “substantial injury” in the context of information about consumers. She indicated that she intends to launch an effort to examine this further. Such a study could also potentially inform the larger debate on standing in privacy law suits and should be of particular note to companies marketing now-ubiquitous smart devices.

[View source.]