Vizio Privacy Case Points Up Need to Better Probe ‘Substantial Injury,’ FTC Says

With the Vizio case, the agency for the first time “has alleged in a complaint that individualized television viewing activity falls within the definition of sensitive information,” Ohlhausen said Monday of the action filed in U.S. District Court in Newark, New Jersey. “There may be good policy reasons to consider such information sensitive.”

But under FTC rules, “we cannot find a practice unfair based primarily on public policy,” Ohlhausen said. “Instead, we must determine whether the practice causes substantial injury that is not reasonably avoidable by the consumer and is not outweighed by benefits to competition or consumers.” The Vizio case “demonstrates the need for the FTC to examine more rigorously what constitutes ‘substantial injury’ in the context of information about consumers,” she said. “In the coming weeks I will launch an effort to examine this important issue further.”

Using the Inscape feature, Vizio “collected a selection of pixels on the screen that it matched to a database of TV, movie, and commercial content,” said Senior FTC Attorney Lesley Fair in a Monday blog post. “Add it all up and Vizio captured as many as 100 billion data points each day from millions of TVs. Vizio then turned that mountain of data into cash by selling consumers' viewing histories to advertisers and others.” The company didn’t just sell “summary information about national viewing trends,” she said. It also “got personal,” she said. Though Vizio didn't sell actual names or contact information to third parties, “the company provided consumers' IP addresses to data aggregators, who then matched the address with an individual consumer or household,” allowing third parties access to details such as gender, age, income, marital status and home ownership, she said: “That's what Vizio was up to behind the screen, but what was the company telling consumers? Not much, according to the complaint.”

Under the settlement agreement, Vizio neither admits nor denies the allegations, said a stipulated order filed Monday with the complaint. Going forward, the firm agrees to “prominently disclose” to consumers the types of viewing data it will collect and use or share with third parties, including the identity of those third parties, said the order. It defined “prominently” as any required disclosure that is “difficult to miss” and is “easily understandable by ordinary consumers.”

The order gives Vizio four months to destroy any viewer-tracking data it collected before March 1, 2016. The order also requires Vizio immediately to install a “mandated privacy program” that will be monitored “by a qualified, objective, independent third-party professional, who uses procedures and standards generally accepted in the profession.” The third-party professional must file “assessments” with the FTC first within six months, and then every two years for the next 20 years, the order said.

The settlement “sets a new standard for best industry privacy practices for the collection and analysis of data collected from today's internet-connected televisions and other home devices," Vizio said Monday in a statement. Inscape “never paired viewing data with personally identifiable information such as name or contact information,” and the FTC “did not allege or contend otherwise,” it said. The FTC has made clear “that all smart TV makers should get people's consent before collecting and sharing television viewing information,” and Vizio “now is leading the way," the company said. Last summer, it said it thought the class-action complaints against the Inscape viewer-tracking feature had “no merit” (see 1607260066).