Skip to content
Naked Security Naked Security

Vizio to send class notices through the TVs that spied on viewers

Millions of smart TVs may soon be forced to admit to viewers that they spied on them, and then sold their data.

In a sign that we’re actually all living in a science fiction novel, millions of smart TVs may soon be forced to admit to viewers that they have been spying on them.
TV manufacturer Vizio is working on the feature to help satisfy a class action suit against it by disgruntled customers.
Back in 2015, investigative journalism site ProPublica revealed that Vizio’s smart TVs were just a little too smart for their own good. The TVs included a feature – switched on by default in 11 million devices – called ‘Smart Interactivity’, which tracked its customers’ viewing habits.
Vizio’s Inscape data services operation collected data including snippets of the programs that the viewers watched, along with the date, time, channel, and whether they were viewed live, or as recordings. It also gathered data on over-the-top services such as Netflix, along with data from DVDs and even streaming devices. In short, if you watched it on a Vizio TV, Vizio knew about it.
The company then linked that data to your IP address and sold the whole package to advertisers, who could then combine it with information about other devices associated with that IP address. So if, as most of us do, you connected your phone or your home computer to your home Wi-Fi network, advertisers could use your viewing data to serve you ads via those devices too.
The manufacturer, which was preening itself for an IPO at the time, argued that laws preventing cable TV companies from selling their customers’ viewing data didn’t apply to its business. In fact, it doubled down by using data brokers to append more information to its customers’ viewing data, including sex, age, income, marital status, household size, education level, home ownership, and household value. It then promoted “highly specific viewing behavior data on a massive scale with great accuracy” as a way to boost its margins for investors.
The company’s frankly anti-privacy stance got it into hot water. It was investigated by the Federal Trade Commission, which along with the New Jersey Attorney General made it agree to a $2.2m settlement in February 2017. Alongside the hefty fine, the federal court order forced the company to delete data collected before 1 March 2016, implement a privacy program, and to get explicit consent for its data slurping.


Customers also hit Vizio with a class action lawsuit. It had maintained that associating the data with an IP address didn’t make it identifiable data, but customers in California disagreed. The lawsuit – which Vizio tried and failed to quash – has now reached the preliminary settlement stage. In a court document filed 5 September, the plaintiffs and Vizio said:

The Parties are developing a class notice program with direct notification to the class through VIZIO Smart TV displays, which requires testing to make sure any TV notice can be properly displayed and functions as intended. The additional time requested will allow the parties to confirm that the notice program proposed in the motion for preliminary approval is workable and satisfies applicable legal standards.

This means that Vizio customers affected by this privacy mess – even those that were not involved in the class action lawsuit – will read about it on the same TV that spied on them in the first place. Exactly what it will say remains subject to speculation, but class action notices, which typically run in the newspapers, on TV and on radio, are a way of informing unknown affected parties that they may be entitled to compensation.
The document moves the deadline for this measure from today to 3 October while they work out the technical and legal details.
It’s a sorry end to a cautionary tale for Vizio, and a clear example of what happens when companies clumsily try to monetize IoT data. Selling the information that connected devices collect can turn paying customers into unwitting products, violating their privacy while making them pay for the privilege. It will be difficult to get that goodwill back.
Companies are still building out business models in a nascent IoT industry. If they want to have their cake and eat it by selling devices and then monetizing the customers that bought them, they’ll have to be a lot smarter about how they do it.

5 Comments

A hefty fine of $2.2 million. Why do I suspect they may have made way more money than that from selling the data? If so, they _still_ turned a profit while breaking the law.

In addition to requiring consent, they can’t just make it an OK button (with no decline option). Otherwise, they’ll just build it into the license agreement for the future.

Thanks for the great journalism as I have been questioning why certain comments, commercials, advertisements and other media related issues have hit home for me for many years and now there is actually factual information about this issue.

Comments are closed.

Subscribe to get the latest updates in your inbox.
Which categories are you interested in?
You’re now subscribed!