Vizio to pay $2.2m for invasive tracking of users and selling their data

A settlement with the US Federal Trade Commission (FTC) and the Office of the New Jersey Attorney General will cost Vizio $2.2 million, the FTC announced on Monday. The sum will settle charges with both the federal and state agencies after complaints were made of the company engaging in invasive data collection activities from February 2014.

The agencies alleged that Vizio had pre-installed tracking software on its TVs to collect "second-by-second" viewing data on 11 million TVs without consumers' knowledge or consent.

It was also alleged that Vizio sent a software update to the TVs sold in the previous four years to add the tracking software. The update prompted a pop-up message on the TVs that merely stated that Vizio's privacy policy had changed and presented a URL with more information.

In the smart TV's settings menu, the tracking feature was referred to as "smart interactivity", with a description merely indicating that it "enables program offerings and suggestions". No disclosures were added in the description about the feature enabling the collection of consumers' viewing data.

"This notification provided no information about the collection of viewing data or ACR software. Nor did it directly link to the settings menu or privacy policy," the FTC stated in its complaint [PDF].

"Defendants have not provided any 'program offers or suggestions' or 'program-related information' for most televisions for more than two years, and did not update the disclosures."

In addition to tracking viewing activity, the federal and state agencies have alleged that Vizio sold demographic information to third parties. Such information includes sex, age, income, marital status, household size, education level, home ownership, and household value.

FTC acting chairman Maureen Ohlhausen issued a concurring statement [PDF] addressing the aspect of the FTC's complaint [PDF] that objected to how Vizio had allegedly used software to unfairly and deceptively track the "sensitive television viewing activity" across video from consumer cable, broadband, set-top box, DVD, over-the-air broadcasts, and streaming devices.

"We have long defined sensitive information to include financial information, health information, social security numbers, information about children, and precise geolocation information. We have also recommended that companies get opt-in consent before collecting and sharing the content of consumers' communications," Ohlhausen said in the statement.

"But here, for the first time, the FTC has alleged in a complaint that individualized television viewing activity falls within the definition of sensitive information."

Of the sum to be paid by Vizio, $1.5 million will go the FTC, while $700,000 will go to the New Jersey Division of Consumer Affairs after $300,000 was suspended.

In addition to the monetary settlement, a federal court order requires Vizio to disclose its data collection and sharing practices and get explicit consent from customers before doing so. The order also prohibits Vizio from misrepresenting the privacy, security, or confidentiality of consumer information it collects.

As part of the settlement, the company is required to delete data collected before March 1, 2016 and implement a comprehensive data privacy program and biennial assessments of its program.

Vizio said in a statement that it's "pleased" to reach a settlement.

"Going forward, this resolution sets a new standard for best industry privacy practices for the collection and analysis of data collected from today's internet-connected televisions and other home devices," Jerry Huang, Vizio general counsel, said in the statement.

"The ACR program never paired viewing data with personally identifiable information such as name or contact information, and the commission did not allege or contend otherwise. Instead, as the complaint notes, the practices challenged by the government related only to the use of viewing data in the 'aggregate' to create summary reports measuring viewing audiences or behaviors."

Vizio is not the only smart TV manufacturer to come under fire for tracking the viewing habits of its customers. Samsung and LG have also had similar default settings that enable data collection.

In 2015, it was revealed that some Samsung smart TV models can "capture voice commands and associated texts" so that it can provide viewers with "voice recognition features and evaluate and improve the features".

Samsung's privacy policy framed the collection of sensitive information as an implicit activity dependent on the actions of the consumer.

"Please be aware that if your spoken words include personal or other sensitive information, that information will be among the data captured and transmitted to a third party through your use of voice recognition," the privacy policy stated.

In 2013, it was found that the LG Smart TV had been tracking viewing habits of users, which were sent back to the manufacturer.

The TVs had a "smart ad" feature which LG claimed was there to analyse user behavior to help direct advertisements to more interested customers. However, the opt-out setting hadn't worked, a UK user found after investigating the matter.