Last month, the U.S. District Court of New Jersey approved a settlement between the Federal Trade Commission, the New Jersey Attorney General, and VIZIO, Inc. The settlement arose from a complaint brought by the FTC and the New Jersey Attorney General that alleged VIZIO had engaged in unfair and deceptive practices by collecting and using consumers’ television viewing data from Internet-connected VIZIO televisions without appropriate disclosure or consumer consent. The complaint, the stipulated settlement order, and an FTC blog post relating to the settlement provide several important takeaways for privacy and data security practitioners.
The Expansion of “Sensitive Data” to Include Television-Viewing Activity
The complaint alleged that television-viewing activity is considered “sensitive data” whose collection can form the basis of an unfair practices claim. This is the first indication from the FTC that television-viewing activity is “sensitive data.”
This new development is not unprecedented, nor is it particularly surprising. The complaint relied on the Cable Privacy Act’s prohibition on cable companies disclosing television-viewing data to claim that consumers expect viewing data to be private. The FTC also indicated its concerns about television tracking in a presentation it made at an event held about two months prior to filing the complaint.
The “sensitive data” interpretation advanced in the complaint may change in the future. Commissioner Ohlhausen, the acting chair of the FTC, took issue with the rationale underlying this conclusion in a concurring statement. Commissioner Ohlhausen acknowledged that public policy indicates that television-viewing activity is “sensitive data” but stated that the FTC “cannot find a practice unfair based primarily on public policy.”
Indications of Heightened Standards for New Technology Privacy Disclosures
The complaint, stipulated order, and FTC blog post indicate that the FTC will closely scrutinize privacy disclosures relating to new technologies. They further indicate that a privacy policy, standing alone, is not likely to be considered sufficient in this regard.
The complaint criticized the lack of onscreen notifications about the tracking and collection of television-viewing data. Prior to the FTC and New Jersey Attorney General investigation, purchasers of VIZIO televisions received no on-screen notification of tracking activities.
The stipulated order requires VIZIO’s disclosures to be “difficult to miss” and “easily understandable by ordinary consumers.” Those disclosures must describe the types of data collected, what data will be shared, with whom the data will be shared, and the purposes for which the data is shared. The order also expressly provides that a privacy policy alone is not adequate to make those disclosures.
Another notable aspect of the stipulated order is the requirement to obtain “the consumer’s affirmative express consent” to the collection of television-viewing data. That requirement is consistent with the FTC’s blog post statement that best practice is obtaining opt-in consent for tracking consumer entertainment preferences.
Purveyors of new technologies should carefully review the effectiveness of their disclosures to avoid regulatory investigation and enforcement actions. The development of new technologies and additional consumer behavioral tracking is clearly of interest to regulators. The VIZIO case demonstrates an expansion of scope of unfair practice claims and heightened standards for new technology privacy disclosures.