Vizio Reaches $2.2 Million Settlement With FTC, New Jersey, For Failing to Obtain Viewer Consent to Track and Sell Viewing Habits to Third Parties
Traditionally, advertisers purchase ad inventory during television programs based on basic demographic information regarding viewer attributes. Thus, while ads may reach viewers of a particular gender and age range, those ads may not necessarily reach the consumers that are most interested in their products or services. Thus, advertisers are increasingly interested in more finely targeting their advertising and sending a specific television commercial to a specific household based on the viewing activities in that household. In order to pinpoint their targets, marketers rely on data extending beyond demographic information that includes information on consumer viewing and internet habits. While targeting commercials to specific households can be highly beneficial to marketers (allowing them to send their ads to the consumers most interested in seeing them) and consumers (showing them the ads they most want to see), marketers must remember that the basic requirements of advertising law still apply. Thus, in collecting data, marketers must ensure that they clearly disclose their data collection practices up front, obtain consent from consumers before collecting and sharing highly specific information regarding their viewing practices, and make it easy for consumers to opt out.
On February 6, 2017, the Federal Trade Commission (“FTC”) and the State of New Jersey reached a $2.2 million settlement with VIZIO, Inc. and its wholly owned subsidiary VIZIO Inscape Services (collectively, “Vizio”) for failing to meet these standards. Vizio is a manufacturer of “smart” TV’s, which are internet connected. According to the Complaint Vizio’s proprietary automated content recognition (“ACR”) software was installed on Vizio televisions beginning in February 2014. In addition, the defendants remotely downloaded the software onto previously sold sets that did not initially have the technology installed at the time of purchase. Using the ACR software, which was turned on by default, Vizio tracked consumers’ viewing habits on a second-by-second basis and collected more than one hundred billion data points per day. The software captured information about pixels on screen that was matched against a database of publicly available television, movie and commercial content. That information was combined with viewing data from cable or broadband service providers, set top boxes, and external streaming devices. In addition, the ACR software also collected information about the television, including the IP address, WiFi signal strength and access points, MAC addresses, and other similar information. That data was transmitted to the defendants and stored indefinitely.
According to the Complaint, Vizio earned revenue from this data in three ways. First, the Defendants sold the viewing data to third parties for purposes of audience measurement. In sharing this data, the Defendants provided a persistent identifier for each television along with the content and programs viewed, when the content was viewed, for how long, and the channels that were on. Second, the Defendants provided third parties with IP addresses so that they could measure a household’s behavior across devices. Using this data, third parties could analyze whether a consumer visited a website after viewing a particular advertisement or whether a consumer viewed a television program after viewing an online ad for that program, enabling third parties to evaluate the effectiveness of their ad campaigns. Third, the Defendants provided aggregated device and viewing data to third parties for purposes of targeting advertisements to individual consumers.
For consumers who purchased Vizio televisions with ACR tracking preinstalled, no onscreen notice of this data collection was provided. For televisions updated with the ACR software, consumers were provided with a pop up notification stating “The VIZIO Privacy Policy has changed. Smart Interactivity has been enabled on your TV, but you may disable it in the settings menu. See www.vizio.com/privacy for more details. This message will time out in 1 minute.” However, the FTC alleged that this notice was inadequate because it failed to inform the consumer that viewing data would be collected, the ACR software had been installed, and also did not directly link to the settings menu or privacy policy.
The complaint alleged that Vizio violated Section 5 of the FTC Act and engaged in unconscionable activities under NJ consumer protection law: (1) Vizio engaged in “unfair tracking” that consumers did not reasonably anticipate and could not therefore avoid; (2) Vizio deceptively omitted disclosure to consumers of its viewing tracking practices , and (3) Vizio falsely and deceptively represented to consumers, expressly or by implication, that the Defendants would provide offers and suggestions with “Smart Interactivity” enabled on their televisions, which they never did.
To settle the charges, Vizio agreed to pay civil penalties totaling $2.2 million and to stop unauthorized tracking. In addition, Vizio agreed to prominently disclose its data collection practices and obtain consumers’ express consent before collecting and sharing information about consumers’ viewing habits. Finally, Vizio agreed to delete most of the data that it has collected and implement a privacy program to evaluate its practices.
Acting Chairman Maureen Ohlhausen issued a concurring statement, stating that while she agrees with the FTC staff that consumers do not expect televisions to collect and share information regarding their viewing activities, she urged further consideration of the FTC’s allegation that sensitive information includes individualized television viewing activities. Noting that “[t]here may be good policy reasons to find such information sensitive . . . under our statute, we cannot find a practice unfair based primarily on public policy. Instead we must determine whether the practice causes substantial injury that is not reasonably avoidable by the consumer and is not outweighed by benefits to competition or consumers.” Thus, the Acting Chairman intends to “examine more rigorously what constitutes ‘substantial injury’ in the context of information about consumer” in the coming weeks.
Lessons Learned
This case is an important reminder for advertisers interested in addressable advertising. Advertisers should adhere to the following best practices.
- Prominently disclose your data collection practices up front – separate and apart from your privacy policy or terms of use. Make sure consumers understand what data you are collecting and what you will be doing with that data (what will be shared, with whom, and the purpose of sharing).
- Obtain affirmative express consent from consumers before collecting and granular data regarding household or individual television viewing activity with third parties.
- If you make any material changes to your collection practices, you must obtain affirmative express consent to those changes.
- Offer consumer choices regarding data collection and make it easy for them to exercise those choices.