On Monday, February 6, 2017, the Federal Trade Commission (“FTC”) and New Jersey Attorney General (“NJAG”) announced a settlement agreement to resolve their joint enforcement action against Vizio. The regulators claimed that Vizio collected detailed information about the content consumers watched (including identifying the content and advertisements viewed through broadcast and cable networks, DVDs, and over-the-top streaming devices), enhanced the viewing information with device identifiers (e.g., IP addresses and MAC addresses) and demographic data (including gender, age, income, household size, and marital status), and disclosed this information to third parties for their own uses, including targeted advertising.
Extension of General Consumer Protection Laws to Video Privacy
The regulators brought these claims under the FTC Act and New Jersey Consumer Fraud Act (“NJ CFA”), indicating that they interpret these statutes to overlap with the Video Privacy Protection Act (“VPPA”). However, it should be noted that the complaint acknowledges that Vizio took steps to prevent disclosure of traditional personal identifiers (e.g., names and addresses). While the federal courts have yet to clearly resolve whether device identifiers are personally identifiable under VPPA, the regulators assume that disclosure of viewing information and device identifiers is subject to the FTC Act and NJ CFA.
Insufficient Notice to Consumers
The complaint also notes that the description of the Smart Interactivity feature within the television settings menu did not clearly explain the information collection and disclosure practices. The settings menu simply described Smart Interactivity as “Enables program offers and suggestions.” Moreover, the television manual described Smart Interactivity as “Your TV can display program-related information as part of the broadcast.” This description does not provide clear notice that detailed viewing information would be shared with third parties.
Settlement Requirements Affirmative Consent
The settlement agreement imposes a number of conduct obligations (e.g., implementation of a comprehensive privacy program, appointment of a privacy officer, and periodic third party privacy assessments) and $2.2 million in monetary penalties. In addition, the settlement agreement requires Vizio to obtain affirmative consent from consumers after providing notice that:
- describes the types of data that will be collected;
- describes the types of data that will be disclosed to third parties;
- lists the identities or categories of the third parties to which the data may be disclosed;
- explains the purposes for which data may be disclosed to third parties; and
- provides instructions on how to revoke consent later.