Smart TV Makers Will Soon Make More Money Off Your Viewing Habits Than The TV Itself

from the what-could-possibly-go-wrong dept

"Smart" televisions have long been the poster child for the abysmal privacy and security standards inherent in the "internet of things" space. Such televisions have been routinely found to have the security and privacy standards of damp cardboard, making the data they collect delicious targets for hackers and intelligence agencies alike.

At the same time these companies have failed repeatedly to secure (or sometimes even encrypt) consumer data, their data collection revenue is positively exploding. Vizio, for example, recently noted that it made $38.4 million in one quarter just from tracking and monetizing consumer viewing and usage data. It made $48.2 million on hardware (both TVs, soundbars, and other products) in that same period, and that gap (if not already closed) is quickly closing:

"Its device business (the part that sells TVs, sound bars and the like) had a gross profit of $48.2 million in the same period, up from $32.5 million last year. While the hardware business has significantly more revenue, profits from data and advertising spiked 152 percent from last year, and are quickly catching up."

The problem researchers keep pointing out is not enough of that revenue is being put back into device security research and privacy standards, which is why Vizio, like most "smart" TV manufacturers, has been repeatedly caught in privacy scandals. Like that time it had to shell out $2.2 million to the FTC and NJ AG for failing to inform consumers this data was even being collected. By the time consumers got their share of that settlement, it wound up being about $20 per person. And it's not really clear anything would have happened at all if not for a 2015 ProPublica investigation into Vizio's lack of transparency.

The problem of course is that regulators, when they do bother to act, act half a decade after the fact, and only if a journalist exposes the problem first. Consumers then get a tiny pittance. And it shouldn't be too hard to understand how a $2.2 million fine -- for a company pulling down $38.4 million every three months off of consumer data alone -- probably isn't going to be an effective deterrent against future privacy abuses. It's viewed as just a light gnat on the nose and the cost of doing business.

Consumers do have a bit of control. They can disable a set's WiFi features entirely, even though in many instances doing so can disable core set functionality in obnoxious and unforeseen ways. Ideally I'd love to be able to buy a "dumb" TV that's just a great display with HDMI ports and no "smart" internals, but because consumer data is now so profitable, most TV vendors no longer even sell such an option.

It's also worth remembering that your smart TV is just one in a long line of systems collecting and monetizing your data, including the streaming hardware you're using (Roku, etc.), your ISP, any additional internet of things devices you've connected to your network, and even your energy company. While folks intent on downplaying modern privacy abuses often like to pretend this is the age of consumer empowerment, it's not really possible for consumers to "opt out" of data collection and monetization at the scale it's now occurring. Even with a lot of elbow grease, technical innovation, and external help.

Organizations like Consumer Reports have been pushing hard for improved efforts to warn consumers about potential privacy abuses at the point of sale, including them in product reviews and even on product packaging. And while their "open source" efforts on this front are really interesting, we're a long way away from this kind of transparency being the norm.

Filed Under: data, privacy, smart tvs
Companies: vizio

Vizio Admits Modern TV Sets Are Cheaper Because They're Spying On You

from the watching-you-watching-me dept

If you've shopped for a TV recently, you may have noticed that it's largely impossible to just buy a "dumb" TV set without all of the "smart" internals. More specifically, most TV vendors don't want to sell you a bare-bones set because they want you to use their streaming services. Even more specifically, they want you to buy their sets with their specific streaming functionality because they want to spy on you. Poorly.

That's always been fairly obvious to most folks, but it was nice to see Vizio CTO Bill Baxter acknowledge that the reason you pay a discount is because your viewing habits are being collected and sold to the highest bidder:

"Q. One sort of Verge-nerd meme that I hear in our comments or on Twitter is “I just want a dumb TV. I just want a panel with no smarts and I’ll figure it out on my own.” But it sounds like that lifetime monetization problem would prevent you from just making a dumb panel that you can sell to somebody.

A. Well, it wouldn’t prevent us, to be honest with you. What it would do is, we’d collect a little bit more margin at retail to offset it. Again, it may be an aspirational goal to not have high margins on our TV business because I can make it up downstream. On the other hand, I’m actually aggregating that monetization across a large number of users, some of which opt out.

It’s a blended revenue model where, in the end, Vizio succeeds, but you know, it’s not wholly dependent on things like data collection.

The problem is that this trade off isn't really providing value to the end user, in large part thanks to the TV sector's terrible security and privacy practices. For one, navigating the TV sector's historically terrible GUIs to actually find and opt out of this data collection is often a nightmare. Usually opting out is first intentionally named something nebulous, then buried deep in a sea of terribly-designed menus. And even then, opting out can often result in you losing access to some core set features you might actually use. That's only a good deal if you enjoy annoyance.

Then there's the fact that the TV sector routinely does an absolutely terrible job at the security and privacy practices needed to protect this data. We've seen vendors like Samsung get busted hoovering up and collecting living room conversations, then shoveling this data off to a nebulous assortment of third-party clients. Numerous set vendors have similarly been busted collecting this data then transmitting it to the cloud without adequate encryption. Vizio itself just struck a $2.2 million settlement with the FTC for secretly tracking and selling the usage habits of around sixteen million Vizio owners for around three years.

So yes you're maybe paying a bit less up front for a cheaper set, but you're paying for the deal out the other side of the equation in a way that's not even entirely calculable. Even then, higher-end TV set vendors do this same thing, kind of deflating the claim that this is only being done by necessity among lower-end vendors trapped by tight margins. In reality, the same disregard for privacy and security that has infected the internet of broken things space is on proud display in the TV business, resulting in hardware that's easily exploitable by everyone from run of the mill hackers to intelligence services. Is that a bargain, really?

With so many streaming hardware platforms to choose from (game consoles, your phone, home-built PCs, Roku, Apple TV, etc.), many users just want a dumb TV with ample HDMI ports that simply does one job, really well. Instead, like so many sectors (telecom comes quickly to mind) the priority appears to be focused on treating user data like a harvestable resource, with security, privacy, and transparency a very distant afterthought.

Filed Under: bill baxter, data, privacy, smart tvs
Companies: vizio

Vizio Customers Get A Pittance In Settlement Over Snooping Televisions

from the watching-you,-watching-me dept

As we frequently note, most of the "smart" products you buy are anything but intelligent when it comes to your privacy and security. Whether it's your refrigerator leaking your gmail credentials or your new webcam being hacked in mere minutes for use in massive new DDoS attacks, the so-called "smart" home is actually often dumb as nails and potentially hazardous. So-called smart-televisions have been particularly problematic, whether that has involved companies failing to encrypt sensitive data, or removing features if you refuse to have your daily viewing habits measured and monetized.

Last year Vizio joined this not-so-distinguished club when it was discovered that the company's TVs had been spying on users for the last several years, starting back in 2014. Vizio's $2.2 million settlement with the FTC indicates that the company at no time thought it might be a good idea to inform customers this was happening. The snooping was part of a supposed "Smart Interactivity" feature deployed in 2014 that claimed to provide users with programming recommendations, but never actually did so. Its sole purpose was to hoover up your data and help Vizio sell it, without your express consent.

Vizio was also hit with a class action lawsuit over its actions, and the finishing touches on a settlement are just getting hashed out now. Lawyers representing consumers in the case state Vizio secretly tracked and sold the usage habits of around sixteen million Vizio owners for around three years. They're demanding a settlement of $17 million and a promise from Vizio that this won't ever happen again:

"Under the terms of the proposed settlement, Vizio will establish a $17 million settlement fund that will deliver money directly to consumers who bought Vizio Smart TVs that were subsequently connected to the Internet between February 1, 2014 and February 6, 2017. Vizio has also stopped tracking what is displayed on its Smart TVs unless a consumer consents to this tracking after receiving a prominent notification. And Vizio will delete the remaining contested viewing data in its possession."

What this actually means for consumers is a bit less impressive. Ars Technica took a closer look at the court filings in the case and found that consumers are likely to get all of somewhere between $13 and $31 for the inconvenience of being spied on without their permission. Lawyers will, unsurprisingly, get significantly more:

"When it’s all said and done, new court filings submitted on Thursday say each of those 16 million people will get a payout of somewhere between $13 and $31. By contrast, their lawyers will collectively earn a maximum payout of $5.6 million in fees."

On the plus side, insiders tell Ars Technica that the $17 million being doled out is more than Vizio made from selling this data, which usually isn't the case in other similar failures of trust (especially by cellular carriers, who'll often be fined millions for privacy violations that potentially netted them billions). And while Vizio's promises are good and all, many argue we need stronger public deterrents for companies that fail to respect user privacy, starting first and foremost with efforts to include privacy and security oversights in product reviews.

Filed Under: class action, privacy, smart tv, surveillance
Companies: vizio

Vizio Fails To Dodge Class Action Over Its Spying 'Smart' Televisions

from the watching-you-watching-me dept

So if you hadn't been paying attention, most of the "smart" products you buy are anything but intelligent when it comes to your privacy and security. Whether it's your refrigerator leaking your gmail credentials or your new webcam being hacked in minutes for use in massive new DDoS attacks, the so-called "smart" home is actually quite idiotic. So-called smart-televisions have been particularly problematic, whether that has involved companies failing to encrypt sensitive data, to removing features if you refuse to have your daily viewing habits measured and monetized.

Last month Vizio joined this not-so-distinguished club when it was discovered that the company's TVs had been spying on users for the last several years. Vizio's $2.2 million settlement with the FTC indicates that the company at no time thought it might be a good idea to inform customers this was happening. The snooping was part of a supposed "Smart Interactivity" feature deployed in 2014 that claimed to provide users with programming recommendations, but never actually did so. In short, it wasn't so much what Vizio was doing, it was the fact the company tried to bullshit its way around it.

And while Vizio may have settled the FTC investigation into its snooping televisions, the company now faces an additional class action after a California federal judge late last week denied the company's motion to dismiss. The court ruled that Vizio customers' claimed injuries were "sufficiently concrete" to bring suit under the Video Privacy Protection and Wiretap Acts:

"Congress has determined that the interception of a person’s electronic communications and the unauthorized disclosure of a person’s video viewing history are sufficiently harmful to warrant private causes of action," and in response to Vizio's contention that the information it allegedly discloses is not personally identifiable, adds, "Taken to its logical conclusion, Defendants’ argument absurdly implies that a court could never enter judgment against a plaintiff on a VPPA claim if it found that the disclosed information was not within the statutory definition of personally identifiable information; instead, it would have to remand or dismiss the action for lack of jurisdiction."

U.S. District Court judge Josephine Staton also supported the lawsuit's claim of "highly offensive" conduct by Vizio by reiterating that the "Smart Interactivity" feature that did the spying was difficult to disable (impossible, initially), and was often reset after every Vizio firmware update:

"Plaintiffs point to a report by the security software company Avast, which concluded that Smart Interactivity’s “off” function was not operational “for months, if not years.” So, even if consumers believed they had opted out of Vizio’s data collection practices, Vizio was still collecting their data for a considerable period. In addition, Vizio’s...Smart Interactivity software switches back on without warning if the Smart TV ever reverts to the factory settings—as can occur through Vizio’s software updates. Consumers would likely not realize for a significant period that Vizio’s collection and disclosure software has been re-enabled because the opt-out feature is allegedly buried in an obscure settings menu."

So many of these companies wouldn't be facing settlements and lawsuits if they'd simply been transparent about what they were collecting in the first place. But time and time again we see "smart" IOT vendors trying to bullshit their way around what they're doing, bury settings that control privacy settings under layers of intentionally intimidating menus, or simply refuse outright to offer consumers working opt out tools in the first place.

Filed Under: class action, iot, smart tvs, video privacy, wiretap act
Companies: vizio

Vizio Fined $2.2 Million For Not Telling Customers Their TVs Were Spying On Them

from the I-always-feel-like-somebody's-watching-me dept

Security isn't the only thing being ignored as hardware vendors rush to connect televisions, toasters, and tea kettles to the internet. Consumer privacy and data-collection transparency has also become a distant afterthought as companies rush to cash in on the ocean of data these connected-devices collect. The "smart" television sector has been notably problematic, with Samsung busted a few years back for not only recording customer living room conversations, but transmitting that data unencrypted back to the company mothership.

These are lessons that hardware vendors appear incapable or unwilling to learn. Case in point: this week the FTC announced that it had struck a $1.2 million settlement with discount TV vendor Vizio. According to the full FTC complaint (pdf), Vizio began using the company's smart televisions to track user behavior in 2014, without informing customers that this was happening. The FTC notes that Vizio for years heavily advertised a "Smart Interactivity" feature that "enables program offers and suggestions." But the complaint notes this feature never provided customers with a single suggestion.

But it did provide Vizio with a wonderful new way to collect and store a huge variety of consumer data under the pretense of adding consumer functionality. MAC addresses, IP addresses, nearby WiFi network names, metadata were all hoovered up and stored. And when the FTC says viewing data, it means that Vizio used pixel analysis to compile personal data on every program and device connected to the Vizio set:

"According to the agencies’ complaint, starting in February 2014, VIZIO, Inc. and an affiliated company have manufactured VIZIO smart TVs that capture second-by-second information about video displayed on the smart TV, including video from consumer cable, broadband, set-top box, DVD, over-the-air broadcasts, and streaming devices.

In addition, VIZIO facilitated appending specific demographic information to the viewing data, such as sex, age, income, marital status, household size, education level, home ownership, and household value, the agencies allege. VIZIO sold this information to third parties, who used it for various purposes, including targeting advertising to consumers across devices, according to the complaint."

Again, this in and of itself isn't that controversial, especially in the age of location data and cell phones. The fact that Vizio chose not to tell anyone this data was being collected is where the company ran afoul of the FTC. An FTC blog post has a little more detail on just how specific this data was, and to whom it was sold:

"And let’s be clear: We’re not talking about summary information about national viewing trends. According to the complaint, Vizio got personal. The company provided consumers’ IP addresses to data aggregators, who then matched the address with an individual consumer or household. Vizio’s contracts with third parties prohibited the re-identification of consumers and households by name, but allowed a host of other personal details – for example, sex, age, income, marital status, household size, education, and home ownership. And Vizio permitted these companies to track and target its consumers across devices."

It's here that we'll remind you that the "anonymization" of data doesn't mean much. Time and time again, studies have shown that anonymized data sets aren't really anonymous, given that it only takes a few additional contextual clues (the likes of which companies that collect this sort of data already have) to ferret out personal identities.

It's not really clear how many settlements of this type it's going to take before "smart" hardware vendors acknowledge that being transparent with consumers (which frankly is neither onerous or particularly difficult for them in the 400-page EULA era) is important. And should we continue to weaken FCC and FTC privacy oversight of ISPs and hardware vendors (as is strongly implied by both agencies), that's less likely than ever to happen anytime soon.

Filed Under: ftc, smart tv, spying
Companies: vizio

Vizio Latest Manufacturer To Offer More Ways For TVs To Watch Purchasers

from the buy-our-things-so-we-can-sell-your-data! dept

Vizio is the latest consumer electronics manufacturer to announce -- publicly, but not, like, PR-onslaught publicly -- that its TVs will be watching purchasers as much as purchasers are watching them. The details of its strategy to generate the most ROI from each and every purchaser willing to blow past the fine print during setup are contained in the company's SEC filing for its debut as a public company. Engadget's Richard Lawler has the details. (h/t to Techdirt reader MarcAnthony)

According to the filing, Vizio has sold more than 15 million smart TVs, with about 61 percent of them connected as of the end of June. While viewers are benefiting from those connections, streaming over 3 billion hours of content, Vizio says it's watching them too, with Inscape software embedded in the screens that can track anything you're playing on it -- even if it's from cable TV, videogame systems and streaming devices.

Here's the potential shareholder-friendly description included in the S-1 filing:

Our Inscape data services capture, in real time, up to 100 billion anonymized viewing data points each day from our over 8 million VCUs. Inscape collects, aggregates and stores data regarding most content displayed on VCU television screens, including content from cable and satellite providers, streaming devices and gaming consoles. Inscape provides highly specific viewing behavior data on a massive scale with great accuracy, which can be used to generate intelligent insights for advertisers and media content providers and to drive their delivery of more relevant, personalized content through our VCUs.

And here's the grand plan, which is a slice of a multi-billion dollar data sales market:

We believe our business focus enables a self-reinforcing consumer use and engagement model that we expect to fuel our growth while driving revenue. Our connected entertainment products and discovery and engagement software increase usage of our platform, enabling Inscape to gather more anonymized data on viewing behaviors, which we can deliver to advertisers and media content providers. These companies in turn can deliver more relevant and personalized content for viewers, further enhancing the entertainment experience. We believe this self-reinforcing cycle will increase our brand awareness and enhance demand for our connected entertainment products.

What's curious about the wording isn't the gung ho appropriation of viewer data to sell to advertisers. What's curious is Vizio's claim that "anonymized data" will result in "more relevant and personalized content" for purchasers. There may be a certain level of anonymity involved, but Vizio still needs to provide enough defining demographic data to make this information worth purchasing. There is some value in general data like number of viewers of specific content at certain times, but Nielsen has done this sort of thing for years and it's a huge stretch to call anything about TV advertising "personal" or "relevant." So, there's something a bit off about the anonymization claims Vizio is making here.

The other issue is that while Vizio is being upfront with regulators about this aspect of its TV offerings, it's not being similarly explicit with purchasers. It is truly the rarest of customers that seeks out a television for its ability to offer "personalized content" in exchange for the sale of his or her viewing data to marketers.

Will users know Vizio is selling their viewing data, including that generated by third-party devices connected to a Vizio smart TV? Probably not. While Lawler noted on Twitter than the SEC filing contains 102 mentions of Inscape, the term fails to surface in searches of Vizio's website. There's also nothing referencing the service in its Privacy Policy.It's not as though this is a feature (which many purchasers would find closer to a bug) still in development. Vizio's own filing indicates this is already in use. While it may be proudly trumpeting its built-in spyware to potential shareholders, it seems a bit more reluctant to inform potential purchasers about the company's thirst for sellable data.

Far too many electronic device manufacturers are unwilling to honestly discuss this part of the business with paying customers, preferring pages and pages of legalese to do the talking for them -- a tactic that allows for both ass-coverage and obfuscation. Vizio does better than some by providing instructions on how to disable this on-by-default "interactivity" early on in its Privacy Policy, but that doesn't necessarily excuse yet another manufacturer that views paying customers as ongoing revenue streams long after they've collected the purchase price for the device. In today's electronics market, it's not enough to simply be a paying customer. You must also be the product as well.

Filed Under: privacy, smart tvs
Companies: vizio

SGI Back From The Dead (Again) And Suing Tons Of Companies For Patent Infringement

from the troll-troll-troll-troll dept

Back when I moved to Silicon Valley, Silicon Graphics Inc., (SGI) was still a hot place to work. They were still pumping out cool machines and had a reputation for a fun corporate culture. Of course, that collapsed pretty quickly over the next few years, as SGI totally misjudged the market trends and fell victim to the innovator's dilemma. Basically, SGI never could come to terms with the fact that its premium products were going to be increasingly undercut as cheaper commodity technology improved. Back in 2006, we noted that what remained of SGI had indicated that it planned to resurrect the company by going patent troll. However, we thought we'd avoided that ignoble result when SGI sold most of its assets to Rackable for a mere $25 million three years ago. Silly us for assuming those patents would just go away.

While Rackable changed its name to Silicon Graphics International... the original company actually retained the patents, and renamed itself Graphics Properties Holdings... and over the last few years has been suing lots of companies for patent infringement. In the last year alone it has sued Apple, HTC, LG, RIM, Samsung, Sony, Acer, ASUS, Panasonic, Sharp, Toshiba, Vizio and Motorola Mobility.

As the link above notes, while some of GPH's patents are relatively early, it appears that lots of similar inventions predated key patents. However, the early date may make those patents look stronger, and give GPH much more leverage in getting companies to pay up -- or risk losing the ability to produce devices with nice graphics capabilities.

Filed Under: patent troll, silicon valley
Companies: acer, apple, asus, htc, lg, motorola mobility, panasonic, rim, samsung, sgi, sharp, sony, toshiba, vizio