){kind=logo}
The Federal Trade Commission (“FTC”) recently held a workshop that brought together regulators, academics, policymakers and industry professionals to discuss the smart TV ecosystem and the opportunities and challenges faced by companies seeking to harness the consumer measurement and targeting capabilities available through these smart technologies. This was the FTC’s first foray into this area. It was an initial effort to describe the ecosystem, define the issues and draw some conclusions about where the FTC may have a role to play in establishing ground rules and protecting consumers.
It was clear from the discussions that the FTC believes that smart TVs are just one component of a much larger and not yet fully formed smart entertainment ecosystem. From a policy perspective, the FTC set forth a very broad definition of a smart TV or smart entertainment device as “something that enables internet connectivity on a large screen format,” such that smart peripherals (e.g., smart Blu-ray players and Roku) are also captured in this definition.
The benefits to the content, distribution and advertising industries are numerous, as was discussed in the overview that detailed the opportunities smart TVs offer companies to collect data for a variety of purposes (e.g., delivery of relevant content, research and product development, measurement and ratings, advertising, and cross-device tracking), and through a plethora of means (e.g., cookies, device IDs and other unique identifiers, IP addresses, data-capturing software, embedded chips or video cameras, and voice capture).
In addition to presentations from FTC staff, there were two panel discussions. The first of which was the measurement and targeting panel that included representatives of several media measurement companies (comScore, CIMM (which is a coalition of programmers), Tivo Research and Samba (a software measurement company)) and the Network Advertising Initiative (“NAI”). The panelists discussed ways in which the data collected can be used to inform manufacturing, understand audiences, customize content offerings and recommendations, and serve targeted advertising on a household-by-household basis and across application platforms. They described an effort by New York cable companies to pool and analyze their set-top box data, leading to the conclusion that one-third of New York viewing was of non-English-language programming that is not captured by Nielsen ratings. The comScore representative suggested that as TV seeks to replicate the capabilities of online advertising and move to more targeted ads, the online advertising industry is seeking ways to expand its reach to television levels by advertising more broadly.
Yet, not surprisingly, with increased data collection and optimization capabilities come consumer privacy and data security concerns and challenges. Consistent with what has come to be expected from the FTC, one of the underlying questions was about consumer expectations for smart TV privacy. Security is an incredibly important issue for smart TVs, as emphasized by Justin Brookman, the FTC’s policy director for its Office of Technology Research and Investigation, who reiterated the fact that security was a key concern in connection with the FTC’s internet of things report and security will continue to be an issue in connection with smart devices. The FTC expressed a continuing interest in exploring the expectations consumers have with respect to the duration of the useable life of connected or smart devices, and the obligations that should be in place for companies to update those smart devices (i.e., whether smart devices get security updates, how regularly and for how long following a consumer’s purchase).
As a possible indication of the approach the FTC may take to smart device privacy compliance, the agency walked through its own research into the policies and practices of three smart TV platforms currently on the market, focusing its review on three components: (i) disclosures (i.e., what information was made available to consumers), (ii) data flows (i.e., what types of data were collected from the devices and where the data were stored) and (iii) controls (i.e., what types of data privacy controls, platform level or otherwise, were available to consumers).
Observing the growing convergence of cable television, app companies and TV manufacturers around smart devices, an NAI representative also noted that the organization has begun to think about notice and choice in different ways, with the goal of eventually developing an NAI code for third-party collection and use of data from smart TVs. The NAI described consumer education as one of its key goals, such that the organization leans toward solutions that would allow consumers to click on an icon (similar to AdChoices) in the smart TV environment in order to access more information, rather than implementing jarring disclosures on a screen.
The second panel of the workshop was titled “Consumer Understanding and the Regulatory Framework.” This panel included representatives from the Berkeley Lab for Usable and Experimental Security, Epic, Public Knowledge, Consumer Reports and the Data and Marketing Association (“DMA”). While the DMA described self-regulatory efforts as successful, the Berkeley Lab representative described them as a failure, suggesting that consumers have lapsed into “learned helplessness” with respect to privacy. Some panelists called for broad privacy legislation, a one-button opt-out on remotes, broader definitions of personally identifiable information that include device IDs and pseudonyms, and privacy policies that describe companies’ practices in more precise and specific terms. The Consumer Reports representative said they are developing a privacy rating system to include in their smart TV product reviews.
While we are still in the early stages of smart device development, the DMA previewed their Next Generation TV white paper, An Overview of the Existing Landscape and a Recommended Approach for Cultivating Continued Innovation in the Ecosystem, which was released the next day. The white paper described the legal and regulatory landscape for the use of smart TV data, addressing the potential application of certain key laws (i.e., the Video Privacy Protection Act, the Cable Act and wiretap laws) to smart devices and calling for a more flexible and consistent self-regulatory regime to replace the current balkanized set of laws and regulations.
-
Video Privacy Protection Act (“VPPA”): The VPPA prohibits the knowing disclosure by video tape service providers to third parties of “information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider” (see 18 U.S.C. § 2710). Courts have found that the statute applies to companies that provide online video services, including video streaming to computers, mobile devices and televisions (see, e.g., In re Hulu Privacy Litig., No. C 11-03764 LB, 2012 WL 3282960, at *5 (N.D. Cal. Aug. 10, 2012)). In giving thought to a company’s data collection and use practices, the courts have held that the disclosure of an anonymous identifier and viewing habits, absent additional data points, does not constitute the knowing disclosure of PII; however, the addition of the user’s precise GPS coordinates to the disclosure could be considered the knowing disclosure of PII under the VPPA.
-
Cable Act: The Cable Act governs the rights of cable operators to collect PII from their subscribers and imposes restrictions on disclosing PII to third parties. Cable operators are generally restricted in their collection and use of PII obtained through their cable systems, except for disclosure of PII in connection with providing cable service, conducting a legitimate business activity related to providing cable service, disclosure in response to a court order or to a government entity pursuant to a lawful request, or disclosure of names and addresses when the subscriber has the opportunity to prohibit that disclosure and the information does not disclose the nature or extent of viewing habits. The provisions of the Cable Act may apply to cable operators that develop smart TV service offerings that leverage the cable system, so that the cable privacy provisions could impact the developing smart device ecosystem.
-
Wiretap Laws: State and federal wiretap laws could be implicated where a smart TV provider seeks to intercept the content of a consumer’s communication, such as voice commands to a television, if that provider is not a party to that communication. The wiretap laws generally prohibit the interception of the contents of a communication, absent the prior consent of one of the parties to that communication, and approximately 14 states require that all parties to a communication consent to the recording of that communication. Smart TV providers could also be subject to courts’ case-by-case analyses of their data collection activity to determine whether the data collected involves the content of a communication.
As the smart device ecosystem continues to evolve, we can expect that traditional applications of the various laws, rules, regulations and self-regulatory industry guidelines and frameworks, as well as the best practices based on them, will continue to evolve as well. It seems likely that the FTC will also play a role in establishing and enforcing best practices for the collection and use of data in this area.