Back in 2015, we covered how Vizio was using its new smart TVs to gather data on the viewing habits of all US customers, then sending that data back to itself to sell to third party advertising companies. What made the breach of customer trust particularly egregious was the fact that Vizio was doing this whether the end-user agreed to it or not. While the company patched that specific problem after it was publicly disclosed by third parties, the FTC opened an investigation into the company’s behavior more generally.

The findings of that investigation have since been announced. Since February 2014, Vizio has sold TVs with Inscape’s ACR content recognition software pre-installed. This software has been retrofitted into previously sold devices that lacked it — unless you’ve got a TV from prior to 2014 that you’ve never connected to the Internet, chances are that you’ve got ACR software sitting on your TV. The FTC notes that this software allows Vizio to collect information on what a consumer is watching on a second-by-second basis:

Defendants’ ACR software captures information about a selection of pixels on the screen and sends that data to Vizio servers, where it is uniquely matched to a database of publicly available television, movie, and commercial content. Defendants collect viewing data from cable or broadband service providers, set-top boxes, external streaming devices, DVD players, and over-the-air broadcasts. Defendants have stated that the ACR software captures up to 100 billion data points each day from more than 10 million Vizio televisions. Defendants store this data indefinitely.

Here’s how the system works. To you, the following line segment doesn’t look like much:

To a computer, however, each pixel of that image can be translated into data and compared with similar blocks of pixels taken from a huge catalog of TV and movies. When we talk about Big Data giving us access to relationship information that was previously obscured, this isn’t the kind of breakthrough most people had in mind, but that’s what it is. One pixel’s worth of data doesn’t identify anything, but an entire slice of data from a frame can be compared with a comprehensive data base of film and movie “slices” to see which they match up with. Here’s more, from the FTC:

Defendants’ ACR software also periodically collects other information about the television, including IP address, wired and wireless MAC addresses, WiFi signal strength, nearby WiFi access points, and other items. Vizio earns revenue by providing consumers’ television viewing history to third parties through licensing agreements, on a television-by-television basis for three main uses, specified by contracts.

First, Vizio provides aggregate viewing information to third parties for the purposes of measuring audience engagement (what did people watch and how did they watch it). Defendants are given a unique identifier for each television and metrics identifying what people watch, when it was watched, how long it was watched for, and what channels were watched.

Second, Vizio has provided IP addresses of all devices associated with the IP address of the television so that advertisers could determine whether consumers visit a web address shown on TV after seeing an ad for a product or service. This data is also used to determine if someone views a TV program after seeing an online ad. The idea that this data is anonymous in any meaningful way is, of course, hilarious.

Third, consumer data is sold to third parties for the purpose of targeting advertising at them on other devices they may own, based on their television viewing data. This last program got started in March 2016, which means this is what Vizio did as a “Sorry,” after getting caught running data collection on all customers, whether they opted in or not.

In my 2015 write-up, I specifically noted that while IP addresses weren’t considered legal proof of liability, advertisers would be happy to use them. That’s precisely what the FTC found:

Defendants facilitate the provision of demographic information to third parties about VIZIO television viewers. Defendants do this by providing consumers’ IP addresses to a data aggregator. The data aggregator uses the IP address information to identify a particular consumer or household, and then sends the third parties described in Paragraph 16 the demographic information associated with that consumer or household. Defendants’ contracts with third-party users of the viewing data prohibit the re-identification of consumers and households by name, but allow the following information to be appended: sex, age, income, marital status, household size, education, home ownership, and household value. For all of these uses, Defendants provide highly-specific, second-by-second information about television viewing. Each line of a report provides viewing information about a single television. In a securities filing, VIZIO states that its data analytics program, for example, “provides highly specific viewing behavior data on a massive scale with great accuracy, which can be used to generate intelligent insights for advertisers and media content providers.”

In 2016, Vizio did notify end users that it was now collecting data from their televisions to sell to third parties. This notification was provided in the form of a one-time popup lasting thirty seconds that did not need to be dismissed or acknowledged, vanished afterwards, never appeared again, and contained no links to the Settings menu or provide any additional information on how customers might opt out of this feature.

The FTC filing notes that Vizio’s customers are prohibited from re-identifying household customers by name, but let’s get real — if you know that the resident of 1234 Anystreet is a 42 year-old white male, never-married, with a bachelor’s degree, and a $250,000 home with a 30-year mortgage, you have identified that person. At that point, most public record databases will readily cough up a name.

The company will pay $1.5 million to the FTC and $700,000 to the New Jersey Division of Consumer Affairs. It must also delete all data collected before March 1, 2016 (but not since) and has agreed to prominently advertise and obtain consent before collecting information.

It’s time to stop pretending this is accidental

The ludicrously small fine for collecting data on an estimated 11 million televisions sold for up to three years highlights both the limits of federal law — there aren’t exactly any comprehensive digital privacy statutes preventing corporations from buying and selling this information — and the futility of preventing corporations from engaging in this kind of treachery. I do not use that word lightly.

While I recognize that the vast majority of consumers have little interest in security, I suspect most of Vizio’s customers would’ve very much liked to know they were carrying a device into their homes that would phone home with their viewing habits and other attached products so unknown advertisers could use third-party databases to figure out who they were — and no, I don’t consider a toothless agreement to constitute a compelling privacy-protecting arrangement. When a corporation sells you everything you could possibly need to identify a specific individual, up to and including information gathered about his or her other devices, then says “Oh but wait, you can’t look up who it is,” this is not an arrangement we need take seriously when evaluating whether the agreement adequately safeguards privacy.

Based on the behavior of Samsung, LG, Vizio, and other companies, I wouldn’t recommend buying any smart TV, from any manufacturer, for any reason. Since such TVs are going to eventually become the only TVs you can buy, a more practical alternative is to simply never connect it to the Internet. If you simply can’t live without an online connection on your TV, use a set-top box. Use a game console. Use a PC and connect the TV as a monitor (pick your set carefully if you go this route). But don’t connect your TV to the Internet. It’s true, companies like Google and Apple collect far more data from your smartphone, but there’s little practical way to limit data collection on a device whose functionality is fundamentally predicated on being connected to location-monitoring services. If you want turn-by-turn, GPS needs to know where you are. If you want to get phone calls, text messages, or use the Internet, various services need to know where your phone is.

Nobody needs to know what you’re watching on your TV, much less resell that information. Samsung, LG, Vizio, these corporations have no moral right to any of this information, and few would argue that consumers have been properly notified that their private information is handed over to such companies. If smart TV manufacturers want to argue that everyone is actually fine with these practices, let them put their money where their mouths are and advertise it prominently on the box. Let them do what Amazon does, and offer a TV at one price if you accept data monitoring and a TV at a higher price if you don’t. What these companies do may not be illegal, but that doesn’t make it right.