While that site only referred to a single lawsuit in its report, turns out the company is facing two different class action complaints. In both the lawsuits—filed two days apart in separate California courts last week—Cognitive Media Networks has been named as a co-defendant alongside the TV maker. Cognitive’s Automatic Content Recognition (ACR) technology is essential to Vizio’s ability to track users’ viewing habits, so much so that it acquired the San Francisco-based company earlier this year and renamed it Inscape Data Services.
The whole controversy erupted last week when ProPublica ran an article highlighting just how aggressively the Smart Interactivity “feature” in Vizio smart TVs monitors users’ viewing habits. It is enabled by default—unbeknown to most users—and remains active unless you opt out of it. The worrying part is Vizio shares the viewing data with third parties—advertisers, content providers, etc.—along with some potential personally identifiable information. The TV maker, however, denies passing on any information that could lead someone to a user’s true identity.
Vizio’s privacy policy states that IP addresses are an example of the kind of harmless “non-personal information” it collects and shares with others; conventional wisdom holds otherwise. In most cases, IP addresses can easily be used to identify the specific people they are associated with. That’s especially true if you are a data broker, a type of business that specializes in this kind of “data enhancement.”
A lawsuit filed with the U.S. District Court for the Northern District of California on Friday, November 13, 2015, accuses Vizio and Cognitive of secretly installing tracking software on the former’s smart TVs in a way that violates various federal and state laws. The tracking program—whose scale and sophistication is a source of pride for Vizio, as revealed by its recent IPO filing—goes well beyond users’ viewing habits and IP addresses. According to the complaint, it continuously scans their home computer networks for all manner of other information. This may even include the exact make, model, serial number, and software and hardware IDs of non-Vizio devices (say a Sonos speaker) connected to the same network as the spying TV.
It further alleges that the company freely enlists the help of data brokers to enhance (read: de-anonymize) the data it collects, and passes some of that sensitive information along to some of its partners. The more specific the data is, the more ad dollars it is likely to fetch. “That is, Defendants may know from the Tracking Software that an individual watched Scandal on a Thursday at 8:00 pm pacific time with an IP address of 96.90.87.4 and a Wifi router MAC address of 04:bd:88:7a:1c:c1, but they want to know the individual’s name, address, and other demographic information,” reads the complaint accessed by TechHive. You can read the entire document here:
Chief among the laws that this whole practice is said to violate is the Video Privacy Protection Act. It prohibits a “video tape service provider”—any company engaged in rental, sale or delivery of audio visual content and not necessarily just video tapes—from divulging any personally identifiable information about its customer to a third party, except where the customer has clearly consented to such data sharing (definitely not the case here). This includes any information that so much as “identifies a person as having requested or obtained video materials or services from a video tape service provider” (precisely what the company’s Smart Interactivity feature does). Vizio has previously argued it’s not a video tape service provider at all, and so this particular law doesn’t apply to it.
The other lawsuit, filed on November 11 with the U.S. District Court for the Central District of California, also makes similar claims. Given their similarities, we won’t be surprised if they end up being combined into one lawsuit.