By Mike Hintze
On Wednesday, December 7, 2016, the Federal Trade Commission held a Smart TV workshop, as part of its Fall Technology Series.
The event began with opening remarks from Jessica Rich, Director of the FTC's Bureau of Consumer Protection. Rich described how the changes from traditional broadcast television to the use of more streaming services and smart devices have resulted in more data being collected about TV viewing. And while the tracking of TV viewing behavior can result in better functionality, better measurement, and better ad revenue, there are significant privacy concerns.
TV viewing data can reveal sensitive information about a person. Recognizing the sensitivity of the data, Congress acted twice in the 1980s to protect the privacy of the video programming people watch -- enacting the privacy provisions of the Cable Communications Policy Act of 1984 and the Video Privacy Protection Act (VPPA) of 1988. Rich also noted that the different histories of televisions and PC have created different consumer expectations regarding privacy and data collection. Finally, she concluded by noting that as in other areas, the role of the FTC with regard to Smart TV will be to highlight privacy and consumer protection issues and to bring enforcement actions for unfair and deceptive acts.
Next, the FTC's Justin Brookman (Policy Director, Office of Technology Research and Investigation) and Ian Klein, a graduate student at Stevens Institute of Technology who interned with the FTC during the summer of 2016, gave an overview of the Smart TV ecosystem. They based their presentation in part on laboratory testing they conducted of disclosures, controls, and data coming off of smart entertainment devices, along with some speculation of what data collection, use, and sharing might be happening or could happen.
Areas of particular concern and focus of this overview were:
The use of "automatic content recognition" --- a method by which snapshots of the content displayed on the device are sent to the manufacturer or another party in order to determine what content is being viewed;
Collection of audio or video from the home environment through microphones or cameras embedded in the entertainment devices;
Cross-device tracking;
Combining viewing behavior data with other sources of data (purchase data, geolocation, demographics, etc.);
Device security -- a lack of which could lead to attacks on the device itself, other devices on the same local network, or on others through the use of a compromised device in a distributed denial-of-service attacks; and
User controls, with their research finding some controls for data collection by the device manufacturer, but few or no platform-level controls for app data collection or third party data sharing.
The first of two panels, entitled "New Frontier in Media Measurement and Targeting," consisted of industry representatives and was moderated by FTC attorney Kevin Moriarty. The panel discussed the benefits of data collection in the Smart TV context, including better and more personalized content discovery and recommendation, enabling more "second screen" experiences, and more relevant (and potentially fewer) ads.
There was general agreement that with the fragmentation of media, traditional "Nielsen-like" sampling methods are no longer sufficient to measure viewing behavior, and there is a need to collect more complete "census" data from entertainment devices. But Josh Chasin, Chief Research Officer for comScore, also noted that collecting lots of data is not the objective -- and that "good data" is more important than "big data."
While there was an acknowledgement that the data collection use necessary for the provision of these new and useful services raises legitimate privacy concerns, members of the panel argued for a reliance on industry self-regulation. Jane Clarke, CEO of the Coalition for Innovative Media Measurement, stated companies in this space do a good job of keeping PII and non-PII separate, and using only non-PII for analytics and measurement. Ashwin Navin, CEO of Samba TV (a provider of media measurement software and services), noted that his company requires TV manufacturers that include their measurement software to provide users with notice and an ability to turn off the data collection.
Shaq Katikala from the Network Advertising Initiative (NAI) noted that today's Smart TV environment involves the convergence of three distinct groups of companies: cable providers, app and software platform companies, and TV manufacturers -- and each comes with very different histories and experiences with regard to regulation. Thus, there is a strong appetite for self-regulation to help bridge the gaps and inconsistencies.
Nevertheless, there are still challenges with respect to getting it right in the Smart TV ecosystem. There are still no accepted or standard ways to provide notice and choice on a smart entertainment device, and there are unique challenges because of differing platforms and a lack of easily clickable links on most TV interfaces. According to one panelist, the manufacturers have little or no bargaining power over the data collection by the "top-tier apps" that manufacturers feel they must have on their devices. Thus, the top-tier apps dictate what data is collected and how it is used, and the TV manufacturer has little insight or ability to influence that.
The second panel, entitled "Consumer Understanding and Regulatory Framework," was moderated by FTC attorney Megan Cox and included representatives from industry, advocacy organizations, and academia. It began with Serge Egelman from the Berkeley Laboratory for Usable and Experimental Security (BLUES) presenting the results of survey research he conducted on consumer views on data collection and sharing, and their expectations with regard to Smart TVs. He concluded that people often perceive that data collected on Smart TVs (such as for voice recognition) doesn't leave the device, that data is not used for secondary purposes, and that there are legal protections against sharing(and that there is a strong correlation between those people who believe there are legal protections against data sharing and those who believe data is not used for other purposes. Egelman also a found a level of cynicism among respondents, with some expressing a view that companies find ways around legal protections to the extent they exist.
Most of the panelists concurred that there is a lack of transparency and understanding with respect to what data is collected and shared, by whom, for what purposes, and what controls are available. Claire Gartland from the Electronic Privacy Information Center (EPIC) noted that there is a complex ecosystem with many actors that are not known or understood by consumers - and that privacy policies do a poor job of explaining this. Dallas Harris from Public Knowledge echoed this, and added that consumers feel powerless to control how data is collected and shared. Maria Rerecich from Consumer Reports noted that user controls, when available, are often buried deep in menus and are not well explained.
The panelists discussed what existing laws will apply to the Smart TV environment. The VPPA, Cable Act, and the Children’s Online Privacy Protection Act (COPPA) may all play a role, but panelists suggested that unclear and incomplete application of those laws to this new and emerging area results in inadequate protections.
Emmett O'Keefe from the DMA cautioned against taking steps that could interfere with the ability to provide new television services that consumers want and enjoy. He suggested that many of these services are similar or identical to services that have been available on laptops, tablets, and smartphones for several years and the fact that they are now being offered through a larger screen does not require a new or different approach to regulation. O’Keefe also noted the DMA would be releasing a white paper on the Smart TV ecosystem (which is now available here).
There was a lively debate among the panelists on the effectiveness of self-regulation in protecting consumer privacy -- with O'Keefe referring to self-regulation of privacy in online advertising as "the gold standard" and Egelman calling it "an abject failure." Finally, Rerecich stated that Consumer Reports will begin including privacy and security ratings in its product reviews. She agreed that consumers want these new features, and the ratings will help them make informed decisions based on an understanding of the data collected and the privacy protections offered.