Viewing Data Harvested From Smart TVs Used To Push Ads To Other Screens? (securityledger.com)

chicksdaddy writes: In the latest episode of EULA overreach, electronics maker Vizio Holdings has been called out by the non profit investigative reporting outfit ProPublica for an on-by-default feature on its smart TVs called "Smart Interactivity" that analyzes both broadcast and streamed content viewed using the device. ProPublica noted that the company's privacy policy failed to clearly describe the tracking behavior, which included the collection of information such as the date, time, channel and whether the program was viewed live or recorded.

According to ProPublica, the monitoring of viewing information through IP addresses, while it does not identify individuals, can be combined with other data available in commercial databases from brokers such as Experian, creating a detailed picture of an individual or household. Vizio has since updated its privacy policy with a supplement that explains how "Smart Interactivity" works.

The bigger issue may be what that updated privacy policy reveals. As The Security Ledger notes, the updated Vizio privacy policy makes clear that the company will combine "your IP address and other Non-Personal Information in order to inform third party selection and delivery of targeted and re-targeted advertisements." Those advertisements "may be delivered to smartphones, tablets, PCs or other internet-connected devices that share an IP address or other identifier with your Smart TV."

In other words, TV viewing patterns will be used to serve ads to any device user who happens to be connected to the same network as the Vizio Smart TV — an obvious problem for households with a mix of say... adults and children?! Vizio does provide instructions for disabling the Smart Interactivity features and says that "connected" features of the device aren't contingent on monitoring. That's better than some other vendors. In 2014, for example, LG used a firmware update for its smart televisions to link the "smart" features of the device to viewer tracking and monitoring. Viewers who applied the update, but refused to consent to monitoring were not able to use services like Netflix and YouTube.

Comments

Weasel words

[olsmeister]

Wow, who wouldn't want to leave "Smart Interactivity" on? I don't know what it is or does, but if it's smart, and interactive, I had better leave it on, right? I want to get my money's worth out of this smart TV. I sure don't want to start disabling the smart features on my new smart TV.

Some marketing drone really earned their salary when they came up with that name.

Re:Weasel words

[MyAlternateID]

As I've advised people before, never give a smart TV its own Internet connection. Instead, use a cheap media center PC and an HDMI cable (or whatever). It will be a small portion of the cost of setting up a home theater. Then you'll have something that has serious storage, can stream whatever you like, has upgradable hardware, and easily updatable software. If you go open source, you won't have to worry about phoning home and you can put the package manager in your cron tab.

While I've advised this in the past for security purposes (I'm not on board with the whole Internet of Things for solid reasons), it's no surprise that we're seeing concrete privacy reasons as well. Corporations and the sociopaths who run them have no sense of honor or respect for their customers. That's why you can't expect them to simply ignore another chance to get advertising revenue. They're counting on the average person being too stupid and ill-informed to resist and that alone is why they don't deserve to get their way.

It would be nice to see customers rejecting this kind of practice early on, rather than waiting for it to become so bad and widespread that government finally sees an opportunity (yet one more thing to regulate!) and steps in.

Re:Weasel words

[lgw]

It would be nice to see customers rejecting this kind of practice early on, rather than waiting for it to become so bad and widespread that government finally sees an opportunity (yet one more thing to regulate!) and steps in

TFA doesn't go into how this has been monetized before ad-serving: this is the new Neilson Ratings. Broadcast, stream, or torrent, a smart TV with an internet connection can report what you're watching to a ratings firm. The funny thing is: Neilson is an all-volunteer service, and had the TV makers been open about this I'm sure only a few /. nerds would have opted out, while most people would be delighted that their viewing habits were important to someone.

I somehow doubt there will be much pushback about this.

What I dread is the MPAA finding a way to start using this to sue random people. "We caught you watching the new Star Wars movie and you're no paying to stream it, so you're automatically a thief - pay up!" Remember when an idea like that was tinfoil hat material?

Re:Weasel words

[kheldan]

Does the solution have to be a 1985 Television and over-the-air reception?

So cable TV, satellite, and streaming are such gods-be-damned great alternatives? How does 'FREE HDTV' sound to you, pretty good? That's OTA broadcasts. Buy an antenna, once, and get free HDTV, and the quality is as good if not better than anything else (less compression).

Re:Weasel words

[D.McG.]

There is nothing broadcast over the airwaves that I'd be worried about. Heck, letting them know which primetime shows on ABC/CBS/NBC etc. that I watch would actually help the ratings of the shows, increasing the probability that my favorite shows will be picked up for another season.

Why is it that the good sci-fi shows keep getting cancelled? Is it because the folks here are preventing the ratings from being calculated? Seems counter-intuitive.

Re:Weasel words

[shaitand]

Industry collusion can largely negate realistic options. There is no reason services like netflix can't exist while preserving privacy (security is an illusion and therefore false by definition). But there is profit in stealing our data and therefore the industry creates an artificial dichotomy, choose between no/inferior service and your private data being stolen and sold by vendors.

"LG used a firmware update for its smart televisions to link the "smart" features of the device to viewer tracking and monitoring. Viewers who applied the update, but refused to consent to monitoring were not able to use services like Netflix and YouTube."

Consumers who opt-in and/or are opted in to data collection should have to be paid a mandatory non-transferable or waivable 50% commission on all sales of data and advertising revenues for which it is used or face fines which are at a minimum treble damages (paid back to consumers) without regard for damage to business model viability, bankruptcy, or allowance of settlements below the minimum and criminals penalties for negligent failure to prosecute.

Going to steal my data? If I can't stop you then you should at least have to split the proceeds 50/50 and be denied all manner of ways to pressure me into giving up my cut.

Re:Weasel words

[kheldan]

I'm starting to wonder about people. I used to have cable and spent what seems like way too much time watching TV. These days it's all OTA and I have other interests and TiVo gets piled up with things I enjoy watching because I'm busy with other things. What I start to wonder is whether people should be spending less time watching TV and more time doing other things.

No concept of family or shared homes.

[daq man]

"In other words, TV viewing patterns will be used to serve ads to any device user who happens to be connected to the same network as the Vizio Smart TV — an obvious problem for households with a mix of say... adults and children?"

How about a house with a mix of older and younger adults. My kids (23 and 21) watch all sorts of stuff that I don't and watch a lot more TV than me so my TV, laptop or whatever device on the same network would show ads that are dominated by the tastes of my children.

Similarly how about students or other similar groups who share a house, and thereby the same IP address. The advertising would be a mishmash of varying tastes or maybe dominated by the one guy who has the TV on all day to provide "white noise" in the background.

Re:No concept of family or shared homes.

[known_coward_69]

i get all kinds of lingerie and bra ads on my chrome browser because my wife surfs this stuff at home on safari. sometimes big fredricks of hollywood ads at work because i bought something a year ago and get emails into my gmail every other day

Re:No concept of family or shared homes.

[bill_mcgonigle]

The advertising would be a mishmash of varying tastes

It's still going to get a better result than the shotgun approach. Marketers are good at many things - not letting the perfect be the enemy of the good is one of them.

Re:No concept of family or shared homes.

[AmiMoJo]

I was going to suggest installing AdBlock and Privacy Badger, but of course they are not available for smart TVs.

Once again, APK's hosts file is looking like it will be useful again. A little DD-WRT script to download an integrate it with the router's DNS server seems wise. I just wish DD-WRT had an easy way to spy on URLs and IP addresses being accessed by a single device (my TV) so I can block them where they are inappropriate.

Yet another reason

[Anonymous Coward]

Why "smart" internet connected TV's are a bad idea. If a device (any device) can spy on you to gather information a marketer might want, you should probably assume it will.

Get a "dumb" TV (or a smart TV that you don't set up to connect to the internet), and use a dedicated device that you choose (and preferably an open one like XBMC that you explicitly control) to stream content to it. It's not much more expensive, and isolating components to only do the thing you expect them to do prevents this kind of attack on your privacy.

May be delivered?

[Viol8]

"may be delivered to smartphones, tablets, PCs or other internet-connected devices that share an IP address or other identifier with your Smart TV."

According to TFA , they somehow link the cookies they store on your browser when you visit their website to your TV. So I'm guessing they store the external IP address of the TV and if the same address suddenly starts querying their website they assume its a device behind NAT and feed it ads.

Solution - don't visit their website or delete your cookies. Quite why anyone needs a smart TV anyway is another matter. My TV is just a monitor - the smart stuff happens on my other devices.

Worse

[nospam007]

"Viewers who applied the update, but refused to consent to monitoring were not able to use services like Netflix and YouTube."

Another reason to use torrents and VPNs instead of apple tv, chromecast, netflix, hulu and so on.
I have a 'smart' TV as well, but I just use it as a monitor, no network cable attached.

What does one gain from a "smart" TV anyway?

[mlts]

Other than an "enhanced advertising experience", and perhaps viewing some web content, what does a smart TV actually give as a service? Especially if one has a set top box from their provider, or something like a Roku, Chromecast, Apple TV, or a HTPC. At best, I can see the TV streaming Netflix as a feature... but with all the data sent back, it isn't worth the privacy invasion.

Of course, if the TV can't work unless it has Internet access, it will go back to the store -stat-.

Re:What does one gain from a "smart" TV anyway?

[StormReaver]

the only thing pay TV is good for is sports....

I complete agree that pay TV is 100% worthless.

Re: No concept of Ashley-Madison

[mnemotronic]

i get all kinds of lingerie and bra ads on my chrome browser because my wife surfs this stuff at home on safari. sometimes big fredricks of hollywood ads at work

At our house it's only me, my wife and the cat. I'm seeing ads for something called "Ashley-Madison". Are they related to Dolly-Madison cupcakes?

Re:Good way to stop this...

[Anonymous Brave Guy]

Don't worry. You can rest assured that your pattern of watching shows relating to civil liberties, legalising recreational drug consumption, and footage of police raids does not in any way reflect upon your character as viewed by the authorities. We were just passing through your neighbourhood offering a free swatting to randomly selected individuals.

Re: No concept of Ashley-Madison

[sociocapitalist]

i get all kinds of lingerie and bra ads on my chrome browser because my wife surfs this stuff at home on safari. sometimes big fredricks of hollywood ads at work

At our house it's only me, my wife and the cat. I'm seeing ads for something called "Ashley-Madison". Are they related to Dolly-Madison cupcakes?

Don't worry that's just the pussy looking for someone to play with.

Re: No concept of Ashley-Madison

[Type44Q]

I'm seeing ads for something called "Ashley-Madison". Are they related to Dolly-Madison cupcakes?

Too much of the latter on the part of one can definitely lead to a craving for the former on the part of the other. ;)