The Federal Trade Commission’s recent settlement with VIZIO, Inc., may have created a new definition of “sensitive information” that includes viewing data, but the opinion of Acting Chairperson Maureen Ohlhausen may provide further insight on how the agency will act under the new administration.
On February 6, the FTC settled charges with VIZIO, one of the world’s largest manufacturers and sellers of internet-connected “smart” televisions. VIZIO agreed to pay $2.2 million based on allegations that it installed software on its TVs to collect viewing data on 11 million consumer TVs without consumers’ knowledge or consent. After capturing this second-by-second information about what was shown on these TVs, VIZIO allegedly appended demographic information to the viewing data, including sex, age, income, marital status, household size, education level, home ownership, and household value, and subsequently sold this information to third parties who used it to target advertising to consumers across devices.
The Order requires VIZIO to prominently disclose and obtain affirmative express consent for its data collection and sharing practices, and prohibits misrepresentations about the privacy, security, or confidentiality of consumer information they collect. It also requires VIZIO to delete data collected before March 1, 2016, and to implement a comprehensive data privacy program with biennial assessments.
Significantly, the FTC’s complaint states that television viewing activity is “sensitive” and that VIZIO’s collection and sharing of that sensitive data without consumers’ consent has caused, or is likely to cause, substantial injury to consumers that is not outweighed by countervailing benefits to consumers or competition, and is not reasonably avoidable by consumers, making it an unfair act or practice in violation of Section 5(a) of the FTC Act.
In response to the agency’s characterization of television viewing activity as “sensitive,” which had not been stated explicitly in any prior FTC statements, Acting Chairperson Maureen Ohlhausen wrote a concurring statement highlighting the implications of this new policy.
“There may be good policy reasons to consider such information sensitive,” Ohlhausen wrote. “Indeed, Congress has protected the privacy of certain video viewing activity by passing specific laws, such as the Cable Privacy Act of 1984. But, under our statute, we cannot find a practice unfair based primarily on public policy. Instead, we must determine whether the practice causes substantial injury that is not reasonably avoidable by the consumer and is not outweighed by benefits to competition or consumers.”
As a result, Ohlhausen wrote, “This case demonstrates the need for the FTC to examine more rigorously what constitutes ‘substantial injury’ in the context of information about consumers. In the coming weeks I will launch an effort to examine this important issue further.”
The concurrence of Ohlhausen, currently the lone Republican commissioner, may signal the direction that the FTC will take under the Trump administration, especially given that there are several vacancies that will soon be filled by appointments. By promising a new effort to scrutinize the FTC’s interpretation of what constitutes “substantial injury” to consumers’ information, Ohlhausen has indicated that there may be a reexamination of privacy-based enforcement to ensure that it is focused on practices that have the capacity to cause substantial injury to consumers. There is likely to be a greater emphasis in the privacy and data security area on a cost-benefit approach that assesses risk to consumers, limits expansion of the definition of “personal information,” and confines enforcement to “sensitive information” compromises that cause “substantial injury” to consumers.
Ohlhausen’s concurrence would also appear to echo concerns about due process and predictability of enforcement, which were at issue in previous enforcements. The Commission’s Order, as a whole, may herald increased attention to the deception of consumers by omission, such as by failing to adequately notify them of the collection of their sensitive data. As the Commission focuses more on substantial injury, deception claims may go hand in hand with unfairness claims, as well. The FTC has made privacy enforcement a high priority, and as consumers and their advocates press the agency for action, that is unlikely to change; however, under Ohlhausen and the new appointees, we may see a shift in enforcement that more heavily scrutinizes proposed expansions of liability.