Samsung “SmartTV” Complaint

Background on the Samsung “SmartTV”

“Smart” Technology

The market for voice-recognition technology has rocketed as companies embed internet-connected devices (from smartphones, televisions, and cars to refrigerators, thermostats and coffee makers) with listening capabilities and voice-activated features. Samsung first announced its voice-activated television at the Consumer Electronic Expo in 2012. Samsung’s “Smart Touch” remote control has a built-in microphone for voice recording. Other models include a camera and additional microphones to record voice and hand gesture.

Samsung is the leading provider of smart TVs, with nearly a thirty percent share of the “Smart TV” market as of 2013. SmartTV sales reached more than 90 million worldwide in 2013. Sales are expected to grow to 228 million by 2018. Other market forecasts estimate that Smart TV sales will reach 141 million in 2015. Samsung has marketed the convenience of its voice-recognition capable SmartTV, but has not adequately addressed the privacy consequences of its SmartTV’s configuration.

Samsung’s “Always-On” Voice Recorders

When the voice recognition feature is enabled, everything a user says in front of the Samsung SmartTV is recorded and transmitted over the internet to a third party regardless of whether it is related to the provision of the service. Under the heading “Voice Recognition” on the company’s Privacy Policy page, the company states: “To provide you the Voice Recognition feature, some voice commands may be transmitted (along with information about your device, including device identifiers) to a third-party service that converts speech to text or to the extent necessary to provide the Voice Recognition features to you. In addition, Samsung may collect and your device may capture voice commands and associated texts so that we can provide you with Voice Recognition features and evaluate and improve the features. Please be aware that if your spoken words include personal or other sensitive information, that information will be among the data captured and transmitted to a third party through your use of Voice Recognition.”

Samsung has identified the third party as Nuance, a voice-to-text recognition company. Samsung attempts to disclaim liability for any third party data privacy or security practices, including Nuance’s data privacy and security practices. Under the heading “Third Parties,” Samsung states: “Please note that when you watch a video or access applications or content provided by a third-party, that provider may collect or receive information about your SmartTV (e.g., its IP address and device identifiers), the requested transaction (e.g., your request to buy or rent the video), and your use of the application or service. Samsung is not responsible for these providers’ privacy or security practices. You should exercise caution and review the privacy statements applicable to the third-party websites and services you use.”

Samsung has represented that it encrypts the voice communications it transmits to Nuance. Samsung claims it, “takes consumer privacy very seriously and our products are designed with privacy in mind. We employ industry-standard security safeguards and practices, including data encryption, to secure consumers’ personal information and prevent unauthorized collection or use.” However, a computer researcher determined that Samsung does not encrypt all the conversations it records and transmits to Nuance. Samsung later conceded that the company does not encrypt all the voice recordings it transmits. Samsung also admitted it has not deployed the software necessary to encrypt plaintext transmissions.

EPIC’s Complaint

On February 24, 2015, EPIC filed a formal complaint with the Federal Trade Commission regarding Samsung’s deceptive and unfair trade practices and violation of the Children’s Online Privacy Protection Act, the Electronic Communications Privacy Act, and Cable Communications Policy Act. The complaint concerns the consumer privacy violations of Samsung’s “always on” SmartTV. Samsung deceived consumers by not effectively disclosing the spying capabilities of its Smart TV, leaving the majority of its consumers unaware that their SmartTV is routinely intercepting and recording the private communications of consumers in their homes. “Samsung’s attempts to disclaim its intrusive surveillance activities by means of a ‘privacy notice’ do not diminish the harm to American consumers.”

The Federal Trade Commission Act (“FTC Act”) prohibits unfair and deceptive acts and practices, and empowers the Commission to enforce the Act’s prohibitions. Under the Act, a business practice is deceptive if it “involves a representation, omission or practice that is likely to mislead the consumer acting reasonably under the circumstances,” and is “material,” or meaningful to the consumer. An unfair act under Section 5 are those that “cause[] or [are] likely to cause substantial injury to consumers which [are] reasonably avoidable by consumers themselves and not outweighed by countervailing benefits to consumers or to competition.”

Legal Theories

In the Complaint, EPIC charged Samsung with engaging in deceptive business practices in violation of Section 5 of the FTC Act. EPIC explained that Samsung “deceptive[ly] fail[ed] to disclose that Samsung records and transmits private conversations through its SmartTV.” EPIC explained that SmartTV users had been misled, as they were typically unaware that their televisions were recording and transmitting their private conversation. Additionally, Samsung had represented to consumers that it encrypted all recorded transmissions, but in reality transmitted some recordings unencrypted. Further, when users found out that SmartTV was recording them in their home, they expressed extreme outrage, indicating that this misrepresentation was material to consumers. Thus the failure to adequately disclose that the commitment to privacy was subject to reversal constituted a deceptive act in violation of Section 5 of the FTC.

EPIC further charged Samsung with committing unfair trade practices in violation of Section 5 of the Federal Trade Commission Act. Samsung disclaims liability for the privacy and security practices of the third parties to which it transfers user data, and failed to disclose in its privacy policy the name of the company to whom Samsung was transmitting user data. Additionally, Samsung misled users about the use of encryption in transmitting recorded conversations. Samsung users could not reasonably have anticipated that by using a voice-controlled SmartTV, their private conversations would be transmitted, sometimes unencrypted, to a third party company. Further, the inadequate protections are not outweighed by countervailing benefits to consumers or to competition.

EPIC charged Samsung with violating the Children’s Online Privacy Protection Act (COPPA) by knowingly collecting and recording the personal information of children under the age of 13. COPPA regulates the collection of children’s personal information by operators of online services. Operators of online services directed to children under the age of 13 must comply with COPPA. Operators of online services serving a general audience must comply with COPPA when the operator has “actual knowledge that it is collecting or maintaining personal information from a child.” To comply, operators must obtain parental consent before collecting children’s personal information and data. Prior to consenting, parents must be given notice as to what information it collects, how it uses such information, and the extent to which the information is disclosed to third parties as well as a means for parents to review the information collected.

Samsung claims that it does not knowingly market its SmartTV to children, however it admits that families with children under age 13 buy the SmartTV, and the SmartTV routinely records and transmits conversation, including children’s voices. Additionally, Samsung specifically markets features of the SmartTV to young children. Its website boasts programming specifically designed for pre-school aged children and encourages parents to have their children interact with its SmartTV.

Additionally, EPIC charged Samsung with violations of the Electronic Communications Privacy Act (ECPA) and the Cable Communications Policy Act (CCPA). Samsung violated the ECPA’s prohibition on the interception and intentional disclosure of a person’s wire, oral, and electronic communications. Under the CCPA, Samsung was required to obtain its consumers’ written or electronic consent to its recording of their private conversations and transmittance to Nuance.

Expert Reports

• Paul Levy, Privacy is fast becoming the real disruptive force in digital technology, The Conversation (Feb. 11, 2015)
• Federal Trade Commission, Complying with COPPA: Frequently Asked Questions (last visited Feb. 11, 2015)
• Matt Kwong, Samsung SmartTV an ‘absurd’ privacy intruder, Ann Cavoukian says, CBC News (Feb. 10, 2015)
• Alex Hern, Samsung Rejects Concern Over Orwellian Privacy Policy, The Guardian (Feb. 9, 2015) (quoting the remarks of Emma Carr)
• Natasha Lomas, Today in Creepy Privacy Policies, Samsung’s Eavesdropping TV, Techcrunch (Feb. 8, 2015)
• Opening Remarks of FTC Chairwoman Edith Ramirez at the International Consumer Electronics Show, Privacy and the IoT: Navigating Policy Issues (Jan. 6, 2015)
• Fed. Trade Comm’n, FTC Policy Statement on Deception (1983)
• Fed. Trade Comm’n, FTC Policy Statement on Unfairness (1980)