The market for voice-recognition technology has rocketed as companies embed internet-connected devices (from smartphones, televisions, and cars to refrigerators, thermostats and coffee makers) with listening capabilities and voice-activated features. Samsung first announced its voice-activated television at the Consumer Electronic Expo in 2012. Samsung’s “Smart Touch” remote control has a built-in microphone for voice recording. Other models include a camera and additional microphones to record voice and hand gesture.
Samsung is the leading provider of smart TVs, with nearly a thirty percent share of the “Smart TV” market as of 2013. SmartTV sales reached more than 90 million worldwide in 2013. Sales are expected to grow to 228 million by 2018. Other market forecasts estimate that Smart TV sales will reach 141 million in 2015. Samsung has marketed the convenience of its voice-recognition capable SmartTV, but has not adequately addressed the privacy consequences of its SmartTV’s configuration.
Samsung’s “Always-On” Voice Recorders
Samsung has identified the third party as Nuance, a voice-to-text recognition company. Samsung attempts to disclaim liability for any third party data privacy or security practices, including Nuance’s data privacy and security practices. Under the heading “Third Parties,” Samsung states: “Please note that when you watch a video or access applications or content provided by a third-party, that provider may collect or receive information about your SmartTV (e.g., its IP address and device identifiers), the requested transaction (e.g., your request to buy or rent the video), and your use of the application or service. Samsung is not responsible for these providers’ privacy or security practices. You should exercise caution and review the privacy statements applicable to the third-party websites and services you use.”
Samsung has represented that it encrypts the voice communications it transmits to Nuance. Samsung claims it, “takes consumer privacy very seriously and our products are designed with privacy in mind. We employ industry-standard security safeguards and practices, including data encryption, to secure consumers’ personal information and prevent unauthorized collection or use.” However, a computer researcher determined that Samsung does not encrypt all the conversations it records and transmits to Nuance. Samsung later conceded that the company does not encrypt all the voice recordings it transmits. Samsung also admitted it has not deployed the software necessary to encrypt plaintext transmissions.
On February 24, 2015, EPIC filed a formal complaint with the Federal Trade Commission regarding Samsung’s deceptive and unfair trade practices and violation of the Children’s Online Privacy Protection Act, the Electronic Communications Privacy Act, and Cable Communications Policy Act. The complaint concerns the consumer privacy violations of Samsung’s “always on” SmartTV. Samsung deceived consumers by not effectively disclosing the spying capabilities of its Smart TV, leaving the majority of its consumers unaware that their SmartTV is routinely intercepting and recording the private communications of consumers in their homes. “Samsung’s attempts to disclaim its intrusive surveillance activities by means of a ‘privacy notice’ do not diminish the harm to American consumers.”
The Federal Trade Commission Act (“FTC Act”) prohibits unfair and deceptive acts and practices, and empowers the Commission to enforce the Act’s prohibitions. Under the Act, a business practice is deceptive if it “involves a representation, omission or practice that is likely to mislead the consumer acting reasonably under the circumstances,” and is “material,” or meaningful to the consumer. An unfair act under Section 5 are those that “cause or [are] likely to cause substantial injury to consumers which [are] reasonably avoidable by consumers themselves and not outweighed by countervailing benefits to consumers or to competition.”
In the Complaint, EPIC charged Samsung with engaging in deceptive business practices in violation of Section 5 of the FTC Act. EPIC explained that Samsung “deceptive[ly] fail[ed] to disclose that Samsung records and transmits private conversations through its SmartTV.” EPIC explained that SmartTV users had been misled, as they were typically unaware that their televisions were recording and transmitting their private conversation. Additionally, Samsung had represented to consumers that it encrypted all recorded transmissions, but in reality transmitted some recordings unencrypted. Further, when users found out that SmartTV was recording them in their home, they expressed extreme outrage, indicating that this misrepresentation was material to consumers. Thus the failure to adequately disclose that the commitment to privacy was subject to reversal constituted a deceptive act in violation of Section 5 of the FTC.
EPIC charged Samsung with violating the Children’s Online Privacy Protection Act (COPPA) by knowingly collecting and recording the personal information of children under the age of 13. COPPA regulates the collection of children’s personal information by operators of online services. Operators of online services directed to children under the age of 13 must comply with COPPA. Operators of online services serving a general audience must comply with COPPA when the operator has “actual knowledge that it is collecting or maintaining personal information from a child.” To comply, operators must obtain parental consent before collecting children’s personal information and data. Prior to consenting, parents must be given notice as to what information it collects, how it uses such information, and the extent to which the information is disclosed to third parties as well as a means for parents to review the information collected.
Samsung claims that it does not knowingly market its SmartTV to children, however it admits that families with children under age 13 buy the SmartTV, and the SmartTV routinely records and transmits conversation, including children’s voices. Additionally, Samsung specifically markets features of the SmartTV to young children. Its website boasts programming specifically designed for pre-school aged children and encourages parents to have their children interact with its SmartTV.
Additionally, EPIC charged Samsung with violations of the Electronic Communications Privacy Act (ECPA) and the Cable Communications Policy Act (CCPA). Samsung violated the ECPA’s prohibition on the interception and intentional disclosure of a person’s wire, oral, and electronic communications. Under the CCPA, Samsung was required to obtain its consumers’ written or electronic consent to its recording of their private conversations and transmittance to Nuance.