Smart TVs are web-enabled TV sets allowing consumers to use many more information channels, functions and online services like video streaming in addition to the traditional television programme. They are representative of many other devices in the context of the so-called Internet of Things (IoT).
The sector inquiry has shown that smart TVs can collect personal data in many forms. Companies have been collecting data to varying extents so far.
A person’s individual viewing habits, app use, surfing and click behaviour or biometric data like voice or cursor movements as well as contents played via the TV set can be recorded and evaluated.
Consumers can often prevent the collection of such detailed personal user data and, possibly, their use for personalised marketing by setting up their TV sets accordingly.
It is either not possible at all or very difficult for consumers to find information on the use of their data prior to purchasing the TV set. Once the purchase has been made, consumers usually consent to the data protection provisions and terms of use displayed during the initial setup of their device as they do not see any alternatives.
The Bundeskartellamt has established that almost all smart TV manufacturers active on the German market use privacy policies that have serious shortcomings in terms of transparency and thus violate the General Data Protection Regulation (GDPR). Consumers find it especially difficult to understand privacy policies because they apply to a large variety of services and use processes.
This “one fits all†approach leaves consumers deprived of reliable information on what type of personal data is processed, which use processes trigger which type of data processing, which data are transferred to third parties and for how long their data are stored. As a consequence, consumers cannot change their use behaviour to reduce the amount of personal data shared to a minimum.
The Bundeskartellamt also examined software data security risks of smart TVs. After past reports of shortcomings the sector inquiry has shown that manufacturers’ efforts to ensure a high level of data security vary.
A lot of manufactures do not ensure that their devices’ security standards are maintained through software updates in the years after the purchase. No company provides reliable information on how long security updates will be available for its products. However, this information is indispensable for consumers to assess the time period during which they can use the device without risks. With regard to software updates the legislator should improve the consumers’ legal position, especially towards manufacturers.
The Bundeskartellamt also analysed further problem areas affecting consumers using IoT products from a legal perspective, for example the legality of advertisements in the TV portal. ■