Smart TVs sending sensitive user data to Netflix and Facebook

Re:Smart TVs sending sensitive user data to Netflix and Face... by Silhouette on Wednesday September 18, 2019 @08:42PM (#21012087)

Are you sure about this? If the TV really is phoning home with whatever is on the screen, including anything personal the owner might happen to be displaying, that's a vast set of lawsuits waiting to happen. The GDPR fines alone could be staggering. I could easily imagine spyware logging whatever TV shows you're streaming and the like, but it's hard to imagine any business in this industry having lawyers dumb enough to allow sending actual screen images like that.

[ Parent | on HN ]

Re:Smart TVs sending sensitive user data to Netflix and Face... by obmelvin on Wednesday September 18, 2019 @09:06PM (#21012209)

Sorry, I was being a bit lazy in my comment. I didn't specify, but I don't really suspect they are sending full frames back if for no other reason than bandwidth. But, honestly fingerprinting is so similar it might as well be the same thing. Though thankfully, yes, the fingerprint calculated for something personal probably is meaningless to them, but possibly could be replaced with a reversible option

[ Parent | on HN ]

Re:Smart TVs sending sensitive user data to Netflix and Face... by btown on Wednesday September 18, 2019 @09:35PM (#21012377)

One danger is that videos can now "phone home" with the TV they're viewed on. You could torrent through Tor and take all sorts of precautions, then watch on your TV at home and leak your viewing habits. Or worse, get someone else targeted for copyright enforcement if you watch pirated content on their TV.

[ Parent | on HN ]

Re:Smart TVs sending sensitive user data to Netflix and Face... by rocqua on Thursday September 19, 2019 @04:57AM (#21014511)

How would data in the video be used to direct the TV to phone home? As in, what field would be set?

[ Parent | on HN ]

Re:Smart TVs sending sensitive user data to Netflix and Face... by jodrellblank on Thursday September 19, 2019 @05:06AM (#21014546)

I guess it would be a watermark style change through all the video frames which affects the hashes - e.g. brightness or contrast or sharpness or some combination of that kind of thing - then seed that on torrent sites, and advertisers get to see which TVs watched the torrented film vs the official film.

[ Parent | on HN ]

Re:Smart TVs sending sensitive user data to Netflix and Face... by Silhouette on Thursday September 19, 2019 @12:30AM (#21013315)

I don't think fingerprints are the same at all. While still having privacy implications, fingerprints to match against broadcast content aren't uploading your family photo or caps from your home movie if that's what you're showing on screen.

[ Parent | on HN ]

Re:Smart TVs sending sensitive user data to Netflix and Face... by jchrome on Wednesday September 18, 2019 @10:16PM (#21012595)

It’s called ACR data and it’s very common. And yes, TVs are phoning home with it.

And GDPR only requires that you opt in. So when you sign into the TV for the first time, it gives you an opt in choice and many do it. The States is less regulated but will be soon.

[ Parent | on HN ]

Re:Smart TVs sending sensitive user data to Netflix and Face... by Liquid_Fire on Thursday September 19, 2019 @08:05AM (#21015376)

GDPR can be quite strict on consent. See for example the UK's ICO guidelines. A sample of them:

> We don’t use pre-ticked boxes or any other type of default consent.

> We use clear, plain language that is easy to understand.

> We specify why we want the data and what we’re going to do with it.

> We give separate distinct (‘granular’) options to consent separately to different purposes and types of processing.

https://ico.org.uk/for-organisations/guide-to-data-protectio...

These are of course just guidelines, but if you don't explicitly inform your users that you will be sending images of what's on the screen over the Internet, you are likely to get in trouble. (And no, a giant EULA-type wall of text probably wouldn't be sufficient)

[ Parent | on HN ]

Re:Smart TVs sending sensitive user data to Netflix and Face... by Silhouette on Thursday September 19, 2019 @12:14AM (#21013234)

It isn't nearly as easy as you're suggesting to escape the scope of GDPR protections. There could be sensitive personal data or data about children involved. Even if it's just some identifiable individual in the screenshot, you still can't just rely on some sneaky "consent" as a blank cheque - that is merely a possible lawful basis for processing, and all the other provisions of the GDPR still apply.

Edit: Also, on your first point, ACR is generally a variation of fingerprinting technology. It wouldn't be sending entire screenshots of whatever is being displayed even if it's not broadcast content, at least not in any variation I've heard of. It was the idea of uploading the entire image that I was questioning before.

[ Parent | on HN ]

Re:Smart TVs sending sensitive user data to Netflix and Face... by jchrome on Thursday September 19, 2019 @10:07AM (#21016288)

Fair point on the screenshot. Yea I dont think any TV is phoning home with screenshots. Rather it's phoning home with a processed signal of the A/V in order to ID that A/V. If there is A/V that cannot be recognized, it may phone home a screenshot of that.

And I also don't think it's easy to escape the scope of GDPR. I'm just saying companies come up with ways of being "GDPR compliant" and they've done so.

[ Parent | on HN ]