Stipulated Order for Permanent Injunction and …

1 UNITED STATES DISTRICT COURT DISTRICT OF NEW JERSEY FEDERAL TRADE COMMISSION, CHRISTOPHER S. PORRINO, Attorney General of the State of New Jersey, and STEVE C. LEE, Director of the New Jersey Division of Consumer Affairs, Plaintiffs, v. VIZIO, INC., a Delaware corporation, and VIZIO INSCAPE SERVICES, LLC, a Delaware limited liability company, Defendants. Case Stipulated Order FOR Permanent Injunction AND MONETARY JUDGMENT Plaintiffs, the Federal Trade Commission ( FTC or Commission ), Christopher S. Porrino, Attorney General of the State of New Jersey ( Attorney General ), and Steve C. Lee, Director of the New Jersey Division of Consumer Affairs ( Director ) (collectively, Plaintiffs ), filed a Complaint for Permanent Injunction and other equitable and monetary relief in this matter against defendants VIZIO, Inc.

2 ( VIZIO ) and VIZIO Inscape Services, LLC ( VIZIO Inscape Services ) (collectively, Defendants ). The FTC brought its claims pursuant to Section 13(b) of the Federal Trade Commission Act, 15 53(b) ( FTC Act ), and the Attorney General and the Director brought their claims pursuant to the New Jersey Consumer Fraud Act, Stat. Ann. 56:8-1 et seq. ( CFA ). Plaintiffs and Defendants stipulate to the entry of this Stipulated Order for Permanent Injunction and Monetary Judgment ( Order ) to resolve all matters in dispute in this action. THEREFORE, IT IS ORDERED as follows: Case 2:17-cv-00758 Document 1-3 Filed 02/06/17 Page 1 of 17 PageID: 15 FINDINGS 1. This Court has jurisdiction over this matter. 2. The Complaint charges that Defendants participated in deceptive and unfair acts or practices in violation of Section 5 of the FTC Act, 15 45, and unconscionable commercial practices, misrepresentations, false promises, and omissions of material fact in violation of the CFA, Stat.

3 Ann. 56:8-2, in connection with Defendants unfair collection and sharing of consumers Viewing Data and deception concerning Defendants Smart Interactivity feature. 3. Defendants neither admit nor deny any of the allegations in the Complaint, except as specifically stated in this Order . Only for the purpose of this action, Defendants admit the facts necessary to establish jurisdiction. 4. Defendants waive any claim they may have under the Equal Access to Justice Act, 28 2412, concerning the prosecution of this action through the date of this Order , and agree to bear their own costs and attorneys fees. 5. The parties waive all rights to appeal or otherwise challenge or contest the validity of this Order . DEFINITIONS For purposes of this Order , the following definitions apply: A.

4 Covered Information means information collected from a VIZIO internet-connected device, including, but not limited to, (1) product registration data; (2) Viewing Data; (3) Internet Protocol ( IP ) address; (4) User ID or other identifiers; and (5) geolocation or Case 2:17-cv-00758 Document 1-3 Filed 02/06/17 Page 2 of 17 PageID: 16 information that can be used to derive geolocation. Covered Information also means information combined with any of (1) through (5) above. B. Defendants means VIZIO, Inc., and its successors and assigns, and VIZIO Inscape Services, LLC, and its successors and assigns. C. Smart TV means any of Defendants televisions or monitors that have the ability to connect to the internet. D. Viewing Data means any information or data collected or planned to be collected from a Smart TV about the content viewed on that television, or any reports or data derived therefrom and any information combined with such data.

5 Order I. PROHIBITED MISLEADING REPRESENTATIONS IT IS ORDERED that Defendants and Defendants officers, agents, employees, and attorneys, directly or through any corporation, subsidiary, division, website, or other device or affiliate owned or controlled by Defendants, in or affecting commerce, must not misrepresent in any manner, expressly or by implication: A. The extent to which Defendants collect, use, maintain, or protect the privacy, confidentiality, or security of any Covered Information; or B. The purpose of their collection, use, or disclosure of Covered Information. II. NOTICE AND AFFIRMATIVE EXPRESS CONSENT PROVISION IT IS FURTHER ORDERED that Defendants and Defendants officers, agents, employees, and attorneys, and all other persons in active concert or participation with any of them, who receive actual notice of this Order , in connection with any collection of Viewing Data for any product or service, prior to collecting any Viewing Data must: Case 2:17-cv-00758 Document 1-3 Filed 02/06/17 Page 3 of 17 PageID: 17 A.

6 Prominently disclose to the consumer, separate and apart from any privacy policy, terms of use page, or other similar document: (1) the types of Viewing Data that will be collected and used, (2) the types of Viewing Data that will be shared with third parties; (3) the identity or specific categories of such third parties; and (4) all purposes for Defendants sharing of such information; B. Obtain the consumer s affirmative express consent (1) at the time the disclosure in Part is made and (2) upon any material changes to the terms disclosed in Part ; and C. Provide instructions, at any time the consumer s affirmative express consent is sought under Part , for how the consumer may revoke consent to collection of Viewing Data. D. For the purposes of this Order , Prominently means that a required disclosure is difficult to miss ( , easily noticeable) and easily understandable by ordinary consumers, including in all of the following ways: 1.

7 A visual disclosure, by its size, contrast, location, the length of time it appears, and other characteristics, must stand out from any accompanying text or other visual elements so that it is easily noticed, read, and understood. 2. An audible disclosure, including by telephone or streaming video, must be delivered in a volume, speed, and cadence sufficient for ordinary consumers to easily hear and understand it. 3. In any communication using an interactive electronic medium, such as in connection with an update to device firmware, the disclosure must be unavoidable. 4. The disclosure must use diction and syntax understandable to ordinary consumers and must appear in each language in which the triggering representation appears. Case 2:17-cv-00758 Document 1-3 Filed 02/06/17 Page 4 of 17 PageID: 18 5.

8 The disclosure must comply with these requirements in each medium through which it is received, including all electronic devices and face-to-face communications. 6. The disclosure must not be contradicted or mitigated by, or inconsistent with, anything else in the communication. 7. When the representation or sales practice targets a specific audience, such as children, the elderly, or the terminally ill, ordinary consumers includes reasonable members of that group. III. DATA DELETION IT IS FURTHER ORDERED that within 120 days after entry of this Order , Defendants and Defendants officers, agents, employees, and attorneys, and all other persons in active concert or participation with any of them, who receive actual notice of this Order , must destroy Viewing Data that has been collected prior to March 1, 2016.

9 Provided, however, that such Viewing Data need not be destroyed, and may be disclosed, (A) to the extent requested by a government agency or required by law, regulation, or court Order , including without limitation as required by rules applicable to the safeguarding of evidence in pending litigation, or (B) to the extent a user of a television associated with the Viewing Data has affirmatively consented to the collection, use, or disclosure thereof, consistent with Part II of this Order . IV. MANDATED PRIVACY PROGRAM IT IS FURTHER ORDERED that Defendants must, no later than the effective date of this Order , establish and implement, and thereafter maintain, a comprehensive privacy program that is reasonably designed to (1) address privacy risks related to the development and management of new and existing products and services for consumers, and (2) protect the privacy and confidentiality of Covered Information collected directly or indirectly by Case 2:17-cv-00758 Document 1-3 Filed 02/06/17 Page 5 of 17 PageID: 19 Defendants.

10 Such program, the content and implementation of which must be documented in writing, must contain controls and procedures appropriate to Defendants size and complexity, the nature and scope of Defendants activities, and the sensitivity of the Covered Information, including: A. The designation of an employee or employees to coordinate and be responsible for the privacy program; B. The identification of reasonably foreseeable risks, both internal and external, that could result in Defendants unauthorized collection, use, or disclosure of Covered Information and an assessment of the sufficiency of any safeguards in place to control these risks. At a minimum, this risk assessment should include consideration of risks in each area of relevant operation, including: (1) employee training and management, including training on the requirements of this Order , and (2) product design, development, and research; C.