Your smart TV could be spying on you

The “smart” devices that represent the so-called Internet of Things were supposed to improve consumers’ quality of life with new, interactive features. But an unintended consequence of one of those life-improving features—voice recognition—has given a major manufacturer of smart televisions some negative publicity and is shedding light on potential security and privacy issues associated with internet-connected appliances.

The Daily Beast reported earlier this month that the privacy policy accompanying Samsung’s new Smart TV seems to suggest the device’s voice recognition feature could capture private conversations and send them to third parties.

The current policy reads: “Please be aware that if your spoken words include personal or other sensitive information, that information will be among the data captured and transmitted to a third party.”

The story that Samsung’s Smart TVs “could be spying on you” went viral during the following week and prompted Samsung to issue a clarification which included the following statement: “If a consumer consents and uses the voice recognition feature, voice data is provided to a third party during a requested voice command search.”

The interactive voice commands for the Samsung Smart TV are supposed to control not only basic television controls, such as volume and channel selection, but also allow the user to search for video content by talking to the television—a verbal equivalent of typing out a Google search.

But just as typing an internet search can (and often does) initiate targeted advertising, a voice command search spoken into a Samsung Smart TV could be considered marketing data. The key difference between a typed search and a verbal search performed after a prompt by the TV is that your casual conversation might be mistaken by the “smart” TV for an actual search.

Samsung acknowledges through its privacy policy that the voice activation feature may transmit data it’s not supposed to, and that the company doesn’t retain that data directly. But it says nothing about how that data might be used.

“What restrictions are placed upon third party data collection?” asks Joel Hruska writing in the tech website Extremetech.com. “Samsung doesn’t say. What security practices are those vendors required to follow? Samsung doesn’t say. Which companies actually handle the data collection? Samsung doesn’t say.”

To make matters even more complicated, the voice recognition feature is not an optional one. Users must take active steps to disable the feature by locking the TV to respond only to specific phrases, turning functions off completely, or completely disconnecting the TV from the internet.

Many technology analysts believe improving data security is going to be a significant issue for the emerging “Internet of Things.” But, as Hruska speculates, a simple first step might just be getting the right policies in place for handling that data: “People might be more likely to buy into ideas like Smart TVs … if the terms and services made strong guarantees about precisely which information was captured, shared, and transmitted to third-party services.”