BILL ANALYSIS Ó AB 1116 Page 1 Date of Hearing: April 28, 2015 ASSEMBLY COMMITTEE ON JUDICIARY Mark Stone, Chair AB 1116 (Committee on Privacy and Consumer Protection) - As Amended April 13, 2015 As Proposed to be Amended SUBJECT: CONNECTED TELEVISIONS KEY ISSUES: 1)SHOULD A TELEVISION THAT HAS THE CAPABILITY OF RECORDING HOUSEHOLD CONVERSATONS BE PROHIBITED FROM RECORDING, STORING, OR TRANSMITTING SPOKEN WORDS UNLESS THE PURCHASER OF THE DEVICE CHOOSES TO ENABLE THAT CAPABILITY AND CONSENTS TO HAVE HIS OR HER SPEECH RECORDED? 2)SHOULD A CONSUMER WHOSE HOUSEHOLD CONVERSATONS ARE SURREPTIOUSLY RECORDED BY A TELEVISION WITHOUT HIS OR HER KNOWLEDGE OR CONSENT HAVE NO CIVIL REMEDY FOR THE VIOLATION OF HIS OR HER PRIVACY? SYNOPSIS Smart TVs are home entertainment systems that are connected to the Internet. Some smart TVs now have technology that can AB 1116 Page 2 respond to human voices, which allows consumers not only to speak basic commands but also to search for content on the Internet or TV, rather than use a standard remote control to find and select options. While some manufacturers have warnings in their user manuals and privacy policies, many consumers are unaware that their TVs can capture conversations inside the home and transmit them back to the manufacturer or to a third-party service provider. Current law prohibits cable and satellite TV operators from recording or transmitting conversations that occur in a subscriber's home without notice and consent. However, current law does not require all smart TV manufacturers to meet this opt-in notice and consent standard. In addition, current law does not protect against secondary uses of voice data collected by smart TVs. This bill requires notice and consent before recording or transmitting any conversations that occur inside a consumer's home. This bill also requires consent before the collection of voice data and also prohibits any secondary uses of voice data. The bill does not specify that a manufacturer is liable for civil damages as a result of violating the requirements of the bill. Nevertheless, the bill states that "This chapter shall not be deemed to create a private right of action." This sentence is not only unnecessary, but could also be misleading and possibly counterproductive to privacy interests. In order to clarify that the bill neither creates a new cause of action, nor eliminates an existing cause of action, a clarifying amendment is suggested. The author also proposes a number of clarifying amendments that were debated and approved when this bill was heard and passed unanimously by the Assembly Privacy and Consumer Protection Committee. This bill has no opposition and is supported by Privacy Rights Clearinghouse. SUMMARY: Limits the ability of Internet-connected televisions, commonly known as "smart TVs," to record and transmit spoken words for a purpose that is not essential to the function of the television. Specifically, this bill: AB 1116 Page 3 1)Prohibits televisions (TVs) with voice-recognition (VR) features, also known as "smart TVs," from being used to collect, record, store, analyze, or transmit spoken words for any purpose not essential to the function of the application with the VR feature that the consumer uses. 2)Specifies that advertising and the analysis of household conversations are not essential to the function of an application. 3)Requires a one-time opt-in consent with a separate notice to the consumer before a VR feature on a smart TV is enabled. 4)Requires smart TVs with VR features to have mechanisms that allow consumers to: a) Affirmatively choose to use of the VR feature; b) Start and stop the VR feature; and c) Understand when the VR feature is on and collecting or transmitting spoken words or sounds. 5)Defines "connected television" as a device that can be connected to the Internet, receives television signals used to broadcast programs for entertainment, information, and education, and reproduces them on a screen, but excludes personal computers, tablets, and mobile phones. 6)Defines "voice recognition feature" as the function of a connected television that allows the collection, recording, storage, analysis, transmission, interpretation, or other use of spoken words or other sounds, but excludes voice commands not recorded or transmitted beyond the TV. 7)Gives the Attorney General or a district attorney the power to prosecute a manufacturer that violates or proposes to violate these provisions by seeking injunctive relief or a civil AB 1116 Page 4 penalty of up to $2,500 per violation, or both. 8)Specifies that there is no private right of action for violation of these provisions. 9)Invalidates any waiver of this bill's provisions as contrary to public policy. EXISTING LAW: 1)Bans, under the Electronic Communications Privacy Act of 1986, the interception of electronic communications, such as e-mail, radio-paging devices, cell phones, private communications carriers, and computer transmissions. (18 United States Code (U.S.C.) Sections 2510-2522, 2701-2711, 3121, and 1367.) 2)Requires, under the federal Cable Communications Policy Act of 1984, cable TV operators to obtain written or electronic consent before collecting or sharing individually identifiable information about cable TV subscribers. (47 U.S.C. 601-639.) 3)Gives citizens an "inalienable right" to privacy. (California Constitution, Article 1, Section 1.) 4)Prohibits, with exceptions, electronic eavesdropping or recording of private communications by telephone, radio telephone, cellular radio telephone, cable or any other device or in any other manner. Violation can result in penalties of up to $10,000 and imprisonment in county jail or state prison for up to one year. (Penal Code Sections 630-638.) AB 1116 Page 5 5)Prohibits cable TV and satellite TV operators from monitoring or recording conversations in a subscriber's residence, or from sharing individually identifiable information on subscriber viewing habits or other personal information without written consent. (Penal Code Section 637.5.) 6)Establishes criminal and civil penalties for a violation of cable and satellite television privacy laws, including: a) A misdemeanor, punishable by a fine not exceeding $3,000, or by imprisonment in the county jail not exceeding one year, or by both such fine and imprisonment. (Penal Code Section 637.5, subds. (a) and (j).); and b) A private right of action, which any aggrieved person may commence, for damages for invasion of privacy. (Penal Code Section 637.5(i).) FISCAL EFFECT: As currently in print this bill is keyed fiscal. COMMENTS: According to Assemblymember Gatto, the lead author of this bill, "AB 1116 protects California consumers by requiring manufacturers to ensure that a TV's VR features cannot be enabled or activated without a consumer's knowledge or consent and also by banning the secondary use of voice data, for example for marketing and advertising purposes. This bill affirms the fundamental right to privacy established in the California constitution. Nowhere is privacy more sacred than in the comfort of a person's home. As Justice Scalia noted in Kyllo v. United States, when speaking about the home, 'all details are intimate details, because the entire area is held safe from prying government eyes.' People's intimate details must be kept safe from the prying eyes of corporations as well." AB 1116 Page 6 (Too) Smart TVs? Smart TVs are home entertainment systems that are connected to the Internet. Some smart TVs now have technology that can respond to human voices, which allows consumers not only to speak basic commands but also to search for content on the Internet or TV, rather than use a standard remote control to find and select options. Manufacturers have been producing smart TVs with built-in VR features since 2012. The primary manufacturers of smart TVs sold in the United States are Samsung Electronics, LG, Sony, Philips, and Panasonic. According to Statistica.com, about 52 million Smart TVs were sold worldwide in 2011, and that figure is expected to reach 141 million in 2015. One well-known example of a smart TV is Samsung's own SmartTV system. According to the Samsung Electronics Official Global Blog, Samsung Tomorrow, the SmartTV has two separate VR features: A microphone embedded inside the TV set that responds to commands to perform simple functions, such as changing the channel and increasing the volume; and A microphone inside the TV's remote control that can be used to search for TV or Internet content (e.g., "Recommend a good Sci-Fi movie.") According to Samsung, voice data for the predetermined commands is neither stored nor transmitted. However, the VR search feature captures, records, stores and transmits spoken words and conversations and transmits them to a third party for analysis (in this case, Nuance Communications). AB 1116 Page 7 According to Samsung, to activate the VR feature, consumers must: Enable the feature when initially installing and setting up the TV; and Press a button on the remote control or on the TV screen before speaking search terms out loud. Privacy concerns with smart TVs. Once considered a novelty, VR technology has become a standard feature of many consumer electronics. From telephones that capture and interpret our voices to enable hands-free texting to televisions that allow users to change channels or search for content via voice commands, speech recognition features have evolved in ways that promote ease of use and safety for consumers. Critics, however, question the price of this progress. Recent news reports have alleged that smart TVs with VR features can unintentionally record and transmit sounds and private conversations inside the room where the TV is located. ("It's not just Samsung TVs - lots of other gadgets are spying on you," Fusion, February 17, 2015; and "Be careful what you say when your smart TV is on, Samsung warns customers," ABA Journal, February 9, 2015.) While some manufacturers have warnings in their user manuals and privacy policies, many consumers are unaware that their TVs can capture conversations inside the home and transmit them back to the manufacturer or to a third-party service provider. On February 24, 2015, the Electronic Privacy Information Center (EPIC) filed a formal complaint to the Federal Trade Commission (FTC) about Samsung Electronics SmartTVs. According to the EPIC complaint, "Samsung routinely intercepts and records the private AB 1116 Page 8 communications of consumers in their homes." In addition, while Samsung initially claimed that it encrypted all voice communications during transmission, the EPIC complaint pointed out that in February 2015 Samsung admitted it did not encrypt all voice recordings it transmits over the Internet. According to EPIC, "When the [VR] feature is enabled, everything a user says in front of the Samsung SmartTV is recorded and transmitted over the Internet to a third party regardless of whether it is related to the provision of the service." EPIC compiled numerous statements from Samsung SmartTV customers who stated they had no idea the TVs were recording conversations occurring in their homes. Furthermore, EPIC argued that "privacy notices" do not diminish the harm to American consumers. The EPIC complaint claimed, therefore, that Samsung had surreptitiously recorded private communications in the home and therefore violated several federal privacy laws, including the Children's Online Privacy Protection Act, The Cable Act, and the Electronic Communications Privacy Act. EPIC asked the FTC to enjoin Samsung and other companies that engage in similar practices. That complaint is currently pending before the FTC. The Center for Privacy and Technology at Georgetown Law School and Consumer Reports analyzed the privacy policies and public statements of Samsung and LG regarding their smart TVs and concluded that "The privacy policies that cover smart TVs aren't respecting [the privacy of your own home] the way they should. The Samsung and LG policies say that you need to give their TVs permission to collect voice data. That much is clear. Everything else isn't." (Samsung and LG smart TVs share your voice data with a third party, Consumer Reports, February 9, AB 1116 Page 9 2015.) Activation with the consumer's knowledge or consent. Current law prohibits cable and satellite TV operators from recording or transmitting conversations that occur in a subscriber's home without notice and consent. This bill is similar to the laws governing cable and satellite TV providers because it also requires notice and consent before recording or transmitting conversations that occur inside a consumer's home. In the case of Samsung's SmartTV, the company has argued that it already obtains consent from consumers by requiring them to activate the VR feature in the SmartTV and also agree to the manufacturer's privacy policy (which explains the recording and transmission of conversations) before using the VR features. However, current law does not require all smart TV manufacturers to meet this opt-in notice and consent standard. In addition, current law does not protect against secondary uses of voice data collected by smart TVs. This bill requires consent before the collection of voice data and also prohibits any secondary uses of voice data. Effect of bill's disclaimer that there is no "private right of action" for violation of this proposed law. The bill does not specify that a manufacturer is liable for civil damages as a result of violating the provisions of the bill. Nevertheless, the bill states that "This chapter shall not be deemed to create a private right of action." This sentence is not only unnecessary, but could possibly be misleading and counterproductive to privacy interests. It is unnecessary because, as the court noted in Doe v. Albany Unified School District, 2011 Cal. LEXIS 2555 (Cal. Mar. 1, 2011), a violation of a statute, even one that is mandatory, does not necessarily give rise to a private right of action. Quoting prior case law, the court noted that "whether a party has a right to sue depends on whether the Legislature has 'manifested an intent to create such a private cause of action' under the statute." The court AB 1116 Page 10 added that such intent, if any, is revealed through the language and legislative history of the statute. (Doe v. Albany Unified School District, supra, quoting Moradi-Shalal v. Firemen's Fund Insurance Companies (1988) 46 Cal. 3d 287, 305.) As for the statute amended by this bill, neither the language of the statute nor its legislative history reveals any intent to create a private right of action, expressly or otherwise. The language of the bill does not provide that a person whose privacy is violated has the right to collect damages from a manufacturer who violates the provisions of this bill. Therefore, it seems redundant and unnecessary to say that the statute does not intend to create a private right of action. Because the bill does not, in fact, create one. This provision is misleading and possibly counterproductive to the protection of consumer rights and privacy because it implies that a party could not rely on the violation of this statute in a civil action. It could be relevant in a negligence per se claim to show a breach of duty by the manufacturer of a TV, or it could be relevant in a civil action for common law invasion of privacy. It is also important to note that although a consumer would have a civil remedy when a cable operator eavesdropped on his or her home (Penal Code Section 637.5(i), providing that "Any aggrieved person may commence a civil action for damages for invasion of privacy against any satellite or cable television corporation, service provider, or person that leases a channel or channels on a satellite or cable television system that violates the provisions of this section.") the Committee may question why satellite and cable television operators are made expressly liable in a civil action for eavesdropping on a consumer, while television manufacturers are relieved from civil liability to individual victims under the provisions of this bill. Arguments in support: Privacy Rights Clearinghouse states in support of the bill: AB 1116 Page 11 AB 1116 will protect the privacy of people in the sanctity of their homes by restricting the sale of televisions in California that can record and transmit sounds or conversations from inside a person's home back to the manufacturer or a third party when the TV's voice recognition technology is not enabled by the consumer. . . While manufacturers have warnings tucked away in their privacy policies and service agreements, consumers have been largely unaware that whatever they say can be captured, recorded and transmitted to the manufacturer or a third party service provider. AB 1116 protects California consumers by effectively requiring manufacturers to ensure that a TV's voice recognition feature cannot be remotely enabled by the manufacturer or the manufacturer's third party service provider without the consumer's knowledge and without any action by the consumer to enable the voice recognition feature. Clarifying amendments. In order to clarify that the bill neither creates a new private right of action, nor eliminates an existing private right of action, the following clarifying amendments are suggested: On page 4, at line 24, after the word "action" insert the following: ", or limit any existing private right of action" In addition, the author proposes the following clarifying amendments that were discussed and approved by the Assembly Privacy and Consumer Protection Committee when it heard this bill on April 21, 2015, along with the author's explanation of the amendments. Page 3, lines 21-22, strike ", including, but not limited AB 1116 Page 12 to, an interactive on screen dialog" Page 3, line 34, strike ", including, but not limited to, a button or voice command" Page 3, line 37, strike ", including, but not limited to, a signal light" Author's explanation: "The above three amendments are a result of discussions with an attorney from the Consumer Electronics Association. . . .[T]he attorney indicated that though that may be the case, there was a fear that mentioning specific things (like a signal light to indicate the TV is collecting sounds) could lead to California only TVs, which is not at all our intent." Page 3, between lines 37 and 38 insert: "(d) This section shall not apply to those products and services provided by companies covered under Section 637.5 of the Penal Code." Author's explanation: "This amendment is at the request of the Cable/Satellite folks who pointed out to us that they are already subject to privacy provisions in Penal Code 637.5." Page 4, line 5, after "tablet," insert: "video game console" Author's explanation: "This amendment came from several sources, including the Republican policy consultant who wanted to make sure that a PlayStation or X-Box would not be defined as a TV, as one could argue that some of these gaming systems receive TV signals used to broadcast signals. As we have also carved out personal computers, tablets, and cell phones (because this bill AB 1116 Page 13 is narrowly about the TVs themselves), it just made sense to carve out video game consoles." Add Assemblymember Dababneh as a Committee co-author. Prior legislation. SB 1090 (Bowen), Chapter 731, Statutes of 2001, gave satellite TV subscribers the same privacy rights afforded to cable TV subscribers under state law by prohibiting satellite TV operators from recording or transmitting conversations in a person's residence and requiring satellite TV operators to get written or electronic consent before collecting or sharing subscribers personal information or television viewing habits. Prior votes on this bill. AB 1116 passed the Assembly Privacy and Consumer Protection Committee on April 21, 2015 by a vote of 11-0. REGISTERED SUPPORT / OPPOSITION: Support Privacy Rights Clearinghouse Opposition AB 1116 Page 14 None on file Analysis Prepared by:Alison Merrilees / JUD. / (916) 319-2334