FEDERAL TRADE COMMISSION Washington, DC 20580 In the Matter of Comcast Corp. Cablevison Systems Corp. AT&T, Inc. ) ) ) ) ) Complaint, Request for Investigation, Injunction, and Other Relief Submitted by Public Knowledge, Center for Digital Democracy, TURN-The Utility Reform Network, Consumers Union, Consumer Action, and Consumer Federation of America I. Introduction 1. This complaint focuses on the failure of several cable companies to adequately disclose the extent to which they are sharing and combining consumer information, which rises to the level of a deceptive practice. Further, cable operators fail to comply with privacy laws. Since consumers expect that cable operators are complying with the law, their failure to do so is also deceptive to consumers. II. Parties 2. Public Knowledge is a nonprofit organization located in Washington, D.C that is dedicated to promoting innovation, creativity, and competition in the technology industry. As part of this mission, Public Knowledge regularly files complaints with regulatory agencies to enforce violations of laws designed to protect consumers and competition. 3. The Center for Digital Democracy is a nonprofit organization located in Washington, DC and is recognized as one of the leading consumer protection and privacy organizations in the United States. Since its founding in 2001 (and prior to that through its predecessor organization, the Center for Media Education), CDD has been at the forefront of research, public education, and advocacy protecting consumers in the digital age. 4. TURN is a nonprofit organization located in California and champions the cleanest energy and highest quality phone service at the lowest prices possible for residential customers, low-income households, and small businesses through legal advocacy at the California Public Utilities Commission, state and federal policy development, and community organizing throughout California. 5. Consumers Union is a nonprofit located in Washington, DC that serves consumers through unbiased product testing and ratings, research, journalism, public education, and advocacy. 6. Consumer Action is a nonprofit located in California that empowers underrepresented consumers nationwide to assert their rights in the marketplace and financially prosper through multilingual financial education materials, community outreach, and issuefocused advocacy. 7. Consumer Federation of America is an association of non-profit consumer organizations located in Washington, DC that was established in 1968 to advance the consumer interest through research, advocacy, and education. 8. Comcast Corporation is an American multinational mass media company incorporated in Philadelphia, Pennsylvania.1 Comcast has its principle place of business at One Comcast Center, 1701 John F. Kennedy Blvd., Philadelphia, Pennsylvania 19103.2 9. Cablevison Systems Corp. is a telecommunications and media company with a portfolio of operations that includes digital television, voice and high-speed Internet services and local media and programming properties. Cablevision has its principle place of business at 1111 Stewart Avenue Bethpage, NY 11714-3581.3 10. AT&T, Inc. is an American multinational telecommunications corporation. AT&T, Inc. has its principle place of business at 208 S. Akard St. Dallas, TX 75202.4 III. Factual Background 11. Exactly how and to what extent cable operators are leveraging their customer’s data has been extensively documented in a recent report by the Center for Digital Democracy.5 12. Cable operators increasingly gather their customers’ personal information, share and combine that information with third parties, and use it to target customers for advertising on an individual level. 1 Comcast Articles of Incorporation, available at http://www.cmcsa.com/documentdisplay.cfm?DocumentID=5986 2 Comcast Contact Information, available at http://corporate.comcast.com/contact-information 3 Cablevison Corporate Information, http://www.cablevision.com/investor/index.jsp 4 AT&T Investor Relations, available at http://www.att.com/gen/investor-relations?pid=5598 5 Center for Digital Democracy, Big Data is Watching: Growing Digital Data Surveillance of Consumers by ISPs and Other Leading Video Providers Center for Digital Democracy (March 23, 2016), available at https://www.democraticmedia.org/sites/default/files/field/publicfiles/2016/ispbigdatamarch2016.pdf (Appendix A) 13. The programs described below illustrate how cable providers give advertisers the ability to easily access and use a customer’s information, without that customer knowing the extent to which that information is being used. 14. While these practices are broadly indicative of the ways many cable operators improperly use subscriber data, AT&T, Cablevision, and Comcast are among the most egregious. The FTC should investigate these practices and find that they are decptive. 15. As the Wall Street Journal explained, “Companies like Simulmedia” that specialize in targeted TV advertising “emerged in the past few years once cable and satellite companies began licensing out their set-top box data.”6 16. Once third parties are given access to confidential viewing data, they can combine it with still more data sources to create an even more comprehensive look into a person’s life. For example, one company has combined TV viewing data with information from retail loyalty cards.7 17. AT&T, Comcast, and Cablevision attempt to disclose the extent to which they use and share customer data through disclosures that state that they “may” share data with third parties.8 Such disclosures do not convey to consumers that they are engaging in the practices described below. A. AT&T is Combining and Sharing Customer Data with Third Parties to Target Them for Advertising. 18. AT&T’s TV Blueprint, for example, “gives advertisers working with AT&T the ability to reach people based on factors like device, operating system, whether or not they’re heavy data users or the status of their carrier contract,” using “sophisticated second-by-second set- top box data” and other information.9 19. AT&T pulls data “from millions of set-top boxes” and analyzes consumer viewing history and uses these data to target consumers based on their viewing profile.10 6 Steven Perlberg, Targeted Ads? TV Can Do That Now Too, Wall Street Journal (Nov. 20, 2014), http://www.wsj.com/articles/targeted-ads-tv-can-do-that-now-too-1416506504. 7 Id. 8 See e.g. Cox Communications, Your Privacy Rights as a Cox Customer and Related Information, available at https://www.cox.com/aboutus/policies/annual-privacy-notice.html#use (“We may combine Personally Identifiable Information with demographic and other information for purposes consistent with this Notice.”) 9 Kelly Liyakasa, “AT&T AdWorks Officiates Marriage Between Mobile Data And TV Audiences,” AdExchanger, 30 July 2014, http://adexchanger.com/digital-tv/att-adworksofficiates-marriage-between-mobile-data-and-tv-audiences/. 10 “AT&T's Mike Welch on Programmatic, Addressable and the Coming Multi-billion-dollar Advanced Ad Biz.” B. Cablevision is Combining and Sharing Customer Data with Third Parties to Target Them for Advertising. 20. Companies like Cablevision leverage granular data and precise details of household viewing behavior, and combine it with third-party data covering other intimate details of consumers’ lives to analyze and target specific individuals with video advertising across a range of screens. 21. In their own words, “this set-top box level targeting lets marketers target customers that fit particular trends, profiles, demographics and attributes, and they can also pair the Cablevision data with their own or third-party data.”11 C. Comcast is Combining and Sharing Customer Data with Third Parties to Target Them for Advertising. 22. Cablevision and AT&T are not alone in their pervasive use of consumer data. In 2015, Comcast acquired Visible World, which boasts of using data “from millions of enabled Smart TVs” as part of its advertising targeting service.12 23. Data points used to target consumers include income, ethnicity, education level, what kind of car they drive, purchase history, and location of their residence. Further, Comcast has acquired companies like This Technology,13 which are capable of inserting personalized content into network streams—including advertising messages tailored for specific individuals.14 IV. Legal Analysis A. The FTC’s Section 5 Authority 24. The FTC Act prohibits unfair and deceptive acts and practices, and empowers the Commission to enforce the Act’s prohibitions.15 These powers are described in FTC Policy Statements on Deception and Unfairness.16 11 Daisy Whitney, “Cablevision Finds Success with Census-Level, Impression-Based Ads,” Beet.TV, June 16, 2015, available at http://www.beet.tv/2015/06/kristindolan.html 12 Wayne Friedman, “Comcast Buys Visible World, Expands Addressable TV Advertising,” Media Daily News, 4 June 2015, http://www.mediapost.com/publications/article/251336/comcast-buys-visible-world-expandsaddressable-tv.html. 13 Greg Avery, “Comcast will Fold Denver Technology Company into LoDo Tech Hub,” Denver Business Journal, Aug 26, 2015, http://www.bizjournals.com/denver/blog/boosters_bits/2015/08/comcast-buys-denvertechnology-company.html. 14 This Technology, “VEX Manifest Manipulator,” http://thistech.com/vex-manifestmanipulator. 15 See 15 U.S.C. § 45 (2010) 25. A trade practice is unfair if it “causes or is likely to cause substantial injury to consumers which is not reasonably avoidable by consumers themselves and not outweighed by countervailing benefits to consumers or to competition.”17 26. The injury must be “substantial.”18 Typically, this involves monetary harm, but may also include “unwarranted health and safety risks.”19 Emotional harm and other “more subjective types of harm” generally do not make a practice unfair.20 Secondly, the injury “must not be outweighed by an offsetting consumer or competitive benefit that the sales practice also produces.”21 Thus the FTC will not find a practice unfair “unless it is injurious in its net effects.”22 Finally, “the injury must be one which consumers could not reasonably have avoided.”23 This factor is an effort to ensure that consumer decision making still governs the market by limiting the FTC to act in situations where seller behavior “unreasonably creates or takes advantage of an obstacle to the free exercise of consumer decision making.”24 Sellers may not withhold from consumers important price or performance information, engage in coercion, or unduly influence highly susceptible classes of consumers.25 27. An act or practice is deceptive if it involves a representation, omission, or practice that is likely to mislead the consumer acting reasonably under the circumstances, to the consumer’s detriment.”26 28. There are three elements to a deception claim. First, there must be a representation, omission, or practice that is likely to mislead the consumer.27 The relevant inquiry for this 16 Fed. Trade Comm’n, FTC Policy Statement on Deception (1983), available at http://www.ftc.gov/bcp/policystmt/ad-decept.htm (hereinafter FTC Deception Policy); Fed. Trade Comm’n, FTC Policy Statement on Unfairness (1980), available at http://www.ftc.gov/bcp/policystmt/ad-unfair.htm (hereinafter FTC Unfairness Policy). 17 15 U.S.C. § 45(n); see, e.g., Fed. Trade Comm’n v. Seismic Entertainment Productions, Inc., Civ. No. 1:04-CV- 00377 (Nov. 21, 2006) (finding that unauthorized changes to users’ computers that affected the functionality of the computers as a result of Seismic’s anti-spyware software constituted a “substantial injury without countervailing benefits.”). 18 FTC Unfairness Policy, supra. 19 Id.; see, e.g., Fed. Trade Comm’n v. Information Search, Inc., Civ. No. 1:06-cv-01099 (Mar. 9, 2007) (“The invasion of privacy and security resulting from obtaining and selling confidential customer phone records without the consumers’ authorization causes substantial harm to consumers and the public, including, but not limited to, endangering the health and safety of consumers.”). 20 FTC Unfairness Policy, supra. 21 Id. 22 Id. 23 Id. 24 Id. 25 Id. 26 FTC Deception Policy, supra factor is not whether the act or practice actually misled the consumer, but rather whether it is likely to mislead.28 29. Second, the act or practice must be considered from the perspective of a reasonable consumer.29 “The test is whether the consumer’s interpretation or reaction is reasonable.”30 The FTC will look at the totality of the act or practice and ask questions such as “how clear is the representation? How conspicuous is any qualifying information? How important is the omitted information? Do other sources for the omitted information exist? How familiar is the public with the product or service?”31 30. Finally, the representation, omission, or practice must be material.32 Essentially, the information must be important to consumers. The relevant question is whether consumers would have chosen another product if the deception had not occurred.33 Express claims will be presumed material.34 Materiality is presumed for claims and omissions involving “health, safety, or other areas with which the reasonable consumer would be concerned.”35 31. The FTC presumes that an omission is material where “the seller knew, or should have known, that an ordinary consumer would need omitted information to evaluate the product or service, or that the claim was false . . . because the manufacturer intended the information or omission to have an effect.”36 32. The FTC has previously found that a company may not repurpose user data for a use other than the one for which the user’s data was collected without first obtaining the user’s “express affirmative consent.”37 B. Federal Cable Privacy Laws 27 7 FTC Deception Policy, supra ; see, e.g., Fed Trade Comm’n v. Pantron I Corp., 33 F.3d 1088 (9th Cir. 1994) (holding that Pantron’s representation to consumers that a product was effective at reducing hair loss was materially misleading, because according to studies, the success of the product could only be attributed to a placebo effect, rather than on scientific grounds). 28 FTC Deception Policy, supra. 29 Id. 30 Id. 31 Id. 32 Id. 33 Id. 34 Id. 35 Id. 36 Id. 37 In the Matter of Google, Inc.; FTC File No. 102 3136 (Oct. 13, 2011) (Decision and Order), http://www.ftc.gov/sites/default/files/documents/cases/2011/10/111024googlebuzzdo.pdf. 33. 47 U.S.C. §551 and 47 U.S.C. § 338(i) require that cable and satellite providers obtain the “written or electronic consent of the subscriber concerned” prior to the collection and use of that information for advertising purposes.38 34. Cable operators are also required to provide a written statement to their subscribers, which clearly and conspicuously informs the subscriber of the nature of the use of their personally identifiable information.39 35. Through these rules, Congress and the Federal Communications Commission have emphasized the importance of giving consumer’s control over how their information is being used. 36. Congress included a right to sue and a liquidated damages clause of $1K/day/violation. This reflects the Congressional assessment that the harm is "substantial." C. Count I: AT&T, Comcast, and Cablevision Deceive Customers by Failing to Comply with Laws Requiring Consent Prior to the Sharing of Customer Information 37. Cable providers require consumers to opt-out of the use of their information, including personally identifiable information (PII). This “consent” regime is in direct conflict with the federal privacy rules, which require cable providers to obtain the “written or electronic consent of the subscriber concerned” prior to the collection and use of that information for advertising.40 38. Opt-out consent is an insufficient means for cable providers to obtain the consent required under the privacy rules. 39. The FCC requires carriers to obtain consent via opt-in for use of PII and by logical extension cable providers should not be allowed to do so without a similar requirement. 40. In 2007, the FCC determined (1) PII is customer proprietary network information (CPNI) and (2) carriers must to obtain opt-in consent from customers before sharing CPNI with joint venture partners and independent contractors for marketing purposes.41 38 47 U.S.C. § 551(b)-(c); 47 U.S.C. § 338(i)(3)(A) (emphasis added). 47 U.S.C. § 551(a)(1)(A); 47 U.S.C. § 338(i)(1)(A). 40 47 U.S.C. § 551(b)-(c). 41 Implementation of the Telecommunications Act of 1996: Telecommunications Carriers’ Use of Customer Proprietary Network Information and Other Customer Information; IP-Enabled Services, Report and Order and Further Notice of Proposed Rulemaking, 22 FCC Rcd 6927, para 45 (2007) (2007 CPNI Order). 39 41. In addition, the FCC has explicitly stated that the Cable Communications Policy Act, which created 47 U.S.C. §551, does not “employ an opt-out approach but rather requires an individual’s explicit consent before private information is disclosed or employed for secondary purposes.”42 Accordingly, cable operators cannot continue their current practice of using PII without the customer first opting in. D. Count II: AT&T, Comcast, and Cablevision Do Not Adequately Disclose to Consumers the Extent to Which They Share and Combine Data for Targeting Advertising 42. Most subscribers don’t fully grasp the extent to which pay-TV companies collect data about their viewing habits, monetize it in various way, and even target ads to individual households in much the same way that online companies can serve up individuallytargeted ads.43 43. Although many providers include statements in their privacy policies indicating that they may use PII in combination with third party data for advertising purposes,44 these “disclosures” are wholly inadequate. 44. Cable providers disclose that they may share and combine data for advertising purposes, but leave out the extent to which they are combining and sharing information, even when that information is known to the cable companies. 45. Privacy policies do not inform consumers of the extent to which their information is being shared and combined with other data to target advertising on an individual level, or of any of the other practices described above. V. Prayer for Investigation and Relief 46. Public Knowledge, Center for Digital Democracy, TURN, Consumer Watchdog, and Consumer Action urges the FTC to investigate AT&T, Comcast, and Cablevison, and enjoin their deceptive data collection and sharing practices. 47. Specifically, complainants requests the FTC to: a) Initiate an investigation of AT&T, Comcast, and Cablevison’s data collection, sharing, and advertising practices; 42 Id. Philip Elliott, New Political TV Ads Can Target Individual Homes, PBS (Feb. 17, 2014), http://www.pbs.org/newshour/rundown/new-political-tv-ads-can-target-individual-homes. 44 See e.g. Cox Communications, Your Privacy Rights as a Cox Customer and Related Information, available at https://www.cox.com/aboutus/policies/annual-privacy-notice.html#use (“We may combine Personally Identifiable Information with demographic and other information for purposes consistent with this Notice.”) 43 b) Investigate AT&T, Comcast, and Cablevison’s violation of the Cable Communications Privacy Act, codified at 47 U.S.C. §551; c) Investigate other companies engaged in similar practices, and d) Provide such other relief as the FTC finds necessary and appropriate. Respectfully submitted, /s/ Dallas Harris Policy Fellow Public Knowledge /s/Jeffrey Chester Executive Director Center for Digital Democracy /s/ John Simpson Privacy Project Director Consumer Watchdog /s/ Linda Sherry Director, National Priorities Consumer Action /s/ Mark Toney Executive Director TURN—The Utility Reform Network /s/ Susan Grant Director of Consumer Protection and Privacy