Case 2:17-cv-00758 Document 1-3 Filed 02/06/17 Page 1 of 17 PageID: 15 UNITED STATES DISTRICT COURT DISTRICT OF NEW JERSEY FEDERAL TRADE COMMISSION, CHRISTOPHER S. PORRINO, Attorney General of the State of New Jersey, and STEVE C. LEE, Director of the New Jersey Division of Consumer Affairs, Plaintiffs, Case No._________________ STIPULATED ORDER FOR PERMANENT INJUNCTION AND MONETARY JUDGMENT v. VIZIO, INC., a Delaware corporation, and VIZIO INSCAPE SERVICES, LLC, a Delaware limited liability company, Defendants. Plaintiffs, the Federal Trade Commission (“FTC” or “Commission”), Christopher S. Porrino, Attorney General of the State of New Jersey (“Attorney General”), and Steve C. Lee, Director of the New Jersey Division of Consumer Affairs (“Director”) (collectively, “Plaintiffs”), filed a Complaint for permanent injunction and other equitable and monetary relief in this matter against defendants VIZIO, Inc. (“VIZIO”) and VIZIO Inscape Services, LLC (“VIZIO Inscape Services”) (collectively, “Defendants”). The FTC brought its claims pursuant to Section 13(b) of the Federal Trade Commission Act, 15 U.S.C. § 53(b) (“FTC Act”), and the Attorney General and the Director brought their claims pursuant to the New Jersey Consumer Fraud Act, N.J. Stat. Ann. § 56:8-1 et seq. (“CFA”). Plaintiffs and Defendants stipulate to the entry of this Stipulated Order for Permanent Injunction and Monetary Judgment (“Order”) to resolve all matters in dispute in this action. THEREFORE, IT IS ORDERED as follows: Case 2:17-cv-00758 Document 1-3 Filed 02/06/17 Page 2 of 17 PageID: 16 FINDINGS 1. This Court has jurisdiction over this matter. 2. The Complaint charges that Defendants participated in deceptive and unfair acts or practices in violation of Section 5 of the FTC Act, 15 U.S.C. § 45, and unconscionable commercial practices, misrepresentations, false promises, and omissions of material fact in violation of the CFA, N.J. Stat. Ann. § 56:8-2, in connection with Defendants’ unfair collection and sharing of consumers’ Viewing Data and deception concerning Defendants’ “Smart Interactivity” feature. 3. Defendants neither admit nor deny any of the allegations in the Complaint, except as specifically stated in this Order. Only for the purpose of this action, Defendants admit the facts necessary to establish jurisdiction. 4. Defendants waive any claim they may have under the Equal Access to Justice Act, 28 U.S.C. § 2412, concerning the prosecution of this action through the date of this Order, and agree to bear their own costs and attorneys’ fees. 5. The parties waive all rights to appeal or otherwise challenge or contest the validity of this Order. DEFINITIONS For purposes of this Order, the following definitions apply: A. “Covered Information” means information collected from a VIZIO internet- connected device, including, but not limited to, (1) product registration data; (2) Viewing Data; (3) Internet Protocol (“IP”) address; (4) User ID or other identifiers; and (5) geolocation or Case 2:17-cv-00758 Document 1-3 Filed 02/06/17 Page 3 of 17 PageID: 17 information that can be used to derive geolocation. Covered Information also means information combined with any of (1) through (5) above. B. “Defendants” means VIZIO, Inc., and its successors and assigns, and VIZIO Inscape Services, LLC, and its successors and assigns. C. “Smart TV” means any of Defendants’ televisions or monitors that have the ability to connect to the internet. D. “Viewing Data” means any information or data collected or planned to be collected from a Smart TV about the content viewed on that television, or any reports or data derived therefrom and any information combined with such data. ORDER I. PROHIBITED MISLEADING REPRESENTATIONS IT IS ORDERED that Defendants and Defendants’ officers, agents, employees, and attorneys, directly or through any corporation, subsidiary, division, website, or other device or affiliate owned or controlled by Defendants, in or affecting commerce, must not misrepresent in any manner, expressly or by implication: A. The extent to which Defendants collect, use, maintain, or protect the privacy, confidentiality, or security of any Covered Information; or B. II. The purpose of their collection, use, or disclosure of Covered Information. NOTICE AND AFFIRMATIVE EXPRESS CONSENT PROVISION IT IS FURTHER ORDERED that Defendants and Defendants’ officers, agents, employees, and attorneys, and all other persons in active concert or participation with any of them, who receive actual notice of this Order, in connection with any collection of Viewing Data for any product or service, prior to collecting any Viewing Data must: Case 2:17-cv-00758 Document 1-3 Filed 02/06/17 Page 4 of 17 PageID: 18 A. Prominently disclose to the consumer, separate and apart from any “privacy policy,” “terms of use” page, or other similar document: (1) the types of Viewing Data that will be collected and used, (2) the types of Viewing Data that will be shared with third parties; (3) the identity or specific categories of such third parties; and (4) all purposes for Defendants’ sharing of such information; B. Obtain the consumer’s affirmative express consent (1) at the time the disclosure in Part II.A is made and (2) upon any material changes to the terms disclosed in Part II.A; and C. Provide instructions, at any time the consumer’s affirmative express consent is sought under Part II.B, for how the consumer may revoke consent to collection of Viewing Data. D. For the purposes of this Order, “Prominently” means that a required disclosure is difficult to miss (i.e., easily noticeable) and easily understandable by ordinary consumers, including in all of the following ways: 1. A visual disclosure, by its size, contrast, location, the length of time it appears, and other characteristics, must stand out from any accompanying text or other visual elements so that it is easily noticed, read, and understood. 2. An audible disclosure, including by telephone or streaming video, must be delivered in a volume, speed, and cadence sufficient for ordinary consumers to easily hear and understand it. 3. In any communication using an interactive electronic medium, such as in connection with an update to device firmware, the disclosure must be unavoidable. 4. The disclosure must use diction and syntax understandable to ordinary consumers and must appear in each language in which the triggering representation appears. Case 2:17-cv-00758 Document 1-3 Filed 02/06/17 Page 5 of 17 PageID: 19 5. The disclosure must comply with these requirements in each medium through which it is received, including all electronic devices and face-to-face communications. 6. The disclosure must not be contradicted or mitigated by, or inconsistent with, anything else in the communication. 7. When the representation or sales practice targets a specific audience, such as children, the elderly, or the terminally ill, “ordinary consumers” includes reasonable members of that group. III. DATA DELETION IT IS FURTHER ORDERED that within 120 days after entry of this Order, Defendants and Defendants’ officers, agents, employees, and attorneys, and all other persons in active concert or participation with any of them, who receive actual notice of this Order, must destroy Viewing Data that has been collected prior to March 1, 2016. Provided, however, that such Viewing Data need not be destroyed, and may be disclosed, (A) to the extent requested by a government agency or required by law, regulation, or court order, including without limitation as required by rules applicable to the safeguarding of evidence in pending litigation, or (B) to the extent a user of a television associated with the Viewing Data has affirmatively consented to the collection, use, or disclosure thereof, consistent with Part II of this order. IV. MANDATED PRIVACY PROGRAM IT IS FURTHER ORDERED that Defendants must, no later than the effective date of this Order, establish and implement, and thereafter maintain, a comprehensive privacy program that is reasonably designed to (1) address privacy risks related to the development and management of new and existing products and services for consumers, and (2) protect the privacy and confidentiality of Covered Information collected directly or indirectly by Case 2:17-cv-00758 Document 1-3 Filed 02/06/17 Page 6 of 17 PageID: 20 Defendants. Such program, the content and implementation of which must be documented in writing, must contain controls and procedures appropriate to Defendants’ size and complexity, the nature and scope of Defendants’ activities, and the sensitivity of the Covered Information, including: A. The designation of an employee or employees to coordinate and be responsible for the privacy program; B. The identification of reasonably foreseeable risks, both internal and external, that could result in Defendants’ unauthorized collection, use, or disclosure of Covered Information and an assessment of the sufficiency of any safeguards in place to control these risks. At a minimum, this risk assessment should include consideration of risks in each area of relevant operation, including: (1) employee training and management, including training on the requirements of this Order, and (2) product design, development, and research; C. The design and implementation of reasonable controls and procedures to address such risks and regular testing or monitoring of the effectiveness of those controls and procedures; D. The development and use of reasonable steps to select and retain service providers capable of appropriately protecting the privacy of Covered Information they receive from Defendants and requiring service providers, by contract, to implement and maintain appropriate privacy protections for such Covered Information; and E. The evaluation and adjustment of Defendants’ privacy program in light of the results of the testing and monitoring required by sub-provision C, any changes to Defendants’ operations or business arrangements, or any other circumstances that Defendants know or have reason to know may have an impact on the effectiveness of the privacy program. Case 2:17-cv-00758 Document 1-3 Filed 02/06/17 Page 7 of 17 PageID: 21 V. PRIVACY ASSESSMENTS BY A THIRD PARTY IT IS FURTHER ORDERED that, in connection with its compliance with the Provision of this Order titled Mandated Privacy Program, Defendants must obtain initial and biennial assessments (“Assessments”): A. The Assessments must be completed by a qualified, objective, independent third- party professional, who uses procedures and standards generally accepted in the profession. An individual qualified to prepare such Assessments must have a minimum of 3 years of experience in the field of privacy and data protection. All individuals selected to complete such Assessments must be approved by the Associate Director for Enforcement, Bureau of Consumer Protection, Federal Trade Commission in his or her sole discretion. Any decision not to approve an individual selected to conduct such Assessments must be accompanied by a writing setting forth in detail the reasons for denying such approval. B. The reporting period for the Assessments must cover: (1) the first 180 days after the issuance date of the Order for the initial Assessment, and (2) each 2-year period thereafter for 20 years after the issuance date of the Order for the biennial Assessments. C. Each Assessment must: 1. Set forth the specific privacy controls that Defendants have implemented and maintained during the reporting period; 2. Explain how such privacy controls are appropriate to Defendants’ size and complexity, the nature and scope of Defendants’ activities, and the sensitivity of the Covered Information; Case 2:17-cv-00758 Document 1-3 Filed 02/06/17 Page 8 of 17 PageID: 22 3. Explain how the privacy controls that have been implemented meet or exceed the protections required by the Provision of this Order titled Mandated Privacy Program; and 4. Certify that the privacy controls are operating with sufficient effectiveness to provide reasonable assurance to protect the privacy of Covered Information and that the controls have so operated throughout the reporting period. D. Each Assessment must be completed within 60 days after the end of the reporting period to which the Assessment applies. Defendants must provide the initial Assessment to Plaintiffs within 10 days after the Assessment has been completed. Defendants must retain all subsequent biennial Assessments, at least until the Order terminates. Defendants must submit any biennial Assessments to Plaintiffs within 10 days of a request from a representative of Plaintiffs. VI. MONETARY RELIEF IT IS FURTHER ORDERED that: A. Defendants must pay to the Commission $1,500,000 within [8] days of the effective date of this Order by electronic fund transfer in accordance with instructions provided by a representative of the Commission. B. Defendants shall also pay the New Jersey Division of Consumer Affairs $1,000,000.00, which is comprised of $915,940.00 in civil penalties pursuant to N.J. Stat. Ann. § 56:8-13, and $84,060.00 in attorneys’ fees and investigative costs pursuant to N.J. Stat. Ann. § 56:8-11, -19 (“New Jersey Monetary Relief”). C. Defendants shall pay $700,000 of the New Jersey Monetary Relief to the New Jersey Division of Consumer Affairs within [8] days of the effective date of this Order by credit Case 2:17-cv-00758 Document 1-3 Filed 02/06/17 Page 9 of 17 PageID: 23 card, wire transfer, bank check, money order, certified check, or cashier’s check payable to “New Jersey Division of Consumer Affairs” and shall be forwarded to: Case Management Tracking, Division of Consumer Affairs, 124 Halsey Street – 7th Floor, Newark, New Jersey 07101. D. The balance of the New Jersey Monetary Relief, totaling $300,000, shall be suspended and automatically vacated at the expiration of five (5) years from the effective date of this order (“Suspended Penalty”), provided: a. Defendants comply in all material respects with Sections I through VI and Sections VIII through XI of this Order; b. E. Defendants do not engage in acts or practices in violation of the CFA. In the event Defendants fail to comply with Section VI, Paragraph D of this Order, the New Jersey Division of Consumer Affairs (“Division”) shall provide Defendants with written notice of default or noncompliance, seeking payment of any unpaid portion of the New Jersey Monetary Relief, as well as the Suspended Penalty (“Notice of Noncompliance”). In any such Notice of Noncompliance, the Division shall provide Defendants with the specific details of the alleged default or noncompliance, as well as any supporting documents, and shall afford Defendants a fifteen (15) day period from receipt of the Notice of Noncompliance to cure the default or noncompliance. The Division may move on short notice or by Order to Show Cause to have a judgment entered for any unpaid portion of the New Jersey Monetary Relief as well as the Suspended Penalty. VII. ADDITIONAL MONETARY PROVISIONS IT IS FURTHER ORDERED that: A. Defendants relinquish dominion and all legal and equitable right, title, and interest Case 2:17-cv-00758 Document 1-3 Filed 02/06/17 Page 10 of 17 PageID: 24 in all assets transferred pursuant to this Order and may not seek the return of any assets. B. The facts alleged in the Complaint will be taken as true, without further proof, in any subsequent civil litigation by or on behalf of any of Plaintiffs to enforce their rights to any payment pursuant to this Order, such as a nondischargeability complaint in any bankruptcy case. C. The facts alleged in the Complaint establish all elements necessary to sustain an action by or on behalf of any of Plaintiffs pursuant to Section 523(a)(2)(A) of the Bankruptcy Code, 11 U.S.C. § 523(a)(2)(A), and this Order will have collateral estoppel effect for such purposes. D. Defendants acknowledge that their Taxpayer Identification Numbers, which Defendants have previously submitted to the Commission, may be used for collecting and reporting on any delinquent amount arising out of this Order, in accordance with 31 U.S.C. § 7701. VIII. ACKNOWLEDGMENTS OF THE ORDER IT IS FURTHER ORDERED that Defendants obtain acknowledgments of receipt of this Order: A. Defendants, within 10 days of entry of this Order, must submit to Plaintiffs an acknowledgment of receipt of this Order under sworn penalty of perjury. B. For 5 years after the issuance date of this Order, Defendants must deliver a copy of this Order to: (1) all principals, officers, and directors; (2) all employees, agents, and representatives who participate in conduct related to the subject matter of the Order; and (3) any business entity resulting from any change in structure as set forth in the Provision titled Compliance Report and Notices. Delivery must occur within 10 days after the effective date of this Order for current personnel. For all others, delivery must occur before they assume their Case 2:17-cv-00758 Document 1-3 Filed 02/06/17 Page 11 of 17 PageID: 25 responsibilities. C. From each individual or entity to which a Defendant delivered a copy of this Order, that Defendant must obtain, within 30 days, a signed and dated acknowledgment of receipt of this Order. IX. COMPLIANCE REPORTING IT IS FURTHER ORDERED that Defendants make timely submissions to Plaintiffs: A. One year after the issuance date of this Order, Defendants must submit a compliance report, sworn under penalty of perjury, in which it must: (a) identify the primary physical, postal, and email address and telephone number, as designated points of contact, which representatives of Plaintiffs may use to communicate with Defendants; (b) identify all of Defendants’ businesses by all of their names; (c) describe the activities of each business, including the goods and services offered; (d) describe in detail whether and how Defendants are in compliance with each Provision of this Order, including a discussion of all of the changes Defendants made to comply with the Order; and (e) provide a copy of each Acknowledgment of the Order obtained pursuant to this Order to Plaintiffs, unless previously submitted. B. Defendants must submit a compliance notice, sworn under penalty of perjury, within 14 days of any change in the following: (a) any designated point of contact; or (b) the structure of any Corporate Defendants or any entity that Defendants have any ownership interest in or controls directly or indirectly that may affect compliance obligations arising under this Order, including: creation, merger, sale, or dissolution of the entity or any subsidiary, parent, or affiliate that engages in any acts or practices subject to this Order. C. Defendants must submit notice of the filing of any bankruptcy petition, insolvency proceeding, or similar proceeding by or against such Defendants within 14 days of its Case 2:17-cv-00758 Document 1-3 Filed 02/06/17 Page 12 of 17 PageID: 26 filing. D. Any submission to Plaintiffs required by this Order to be sworn under penalty of perjury must be true and accurate and comply with 28 U.S.C. § 1746, such as by concluding: “I declare under penalty of perjury under the laws of the United States of America that the foregoing is true and correct. Executed on: _____” and supplying the date, signatory’s full name, title (if applicable), and signature. E. Unless otherwise directed by a Commission representative in writing, all submissions to the Commission pursuant to this Order must be emailed to DEbrief@ftc.gov or sent by overnight courier (not the U.S. Postal Service) to: Associate Director for Enforcement, Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue, NW, Washington, DC 20580. The subject line must begin: In re VIZIO, Inc. F. Unless otherwise directed by an Attorney General and/or Director representative in writing, all submissions to the Attorney General and/or Director pursuant to this Order must be emailed to cmt@dca.lps.state.nj.us or sent by overnight courier (not the U.S. Postal Service) to: Case Management Tracking, Division of Consumer Affairs, 124 Halsey Street – 7th Floor, Newark, New Jersey 07101. The subject line must begin: In re VIZIO, Inc. X. RECORDKEEPING IT IS FURTHER ORDERED that Defendants must create certain records for 20 years after the issuance date of the Order, and retain each such record for 5 years, unless otherwise specified below. Specifically, Defendants, in connection with the collection, maintenance, or storage of personal information from or about consumers, must create and retain the following records: A. Accounting records showing the revenues from all goods or services sold, the Case 2:17-cv-00758 Document 1-3 Filed 02/06/17 Page 13 of 17 PageID: 27 costs incurred in generating those revenues, and resulting net profit or loss; B. Personnel records showing, for each person providing services in relation to any aspect of the Order, whether as an employee or otherwise, that person’s: name; addresses; telephone numbers; job title or position; dates of service; and (if applicable) the reason for termination; C. Copies or records of all consumer complaints regarding Defendants’ collection, use, maintenance, or protection of the privacy, confidentiality, or security of any Covered Information, whether received directly or indirectly, such as through a third party, and any response; D. A copy of each representation by Defendants that describes Defendants’ collection, use, maintenance, or protection of the privacy, confidentiality, or security of any Covered Information. E. For 5 years after the date of preparation of each Assessment required by this Order, all materials relied upon to prepare the Assessment, whether prepared by or on behalf of Defendants, including all plans, reports, studies, reviews, audits, audit trails, policies, training materials, and assessments, and any other materials concerning Defendants’ compliance with related Provisions of this Order, for the compliance period covered by such Assessment; and F. All records necessary to demonstrate full compliance with each provision of this Order, including all submissions to Plaintiffs. XI. COMPLIANCE MONITORING IT IS FURTHER ORDERED that, for the purpose of monitoring Defendants’ compliance with this Order: A. Within 10 days of receipt of a written request from a representative of Plaintiffs, Case 2:17-cv-00758 Document 1-3 Filed 02/06/17 Page 14 of 17 PageID: 28 Defendants must: submit additional compliance reports or other requested information, which must be sworn under penalty of perjury, and produce records for inspection and copying. B. For matters concerning this Order, representatives of the Plaintiffs are authorized to communicate directly with Defendants. Defendants must permit representatives of Plaintiffs to interview anyone affiliated with any Respondent who has agreed to such an interview. The interviewee may have counsel present. C. Plaintiffs may use all other lawful means, including posing through its representatives as consumers, suppliers, or other individuals or entities, to Defendants or any individual or entity affiliated with Defendants, without the necessity of identification or prior notice. Nothing in this Order limits Plaintiffs’ lawful use of compulsory process, pursuant to Sections 9 and 20 of the FTC Act, 15 U.S.C. §§ 49, 57b-1, and the CFA, N.J. Stat. Ann. § 56:83, -4. XII. RETENTION OF JURISDICTION IT IS FURTHER ORDERED that this Court retain jurisdiction of this matter for purposes of construction, modification and enforcement of this Order. SO ORDERED this _______ day of _______________________________, 2017 ___________________________________ UNITED STATES DISTRICT JUDGE Case 2:17-cv-00758 Document 1-3 Filed 02/06/17 Page 15 of 17 PageID: 29 SO STIPULATED AND AGREED BY: FOR PLAINTIFFS: FEDERAL TRADE COMMISSION . m2: Dated:ljifg?. ,2017 IN .MO MEGAN E. COX Federal Trade Commission 600 Avenue NW. Washington, DC 20580 mcoxl Tel: (202) 326?2949 CHRISTOPHER S. PORRINO, Attorney General of the State of New Jersey, and STEVE C. LEE, Director of the New Jersey Division of Consumer Affairs Dated: ?3 92017 . SW 1""3 a he IDEt?isoN . l. SIEBERS RUSSELL M. SMITH, JR. Deputy Attorneys General State of New Jersey Department of Law Public Safety Division of Law 124 Halsey Street, 5th Floor Newark, New Jersey 07101 Tel: (973) 648?2689 .f Case 2:17-cv-00758 Document 1-3 Filed 02/06/17 Page 16 of 17 PageID: 30 FOR DEFENDANTS: LATHAM WATKINS LLP BYW I Dated: 2016 KEVIN M. MCDONOUGH N.J. Bar No. 41892005 Latham Watkins LLP 885 Third Avenue New York, NY 10022 kevin.mcdon0ugh@1w.com Tel: (212) 906?1246 gag/ma JENNIFER C. ARCHIE (pro hac vice to be filed) Latham Watkins LLP 555 11th St. NW, Suite 1000 Washington DC. 20004 jennifer.archie@lw.com Tel: (202) 637?2205 Case 2:17-cv-00758 Document 1-3 Filed 02/06/17 Page 17 of 17 PagelD: 31 VIZIO, INC. By: 04? Dated: Wm ,2016 Name: Robert L. Brinkman Title: Chief Administrative Of?cer and Assistant Secretary Address: 39 Tesla, Irvine, California 92618 E-Mail: rob.brinkman@vizio.com Tel: (949)428-2585 VIZIO INSCAPE SERVICES, LLC 13W WC CM Dated: beam/14m ,2016 Name: Robert L. Brinkman Title: Chief Administrative Of?cer and Secretary Address: 39 Tesla, Irvine, California 92618 E-Mail: rob.brinkman@vizio.com Tel: (949) 428-2585