Careful what you say around your TV. It may be listening. And blabbing.
A single sentence buried in a dense “privacy policy” for Samsung’s Internet-connected SmartTV advises users that its nifty voice command feature might capture more than just your request to play the latest episode of Downton Abbey.
“Please be aware that if your spoken words include personal or other sensitive information, that information will be among the data captured and transmitted to a third party,” the policy reads.
So be advised: If you’re too lazy to pick up the remote, you may want to keep your conversation with the TV as direct and non-incriminating as possible. Don’t talk about tax evasion, drug use. And definitely don’t try out your Violet Crawley impression.
Judging by the privacy policy, it seems Samsung is collecting voice commands mostly to improve the TV’s performance. “It looks like they are using a third-party service to convert speech to text, so that’s most of what is being disclosed here,” said Corynne McSherry, the intellectual property director at the Electronic Frontier Foundation.
So this may just be an effort to make your SmartTV smarter.
But, said McSherry, “If I were the customer, I might like to know who that third party was, and I’d definitely like to know whether my words were being transmitted in a secure form.” If the transmission is not encrypted, a SmartHacker could conceivably turn your TV into an eavesdropping device.
Samsung didn’t immediately respond to a request for comment. And the privacy policy doesn’t identify the third party that’s listening to you scream, “I said Abbey, goddamit! Not Annie! Your as deaf as my mother-in-law!”
This isn’t the first time Samsung’s too-clever-by-half TV has set off alarms among privacy experts. Writing in Salon in November 2014, Michael Price, counsel in the Liberty and National Security Program at the Brennan Center for Justice at the NYU School of Law, said the details in his new smart TV’s lengthy privacy policy made him “afraid to use it.” Price didn’t name the brand, but the wording matches exactly what’s contained in Samsung’s notice to its customers.
“I do not doubt that this data is important to providing customized content and convenience, but it is also incredibly personal, constitutionally protected information that should not be for sale to advertisers and should require a warrant for law enforcement to access,” Price wrote.
Samsung’s privacy policy notes that in addition to voice commands being transmitted, information about your device, “including device identifiers,” may also be beamed over the Internet to the third-party service, “or to the extent necessary to provide Voice Recognition features to you.”
McSherry called that bit of qualifying language “worrisome.”
“Samsung may just be giving itself some wiggle room as the service evolves, but that language could be interpreted pretty broadly,” she said.
UPDATE 2/6/15 1:59 PM: "Samsung takes consumer privacy very seriously. In all of our Smart TVs we employ industry-standard security safeguards and practices, including data encryption, to secure consumers’ personal information and prevent unauthorized collection or use," the company said in a statement to The Daily Beast. "Voice recognition, which allows the user to control the TV using voice commands, is a Samsung Smart TV feature, which can be activated or deactivated by the user. The TV owner can also disconnect the TV from the Wi-Fi network."
