It’s too early to let Samsung off the hook for smart TV eavesdropping

Samsung said today that it has reworded the sentence in its privacy policy that caused an uproar among media and privacy rights advocates last week.

The line warned that Samsung smart TV owners should watch what they say in front of the set, because the voice-recognition technology inside the TV might capture what they say and send it to a third party.

For your reference, the actual line read: “Please be aware that if your spoken words include personal or other sensitive information, that information will be among the data captured and transmitted to a third party through your use of voice recognition.”

Samsung also put out a blog post further explaining how the voice recognition technology in its TVs — which comes from Nuance Communications — works.

But for all its work to move words around today, Samsung didn’t say it would fix the technology that could threaten users’ privacy, nor has it explained why it included that scary sentence in its privacy policy to begin with.

It’s too soon to let Samsung off the hook for this.

This is not privacy paranoia. Companies have a very real business interest in collecting, storing, and acting upon the audio cues that come out of viewers mouths in the living room. I’ve personally talked to sources high up in the interactive advertising industry who are following this story closely.

The living room conversations of viewers could, after all, reveal their personal information and product preferences, which could be very valuable to third parties who might use the information to target ads and such. Advertising, after all, is supposed to be one of the great promises of smart TVs, making it easier to track how and when viewers respond to various types of content, including ads.

Samsung explained in today’s blog that its TVs use two separate microphones to listen for two types of voice information. A microphone in the TV listens for a limited set of voice commands, like “change channel” or “volume up” and can’t act upon other terms. In the blog post, Samsung points out that this type of voice data “is neither stored nor transmitted.”

But in the rewritten privacy statement it says this: “To provide you the Voice Recognition feature, some interactive voice commands may be transmitted (along with information about your device, including device identifiers) to a third-party service provider (currently, Nuance Communications, Inc.) that converts your interactive voice commands to text and to the extent necessary to provide the Voice Recognition features to you.”

OK, so which is it? Are the TVs transmitting voice data or not? And more important: Is the data being stored? Samsung says Nuance is “currently” the third party collecting the data, but could some other third party get access to it in the future?

A second microphone, Samsung explains, is in the remote control. This one is smarter because it listens for free-form search requests, like “recommend a good adventure movie starring Tom Cruise.” Samsung does not say in its blog today that it never stores or transmits this type of voice data.

It’s the data collected by that second microphone that we should be concerned about. Here’s the line in Samsung’s rewritten privacy statement that addresses that:

“Samsung will collect your interactive voice commands only when you make a specific search request to the smart TV by clicking the activation button either on the remote control or on your screen and speaking into the microphone on the remote control.”

This voice data is directly related to programming content. Samsung says it will “collect” these voice commands, presumably to learn about what TV shows, movies, and actors the viewer likes. This might help the TV make smarter suggestions in the future.

But what about the conversation happening in the room? In its blog, Samsung explains that this type of recording can only happen when the user has pushed the microphone button on the remote But nowhere does that privacy statement preclude that practice. Samsung simply removes the warning statement, but it does not pledge to never transmit or store such data.

It does, however, make clear that users can turn off the voice recognition features if they want to. The question then becomes: How easy is it to do this? How many menus and submenus must people swim through?

It’s easy to get the impression that Samsung opened up a can of worms here by being truthful in its original privacy statement, and now it’s having trouble getting all the worms back in the can. Despite Samsung’s statements today, lots of questions remain about what the company is doing with voice recognition data now, and what it might do with it in the future.