The Privacy Foundation and the University of Denver Privacy Center are claiming that the TiVo personal television recorder may track personally identifiable information, while the manufacturer claims it does not.
According to the results of a four-month investigation by the two organizations, the TiVo device gathers enough information to track individual users' home viewing habits while promising not to do so. The report claims that the device could identify subscribers' personal viewing habits at will and that the privacy policy disclosure on the company's Web site is much more explicit than the disclosure in the printed material included with the device.
In response to the report, TiVo, San Jose, CA, posted a statement on its Web site that it has never collected personal information about its viewers without their express consent. TiVo stated that while it may share viewing information with “certain groups” in the television industry, it is only in the form of anonymous aggregate data.
The company said it designed its systems to gather diagnostic log information from the recording device into one database and anonymous viewing information on a separate database, running on a separate server.
TiVo further claimed that it designed its systems in a way that does not capture information that could be used to link anonymous viewing data with an individual.
The report recommends that until TiVo “adopts a long-term solution,” the company should immediately stop collecting diagnostic logs and viewing information from all its subscribers.
In addition, it suggests that if TiVo wants to collect viewing information, it should ask for subscriber permission possibly during the “guided setup” in which the subscriber is asked questions about their audio, video and telephone equipment.
The report also recommends that:
• Users should be able to change their privacy preferences at any time through the TiVo user interface.
• TiVo should explain to customers how the device works in straightforward language.
• TiVo should not claim that personal viewing information remains on the subscriber's receiver while it is actually transmitted to TiVo's computers.
• TiVo should disclose that its customer-identified log can indicate when the remote control was in use.
• The company should obtain subscribers' consent before making any software updates to their units.
