A thumbs-down for streaming privacy

By Shira Ovide, The New York Times Co.

There’s an expression about the personal-information-grubbing practices of free digital services that sell ads, including Facebook and weather apps: If you don’t pay for the product, you are the product.

But sometimes you can pay for a product and be the product.

Common Sense Media, a nonprofit advocacy group for children and families, published a report this week that found that most of America’s popular streaming services and TV streaming gadgets such as Netflix, Roku and Disney+ failed to meet the group’s minimum requirements for privacy and security practices. The lone exception was Apple.

We’ve become accustomed to the corporate arms race to track our every mouse click and credit card swipe. But what’s surprising from the group’s report is that streaming entertainment products for which people pay out of their pockets have some of the same data habits of sites like Facebook and Google that make their money renting our data for advertising dollars.

“This should be a wake-up call to the streaming platforms,” James P. Steyer, chief executive of Common Sense Media, told me. “These platforms can and should do better, and I think that they will.”

The organization said that streaming companies could be doing more to keep to themselves the data they collect from American households, carve out exceptions to their information practices to better protect children, and offer more assurances that people’s data won’t be used to blitz customers with advertisements all over the internet or get fed into the dossiers compiled by data middlemen.

Researchers have previously analyzed the data habits of some streaming products. What Common Sense Media did with this latest report was cleverly comprehensive. It examined the privacy policies of 10 online video services, like HBO Max, and five streaming devices, including those from Roku and Amazon’s Fire TV. The organization also set up computer systems to follow where the digital information leaving the streaming video apps or devices went.

Common Sense Media found that most of the companies in its analysis could use information about what people do on their services to tailor ads to customers all over the internet, or allow other companies to do the same. It was able to see, for example, that many of the streaming companies piped data to Amazon and Google’s advertising businesses.

Some streaming companies, including Netflix, say that they don’t typically permit other companies to know what we watch on a Friday night binge session. Some others in the analysis leave open the possibility that information on what we watch might be used for targeted ads or for other purposes.

Data from streaming companies could also wind up with companies that compile reams of information like what brand of toothpaste you buy in the store and what you do on your phone. And Common Sense Media said some efforts to offer customers informed consent were overly complicated. For example, the organization said that Amazon asked people on a Fire streaming gadget to click through 25 policies to use the device, plus two more to use its Alexa voice assistant.

The organization said that Apple, which touts its consumer privacy principles but doesn’t always deliver on its stated ideals, had stronger protections in its Apple TV+ streaming video service and its TV connector gadget called Apple TV than the others examined.

(Apple helps fund a Common Sense Media news literacy program for schools, and it is among the companies that license the organization’s ratings and reviews. Common Sense Media told me that has no bearing on its privacy evaluations.)

Not all collection or uses of our data are necessarily harmful. Streaming companies use people’s information to help us reset a forgotten password and make sure that we can watch Hulu as we hop from a smartphone to a TV set.

The problem that Common Sense Media highlighted is that Americans, with limited exceptions, simply cannot know what companies do with all the information they gather about us. Mostly we have to rely on legal documents that offer an illusion of control and think through the hypothetical risks of what could go wrong with our personal information out in the wild.

That condition has contributed to Americans’ mistrust of tech companies and concerns about what happens to our personal data, but Steyer said that there’s a silver lining in our collective anxiety: Companies and politicians know that more Americans care about information privacy.

“I am incredibly gratified to see the fundamental change in public perception and awareness, and that is what will drive both political change and industry change,” Steyer said. “The tide is turning.”

This article originally appeared in The New York Times.