Seduction by Technology: Why Consumers Opt out of Privacy by Buying into the Internet of Things
I. IntroductionIn early 2015, consumers were shocked to discover that Lenovo, a computer company, was selling its computers with a preloaded software that would give hackers1 a back door into consumers' private communications.2 This software, called Superfish, tracked "consumers' online movements" without the consumers' full knowledge or consent.3 This meant that when a consumer thought he was communicating with a secure server, he was actually open to attack because his "personal data and passwords" for "banking, social media, and email websites" could be stolen.4 Although Superfish was already preloaded onto the computers, consumers had an opportunity to opt out of Superfish when they first started their machines.5 This option was not exercised by at least 250,000 consumers: while Lenovo has not released information about how many computers were infected or how many consumers opted out of the software,6 Microsoft created a tool that detected Superfish on 250,000 machines, even with the opt out.7 Consumer reactions to Superfish were immediate, intense, and critical; one article described the scandal as "one of the most irresponsible mistakes an established tech company has ever made."8The reaction to Superfish stands in stark contrast to consumers' everyday privacy sacrificing behaviors. Whenever a user signs into two or more Google services (such as Gmail, Google Search, Google Maps, or YouTube) Google monitors and aggregates the user's every search and activity.9 Amazon consolidates data about customers' purchases, product searches, online profiles, and location.10 Target keeps tabs on its shoppers and can determine if a shopper is pregnant just from her purchase history.11 Consumers also disregard their privacy rights on a more granular level through what is called the "Internet of Things" (IoT) or a system of devices that connect to each other via the Internet.12 Surprisingly, consumers purchase these data devices with little knowledge of and perhaps little regard for whom the data can be disclosed to.13 Such devices include a pocket breathalyzer whose results can be used against the consumer in court,14 fitness tracking devices that could be used to determine disabilities,15 and a car plug in that tracks a consumer's driving data, which then determines the appropriate insurance premium based on the user's driving habits.16These devices are increasingly prevalent and convenient, but have great potential for harm when consumers exchange their privacy rights for the convenience of using the devices. First, companies producing IoT products could go in the direction of Google or Target, using customers' private data to create targeted products or advertisements. While legal, this could still rightfully make consumers uncomfortable17 because companies would possess almost unrestricted information about a consumer, such as how many miles he drives, if he donates to charities, and his health conditions.18 Second, there are security risks whenever personal data are available via the Internet. Hackers have demonstrated a capability to compromise IoT devices and have broken into online video cameras and baby monitors.19 Finally, companies can sell data to willing buyers. A prominent example is "data brokers," entities that aggregate consumer profiles that "may reveal where consumers live; how much they earn; and their race, health conditions, and interests."20 The Federal Trade Commission (FTC) has already discovered that some mobile apps transmit information to third parties "about consumers' workouts, meals, or diets."21 These data exposures are not limited to third party data brokers; for example, Fitbit has expanded its market to include sales to employers.22 While Fitbit insists that it does not sell a consumer's individualized data to employers without the consumer's permission,23 its privacy terms allow it to sell "de identified data" without a consumer's consent.24As the IoT continues to develop, legal scholarship has called for federal regulation to address the privacy concerns raised by these devices.