Telly, the ‘free’ smart TV with ads, has privacy policy red flags

Yesterday, we looked at a new hardware startup called Telly that’s giving away half a million of its new smart televisions for free. The catch is that the 55-inch smart television is fitted with a second display that sits underneath and displays ads while you watch your favorite shows.

The trade-off for a free television is agreeing to let this brand new startup collect vast amounts of data about you because the money ads make from you cover the costs of the television itself.

According to its privacy policy, the startup collects data about what you view, where you’re located, what you watch, as well as what could be inferred about you from that information.

But annotations left in its privacy policy that were published in error raise concerns about its data practices. As first noted by journalist Shoshana Wodinsky:

We’ve pasted below the portion of Telly’s privacy policy verbatim, typos included, as it was published at the time — and have highlighted the questionable passage in bold for emphasis:

“As noted in the Terms of Use, we do not knowingly collect or solicitPersonal Data about children under 13 years of age; ifyou are a child under the age of 13, please do not attempt to register for orotherwise use the Services or send us any Personal Data. Use of the Servicesmay capture the physical presence of a child under the age of 13, but noPersonal Data about the child is collected. If we learn we have collectedPersonal Data from a child under 13 years of age, we will delete thatinformation as quickly as possible. (I don’t know that this is accurate. Do wehave to say we will delete the information or is there another way aroundthis)? If you believe that a child under 13 years of age may have providedPersonal Data to us, please contact us at…”

A short time after contacting Telly for comment, the company removed the section from its privacy policy.

In an email, Telly chief strategy officer Dallas Lawrence said an old draft of the privacy policy was uploaded by mistake.

“The questions raised in the document between our developer team and our privacy legal counsel appear a bit out of context. The issue raised was a two-part technical question related to timing and whether or not it was even possible for us to be in possession of this kind of data,” Lawrence said. “The team was unclear about how much time we had to delete any data we may inadvertently capture on children under 13. The term ‘quickly as possible’ that was included in the draft language seemed vague and undetermined and needing [sic] further clarification from a technical perspective.”

Lawrence said its developers did not believe it’s possible to capture personal data on children under 13, adding that minors are “not allowed to register” with Telly.

It’s not the only red flag in the policy itself. According to the policy, some of the data it collects is sensitive, like precise geolocation. The television also collects names, email addresses, phone numbers, ages and dates of birth, zip codes, gender and ethnicity, and “sex life or sexual orientation” (which Telly quietly removed after this article was published).

The startup says it also collects your “cultural or social identifiers,” such as what sports team you might like (“a Green Bay Packers fan”), what physical activities you enjoy (like “being a skateboarder”), but also things like if you’re “an environmental activist,” the policy states.

While it might not be surprising that a free, ad-supported product is collecting vast amounts of information about its users, there are dangers in collecting this data to begin with.

Ad networks collect gobs of information from various sources — websites, phone apps, and ad-supported hardware — to build up profiles about users that can be used for targeted advertising. The more that ad networks collect, the more they can infer about you, and the more they think they can accurately serve you ads that you’re likely to click on and make them money.

Once data is collected, ads data is shared and sold by data brokers, who then sell it on to other companies and businesses for anything from fraud prevention to enabling surveillance. Data brokers also sell ads data to law enforcement agencies, which can buy the data instead of obtaining a warrant. The FTC recently accused data broker Kochava of selling geolocation data on “hundreds of millions” of mobile devices, which could be used to track the movements of individuals to sensitive locations, like abortion clinics and places of worship.

Smart TVs are notorious data collectors. Years ago, Vizio televisions were caught spying on customer viewing habits and later ordered to offer customers a way to opt-out of the tracking. Other smart TV makers aren’t much different: Samsung collects information about what users watch on its smart televisions, data that was subsequently stolen in a data breach last year.

Especially with hardware, there is no such thing as free. If you don’t want your television telling the world what you watch and why, perhaps Telly isn’t for you.