Illinois bill banning eavesdropping by IoT devices defanged by tech lobby
On April 10, the Illinois State Senate passed the “Keep Internet Devices Safe Act,” a bill that would ban Internet device manufacturers from collecting audio from Internet-connected devices without disclosing it to consumers. But the bill was substantially neutered after a fierce lobbying effort by an industry association backed by Amazon and Google.
The bill passed on the heels of Amazon’s admission that the company sometimes sends copies of audio clips captured by its Echo devices to offices around the world for transcription by employees—something not mentioned in Echo’s terms of service or FAQ pages.
The bill as passed by the Senate states:
No private entity may turn on or enable a digital device’s microphone unless the registered account holder or another user that is setting up or configuring the device first agrees to the following information in a consumer agreement or privacy notice notifying the registered account holder:
(1) that the microphone in the digital device will be turned on or enabled:
(2) what command or action will turn on or enable the microphone;
(3) the categories of sounds the microphone will be listening for, recording, or disclosing; and
(4) the categories of third parties to which the sounds may be disclosed.
The bill also requires that any recordings and other personal information captured by devices protect against “unauthorized access, acquisition, destruction, use, modification, and disclosure” of the data.
The original bill would have made collection of audio by an Internet device “an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act.” That wording would have allowed device owners to complain to the Illinois Attorney General’s office, or any Illinois state’s attorney, and could result in fines of up to $50,000 per case—on top of any other compensatory damages for privacy violations.
That changed after a lobbying push by the Internet Association—an effort picked up on by Matt Stoller, a fellow at the Open Markets Institute:
Well, this is interesting. Apparently Amazon and Google came out swinging against this Illinois bill saying a company is not allowed to remotely turn on a microphone without the owner’s permission. https://t.co/4xs7rsU72A
— Matt Stoller (@matthewstoller) April 10, 2019
Talking points provided by the Internet Association to state senators pushed back against the attachment of the Consumer Fraud and Deceptive Practices Act, complaining that it would create “significant legal liability for companies” because it “allows a path to private litigation which can lead to frivolous class action litigation against Illinois businesses of all sizes.”
The lobbyists also complained that the bill would allow for “company terms of service agreements to be void and unenforceable even if a failure to disclose [recording] is accidental.”
As amended, the bill lacks any specific enforcement provisions—instead it states only that the attorney general “shall have exclusive authority to enforce this Act.” That means that individual consumers won’t have the right to launch class action lawsuits on their own behalf if the bill is passed by Illinois’ House of Representatives.
