Users of an app-enabled sex toy cried foul after learning that their vibrators were uploading non-anonymized usage habits to the cloud.
Now, the company responsible will be paying each of those customers $10,000.
After facing a lawsuit alleging that it improperly gathered and transmitted "highly sensitive" information about its customers, Standard Innovation, makers of the app-enabled "We-Vibe" sex toy, have reached a settlement that will send $10,000 to each customer who used both the vibrator and its companion app.
The lawsuit was filed by an Illinois woman six months ago after concerns about the We-Vibe were brought to light at the annual Defcon hacking convention. Security researchers worked to show that a skilled hacker could actually take control of the vibrator remotely -- in doing so, the demonstrators also looked at the specific information gathered and transmitted by the device. That information included user preferences and usage statistics, all of which were transmitted to We-Vibe's servers along with user-identifiable email addresses -- and all without notifying customers.
Now, that woman and all other customers who used the We-Vibe and its companion app will receive a $10,000 settlement. Customers who used the vibe but not the app will receive $199. As part of the settlement, Standard Innovation states that it has at all times denied, and continues to deny any allegations of wrongdoing and liability.
The company issued the following statement to CNET:
"We are pleased to have reached a fair and reasonable settlement in this matter. At Standard Innovation we take customer privacy and data security seriously. We have enhanced our privacy notice, increased app security, provided customers more choice in the data they share, and we continue to work with leading privacy and security experts to enhance the app. The We-Connectâ„¢ app and our app privacy notice were updated in September, 2016. That update includes:
- Enhanced communication regarding our privacy practices and data collection - in both the onboarding process and in the app settings.
- No registration or account creation. Customers do not provide their name, email or phone number or other identifying information to use We-Connect.
- An option for customers to opt-out of sharing anonymous app usage data is available in the We-Connect settings.
- A new plain language Privacy Notice outlines how we collect and use data for the app to function and to improve We-Vibe products.
With this settlement, Standard Innovation can continue to focus on making new, innovative products for our customers."
At very least, the case makes a good cautionary tale for age of the Internet of Things, where more and more kinds of devices are leveraging cloud connectivity to connect with users. That means that more and more of our personal data is getting uploaded to private servers, where its security depends on the best practices of the company collecting it.
Translation: It's up to consumers to stop and think about how much of that data they're comfortable sharing (let alone whether or not masturbatory habits should make the cut), and also up to the companies collecting data to be transparent about it, and to keep that data properly protected, encrypted, and in instances like the We-Vibe, anonymized.
For Standard Innovation, at least, that's proven to be a costly lesson.