The deadline to achieve compliance with the European Union’s General Data Protection Regulation (GDPR) has passed, and the global sense of panic that so many organizations felt as they rushed to meet that deadline has died down. But GDPR’s broad definition of what constitutes a consumer’s personal data, and its strict requirements governing how companies process and use that data, remain pervasive topics of an on-going global discourse around privacy regulation. Like any other internet consumer service, OTT video providers with subscribers in the EU must comply with GDPR because they typically handle data that fall under its purview. One example that OTT providers need to pay close attention to is device IDs.

Smart TVs and streaming digital media players such as Roku and Chromecast have their own unique device IDs that fulfill several functions for OTT services in addition to identifying a specific device. They can also be used to tie licenses for consuming content to a device or user, track user behavior to create personalized content recommendations, perform audience measurement and target interest-based advertising.

Collecting and using this information incurs several obligations on the part of OTT providers, ideally beginning with conducting a “data protection by design” review of their applications and services. This is a systematic technology and process review to ensure good privacy protections are built in, identify and mitigate potential privacy risks and document all the steps in accordance with the GDPR’s accountability requirement.  

Users should be informed about the collection of identifiers and the purposes they are used for prior to collection. Automated collection in the background without the user’s knowledge is problematic.

An OTT provider needs to decide on a legal basis for processing device IDs, which would typically be "consent" or "legitimate interest" of the provider. Where "consent" is the legal basis it should be "unbundled" to give users meaningful choices - and not simply a take-it-or-leave-it menu. For example, device identification may be strictly necessary for service delivery, and the utilization of identifiers for DRM purposes is arguably in the legitimate interest of the provider. However, the use for recommendation services or targeted advertising may require independent consent. 

If device identifiers are shared with third parties, put proper contractual safeguards in place. This includes provisions of how the identifiers can be used by any third party. Also, decide on data retention policies for identifiers and the usage data associated with them. 

 With regard to privacy by design and default, OTT service providers should apply good privacy engineering principles to the generation, collection and processing of device IDs. “Data minimization” is one such principle. Collecting only what’s needed will make it much easier to manage and secure personal data responsibly. 

 Another privacy engineering principle to embrace focuses on giving users more control over their data. For example, a user should be able to reset device IDs, where doing so is reasonably possible. If a class of device IDs is not resettable for justifiable reasons, then consider generating multiple device IDs for additional purposes. 

Even OTT video providers that do not need to comply with GDPR should conduct thorough audits of their policies and practices for managing personal data. GDPR and the scandal created by Cambridge Analytica’s misuse of Facebook data are just two events driving rising consumer demand for more control over the privacy of one’s data. In the U.S. that’s causing a ripple effect across state legislatures and in several departments and offices throughout the federal government. 

 Consider that California and Vermont this year passed legislation, which aggressively addresses data privacy that, like GDPR, has broad-reaching ramifications around how companies collect and use personal data. At the federal level, the Trump administration is reportedly crafting a set of data privacy protections to guide state and federal lawmakers as they consider similar legislation. 

 There is still some uncertainty about when it’s OK to use "legitimate interest" rather than opt-in consent as the legitimate basis for processing: it seems prudent to wait to see how these discussions shape up before making drastic decisions that could dramatically impact a product. What degree of unbundling of consents is expected will also become clearer as lawmakers are deciding complaints against big tech companies such as Google and Facebook on similar issues.In closing, it’s imperative that OTT video service providers strive to ensure compliance with all applicable laws and regulations that are “on the books” today and may be signed into law tomorrow. 

This can start with a straightforward two-step process: 

1. Conduct a detailed "data protection by design" review of OTT applications and services; 
2. Develop and implement a mitigation plan for any privacy risks and shortcomings. 

Dr. Tomas Sander is the data protection officer (DPO) and a senior research scientist at Intertrust Technologies. Tomas leads Intertrust’s Privacy and Data Protection program. He also conducts research on privacy enhancing technologies and their use in practice. Prior to joining Intertrust, Tomas worked for 14 years at Hewlett Packard Labs in Princeton, New Jersey where he was a member of the Security and Manageability Lab, which conducts research in security, privacy and cloud technologies.

“Who are you; who-who, who-who?” The 1978 hit song from The Who, and theme of the long-running TV show CSI (a.k.a. Crime Scene Investigation), asks an important question, namely, who committed the crime? But here is the irony of the show and the use of that particular song — while the actors were trying to profile who committed the crime, nobody was creating a profile of who was actually watching the show. That’s because the service providers broadcasting the show haven’t really tried to get to know anything about their viewers, apart from their street address or phone number. Hopefully, that will change with the introduction of Digital Identity technology.

Digital Identity is in use already by the largest internet organizations. Facebook, Google, Amazon and many other tech companies ask us to sign in and provide a password when we begin to consume their content or utilize their search or shopping sites. They don’t ask us for any money, just that we sign in. That’s because sign-ins provide them with a profile of our likes and interests, our age and whom we consider to be our friends, and more important, what our choices are when it comes to entertainment.

This makes us a better target for advertisers, which seems like a small price to pay.

Getting to Know Digital Identity
Communication service providers (CSPs) are beginning to see the importance of Digital Identity. Veon, the company formerly known as Vimplecom, recently rolled out a “personal internet platform” in Italy that requires a login. They plan to personalize the service to each customer, offering music, entertainment, news and advertising that is targeted to each specific user.
If a telecom service provider like Veon can offer this kind of personalization through Digital Identity, why can’t the people who provide our TV entertainment do the same?

We all spend a lot of time watching TV each day. According to Statista.com, Americans are watching the most at 274 minutes per day (more than 4.5 hours); in Sweden, the country ranked No. 15, they are watching “only” 154 minutes per day (still more than 2.5 hours). With this much quality time spent with our TV provider each day, don’t we deserve a bit of personalized service?

They should know which movies we like — whether it’s Wonder Woman or xXx: Return of Xander Cage. They should know our habits and preferences when it comes to sports, news and videos, because it is in their interest to keep us engaged.

One way to keep us engaged would be to allow us into the world of voice-recognition search so we could easily find the content we are interested in. A recent survey of 17 major cable companies and satellite TV providers serving over 100 million customers asked about trends that would be coming up in the next three to five years; 65% said that voice-activated search would be a new feature coming soon, with 59% acknowledging that universal-content search would be necessary in the future. This would certainly help us find what we are looking for, and eliminate the channel surfing that we have all gotten so used to.

Another factor that should push our TV providers into action on Digital Identity is that the companies building profiles of us as customers, such as Google (YouTube) and Amazon, are starting to develop their own entertainment empires. Internet streaming companies such as Netflix and Hulu and other third-party over-the-top services have been developing series and are increasing both their domestic and international subscriber bases. These companies continue to invest heavily in original programming, and have positioned themselves as indispensable parts of a subscriber’s video spend. Maybe they will start their own internet-based networks one day, similar to Apple TV and the upcoming Facebook TV.

Time to Get Personal
Digital Identity is a technology that is being successfully used by many of the major internet companies to profile us, target us for advertisers and steer us toward the content we are interested in. It isn’t that great a technological leap for our TV providers to do the same.

If we are receiving TV or internet content via the TV set, a tablet or our phones, each one of us should be able to get personalized service. It is in their interest to keep us engaged. Over the years, these pay TV providers have been widely criticized by consumers for not providing intuitive and flexible user interfaces and for making content discovery extremely challenging. If they want to give us the entertainment experience that we ask for, then employing Digital Identity technology will be the right step forward.

Doug Fantuzzi is vice president of media and entertainment solutions at Amdocs, a global software and services provider. Image by Getty Images.