CBC News reports a Chicago-area woman, identified by her initials, N.P., filed a lawsuit against Ottawa-based Standard Innovation Corp. in September 2016 alleging the company was “selling adult sensual lifestyle products that secretly collected and transmitted highly sensitive information about consumers, including temperature and vibration intensity, without their knowledge or consent.” Another women, identified as P.S., joined the lawsuit in February 2017.
At issue was Standard Innovation’s We-Vibe Rave, a Bluetooth and Wi-Fi compatible vibrator that can be controlled via a downloadable smartphone app called We-Connect. We-Vibe Rave promises “intimate, intense orgasms,” but the experience proved too intimate for the plaintiffs’ pleasure.
“Unbeknownst to its customers… [Standard Innovation] designed We-Connect to collect and record highly intimate and sensitive data regarding consumers’ personal We-Vibe use, including the date and time of each use and the selected vibration settings, and transmit such usage data — along with the users’ personal email address — to its servers in Canada,” the September 2016 court filing states. The suit further alleges Standard Innovation demonstrated “a wholesale disregard” for its customers’ privacy and violated numerous U.S. laws.
“[N.P.] would never have purchased a We-Vibe had she known that in order to use its full functionality, [Standard Innovation] would monitor, collect and transmit her usage information through We-Connect,” the statement of claims says.
Newsweek reports the We-Vibe privacy issue was first revealed at last year’s DefCon hacking convention, where two hackers who go by the online names Goldfisk and Follower demonstrated how data is sent from the vibrator to Standard Innovation in a presentation titled “Breaking the Internet of Vibrating Things: What we learned reverse-engineering Bluetooth and Internet-enabled adult toys.” The hackers further demonstrated the capability of third parties to intercept data from We-Vibe and even gain control of the vibrator to commit what they called “potentially sexual assault.”
The National Post reports some 300,000 people purchased the sex toys, with about a third of the customers using them with We-Connect.
The two plaintiffs won’t share the entire settlement amount; under the terms of the agreement, app users may receive up to $10,000 each after expenses and fees and those who bought We-Raves but did not download the app are eligible for up to $199 each. The vibrators sell for around $170.
Standard Innovation said it was pleased to reach a “fair and reasonable” settlement. “At Standard Innovation we take customer privacy and data security seriously,” company spokesman Denny Alexander told CBC News. “We have enhanced our privacy notice, increased app security, provided customers more choice in the data they share, and we continue to work with leading privacy and security experts to improve the app.”
The rise of the Internet of Things brings with it serious privacy protection concerns, as everything from children’s dolls to smartphones and televisions can become surveillance tools. This isn’t even the first spying sex toy scandal — last March, online security experts at the company Trend Micro hacked into a Internet-connected vibrator at Germany’s CeBIT technology fair.
“The problem here is that many Internet of Things devices are horribly broken security-wise because it costs money to ensure a reasonable standard of protection on a product,” Chris Boyd, an analyst at the security firm Malwarebytes, told Newsweek.
