Company allegedly collected intimate data without consent.

Standard Innovation, the Canadian manufacturer of the Internet-connected We-Vibe vibrator, has agreed to pay $3.75 million to settle a privacy lawsuit that alleged it had collected intimate user data without permission.

The We-Vibe is a line of Internet-connected “smart” sex toys that connect, via Bluetooth, to the We-Connect—a proprietary app to allow users to control devices remotely and create custom vibration modes.

According to the agreement, Standard Innovation will pay up to $199 to each person who bought a We-Vibe sex toy before Sept. 26, 2016. Customers who used the We-Connect app to control the vibrator will receive up to $10,000 each. However, Standard Innovation denies any wrongdoing.

The settlement comes after a long series of technical, financial, and legal setbacks for the company.

Beginning with a hack

Standard Innovation’s difficulties began in August 2016 when, at the hacker convention DEF CON, a pair of New Zealand-based speakers revealed that the We-Vibe’s internet security was seriously lacking, allowing practically anyone to access a user’s personal data.

Security again came up in September 2016, when a woman identified only as N.P. sued the Canadian-based company in Illinois Federal Court for collecting, without user consent, personal information such as dates of sex toy use, time, duration, temperature, and even the IP addresses of smartphone users.

Being upfront about sharing

The crux of the suit, though, was less about sharing this information as it was about Standard

Innovation being upfront about it. As we reported earlier, the attorney representing N.P., Eve-Lynn Rapp of Edelson PC said: “When they [Windows or Apple] wants to track your diagnostic information about how you read your word document they actually ask you. It is usually something like, ‘we see your computer has shut down, can we send your diagnostics to Microsoft for analysis?’ There is nothing like that over here in this lawsuit.”

While not directly addressing the suit, Standard Innovation did post to its company blog in October of 2016 that it had upgraded the We-Connect app to better protect user security:

The terms of the settlement

Then, in November 2016, came news that Standard Innovation was planning to settle with the plaintiff. Legally, this was a way for Standard Innovation to deal with the lawsuit without the matter proceeding to trial.

The exact nature of this settlement, however, just came to light—and it’s more than likely made manufacturers of Internet-connected devices, sexual or otherwise, pay attention.

Going forward: privacy

In addition to the monetary compensation, Standard Innovation has promised to erase all personal data it has collected. Going forward, it says it will only collect information that cannot be identified with any user. Finally, the company must clearly identify when it is collecting some forms of user data.

In response to the settlement, Standard Innovation made the following statement to MarketWatch:

While more and more products join the Internet of things, it’s clear that companies need to be extra-careful about not just security but also about being upfront about what data they might be collecting. Security and confidentiality should always be at the forefront of any product, especially when they are sexually intimate.

Image sources: Joe Gratz, Yuri Samoilov