Bose headphones spy on listeners: lawsuit (2017)

Clearly this man is seeking a fat settlement but this kind of behavior by Bose is indeed sleazy, even if it is mentioned in the small print most people wouldn’t expect that and read it.

perfmode2• 7 years ago

Isn’t hitting corps with settlements an effective mechanism in the consumer protection toolkit?

a-dub2• 7 years ago

it shouldn't be necessary.

avip2• 7 years ago

Who would not expect a music streaming app to collect data on the music customers listen to? I completely expect spotify, youtube, and any other streaming app to do the same? How else could you provide discovery to customers?

DavidSJ• 7 years ago

It’s not a music streaming app. It’s a Bluetooth headphone management app.

loki2005• 7 years ago

Why should one need an app to control their headphones?

Give me hardware interface to control the functions.

algesten• 7 years ago

The one thing I use the app for is system updates.

jmiserez2• 7 years ago

I too have these headphones. I don't really know what the frequent firmware updates do, or if they are necessary.

I can understand why the mechanism for firmware updates exists, but this constant updating of every single thing is insane. Bluetooth headphones aren't even exposed/connected to the internet.

hadrien01• 7 years ago

You can update the headphones through a PC application: https://btu.bose.com/

tty23003• 7 years ago

I used the app breifly when setting mine up before deleting it. The 2 things I used it for was updating the firmware and remapping the voice control button to instead change the noise canceling amount.

petre• 7 years ago

The app doesn't do anything in Color Soundlink models that you can't do with the buttons. I couldn't even set the bass/treble so I erased it. It's quite useless.

theDoug• 7 years ago

In the instance of these headphones, the app allows you to adjust the level of active noise cancellation as well as choose which sources can send audio to the headphones. Neither of which are set up to be done directly via the device.

falcolas3• 7 years ago

The source choosing can be done (with the power slider) without the app. Just FYI.

jdietrich2• 7 years ago

You couldn't physically fit those controls onto a pair of headphones. There's simple stuff like the level of noise cancellation, but also language settings for the voice prompts and saved profiles for different paired devices.

The Bose app is relatively simple as headphone apps go. Nuro and Even offer headphones with custom DSP profiles to match your hearing and the Audeze Mobius has spatial audio with motion tracking. It's simply not possible to implement features like that without some kind of companion app.

gaspoweredcat• 7 years ago

id argue that the bose app was only really useful for updating firmware, noise cancellation level could be adjusted on the device and it didnt really do much of anything else last time i used it

the mobius is different though but only slightly, all the sound modes etc are switchable on the device its only the head tracking setup that really needs the app

(by the way im not complaining, anyone with my spotify username can know what ive been listening to and it doesnt bother me one bit)

jacquesm3• 7 years ago

An embedded web server would take care of that. And you'd not need an App, besides it would also work for people without smartphones.

muxator• 7 years ago

Or publish the APIs for at least allowing a third-party implementation?

rando444• 7 years ago

But then you need to bring the conversation back around to "why ruin it with hidden data collection"

When I set up my QC35 II, I couldn't get it to pair, so I reluctantly downloaded the app. I got my headphones set up and noticed the other features, which I thought could be useful, but uninstalled the app anyway, because the amount of times I would change these settings didn't outweigh having another app on my phone that could be collecting data.

I hate that I was correct in uninstalling the software due to privacy concerns, and only reinforces my distrust of hardware and software vendors.

insickness• 7 years ago

My $35 pair of Phaiser BHS-760 bluetooth headphones connect far, far better than my $350 Bose QCII headphones and the BHS-760s don't require an app.

noitsnot• 7 years ago

Your $35'rs aren't a good comparison when they don't provide noise cancelation.

readparryrepost• 7 years ago

I'd be fascinated to see whether a similar degree of monitoring is going on in a post-GDPR context. A data request should return everything as Bose is an EU based firm with some customers within the EU surely?

fyfy18• 7 years ago

The GDPR haters need to realise this is exactly the sort of thing it is meant to prevent. The EU legal landscape is very different from the US, in that regulations protect consumers vs the threat of class action lawsuits. What would happen here if Bose were a solely EU company with no US presense, who would you sue then?

jacquesm3• 7 years ago

The GDPR haters on the tech side usually work for companies (or are founders of) that do stuff that they really shouldn't be doing.

akersten• 7 years ago

The "GDPR haters" realize that this is the sort of thing it is meant to prevent. They probably want to see this kind of thing prevented too.

But they also realize that intention is hard to codify in law, and when their concerns about an overly non-specific and broad legislation are dismissed with "well obviously the GDPR intends this and not that, it's such a straightforward legislation to read, anyone can understand it," it's easy to become a "hater" - because they realize that there is a lot of latitude in interpreting the law.

It would be more constructive to try to understand the position of people you disagree with, instead of labeling them as "haters" - just because someone is critical of the GDPR doesn't mean they don't value privacy.

tty23003• 7 years ago

This is exactly why I refuse to use an app for setting up hardware. Bose pushes really hard to get you to use an app for something that really doesn't require an app.

Nextgrid2• 7 years ago

This itself should be a red flag. If they heavily push something for a task that clearly has no reason to require that something then it’s probably fishy.

Same scenario about PayPal offering that I receive receipts in Messenger or Deliveroo offering WhatsApp notifications.

lstamour2• 7 years ago

If you want to use the Alexa/Google button on the QC 35 II, you’d need the app. Also to configure Bluetooth settings and update the headphones’ firmware. I use it daily to connect or disconnect named devices from the headphones to either improve connectivity (fewer devices connected, better bandwidth) or save battery (fewer devices connected, battery lasts a bit longer).

I’m happy to report there’a a toggle in the app’s settings and that it now clearly indicates it sends the song data for diagnostic purposes if checked. (And yes, I disabled it.)

a1369209993• 7 years ago

If they heavily push something for a task that clearly has no reason to require that something then it's probably fishy.

See also ninety-plus percent of existing javascript, and literally the entire existence of intel management engine.

code_duck• 7 years ago

Instagram does this in several ways. You can't post 'stories' unless you give camera and microphone permission - even for existing videos and photos, when you have no desire to use their app to record. At first you could, now it's more restrictive.

Same for adding location to photos. On iOS you can deny the permission and still enter location manually. On Android, you can't enter a location manually unless you give the app location permission. Totally not useful, either - location info is already embedded in the photo and I really don't need the help of GPS to determine my current location.

woadwarrior014• 7 years ago

I switched from a Bose QC35 to a Sony WH-1000XM3 about half a year ago, and the Sony app on iOS was egregiously requesting permission for location access, even while the app is in background. The cited reason for location access sounded rather flimsy and suspicious. Luckily, everything that can be done with the app can also be done with the physical buttons on the headphones. I guess their design philosophy is that if you want the convenience of using an app with the product that you’ve already paid a lot of money for, you’ll need to pay for it with your location info.

hsivonen• 7 years ago

Pre-GDPR Sony’s terms claimed a very wide scope of data collection (“content” of the device the headphones were connected to) without opt-out UI. It appears that the terms have been narrowed now to cover only the technical attributes of content, such as codec. Is there now a way to opt out of data collection?

noisem4ker• 7 years ago

What was the "cited reason"?

imglorp• 7 years ago

Same, WH-900N. I just used the app to flash updated firmware on the headphones (!) and then deleted the app. It has zero value.

JustSomeNobody3• 7 years ago

On iOS location access is a workaround for being able to kinda stay awake in the background. Some photo sync apps do that so they can (near) constantly sync your photos.

On that subject, I really wish Apple would allow me to use photos app to sync with a network share.

javajosh• 7 years ago

A company should exist that simply takes wonderful products, removes the offending bits, and resells them, perhaps at a premium. Both headphones are really good, and I certainly would pay a $100 premium if the maker was "one of the good ones" and provided, e.g., an optional, open-source app with minimal permissions.

windexh8er3• 7 years ago

I own the WH-1000XM2 (same app for both models) and the reason the app requests location is for a singular feature called 'Adaptive Sound Control'. This feature lets the app change sound profiles based on where you are, so yes - location access is required.

Stating that this is "their design philosophy" is a stretch here. I realize Sony doesn't have a stellar track record but in their defense if you don't use 'Adaptive Sound Control' the app does not and will not try to enable Location access unless you turn said feature on and the app doesn't already have access.

So, no - you don't need to pay for the convenience of Sony's app by allowing Location access as it's not required but for a singular feature that is fundamentally based around setting profiles based on your location.

JumpCrisscross4• 7 years ago

I switched from a Bose QC35 to a Sony WH-1000XM3 about half a year ago, and the Sony app on iOS was egregiously requesting permission for location access

I did too, and I stopped using them largely because of the amount of information the app collects. If this lawsuit gets a class certified, an analog for Sony might be something I look into.

lovedva• 7 years ago

How do the two compare, which do you like better?

phreeza2• 7 years ago

It is made worse by the fact that Bluetooth Low energy requires location access on Android.

nullwasamistake• 7 years ago

I noticed this a while ago. I can't see any reason besides Google finding a nice submarine for getting everybody to leave location services enabled constantly. As Bluetooth slowly becomes ubiquitous, eventually everyone will need location turned on 24/7.

Google clearly wants this, but can't do anything overt about it without attracting bad press. So they attached location permissions to a new technology they know everybody will use eventually.

panpanna3• 7 years ago

Not only that, on 9.0 it demands you enable GPS and waits for GPS lock before pairing.

Google now has the data and technology to spy on everyone using their wearables. Including people who never owned or used a Google product.

mmjaa2• 7 years ago

I build software systems which integrate a software front-end app with hardware, and I don't think I agree with the supposition that using an app to set up hardware is a negative.

Its just that I think that an app/hardware integration ethic definitely has a place in the world. For example, hardware which works with Apple, without allowing third-party (not even Apple) involvement, is a battle being fought.

Hardware vendors should be encouraged to ensure their hardware remains useful for generations, in my opinion. Apps always go stale while the hardware remains operational.

Of course: none of this forgives the vendors using it to spy on its customers.

Hardware like this, anyway imho at this market, is a platform battleground. In all honesty, we have more computer vendors battling it out now, than ever before.

More than likely, putting "compatible with iOS" on the box of an expensive speaker means more shelf-shopping customers. Alas, Bose and Apple probably have, at least, MFI-level involvement...

telchar2• 7 years ago

How do you feel about a 30 page TOS and privacy policy being necessary to use said app? Something of that length tells me that the company likely wants to get a lot of data from me. Reading it is hardly necessary with the way these are typically written to be as friendly to whatever the company wants to do as possible.

This is why I have never used the Bluetooth features on my QC35s. They're mostly dumb headphones to me since I won't accept their user agreement. This seems counterproductive for the company, unless they simply don't care about user privacy and expect users to roll over.

HenryBemis• 7 years ago

This is why I firewall my phone, so when Bose (that e.g. as the app to fine tune the frequencies etc) is installed, I immediately "block all" on mobile data and Wifi, so even if the app does want to 'speak' to someone, ET won't phone-home.

On android devices one (at least on my Huawai)(to the degree that I trust the Settings) can regulate whether an app has connectivity. I block 90% of my apps completely (e.g. workout apps, or an offline Chess app)

brokenmachine2• 7 years ago

This is why I firewall my phone
my Huawai

Hmmm.

e40• 7 years ago

The joke is the app does nothing, other than upgrade the firmware of the headphones. No settings to change or alter the behavior of buttons, initial volume, etc. Nada. Nothing.

h4waii• 7 years ago

Er. The app allows to you adjust the "aggressiveness" of the noise cancellation or turn it off completely.

phreeza2• 7 years ago

It enables a second, lower level, noise cancellation mode, that works well in windy environments.

leowoo91• 7 years ago

I've used QuietComfort (25) in past, I've never heard of any app that was available to configure it.

lstamour2• 7 years ago

It’s very common to have an app for Bluetooth QC 35 headphones, as these headphones play back digital audio (they basically have built-in iPods minus the on-board storage), and in their newest variants, ship with Google or Alexa via the app. But primarily you’d get the app to customize EQ, customize which devices are connected, troubleshoot the Bluetooth connection or perform software upgrades (an essential task these days...)

WAHa_06x36• 7 years ago

There isn't. The app is for the 35s.

Ice_cream_suit• 7 years ago

The outcome :

"The court dismissed Zak’s novel wiretap and eavesdropping claims, writing that the complaint failed to adequately allege that Bose is not a party to communication, as is necessary for violations of these statutes. “ … [T]he relevant inquiry,” the court wrote, “is whether the defendant is a participant in the conversation, as opposed to a nonparticipant that uses other means to gain access to – i.e., intercept – the communication.” Bose wasn’t an intruding third party, so this line of attack was shut down.

Nonetheless, the unjust enrichment and Illinois state consumer fraud charges survived. And, to make things a little more interesting for the defendant, the court left the door open for Zak to file again under the Wiretap Act if he could prove “that Bose is in fact not a party to the communication or that Bose, while a party, nevertheless intercepted a communication with the purpose of committing a crime or tort independent from the alleged interception.”"

https://www.lexology.com/library/detail.aspx?g=5499bec3-8a87...

zaroth• 7 years ago

Not an intruding party?! Well who the heck invited them to the conversation!!

I was assuming it would be thrown out because they only collected metadata and if they didn’t pull full audio that they didn’t meet a required element.

Luckily the wording implies that it’s not that the judge found from the evidence that they were an invited party, just that the claim failed to properly lay the foundation in their briefs?

I hope they refile.

davemp• 7 years ago

It looks like the app only sent song selections so there's no "communication" in general.

The alleged eavesdropping would deliver user information – including song selections . . .

[GP's source]

---

Honestly I think it might be worth looking into the idea of metadata collection as eavesdropping. Unless there's an implicit technical requirement for data, the company should need to explicitly request it.

For phone lines it's obvious why the service provider is party to the communications:

    caller --> switching equipment --> callee

The bose situation is more:

    user --> bluetooth --> headphones
                 |
                 +--> bose

Though this sort of ruling might just drive everything to an even more disgusting state of centralized services so that companies can claim an implicit technical need for data.

JumpCrisscross4• 7 years ago

the wording implies that it’s not that the judge found from the evidence that they were an invited party, just that the claim failed to properly lay the foundation in their briefs

The Wiretap Act complaint has bigger problems.

“‘Electronic communication’ is defined, in relevant part, as ‘any transfer of signs, signals, writing, images, sounds, data, or intelligence of any nature transmitted in whole or in part by a wire, radio, electromagnetic, photoelectronic or photooptical system that affects interstate or foreign commerce . . . .’ 18 U.S.C. § 2510(12)” [1]. It would be tough to claim the Bluetooth connection between the phone and headphones are engaged in interstate commerce.

“Moreover, Zak’s Brief in Opposition to the Motion to Dismiss (‘Opposition Brief’) further clarifies the FAC’s allegations6 and makes clear that in fact ‘Bose Connect is part of the listener to music provider communication[,]’ indeed ‘the App is supposed to function as a leg in the listener-to-music provider communication pathway—one that can be used to request new material or view audio track information.’ (Opp. Br. at 7 n.5, 8.) The Opposition Brief further explains that ‘information is . . . routed to the App where track information—e.g. song name, album, and artist information—is displayed.’ (Id. at 1.) It is clear from the facts alleged in the FAC, and clarified in the Opposition Brief, that the App is in fact a known participant in—and intended recipient of—the communication of the Media Information.”

[1] https://f.datasrvr.com/fr1/319/48563/Bose_Memo_and_Order.pdf

Angostura• 7 years ago

It looks as if there are quite a few Bose-made apps available for download in in the EU. Feels like a clears GDPR violation without active consent

gffg• 7 years ago

It is worth pointing out that MIT owns Bose. 100%. Omar Bose left it to MIT in his will. He would be rolling in his grave if he saw what MIT was doing with it.

JBorrow• 7 years ago

MIT does not have any say in the running of the company, all their shares are non-voting

auxym• 7 years ago

So they have 100% of the shares, which are all nonvoting?

ChrisLomont2• 7 years ago

MIT doesn’t own 100% of Bose; he didn’t leave it all to them.

sjwright• 7 years ago

From Wikipedia:

In 2011, Bose donated a majority of the company's non-voting shares to MIT on the condition that the shares never be sold. Because these shares are non-voting, MIT does not participate in operations or governance of Bose Corporation.

What the heck is the point of owning shares if you can't sell them and you can't influence the direction of the company? That sounds like an accountant's joke.

(Presumably the benefit comes from the fact that Bose Corporation pays dividends, but nothing stops the other shareholders from deciding to cut or stop dividend payments. MIT certainly has no way to stop them.)

tr33house2• 7 years ago

This must have been happening while he was alive

woofwoofwoof• 7 years ago

I agree that this is quite shady, but they require your explicit permission when you enable music sharing. My QC35s are great btw.

tr33house2• 7 years ago

Why do people build great companies then do unnecessary things to destroy them just for a few more dollars

TeMPOraL5• 7 years ago

Competitive pressure.

falcolas3• 7 years ago

A terminal (to the company) focus on short term profits over long term sustainability. Profits, after all, boost stock prices, and a good portion of a CEO’s compensation is typically in stock grants (not to mention share holders or board members).

cecicasa• 7 years ago

I have Bose QC35 and personally I think that app is great because: 1) you can select the level of noise cancellation, and I found that I appreciate more having a low level NC a part from when I am on a flight where I use high NC 2) you can select 2 devices to pair at the same time, having 2 laptops and my iPhone at work is great to be able to switch with an app

That said, these two actions do not require to collect users data..so they should stop doing that without users’ consent

deogeo• 7 years ago

If I planted a listening device in someone's home, I wouldn't be asked to 'stop doing that' - I'd go to jail.

craftyguy3• 7 years ago

You? Yes.

"Tech" companies? Nope.

tga• 7 years ago

You can configure the left button to switch between noise cancelling levels (yeah, using the app once) and switch between Bluetooth devices using the right button -- so the app isn't needed for daily operation.

POTUS2• 7 years ago

QC35 doesn’t have a left button, that’s the QC35-2. Which sucks because i now need the app multiple times a day.

falcolas3• 7 years ago

Switching between paired devices can be done with the power slider, without the Bose app. I don’t know how to do #1 without the app though.

EmilStenstrom• 7 years ago

If you start the app (Bose Connect, iOS), there's a setting called "Privacy Policy & Settings". There's one option there, which disables "Share data with Bose". I'm not saying that everyone will find it, but at least it's a solution for people that read Hacker News and wants to keep using the app.

craftyguy3• 7 years ago

Why do you need a special app to use headphones? Is this really what the future looks like?

RKearney• 7 years ago

You don’t. The last pair of Bose headphones I had came with instructions to download the app which I just ignored. The headphones worked perfectly fine without the app.

POTUS2• 7 years ago

They have some actual features in there like find my buds, music sharing and noise cancellation controls. Also there’s some settings adjustments like standby times, connections and voice prompts. It’s actual pretty useful.

stunt• 7 years ago

Updating the firmware.

bose1231• 7 years ago

I believe this was only later added after it became public that Bose was data collecting.

(I own the QC35 ver. 1)

jmiserez2• 7 years ago

It was added in version 4.1.0 according to this post [1], after the lawsuit was filed.

[1] https://www.reddit.com/r/bose/comments/690592/bose_connect_a...

jwr• 7 years ago

A better solution might be to get the Sony WH1000XM3 headphones, which do not attempt to spy on you, and are in general better.

I am getting increasingly annoyed by the fact that buying anything is becoming a minefield: you have to actively scan for attempts to screw you over, and every company out there will actively try to screw you over. This goes on all over the place: think airplane ticket pricing (with all the "fees" added later), buying rental car insurance, extended warranties, security systems that suddenly enable a secret microphone, and headphones that report everything you do. There seems to be no penalty: if a company is caught doing that, they don't suffer much. They should.

jake_the_third• 7 years ago

I am getting increasingly annoyed by the fact that buying anything is becoming a minefield

Not only that, but they keep repopulating the minefield with new mines after you've spent considerable time clearing them. (Google, I really don't want you to use wifi to "improve" location precision and silently re-enabling the setting after a system update isn't going to change my mind.)

One way or another, this has to stop.

fartcannon• 7 years ago

You then have to trust that the app respects your settings. Years later when it's discovered that it doesn't, they can claim that it was a bug. Woops. Sorry.

JumpCrisscross4• 7 years ago

The court’s opinion and order: https://f.datasrvr.com/fr1/319/48563/Bose_Memo_and_Order.pdf.

codedokode• 7 years ago

Will there be similar consequences for Bose, as for Huawei? Like companies stopping dealing with them, Google revoking software licenses? Or if it is an American manufacturer, then it's ok to spy?

neon_me• 7 years ago

New marketing strategy: Bose // We Listen to our Customers

Bose headphones spy on listeners: lawsuit (2017)

Related Stories