Ambiguities over whose information is really shared blocks a privacy suit against video streaming giant Hulu from proceeding as a class action.
San Francisco District Court Judge Laurel Beeler denied plaintiff’s class action certification because online ad and cookie blockers makes it difficult to identify whose information Hulu passed on to Facebook without their knowledge. According to Beeler’s decision, the number of subjective privacy options online sunk the class action accusing Hulu of violating the Video Privacy Protection Act.
[T]he court cannot tell how potential class members reliably could establish by affidavit the answers to the potential questions: do you log into Facebook and Hulu from the same browser; do you log out of Facebook; do you set browser settings to clear cookies; and do you use software to block cookies?
Plaintiffs accused Hulu of passing on their video preferences and personal identification information to Facebook and other third parties from April 2010 to June 2012. This suit has been trying to make sense of a variety of modern media problems under older laws. Hulu, which makes money by selling targeted ads, has been moving to dismiss the case by claiming that the VPPA doesn’t apply to online streaming media and questioning what counts as personal information.
According to Bradley Guyton of the Privacy & Security Law blog, the case against Hulu was the first of its kind.
In denying Hulu’s motion to dismiss [in 2012] a class-action suit alleging Hulu wrongfully disclosed users’ [Personal Identifying Information] and video viewing histories to online ad networks and other third parties, the court rejected contentions that the VCR-era VPPA only applied to brick-and-mortar providers of video tapes, and/or only physical audio-visual media. Rather, the court held the VPPA’s reference to “prerecorded video cassette tapes or similar audio visual materials” covers video content in intangible formats, not just hard copies.
The VPPA has since been amended to include online streaming services, but explicit consent is still required before viewing history can be shared with Facebook.
Judge Beeler also rejected claims by Hulu that transmitting anonymous users IDs didn’t technically count as sharing private information with Facebook, wrote privacy lawyer Matthew Turnell in Of Digital Interest.
Hulu’s disclosures to Facebook included certain cookies that Hulu sent to Facebook that allowed Hulu to load a Facebook “Like” button on users’ web browsers. The court held that the cookies that Hulu sent to Facebook to accomplish this task “together reveal information about what the Hulu user watched and who the Hulu user is on Facebook.” The court noted that this disclosure was “not merely the transmission of a unique, anonymous ID”; rather it was “information that identifies the Hulu user’s actual identity on Facebook” as well as the video that the Facebook user was watching. Thus, the court held, Hulu’s disclosures to Facebook potentially violated the VPPA.
That “potentially” is paying off for Hulu in this most recent decision. VPP violations carry a fine of $2,500 per class member. If every Hulu user with a connected Facebook account joined a successful class action suit, Hulu wouldn’t be around for much longer. Individual plaintiffs are able to proceed with a case against Hulu if they are able to prove that they didn’t block cookies, but alone, the $2,500 payout might not be worth the legal fees.
While the case has lost quite a bit of steam, it presents a good legal lesson for any video streaming site with social media plugins, according to the writers at Socially Aware:
The decision with respect to the social networking service highlights the risk posed by integrations with social media companies on websites that host video services. Such integrations may cause a cookie or other data to be sent from a user’s browser without any affirmative action by the user, which could permit the social media company to identify a specific person and his or her video watch history—and thus trigger VPPA liability.