Court Declines to Dismiss Video Privacy Protection Act Claims against Hulu
[Post by Venkat Balasubramani]
In re Hulu Privacy Litigation, C 11-03764 LB (N.D. Cal.; Aug. 10, 2012)
Hulu is facing a putative class action alleging that Hulu improperly disclosed the video viewing choices of its users without obtaining consent. Hulu initially argued that plaintiffs lacked standing. Relying on the Ninth Circuit’s decision in First American Fin’l Corp. v. Edwards, the court said that alleging a violation of a federal statute was sufficient to satisfy Article III standing. Now the court looks at whether the allegations state a claim for 12(b)(6) purposes.
Is Hulu a “video tape service provider”? The VPPA only covers the rental, sale, or delivery of “prerecorded video cassette tapes or similar audiovisual materials.” Hulu argued that this language does not cover online providers. The court disagrees. The court looks to the language of the statute and finds that the phrase “similar audiovisual materials” focuses on the content, not the means of content delivery. While the dictionary definition of the word “material” is inconclusive, and everyone agrees that online delivery wasn’t around when the VPPA was enacted, the court looks to the legislative intent:
Congress was concerned with protecting the confidentiality of private information about viewing preferences regardless of the business model or media format involved. The question is whether the mechanism of delivery here – streaming versus bricks-and-mortar delivery – ends this case at the pleading stage. . . . Given Congress’s concern with protecting consumers’ privacy in an evolving technological world, the court rejects [Hulu’s] argument [that it’s not covered by the statute because the statute does not cover digital distribution].
Other defenses: Hulu raised two other defenses, neither of which the court buys, at least at the 12(b)(6) stage. First, Hulu says that its disclosures fall within the VPPA’s “ordinary course of business” exception. The statute defines ordinary course of business to include “debt collection activities, order fulfillment, request processing, and the transfer of ownership.” Hulu’s disclosures (to Facebook, Doubleclick, QuantCast, Google Analytics, and ScoreCard) do not clearly fall under this definition. No dismissal at the pleading stage based on this defense.
Second, Hulu argued that plaintiffs were not “consumers” as defined by the VPPA. The statute defines consumers as “any renter, purchaser, or subscriber,” and since the proposed class did not involve paying Hulu customers, Hulu argued that they were not consumers. The court disagrees with Hulu, saying that “[i]f Congress wanted to limit the word ‘subscriber’ to ‘paid subscriber,’ it would have said so.”
__
The VPPA has spawned a lot of litigation recently! Facebook’s ill-fated beacon initiative was the first target, but since then, Netflix, Redbox, and Hulu have all been ensnared in VPPA class actions. Interestingly, someone mentioned that books were initially proposed to be part of the VPPA, but at the FBI’s request, were carved out. [Eric’s note: books are now covered in California under the Reader Privacy Act.]
To my knowledge, two of the three issues decided in this ruling have not been previously dealt with: (1) does the VPPA apply to purely online service providers, and (2) does it cover non-paying customers. The court could have probably gone either way on this, and the court’s conclusion takes the privacy-friendly approach. As interpreted in this manner, the VPPA applies to a wide range of sites, from YouTube to Vimeo. The scope of the proposed class also shows the reach of the VPPA as construed in this manner. The proposed class encompasses people who visited Hulu.com between March 4, 2011 and July 28, 2011 and who viewed video content. Hulu didn’t actually provide a list to third parties of what videos these individuals viewed. It used certain cookies that respawned and were difficult to delete, and disclosed unique identifiers (e.g., Facebook IDs & Hulu profile identifiers). It’s tough to argue based on the allegations in the complaint that Hulu was guilty of some sort of knowing malfeasance. It used a third party ad network that allegedly engaged in aggressive tracking practices and as a result Hulu is potentially on hook for damages under the VPPA.
I’m somewhat surprised to not see any discussion of the Hulu terms of use. I would expect that, if I register on a free website to view videos, my viewing habits would at a minimum be used for ad targeting. As to why this and more was not disclosed and assented to in the terms of service is a mystery to me. I guess some interpret the VPPA to require consent on a movie-by-movie basis and something other than a term of use-based consent. See this post by Wendy Davis that mentions possible amendments to the VPPA that would tweak these to make sharing easier.
Other coverage:
ReadWriteWeb (Nancy Scola): The Hulu Dilemma: How Private is Your Video Playlist?
Forbes (Kash Hill): Court Case Spells Trouble for Frictionless Sharing of Videos on Facebook
Related posts: