Federal Video Privacy Law Could Cover Internet Streaming

This posting was written by Thomas A. Long, Editor of CCH Privacy Law in Marketing.

Viewers of Internet video streaming website Hulu.com could go forward with purported class-action claims that Hulu violated the Video Privacy Protection Act (VPPA) by disclosing their video viewing selections and personal information to third-party ad networks and data-tracking companies, the federal district court in San Francisco has determined. A motion by Hulu to dismiss the lawsuit for failure to state a claim was denied.

According to the court, the VPPA could cover Hulu’s business model and data practices, and the site’s viewers could have standing to sue as “consumers” under the statute. In an earlier decision (CCH Privacy Law in Marketing ¶60,779), the court had ruled that the viewers’ allegations satisfied the requirements of Article III standing by stating an injury-in-fact.

Video Privacy Protection Act

The VPPA protects from disclosure certain personal information of individuals who rent, purchase, or otherwise receive video materials. Consumers whose “personally identifiable information” was knowingly disclosed by a “video tape service provider” to third-parties may bring a private cause of action. “Personally identifiable information” includes information that identifies a person as having requested or obtained specific video materials or services. Potential remedies include actual damages (but not less than liquidated damages of $2,500), punitive damages, attorney’s fees and litigation costs, and preliminary and equitable relief that the court determines is appropriate.

Video Tape Service Provider

The VPPA defines “video tape service provider” as “any person, engaged in the business, in or affecting interstate or foreign commerce, of rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials.” Although Hulu did not deal in prerecorded video cassette tapes, Hulu could be considered a “video tape service provider,” for purposes of the VPPA, the court said. Contrary to Hulu’s contention, the phrase “similar audiovisual materials” included digital content delivery.

Disclosures “Incident to the Ordinary Course of Business”

Disclosures of personal information are not prohibited if they are “incident to the ordinary course of business” of the video tape service provider. The VPPA defines “ordinary course of business” as “debt collection activities, order fulfillment, request processing, and the transfer of ownership.” The plaintiffs alleged that Hulu’s disclosures—done for purposes including unauthorized tracking—did not fall within this “ordinary course of business” exception.

Hulu contended that disclosure of viewers’ data to online market research, ad network, and web analytics companies all involved Hulu’s use of third-party vendors providing services like internal research, advertising, and analytics that Hulu could do on its own and thus permissibly could outsource in the “ordinary course of business.” The factual issue could not be resolved on the pleadings, the court said, so the claim survived Hulu’s motion to dismiss.

“Consumers”

The viewers could qualify as “consumers,” for purposes of the VPPA, according to the court. The VPPA defined “consumers” as “any renter, purchaser, or subscriber of goods or services from a video tape service provider.”

Hulu contended that the viewers were not “subscribers” because they did not rent or purchase content or otherwise pay Hulu for services or products. However, the viewers did more than visit Hulu’s website. The website’s “resurrection” of cookies previously deleted from the viewers’ computers allegedly allowed their data to be tracked “regardless of whether they were registered and logged in.” Hulu allegedly disclosed the viewers’ “Hulu profile identifiers” to third parties and linked the identifiers to their “individual Hulu profile pages that included name, location preference information designated by the user as private, and Hulu username.”

Moreover, while the terms “renter” and “buyer” necessarily implied payment of money, the term “subscriber” did not, the court said. Hulu cited no authority to the contrary. If Congress wanted to limit the VPPA’s definition of “subscriber” to “paid subscriber,” it would have said so, the court reasoned.

The decision is In re Hulu Privacy Litigation, CCH Privacy Law in Marketing ¶60,789