April 9th, 2015
Court finds Hulu did not “knowingly” disclose PII in violation of VPPA, grants summary judgment[i]
By: Mariana Cunha e Melo
- The case
One of the seminal cases on the interpretation of the Video Privacy Protection Act (VPPA) has just come to an end: the In Re Hulu Privacy Litigation. The Northern District Court of California dismissed the case with prejudice on March 31, 2015 on the grounds that Hulu did not “knowingly” disclose plaintiff’s information to third parties.
The case was brought by Hulu’s viewers under the VPPA provision that prohibits any person in the business of providing prerecorded audio visual materials from “knowingly” disclosing “information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider”. Plaintiffs alleged unlawful disclosures of data to two companies: the metrics company comScore and the social media company Facebook.
- Background
On April 28, 2014, the Court dismissed most of the claims based on the finding that the information disclosed to comScore were not “personally identifiable information” in the meaning of the statute. In re Hulu Privacy Litig., 2014 WL 1724344, *12 (N.D. Cal., 2014). The opinion reasoned that sharing unique anonymous identifiers do not violate the VPPA when the context surrounding such disclosure does not reverse this anonymity. 2014 WL 1724344, *11 (N.D. Cal., 2014). And concluded that no evidence suggested the link between users’ identities and their video habits was found in the disclosures to comScore.
As to the alleged unlawful data sharing with Facebook, the Court concluded that the context in which Lulu disclosed users’ data could make more obvious the link between the users’ identity and video views. Hulu’s conduct regarding Facebook consisted in inserting a “Like” button on its watch pages. The Court found that it could cause cookies to be sent to Facebook if a Hulu user happened to have recently logged into Facebook under specific settings. These cookies would reveal the Facebook ID of the visitor of a particular watch page, along with other information that Facebook could link to a specific individual. The opinion then narrowed the remaining issue as to whether Hulu made a “knowingly” disclosure to Facebook, that is, whether the company knew it was transmitting video watching information along with personal identifying information.
The Court then held there was not enough evidence to sustain a summary judgment for the defendant and denied its motion. On August 29, 2014, Hulu filed a new summary judgment motion.
- Latest developments of the case
On March 31, the Court granted the defendant’s motion on the grounds that Hulu did not have “actual knowledge” that the cookies it sent to Facebook contained the users’ Facebook ID or that Facebook would aggregate the information it received separately. The Court found that the occurrence of automatic data sharing and the fact that Facebook tied users’ identity and video views did not implicate Hulu had actual knowledge of what would was happening. Finally, the Court held that the evidence showed Hulu in fact did not have knowledge of the operation of the cookie associated with the Facebook “Like” button. And that Hulu employee’s general knowledge that data sets may me aggregated to identify users did not change the case, since all employee’s communications referred to other functionalities rather than the “Like” button.
- Thoughts on the aftermath
The report on the case indicates that the Court adopted “actual knowledge” as a standard of liability demanding a very high level of fault in identifying individual users to particular video habits. After all, the Court found no liability in the fact that Hulu inserted on its website a functionality that it did not know what consequences could bring to its users’ privacy.
The Court’s ruling in In re Hulu reflects a clear position in favor of innovative data sharing among different services. Considering the importance the April 28, 2014 ruling has gained in the caselaw (see, e.g, the Cartoon Network case), this final decision is also expected to be very influential to future cases interpreting the application of VPPA to new technologies.
[i] By Dominique R. Shelton, Derin B. Dickerson, Elizabeth Broadway Brown and Michael J. Barry, Apr. 03, 2015. Available at: http://www.lexology.com/library/detail.aspx?g=ae277a8c-3a4d-4e79-941d-e60171a6d576.