Online video provider Hulu has decisively won a lawsuit claiming it violated the Video Privacy Protection Act (VPPA), a quirky 1988 law that provides a $2,500 penalty for the "wrongful disclosure of video tape rental or sale records."
In the 2011 complaint (PDF), plaintiffs claimed that Hulu broke the law by providing Facebook data about what videos its customers were watching. The suit sought class-action status, but the judge rejected the plaintiffs' first attempt to certify a class.
In an order (PDF) published Tuesday, US Magistrate Judge Laurel Beeler said that Hulu was in the clear.
Hulu did send to Facebook user data in the form of a cookie called "c_user," which identified users who had logged into Facebook in the last four weeks via a "Like" button on Hulu video places. Hulu also sent URLs of "watch pages" to Facebook, which relate to individual videos, so that Facebook would know where to send code related to the "Like" button. However, there was nothing in the record to suggest that Hulu knew that the watch page data and the c_user cookie would be combined, she found.
The VPPA came into existence in the late 1980s when a Washington, DC weekly obtained and published the (utterly boring) video-rental history of Supreme Court nominee Robert Bork, who ultimately was not confirmed by the Senate.
Sending along certain user IDs and data of videos didn't mean the two pieces of data were necessarily connected. "By sending those two items Hulu did not thereby connect them in a manner akin to connecting Judge Bork to his video-rental history," Beeler wrote.
The data Hulu was shipping to Facebook wasn't like the list of Bork's videos the reporter dug up, Beeler found, creating her own analogy:
Let us say that a video-store clerk gives a local reporter a slip of paper showing only someone‘s name. Weeks later, someone else hands the reporter a list of video titles. There is no obvious connection between the two.
There's also no evidence that Facebook ever did anything with the "c_user" cookies that were sent by Hulu, Beeler noted.
"This decision validates our willingness, as a matter of principle, to prove the integrity of our business practices, even if it means spending nearly four years in litigation," Hulu GC Chadwick Ho said in a statement to The Recorder, which first reported the decision.
Plaintiffs' attorney Scott Kamber told the legal newspaper that he plans to appeal. "We think the order of the lower court would undermine fundamental statutory privacy rights if allowed to stand," he said yesterday.
The detailed factual basis for Hulu's win suggests that the case won't have a wide-ranging effect or wipe out other video-privacy lawsuits. Internet privacy laws range from murky to nonexistent, but that hasn't stopped the proliferation of digital privacy-related litigation in recent years.
In 2009, Facebook settled a lawsuit related to its failed Beacon program for $9.5 million, which included VPPA and other privacy claims. Plaintiffs in that case, called Lane v. Facebook, were also represented by Kamber. In 2012, Netflix settled a VPPA case about retaining the data of its former users for $9 million.
In 2012, Congress tweaked the VPPA to make it clear that Netflix and other Web video companies could publish to Facebook after getting user consent. It isn't clear that change would have had any effect on this lawsuit, which involved claims related to users who hadn't given any kind of clear consent.
reader comments
23