How Entertainment Companies Are Fighting Lawsuits Over Disclosures of Who's Watching

As HBO, CBS and ESPN launch online subscription services, they will have to be mindful of a 1988 law that has sparked widespread privacy claims
 Ben Wiseman

It's no secret that privacy is a scorching hot issue in the tech world, but without much of a legal regime to govern how companies keep and disseminate user records, some class action lawyers have turned to the Video Privacy Protection Act of 1988 to go after entertainment companies that knowingly disclose "personally identifiable information" regarding their consumers. The law, enacted after Supreme Court justice nominee Robert Bork's rental history was leaked to a newspaper, has its shortcomings for plaintiffs, but will nevertheless be an important guiding post as companies like HBO, CBS and ESPN launch online subscription services.

This year has been an important one on the VPPA front as Hulu, Cartoon Network, Disney Interactive and AMC Networks have been separately fighting proposed class action lawsuits in regards to alleged disclosures made about who's watching what. These lawsuits have attempted to articulate all sorts of theories on how consumer privacy has been violated — from information shared with a metrics company providing reports for the purpose of selling advertising to information shared with Facebook. Plaintiffs have also brought up alleged disclosures like smartphone registration IDs and Roku device serial numbers.

Perhaps the biggest decision to date came in the Hulu case this past April when U.S. Magistrate Judge Laurel Beeler had to figure out what Congress meant by "personally identifiable information."

Hulu argued that the disclosure has to be the person’s actual name, but Judge Beeler responded, "That position paints too bright a line. One could not skirt liability under the VPPA, for example, by disclosing a unique identifier and a correlated look-up table."

The judge added, "One can be identified in many ways: by a picture, by pointing, by an employee number, by the station or office or cubicle where one works, by telling someone what 'that person' rented."

Nevertheless, Judge Beeler dismissed a VPPA claim against Hulu for sharing with metrics company comScore a "watch page" URL web address containing a video name and a Hulu user's unique seven-digit ID. Yes, given that information, comScore could theoretically do some reverse engineering and access the profile page and see the user's first and last name, but that would take several steps beyond what was disseminated, and the plaintiffs lacked any evidence that users were being tied to their video habits.

Building on that decision, U.S. District Judge Thomas Thrash, Jr. earlier this month dismissed a VPPA lawsuit against The Cartoon Network where the plaintiff's allegation was that the Time Warner-owned network was transmitting a user's video history along with the user's Android ID to data analytics company Bango.

"The Android ID is a randomly generated number that is unique to each user and device," wrote the judge. "It is not, however, akin to a name. Without more, an Android ID does not identify a specific person."

Other entertainment companies hope this is the beginning of a trend that will doom VPPA claims.

For example, there's presently an allegation that "unbeknownst to Disney Channel users, each time they watched videos on the Channel, Disney disclosed their personally identifiable information (“PII”) in the form of the hashed version of their Roku device serial numbers, and video viewing histories, to data analytics giant Adobe Systems, Inc."

On Friday, Disney urged a federal judge in New York to dismiss the case by pointing to the Cartoon Network decision and arguing that Roku device serial numbers hardly amount to personally identifiable information. And if the judge doesn't buy it, the company also told the judge that the plaintiff "does not allege any facts supporting a plausible inference that Adobe could or does reverse engineer the 32-digit hexadecimal hashed Roku device serial numbers it receives from the DI Channel into 12-digit alphanumeric actual Roku Device serial numbers."

Despite the burdens of alleging plausible theories on how entertainment companies are identifying their fans' viewing habits, defendants aren't totally off the hook.

In the Hulu ruling that came in April, Judge Beeler allowed a claim to survive that was based on Hulu's placement of the Facebook Like button on a watch page, which had the effect of transmitting to Facebook a user's IP address, a video name and that user's Facebook IDs. The judge found "the link between the user and the video was more obvious" than the alleged comScore breach and warned, "If Hulu and Facebook negotiated the exchange of cookies so that Facebook could track information (including watched videos) about its users on Hulu’s platform when the Like button loaded, or if Hulu knew that it was transmitting Facebook ID cookies and video watch pages, then there might be a VPPA violation."

That doesn't necessarily prove Hulu's liability, however, because the plaintiffs still need to show that the popular video hub "knowingly" disclosed this information. Recently, Hulu has been jumping on this VPPA limitation in its latest bid to have the case dismissed.

"The evidence demonstrates that Hulu did not know that Facebook’s c_user cookies were transmitting Facebook User IDs to Facebook or what Facebook did, if anything, with these transmissions," Hulu's lawyers tell the judge. "This lack of knowledge is fatal to plaintiff’s VPPA claim."

AMC is another entertainment company in court over alleged VPPA violations in regards to its own use of the Facebook like button. For now, though, the Walking Dead network is taking a different tactic in an attempt to undercut a proposed class action lawsuit.

In a letter sent to U.S. District Judge Naomi Buchwald on Friday, attorneys for AMC say they will be addressing whether the plaintiff is really a "consumer" protected by the VPPA. "Although Plaintiff labels herself a 'subscriber' to AMC’s website in her complaint, her allegations state she only 'surf[ed] the AMC website on her computer' to watch videos from AMC’s television shows," states AMC's letter. "Merely visiting a website set up to market and promote AMC’s television shows does not constitute being a 'subscriber' of AMC under any ordinary meaning of the term."

Whether that argument flies with the judge remains to be seen — both the Hulu and Cartoon Network decisions seemed to provide a wide interpretation of the meaning of a "subscriber" to encompass those also visiting websites who aren't paying — but in any event, few will doubt that anyone signing up for digital services forthcoming from HBO, ESPN and CBS will be subscribers.

Fortunately for these companies, Congress amended the VPPA in January 2013 to permit disclosures with a consumer’s informed consent. The legislative change happened after furious pressure by the tech lobby so that Netflix users, as one example, could opt-in to sharing their viewing history on Facebook. Now that television is beginning to really dip itself into digital waters, it bears watching what sort of user agreements will be crafted for these over-the-top services, especially as many in the industry look to advance forward from traditional ways of measuring who's watching what.

Email: Eriq.Gardner@THR.com
Twitter: @eriqgardner

comments powered by Disqus