10:52am PT by Eriq Gardner
Hulu Beats Big Privacy Lawsuit Over Video Viewing Disclosures
After nearly four years of litigation, Hulu has finally prevailed in a landmark privacy battle for the digital age. On Tuesday, a federal judge in California granted summary judgment on the basis that the plaintiffs lacked evidence that Hulu had "knowingly" disclosed the viewing habits of its users to Facebook.
The proposed class action was filed in 2011 and looked to hold Hulu liable for violating the Video Privacy Protection Act of 1988.
That was the law enacted by Congress in response to a video store that gave The Washington Post a list of videos that Supreme Court nominee Robert Bork had rented. The statute is intended to punish a "video tape service provider who knowingly discloses ... personally identifiable information concerning any consumer of such provider."
Once sites like Hulu and Netflix came along, and as entertainment companies like ESPN and Nickelodeon began offering streaming videos of their own, some lawyers saw the opportunity to apply the VPPA in a digital context. Over the last few years, many of the companies have been fighting the lawsuits on various grounds — for example, AMC is currently contending that those watching Walking Dead online aren't subscribers — but the lawsuit concerning Hulu has been the longest-running in this category and has set precedence as it has been litigated.
Earlier, the judge allowed the plaintiffs to continue battling by rejecting Hulu's contention that plaintiffs had to show actual injury. The judge said that wrongful disclosure was enough. On another occasion, the judge threw out claims premised on Hulu sharing viewer data with metrics company comScore for advertising purposes. The judge said it didn't add up to "personally identifiable information." But the judge did allow a claim to advance over what Hulu was sharing with Facebook.
Hulu then made another challenge to the lawsuit — and one that demonstrates why getting the VPPA to stick in the digital age will be a tough slog for plaintiffs. Hulu focused on what, if anything, it had done "knowingly."
The parties began to examine how after Facebook launched its "Like" button in 2010, Hulu added a Facebook Like button to each hulu.com watch page. That meant Hulu transmitted to Facebook the watch page's address along with a Facebook ID cookie that could be put together, and according to the plaintiffs' expert, allow Facebook to identify a user, the user's video choices, and other information about the user.
Maybe so, but U.S. District Judge Laurel Beeler says what Hulu is sending Facebook is different from the "paradigmatic case" of a video store giving a reporter Bork's video rental history.
"The user‘s identity and that of the video material were transmitted separately (albeit simultaneously)," she writes. "By sending those two items Hulu did not thereby connect them in a manner akin to connecting Judge Bork to his video-rental history; that is, Hulu did not disclose information that 'identifie[d] a person as having requested or obtained specific video materials.' Unlike in the paradigmatic Judge Bork case, the connection here would be established, if at all, by an act of the recipient."
The judge analogizes the situation to a video store clerk giving a local reporter a slip of paper showing only someone's name, and then weeks later, a list of video titles. "There is no obvious connection between the two," she writes. "In the VPPA‘s terms, no one has tied a person to specific videos."
The judge basically says that something more is needed like extrinsic proof showing the "reporter and video provider had agreed to separate the disclosures in place and time."
But she adds, "In terms of this case, if Hulu did not actually know that Facebook might 'read' the c_user cookie and video title together (yielding something akin to the list of Judge Bork‘s videos), then there cannot be a VPPA violation."
The plaintiffs can't come up with a genuine issue of material fact establishing a connection, even though they had attempted to demonstrate that Hulu knew that it was sending Facebook users‘ identities by doing things like using code to show the faces of a user's Facebook friends who had liked a given web page. The judge writes that it's not enough, and she won't send it to a jury.
"More broadly, the plaintiffs urge, 'we all know' how these sorts of Internet services work: personal information is constantly shared and connected," states the opinion. "The court agrees that it would take willful ignorance to pretend otherwise. But a jury cannot be allowed to pass on liability based on broad hand waves toward what we all know, what we all expect about how our personal information moves around, and how things generally work in the age of the Internet."
Below is the full opinion, which goes into other ways in which the plaintiffs unsuccessfully attempted to demonstrate that Hulu knew what it was doing. The lawsuit has been dismissed with prejudice. Hulu and its attorneys at O’Melveny & Myers score the win.
"There will be an appeal," says attorney Joseph Malley, who along with Scott Kamber, Brian Strange and David Parisi represented the plaintiffs.
Congress can always amend the privacy laws too, but for now, disclosures about online video habits appear to be resistant to punishment.