Nickelodeon Pre-School Shows - H 2014
NickelodeonThe law permits all sorts of data collection on those who travel the internet and watch videos, but on Monday, the 3rd Circuit Court of Appeals revived one of the claims in a lawsuit contending that Viacom went too far.
Viacom along with Google faced off against parents of children who visited Nick.com over the alleged collection and dissemination of user data. A multidistrict consolidated class action ensued in New Jersey, and in January 2015, a federal judge rejected the $5 million complaint which alleged violation of the Video Privacy Protection Act (VPPA), New Jersey’s Computer Related Offenses Act and other laws.
Today, the 3rd Circuit affirms most of the lower court’s opinion, but not everything.
Related Stories
The plaintiffs alleged that Viacom committed intrusion upon seclusion — a New Jersey privacy tort — by encroaching on one’s reasonable expectation of solitude. That claim was premised on the allegation that Nick.com included a message that read, “HEY GROWN-UPS: We don’t collect ANY personal information about your kids. Which means we couldn’t share it even if we wanted to!”
In fact, the plaintiffs alleged that Viacom was indeed collecting personal information about children and permitted Google to do the same by allowing the web giant to place advertisements which resulted in web browser cookies on the computers of those visiting Nick.com. Viacom argued that the state-based claim was preempted by the Children’s Online Privacy Protection Act (COPPA), a federal statute that gives the FTC the authority to issue rules regarding the collection, use or disclosure of personal information from kids.
In rejecting that contention, Circuit Judge Julio Fuentes writes, ” In our view, the wrong at the heart of the plaintiffs’ intrusion claim is not that Viacom and Google collected children’s personal information, or even that they disclosed it. Rather, it is that Viacom created an expectation of privacy on its websites and then obtained the plaintiffs’ personal information under false pretenses. Understood this way, there is no conflict between the plaintiffs’ intrusion claim and COPPA.”
Fuentes also says that the plaintiffs have adequately pled this claim against Viacom (if not Google). “We think that a reasonable fact finder could conclude that Viacom’s promise not to collect ‘ANY personal information’ from children itself created an expectation of privacy with respect to browsing activity on the Nickelodeon website,” writes Fuentes.
Viacom will thus have to continue to fight this case at the lower district court level, although it keeps the other claims down.
But not because of standing.
This is a hot topic given a recent Supreme Court ruling (Spokeo v. Robins) that said plaintiffs must show an injury that is both “concrete and particularized.” In applying it to a case like here where plaintiffs may suffer from privacy intrusions but have a hard time showing the specific harm from having data collected and disseminated, the 3rd Circuit won’t stop the lawsuit on standing grounds.
“The purported injury here is clearly particularized, as each plaintiff complains about the disclosure of information relating to his or her online behavior,” writes Fuentes. “While perhaps ‘intangible,’ the harm is also concrete in the sense that it involves a clear de facto injury, i.e., the unlawful disclosure of legally protected information. Insofar as Spokeo directs us to consider whether an alleged injury-in-fact ‘has traditionally been regarded as providing a basis for a lawsuit,’ Google noted that Congress has long provided plaintiffs with the right to seek redress for unauthorized disclosures of information that, in Congress’s judgment, ought to remain private.”
Nevertheless, Viacom and Google beat a claim alleging a violation of the Federal Wiretap Act and another over the California Invasion of Privacy Act because of the conclusion there’s been no real interception of data. They also affirm victories over interpretation of various anti-hacking statutes.
The 3rd Circuit also addresses the Video Privacy Protection Act, the big kahuna that has provided most of the legal action over disclosures of what people watch online. Here, Google escapes because it is deemed to not be a video tape service provider that has disclosed personally identifiable information while Viacom gets its win because of a tight definition of what qualifies as personally identifiable information. This has been a tough subject as evidenced by how the 1st Circuit recently revived a VPPA claim. Fuentes says the meaning of PII is “not straightforward” and “constantly in flux and often depend on the novelty at issue.”
While the 1st circuit might have looked at the sharing of GPS coordinates of a mobile device as possibly identifying its user, Fuentes draws the line on disclosures of static digital identifiers like IP addresses. He writes, “In our view, personally identifiable information under the Video Privacy Protection Act means the kind of information that would readily permit an ordinary person to identify a specific individual’s video-watching behavior.”
In holding such, the 3rd Circuit refuses to interpret the VPPA to be a broad consumer privacy act governing online data dissemination, though the opinion does advise companies doing business online to think carefully about providing noticing and obtaining consent.
Viacom responds that it is “pleased” by what has been affirmed and remains “confident” on prevailing on the intrusion upon seclusion claim.
