Judge Allows 'Zombie Cookie' Suit Against Hulu to Proceed

Hulu Logo - H Publicity 2011

A California judge isn't allowing Hulu to dodge a claim of violating a privacy law by tracking users' online activity with cookies and other identifiers on their computers.

Hulu attempted to dismiss a class-action lawsuit brought last year over so-called "zombie cookies," which re-spawn even when users clear their Internet browsers of data files. The online video hub argued that that the Video Privacy Protection Act, enacted by Congress in 1988, didn't cover the digital transmission of content.

On Friday, U.S. District Court Judge Laurel Beeler denied a motion to dismiss, allowing the plaintiffs to go on with their allegations.

The VPPA prohibits a "videotape service provider" from knowingly disclosing "personally identifiable information," which includes information that "identifies a person as having requested or obtained specific video materials or services." In other words, companies can't share customers' video viewing history, and in this case, the plaintiffs allege that Hulu disclosed their video requests and their identities to social networks and online advertising networks.

In moving for a dismissal, Hulu argued that since the VPPA focuses on "video tape" and since the legislative history of the act spoke about "physical stores selling goods," the law wasn't regulating businesses dealing in digital content.

In response, the plaintiffs pointed to how "videotape service provider" is defined, which according to the law meant businesses engaged in the "delivery of prerecorded videocassette tapes or similar audio visual materials," emphasizing the latter part as being inclusive of technologies not contemplated at the time of the law's enactment.

Beller agrees in her decision, saying that Congress' concern with privacy and protecting the confidentiality of an individual's choices is what's relevant.

Hulu also attempted to dismiss the lawsuit because the VPPA allowed disclosures when they are "incident to the ordinary course of business," but the judge says that market research and web analytics don't qualify as an ordinary course of Hulu's business. The judge says if there are factual questions about what role third-party companies such as Google Analytics, Doubleclick and Facebook play for Hulu, those questions can't be resolved at this stage of the dispute.

The case goes forward, and if history is a judge, it stands a very good chance of settling.

Other web-privacy class actions have settled, including a recent settlement of a suit alleging VPPA violations by Netflix for retaining information about former customers' viewing habits and rental history. Netflix agreed to pay $9 million to resolve those claims and made changers to its data-retention policy whereby it would henceforth "decouple" viewing history data from identification information.

However, since the proposed Netflix settlement became public, there have been dozens of objections lodged in court from those who don't like that almost all of the money will be heading to lawyers and charity and from those who believe Netflix's policy changes are weak.

Meanwhile, backed by lobbying by companies including Facebook and Netflix, legislators have spent the past couple of years talking about diluting the VPPA to allow more online sharing of video history. Most recently, Sen. Patrick Leahy, D-Vt., proposed such a change a few weeks ago as an amendment to the Cybersecurity Act of 2012, where it is awaiting a vote.

E-mail: Eriq.Gardner@thr.com

Twitter: @eriqgardner