Antitrust Law Daily Wrap Up, PRIVACY—N.D. Cal.: Hulu may be liable for disclosing personal information of consumers to Facebook, (Apr 30, 2014)

By Jody Coultas, J.D.

Material issues of fact precluded summary judgment of a class action filed by Hulu users against Hulu for disclosing personally identifiable information to Facebook, Inc., the federal district court in San Francisco has held (In re: Hulu Privacy Litigation, April 28, 2014, Beeler, L.). However, Hulu was not liable for disclosures of anonymous user information to a data tracking company.

Hulu provides free and paid online access to television shows, movies, and other pre-recorded video content from networks and studios through its website. Viewers of Hulu’s on-line video content allege that Hulu wrongfully disclosed their video viewing selections and personal identification information to third party data tracking company comScore and social networking site Facebook, in violation of the Video Privacy Protection Act (VPPA). comScore reports to Hulu regarding the size of the audience for programming on hulu.com, and Hulu uses the reports to obtain programming and sell advertising.

Software used by Hulu directs a user’s browser to send a piece of programming code to comScore that contains: (1) the Hulu user’s unique numerical Hulu User ID; (2) the “GUID,” a long alphanumeric string that Hulu used to differentiate between web browsers and that Hulu assigned at random to a browser when it accessed hulu.com; (3) the Hulu “Ad ID,” a unique six-digit number that identifies only the advertisement; and (4) the name of the program and any season or episode.

Hulu included a Facebook Like button on each hulu.com watch page. Each time a Hulu customer clicked on the Like button, Facebook received: (1) the user’s browser identification; (2) the Facebook user ID of another that had logged into via the browser; and (3) the logged-in user’s Facebook user ID. There was no evidence that Facebook took any actions with this information.

The VPPA prohibits a “video tape service provider” from knowingly disclosing “personally identifiable information of a consumer of the provider” to third parties except under certain exceptions. No VPPA case has specifically addressed directly the issue involved. Most cases involve identified customers linked to the videos they watch, and few cases address unique anonymous IDs.

The disclosures to comScore were insufficient to establish a VPPA violation, according to the court. Hulu argued that it had not violated the VPPA because it never combined or linked customer IDs to identifying data and the disclosure had to be the person’s actual name. comScore could only hypothetically use the Hulu ID to access the Hulu user’s profile page to obtain the user’s name. The Hulu users failed to show that comScore did anything with the information it received from Hulu. comScore measured whether users watched the advertisements and was interested in tracking a user’s visits to other websites. There was no evidence that comScore had any interest in linking a specific, identified person and his video habits.

There were material issues of fact about whether the disclosure of the video name was tied to an identified Facebook user such that it was a prohibited disclosure under the VPPA, according to the court. Hulu argued that it needed to send an actual name to be liable, that it sent only cookies to Facebook, and that Facebook did not take any actions with the cookies after receiving them. If Hulu and Facebook negotiated the exchange of cookies so that Facebook could track user information, including what videos users watched, on Hulu’s platform when the Like button loaded, or if Hulu knew that it was transmitting Facebook ID cookies and video watch pages, there might be a VPPA violation. What Hulu knew was a question of fact. Therefore, Hulu’s summary judgment motion was denied.

The case is No. C 11-03764 LB.

Attorneys: David Christopher Parisi (Parisi & Havens LLP) for Joseph Garvey. Randall W. Edwards (O’Melveny & Myers LLP) and Simon J. Frankel (Covington & Burling LLP) for Hulu, LLC.

Companies: Hulu; Facebook, Inc.

Cases: Privacy CaliforniaNews