A court in the Northern District of California has refused to grant a motion to dismiss a Video Privacy Protection Act (VPPA) putative class action claim brought against video streaming service Hulu. In re Hulu Privacy Litigation, No. C 11–03764 LB, 2012 WL 3282960, slip op. (N.D. Cal.).
The judge’s August 10 decision rules that the VPPA applies to online video streaming services, such as Hulu, and that even users who did not pay for the service count as “consumers” who may sue under the statute. It is not yet clear whether the decision will be published.
The VPPA – the federal video rental privacy statute enacted in 1988 in response to the disclosure of the videos Judge Robert Bork rented – is restrictive and provides for potential statutory damages of “not less than $2,500.” It has been invoked in a significant number of class actions filed over the past several years. Most of these lawsuits have been followed in Illinois federal district court and most have targeted retention of customer video choice information, which is limited under the VPPA.
Two appellate courts have ruled that the VPPA does not provide a private right of action for damages for excessive retention claims under the VPPA. See Sterk v. Redbox, 672 F.3d 535 (7th Cir. 2012) (limiting damage recovery under VPPA by holding there is no recovery under subsection (e) governing the “destruction of old records”); and Daniel v. Cantrell, 375 F.3d 377, 384–85 (6th Cir.2004) (holding that damages recovery is limited to violations of the non-disclosure provisions of the VPPA).
Magistrate judge Laurel Beeler of the US District Court for the Northern District of California, in contrast, refused to dismiss a VPPA putative class action brought against defendant Hulu for alleged disclosures in violation of the statute. Hulu allegedly allowed third-party metrics provider Kissmetrics to track Hulu customers, using Flash LSOs placed through the Hulu site on users’ computers. The Flash LSOs, among other things, gathered data about Hulu users’ viewing choices on Hulu – information that was allegedly shared with third-party ad networks, market research companies, social networks and analytics companies.
If, as the court concluded, a video streaming service is a “video tape service provider” under the Video Privacy Protection Act, unless a relatively narrow range of statutory exceptions applies, the company may not disclose personally identifying viewing information it collects about its users to third parties without first obtaining user consent.1
Hulu moved to dismiss the action on the grounds that the disclosures were exempt because they were made in the ordinary course of business, that Hulu wasn't a video tape service provider and that the plaintiffs weren’t “consumers” under the VPPA. The magistrate judge denied Hulu's motion in its entirety and allowed the suit to proceed.
She ruled first that disclosures to third parties for advertising purposes are not exempt under the VPPA as disclosures “in the ordinary course of business.” The VPPA “ordinary course of business” exceptions are quite narrow – only “debt collection activities, order fulfillment, request processing, and the transfer of ownership” -- and predate the world of free, advertising supported video services.
Second, the magistrate judge ruled that the VPPA's definition of a “video tape service provider,” which encompasses businesses that are involved in delivery of video tapes “or similar audio visual material,” includes Hulu. She reasoned that the statutory term word “material” did not preclude regulating digital material and that Senate legislative history (principally drafted by Mark Rotenberg, Executive Director of EPIC, while a Senate staffer) showed that Congress intended that the statute apply in a technology neutral way to future technologies. Perhaps because it also offers full-length movies, Hulu did not make the stronger argument that the episode-by-episode streaming of TV shows for free is not “similar audio-visual material” to a video tape, which contains more content and for which users must pay. However, Hulu may raise this argument in opposing class certification or in a summary judgment motion later in the case.
The magistrate judge also ruled that Hulu users did not have to pay Hulu or purchase video content from Hulu to be considered a “consumer” protected under the VPPA, because the statute defines “consumer” as including not only renters and purchasers, but also subscribers.
This decision is significant because it may encourage other attempts by the plaintiff’s class action bar to challenge disclosures of personally identifying video selection information by providers of online video content. Because the VPPA offers the prospect of statutory damages, companies in the online video distribution business that haven't already done so should consider:
(1) reviewing their disclosures of customer and subscriber information against the VPPA requirements and
For more information please contact Jim Halpert and Kate Lucente.
1 Last year, the House of Representatives passed a bill, H.R. 2471, to clarify that a user may give one-time consent under the VPPA for ongoing disclosures of viewing information -- for example, on Facebook. The bill’s prospects in the Senate are unclear. Senate Judiciary Committee Chairman Patrick Leahy (D-VT), an original author of the VPPA, included similar language in a potential amendment to the Senate Cybersecurity bill, signaling his support for making the consent requirement in the VPPA more flexible.