Recent weeks have seen two notable federal court decisions involving the Video Privacy Protection Act (“VPPA”) since last week: In re Hulu Privacy Litigation, 3:11-CV-03764 (N.D. Cal. March 31, 2015) (“Hulu Privacy Litigation”) and Austin-Spearman v. AMC Network Entertainment LLC, 1:14-CV-06840 (S.D.N.Y. April 7, 2015) (“Austin-Spearman”). While the Hulu Privacy Litigation decision may establish an important limitation on liability under VPPA, the Austin-Spearman case may call for continuing observation because it could open new approaches for plaintiffs.

Hulu Privacy Litigation

The Hulu Privacy Litigation court granted Hulu’s motion to dismiss on the basis that the plaintiffs failed to show that Hulu had knowledge that Facebook would link identification information with video content information. The court asserted that there are three key elements that must be met to constitute “personally identifiable information” under the VPPA:

• the identity of an individual;
• the identity of the video material; and
• a connection between the individual and the video material.

The court stated that an individual identifier (the c_user cookie) and the video material identifier (the watch page address) were transmitted from Hulu to Facebook simultaneously but in separate data streams. However, the court found that the plaintiffs could not show that Hulu knew that Facebook connected the two data elements.

The court found the plaintiffs attempts to show evidence from which a jury may infer Hulu’s knowledge to be insufficient. For example, the plaintiffs claimed that Hulu’s understanding of the show_faces function of the Facebook Like button demonstrates that Facebook could readily link individual identifiers (the c_user cookie read when the Like button is served to a web page) and the video material identifier (the watch page address also transmitted to Facebook in order to serve the Like button to the appropriate Hulu web page). The plaintiffs noted that when the show_faces flag is marked “true” Facebook will display profile information about an individual’s friends who also “liked” the watch page. Because this function requires Facebook to link the individual’s identity to the video content of the watch page, the plaintiffs argued that Hulu must have known that Facebook would link the data. However, the court notes that evidence provided in discovery indicated that Hulu set the show_faces flag to “false”. Because the plaintiffs did not provide evidence demonstrating that the individual identifier and video material identifier were linked when the show_faces flag is set to “false”, the court was not inclined to assume that Hulu knew that such linkage occurred.

This case establishes some precedent that VPPA plaintiffs must show evidence specifically demonstrating that a company knew that the recipient of data would link individual identifiers to video material identifiers. Therefore, companies may be able to assert that inadvertent disclosures of individual identifiers and video material identifiers through separate data streams does not give rise to a viable VPPA claim. However, companies should exercise caution because different courts may determine that knowledge is easily inferred. As a best practice, companies are still advised not to use URLs that clearly disclose the content of audiovisual materials provided on a web page. It is industry standard practice for web servers to record the referring URL every time a cookie is placed or read. Therefore, third parties that place or read cookies from the web page will typically generate lists that combine an individual identifier (the cookie) and content identifiers (if the referring URL discloses the audiovisual content of web pages) in their web server logs. Creative plaintiffs may make a strong argument that it is unreasonable for a company to claim ignorance of such an industry standard practice.

Austin-Spearman

In Austin-Spearman, the court considered the question of what constitutes a “consumer” protected by the VPPA. In particular, the court analyzed the characteristics necessary to be deemed a “subscriber” to a video tape service provider. The case was brought by an individual who viewed video clips of the Walking Dead television series on the AMC network website. The plaintiff alleged that relevant pages of the AMC websites contained Facebook Like buttons which allowed Facebook to link her Facebook account (through the c_user cookie) to the titles of the video clips that she viewed on the AMC website. The court noted that the AMC website allowed visitors to register an account with AMC, but did not require account registration to view Walking Dead video clips. The key issue addressed by the court was: Is the plaintiff a “consumer” if she did not register an account on the AMC website?

The statute defines a consumer as “any renter, purchaser, or subscriber of goods or services from a video tape service provider”. Since there was no evidence that the plaintiff exchanged money, the court focused on whether she may be a “subscriber”. The court states that “subscriber” typically involves an individual exchanging “money and/or personal information in order to receive a future and recurrent benefit”. The court notes that the complaint did not assert any such exchange of money or information; the plaintiff did not allege any payment, registration, or creation of a user account. Thus, the court found that the plaintiff sought to base their case on “simply visiting a website”. Ultimately, the court concluded that such an interpretation would be effectively limitless and contrary to the intent of the statute.

Nevertheless, it should be noted that the court granted the plaintiff leave to amend the complaint based in large part on a letter submitted by the plaintiff stating that she had registered for a Walking Dead email newsletter distributed by AMC. Presumably, the plaintiff will argue that registration for the newsletter would constitute a subscription relationship under VPPA.

While the immediate ruling is fairly straightforward, this case warrants continuing observation if the plaintiff amends her complaint to allege that email newsletter registration is sufficient to be a deemed a “subscriber”, and therefore, a “consumer” protected by VPPA. If the court finds newsletter registration sufficient, it may be necessary for companies to reevaluate how they handle information collected through marketing programs (such as fan newsletters and sweepstakes) that could be linked to the use of audio-visual materials.