Judge Splits Difference in Hulu Privacy Case

SAN FRANCISCO (CN) - Hulu may have illegally disclosed viewer data via Facebook "likes," a federal magistrate judge ruled in an ongoing class action.

Joseph Garvey is lead plaintiff in "Hulu Privacy Litigation" which claims Hulu "repurposed" its browser cache to let marketing-analysis services store users' private data.

While U.S. Magistrate Judge Laurel Beeler gutted the case in 2012, she deferred ruling on the alleged violation of the federal Video Privacy Protection Act (VPPA), which was enacted in 1988 after a Washington, D.C., newspaper published the video-rental history of Supreme Court nominee Robert Bork.

Hulu claimed the class could not prove injury to establish standing, since that would require a recitation of watched videos, and how third parties received this information.

The media-streaming service also argued that the plaintiffs needed to prove an additional injury besides violating the VPPA, and moved for a judgment on that issue.

Beeler unraveled Hulu's argument in December 2013, finding that the act "requires only injury in the form of a wrongful disclosure."

"Hulu's main argument - that the word 'aggrieved' in the statute requires an additional injury - does not change the outcome," Beeler wrote.

Illegally disclosing personal information is an "actual injury" in this case, and the plaintiffs could recover damages if the court finds Hulu violated the VPPA, according to the order.

In depositions, several plaintiffs said they felt their privacy was violated by Hulu's disclosure of their personal data.

"I'm paying for a service, and I thought that I understood what was involved in that transaction," plaintiff Paul Torre said in his deposition.

"But now I understand more, and it's disturbing."

Hulu continues to dispute the class's claims that it used the analytics service comScore and Facebook "like" buttons to store user data; it moved for summary judgment.

Among other things, Hulu argued that its Facebook users consented to the disclosure of their information under Facebook's terms of use.

Beeler, referring to the case that gave rise to the VPPA, said the issue at hand depends on whether Hulu's disclosure of information was "knowing."

"Throwing Judge Bork's video watch list in the recycle bin is not a disclosure. Throwing it in the bin knowing that the Washington Post searches your bin every evening for intelligence about local luminaries might be," Beeler wrote in her ordering granting in part and denying in part Hulu's request for summary judgment.

"Considering the statute's reach, the conclusion is that Hulu's transmission of the Facebook user cookies needs to be the equivalent of knowingly identifying a specific person as 'having requested or obtained specific video materials or services."

She continued: "If Hulu did not know that it was transmitting both an identifier and the person's video watching information, then there is no violation of the VPPA. By contrast, if it did know what it was transmitting, then (depending on the facts) there might be a VPPA violation." (Parentheses in order.)

Hulu's argument that transmitting website cookies is a normal way that Facebook "likes" work "is not enough to negate knowledge or show the absence of evidence about knowledge," Beeler wrote.

"If Hulu and Facebook negotiated the exchange of cookies so that Facebook could track information (including watched videos) about its users on Hulu's platform when the Like button loaded, or if Hulu knew that it was transmitting Facebook ID cookies and video watch pages, then there might be a VPPA violation. The record shows fact issues about Hulu's knowledge."

Beeler noted that the plaintiffs are still reviewing documents and source code, and denied Hulu's motion for summary judgment on the Facebook issue.

Regarding the metrics company comScore, Beeler found the plaintiffs could not prove the company did anything with their information, and found for Hulu on that issue.

"The evidence shows comScore's role in measuring whether users watched the advertisements. It also demonstrates comScore's interest in recognizing users and tracking their visits to other websites where comScore collects data," Beeler wrote.

"That information is likely relevant to an advertiser's desire to target ads to them. It does not suggest any linking of a specific, identified person and his video habits."

The trial is scheduled for July 28.

Subscribe to Closing Arguments

Sign up for new weekly newsletter Closing Arguments to get the latest about ongoing trials, major litigation and hot cases and rulings in courthouses around the U.S. and the world.

Email *

Submit