Many companies host videos on their websites or via mobile apps. They often use analytic companies/vendors to help them track whether the videos are in fact viewed and other information about site usage. This is precisely the issue at the core of In re: Hulu Privacy Litigation, pending in the Northern District of California. Accordingly, all companies that host videos on their websites or mobile apps and track that data for analytic purposes should be following the Hulu case very closely. The plaintiffs contend that as prior (free and paid) subscribers to the Hulu site, they are entitled to recover statutory damages (of $2,500 per violation) under the Video Privacy Protection Act (VPPA) for the alleged disclosure of their video viewing to website vendors and social networking sites. The VPPA prohibits the knowing disclosure of “personal information,” which the statute defines as including an individual’s video viewing.
The Hulu court’s recent December 20, 2013, decision denying Hulu’s motion for summary judgment on the issue of injury is notable. Specifically, Magistrate Judge Beeler took up the question of whether plaintiffs must demonstrate “actual injury” above and beyond the alleged unauthorized disclosure of their video viewing to third parties in order to maintain their VPPA claims. The court held that plaintiffs did not.
The court’s December 20, 2013, ruling is consistent with its earlier June 2012 order denying Hulu’s 12(b)(1) motion based upon alleged lack of standing at the pleading stage. Citing the United States Supreme Court’s failure to overturn the Ninth Circuit’s decision in Edwards v. First American Financial (holding that statutory damages are sufficient to sustain Article III standing in federal court), Magistrate Judge Beeler concluded that Hulu’s December 2013 “actual injury” argument was similar to Hulu’s original standing argument and it was rejected for similar reasons. The court stated that “[t]he legal issue is whether the VPPA requires Plaintiffs to show actual injury that is separate from a statutory violation to recover actual or liquidated damages. The court concludes that they do not because the VPPA requires only injury in the form of a wrongful disclosure.”
The recent Hulu decision highlights how courts are grappling with the issue of whether actual injury must be proved in statutory damages cases involving tracking. In the recent October 9, 2013, decision In re: Google Inc. Cookie Placement Consumer Privacy Litigation (MDL – 12-2358), the Delaware district court held that the plaintiffs failed to establish injury in fact to support standing for alleged invasions of privacy associated with tracking users using cookies to serve targeted advertising in alleged contravention of consumer privacy settings. In holding that the plaintiffs’ failed to establish injury in fact to support standing, the Delaware court did acknowledge that statutory damages can sometimes constitute sufficient grounds for standing. The court then went on to analyze each of the claims asserted by the plaintiffs and held that they failed to state a claim for different (non-standing related) reasons. Although the Google case did not involve the VPPA, it is an interesting contrast to the Hulu decision where the Hulu court held that no injury need be established above and beyond the statutory violation—i.e., the alleged unlawful “disclosure” of consumers’ video-viewing behavior without their consent.
On the one hand, in the Google case, the court held that notwithstanding the existence of statutory damages, the issue of injury should be explored, and ultimately concluded that the plaintiffs failed to establish injury. In contrast, in the Hulu case, the court refused to explore the issue of injury in fact because the VPPA affords statutory damages. These are two different approaches, which might be explained by the venue of the cases. In Hulu, the Northern California district court relied on the Ninth Circuit’s binding decision in the Edwards v. First American Financial case—holding that statutory damages are sufficient to establish Article III standing. Notably, the Google case (based in Delaware) did not rely on Edwards.
Next on the Hulu docket will be the February 6, 2014, arguments on Hulu’s second round of summary judgment motions concerning whether Hulu knowingly disclosed personal information under the VPPA to any third parties (e.g., comScore or Facebook) given that the data was in an anonymized format at the time of disclosure. Companies should pay attention to the February 2014 hearing and ruling. The plaintiffs’ bar may be emboldened to bring many more of these cases depending upon the result. The statutory damages are tantalizing to plaintiffs’ at $2,500 per violation, particularly given the potential for millions of violations (per day) depending on the site.
Regardless of the result of the decision, companies should consider whether they should seek advanced consent for disclosures of video viewing in accordance with the December 2012 amendments to the VPPA. The amendments permit companies to obtain advanced consent for up two years or until the user withdraws their consent. The advanced consent must be contained in a separate legal document (e.g., click wrap) to be valid. At a minimum, legal counsel should work with IT and marketing departments to determine if a company is gathering and sharing tracking data relating to video viewing with third parties—including research and analytic companies. If so, a compliance program and best practices (such as advanced consent) should be considered.
This advisory is published by Alston & Bird LLP’s Privacy & Data Security practice area to provide a summary of significant developments to our clients and friends. It is intended to be informational and does not constitute legal advice regarding any specific situation. This material may also be considered attorney advertising under court rules of certain jurisdictions.