A California federal magistrate judge recently ruled that the Video Privacy Protection Act, 18 U.S.C. § 2710, is not limited to brick-and-mortar stores, and thus applies to online video streaming services like Hulu. The ruling was part of the court’s denial of Hulu’s motion to dismiss a putative class action, in which plaintiffs alleged Hulu permitted an advertising firm’s use of persistent tracking cookies on its users’ computers, and then shared subscribers’ viewing information with analytics firms and social networks without their consent. The VPPA prohibits “video tape service providers” from knowingly disclosing consumers’ personally identifiable information unless a specific exception applies. Hulu argued, among other things, that (1) it was not a “video tape service provider,” and (2) the VPPA applied only to customers who pay for video content. The magistrate acknowledged that online streaming services were developed after the enactment of the VPPA, but still confirmed that Hulu falls within the definition of a “video tape service provider” because it provides “similar audio visual materials.” According to the judge, this broad phrase in the Act was intended to include new technologies. The judge went on to emphasize that the statute focuses on video content, rather than a video recording as a physical object. The magistrate also concluded that the statute also covers customers of ad-supported websites that stream video content, even if use of the site is free and the customers are not “buyers” or “renters.” The magistrate also found persuasive the statute’s definition of “consumers” as “subscribers.” According to the judge, this term does not necessarily imply payment of money.

Tip: Providers of online streaming content should proceed cautiously when sharing personally identifiable information with third parties. While this decision may be an outlier - other courts have rejected arguments that the VPPA applies to online streaming websites, and this decision was issued by a magistrate judge – websites that stream content may wish to review their data sharing practices.