A district court recently ruled that a class action alleging violations of the Video Privacy Protection Act (VPPA) could proceed against Hulu LLC. A putative class action was filed against the company alleging that it improperly disclosed personal information to third parties such as metrics companies and Facebook in violation of the VPPA. That Act prohibits a “video tape service provider” from knowingly disclosing personally identifiable information to third parties except in limited circumstances. Hulu argued that it did not violate the VPPA because the information it disclosed consisted of anonymous user IDs, not user names and addresses. The court agreed with respect to disclosure of anonymous user IDs to metric companies, granting a partial summary judgment. However, it disagreed with respect to disclosures of user IDs made to Facebook, which IDs – according to the plaintiffs – could be linked by Facebook to a user and a user’s video choices (even though there was no evidence that Facebook had done so). The court concluded that there were material issues of fact as to whether information had been disclosed to Facebook which could “identify a person” in violation of the VPPA. According to the court, because a User ID was “more than a unique, anonymous identifier,” and “personally identifie[d] a Facebook user,” there was a material issue of fact that the information was sufficient to identify individual consumers.
TIP: This case is a reminder that consumer advocates – and potentially courts – are taking an expanded view of what constitutes personally identifiable information.