Last month, a federal Magistrate Judge in In re Hulu Privacy Litigation held that the Video Privacy Protection Act (“VPPA”) applies to online video streaming services. This ruling could have a broad impact on the video streaming services, advertisement and analytics provider industries.
1. Background
The VPPA, which became law in 1988, prohibits “video tape service provider[s]” from disclosing personally identifiable information about renters, purchasers, or subscribers of “prerecorded video cassette tapes or similar audio visual materials” to third parties. The VPPA was passed after a newspaper obtained and published information about the video rental records of Supreme Court nominee Robert Bork. The VPPA was passed long before video-streaming technology existed—and even before the advent of the World Wide Web.
The Magistrate Judge had to decide whether the VPPA’s language should be broadly interpreted to apply to new technologies that provide access to video content. The Magistrate Judge also had to address whether Hulu’s disclosures fit within the VPPA’s “ordinary course of business” exception.
2. Plaintiffs’ Claim and Hulu’s Response
The plaintiffs in this case alleged that Hulu improperly tracked and shared its users’ video viewing details with third party advertising networks, metrics companies, and social networks in violation of the VPPA. The information shared included personally identifying information of the users, including their web browsing histories (including video viewing choices) and user registration information.
Hulu asked the court to hold that the VPPA does not apply to Hulu’s disclosure of this information, because Hulu does not sell or rent prerecorded videocassette tapes. Hulu also asked the court to rule that its disclosures occurred in the ordinary course of its business, and so the VPPA’s strictures do not apply to the disclosures.
3. The Court’s Decision
a. Breadth of the VPPA
The Magistrate Judge ruled that the streaming videos provided by Hulu constituted “similar audio visual materials” protected by the VPPA. Her ruling extends the VPPA beyond videotapes to streaming services as well. She rejected the argument that the VPPA only applies to physical materials such as videocassette tapes, concluding that the statute’s reference to “similar audio visual materials” indicates the authors of the bill wanted the VPPA to be forward-looking to apply to all video content, irrespective of the format in which the content is delivered.
b. “Ordinary Course of Business” Exception
The VPPA defines “ordinary course of business” as “debt collection activities, order fulfillment, request processing, and the transfer of ownership.” Based only the allegations in the complaint, the Magistrate Judge rejected Hulu’s argument that its disclosures of personally identifiable information fit the “ordinary course of business” exception to the VPPA. Hulu argued that the advertising, market research, and web analytics companies with which it shared its users’ data effectively performed third-party vendor functions for “order fulfillment” and “request processing” that Hulu could have performed internally, and so the outsourcing of these functions was not improper. The court disagreed, stating that “market research and web analytics are not in the ordinary course of delivering video content to consumers.” The court noted that further factual development in the case might permit an eventual ruling in Hulu’s favor on this point, but that the court could not determine the legal issue in Hulu’s favor based solely on the allegations in the complaint.
The Magistrate Judge’s order can be found here: https://www.eff.org/sites/default/files/Hulu-Order_1.pdf