Last Friday, the District Court for the Northern District of California issued a ruling that clarifies that the Video Privacy Protection Act (“VPPA”) applies to online video. The court thereby confirmed what EFF has been arguing for quite some time: that this law protects users' online watching habits. This ruling is particularly welcome as the VPPA's protections could now be limited through an amendment that is pending in Congress.
The VPPA was passed in 1988, after a scandalous disclosure of video rental records of the Supreme Court nominee Robert Bork. While initially intended to protect all “intellectual vitamins”—including books and records—the final version of this law only applied to “prerecorded video cassette tapes or similar audio visual materials.” It requires users' consent before any personal information showing their requests or purchases of this kind of material may be disclosed. It also specifies that this information may only be disclosed “to a law enforcement agency pursuant to a warrant issued under the Federal Rules of Criminal Procedure, an equivalent State warrant, a grand jury subpoena, or a court order.”
Earlier this year, a class of Hulu users filed a lawsuit against Hulu alleging that its practice of sharing their viewing history with third parties violated the VPPA. Hulu tried to dismiss the action arguing that its online video services are not covered by this law. It also argued that the users were not protected as “consumers” because they did not pay for video content on Hulu. Finally, it argued that it did not violate the VPPA because it only disclosed personal information in its “ordinary course of . . . business.” The Court disagreed with Hulu on every point. Most importantly, it made clear that the VPPA indeed protects users' online watching habits. It reasoned that a “plain reading” of the term “similar audio visual materials” suggests that the law covers various video content regardless of whether it is delivered online or on a videotape. It further found that “Congress [intended to protect] the confidentiality of private information about viewing preferences regardless of the business model or media format involved.”
Of course, several online video service providers already believed that they were subject to the VPPA's requirements. Google has argued that this law applied to YouTube's services when it unsuccessfully tried to oppose Viacom's civil discovery for:
all data from the Logging database concerning each time a YouTube video has been viewed on the YouTube website or through embedding on a third-party website.
And Netflix—when sued over a VPPA violation last year—settled the action rather than trying to dispute whether this law applied . Netflix has also supported legislation to amend the VPPA. It therefore appears to have suspected that the VPPA applied to its online video services—which has now been confirmed by the Hulu ruling.
This ruling comes at a time when the privacy protections of the VPPA are under risk to be significantly curbed. The amendment supported by Netflix would allow users to provide an electronic consent once to automatically share everything they watch with social networks. This would allow for the so-called “frictionless sharing” of online videos. But users have already expressed frustration with “frictionless sharing” of articles and music because of their inability to control the sharing of their information. Applications commonly require users to consent to access a particular article and everything they subsequently read gets shared via a social network. While passed long before the advent of “frictionless sharing,” the VPPA was generally intended to protect against this very type of powerlessness with respect to videos. It did so by requiring that consent be “given at the time the disclosure is sought.” If the new amendment were to pass, this safeguard would be eliminated.
