In re Hulu Privacy Litigation
86 F. Supp. 3d 1090
N.D. Cal.2015Background
- Plaintiffs are registered Hulu users who allege Hulu transmitted information to Facebook that linked their identities to specific videos they watched, violating the Video Privacy Protection Act (VPPA), 18 U.S.C. § 2710.
- From April 2010 to June 7, 2012 Hulu watch-page URLs included the video title; Hulu embedded Facebook’s Like button on those pages, which caused the user’s browser to request Like-button code from Facebook.
- If a user was logged into Facebook, the browser would send Facebook a facebook.com "c_user" cookie containing the user’s numeric Facebook ID at the time the Like button loaded; Hulu did not send Hulu user IDs or names to Facebook.
- The VPPA claim requires a knowing disclosure of (1) a consumer’s identity, (2) identity of specific video material, and (3) the connection that the consumer requested or obtained that material.
- The key factual dispute narrowed to whether Hulu knew Facebook might combine the c_user cookie (identity) with the watch-page URL (video title) to create VPPA-protected personally identifiable information (PII).
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Whether Hulu "knowingly" disclosed VPPA PII to Facebook | Plaintiffs: sending user-specific data and video titles to Facebook via the Like button is a voluntary disclosure; need not prove Hulu knew what Facebook would do with it | Hulu: VPPA requires actual knowledge that recipient would link identity to specific videos; Hulu did not know Facebook would combine cookie and URL | Court: Grant summary judgment for Hulu — plaintiffs failed to show Hulu knew Facebook would combine the data |
| Whether transmission of separate pieces (c_user cookie and URL) constitutes PII disclosure without recipient action | Plaintiffs: simultaneous transmission suffices; compares to public-display/parking-ticket cases | Hulu: separate items do not themselves identify a person as having requested specific videos absent recipient combining them | Court: The connection element is necessary; separate transmissions do not alone show disclosure of PII under VPPA |
| Whether circumstantial evidence (show-faces, session captures, emails, privacy policy, Nielsen interactions) creates a triable issue on Hulu's knowledge | Plaintiffs: technical features, internal tests, vendor discussions, and privacy policy show Hulu knew cookies could identify users and that data could be linked | Hulu: evidence is too general, often pertains to other features/vendors, or shows at most that Hulu knew cookies could identify users in other contexts; no proof Hulu knew Like-button requests would produce a linked identity+video record | Court: Evidence is too general or not specific to the Like-button/c_user+URL connection; does not create genuine issue on knowing disclosure |
| Whether filing of the complaint itself imparts knowledge to Hulu sufficient to defeat summary judgment | Plaintiffs: after complaint Hulu had notice and thus knowledge of the VPPA issue | Hulu: complaint cannot substitute for proof of actual pre-disclosure knowledge required by statute | Court: Filing suit does not prove the factual element of Hulu's prior knowledge; not enough to defeat summary judgment |
Key Cases Cited
- Anderson v. Liberty Lobby, 477 U.S. 242 (summary judgment standard and genuine dispute test)
- Celotex Corp. v. Catrett, 477 U.S. 317 (moving party s initial burden on summary judgment)
- Nissan Fire & Marine Ins. Co. v. Fritz Cos., 210 F.3d 1099 (summary judgment burden-shifting in Ninth Circuit)
- Matsushita Elec. Indus. Co. v. Zenith Radio Corp., 475 U.S. 574 (viewing inferences for nonmoving party)
- Freedman v. Am. Online, Inc., 329 F. Supp. 2d 745 (E.D. Va.) (discusses knowledge requirement in analogous ECPA context)
- Worix v. MedAssets, Inc., 857 F. Supp. 2d 699 (N.D. Ill.) (interpreting knowledge requirement under similar privacy statute)
- Senne v. Village of Palatine, Ill., 695 F.3d 597 (7th Cir.) (distinguishing public-visible disclosures where PII is obvious)