Hulu Privacy Litigation Continues After Court Concludes No Actual Injury Required

In re Hulu Privacy Litig.,  N.D. Cal., No. 3:11-cv-03764-LB, summary judgment denied 12/20/13

Holding: Customers of online video content provider Hulu LLC do not need to show additional injury beyond company's alleged wrongful disclosure of their personal information to third parties under Video Privacy Protection Act.

Dec. 26 --Customers of online video content provider Hulu LLC do not need to show an additional injury beyond the company's alleged wrongful disclosure of their personal information to third parties under the Video Privacy Protection Act, the U.S. District Court for the Northern District of California ruled Dec. 20 (In re Hulu Privacy Litig., N.D. Cal., No. 3:11-cv-03764-LB, summary judgment denied 12/20/13).

In September 2011, a group of consumers filed a complaint on behalf of a proposed class against Hulu and its web analytics partner Space Pencil Inc., doing business as KISSmetrics, alleging that the companies secretly tracked consumers' Web browsing activities (185 PRA, 9/23/11).

The plaintiffs voluntarily dismissed their claims against KISSmetrics, but KISSmetrics settled similar claims in a separate action in October 2012 (208 PRA, 10/29/12).

In June 2012, the court dismissed all but the plaintiffs' VPPA claims against Hulu, and it placed the VPPA claim on hold pending a U.S. Supreme Court ruling on standing (118 PRA, 6/20/12). The court revisited the case in August 2012, ruling that the VPPA covers online video streaming services and denying Hulu's motion to dismiss (156 PRA, 8/14/12).

In November 2012, the plaintiffs filed a second amended complaint. The plaintiff Hulu customers alleged that the company disclosed their personal identification information and video viewing selections to third parties in violation of the VPPA, 18 U.S.C. § 2710. The court said that the plaintiffs limited those third parties to metrics company comScore Inc. and social network Facebook Inc.

Hulu moved for summary judgment, and a federal magistrate judge denied the motion.

Hulu: Actual Injury Required.

The VPPA, at 18 U.S.C. § 2710(b)(1), provides: “A video tape service provider who knowingly discloses, to any person, personally identifiable information concerning any consumer of such provider shall be liable to the aggrieved person for the relief provided in subsection” (c). Section 2710(c)(1) provides: “Any person aggrieved by any act of a person in violation of this section may bring a civil action in a United States district court.”

Hulu argued that the plaintiffs must show an actual injury that is separate from a statutory violation to recover actual or liquidated damages under the VPPA.

“The court concludes that they do not because the VPPA requires only injury in the form of a wrongful disclosure,” the court said. “Hulu's main argument--that the word 'aggrieved' in the statute requires an additional injury--does not change the outcome.”

Looking at the plain language of the statute, the court said a consumer is an “aggrieved person” when “a video tape service provider wrongfully discloses that consumer's personally identifiable information.” The court noted that the term “aggrieved person” in Subsection (b) is singular and preceded by a definite article, “the.”

Subsection (c) does not require any additional injury beyond the violation delineated in Subsection (b), the court said. In addition, the terms “aggrieved person” in Subsection (b) and “any person aggrieved” in Subsection (c) have the same meaning, it said.

Comparison to DPPA.

Hulu also argued that, unlike the Driver's Privacy Protection Act, Congress chose with the VPPA not to provide relief for just a disclosure of personal information.

The court said that some courts, such as Pichler v. UNITE, 542 F.3d 380 (3d Cir. 2008) (176 PRA, 9/11/08), have held that the DPPA only requires an improper disclosure of information.

“Given the similarity of the DPPA and the VPPA, the DPPA cases militate in favor of a conclusion that Plaintiffs need show only a violation of the VPPA,” the court said here.

Effect of Sterk Cases.

Hulu also contended that other cases require actual injury as a prerequisite for recovering damages under the VPPA. However, the court did not find those cases persuasive, pointing out in a footnote that they made different arguments, such as requiring standing or “actual damages” as a predicate to statutory damages.

For example, Hulu relied on Sterk v. Best Buy Stores LP, No. 1:11-cv-01894, 2012 BL 275176 (N.D. Ill. Oct. 17, 2012), which held that an allegation of a statutory violation under the VPPA is not enough to establish an injury in fact under Article III (204 PRA, 10/23/12).

In addition to being a standing case, the court said Sterk is an “out-of-circuit case that applies a different injury-in-fact standard.” In the Ninth Circuit, an allegation of a violation of a statutorily created right satisfies the injury in fact requirement of Article III, the court said.

The court added that its conclusion that an unlawful disclosure of personal information constitutes an actual injury is supported by Sterk v. Redbox Automated Retail LLC, 672 F.3d 535 (7th Cir. 2012). In that case, the U.S. Court of Appeals for the Seventh Circuit held that the VPPA authorizes private causes of action only for unlawful disclosure, not unlawful retention (45 PRA, 3/8/12).

“In sum, Hulu provides no authority for reading the VPPA's 'person aggrieved' language as establishing an additional element of a prima facie claim for unlawful disclosure under the VPPA,” the district court said.

The law firms representing the plaintiffs included: Parisi & Havens LLP, in Sherman Oaks, Calif.; KamberLaw LLC, in New York and Healdsburg, Calif.; Strange & Carpenter, in Los Angeles; and the Law Office of Joseph H. Malley PC, in Dallas. Attorneys from O'Melveny & Myers LLP, in San Francisco and Los Angeles, represented Hulu.

Full text of the court's opinion is available at

Copyright 2013, The Bureau of National Affairs, Inc.