Hulu Wins Dismissal of Privacy Lawsuit Over Consumer Data Sent to Facebook

Bloomberg Law: Privacy & Data Security brings you single-source access to the expertise of Bloomberg Law’s privacy and data security editorial team, contributing practitioners,...

By David McAfee

April 1 — Hulu LLC March 31 prevailed in a proposed class action brought by users of its online streaming TV service who alleged the company wrongfully disclosed their video viewing selections and personal identification information to Facebook Inc.

Magistrate Judge Laurel Beeler granted Hulu's motion for summary judgment and dismissed the case with prejudice, saying there is “no evidence that Hulu knew” that Facebook would gather and combine data equivalent to personally identifiable information under the Video Privacy Protection Act, 18 U.S.C. § 2710.

In a complaint filed in 2011 and amended twice since then, the plaintiffs and registered Hulu users said the company knowingly and without consent disclosed their identifying information to online ad networks, metrics companies and social networks in violation of the VPPA. Hulu moved for summary judgment in August 2014.

The court agreed that the plaintiffs couldn't show Hulu “knowingly” sent Facebook information that could identify users. The “dispositive point” in the case, the court said, “lies in the lack of a known connection between” a user's identity and the titles of the videos that user watched.

“More precisely, there is no evidence that Hulu knew that Facebook might combine a Facebook user's identity (contained in the c_user cookie) with the watch-page address to yield ‘personally identifiable information' under the VPPA,” the court wrote. “There is consequently no proof that Hulu knowingly disclosed any user ‘as having requested or obtained specific video materials or services.’ ”

Christin S. McMeley, a partner at Davis Wright Tremaine LLP in Washington and chair of the firm's Privacy & Security Practice, said the ruling is significant “for every entity that has a website or mobile application that contains video programing.”

“It is clear that Magistrate Judge Beeler recognized the breadth of this audience, the importance of this novel application of the VPPA in an Internet-video case, and the potential ramifications of her ruling, and that is why she went to such great lengths to clarify Plaintiff's burden of proof regarding a covered entity's ‘knowledge’ of disclosing PII,” McMeley told Bloomberg BNA April 1. “Her result enables the continued sharing of non-PII across the Internet to support advertising activities that in turn support free content, so long as it is done in a responsible manner.”

Motion for Certification Denied

In August 2012, the court ruled that the VPPA covers online video streaming services and denied Hulu's motion to dismiss the first amended complaint.

The plaintiffs amended their claims for the second time in November 2012.

In December 2013, the court ruled that the plaintiffs don't need to show an additional injury beyond the company's alleged wrongful disclosure of their personal information to third parties under the VPPA.

In April 2014, the court granted summary judgment to Hulu on the plaintiffs' claims that it made improper disclosures to Web analytics company comScore Inc., but it allowed the claims involving Facebook to continue. 

The court denied the plaintiffs' motion for class certification without prejudice in June 2014, holding that individual issues predominated and that the plaintiffs failed to establish an ascertainable class.

Impact of Latest Ruling

Almost a year after denying class certification to the plaintiffs, the court threw out the suit entirely.

McMeley told Bloomberg BNA that the VPPA's statutory damages “can be very alluring to plaintiffs' lawyers.” Those attorneys will continue to look for ways to assert that online sharing of information constitutes PII, she said.

“We are already seeing the claims evolve in some of the later cases, where the plaintiffs allege that the recipient did in fact combine information to reconstruct a user's PII, and they are using the recipients' advertising materials to bolster their claims,” McMeley said. “It will be increasingly important for content owners to adopt strong controls over de-identified information they share with third parties—including contractual restrictions—to ensure that it is not used to reconstruct PII.”

Victor Jih, partner at O'Melveny & Myers LLP in Los Angeles and, counsel to Hulu, hailed the ruling.

“Hulu takes privacy very seriously and we are very happy it has been vindicated by the Court,” Jih told Bloomberg BNA April 1. “We are also grateful that the Court took the time to make several important rulings to prevent this law from being misused in the future.”

Chadwick Ho, senior vice president and general counsel for Hulu, said in an April 1 statement to Bloomberg BNA that “Hulu is deeply committed to protecting our viewer’s personal information, and we are gratified by the court’s ruling.”

Scott A. Kamber, founding member of KamberLaw LLC in New York and counsel to the named plaintiffs, expressed disappointment in the ruling. His clients look forward to having their arguments heard on appeal, he told Bloomberg BNA April 1.

“While we appreciate the effort and resources the court has expended in our litigation, we are disappointed in the outcome of this motion,” Kamber said. “Plaintiffs strongly believe that the evidence they submitted on the motion for summary judgment was sufficient to demonstrate Hulu's knowledge that it identified its users and their video selections to Facebook.”

Kamber also added that the plaintiffs believe the ruling, if allowed to stand, would “severely undermine statutory privacy protections.”

In addition to KamberLaw, Parisi & Havens LLP and Strange & Carpenter represented the named plaintiffs. O'Melveny & Myers and Covington & Burling LLP represented Hulu.

To contact the reporter on this story: David McAfee in Los Angeles at

To contact the editor responsible for this story: Katie W. Johnson at

Full text of the court's opinion is available at


Request Bloomberg Law: Privacy & Data Security