Opinion
No. C 11-03764 LB
08-10-2012
IN RE HULU PRIVACY LITIGATION
ORDER DENYING DEFENDANT'S MOTION TO DISMISS PLAINTIFFS'
FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT
I. INTRODUCTION
In this putative class action, viewers of Hulu's on-line video content allege that Hulu wrongfully disclosed their video viewing selections and personal identification information to third parties such as online ad networks, metrics companies (meaning, companies that track data), and social networks, in violation of the Video Privacy Protection Act, 18 U.S.C. § 2710. First Amended Consolidated Class Action Complaint, ECF No. 37 at 18.
Citations are to the Electronic Case File ("ECF") with pin cites to the electronic page number at the top of the document.
The court previously dismissed claims two through seven. See 6/11/12 Order, ECF No. 64. The remaining claim alleges that Hulu's data transmissions to third parties violated the Video Privacy Protection Act, which prohibits a "video tape service provider" from transmitting personal identifying information of "consumers" (except for certain permissible disclosures). See 18 U.S.C. § 2710(b)(1). Defendant Hulu moves to dismiss the claim under Federal Rule of Civil Procedure 12(b)(1) on the ground that plaintiffs lack standing. Hulu also argues that the court should dismiss under Rule 12(b)(6) for failure to state a claim because (1) Hulu is not a "Video Tape Service Provider" and thus is not liable under the Act, (2) any disclosures were incident to the ordinary course of Hulu's business and not covered by the Act, and (3) plaintiffs are not "consumers" within the meaning of the Act. Motion to Dismiss, ECF No. 49.
Following a hearing on June 7, 2012, the court held that the Plaintiffs alleged standing sufficiently but allowed further briefing in case the Supreme Court's decision in First American Fin'l Corp. v. Edwards altered the standing analysis. 6/11/12 Order, ECF No. 64 at 9-12. The Supreme Court dismissed the writ of certiorari as improvidently granted. See 132 S. Ct. 2536 (June 28, 2012). The court thus denies Hulu's Rule 12(b)(1) motion to dismiss for lack of standing for the reasons stated in the June 11, 2012 Order.
The court held a second hearing on August 9, 2012 to address Hulu's 12(b)(6) motion. For the reasons stated below, the court denies the motion.
II. FACTS
A. Procedural History
On July 29, 2011, Plaintiffs Garvey and Tsan filed a complaint, and on September 2, 2011, they filed an amended complaint, in Garvey v. Kissmetrics et al., No. C 11-03764 LB. See ECF Nos. 1 and 13. On September 14, 2011, Plaintiffs Couch, Garza, Jauregui, and Moncada filed a complaint in the Central District of California in Couch v. Space Pencil et al., No. C 11-05606 LB, and the case was transferred to this district on September 14, 2011. See Couch, No. C 11-05606 LB, ECF Nos. 1 and 48. The Garvey and Couch complaints both named Space Pencil (doing business as Kissmetrics) and Hulu as defendants, but the Plaintiffs voluntarily dismissed their claims against Space Pencil, which remains a defendant in a related case. See Garvey, No. C 11-03764 LB, ECF No. 31; Couch, No. C 11-05606 LB, ECF No. 22; Kim v. Space Pencil, Inc., No. C 11-03796 LB. The parties stipulated to, and the court ordered, the consolidation of the Garvey and Couch cases into this consolidated action now captioned "In re Hulu Privacy Litigation." ECF Nos. 38, 39. On February 15, 2012, Plaintiffs filed the pending First Amended Consolidated Class Action Complaint ("FAC") naming only Hulu as a defendant. ECF No. 37. The FAC defines the class period as March 4, 2011 to July 28, 2011 and defines a "Class" and a "Video Subclass:" (1) Class: "All individuals and entities in the United States who visited Hulu.com during the Class Period;" and (2) Video Subclass: "All individuals and entities in the United States who visited Hulu.com during the Class Period and viewed video content." Id. at 15, ¶¶ 96-97. B. Allegations in Complaint
The caption still names Kissmetrics, but only Hulu is a defendant.
1. Hulu's Product
Hulu operates a website called Hulu.com that provides video content, both previously released and posted and originally developed. ECF No. 37, ¶¶ 1, 52, 114. The programs include news, entertainment, educational, and general interest programs. Id. ¶ 114.
2. Plaintiffs' Use of Hulu.com
Plaintiffs and Class Members used their Internet-connected computers and browsers to visit hulu.com and view video content. Id. ¶1, 52. They were renters, purchasers, and/or subscribers of goods and/or services from Hulu and so were consumers as defined in the Video Privacy Protection Act. Id. ¶ 115.
3. Plaintiffs' Interests
Plaintiffs value their privacy while web-browsing; they do not want to be tracked online; their web browsing (including their viewing choices) involves personal information that is private; it is their decision to disclose (or not) information when they view a web page; and they expect that the websites they use and "the third parties utilized by those websites will not transmit code that repurposes . . . software . . . to perform unintended functions, such as tracking and circumvention of privacy protection[s]" in Plaintiffs' software. See id. ¶¶ 15-28.
4. Hulu's Alleged Unauthorized Tracking and Sharing of Users' Video Viewing Details
Hulu allowed a metrics company called KISSmetrics to place code containing tracking identifiers on Plaintiffs' computers in the browser cache, Adobe Flash local storage, or DOM local storage. Id. ¶¶ 30-32, 34-51, 69. This code allegedly "respawned" or "resurrected" previously- deleted cookies. Id. ¶ 40. This code was "inescapable" and allowed Plaintiffs' data to be "retained . . . so that they could be tracked over long periods of time and across multiple websites, regardless of whether they were registered and logged in." Id. ¶ 69. As a result, when Class Members viewed video content on Hulu.com, Hulu transmitted their video viewing choices and personally identifiable information to third parties without obtaining their written consent before the disclosure. Id. ¶¶ 52, 59, 69, 116. The third parties included online ad networks, metrics companies, and social networks such as Scorecard Research ("Scorecard") (an online market research company), Facebook (the online social network), DoubleClick (an online ad network), Google Analytics (an online web analytics company), and QuantCast (an online ad network and web analytics company). Id. ¶¶ 52-53, 116.
The information transmitted to Scorecard and Facebook included information that identified Plaintiffs and Class Members personally. Id. ¶ 53. As to Facebook, Hulu included their Facebook IDs, connecting the video content information to Facebook's personally identifiable user registration information. Id. ¶ 58. As to Scorecard, Hulu provided Plaintiffs' "Hulu profile identifiers" linked to their "individual Hulu profile pages that included name, location, preference information designated by the user as private, and Hulu username (which, in the case of many individuals, is the same screen name used in other online environments.)" Id. ¶ 54. Scorecard stored the Hulu ID information in a cookie named "b.scorecardresearch.com" and stored the video information in a cookie named "beacon.scorecardresearch.com." Id. ¶ 55. Scorecard also set its own unique identifier tied to these two cookies. Id. Scorecard's cookies were unencrypted, so any intruder who gained access to a Class Member's computer could "engage in a trivial exploit to view the profile and perform a 'screen scrape' copy of that person's profile page." Id. ¶ 56. Hulu's and Scorecard's practice of sharing user profile IDs and storing them in cookies is a severe failure to observe basic security standards in the handling of user information. Id. ¶ 58.
Plaintiffs and Class Members "reasonably expected that Hulu would not disclose their video and/or video service requests and their identities to social networks and online ad/metrics networks," and they "did not authorize or otherwise consent to" such disclosures. Id. ¶¶ 59-60.
5. Hulu's Terms of Use and Privacy Policy
As a condition of using Hulu, Plaintiffs agreed to Hulu's terms of use and privacy policy. Plaintiffs reference the policy in the complaint, and Hulu attached the November 17, 2010 privacy policy, the updated June 30, 2011 policy, and the terms of use to its motion to dismiss. Robinson Decl. Exs. A-C, ECF Nos. 50-1 to 50-3. Because Plaintiffs reference the policy in the complaint and do not question the authenticity of the documents (and indeed cite them), the court considers them. See Bell Atlantic v. Twombly, 550 U.S. 544, 568 n.13 (2007); Branch v. Tunnell, 14 F.3d 449, 454 (9th Cir. 1994), overruled on other grounds, Galbraith v. County of Santa Clara, 307 F.3d 1119, 1127 (9th Cir. 2002).
III. LEGAL STANDARD
A court may dismiss a complaint under Federal Rule of Civil Procedure 12(b)(6) when it does not contain enough facts to state a claim to relief that is plausible on its face. See Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 570 (2007). "A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). "The plausibility standard is not akin to a 'probability requirement,' but it asks for more than a sheer possibility that a defendant has acted unlawfully." Id. (quoting Twombly, 550 U.S. at 557). "While a complaint attacked by a Rule 12(b)(6) motion to dismiss does not need detailed factual allegations, a plaintiff's obligation to provide the 'grounds' of his 'entitle[ment] to relief' requires more than labels and conclusions, and a formulaic recitation of the elements of a cause of action will not do. Factual allegations must be enough to raise a right to relief above the speculative level." Twombly, 550 U.S. at 555 (internal citations omitted).
In considering a motion to dismiss, a court must accept all of the plaintiff's allegations as true and construe them in the light most favorable to the plaintiff. See id. at 550; Erickson v. Pardus, 551 U.S. 89, 93-94 (2007); Vasquez v. Los Angeles County, 487 F.3d 1246, 1249 (9th Cir. 2007).
If the court dismisses the complaint, it should grant leave to amend even if no request to amend is made "unless it determines that the pleading could not possibly be cured by the allegation of other facts." Lopez v. Smith, 203 F.3d 1122, 1127 (9th Cir. 2000) (quoting Cook, Perkiss and Liehe, Inc. v. Northern California Collection Serv. Inc., 911 F.2d 242, 247 (9th Cir.1990)).
IV. DISCUSSION
Plaintiffs allege that Hulu "knowingly and without . . . [their] consent disclosed to third parties . . . [their] video viewing selections and personally identifiable information, knowing that such disclosure included the disclosure of [their] personally identifying information . . . and their requests for and/or obtaining of specific video materials and/or services from Hulu," in violation of the Video Privacy Protection Act ("VPPA"), 18 U.S.C. § 2710(b)(1). Id. ¶¶ 116-17.
The VPPA "'protect[s] certain personal information of an individual who rents video materials from disclosure'" See Dikes v. Borough of Runnemede, 936 F. Supp. 235, 238 (D.N.J. 1996) (quoting S. Rep. 100-599, 2d Sess. at 16 (1988)). The impetus for the Act was a newspaper's obtaining and publishing a list of video tapes that Supreme Court nominee Judge Robert H. Bork rented from his local video store. Id. (citing S. Rep. 100-599, 2d Sess. at 5).
The Act prohibits a "video tape service provider" from (1) knowingly disclosing to any person (2) personally identifiable information concerning any consumer of such provider (3) except for certain disclosures - such as to the consumer or law enforcement - allowed under section 2710(b)(2). 18 U.S.C. § 2710. "'Personally identifiable information' includes information which identifies a person as having requested or obtained specific video materials or services." Id. § 2710(a)(3). Such disclosures are not prohibited if they are "incident to the ordinary course of business" of the video tape service provider. 18 U.S.C. § 2710 (b)(2)(E). The VPPA defines "ordinary course of business" as "debt collection activities, order fulfillment, request processing, and the transfer of ownership." 18 U.S.C. § 2710(a)(4).
Section 2710(c)(1) provides a private federal right of action to "any person aggrieved by any act of a person in violation of this section." Under section 2710(c)(2), the federal court may award (A) actual damages but not less than liquidated damages of $2,500, (B) punitive damages, (C) reasonable attorneys' fees and litigation costs, and (D) preliminary and equitable relief that the court determines is appropriate.
--------
Hulu moves to dismiss under Federal Rule of Civil Procedure 12(b)(6) for failure to state a claim, alleging that (A) Hulu is not a "video tape service provider" and thus is not liable under the Act, (B) any disclosures were incident to the ordinary course of Hulu's business and are not covered by the Act, and (C) Plaintiffs are not "consumers" within the meaning of the Act. Motion to Dismiss, ECF No. 49, at 21-24. A. Video Tape Service Provider
VPPA defines "video tape service provider" as "any person, engaged in the business, in or affecting interstate or foreign commerce, of rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials." 18 U.S.C. § 2710 (a)(4).
Hulu does not deal in prerecorded video cassette tapes. Thus, whether Hulu is a "video tape service providers" turns on the scope of the phrase "similar audio visual materials."
Citing dictionary definitions, Hulu contends that "materials" are things "composed of physical matter." Motion, ECF No. 49 at 22. Hulu argues that the legislative history confirms a focus on "physical stores selling goods." Id. (quoting the statement in S. Rep. No. 100-599 at 6 that "[t]he bill prohibits video stores from disclosing personally identifiable information"). As drafted, Hulu contends, the VPPA "only regulates businesses that sell or rent physical objects (i.e, 'video cassettes or other similar audio visual materials') . . . and not businesses that transmit digital content over the Internet." Id. at 22-23. This makes sense, Hulu argues, because unlike bricks-and-mortar businesses that can provide videos directly to customers, video-streaming businesses like Hulu necessarily rely on third parties to "facilitate many aspects of their businesses, including in-stream advertising, analytics, and transmission to users." Id. at 23. Had Congress wanted to regulate businesses dealing in digital content, it would have defined "video tape service provider" to include businesses that "traffic in audio-visual information or data." Id.
Plaintiffs counter that by focusing on the word "materials," Hulu misconstrues the VPAA to apply only to physical objects and ignores the full statutory language that covers businesses that "rent, sell, or deliver 'prerecorded video cassette tapes or similar audio visual materials.'" Opposition, ECF No. 58 at 11 (quoting statute). "Similar audio visual materials" is a broad phrase designed to include new technologies for pre-recorded video content. Id. (quoting Senate Report's statement that "video tape service provider" means a person "'engaged in the business of . . . delivery of pre-recorded video cassette tapes or similar audio visual materials such as laser discs, open-reel movies, and CDI technologies.'" Id. Plaintiffs note that Hulu provides only a dictionary definition for the singular, adjective form of the word "material" as opposed to the definition of the plural "materials" used in the VPAA. Id. at 11-12. The singular "material" is "matter" or the composition of something, but the plural "materials" means "the equipment necessary for a particular activity." Id. And, Plaintiffs observe, in its own terms of use, Hulu uses the words "video materials" to mean "content . . . includ[ing] . . . any text, graphics, layout, interface, logos, photographs, audio and video materials, and stills." Id. at 12 (citing Robinson Decl., Exh. C, ECF No. 50-3). Plaintiffs conclude that pre-existing video cassettes are obsolete and analogize Hulu's argument that its product is not a "similar audio visual material" to an argument that an e-mail is not a document because it exists only in cyberspace. Id.
Statutory interpretation begins with the plain language of the statute, and it ends there if the text is unambiguous. See Edwards, 610 F.3d at 517. If the statutory language is unclear, courts consider legislative history and also follow the "common practice of consulting dictionary definitions to clarify their ordinary meaning [] and look to how the terms were defined at the time [the statute] was adopted.]" United States v. TRW Rifle 7.62X51mm Caliber, One Model 14 Serial 593006, 447 F.3d 686, 690 (9th Cir. 2006) (citing MCI Telecomms. Corp. v. AT & T Co., 512 U.S. 218, 228 (1994) (other quotation omitted); see United States v. Williams, 659 F3d 1223, 1225 (9th Cir. 2011).
To this reader, a plain reading of a statute that covers videotapes and "similar audio visual materials" is about the video content, not about how that content was delivered (e.g. via the Internet or a bricks-and-mortar store). Still, the online streaming mechanism of delivery here did not exist when Congress enacted the statute in 1988. A dictionary definition helps some. The undersigned looked at the third edition of Oxford English Dictionary, which defines "material" both as "relating to substance" and as "Text or images in printed or electronic form; also with distinguishing word, as reading material, etc." Oxford English Dictionary, Third Edition, March 2001; online version March 2012 at http://www.oed.com/view/Entry/114923 (accessed June 3, 2012). This second definition predates the streaming video content that Hulu offers and comports with the court's ordinary sense of the definition of "audio visual materials."
Also, the Senate Report confirms that Congress was concerned with protecting the confidentiality of private information about viewing preferences regardless of the business model or media format involved. See, e.g., S. Rep. No. 100-599 at 1 (VPPA follows a long line of statutes passed by Congress to extend privacy protections to records that contain information about individuals), 3 (quoting Senator Leahy's denouncement of the disclosures: "It is nobody's business what Oliver North or Robert Bork or Griffin Bell or Pat Leahy watch on television or read . . . . In an era of interactive television cables, the growth of computer checking and check-out counters, of security systems and telephones, all lodged together in computers, it would be relatively easy at some point to give a profile of a person and tell what they buy in a store, what kind of food they like, what sort of television programs they watch. . . . I think that is wrong, I think that is Big Brother, and I think it is something we have to guard against), 2-4 (extensive discussion of privacy, including Supreme Court case law and noting that protecting an individual's choice of books and films is a pillar of intellectual freedom under the First Amendment).
Congress's concern with privacy and protecting the confidentiality of an individual's choices is relevant context to the Senate Report's discussion of "similar audio visual materials, such as laser discs, open-reel movies, and CDI technologies." See S. Rep. No. 100-599 at 12. Considering both together does not suggest - as Hulu argues - an intent to limit the VPAA to tangible materials but -as Plaintiffs argue - instead suggests Congress's intent to cover new technologies for pre-recorded video content. Indeed, the Senate Report discusses extensively the concept of privacy in an evolving technological world. The court concludes that Congress used "similar audio video materials" to ensure that VPAA's protections would retain their force even as technologies evolve.
The question is whether the mechanism of delivery here - streaming versus bricks-and-mortar delivery - ends this case at the pleading stage. Hulu's remaining argument is only that it is not a "video tape service provider" because the VPPA does not expressly cover digital distribution (a term that did not exist when Congress enacted the statute). Reply, ECF No. 60 at 13. Given Congress's concern with protecting consumers' privacy in an evolving technological world, the court rejects the argument. B. Disclosures "Incident to the Ordinary Course of Business"
The next issue is whether Hulu's alleged disclosures did not violate the VPAA because they were "incident to the ordinary course of [Hulu's] business." See 18 U.S.C. § 2710 (b)(2)(E)). The VPPA defines "ordinary course of business" as "debt collection activities, order fulfillment, request processing, and the transfer of ownership." 18 U.S.C. § 2710(a)(4).
Hulu argues that the section shows that Congress took into account that providers use third parties in their business operations and "'allows disclosure to permit video tape service providers to use mailing houses, warehouses, computer services, and similar companies for marketing to their customers. These practices are called 'order fulfillment' and 'request processing.'" Id. (quoting S. Rep. No. 100-599 at 14). Hulu contends that the plaintifffs' allegations - that Hulu shared data with online market research, ad network and web analytics companies - all involve Hulu's use of third-party vendors providing services like internal research, advertising, and analytics that Hulu can do on its own and thus permissibly can outsource in the "ordinary course of business." Id. at 24.
Plaintiffs counter that the "ordinary course of business" is narrowly defined to mean only debt collection, order fulfillment, request processing, and the transfer of ownership. Opposition, ECF No. 58 at 14. The third parties here - ScoreCard, Google Analytics, Doubleclick, QuantCast, and Facebook - do not perform any of those functions. Id. Market research and web analytics are not in the ordinary course of Hulu's business of delivering video content to consumers. Id. And if Hulu is challenging Plaintiffs' facial allegations about the role of the third parties that Hulu shared information with, those are factual questions that cannot be resolved in a motion to dismiss. Id.
Whatever the merits are to Hulu's contentions that it uses the challenged services to deliver targeted advertisements to its users, Plaintiffs alleged unauthorized tracking of Plaintiffs' data (including video content information). The court cannot resolve this factual issue in a motion to dismiss. Put another way, as pled, the claim survives a Rule 12(b)(6) motion.
At the hearing, Hulu emphasized that Plaintiffs raised specific allegations about unauthorized tracking of Plaintiffs' data only with regard to Scorecard and Facebook and did not provide the same specifics about QuantCast, DoubleClick, and Google Analytics. See Complaint, EFF No. 37 at ¶¶ 53-56, 58 (allegations about Scorecard and Facebook). Hulu argued that at least Plaintiffs ought to make a more specific showing about QuantCast, DoubleClick, and Google Analytics. Again considering the issue from a 12(b)(6) perspective, the court concludes that Plaintiffs alleged their claims specifically enough to give fair notice. Plaintiffs alleged what Hulu did (transmitting video viewing choices and personal identifiable information to third parties without obtaining Plaintiffs written consent before the disclosure), it identified the third parties, and it gave specific examples in the context of Scorecard and Facebook. See supra pages 3-4 (describing allegations). As the court said at the hearing, Plaintiffs do not have to plead their evidence to give fair notice of their claims. C. "Consumers" Under the VPPA
The VPPA defines "consumers" as "any renter, purchaser, or subscriber of goods or services from a video tape service provider." 28 U.S.C. § 2710(a)(1). The terms "renter," "purchaser," and "subscriber" are not defined in the Act and thus are given their ordinary meaning. See Gordon v. Virtumundo, Inc., 575 F.3d 1040, 1062 (9th Cir. 2009). The parties focus on the term "subscriber" because Plaintiffs did not allege that they rented or purchased content from Hulu.
Hulu argues that the ordinary meaning of subscriber implies payment of money. Motion, ECF No. 49 at 24. Also, the acts of renting and buying require the exchange of money, and a consistent interpretation of "subscriber" also should require the payment of money. Reply, ECF No. 60 at 14. Plaintiffs did not allege that they subscribed to Hulu Plus, a pay-to-watch service. Id. Plaintiffs respond that they signed up for a Hulu account, became registered users, received a Hulu ID, established Hulu profiles, and used Hulu's video streaming services. Opposition, ECF No. 58 at 13. Hulu counters that even if payment is not required to be a subscriber, being a subscriber requires more than just visiting Hulu. Reply, ECF No. 60 at 15-16 (arguing that Plaintiffs did not plead that they each registered for Hulu accounts).
Plaintiffs pleaded more than just visiting Hulu's website. They were subscribers of goods and services. FAC, ECF No. 37, ¶ 115. They visited hulu.com and viewed video content. Id. ¶¶ 1, 4. The resurrected previously-deleted cookies allowed their data to be tracked "regardless of whether they were registered and logged in." Id. ¶ 69. Hulu gave Scorecard research Plaintiffs' "Hulu profile identifiers" linked to their "individual Hulu profile pages that included name, location preference information designated by the user as private, and Hulu username." Id. ¶ 54; see also id. ¶ 56 (discussing how Scorecard's cookies allowed access to a class member's profile and profile page. And while the terms "renter" and "buyer" necessarily imply payment of money, the term "subscriber" does not. Hulu cites no authority suggesting any different result. If Congress wanted to limit the word "subscriber" to "paid subcriber," it would have said so.
V. CONCLUSION
The court denies Hulu's motion to dismiss.
This disposes of ECF No. 49.
IT IS SO ORDERED.
______________
LAUREL BEELER
United States Magistrate Judge