Appeals Court Says Downloading And Using A Free App Doesn't Make You A 'Subscriber'

from the a-device-is-not-a-person,-even-if-they're-inseperable dept

A plaintiff invoking the Video Protection Privacy Act (VPPA) has just been handed a second defeat in his lawsuit against Cartoon Network. The Eleventh Circuit Appeals Court has reached the same conclusion as the lower court, albeit for different reasons.

Originally written to protect consumers against the release of their VHS rental history, the VPPA has since been invoked in various lawsuits to address the release of protected "subscriber information" to third parties, including more than one against the Blockbuster of today: Netflix.

The most recent VPPA lawsuit against Netflix argued that showing viewing history (upon login to an account) violated the account holder's privacy. The Ninth Circuit Court of Appeals found in favor of Netflix, rather than the person who felt they should still have viewing history privacy despite leaving accounts logged in and/or sharing login information.

This one is a bit more tangled and involves Cartoon Network's phone app, rather than the new face of video rentals. The CN app allows users to view the network's videos. It does not require a login to do so. Because no login was required, the plaintiff felt the app wouldn't gather or disseminate "personal information." Well, the app does collect some information, which is specific to the device, but not necessarily the person.

Cartoon Network identifies and tracks an Android smartphone user on the CN app through his mobile device identification or Android ID, which is “a 64-bit number (hex string) that is randomly generated when a user initially sets up his device and should remain constant for the lifetime of the user’s device.” Cartoon Network keeps track of an Android user’s viewing history by maintaining a record of “every video clip or [episode] viewed by the user” via the Android ID number. Cartoon Network then sends this information to a third-party data analytics company called Bango. Each time a user closes out of the CN app on his Android device, “[a] complete record”—including the user’s “Android ID and a list of the videos he viewed”—is sent to Bango.

Bango, of course, is the subsidization behind the free app.

Bango specializes “in tracking individual behaviors across the Internet and mobile applications . . . [and claims] that its technology ‘reveals customer behavior, engagement and loyalty across and between all [ ] websites and apps.’” Bango uses Android IDs “to identify and track specific users across multiple electronic devices, applications, and services.” Because Bango is apparently “smarter than the average bear,” see The Yogi Bear Show, Trying to Escape Jellystone Park (Hanna-Barbera Prod. 1961), it can “automatically” link an Android ID to a particular person by compiling information about that individual from other websites, applications, and sources. So when Cartoon Network sends Bango the Android ID of a CN app user along with his video viewing history, Bango associates that video history with a particular individual.

It was this tracking that bothered Mark Ellis, who sued on behalf of himself and "others similarly situated."

The decision doesn't head off into a discussion of what is or isn't personally-identifiable and subject to the restraints of the VPPA. Instead, it discusses the difference between a "subscriber" and someone with no viable legal claim at all. The lower court decided Ellis' minimal connection to Cartoon Network (via its free app and his phone's ID) was enough to grant him standing as a "subscriber." But it also found that the information gathered by CN wasn't "personally identifiable" under the VPPA definitions. An Android ID identifies a device, not a person, even if only one person uses it for the lifetime of the device (see also: privacy arguments about license plate readers).

Ellis appealed this finding, and struck out again, but from the other side of the plate.

Mr. Ellis did not sign up for or establish an account with Cartoon Network, did not provide any personal information to Cartoon Network, did not make any payments to Cartoon Network for use of the CN app, did not become a registered user of Cartoon Network or the CN app, did not receive a Cartoon Network ID, did not establish a Cartoon Network profile, did not sign up for any periodic services or transmissions, and did not make any commitment or establish any relationship that would allow him to have access to exclusive or restricted content.

Mr. Ellis simply watched video clips on the CN app, which he downloaded onto his Android smartphone for free. In our view, downloading an app for free and using it to view content at no cost is not enough to make a user of the app a “subscriber” under the VPPA, as there is no ongoing commitment or relationship between the user and the entity which owns and operates the app. Importantly, such a user is free to delete the app without consequences whenever he likes, and never access its content again. The downloading of an app, we think, is the equivalent of adding a particular website to one’s Internet browser as a favorite, allowing quicker access to the website’s content. Under the circumstances, Mr. Ellis was not a “subscriber.”

Having found that Ellis is not a subscriber, the court doesn't weigh in on the issue of the information gathered and distributed by the app. It infers -- by its discussion of previous cases -- that the app behaves more like a website cookie that tracks unregistered users by device info rather than more personally-identifiable data.

Had Ellis increased his level of interaction -- say, by creating an account -- he would have had a better chance at being recognized as a "subscriber." Of course, had he done this, he would have had to agree to CN's terms of service, which likely contains plenty of fine print "disclosing" its relationship with Bango, as well as to what is specifically collected and passed on. So, there would have been no cognizable injury in that case either.

Filed Under: apps, cartoon network, eleventh circuit, privacy, subscribers, vppa
Companies: cartoon network

Appeals Court Says Netflix Doesn't Violate Privacy By Displaying Viewing History To Anyone Using That Account

from the because-duh dept

The Ninth Circuit Appeals Court has upheld a win for Netflix in yet another privacy class-action lawsuit arising from the publication of then-Supreme Court nominee Robert Bork's rental history oh so many years ago. The Video Privacy Protection Act sprang into being in 1988 and was used to extract a settlement from Netflix over 20 years later.

The lawsuit Netflix settled featured one key difference: in that case, rental information -- in the form of "anonymized data" -- was released to third parties working on better suggestion algorithms in hopes of winning $1 million. In this case, no information was released in any form to third parties… at least not in this sense.

At the center of this lawsuit were complaints that Netflix exposed viewing history to certain third parties, i.e., anyone who used the same login as the account holder. This would include family, friends and guests at a person's residence. Since Netflix allows any number of devices to be allowed to access the account simultaneously (depending on how much you want to pay per month), one person's viewing history could theoretically be accessed by a great many people.

So, while there may be a privacy concern, it isn't a logical one. The information "exposed" to third parties is done so willingly by the account holder by sharing login info/logged-in devices with other viewers. Certainly the original account holder would like immediate access to recently viewed content. But this convenience also allows anyone using that login to see what's been viewed by that account. The plaintiffs claimed this convenient feature was actually a violation of the 27-year-old Video Privacy Protection Act.

The complaint alleges that upon setting up a Netflix account, personally identifiable information, by default, is only disclosed to a Netflix subscriber through her password-protected account. Under those circumstances, a subscriber’s queue or recommendation lists are only viewable by the subscriber. Netflix subscribers can then elect to display on their televisions what would otherwise be password-protected information by registering Netflix-ready devices in their accounts. Thereafter, Netflix automatically displays on a television what it displays on a subscriber’s computer: streamed instant videos, the subscriber’s queue, and video recommendations. This is plainly a disclosure “to the consumer” as contemplated by the VPPA. When Netflix displays a subscriber’s queue, viewing history, or recommendation lists in her online account, that is a disclosure directly to the consumer. The nature of that disclosure does not change when subscribers choose to display the same content on their television screens. The subscriber’s choice to do so does not trigger some new statutory duty on the part of Netflix.

Furthermore, the law (logically) does not demand that Netflix prevent things it can't possibly control.

The fact that a subscriber may permit third parties to access her account, thereby allowing third parties to view Netflix’s disclosures, does not alter the legal status of those disclosures. No matter the particular circumstances at a subscriber’s residence, Netflix’s actions remain the same: it transmits information automatically to the device that a subscriber connected to her Netflix account. The lawfulness of this disclosure cannot depend on circumstances outside of Netflix’s control.

The lawsuit also used California's civil code as a fallback option in case the VPPA claims failed, but the court finds the wording in that statute doesn't open Netflix up to any additional culpability.

While phrased in slightly different language than the VPPA, the California Civil Code plainly excludes liability for disclosures to a subscriber who is the subject of a record. Netflix’s disclosure of personal information was made to its subscribers and therefore it is not liable under section 1799.3.

That this case made it as far as the appeals court is simply the judicial system functioning as it should, rather than indicative of the lawsuit's strengths. Exhausting every available remedy is something the system grants to plaintiffs, even if the arguments made are incredibly weak.

The simple fact is that if someone don't want anyone but Netflix knowing what they watch, they should't let anyone but Netflix have access to the account. Additionally, the company now allows the account holder to remove recently-viewed titles at any point in time (exception: children's accounts). Granted, this feature didn't go into effect until after the lawsuit was filed, but its nonexistence at the point of filing (2011) didn't make the lawsuit any less misguided. Information pertinent and relevant to the account holder will obviously be displayed to any person using any device that is logged on to that account. Why anyone should expect anything else when they "log in" is baffling.

Filed Under: privacy, video rentals, videos, vppa
Companies: netflix

Apparently, Congress Isn't Actually Interested In Requiring A Warrant For Law Enforcement To Read Your Email

from the it-was-all-a-charade dept

Yes, we've already covered the rejection of key amendments in the FISA Amendments Act renewal, but that wasn't the only case of Congress ignoring the public's privacy concerns as they close out this session.

Back in September, we noted that Senator Patrick Leahy, who has been working on much needed reforms for ECPA (the Electronic Communications Privacy Act) -- such as requiring law enforcement get a warrant to read your email -- had attached his ECPA reform plan to an update of the Video Privacy Protection Act (VPPA). While I know some privacy folks were worried about this update to the VPPA, I don't have much of a problem with it. The original VPPA, written as a quick response to a video store revealing Robert Bork's (somewhat boring) video rental history during his Supreme Court nomination hearings, did seem a bit limiting -- especially for online video sites such as Netflix that wanted to add some useful social features. However, it was the ECPA reform part that was more important. Attaching ECPA reform to VPPA reform didn't make some privacy folks happy, but they seemed willing to go along with the VPPA changes if it really meant that we'd get warrant requirements for emails and other digital messages.

There were some attempts to water down that ECPA reform at the end of last month, but the Senate Judiciary Committee kept the warrant requirement in there and rejected various attempts to weaken the bill. As we noted, however, it still was a long way from becoming law, given the need to pass a full Senate vote and to have a companion House bill make the rounds. We assumed that there would be no movement until next year and the new Congress.

But... late last week, the House rubberstamped the VPPA update, and the Senate, almost immediately signed off on the House's version, which the President is expected to sign any moment now. In case you missed it, that means that the ECPA reforms -- which were supposed to be bundled with the VPPA to make the whole thing palatable -- got dropped entirely. And now we get the VPPA reforms and no ECPA reform at all. Neat trick. "Bundle" two things to get support... and then at the last minute drop one part and rush through the other.

Filed Under: congress, ecpa reform, privacy, vppa, warrant

Law Enforcement Officials Freak Out About Possibility Of Having To Get Warrants To Read Your Email

from the bill-delayed dept

We recently noted that Senator Leahy had attached his mostly good ECPA (Electronic Communications Privacy Act) reform bill to another bill reforming the VPPA (Video Privacy Protection Act). The ECPA reform would update a decades-old law that law enforcement has interpreted to more or less mean they don't need a warrant to read your online email. Leahy's update would require a warrant. This is a good and important reform that should be supported. But, of course, law enforcement freaked out and it appears that Leahy has backed down, delaying hearings on the bill for now (funny how he really wanted to push through PIPA despite massive public protests, but a few law enforcement people get upset about respecting the 4th Amendment and things get delayed). From Declan McCullagh's coverage:

The delay comes two days after a phalanx of law enforcement organizations objected to the legislation, asking Leahy to "reconsider acting" on it "until a more comprehensive review of its impact on law enforcement investigations is conducted." The groups included the National District Attorneys' Association and the National Sheriffs' Association.

[....] A person participating in Capitol Hill meetings on this topic told CNET that Justice Department officials have been expressing their displeasure about requiring search warrants. The department is on record as opposing such a requirement: James Baker, the associate deputy attorney general, has publicly warned that requiring a warrant to obtain stored e-mail could have an "adverse impact" on criminal investigations.

Of course it would have "adverse impact" on criminal investigations. So do lots of things -- but those are the rules law enforcement plays by in a free society. It's not built to make law enforcement's life easy.

Either way, it appears that this bit of ECPA reform will get pushed off once again. Hopefully, when it comes back, it won't be watered down.

For what it's worth, both the EFF and the ACLU -- who strongly support ECPA reform similar to what Leahy has been proposing -- have also not been that happy with how Leahy introduced this bill, because they both oppose the changes to the VPPA, which they're afraid will weaken privacy for people. This is a (somewhat rare, but not unprecedented) situation where I disagree with both of those organizations. The VPPA was a specific and broad carve-out to deal with a single situation (bork bork bork). I think it's reasonable to update it to allow for things like letting people choose to let Netflix and social networks share info on what movies they've watched -- just like the can choose to show what music they listen to. I don't necessarily believe that it makes sense to link the VPPA to ECPA reform, but I don't think that passing the VPPA reform is so problematic that it should stop ECPA reform. Of course, if law enforcement has its way (and so far, that seems to be the case), ECPA reform might never happen. Is it really worth worrying about how you can choose to share your Netflix movies on Facebook while the Justice Department feels it can snoop broadly through your Gmail?

Filed Under: 4th amendment, ecpa, patrick leahy, privacy, vppa, warrants
Companies: netflix