Two recent developments in data privacy litigation highlight the continuing challenges to companies that collect internet usage information without clearly disclosing the manner and method in which they are doing so to users. As these events demonstrate, plaintiffs’ attorneys are aggressively bringing actions against companies that collect user data, including through the invocation of California’s broad consumer-protection laws and even through an antiquated statute originally designed to prevent Blockbuster and its ilk from disclosing patrons’ potentially embarrassing video rentals. Although the two cases have far different procedural postures – the Vizio case was just filed, while the Google suit was previously dismissed by the trial court and recently resurrected by the Court of Appeals for the Third Circuit– both provide examples of how failure to maintain a privacy policy which accurately reflects a company’s collection and use of consumer data, or clearly communicate that policy to consumers, can lead to increased litigation risks.
The Google “Cookie” Class Action
First, on November 10, the Third Circuit issued a unanimous and precedential opinion in In re: Google Inc. Cookie Placement Consumer Privacy Litigation, reviving a claim that Google intentionally invaded web users’ privacy by placing cookies on their browsers without their knowledge. In that putative class action, plaintiffs alleged that Google, along with other internet advertisers, bypassed the cookie-blocking features in Internet Explorer and Safari to place cookies on the plaintiffs’ browsers, thus enabling them to track plaintiffs’ web use without their consent. The allegations arose from a February 2012 Wall Street Journal article that revealed that Google was using code to command users’ web browsers to trigger an exception to their cookie blockers.
Plaintiffs brought a bevy of both federal and state claims, including invocation of California’s consumer-protection laws. Although the district court dismissed all claims, the Third Circuit held that plaintiffs adequately pled a claim for invasion of privacy under California’s Constitution and state law tort principles. Google argued that courts routinely hold that the tracking, collation, and disclosure of internet usage information does not amount to an actionable privacy invasion, but the court was unpersuaded, holding that the manner in which Google placed cookies – by allegedly tricking browsers with cookie-blockers to accept them – created a potential violation. The court reasoned that Google’s placement of cookies on users’ browsers despite the presence of cookie-blockers defeated users’ “reasonable expectations” regarding their privacy, sufficient to state a claim for invasion of privacy under California law. Given the court’s designation of its opinion as precedential, this holding is likely to have a major impact on future litigation brought in this area.
The Vizio “Smart TV” Class Actions
Second, on November 11 and 13, two putative class actions were filed against Vizio in California federal court alleging that its Smart TVs are capturing the IP addresses of their users unbeknownst to them. The cases, Watts v. Vizio Holdings and Reed v. Cognitive Media, contain substantially the same allegations, including that Vizio is enlisting the help of data brokers to obtain personalized information about users from their IP addresses and that the resulting “enhanced” data is being sold to advertisers. These cases come hot on the heels of a November 9th ProPublica report that Vizio was tracking data about viewing habits and sharing it with advertisers through a feature called “Smart Interactivity” that is enabled on Vizio’s TV’s by default.
In addition to California state law claims, the Vizio cases assert claims under the federal Video Privacy and Protection Act, pursuant to which a video tape service provider must keep its customers’ personally identifiable information confidential. The Act – passed in 1988 in the wake of Congressional questions over Supreme Court Nominee Robert Bork’s video rental history – was designed to prevent the “wrongful disclosure of video tape rental or sale records” and requires “video tape service providers” to keep their customers’ personally identifiable information confidential. Plaintiffs’ foothold into the Act is its designation of “video tape service providers” as those in the business of renting “prerecorded video cassette tapes or similar audio visual materials.” Plaintiffs in these actions allege that Vizio is a “video tape service provider” because it is in the business of providing “similar audio visual materials”; namely, streaming content such as Netflix and Hulu.
A Common Thread
Despite their different procedural postures, the Google and Vizio class actions each provide an example of how the lack of truthful, conspicuous, and clearly articulated privacy policies and notices can create litigation risks.
In the case of Google, the court was particularly troubled by public statements Google made that seemed to contradict its actual policies. As the Third Circuit stated: “What is notable about this case is how Google accomplished its tracking. Allegedly, this was by overriding the plaintiffs’ cookie blockers, while concurrently announcing in its Privacy Policy that internet users could ‘reset your browser to refuse all cookies’” and assuring Safari users that “their cookie blockers meant that using Google’s in-house prophylactic would be extraneous.”
Similarly, in Vizio, plaintiffs allege that Vizio did “not disclose the existence of the Tracking Software during a Vizio Smart TV’s setup, in advertising, or on the products’ packaging” nor do they “require consumers to agree to any terms or privacy policy relevant to the Tracking Software.” Instead, the Vizio plaintiffs allege, Vizio “hid references about its Tracking Software in obscure settings menus” which were tedious to access. Finally, although the TV technically contained an option to “opt-out” of the Tracking Software, plaintiffs allege the opt-out option is misleadingly labeled and does not contain an accurate description of the TV’s tracking capabilities.
The Lesson – Robust Disclosures Are Good Policy
Could Vizio and Google have mitigated litigation risks with more robust disclosures? It is impossible to say for sure, but it seems probable. With regard to Google, the disconnect between the company’s Privacy Policy and tracking activities was a key component of the court’s rationale. Absent that disconnect, perhaps the court would not have revived the lawsuit. Similarly, had Vizio clearly articulated its privacy policy – and provided a clear opt-out (or even opt-in) option – during the television set-up process, one of plaintiffs’ key arguments would certainly be undermined.
Although Vizio may be able to persuade courts that it is not a “video tape service provider” akin to now-defunct rental stores, and Google may ultimately prevail in its cookie-placement litigation, these developments serve as fresh warnings of the litigation risks that accompany collection of user data – particularly in the absence of a robust, accurate, and conspicuous privacy statement detailing what data is collected and how it will be used.