On January 21, Hulu filed a brief in its ongoing Video Privacy Protection Act (“VPPA”) litigation arguing that anonymous “user numbers” are not personally identifiable information (“PII”) subject to the VPPA. If such numbers are PII, video providers will be virtually unable to share any information about subscribers’ viewing histories without their consent unless it is in aggregated form.
Hulu argued: (1) that user numbers do not “identify a person” despite the fact that they differentiate individual users from each other; and (2) that, even if user numbers can be used in combination with other information to “identify a person,” this does not make them PII.
In support of its argument that user numbers do not “identify a person,” Hulu relied on the Viacom Int’l Inc. v. YouTube Inc., 253 F.R.D. 256 (S.D.N.Y. 2008) decision, in which the court held that YouTube usernames could not identify specific individuals and were therefore not PII under the VPPA. Hulu also cited cases outside the VPPA context holding that anonymous numbers are not identifying.
Hulu argued that user numbers can be distinguished from Social Security numbers, which are considered PII, because they are not used ubiquitously and have no meaning to third parties.
Hulu also argued that the VPPA does not impose liability on a video service provider for disclosing non-identifying information that a third party later combines with other information to identify a person, citing Mollett v. Netflix, Inc., 2012 WL 3731542, at *4 (N.D. Cal. Aug. 17, 2012).
This will not be the first question of VPPA interpretation in this case. The court already has ruled that “actual injury” is not an element of a VPPA claim, so plaintiffs need not allege harm beyond that necessary for standing in order to recover damages.
