The Google “Cookie” Class Action
First, on November 10, the Third Circuit issued a unanimous and precedential opinion in In re: Google Inc. Cookie Placement Consumer Privacy Litigation, reviving a claim that Google intentionally invaded web users’ privacy by placing cookies on their browsers without their knowledge. In that putative class action, plaintiffs alleged that Google, along with other internet advertisers, bypassed the cookie-blocking features in Internet Explorer and Safari to place cookies on the plaintiffs’ browsers, thus enabling them to track plaintiffs’ web use without their consent. The allegations arose from a February 2012 Wall Street Journal article that revealed that Google was using code to command users’ web browsers to trigger an exception to their cookie blockers.
Plaintiffs brought a bevy of both federal and state claims, including invocation of California’s consumer-protection laws. Although the district court dismissed all claims, the Third Circuit held that plaintiffs adequately pled a claim for invasion of privacy under California’s Constitution and state law tort principles. Google argued that courts routinely hold that the tracking, collation, and disclosure of internet usage information does not amount to an actionable privacy invasion, but the court was unpersuaded, holding that the manner in which Google placed cookies – by allegedly tricking browsers with cookie-blockers to accept them – created a potential violation. The court reasoned that Google’s placement of cookies on users’ browsers despite the presence of cookie-blockers defeated users’ “reasonable expectations” regarding their privacy, sufficient to state a claim for invasion of privacy under California law. Given the court’s designation of its opinion as precedential, this holding is likely to have a major impact on future litigation brought in this area.
The Vizio “Smart TV” Class Actions
Second, on November 11 and 13, two putative class actions were filed against Vizio in California federal court alleging that its Smart TVs are capturing the IP addresses of their users unbeknownst to them. The cases, Watts v. Vizio Holdings and Reed v. Cognitive Media, contain substantially the same allegations, including that Vizio is enlisting the help of data brokers to obtain personalized information about users from their IP addresses and that the resulting “enhanced” data is being sold to advertisers. These cases come hot on the heels of a November 9th ProPublica report that Vizio was tracking data about viewing habits and sharing it with advertisers through a feature called “Smart Interactivity” that is enabled on Vizio’s TV’s by default.
In addition to California state law claims, the Vizio cases assert claims under the federal Video Privacy and Protection Act, pursuant to which a video tape service provider must keep its customers’ personally identifiable information confidential. The Act – passed in 1988 in the wake of Congressional questions over Supreme Court Nominee Robert Bork’s video rental history – was designed to prevent the “wrongful disclosure of video tape rental or sale records” and requires “video tape service providers” to keep their customers’ personally identifiable information confidential. Plaintiffs’ foothold into the Act is its designation of “video tape service providers” as those in the business of renting “prerecorded video cassette tapes or similar audio visual materials.” Plaintiffs in these actions allege that Vizio is a “video tape service provider” because it is in the business of providing “similar audio visual materials”; namely, streaming content such as Netflix and Hulu.
A Common Thread
Despite their different procedural postures, the Google and Vizio class actions each provide an example of how the lack of truthful, conspicuous, and clearly articulated privacy policies and notices can create litigation risks.
The Lesson – Robust Disclosures Are Good Policy
Although Vizio may be able to persuade courts that it is not a “video tape service provider” akin to now-defunct rental stores, and Google may ultimately prevail in its cookie-placement litigation, these developments serve as fresh warnings of the litigation risks that accompany collection of user data – particularly in the absence of a robust, accurate, and conspicuous privacy statement detailing what data is collected and how it will be used.