Appeals Court Says Downloading And Using A Free App Doesn't Make You A 'Subscriber'

Privacy

from the a-device-is-not-a-person,-even-if-they're-inseperable dept

A plaintiff invoking the Video Protection Privacy Act (VPPA) has just been handed a second defeat in his lawsuit against Cartoon Network. The Eleventh Circuit Appeals Court has reached the same conclusion as the lower court, albeit for different reasons.

Originally written to protect consumers against the release of their VHS rental history, the VPPA has since been invoked in various lawsuits to address the release of protected “subscriber information” to third parties, including more than one against the Blockbuster of today: Netflix.

The most recent VPPA lawsuit against Netflix argued that showing viewing history (upon login to an account) violated the account holder’s privacy. The Ninth Circuit Court of Appeals found in favor of Netflix, rather than the person who felt they should still have viewing history privacy despite leaving accounts logged in and/or sharing login information.

This one is a bit more tangled and involves Cartoon Network’s phone app, rather than the new face of video rentals. The CN app allows users to view the network’s videos. It does not require a login to do so. Because no login was required, the plaintiff felt the app wouldn’t gather or disseminate “personal information.” Well, the app does collect some information, which is specific to the device, but not necessarily the person.

Cartoon Network identifies and tracks an Android smartphone user on the CN app through his mobile device identification or Android ID, which is “a 64-bit number (hex string) that is randomly generated when a user initially sets up his device and should remain constant for the lifetime of the user’s device.” Cartoon Network keeps track of an Android user’s viewing history by maintaining a record of “every video clip or [episode] viewed by the user” via the Android ID number. Cartoon Network then sends this information to a third-party data analytics company called Bango. Each time a user closes out of the CN app on his Android device, “[a] complete record”—including the user’s “Android ID and a list of the videos he viewed”—is sent to Bango.

Bango, of course, is the subsidization behind the free app.

Bango specializes “in tracking individual behaviors across the Internet and mobile applications . . . [and claims] that its technology ‘reveals customer behavior, engagement and loyalty across and between all [ ] websites and apps.’” Bango uses Android IDs “to identify and track specific users across multiple electronic devices, applications, and services.” Because Bango is apparently “smarter than the average bear,” see The Yogi Bear Show, Trying to Escape Jellystone Park (Hanna-Barbera Prod. 1961), it can “automatically” link an Android ID to a particular person by compiling information about that individual from other websites, applications, and sources. So when Cartoon Network sends Bango the Android ID of a CN app user along with his video viewing history, Bango associates that video history with a particular individual.

It was this tracking that bothered Mark Ellis, who sued on behalf of himself and “others similarly situated.”

The decision doesn’t head off into a discussion of what is or isn’t personally-identifiable and subject to the restraints of the VPPA. Instead, it discusses the difference between a “subscriber” and someone with no viable legal claim at all. The lower court decided Ellis’ minimal connection to Cartoon Network (via its free app and his phone’s ID) was enough to grant him standing as a “subscriber.” But it also found that the information gathered by CN wasn’t “personally identifiable” under the VPPA definitions. An Android ID identifies a device, not a person, even if only one person uses it for the lifetime of the device (see also: privacy arguments about license plate readers).

Ellis appealed this finding, and struck out again, but from the other side of the plate.

Mr. Ellis did not sign up for or establish an account with Cartoon Network, did not provide any personal information to Cartoon Network, did not make any payments to Cartoon Network for use of the CN app, did not become a registered user of Cartoon Network or the CN app, did not receive a Cartoon Network ID, did not establish a Cartoon Network profile, did not sign up for any periodic services or transmissions, and did not make any commitment or establish any relationship that would allow him to have access to exclusive or restricted content.

Mr. Ellis simply watched video clips on the CN app, which he downloaded onto his Android smartphone for free. In our view, downloading an app for free and using it to view content at no cost is not enough to make a user of the app a “subscriber” under the VPPA, as there is no ongoing commitment or relationship between the user and the entity which owns and operates the app. Importantly, such a user is free to delete the app without consequences whenever he likes, and never access its content again. The downloading of an app, we think, is the equivalent of adding a particular website to one’s Internet browser as a favorite, allowing quicker access to the website’s content. Under the circumstances, Mr. Ellis was not a “subscriber.”

Having found that Ellis is not a subscriber, the court doesn’t weigh in on the issue of the information gathered and distributed by the app. It infers — by its discussion of previous cases — that the app behaves more like a website cookie that tracks unregistered users by device info rather than more personally-identifiable data.

Had Ellis increased his level of interaction — say, by creating an account — he would have had a better chance at being recognized as a “subscriber.” Of course, had he done this, he would have had to agree to CN’s terms of service, which likely contains plenty of fine print “disclosing” its relationship with Bango, as well as to what is specifically collected and passed on. So, there would have been no cognizable injury in that case either.

Filed Under: apps, cartoon network, eleventh circuit, privacy, subscribers, vppa
Companies: cartoon network