Garvey et al v. Kissmetrics et al

Filing 211

ORDER DENYING WITHOUT PREJUDICE PLAINTIFF'S MOTION FOR CLASS CERTIFICATION by Magistrate Judge Laurel Beeler: Denying 111 Motion to Certify Class. (ls, COURT STAFF) (Filed on 6/17/2014)

1
2
3
4
5
6
7
8

UNITED STATES DISTRICT COURT

9

Northern District of California

10

San Francisco Division
IN RE: HULU PRIVACY LITIGATION

12
For the Northern District of California

UNITED STATES DISTRICT COURT

11

ORDER DENYING WITHOUT
PREJUDICE PLAINTIFFS’ MOTION
FOR CLASS CERTIFICATION

13
14

No. C 11-03764 LB

____________________________________/

[ECF No. 111 ]

15
INTRODUCTION
16
In this putative class action, viewers of Hulu’s on-line video content allege that Hulu wrongfully
17
disclosed their video viewing selections and personal identification information to third parties such
18
as metrics companies (meaning, companies that track data) and social networks, in violation of the
19
Video Privacy Protection Act (“VPPA”), 18 U.S.C. § 2710. Second Amended Consolidated Class
20

Action Complaint (“SAC”), ECF No. 83 at 7-8.1 In their class certification motion, Plaintiffs limit

21
the third parties to comScore, a metrics company that analyzes Hulu’s viewing audience and
22
provides reports that Hulu uses to get media content and sell advertising, and the social network
23
Facebook. See Motion For Class Certification, ECF No. 112.
24
The VPPA prohibits a “video tape service provider” from knowingly disclosing “personally
25
identifiable information of a consumer of the provider” to third parties except under identified
26
27
1

28

Citations are to the Electronic Case File (“ECF”) with pin cites to the electronic page
number at the top of the document.

ORDER (C 11-03764 LB)

1

exceptions that do not apply here. See 18 U.S.C. § 2710. “The term ‘personally identifiable

2

information’ [“PII”] includes information that identifies a person as having requested or obtained

3

specific video materials or services from a video tape service provider.” Id. § 2710(a)(3).

4

“Aggrieved” persons may sue for knowing disclosures of PII in violation of the statute. Id.

5

§ 2710(b)-(c). A court may award “actual damages but not less than liquidated damages in an

6

amount of $2,500.” Id. § 2710(c)(2).

7

In its early summary judgment motion, Hulu argued that it did not violate the VPPA because (I)

person’s name or address; (II) it did not disclose the information “knowingly” and thus is not liable;

10

and (III) Hulu users who are Facebook users consented to the disclosures because Facebook’s terms

11

of use permitted disclosure. Motion for Summary Judgment, ECF No. 125-4 at 1-2. On April 29,

12
For the Northern District of California

it disclosed only anonymous user IDs and never linked the user IDs to identifying data such as a

9

UNITED STATES DISTRICT COURT

8

2014, the court granted Hulu summary judgment as to the disclosures to comScore and denied the

13

summary judgment as to the Facebook disclosures, holding that there were material issues of fact

14

about whether there was a disclosure of PII to Facebook and whether Hulu knew what it was

15

disclosing. See ECF No. 194 at 2, 20-26.

16

Given its grant of summary judgment to Hulu on the comScore disclosure, the court denies as

17

moot Plaintiffs’ motion for certification of a comScore class. Following a hearing on May 8, 2014,

18

and supplemental briefing, see ECF Nos. 202 and 203, the court denies Plaintiffs’ motion for class

19

certification for the Facebook class primarily on the ground that the class is not ascertainable.

20
21
22

STATEMENT
I. THE PARTIES, THE PROPOSED CLASSES, AND THE RELIEF REQUESTED
Hulu provides on-demand, online access to television shows, movies, and other pre-recorded

23

video content from networks and studios through its website, www.hulu.com. SAC ¶¶ 1, 17. It

24

offers a free service that allows users to watch video content on their computers. See Yang Decl.,

25

ECF No. 125-6, ¶ 5. It also offers a paid service called “Hulu Plus” that has more content and

26

allows viewers to watch Hulu content on other devices such as tablets and smart phones. Id. ¶¶ 2, 6.

27

Plaintiffs Joseph Garvey, Sandra Peralta, Paul Torre, Joshua Wymyczak, and Evan Zampella

28

each are registered Hulu users. See SAC ¶¶ 1-6. Sandra Peralta, Evan Zampella, and Paul Torre

ORDER (C 11-03764 LB)

2

1

became paying Hulu Plus subscribers in July 2010, June 2011, and July 2012, respectively. See id.

2

¶¶ 3-4, 6, 34. The SAC alleges that Hulu wrongfully disclosed Plaintiffs’ video viewing selections

3

and “personally identifiable information” to third parties comScore and Facebook, all in violation of

4

the VPPA. See id. ¶¶ 51-63; Motion for Class Certification, ECF No. 112.

5
6
7
8
9
10

12
For the Northern District of California

UNITED STATES DISTRICT COURT

11

In their motion for class certification, Plaintiffs propose the following class definition for the
Facebook Disclosure class:
All persons residing in the United States and its territories who, from April 21, 2010 through
June 7, 2012, were registered users of hulu.com (including, but not limited to, paying
subscribers, also known as Hulu Plus subscribers) while being members of Facebook and
requested and/or obtained video materials and/or services on hulu.com during the Class
Period. Excluded from the class are (i) any person who participated in Facebook connect
with Hulu; (ii) judges to who this case was assigned and judicial staffs; and (iii) all current or
former Hulu employees.
Motion for Class Certification, ECF No. 112 at 15.
At the May 8, 2014 hearing, Plaintiffs limited their disclosure theory to disclosures of identifying

13

information involving the c_user cookie. As discussed below, that cookie contains the logged-in

14

Hulu user’s Facebook ID, and the disclosure theory in effect limits the class to registered Hulu users

15

who at least once during the class period watched a video on hulu.com having used the same

16

computer and web browser to log into Facebook in the previous four weeks using default settings.

17

See infra; Joint Statement of Undisputed Facts (“JSUF”) #22, ECF No. 178; Calandrino Decl., ECF

18

No. 160-5, ¶¶ 66-67.

19

Plaintiffs limit their claim to relief to statutory damages of $2,500 per plaintiff for one incident

20

only. See RT 5/8/14, ECF No. 210 at 12:14-16.

21

II. HOW HULU WORKS2

22

Hulu pays license fees to studios, networks, and other rights holders to obtain the video content

23

that it offers to its users. See Yang Decl, ¶ 10. Hulu allows users to register for a free Hulu account.

24

See id. ¶ 5. A Hulu user does not need to register for a Hulu account to watch videos on hulu.com

25

using a personal computer. See id. ¶ 4. To register for a Hulu account, the user enters a first and last

26
27
28

2

The parties cite facts submitted in support of the summary judgment briefs and
summarized in the summary judgment order at ECF No. 194. The order sets forth those facts in the
next three sections and then adds in additional evidence submitted with the class certification briefs.

ORDER (C 11-03764 LB)

3

1

name, birth date, gender, and an email address. JSUF #1. Users are not required to provide their

2

legal first and last name during registration. JSUF #2. In fact, Plaintiff Joseph Garvey registered for

3

his Hulu account in a name other than his legal name. See JSUF #3. Hulu does not verify the

4

accuracy of the identifying information but stores it in a secure location. Yang Decl. ¶ 6. To

5

register for Hulu Plus, the user must provide the same information as a registered Hulu user,

6

payment information, and a billing address. Id. ¶ 7. Hulu assigned each new registered Hulu user a

7

“User ID,” which is a unique numerical identifier of at least seven digits (e.g., 50253776). JSUF #6;

8

see Tom Dep., Carpenter Decl. Ex. 7, ECF No. 157-11 at 37:9-38:12.

these webpages “watch pages.” See Yang Decl. ¶ 3; JSUF #24. Hulu wrote and deployed the code

11

for its watch pages. Tom Dep., Carpenter Decl. Ex. 7, ECF No. 157-11, at 108:23-109:8, 175:9-16;

12
For the Northern District of California

The videos on hulu.com are displayed on a video player that appears on a webpage. Hulu calls

10

UNITED STATES DISTRICT COURT

9

Wu Dep., Carpenter Decl. Ex. 2, ECF No. 157-6, at 80-84. The code downloaded to registered Hulu

13

users’ browsers when they visited a watch page so that the browser could display the requested web

14

page or video content. Tom Dep., Carpenter Decl. Ex. 7, ECF No. 157-11 at 112:19-113:5. As

15

described in more detail below, the code also allowed information to be transmitted to comScore and

16

Facebook. Until June 7, 2012, the URL (uniform resource locator, meaning, the web address) of

17

Hulu’s watch pages included the name of the video on that page (e.g.,

18

http://www.hulu.com/watch/426520/saturday-night-live-the-californians-thanksgiving). JSUF #24

19

(the number in the URL, here 426520, is the video ID).

20

On or about March 12, 2009, Hulu began providing each registered user with a profile web page.

21

JSUF #9. The first and last name the user provided during registration appeared on the page and in

22

the page title. JSUF #10. Hulu did not allow registered users to decline to share their first and last

23

names on their public profile pages. Until August 1, 2011, a user’s profile page URL included the

24

user’s unencrypted Hulu User ID. JSUF #12. An example is http://www.hulu.com/profiles/u/[User

25

ID], where “[User ID]” is the Hulu User ID. Id. After August 1, 2011, the Hulu User ID was

26

encrypted. JSUF #13. An example is http://www.hulu.com/profiles/u/wxu2RqZLhrBtVjYKEC_R4.

27

Id. Hulu did not provide a separate search function (for example, through a search box) to allow a

28

user to use a Hulu User ID to find the profile page of another user. JSUF #11. On May 30, 2013,

ORDER (C 11-03764 LB)

4

1

Hulu discontinued the user profile pages. JSUF #14.

2

Hulu makes money from advertising revenue and from monthly premiums paid by Hulu Plus

3

members. Yang Decl., ¶ 11. Its main source of income is advertising revenue. Id. Advertisers pay

4

Hulu to run commercials at periodic breaks during video playback. Id. ¶ 12. Advertisers pay based

5

on how many times an ad is viewed. Id. ¶ 13. Hulu thus gathers information (or metrics) about its

6

“audience size.” Id. Advertisers require verified metrics, which means that Hulu needs to hire

7

trusted metrics companies. Id. comScore is one of those companies. Id. ¶ 14.

8

comScore collects metrics on digital media consumption using its Unified Digital Measurement

its 2012 SEC Form 10-K and its Q1 2013 SEC Form 10-Q), Ex. 32, ECF No. 155-32 (Addendum to

11

Hulu-comScore contract). As of 2013, comScore captured 1.5 trillion digital interactions each

12
For the Northern District of California

methodology. Carpenter Decl. Ex. 22, ECF No. 155-27 (comScore press release cross-referencing

10

UNITED STATES DISTRICT COURT

9

month and had more than 2000 clients. Id. Ex. 22; see Harris v. comScore, Inc., 292 F.R.D. 579,

13

581 (N.D. Ill. 2013) (describing comScore’s business).

14

III. HOW HULU INTERACTS WITH COMSCORE

15

The comScore disclosures are no longer part of this lawsuit, but the summary judgment order’s

16

fact section on the disclosures provide relevant context for the Facebook disclosures, particularly

17

with regard to how Hulu transmits information to third parties such as Facebook.

18

According to Hulu, comScore gives it “reports containing metrics regarding the size of the

19

audience for programming on hulu.com,” and Hulu uses the reports to obtain programming and sell

20

advertising. Yang Decl., ECF No. 125-6, ¶ 14. The reports never identify a user by name and

21

instead present the data in an “aggregated and generalized basis, without reference even to User

22

IDs.” Id. Hulu uses the comScore metrics to show “other content owners . . . that the Hulu audience

23

is a desirable outlet for their programming, and to convince advertisers of the value of reaching

24

Hulu’s audience.” Id. Mr. Yang said in his deposition that he did not know why Hulu sent

25

individual comScore user IDs (see below) if comScore provided only aggregate information, and he

26

did not know whether comScore provided other reports with individual-level data. See Yang Dep.,

27

ECF No. 125-3 at 102-04, 108-11.

28

comScore uses “beacon” technology to track audience metrics. Id. ¶ 15. A “beacon” is triggered

ORDER (C 11-03764 LB)

5

1

by defined events during the playing of a video such as when the video starts, when the

2

advertisement starts, when it ends, and when the video re-starts. Id. The beacon, when triggered by

3

an event, directs the user’s browser to send a piece of HTTP programming code to comScore that

4

contains certain defined “parameters” (meaning, pieces of data or information). Id. ¶ 16.

5

From March 27, 2010 through November 8, 2012, when a user watched a video on hulu.com,

6

Hulu, which wrote the code to transmit the data, transmitted information to comScore by using a

7

comScore “beacon” on the Hulu watch page. JSUF #4-5. The beacon included four pieces of

8

information: (1) the Hulu user’s unique numerical Hulu User ID; (2) the “GUID,” a long

9

alphanumeric string3 that Hulu used to differentiate between web browsers and that Hulu assigned at

that identifies only the advertisement; and (4) the name of the program and any season or episode

12
For the Northern District of California

random to a browser when it accessed hulu.com; (3) the Hulu “Ad ID,” a unique six-digit number

11
UNITED STATES DISTRICT COURT

10

number. JSUF #5-8. Hulu suspended sending the Hulu User ID on November 8, 2012. JSUF #4.

13

comScore’s possession of the Hulu User ID allowed it to connect all information that was tied to

14

that Hulu User ID. See Calandrino Decl., ECF No. 160-5, ¶¶ 30, 33-34, 47. Because the Hulu User

15

ID was in the URL of users’ profile page, comScore had the “key” to locating users’ associated

16

profiles, which revealed the names the users provided when they signed up for Hulu. Id. ¶¶ 35-37.

17

The user profile pages were all in a standard format: http://www.hulu.com/profiles/u/[User ID]. As

18

discussed above, the watch page contained the video title. The argument is that comScore could

19

easily access the profile page and see the user’s first and last names (or at least the names that the

20

users gave when registering) and connect that to the user’s viewing information. For Hulu Plus

21

members, presumably the name would correspond to their billing and payment information (and thus

22

likely reflected the users’ true names).

23

The code Hulu wrote and included in each watch page caused a unique numeric or alphanumeric

24

“comScore UID” for each registered user to be communicated from the registered user’s browser to

25

comScore. See Wills Decl., ECF No. 160-6, ¶¶ 36-37; JSUF #15, 17. The comScore UID is stored

26

in a comScore cookie and identifies the specific copy of the web browser. JSUF #15-17. The

27
28

3

An example of a “GUID” is 767DE299767B4E577B787B40B5123C30. JSUF #7.

ORDER (C 11-03764 LB)

6

1

comScore cookie enabled comScore to link the identified user and video choice information to other

2

information it gained about the same user when the user visited websites where comScore collects

3

data. Calandrino Decl., ECF No. 160-5, ¶¶ 48-56; Wills Decl. ECF No. 160-6, ¶ 36.

4

For context, a cookie is a file on a user’s computer. Wu Decl., ECF No. 125-7, ¶ 13. Cookies

5

contain information that identifies the domain name of the webserver that wrote the cookie (e.g.,

6

hulu.com, comScore.com, or facebook.com). Id. ¶ 18. Cookies have information about the user’s

7

interaction with a website. Id. Examples include how the website should be displayed, how many

8

times a user has visited the website, what pages he visited, and authentication information. Id. ¶ 13.

9

Each web browser on a computer (e.g., Internet Explorer or Chrome) stores the cookies that are

browser. Id. ¶ 14. When a user types a website address into the browser, the browser sends (a) a

12
For the Northern District of California

created during a user’s use of the browser in a folder on the user’s computer that is unique to that

11
UNITED STATES DISTRICT COURT

10

request to load the page to the webserver for that website address and (b) any cookies that are

13

associated with the website (such as the cookies on the user’s computer for “hulu.com” or

14

“comScore.com”). Id. ¶ 15. The remote website server returns the requested page and can update

15

the cookies or write new ones. Id. The only servers that can access a particular cookie are those

16

associated with the domain that wrote the cookie. Id. ¶¶ 18, 21. That means that Hulu can read only

17

hulu.com cookies, and it cannot read comScore.com cookies or facebook.com cookies.

18

That being said, according to Plaintiffs, Hulu hosts its vendors’ JavaScript code on Hulu’s

19

domain so that when Hulu’s web pages execute the vendor code, a vendor such as comScore obtains

20

information through cookies that are set by hulu.com. See Carpenter Decl. Ex. 10, ECF No. 158-2 at

21

HULU_GAR231508 (vendors need to set cookies on hulu.com for tracking; example given was

22

google analytics); id. Ex 11, ECF No. 158-3 at HULU_GAR093686 (email from Hulu to Google;

23

hulu user goes to hulu.com to watch a video; user’s browser calls invite_media (presumably where

24

content is); cookies from there will be passed on to Google; Google can set cookies on the user).

25

More specifically as to comScore, Hulu’s documents have examples of code that sets comScore

26

identifiers, including its UID and UIDR cookies. See id. Exs. 11-15, ECF Nos. 158-3 to 158-7.

27

IV. HOW HULU INTERACTS WITH FACEBOOK

28

Facebook collects information and processes content “shared by its users,” and it provides that

ORDER (C 11-03764 LB)

7

1

information to marketers when it sells them its products (identified as “Facebook Ads,” “Facebook

2

Ad System,” and “Ad Analytics and Facebook Insights”). See Carpenter Decl. Ex. 8, ECF No. 157-

3

12 (Facebook 2012 SEC Form 10-K). Facebook shares its members’ information with marketers so

4

that marketers can target their ad campaigns. See id. Marketers can “specify the types of users they

5

want to reach based on information that users choose to share.” Id. Advertisement revenue is how

6

Facebook makes money. See id.

7

Certain information was transmitted from hulu.com to Facebook via the Facebook “Like” button

#18. During this time period, Hulu included a Facebook Like button on each hulu.com watch page.

10

JSUF #18-19. Hulu wrote code for its watch pages that included code for where the “Like” button

11

should be located on the page and where (from facebook.com) to obtain the code that loads and

12
For the Northern District of California

through June 7, 2012 (when Hulu stopped including the video title in the watch page URL). JSUF

9

UNITED STATES DISTRICT COURT

8

operates the button. JSUF #20. When the user’s browser executed this code, the browser sent the

13

request to Facebook to load the Like button. JSUF #21. The request included a “referer URL” value

14

(the URL of the page from which the request issued) in the request headers and the query string.

15

JSUF #21. That is how Facebook knows where to send code for the Like button so that it can be

16

downloaded and used. Wu Decl., ECF No. 125-7, ¶¶ 16, 20. Until June 7, 2012, the URL for each

17

watch page included the title of the video displayed on that watch page. See JSUF #18. The IP

18

address of the Hulu registered user’s computer also was sent to Facebook (although there are

19

scenarios when the IP address might not be that of the users but instead of a proxy or intermediary).

20

See Tom Depo., Carpenter Decl. Ex. 7, ECF No. 157-11 at 190:23-192:12.

21

Facebook also received the following cookies associated with the facebook.com domain: (1) a

22

“datr” cookie, which identifies the browser; (2) a “lu” cookie, which “can contain the Facebook user

23

ID [e.g., 286xxxx1] of the previous Facebook user to log in to Facebook via the browser and has a

24

lifetime of ‘two years;’” and (3) if the user had logged into Facebook using default settings within

25

the previous four weeks, a “c_user” cookie, which contains the logged-in user’s Facebook user ID.

26

JSUF #22; Calandrino Decl., ECF No. 160-5, ¶ 71. Hulu did not send Facebook the Hulu User ID or

27

the Hulu user’s name when the user’s browser executed the code to load the Like button. JSUF #23.

28

ORDER (C 11-03764 LB)

8

1

This screen shot shows the default setting for logging into Facebook.

2
3
4
5
6
7
8
9
10

12
For the Northern District of California

UNITED STATES DISTRICT COURT

11

13
14

When the “remember me” box is checked, Facebook sets the c_user cookie. See 5/8/2014

15

Hearing Transcript, ECF No. 210 at 8-29. The importance of this is that Plaintiffs’ disclosure theory

16

is based on transmission of the c_user cookie back to Facebook. Id. This potentially would happen

17

for Hulu users who watched a video on hulu.com having used the same computer and web browser

18

to log into Facebook in the previous four weeks using default settings. See JSUF #22; Calandrino

19

Decl. ¶¶ 66-67. As discussed below, according to Hulu’s expert Peter Weitzman, the c_user cookie

20

would be cleared if the “keep me logged in” box were not checked, if the user manually cleared

21

cookies after the Facebook session and before the Hulu session, or if the user deleted or blocked

22

cookies. See infra.

23

No evidence has been introduced that Facebook took any actions with the cookies described

24

above. JSUF #25. That being said, Plaintiffs’ expert opines that Hulu’s disclosure to Facebook of

25

cookie identifiers set by Facebook’s domain enabled Facebook to link information identifying the

26

user with the user’s video choices. See Calandrino Decl., ECF No. 160-5, ¶¶ 57-81. In common

27

web browsers, visiting a website out of Facebook’s control will not result in the communication of

28

information to Facebook absent a decision (directly or indirectly) by the party controlling the

ORDER (C 11-03764 LB)

9

communication with Facebook.” Id. When a Hulu watch page loaded with the Facebook Like

3

button, the page prompted the user’s web browser to transmit the watch page URL and Facebook

4

cookies to Facebook-controlled servers. Id. ¶ 58. This happened with the initial Hulu-prompted

5

request from the user’s browser to Facebook before the receipt of any information from Facebook.

6

Id. ¶ 59. Because the URL of the watch page specified the title of the video during the period from

7

April 21, 2010 to June 7, 2012, the disclosure to Facebook included the title of the video being

8

viewed. Id. ¶ 61. The c_user cookie would give the name of the currently-logged in Facebook user.

9

Id. ¶ 66. The lu cookie might too. Id. ¶ 71. A user is logged out of Facebook by default after

10

closing the browser, but Facebook also provides users with an option to remain logged in after

11

closing the browser. Id. ¶¶ 72-73. The lu cookie clears after a user selects Facebook’s log-out

12
For the Northern District of California

website to send information. Id. ¶ 57. It is straightforward to develop a web page that “yields no

2

UNITED STATES DISTRICT COURT

1

option. Id. ¶ 74.

13

V. SUMMARY OF ADDITIONAL EXPERT TESTIMONY

14

A. Plaintiffs’ Expert Gary Wills

15

Craig Wills, Ph.D., an expert in web privacy, analyzed “‘session captures’ – recordings of actual

16

data transmissions between a browser and Web pages on Hulu’s Web site.” Wills Decl. ¶ 26. Dr.

17

Wills reviewed session captures he created that preceded the relevant period and that took place after

18

April 2013. Id. ¶ 27. He also reviewed session captures between March 2011 and April 2013 that

19

Plaintiffs’ counsel provided “with the representation that they were captures of User-Hulu sessions

20

conducted and recorded at the direction of [P]laintiffs’ counsel.” Id. ¶ 28. His review revealed that

21

the following data were sent to Facebook from July 2011 to the present when Hulu users viewed

22

video content on Hulu’s website:

23
24

a. A facebook “datr” cookie value, which is set whether or not a user is logged into
Facebook, that uniquely corresponds to a particular Facebook User and can be used to
uniquely track User activity on Hulu as well as other Web sites and associate it with a User’s
Facebook profile information.”

25
26

b. The URL of the web page, which until June 7, 2012, identified the name of the video
displayed on the web page.

27

c. The numeric Video identifier of any video viewed by the User; and

28

d. The Video Series name for episodic videos such as television shows.

ORDER (C 11-03764 LB)

10

1

Id. ¶ 42. This transmission occurred as part of the loading of the Like button (also described above).

2

Id. ¶ 43a. Hulu inserted instructions in its watch pages so that whenever a Hulu user watched a

3

video, the instructions caused the user’s browser to retrieve Facebook JavaScript code that gathered

4

information about the web page and the user and sent it to the Facebook server. Id. At the same

5

time, the title (in 2011) and identifier of the video being watched were sent via the HTTP referer

6

header to a Facebook server. Id. ¶ 43b. The request also caused the Facebook datr cookies and

7

many other cookies (described in the summary judgment motion as including the lu and c_user

8

cookies) to be transmitted to Facebook. Id. ¶ 43c. This happened without the user clicking on the

9

Facebook Like button. Id. ¶ 45. In his July 2013 tests and analyses, Dr. Wills confirmed that these
findings “apply to any User who is also a Facebook subscriber, regardless of whether the User is

11

actively signed onto Facebook while watching video content on Hulu. Id. ¶ 46.

12
For the Northern District of California

UNITED STATES DISTRICT COURT

10

Dr. Wills concluded that “whenever a User selected a video for possible viewing or viewed a

13

video on Hulu’s Web site during the Relevant Period, the title of video selected or viewed was sent

14

to comScore and Facebook, along with various identifiers uniquely associated with the User.” Id.

15

¶ 32. “The exception to these conclusions would be for Users who implemented software, such as

16

Adblock Plus, that may prevent the operation of some of the data transmissions triggered by Hulu’s

17

JavaScript code described in this section.” Id. ¶ 35.

18

B. Plaintiffs’ Expert Joseph Calandrino, Ph.D.

19

Dr. Calandrino is a computer scientist with Elysium Digital, LLC, “which provides consulting

20

and expert witness services in connection with litigation having technology-related aspects.” See

21

Calandrino Decl., ECF No. 160-5 ¶ 1. Plaintiffs submitted his declaration in the summary judgment

22

proceedings and cited it in their reply here (without objection by Hulu). Dr. Calandrino considered

23

two declarations Hulu filed in support of its summary judgment motion, documents related to the

24

operations of facebook.com, including detailed reports published by the Irish Data Protection

25

Commissioner, a journal article on privacy, and Plaintiffs’ class certification brief. Id. ¶ 3.

26

As discussed above, when a Hulu watch page with the Facebook Like button loaded, it

27

prompted the user’s web browser to transmit the web page URL and Facebook cookies to Facebook.

28

Id. ¶ 58. Dr. Calandrino’s remaining conclusions about the Hulu’s disclosures to Facebook are

ORDER (C 11-03764 LB)

11

1

predicated on the assumption “that a user does not manually delete cookies or enable any browser

2

settings that otherwise cause automatic deletion of cookies prior to their expiration dates.” Id. ¶ 63.

3

Those disclosures generally are set forth above but are reiterated here because of the predicate

4

assumption that the user did not delete cookies. Visiting a page with an embedded Facebook Like

5

button while logged in to Facebook caused the user’s web browser to transmit three cookies:

6

“c_user,” “lu,” and “datr.” Id. ¶ 64.

7

The “c_user” cookie contains the Facebook profile ID of the previously logged in Facebook

8

user. Id. ¶ 66. This means that when a user was logged into Facebook and visited a Hulu watch

9

page during the period that includes December 21, 2011 to May 2, 2012, Hulu prompted the user’s

viewed, meaning, it transmitted “details that uniquely identified a Facebook user along with details

12
For the Northern District of California

browser to transmit to Facebook data specifying the user’s Facebook ID and the title of the video

11
UNITED STATES DISTRICT COURT

10

of the user’s Hulu viewing activity.” Id. ¶¶ 67-69.

13

The “lu” cookie has multiple uses, but it can contain the Facebook profile ID of the previous

14

Facebook user to log in to Facebook in that browser and it has a lifetime of two years. Id. ¶ 71. A

15

user is logged out of Facebook by default after closing the browser, but Facebook also provides

16

users with the option to remain logged in after clearing the browser. Id. ¶¶ 72-73. The lu cookie

17

clears after a user selects Facebook’s log-out option. Id. ¶ 74.4 If a user logs out of Facebook by

18

closing a web browser rather than explicitly logging out, then “transmission of the lu cookie

19

prompted by visiting a Hulu watch page would enable Facebook to identify a unique Facebook user

20

account and associate the account and other details of it (such as provided name) with Hulu viewing

21

activity.” Id. ¶ 76.

22

The datr cookie identifies the web browser used to connect to Facebook and lasts for two years.

23

Id. ¶ 77. “Details in a datr cookie distinguish an individual to the extent that use of a given browser

24

distinguishes that individual.” Id. ¶ 78. “To the extent that use of a particular browser distinguished

25

an individual during a period that includes December 21, 2011 to May 2, 2012, the Hulu-prompted

26
27
4

28

As discussed above and in the section summarizing Hulu’s expert, the c_user cookie clears
in the same way.

ORDER (C 11-03764 LB)

12

1

transmission of the datr cookie and referer URL data to facebook would distinguish the individual

2

and enable Facebook to aggregate that individual’s viewing activity on Hulu.” Id. ¶ 79.

3

C. Hulu’s Expert Peter Weitzman

4

Mr. Weitzman is a manager of the Data Analytics group at Stroz Friedberg, “a firm specializing

5

in critical areas of digital risk management.” Weitzman Decl. ¶ 1, ECF No. 145 at 2. Mr. Weitzman

6

summarizes Hulu’s interactions with Facebook as follows:

7
8
9
10

12
For the Northern District of California

UNITED STATES DISTRICT COURT

11

Watching videos on hulu.com has separately caused the browser to send various unstructured
and structured data elements to Facebook via the Facebook ‘Like’ button. Facebook received
the URL of the page where the Facebook ‘Like’ button was to be uploaded, which before
June 7, 2012, included the video title embedded within it. Hulu does not send Facebook the
Hulu User ID or a user’s name or other identifying information. There are and were many
mechanisms available to Hulu users to prevent the Facebook ‘Like’ button from being
downloaded from Facebook, and thereby prevent these transmissions from occurring, and
also to block any cookies that Facebook may have set on users’ browsers from being
accessed by Facebook. Such mechanisms were freely available throughout the class periods,
and would not prevent a user from watching content on hulu.com

13
14

Weitzman Decl. ¶ 9.
When a person using the Internet browses to a website, the web page may include (a) integration

15

with other websites via social features that allow the sharing of a website via a social network

16

(which in this case would be the Facebook Like button), (b) advertisements, (c) embedded content

17

such as videoclips hosted by third parties, and (d) tracking technologies used by third-party analytics

18

providers such as comScore. Id. ¶ 11. Cookies can be viewed, removed, or blocked by a user of a

19

web browser. Id. ¶ 12. Whenever a computer user’s web browser requests any part of a web page,

20

the cookies associated with the domain for that web server are sent to the web server with the

21

request for the web page. See id. GUIDs (or globally unique identifiers) identify a specific copy of

22

a web browser (as described above) to the website that set the GUID value for the browser, and they

23

are important to identify a browser engaging in a series of transactions on a website (such as adding

24

a number of items to an online shopping cart and then buying them). Id. ¶¶ 13-20.

25

To identify the types of data elements that a user’s browser might transmit to Facebook, Mr.

26

Weitzman reviewed network captures provided by Dr. Wills and network captures he generated or

27

directed to be generated by his colleagues. See id. ¶ 21. He also reviewed Hulu’s source code and

28

changes to the code during the class period. Id. He identified and tested various approaches that a

ORDER (C 11-03764 LB)

13

1

user might take to prevent transmissions to Facebook. Id. ¶ 22. Mr. Weitzman focused on tools that

2

were available during all or part of the class periods and that are easy to install and configure. Id.

3

¶ 22. Mr. Weitzman created a “Microsoft Windows 7 virtual machine,” which is a software-based

4

computer that runs on a host computer’s hardware that allowed him and his colleagues to “browse

5

various Internet pages while capturing network traffic.” Id. Then he could review the captured

6

network traffic data to see exactly which data elements were transmitted by the browser and “deduce

7

which ones were blocked.” Id.

8
9

Due to “the complexity of interactions between the Facebook and Hulu websites,” Mr. Weitzman
“did not review all traffic sent between the user’s browser and Facebook when a user views a Hulu

hulu.com webpage, before any user has clicked on the button.” Id. ¶ 38. The Like button is

12
For the Northern District of California

page” and instead “focused on what happens when the Facebook ‘Like’ button is installed on a

11
UNITED STATES DISTRICT COURT

10

generated on the Hulu watch pages as an “iframe,” which acts as a small Facebook webpage

13

embedded on hulu.com that is separate and apart from the parent web page hulu.com. Id. ¶ 39.

14

“Hulu’s sole involvement with respect to the Facebook ‘Like’ button is instructing the user’s

15

browser to request the Facebook ‘Like’ button from Facebook serves, and setting the parameters that

16

tell Facebook how the ‘Like’ button should be configured.” “When the browser requests the

17

Facebook ‘Like’ button from Facebook servers, it sends the following data elements:

18
19
20
21
22
23
24

1. href parameter – The URL of the page of the [watch] page on which the ‘Like’ button will
be placed . . . . [T]his URL may contain additional embedded information . . . . Before June 7,
2012, such information may have included the title of the video being watched. . . . The
referrer URL also included the numerical ID of the video being watched on a watch page, or
the series title on a Hulu Web page for a television series. . . .
2. the Facebook datr cookie . . . [which] is only set when the user visits facebook.com . . .
[and] identifies a specific instance of a web browser that has accessed facebook.com . . . .
[paragraph contains additional information about how a datr cookie is and is not used]
3. the Facebook profile ID – a Facebook numerical ID associated with the Facebook user . . .
[which] is sent to Facebook web servers via the ‘lu’ cookie when the browser makes the GET
request for the Facebook ‘Like’ button. . . . If the user logs out of Facebook, the ‘lu’ cookie
value is set to ‘0’. . . .

25
26

Id. ¶ 39 (also explains that “[i]f the Facebook user is no longer logged in, but was only logged out

27

passively, such as by a timeout, then the lu cookie will still contain their Facebook numerical ID.

28

The value will change if (1) they actively log out by selecting “Log Out” (then the lu value will be

ORDER (C 11-03764 LB)

14

1

reset to “0”) or (2) if another user logs into the facebook.com on the same browser.”).5

2

Browsers allow users to block and clear cookies (including by setting privacy settings to clear

3

cookies automatically) and to install plugin browser enhancements to configure the browser in many

4

ways, including blocking traffic to a specific web domain. Id. ¶ 40. During the class period of April

5

21, 2010 to June 7, 2012, Hulu users “could take simple steps to block data transmissions from their

6

browsers to third parties, such as comScore and Facebook, when visiting hulu.com. Doing so would

7

not have interfered with the user’s ability to select and watch videos on hulu.com.” Id. ¶ 41.

cookies including (1) using their browsers in “incognito” mode, where no existing cookies from any

10

websites can be accessed, and all cookies set during browsing sessions are deleted when the browser

11

is closed (leading to the resetting of the datr cookie), and (2) deleting cookies either manually or by

12
For the Northern District of California

For example, Hulu users could take standard web-privacy measures to limit the active lifespan of

9

UNITED STATES DISTRICT COURT

8

browser configuration, which has the same effect as browsing incognito. Id. ¶ 43.

13

Other tools available to Hulu users to block communications include three that Mr. Weitzman

14

tested: Ghostery, AdBlock, and Adblock Plus. Id. ¶ 42. Mr. Weitzman tested these plugins (to the

15

extent they were available) in five major web browsers to determine the effect on communications

16

between the browser, comScore, and Facebook. His results are summarized in the following chart:

17

Ghostery v5.0.0 &
v3.1.0 (IE)

AdBlock

AdblockPlus

Internet Explorer
v10.0.9200.16521

Blocked all comScore
beacons and Facebook
like buttons. Requires
32-bit IE and
Administrator privileges.
Not available for IE11.
Some interactions with
the pages caused the
browser to freeze.

Not mentioned.

Available during
class period
apparently only for
Firefox and Chrome.

Mozilla Firefox
v25.0

Blocked all comScore
beacons and Facebook
like buttons.

Not mentioned.

Blocked all
comScore beacons
and Facebook like
buttons.

18
19
20
21
22
23
24
25
26
27
28

5

Similarly, logging out of Facebook clears the c_user cookie. See Gov’t of Ir., Data
Protection Commissioner, Facebook Ireland Ltd: Report of Re-Audit (21 Sept. 2012), ECF No. 146
at 86; Hulu Supplemental Filing, ECF No. 202 at 2 (citing record).

ORDER (C 11-03764 LB)

15

1
2

Google Chrome
v31.0.1650.57

Blocked all comScore
beacons and Facebook
like buttons.

Blocked all comScore
beacons and Facebook
like buttons.

Blocked all
comScore beacons
and Facebook Like
buttons.

Apple Safari
v534.57.2
(Windows)

Did not block comScore
beacons and Facebook
like buttons.

Did not block
comScore beacons and
Facebook like buttons.

Not available.

Opera
v18.0.1284.49

Blocked all comScore
beacons and Facebook
like buttons.

Blocked all comScore
beacons and Facebook
like buttons with extra
options enabled. Did
not block comScore
beacons and Facebook
like buttons with
default installation.

Blocked all
comScore beacons
and Facebook Like
buttons with extra
options enabled. Did
not block comScore
beacons and
Facebook like
buttons with default
installation.

3
4
5
6
7
8
9
10
See Weitzman Decl. Ex. B.

12
For the Northern District of California

UNITED STATES DISTRICT COURT

11

At his deposition, Mr. Weitzman admitted that he tested only versions of the browsers and

13

plugins that were current at the time of testing, not what was available during the class period.

14

Q. So do you have any personal knowledge as to whether any of these plugins blocked
Facebook or comScore for any prior versions of these browsers?

15
16
17
18

Mr. Svirsky: Objection.
A. So, as I said, we did not test the configurations to cover the entirety of the class period or
to cover the class period. We determined when the plugins became available and we tested
current versions, because that was feasible to do so. So we didn’t test the various plugins and
the various browsers as they might have been during the class period, so no, I don’t have any
direct knowledge of that.

19
20

Weitzman Dep. 77:3-17, Tersigni Decl. Ex. 6.

21

D. Hulu’s Expert Hal Poret

22

Mr. Poret, Senior Vice President of ORC International, designed and conducted a consumer

23

survey about Hulu users and how they interact with their Hulu accounts. See ECF No. 144. Mr.

24

Poret holds B.S. and M.A. degrees in mathematics from Union College and S.U.N.Y. Albany,

25

respectively, and a J.D. from Harvard Law School that he received in 1998. ECF No. 144-1 at 2.

26

He worked at Foley Hoag & Elliot in Boston from 1998 to 2003, and has worked at ORC since

27

2004. Id.. He has “personally designed, supervised, and implemented approximately 600 surveys

28

regarding the behaviors and opinions of consumers . . .[,] designed numerous studies that have been

ORDER (C 11-03764 LB)

16

1

admitted as evidence in legal proceedings[,] and . . . been accepted as an expert in survey research

2

on numerous occasions by U.S. District Court” and other tribunals. Id.

3

Mr. Poret conducted an online survey of “U.S. consumers age 18 and older who had a registered

4

account at hulu.com during the class period of April 2010 to November 2012 and viewed content at

5

hulu.com using a computer during that time.” ECF No. 144 at 6. There were 700 respondents,

6

which provided a margin of error for key statistics in the range of +/- 3.7% or less. Id.

7

The double-blind survey first asked respondents a series of screening questions to determine

8

whether they met the appropriate criteria to qualify for the survey. Id. at 6-9, 64. The remaining

9

survey “was comprised of several sections, each targeting one of the following topics regarding the

10

practices of potential class members:
•

Habits regarding how respondents have interacted with their Hulu accounts.

12
For the Northern District of California

UNITED STATES DISTRICT COURT

11

•

Habits regarding how respondents have interacted with Facebook.

13

•

Habits regarding respondents’ computer behavior.

14

•

Habits regarding respondents’ Internet behavior.

15

•

Browsers and operating systems used by respondents.

16

•

Respondents’ concerns and actions regarding privacy protection online.”

17

Id. at 9-10. Some of the relevant lines of inquiry were as follows: (1) whether anyone else had

18

access to the respondents’ Hulu accounts during the class period; (2) whether those users also would

19

have accessed Facebook from the same browser; (3) whether respondents used their real names to

20

register for Hulu and/or Facebook; (4) how frequently respondents signed out of Facebook; (5)

21

whether and how often they ever had cleared Facebook cookies; and (6) whether they cleared or

22

blocked cookies or used ad-blocking software. Id at 10-61. The Poret report includes tables

23

documenting the survey responses for each question. Id.

24

The Poret report concludes “that there is significant variation among Hulu account holders from

25

April 2010 to November 2012, in terms of their interaction with their Hulu account(s), as well as

26

additional factors, such as:”

27

•

How many Hulu account holders allowed others to access their Hulu account.

28

•

How many Hulu account holders knew others were viewing content on their Hulu

ORDER (C 11-03764 LB)

17

1
2

account and how often.
•

How many Hulu account holders admittedly did not use their real name to register for
Hulu, and how many could not remember.

•

How often Hulu account holders used Hulu while also logged into Facebook.

•

How many Hulu account holders cleared Facebook cookies.

•

How many Hulu account holders posted on Facebook about content watched on Hulu,
and how often.

7

•

Browsers used by Hulu account holders to access Hulu during [the] class period.

8

•

Privacy actions taken by Hulu account holders (e.g., clearing cookies, using ad-blocking
software).

3
4
5
6

9

settings that would block cookies. Id. at 47.

12
For the Northern District of California

Id. at 5. For example, over 50% use ad-blocking software, and over 60% use private browser

11
UNITED STATES DISTRICT COURT

10

VI. ADDITIONAL INFORMATION ABOUT HULU’S BLOCKING THE BLOCKERS

13

A comScore witness testified that from 2007 to the present, she could not recall a single instance

14

where the data comScore received from Hulu was not paired with the comScore cookie, meaning,

15

the cookies always came through. See Johnson Dep., Tersigni Decl. Ex. 3, ECF No. 169 at 80-81

16

(not sure about the Safari browser). Also, Hulu was able to defeat cookie-blocking technologies.

17

See Tersigni Decl. Ex. 7, HULU_GAR203628 at 22 (“In our experience ad blockers are not yet an

18

issue within video streams given that ads are much harder to block there. Our medium-term focus

19

on the issue will be to ensure that our reporting and logic functions continue to work correctly in

20

those cases where an ad is blocked.”); Ex. 8 (Hulu applied fixes when new ad-blocking software

21

affected its video technology); Ex. 9, HULU_GAR196877 (Hulu communication to vendor that

22

“[w]e are able to drop cookies in the player without an issue” and “[t]his has been done with pretty

23

much all our vendors”).

24

VII. ADDITIONAL INFORMATION ABOUT NAMED PLAINTIFFS’ BROWSER USE

25

The named plaintiffs Joseph Garvey, Evan Zampella, Paul Torre, and Josh Wymyczak submitted

26

declarations about their browser use. See ECF Nos. 113-13 to 113-16. All are Facebook users who

27

have used Facebook on the same computer that they used when watching videos on hulu.com, none

28

linked their Hulu and Facebook accounts, and they do not use ad-blocking software on devices

ORDER (C 11-03764 LB)

18

1

where they watched videos on Hulu and do not clear cookies regularly or have not cleared cookies in

2

some time. See Garvey Decl. ¶¶ 6-7; Zampella Decl. ¶¶ 6-7; Torre Decl. ¶¶ 6-7; Wymyczak Decl.

3

¶¶ 6-7.

4

In his deposition, Mr. Torre said that he used a program that can block cookies and that he had

5

manually cleared cookies. Torre Dep., Robison Decl. Ex. A, ECF No. 150-4 at 64. Plaintiffs

6

admitted to posting on Facebook about videos they watched on Hulu. See Garvey Dep., Robison

7

Decl. Ex. C at 89:12-17; Torre Dep., Robison Decl. Ex. A at 181:7-12, 183:19-24; Wymyzczak

8

Dep., Robison Decl. Ex. D at 95:3-19.

9
10

I. EVIDENTIARY ISSUES
Plaintiffs argue that the Poret report and survey are irrelevant and unreliable under Daubert v.

12
For the Northern District of California

UNITED STATES DISTRICT COURT

11

ANALYSIS

Merrell Dow Pharms., Inc., 509 U.S. 579, 592-93 (1993). Reply, ECF No. 168 at 14, n.12.

13

A qualified expert may testify in the form of an opinion or otherwise if (A) the expert’s

14

scientific, technical, or other specialized knowledge will help the trier of fact understand the

15

evidence or to determine a fact in issue, (B) the testimony is based on sufficient facts or data, (C) the

16

testimony is the product of reliable principles and methods, and (D) the expert has reliably applied

17

the principles and methods to the facts of the case. See Fed. R. Evid. 702. Under Daubert, the court

18

acts as a “gatekeeper” to ensure that an expert’s opinion rests on a reliable foundation and is

19

relevant. 509 U.S. at 592; Kumho Tire Co. v. Carmichael, 526 U.S. 137, 145, 147-49 (1999).

20

“Daubert does not require a court to admit or exclude evidence based on its persuasiveness; rather it

21

requires a court to admit or exclude evidence based on its scientific reliability and relevance.” Ellis

22

v. Costco Wholesale Corp., 657 F.3d 970 (9th Cir. 2011) (applying Daubert standard to motion for

23

class certification); see also Wal-Mart Stores, Inc. v. Dukes, 131 S. Ct. 2541, 2553-54 (2011)

24

(implying that district court must ensure that any expert testimony complies with Daubert standard

25

at class certification stage).

26

Plaintiffs’ first objection is that the survey’s conclusions about consumer behavior do not

27

demonstrate that these behaviors prevented Hulu’s disclosure of PII. Thus, the survey results are not

28

relevant. Reply, ECF No. 168 at 14, n.12. This argument is predicated on Plaintiffs’ argument that

ORDER (C 11-03764 LB)

19

1

regardless of what Hulu’s experts concluded about consumer habits or user ad-blocking capabilities,

2

they were not aware that Hulu’s technology circumvents ad-blocking. See id. at 14-15, n.12. This

3

goes to weight, not relevance, given that Hulu argues that clearing cookies or using blocking

4

technologies is relevant to whether a VPPA violation occurred and thus is relevant to typicality and

5

predominance. See Opp’n, ECF No. 150-3 at 16, 21-23.

6

The second objection is that Mr. Poret lacked familiarity with the survey topics, especially

7

consumers’ usage of technologies to prevent web tracking. See Reply, ECF No. 168 at 14, n.12. For

8

example, Plaintiffs allege that Mr. Poret was not familiar with whether “do not track” tools were

9

available during the survey, when ad-blocking software was introduced into the U.S. marketplace,

browsers offered a tool to automatically clear or delete cookies as of April 2010, and whether it is

12
For the Northern District of California

whether browsers could be set to automatically delete cookies as of November 2012, whether

11
UNITED STATES DISTRICT COURT

10

possible to clear Facebook cookies from the browser without clearing the other cookies. Id. This

13

relevance argument is more about Mr. Poret’s explanation not being sufficient and does not establish

14

that it is not relevant.

15

The third objection is that Mr. Poret failed to adequately validate the survey results. Id. For

16

example, the Poret report states that 65.3% of survey respondents used ad-blocking software, but

17

Plaintiffs cite another report stating that as of May 2012, fewer than 10% of U.S. internet users

18

employed ad-blocking tools. Id. (citing Ad-Blocking, Measured, ClarityRay, May 2012, at 4,

19

Tersigni Decl. Ex. 18, ECF No. 169-18). This is about the sufficiency of the report, not about its

20

relevance or the reliability of the methodology or results. It is standard territory for expert

21

disagreement, and Plaintiffs could – as they do – challenge the weight that the court ought to accord

22

to it. They could have put in other expert testimony, but they did not.

23

The Poret report discusses its methodology, which included a sampling plan, double-blind

24

interviewing, third-party data collection and processing, and validation and quality control

25

questions. See ECF No. 144 at 62-66. On this record and at this stage of the case, the court finds

26

Mr. Poret qualified to render his opinions, and the Poret report relevant and sufficiently reliable.

27

II. THE VIDEO PRIVACY PROTECTION ACT AND DISCLOSURES OF USER IDS

28

The VPPA is titled “Wrongful disclosure of video tape rental or sales records.” 18 U.S.C.

ORDER (C 11-03764 LB)

20

1

§ 2710. It “‘protect[s] certain personal information of an individual who rents [or otherwise obtains]

2

video materials from disclosure.’” See Dikes v. Borough of Runnemede, 936 F. Supp. 235, 238

3

(D.N.J. 1996) (quoting S. Rep. 100-599, 2d Sess. at 16 (1988)). The protected information is

4

“information which identifies a person as having requested or obtained specific video materials.” 18

5

U.S.C. § 2710(a)(3).

6

“Aggrieved” persons may sue for knowing disclosures of information in violation of the statute.

7

See 18 U.S.C. § 2710(b)-(c). Under the statute, a “court may award – (A) actual damages but not

8

less than liquidated damages in an amount of $2,500; (B) punitive damages; (C) reasonable

9

attorneys’ fees and other litigation costs reasonably incurred; and (D) such other preliminary and

10

Plaintiffs seek to represent a class of “aggrieved persons.” As consumers of Hulu’s video

12
For the Northern District of California

UNITED STATES DISTRICT COURT

11

equitable relief as the court determines to be appropriate.” 18 U.S.C. § 2710(c)(2).

content, they allege that Hulu transmitted their identifying information and the videos they watched

13

to comScore and Facebook. The court granted summary judgment to Hulu as to the comScore

14

transmissions. See ECF No. 194. The remaining issue is whether the information transmitted to

15

Facebook is “information which identifies a person as having requested or obtained specific video

16

materials.” 18 U.S.C. § 2710(a)(3). If it is, then the transmission violates the VPPA. See id. &

17

2710(b). As to the Facebook disclosures, the court held that there are material issues of fact about

18

whether the disclosure of the video name was tied to an identified Facebook user such that it was a

19

prohibited disclosure under the VPPA. See ECF No. 194 at 2. Also, the court could not rule as a

20

matter of law whether Hulu knowingly disclosed information or whether Hulu users consented to the

21

disclosures. See id.

22

II. CLASS CERTIFICATION

23

Plaintiffs here seek to certify a class for damages under Rule 23(b)(3).

24

A threshold requirement is that Plaintiffs must establish a definable class. See

Rule

25

23(c)(1)(B) (“[a]n order that certifies a class action must define the class and the class claims, issues,

26

or defenses”); Mazur v. Ebay Inc., 257 F.R.D. 563, 567 (N.D. Cal. 2009). A party seeking class

27

certification then must show the following prerequisites of Rule 23(a): numerosity, commonality,

28

typicality, and adequacy of representation. A court may certify a class under Rule 23(b)(3) if the

ORDER (C 11-03764 LB)

21

1

court finds that questions of law or fact common to class members predominate over any questions

2

affecting only individual members and a class action is superior to other available methods for fairly

3

and efficiently adjudicating the controversy. See Fed. R. Civ. P. 23(b)(3).

4

“Certification is proper only if the trial court is satisfied, after a rigorous analysis, that the

5

prerequisites of Rule 23(a) have been satisfied.” Dukes, 131 S. Ct. at 2551 (internal quotation marks

6

and citation omitted). The “rigorous analysis” often will “entail some overlap with the merits of the

7

plaintiff’s underlying claim.” Id. at 2551. More specifically:

8
9
10

12
For the Northern District of California

UNITED STATES DISTRICT COURT

11

13

[A] party seeking to maintain a class action ‘must affirmatively demonstrate his compliance’
with Rule 23. The Rule does not set forth a mere pleading standard. Rather, a party must not
only be prepared to prove that there are in fact sufficiently numerous parties, common questions
of law or fact, typicality of claims or defenses, and adequacy of representation, as required by
Rule 23(a). The party must also satisfy through evidentiary proof at least one of the provisions
of Rule 23(b). . . . [I]t may be necessary for the court to probe behind the pleadings before
coming to rest on the certification question, and . . . certification is proper only if the trial court is
satisfied, after a rigorous analysis, that the prerequisites of Rule 23(a) have been satisfied. Such
an analysis will frequently entail overlap with the merits of the plaintiff’s underlying claim. That
is so because the class determination generally involves considerations that are enmeshed in the
factual and legal issues comprising the plaintiff’s cause of action. The same analytical principles
govern Rule 23(b).

14
15

Comcast, 133 S. Ct. at 1432 (quotation marks and citations omitted). Still, “Rule 23 grants no

16

license to engage in free-ranging merits inquiries at the certification stage. Merits questions may be

17

considered to the extent – but only to the extent – that they are relevant for determining whether the

18

Rule 23 prerequisites for class certification are satisfied.” Amgen Inc. v. Conn. Ret. Plans & Trust

19

Funds, 133 S. Ct. 1184, 1194-95 (2013). If a court concludes that the moving party has met its

20

burden of proof, then the court has broad discretion to certify the class. Zinser v. Accuflix Res. Inst.,

21

Inc., 253 F.3d 1180, 1186, amended by 273 F.3d 1266 (9th Cir. 2001).

22

A. Ascertainable and Definite Class

23

A class should be sufficiently definite and “clearly ascertainable” by reference to objective

24

criteria “so that it is administratively feasible [for a court] to determine whether a particular person

25

is a class member” and thus “bound by the judgment.” Shepard v. Lowe’s HIW, Inc., No. C 12-3893

26

JSW, 2013 WL 4488802 (N.D. Cal. Aug. 19, 2013) (collecting cases); Deitz v. Comcast Corp., No.

27

C 06-06352 WHA, 2007 WL 2015440, at *8 (N.D. Cal. July 11, 2007) (proposed class of cable

28

subscribers who owned cable-ready televisions or related equipment not ascertainable where the

ORDER (C 11-03764 LB)

22

1

defendant did not maintain records to identify those customers, rendering it “impossible to determine

2

without significant inquiry which subscribers owned such devices”); see also Newberg on Class

3

Actions § 3:3 (5th Ed. 2013) (“Administrative feasibility means that identifying class members is a

4

manageable process that does not require much, if any, individual factual inquiry.”); Annotated

5

Manual for Complex Litigation (Fourth) § 21.222 (2013) (“Because individual class members must

6

receive the best notice practicable and have an opportunity to opt out, and because individual

7

damage claims are likely, Rule 23(b)(3) class actions require a class definition that will permit

8

identification of individual class members”). Still, “the class need not be so ascertainable that every

9

potential member can be identified at the commencement of the action.” Ortiz v. CVS Caremark

10

The first issue is whether the class can be defined or identified at all. The summary judgment

12
For the Northern District of California

UNITED STATES DISTRICT COURT

11

Corp., No. C-12-05859 EDL, 2013 WL 6236743 (N.D. Cal. Dec. 2, 2013) (quotation omitted).

order narrowed the class harm to the transmission of Facebook ID cookies with the Hulu/Facebook

13

user’s Hulu watch page and video title when the Facebook Like button loaded. Thus, the class is

14

comprised of users of both Facebook and Hulu during the class period. Both services require

15

provision of an email address when a user registers. Presumably email addresses submitted to

16

Facebook and Hulu could be cross-referenced, which would result in the identification of a group

17

that used both services. But Plaintiffs did not propose cross-referencing Hulu and Facebook records

18

or address any burden of doing so.

19

Assuming that cross-referencing is possible, then it would provide a feasible way to notify and

20

communicate with the potential class members. See Brewer v. Salyer, No. 1:06cv1324 AWI DLB,,

21

2010 WL 1558413, at *1 (E.D. Cal. April 19, 2010) (approving over-inclusive class as the best

22

practicable notice under the circumstances). This does not end the ascertainability inquiry, however,

23

because class members are those who actually had their PII transmitted to Facebook. That inquiry

24

turns on whether the c_user cookie was sent to Facebook, which depends on a number of variables

25

(including whether the user remained logged into Facebook, cleared cookies, or used ad-blocking

26

software).

27
28

The order addresses these issues below in the analysis of Rule 23(b)(3) predominance
requirement by considering whether the issues can be resolved by refining the class definition or

ORDER (C 11-03764 LB)

23

1

designating subclasses. See Messner v. Northshore Univ. HealthSystem, 669 F.3d 802, 825 (7th Cir.

2

2012) (class definition is “more of an art than a science,” and definitional flaws “can and often

3

should be resolved by refining the class definition rather than by flatly denying class certification on

4

that basis”). The court concludes there that possibly subclasses could be defined (even though there

5

are issues with that approach). For example, a possible class definition is registered Hulu users who

6

at least once during the class period watched a video on hulu.com having used the same computer

7

and web browser to log into Facebook in the previous four weeks using default settings. See supra

8

Statement (discussing class definition); JSUF #22; Calandrino Decl. ¶¶ 66-67. Subclasses might be

9

users who use the “keep me logged in” box checked (or do not log out at all). Possibly subclasses
could account for whether the user manually clears cookies, sets browser settings to clear cookies, or

11

uses software to clear cookies. See infra.

12
For the Northern District of California

UNITED STATES DISTRICT COURT

10

This approach might define the class, but the question is, how does one ascertain who is in the

13

class or subclasses. The only way is self-reporting, an issue addressed at the May 8, 2014 hearing

14

and in the parties’ supplemental briefing. See ECF Nos. 202, 203, 208, 210.

15

In Harris v. comScore, the court certified a class for transmission of personal information in

16

violation of the Stored Communications Act, the Electronic Communications Privacy Act, and the

17

Computer Fraud and Abuse Act. See 292 F.R.D. at 587-88. Putative class members downloaded

18

comScore’s OSSProxy program as part of bundled free software. Id. In allowing reporting by

19

affidavit, the Harris court observed that at least some portion of the class was known by email

20

address. Id. It recognized that it can be improper to allow class membership to be established only

21

by assertion of the class members without any corroboration by the defendant’s records, but

22

nonetheless allowed submission of affidavits because the “bulk” of the class membership would be

23

determined by comScore’s own records, and the burden of an affidavit process was minimal. Id. at

24

587-88 (collecting cases, including cases where courts allow “portions of a class” to be established

25

by affidavit or claim form when burdens are minimal) (citations omitted). The court also said that if

26

the portion of the class asserting membership by affidavit only was excessively large, it could

27

consider whether to limit the class to members with downloads of OSSProxy that could be

28

ascertained from comScore’s records. Id. at 588.

ORDER (C 11-03764 LB)

24

1

This case is different than comScore: cross-referencing email records here would identify a large

2

pool of users with only a subset of the pool suffering any injury. Plaintiffs have offered no way to

3

identify individual class members other than broad notice and a self-reporting affidavit.

4

Proof by affidavit does not necessarily defeat ascertainability. The reason is that if consumers

5

always had to prove purchases, then that would defeat many consumer class actions. See McCrary

6

v. The Elations Co., LLC, No. EDCV 13-00242 JGB, 2014 WL 1779243, at *7 (E.D. Cal. Jan. 13,

7

2014) (certifying a class of purchasers of a dietary drink marketed to have joint health benefits)

8

(citing Ries v. Arizona Beverages USA LLC, 287 F.R.D. 523, 525 (N.D. Cal. 2012), where the court

9

certified a class that was required to self-identify whether they purchased the iced tea during the
class period). That being said, and as the Harris court noted, reliance on affidavits can be

11

problematic. 292 F.R.D. at 587-88.

12
For the Northern District of California

UNITED STATES DISTRICT COURT

10

One factor to consider in whether to allow affidavits is ease of documentation and burden. See

13

id. An administrator here could handle claims notices and affidavits electronically, by simple form,

14

and probably without substantial burden, which militates in favor of the affidavit process. See id.

15

(citing Newberg on Class Actions § 10.12 (4th ed. 2012)).

16

Other factors are the size of the claims or the difficulty of verifying them: “[a] simple statement

17

or affidavit may be sufficient where the claims are small or are not amenable to ready verification.”

18

Id. (quoting Newberg on Class Actions § 10.12 (4th ed. 2012)). In cases where the dollar amounts

19

are small, and class members do not have proof of purchase of a defective product, courts (including

20

those in this district) allow proof by affidavit. See, e.g., McCrary, 2014 WL 1779243, at *7 (joint

21

supplements); Lanovaz v. Twinings North America, Inc., No. C 12-02646, 2014 WL 1652338, at *3

22

(N.D. Cal. April 24, 2014) (misbranded teas) (collecting cases); Forcellati v. Hyland’s, Inc., No. CV

23

12-1983-GHK, 2014 WL 1410264, at *5 (C.D. Cal. April 9, 2014) (cold and flu products); Boundas

24

v. Abercrombie & Fitch Stores, Inc., 280 F.R.D. 408, 417-18 (N.D. Ill. 2012).

25

By contrast, when dollar amounts are higher, some form of verification is appropriate beyond

26

just an affidavit. See Saltzman v. Pella Corp., 257 F.R.D. 471, 476 (N.D. Ill. 2012) (class action for

27

products defect in windows with wood rot; consumers without sales records could self-identify and

28

provide verification in the form of photographs); Red v. Kraft Foods, Inc., No. Cv10-1028-GW,

ORDER (C 11-03764 LB)

25

1

2012 WL 8019257 (C.D. Cal. April 12, 2012). And in any event, objective criteria (such as

2

corroboration by reference to a defendant’s records or provision of some proof of purchase) are

3

important to establishing class membership as opposed to relying only on potential members’ say-so

4

and subjective memories that may be imperfect. See Harris, 292 F.R.D. at 587; accord Xavier v.

5

Philip Morris USA Inc., 787 F. Supp. 2d 1075, 1089 (N.D. Cal. 2011) (requiring objective criteria to

6

identify a class). In Xavier, for example, the district court denied class certification to a class of

7

smokers who smoked Marlboro cigarettes for at least 20 “pack-years” (one pack a day for 20 years

8

or the equivalent) on the ground that the putative class members’ subjective estimates of their long-

9

term smoking habits were not reliable. See 787 F. Supp. 2d at 1089-90.

10

Here, the claims apparently are not amenable to ready verification. And at $2,500 per class
member, they are not small. As Hulu points out, this amount creates incentives for claimants. In

12
For the Northern District of California

UNITED STATES DISTRICT COURT

11

addition, on this record, the court cannot tell how potential class members reliably could establish by

13

affidavit the answers to the potential questions: do you log into Facebook and Hulu from the same

14

browser; do you log out of Facebook; do you set browser settings to clear cookies; and do you use

15

software to block cookies? The affidavit seems prone to the same subjective memory problems

16

identified in Xavier. See 787 F. Supp. 2d at 1090 (attesting to the number of cigarettes smoked over

17

decades is categorically different than swearing that “I have been to Paris”). The possibility of

18

substantial pecuniary gain affects this analysis too. Accord id. That incentive and the vagaries of

19

subjective recollection makes this case different than the small-ticket consumer protection class

20

actions that this district certifies routinely.

21

Whether these issues could be resolved by narrowing the class definition, by defining subclasses,

22

by reference to objective criteria, by a damages analysis that addresses pecuniary incentives, or

23

otherwise, the undersigned cannot tell. But on this record, Plaintiffs have not defined an

24

ascertainable class.

25
26

Because the court denies class certification on this ground without prejudice, the order addresses
the remaining Rule 23 requirements.

27

B. Rule 23(a)’s Requirements

28

Plaintiffs must show the following prerequisites of Rule 23(a): numerosity, commonality,

ORDER (C 11-03764 LB)

26

1
2

typicality, and adequacy of representation.
1. Numerosity

3

Rule 23(a)(1) requires that, for a class to be certified, it must be “so numerous that joinder of all

4

members is impracticable.” Hulu does not challenge certification based on the numerosity element.

5

See Opp’n, ECF No. 150-3 at 15, n.4 (“Hulu does not dispute numerosity, although . . . their class

6

definitions are overbroad”). Plaintiffs have satisfied this element.

7
8
9

2. Commonality
Under Rule 23(a)(2), a class cannot be certified unless Plaintiffs establish that “there are
questions of law or fact common to the class.” Rule 23(a)(2) does not require Plaintiffs to show that

legal issues with divergent factual predicates is sufficient” to meet the requirements of Rule

12
For the Northern District of California

each class member’s claim is based on identical factual and legal issues: “The existence of shared

11
UNITED STATES DISTRICT COURT

10

23(a)(2).” Parra v. Bashas’, Inc., 536 F.3d 975, 978 (9th Cir. 2008) (quoting Hanlon v. Chrysler

13

Corp., 150 F.3d 1011, 1019 (9th Cir. 1998)). Under Rule 23(a)(2), “even a single common question

14

will do.” Dukes, 131 S. Ct. at 2556 (quotation omitted). “Commonality requires the plaintiff to

15

demonstrate that class members have suffered the same injury. This does not mean merely that they

16

have all suffered a violation of the same provision of law.” Id. at 2551. The common question

17

“must be of such a nature that it is capable of classwide resolution – which means that determination

18

of is truth or falsity will resolve an issue that is central to the validity of each one of the claims in

19

one stroke.” Id. “What matters to class certification . . . is not the raising of common ‘questions’ –

20

even in droves – but rather the capacity of a classwide proceeding to generate common answers apt

21

to drive resolution of the litigation. Dissimilarities within the proposed class are what have the

22

potential to impede the generation of common answers.” Id. (quotation omitted).

23

Plaintiffs argue that the common factual and legal questions are as follows:

24

1. Whether the Facebook c_user cookie provided to Facebook for each class member
“identifies a person” to Facebook under the VPPA;

25
26
27
28

2. Whether the URLs provided to Facebook identify “specific video materials or services”
under the VPPA;
3. Whether Hulu obtained Class Members’ “informed, written consent” under the VPPA to
disclose their personally identifiable information to Facebook, at the time Hulu made
such disclosure;

ORDER (C 11-03764 LB)

27

1

4. Whether, as a result of Hulu’s conduct the Class is entitled to equitable relief and/or other
relief, and if so the nature of such relief; and

2
3

5. Whether, as a result of Hulu’s conduct the Class is entitled to damages, including
statutory and/or punitive damages.

4

Defenses Raised By Hulu

5

1. Whether Hulu’s disclosures were incident to Hulu’s debt collection activities, order
fulfillment, request processing, or transfer of ownership;

6
2. Whether Hulu’s disclosures were in Hulu’s ordinary course of business.
7
8

Motion, ECF No. 112 at 14; see Summary Judgment Order, ECF No. 194 at 11-12 (holding that

9

transmissions were not in Hulu’s ordinary course of business, which is defined in 18 U.S.C.
§ 2710(a)(2) as “only debt collection activities, order fulfillment, request processing, and the transfer

11

of ownership”).

12
For the Northern District of California

UNITED STATES DISTRICT COURT

10

As discussed in the summary judgment order, the theory of the VPPA disclosure to Facebook is

13

that to load the Like button, Hulu sent Facebook the title of the watched video and the Facebook ID

14

cookies, which are the datr cookie (identifying the browser), the lu cookie (identifying the previous

15

Facebook user to log into Facebook) (with a lifetime of three years), and the c_user cookie

16

(identifying any user logged into Facebook using the default setting in the last four weeks). See

17

Summary Judgment Order, ECF No. 194 at 19-20.6 By resolving the issues about whether

18

transmission of the Facebook cookies (now limited to the c_user cookie) identified a consumer and

19

whether the URLs conveyed video titles, the court can resolve issues central to the viability of the

20

class members’ common statutory claim that Hulu violated the VPPA by disclosing their PII to

21

Facebook. Plaintiffs’ common questions of law and fact satisfy Rule 23(a)(2). See In re Netflix

22

Privacy Litig., No. 5:11-CV-00379 EJD, 2012 WL 2598819, at *3 (N.D. Cal. July 5, 2012) (in the

23

context of its final approval of a class action settlement, the district court found that Netflix’s

24

uniform policy of retaining and disclosing PII and viewing histories of subscribers established

25
26
27
28

6

Plaintiffs’ motion for class certification relied only on the datr cookie, asserting that it was
“an identifier unique for each Facebook user.” See Motion for Class Certification, ECF No. 112 at
13. That analysis changed by the summary judgment motion, where everyone acknowledged that
the datr cookie alone was not a unique identifier on its own.

ORDER (C 11-03764 LB)

28

1

common statutory claims under the VPPA; the resulting common factual and legal claims met Rule

2

23(a)’s commonality requirement).

3

Hulu nonetheless argues that the claims are not common because each member’s claim turns on

4

individual evidence, such as whether he or she used ad-blocking software, watched a video while

5

logged into Facebook, or cleared browser cookies before accessing Hulu. See Opp’n, ECF No. 150-

6

3 at 17. These assertions do not change the determination that Plaintiffs have established common

7

issues of law and fact. These also are not potentially disparate questions underlying each putative

8

class member’s claim that prevent Plaintiffs from establishing the commonality requirement. Cf.

9

Dukes, 131 S. Ct. at 2548, 2554-56 (potentially disparate questions about each class member’s

discretion by the company’s managers in a common way resulting in a common injury – meant that

12
For the Northern District of California

discrimination claim – given no evidence about a general policy of discrimination or the exercise of

11
UNITED STATES DISTRICT COURT

10

plaintiffs did not satisfy the commonality requirement). The alleged common injury of disclosure of

13

PII to Facebook by transmission of Facebook ID cookies and the name of the watched video is

14

different than the individualized discrimination claims that the Supreme Court identified in Dukes.

15

To the extent that these fact issues affect the similar but more demanding analysis under Rule

16

23(b)(3)’s predominance requirement, the order discusses them below. In the context of the

17

commonality analysis, at best, they are differences in proof that might be amenable to addressing by

18

subclasses. They do not affect the conclusion that Plaintiffs allege the same claim of wrongful

19

disclosure by Hulu to Facebook of their PII and watched videos.

20
21

3. Typicality
Rule 23(a)(3) requires, as a prerequisite to class certification, that “the claims or defenses of the

22

class representatives [must be] typical of the claims or defenses of the class.” “[R]epresentative

23

claims are typical if they are reasonably co-extensive with those of absent class members; they need

24

not be substantially identical.” Hanlon v. Chrysler Corp., 150 F.3d 1011, 1020 (9th Cir. 1998)

25

(internal quotation marks and citation omitted). “Typicality refers to the nature of the claim or

26

defense of the class representative, and not to the specific facts from which it arose or the relief

27

sought.” Ellis v. Costco Wholesale Corp., 657 F.3d 970, 984 (9th Cir. 2011). “The test of typicality

28

is whether other members have the same or similar injury, whether the action is based on conduct

ORDER (C 11-03764 LB)

29

1

which is not unique to the named plaintiffs, and whether other class members have been injured by

2

the same course of conduct.” Hanon v. Dataproducts Corp., 976 F.2d 497, 508 (9th Cir. 1992)

3

(citation and internal quotation marks omitted). “The purpose of the typicality requirement is to

4

assure that the interest of the named representative aligns with the interests of the class. . . . [C]lass

5

certification is inappropriate when a putative class representative is subject to unique defenses which

6

threaten to become the focus of the litigation.” Id.

7

The claims are typical. Plaintiffs’ claims involve the same statutory violation and the same

8

injury: disclosure of their PII (in the form of the Facebook ID cookies) and the name of the video.

9

Hulu again points to differences in each member’s claim, such as whether he or she used ad-

accounts, made posts on Facebook about videos viewed, or cleared browser cookies before

12
For the Northern District of California

blocking software, watched a video while logged into Facebook, integrated Hulu and Facebook

11
UNITED STATES DISTRICT COURT

10

accessing Hulu. See Opp’n, ECF No. 150-3 at 16 (citing Hulu’s consumer survey that 50% of Hulu

13

users use ad-blocking technology and 60% use browser settings that block cookies). They also point

14

to Joseph Garvey’s use of a pseudonym to register as a Hulu user. Id.

15

These differences do not change the conclusion.

16

First, Plaintiffs exclude participants in Facebook Connect (the service that connects Hulu and

17

Facebook users and allows sharing of views across the two platforms) on the ground that including

18

them would present sufficiently different questions of law and fact to preclude a cohesive class. See

19

Motion, ECF No. 112 at 15, n.8. This disposes of any concern regarding integration of Hulu and

20

Facebook accounts.

21

Second, a plaintiff’s independent posting on Facebook is not a defense. Consent to a disclosure

22

under the VPPA in effect during the class period required the “informed, written consent of the

23

consumer given at the time the disclosure is sought.” 18 U.S.C. § 2710(b)(2)(B). What is at issue

24

here is Hulu’s alleged independent transmission to Facebook – without any consent by the

25

Hulu/Facebook user – of the Facebook ID and the video title as part of the process of loading the

26

code for the Like button. Being logged into Facebook similarly is not obviously consent under

27

VPPA. As discussed in the summary judgment order, there is no evidence in the record that

28

Facebook’s data policies affect this analysis or are the informed, written consent required by the

ORDER (C 11-03764 LB)

30

1
2

VPPA. See ECF No. 194 at 26.
Third, Joseph Garvey’s use of a pseudonym does not alter the issues here: his being identified to

3

Facebook. As discussed in the summary judgment order, there are material issues of fact about

4

whether the transmission of the Facebook cookies with the video title was an electronic transmission

5

of the Hulu user’s actual identity on Facebook and the video that the Facebook user was watching.

6

See ECF No. 194 at 20-22. The Facebook ID personally identifies a Facebook user. See id.

7

(material issue of fact exists about whether the transmission to Facebook was sufficient to identify

8

individual consumers); see also In Re: Zynga Privacy Litig., No. 11-18044, 2014 WL 1814029, at *9

9

(9th Cir. May 8, 2014) (discussing how a Facebook ID is personally identifiable information under

pseudonym on Hulu does not affect the inquiry about whether Hulu knowingly sent his Facebook ID

12
For the Northern District of California

18 U.S.C. § 2702(c) of the Electronic Communications Privacy Act). Joseph Garvey’s use of a

11
UNITED STATES DISTRICT COURT

10

to Facebook together with the titles of his watched videos.

13

Finally, to the extent that fact issues about ad blockers or clearing browser cookies affect the

14

analysis under Rule 23(b)(3), the court discusses them below in the section on the predominance

15

requirement. As to the defenses, they are not the kinds of defenses that typically defeat class

16

certification by the need for substantial cross-examination on negative facts. Moreover, they are not

17

the kinds of defenses that pose “a danger that absent class members will suffer if their representative

18

is preoccupied with defenses unique to it.” Hanon, 976 F.3d at 508.

19
20

4. Adequacy of Representation
Rule 23(a)(4) requires that, before a court may certify a class, it must find that “the

21

representative parties will fairly and adequately protect the interests of the class.” The requirement

22

applies to the class representative and class counsel and requires resolution of two questions: “(1) do

23

the named plaintiffs and their counsel have any conflicts of interest with other class members, and

24

(2) will the named plaintiffs and their counsel prosecute the action vigorously on behalf of the

25

class?” Hanlon, 150 F.3d at 1020. Rule 23(g)(4) also specifies that class counsel “must fairly and

26

adequately represent the interests of the class.” Under Rule 23(g)(1)(A), the court must consider the

27

following criteria in appointing class counsel: (i) counsel’s work “in identifying or investigating

28

potential claims in the action”; (ii) “counsel’s experience in handling class actions, other complex

ORDER (C 11-03764 LB)

31

1

litigation, and the types of claims asserted in the action”; (iii) “counsel’s knowledge of the

2

applicable law”; and (iv) “the resources that counsel will commit to representing the class.” Rule

3

23(g)(1)(B) permits the court to “consider any other matter pertinent to counsel’s ability to fairly and

4

adequately represent the interests of the class.”

5

Defendants do not dispute the adequacy of Plaintiffs’ counsel. Plaintiffs retained counsel with

6

significant experience in prosecuting large consumer class actions. See Parisi Decl., ECF No. 113,

7

Exs. 10-12. Counsel have worked vigorously to identify and investigate the claims in this case, and,

8

as this litigation has revealed, they understand the applicable law and have represented their clients

9

effectively. See In re Netflix Privacy Litigation, 2012 WL 2598819, at *3.

named plaintiff’s claim and the class claims are so interrelated that the interests of the class members

12
For the Northern District of California

As to the adequacy of the named Plaintiffs, the requirement is meant to evaluate whether “the

11
UNITED STATES DISTRICT COURT

10

will be fairly and adequately protected in their absence.” Gen. Tel. of Sw. v. Falcon, 457 U.S. 147,

13

158, n.13 (1982). Plaintiffs’ counsel asserted, and Hulu does not dispute, that Plaintiffs have worked

14

actively with counsel to prepare and “vigorously” prosecute the case. See Fed. R. Civ. P. 23(a)(4);

15

Parisi Decl.; ECF No. 114, Exs. 10-12; Torre Decl. ¶ 9; Wymyczak Decl. ¶ 9; Garvey Decl. ¶ 9;

16

Zampella Decl. ¶ 9; see Opp’n, ECF No. 150-3 at 15, n.4. Given their common claims and shared

17

interests with the class, the named Plaintiffs adequately represent the class’s interests under Rule

18

23(a)(4). Accord In re Netflix Privacy Litigation, 2012 WL 2598819, at *3 (reaching the same

19

conclusion in a VPPA case based on similar facts).

20

Hulu’s only argument against this result is that Plaintiffs are not adequate representatives under

21

Rule 23(b)(3). Opp’n, ECF No. 150-3 at 15, n. 4. The order addresses Rule 23(b) in the next

22

section.

23

C. Rule 23(b)(3) Requirements

24

Under Rule 23(b)(3), a class action is maintainable if “the court finds that questions of law or

25

fact common to class members predominate over any questions affecting only individual members,

26

and that a class action is superior to other available methods for fairly and efficiently adjudicating

27

the controversy.” Rule 23(b)(3) thus requires two inquiries: (1) do the common questions of law or

28

fact “predominate” over questions over questions affecting only individual class members, and (2) is

ORDER (C 11-03764 LB)

32

1
2
3

class treatment “superior” to alternative methods for adjudicating the controversy?
1. Predominance of Common Questions
The Rule 23(b)(3) predominance inquiry involves weighing and evaluating the common and

4

individual issues in the case. See Dukes, 131 S. Ct. at 2556. It involves consideration of the same

5

principles that guide the Rule 23(a) commonality analysis, but it “is even more demanding than Rule

6

23(a). See Comcast Corp. v. Behrend, 133 S. Ct. 1426, 1432 (2013). The Rule 23(a)(2) inquiry is

7

only whether the plaintiff shows the existence of a common issue of law or fact. See Dukes, 131 S.

8

Ct. at 2556. The predominance inquiry looks at those common questions, “focuses on the

9

relationship between the common and individual issues,” Hanlon, 150 F.3d at 1022, and requires the

Class certification under Rule 23(b)(3) is proper when common questions represent a significant

12
For the Northern District of California

court to weigh the common issues against the individual issues. See Dukes, 131 S. Ct. at 2556.

11
UNITED STATES DISTRICT COURT

10

portion of the case and can be resolved for all members of the class in a single adjudication.

13

Hanlon, 150 F.3d at 1022.

14

“Considering whether ‘questions of law or fact common to class members predominate’ begins,

15

of course, with the elements of the underlying cause of action.” Erica P. John Fund, Inc. v.

16

Halliburton Co., 131 S. Ct. 2179, 2181 (2011). “In determining whether common questions

17

predominate, the Court identifies the substantive issues related to plaintiff’s claims (both the causes

18

of action and affirmative defenses); then considers the proof necessary to establish each element of

19

the claim or defense; and considers how these issues would be tried.” Gaudin v. Saxon Mortgage

20

Servs., Inc., No. 11-CV-01663-JST, 2013 WL 4029043 (N.D. Cal. Aug. 5, 2013) (citing Cal. Prac.

21

Guide Fed. Civ. Pro. Before Trial Ch. 10-C § 10:412). The predominance analysis is a pragmatic

22

one: it is not a numerical analysis and instead is a qualitative assessment of overriding issues in the

23

case, despite the existence of individual questions. See Newberg on Class Actions, § 4.51; Butler v.

24

Sears, Roebuck & Co., 727 F.3d 796, 801 (7th Cir. 2013) (finding a single, central issue of liability

25

in a class action involving defects in washing machines; the two central defects were mold and the

26

control unit; those differences could be addressed by subclassing; differences in damages can be

27

addressed in individual hearings, in settlement negotiations, or by creation of subclasses), cert.

28

denied, 134 S. Ct. 1277 (2014).

ORDER (C 11-03764 LB)

33

1

As discussed in the section on commonality, Plaintiffs allege a common claim and the same

2

injury: disclosure of their PII by the transmission of the Facebook ID cookies and their watched

3

videos in violation of the VPPA, 18 U.S.C. § 2710. Hulu argues that there can be no predominance

4

of that common claim over individual issues because each plaintiff must prove that his or her

5

identity was “reversed engineered” from the data sent to Facebook. See Opp’n, ECF No. 150-3 at

6

17. But as narrowed in the summary judgment order, the theory of disclosure to Facebook is not a

7

reverse engineering theory and instead is a theory of direct disclosure to Facebook of its users’

8

actual identities on Facebook and their watched videos. See ECF No. 194 at 19-21. Indeed, the

9

court agreed with Hulu (and granted summary judgment to Hulu on the comScore disclosure) that

watching habits that would violate the VPPA. See id. at 18-19. By contrast, Hulu’s transmission of

12
For the Northern District of California

disclosure of anonymous information was not the linking of a specific, identified person to his video

11
UNITED STATES DISTRICT COURT

10

the Facebook ID cookies and the title of the watched video possibly is information that identified the

13

Hulu user’s actual identity on Facebook. See id. at 19-21. There is a material issue of fact about

14

whether this was sufficient to identify consumers and thus violate the VPPA. See id. at 21-23.

15

Moreover, there are material issues of fact about whether Hulu knew it was disclosing PII in

16

violation of the VPPA. See id. at 22-23. If it knew, then (depending on the facts) there might be a

17

VPPA violation. See id. If it did not, then there would not be a VPPA violation.

18

Hulu also argues that issues that defeat predominance are whether class members (1) registered

19

with a pseudonym, (2) watched videos while logged into Facebook, (3) disclosed their choices to

20

Facebook voluntarily, (4) allowed others to use their Hulu account, and (5) installed ad-blocking

21

software, cleared browser cookies before watching videos, or set browsers to block third-party

22

cookies.

23

First, as to registering with a pseudonym, this does not defeat predominance (just as it did not

24

defeat typicality). The use of a pseudonym on Hulu does not affect the inquiry about whether Hulu

25

knowingly sent a Hulu user’s Facebook ID to Facebook together with the titles of his watched

26

videos.

27

Second, as to Hulu users’ watching videos while logged into Facebook, Hulu’s argument is that

28

this is consent to disclosure. See Opposition, ECF No. 150-3 at 23. But the issue is Hulu’s alleged

ORDER (C 11-03764 LB)

34

1

unauthorized disclosure. Absent the informed, written consent required by the VPPA “given at the

2

time the disclosure is sought,” a disclosure of PII violates the VPPA. See 18 U.S.C. § 2710(a)(b)(2)

3

(2012) (later amended in 2013 to broaden the consent provisions). It is one thing to acknowledge

4

the placement or use of cookies. It is another to interpret a data policy as the informed, written

5

consent that the VPPA required during the class period. As the summary judgment order concluded,

6

there is no evidence in the record that Facebook’s data policies affect this analysis or are informed,

7

written consent under the VPPA. See ECF No. 194 at 26.

8

Third, and similarly, as discussed above, the record does not allow the court to conclude that a

Moreover, the claims here are about Hulu’s alleged unauthorized disclosure of PII during the

11

loading of the Like button when a Hulu user launched the watch page. A user’s independent actions

12
For the Northern District of California

plaintiff’s independent posting on Facebook is an informed, written consent under the VPPA.

10

UNITED STATES DISTRICT COURT

9

do not alter the analysis of whether Hulu knowingly disclosed PII.

13

Fourth, allowing someone else to use one’s Hulu account does not mean that a Hulu user cannot

14

complain about Hulu’s disclosure of the user’s PII. Limiting the injury to one disclosure avoids

15

proof issues that might exist with multiple disclosures and tying a disclosure to a particular user.

16

Fifth, the main issue with predominance is cookie clearing or blocking. As described above, the

17

remaining theory of disclosure is the transmission of the c_user cookie, which includes the Facebook

18

ID. That cookie was transmitted only when a Hulu user watched a video on hulu.com having used

19

the same computer and web browser to log into Facebook in the previous four weeks using default

20

settings. See JSUF #22; Calandrino Decl. ¶¶ 66-67. Also, according to Hulu’s expert Peter

21

Weitzman, the c_user cookie is cleared if the Facebook “keep me logged in” box is not checked, if

22

the user manually cleared cookies after the Facebook session and before the Hulu session, or if the

23

user used cookie-blocking or ad-blocking software that prevented disclosures. See supra Statement.

24

Plaintiffs point out that Mr. Weitzman tested only current versions of blockers and ad-blocking

25

tools, not those in effect during the class period. See Weitzman Dep., Tersigni Decl. Ex. 6, ECF No.

26

170 at 77:3-17. It may be that this does not matter, but the record is silent on this point.

27
28

Plaintiffs also argue that Mr. Weitzman relied only on incomplete versions of their session
captures regarding the loading of the Like button and the disclosure of the user’s Facebook ID in the

ORDER (C 11-03764 LB)

35

1

non-cookie portion of Hulu’s request to Hulu to load the Like button. See Plaintiff’s Reply, ECF

2

No. 168 at 13. In support of this argument, the brief cites the Wills Decl., ECF No. 160, ¶ 47. One

3

cannot tell from the Wills Declaration whether the disclosure of the Facebook ID is in a cookie or

4

non-cookie portion of Hulu’s request to load the Like button. But Plaintiffs’ expert Joseph

5

Calandrino’s declaration refers to a transmission of the Facebook ID of the currently-logged-in

6

Facebook user via the c_user cookie or the lu cookie. Calandrino Decl., ECF No. 160-5, ¶¶ 66, 71.

7

The record does not contain any dispute that (1) the relevant disclosure is the transmission of the

8

c_user cookie, and (2) if the c_user cookie is cleared, then it cannot be transmitted to Facebook

9

when the Like button loads.

10

Hulu also employed technology to block attempts to block ad blockers, and Plaintiffs’ inference
is that there is no evidence that ad blockers were effective. Plaintiffs’ Reply, ECF No. 168 at 10.

12
For the Northern District of California

UNITED STATES DISTRICT COURT

11

Plaintiffs point to comScore’s testimony that its cookies always came through. Johnson Dep.,

13

Tersigni Decl. Ex. 3, ECF No. 169, at 80-91.

14

Finally, Plaintiffs dispute the reliability of Mr. Weitzman’s survey result that 65.3% of

15

respondents used ad-blocking software and cite a different study that as of May 2012, the percentage

16

of Internet users in the U.S. using ad-blocking software was under ten percent. Id. at 14 n.12 (citing

17

Tersigni Decl. Ex. 18, Ad-Blocking, Measured, ClarityRay, May 2012, at 4).

18

In the end, the substantial issues about remaining logged into Facebook and clearing and

19

blocking cookies mean that the court cannot conclude on this record that the common issues

20

predominate over the individual ones. Perhaps subclasses could address the use (or lack of use) of

21

ad-blockers or browser technologies, or whether users stayed logged into Facebook. Plaintiffs have

22

not proposed that subclassing. Given that even the court’s best guess at subclassing would not

23

address the issues about ascertainability and identify the class members, the court finds on this

24

record that common issues do not predominate.

25
26

2. Rule 23(b)(3) Superiority
Rule 23(b)(3) requires a court to assess whether class treatment is “superior to other available

27

methods for the fair and efficient adjudication of the controversy.” Factors to consider in assessing

28

superiority include the following: (A) the class members’ interests in individually controlling the

ORDER (C 11-03764 LB)

36

1

prosecution or defense of separate actions; (B) the extent and nature of any litigation concerning the

2

controversy already begun by or against class members; (C) the desirability or undesirability of

3

concentrating the litigation of the claims in the particular forum; and (D) the likely difficulties in

4

managing a class action. Fed. R. Civ. P. 23(b)(3). Aggregation in a class action can be efficient

5

when many individuals have small damages because absent a class suit, it is unlikely that any of the

6

claimants will be accorded relief. See Amchem Prods., Inc. v. Windsor, 521 U.S. 591, 619 (1997).

7

Here, the factors supporting the superiority of a class action are the small individual statutory

8

damages and the putative class’s common theory of liability. Either Hulu transmitted PII by its

9

policy and practice regarding the loading of the Like button, or it did not. But based on the court’s
holding that a class is not ascertainable on this record, class treatment is not superior.

11

III. HULU’S DUE PROCESS ARGUMENT

12
For the Northern District of California

UNITED STATES DISTRICT COURT

10

Hulu argues that certifying the class would result in statutory damages of $2,500 per class

13

member, without any evidence that a class member was injured, for a total damages award of

14

billions of dollars. Opposition, ECF No. 150-3 at 29. That award is wildly disproportionate to any

15

adverse effects class members suffered, and it shocks the conscience. Id. (citing Kline v. Coldwell

16

Banker & Co., 508 F.2d 226, 234-35 (9th Cir. 1974)). Kline is a case where the Ninth Circuit

17

upheld the district court’s refusal to certify a case involving $750 million in statutory treble

18

damages, noting that each claim involved only minimal damages.

19

It can be a legitimate concern that the potential for a devastatingly large damages award, out of

20

proportion to the actual harm suffered by members of the plaintiff class, may raise due process

21

issues. Parker v. Time Warner Entertainment Co., 331 F.3d 13, 22 (2nd Cir. 2003) (addressing

22

claims for transmission of personally-identifiable subscriber information in violation of the Cable

23

Consumer Protection Act and state consumer protection laws). The aggregation of statutory

24

damages claims potentially distorts the purpose of both statutory damages and class actions, and if it

25

does, it creates a potentially enormous aggregate recovery for plaintiffs that in turn may induce an

26

unfair settlement. Id. In a sufficiently serious case, a defendant might invoke the Due Process

27

clause to reduce the statutory award. Id. The Second Circuit has held that a defendant might invoke

28

the Due Process clause, “not to prevent certification, but to nullify that effect and reduce the

ORDER (C 11-03764 LB)

37

1
2

aggregate damage award.” Id.
Another approach to the calamitous damages problem is to certify a class, allow it to proceed,

prevail. Newburg on Class Actions, § 4.83. In a putative class action against a potential creditor for

5

accessing consumers’ credit history without permission, the Seventh Circuit has held that such

6

“constitutional limits are best applied after a class has been certified.” Murray v. GMAC Mortg.

7

Corp., 434 F.3d 948, 954 (7th Cir. 2006). “Then a judge may evaluate the defendant’s overall

8

conduct and control its total exposure. Reducing recovery by forcing everyone to litigate

9

independently – so that constitutional bounds are not tested, because the statute cannot be enforced

10

by more than a handful of victims – has little to recommend it.” Id.; accord Bateman v. American

11

Multi-Cinema, Inc., 623 F.3d 708 (9th Cir. 2001) (in a class action against a movie theater chain for

12
For the Northern District of California

and then invoke the Due Process clause to cap damages within a reasonable realm if Plaintiffs

4

UNITED STATES DISTRICT COURT

3

violations of the Fair and Accurate Credit Transactions Act, court acknowledged possibility of due

13

process concerns by noting that “reserv[ing] judgment as to whether a district court may reduce

14

damages award as unconstitutionally excessive” but held that “it is not appropriate to evaluate the

15

excessiveness of the award [at the class certification stage] . . . . Because we do not know what

16

amount of damages [plaintiffs] will seek nor how many plaintiffs will ultimately claim the benefit of

17

any damages awarded should plaintiffs prevail, any evaluation of AMC’s potential liability at this

18

stage is unduly speculative.”).

19
20

Given its denial of class certification on this record, the court does not reach this issue. That
being said, likely it is one best addressed after a class is certified.

21
22
23

CONCLUSION
The court denies Plaintiffs’ motion for class certification without prejudice and denies Plaintiffs’
motion for appointment of the class representatives and class counsel as moot.

24

This disposes of ECF No. 111.

25

IT IS SO ORDERED.

26

Dated: June 16, 2014

27

_______________________________
LAUREL BEELER
United States Magistrate Judge

28

ORDER (C 11-03764 LB)

38