This past Friday, the U.S. Court of Appeals for the Ninth Circuit held that class claims against Netflix for alleged violations of the Video Privacy Protection Act and a similar California statute had to be dismissed because neither statute applies when a disclosure of information about a consumer's video-viewing history is the result of the consumer's decision to link a television set to a password-protected account, thus allowing anyone who turns on the TV to see the consumer's video-viewing history. The decision in Mollett v. Netflix, Inc. holds that such disclosures are disclosures to the subscriber herself and not to third parties, even though they may occur without the subscriber's presence or knowledge. Control of the information, the court holds, is the subscriber's problem, not Netflix's.
Both the VPPA and the California statute prohibit the disclosure of information about video rentals to "any person" other than the consumer. Netflix allows subscribers to establish password-protected accounts in which access to information is limited to the subscriber. But it also allows subscribers to link those accounts to particular viewing devices in a way that transmits information about viewing history to the device when it is turned on, without entry of a password or any other confirmation that the person viewing the information is the subscriber.
Although anyone who happens to turn on a linked device can see the information whether the subscriber is present or not, the court's opinion refers to the third parties to whom the information is disclosed as the subscriber's "family, friends and guests" who use the device "or are in the subscriber's presence when she is accessing her account through a Netflix-ready device." The opinion makes clear, however, that it holds that Netflix is not liable regardless of "the particular circumstances at a subscriber’s residence."
In short, if a subscriber chooses to link a TV to her account, the court treats disclosure to anyone who turns on the TV as a disclosure to the subscriber (or with her permission). Video rental companies, the court holds, have no obligation to provide "secure disclosure."
The language of the statutes could probably have supported the opposite outcome, but the court clearly believes that consumers control, and are responsible for, whoever has access to their TV sets and other video devices. Maybe they've never experienced a battle over the remote…. The lesson for consumers is that if you don't want others to know what you're viewing, you'd better keep them from turning on your TV.