Can Blockbuster be Sued Over Facebook/Beacon?

An anonymous reader writes "A professor at the New York Law School is arguing that Blockbuster violated the Video Privacy Protection Act of 1988 when movie choices that Facebook members made on its Web site were made available to other members of the social network via Beacon. The law basically prohibits video rental outfits from disclosing rental choice of their customers to anyone else without specific written consent. Facebook's legal liability in all of this is unclear; with Blockbuster it's a straightforward case of not complying with the VPPA, the law professor says."

Yes, but...

[jo42 (227475)]

Didn't Facebook members make their movie choices public in the first place?

So this public information was then used by someone else.

What be wrong with this?

Re:Yes, but...

[hansamurai (907719)]

Yes, the users did give permission to Blockbuster to broadcast their rentals. So this is really an issue between "written consent" that the summary says and electronic consent without a hand-written signature. I would guess there's tons of precedent one way or the other, though I wouldn't know which way this would lean.

Re:Yes, but...

[Broken scope (973885)]

The issue is that facebook opts int by default, doesn't fucking tell you, then makes it's it unclear on how you disable the "feature"

Re:Yes, but...

[IcyNeko (891749)]

I wrote BBOnline about this, and this was the reply they gave me:

Thanks for contacting Blockbuster Online Customer Care.

I'm very sorry for any inconvenience this may have caused. When you log in to your BLOCKBUSTER Online account, the site uses "cookies" to determine if you have ever visited Facebook.com [facebook.com]. (Cookies: a collection of information, usually including a username and the current date and time, stored on the local computer of a person using the Internet. It is used by websites to identify users who have previously registered or visited the site.)

If cookies detect that you have a Facebook account, regardless of whether or not you have installed the Movie Clique(TM) application, then activities on blockbuster.com [blockbuster.com] such as rating movies or adding movies to your Queue will be sent as notifications to your mini-feed and friends' profiles. You will see a "toast" for each action resulting in a notification. If you want to permanently disable the Facebook integration on blockbuster.com [blockbuster.com], you can easily change these settings on Facebook by clicking on Privacy Settings for External Websites. Under "Allow these websites to send stories to my profile" for Blockbuster, click "Never" and Save.

You may see a pop-up on blockbuster.com [blockbuster.com] which introduces Movie Clique(TM) encourages you to link your BLOCKBUSTER Online® account to your Facebook profile. If you don't want to see the screen pop anymore, click the "Do Not Show This Again" box and click Save. I hope this information helps, feel free to contact me anytime.

So basically, they snag your facebook cookie, then they add your rental info on your account without asking permission, forcing itself on your account, and announcing away. It's up to you to then uninstall that shit.

BBOnline: See you in court!

Re:

[TooMuchToDo (882796)]

If you want to permanently disable the Facebook integration on blockbuster.com, you can easily change these settings on Facebook by clicking on Privacy Settings for External Websites. Under "Allow these websites to send stories to my profile" for Blockbuster, click "Never" and Save.

This is new functionality that Facebook just added. If you want to be sure, google for "Block Facebook Beacon". Plenty of articles on how to use add-ons in Firefox to completely disallow Beacon from getting data on you.

The worst part

[burndive (855848)]

The worst part about this business is not that Facebook tells your friends. It's that Blockbuster tells Facebook in the first place.

Re:Yes, but...

[anticypher (48312)]

Beacon also uses Adobe Flash "stored data" space to write cookie style information, that can be read and written to by any site with a flash bug.

This was the buzz all this week at a conference on how to make money from internet tracking. Adobe controls the settings on how much information can be written to your local hard drive, and they sell the ability to anyone willing to pay. There is a global setting that users can turn to "off", but Adobe ignores it if they are given enough money. Since Flash tends to be installed system-wide and on all browsers on a machine, it doesn't matter if you clear out browser cookies or try blocking tracking sites. If a partner site sticks a 1x1 pixel flash bug on their site, it has the ability to read tracking info from any other site, and to write back additional information.

Beacon is clever because it creates a large enough "cookie" that many sites can write into the cookie without changing the size taken on disk. Beacon also defines exactly how to parse the information, and how to write new info without changing the total cookie size.

Of course, I was just watching a canned demo of this, so the company claiming to be behind Beacon could be making it all up, but the sales pitch was pretty convincing. I haven't the time or inclination to verify this, as I don't ever look at face book, and generally don't allow flash on my machines (which leaves the web looking very poorly these days)

the AC

Re:Wrong

[Culture20 (968837)]

You have a 5 second window to "cancel" the sending of the info, but it's worded in a way that you're forced to think about allow or deny... then it chooses on its own and sends. And... you don't get asked to confirm the post. The post happens whether you want it or not, then you are forced to remove it if you don't want it. Beacon==bad UI from a human user standpoint

Re:

[ThinkingInBinary (899485)]

No! The whole controversy with Beacon is that everyone was opted-in without their consent, and their purchases suddenly started showing up to other people on their Facebook profiles

Re:Yes, but...

[Tim C (15259)]

No, this is about Beacon, the Facebook feature that allowed participating websites to publish stories on your Facebook account about the dealings you had had with them - e.g. items you've bought, or in this case, films you've rented.

Beacon was particularly controversial because it was not only opt-out, you couldn't opt-out of it altogether, you could only opt-out on a per-participating company basis *after* that company had already published a story. Facebook has since made changes due to the backlash the original version caused.

This isn't a case of users making information available and someone else using it, this is the Blockbuster website making available information about its users who also use Facebook, apparently in direct contravention of this legislation.

Privacy is why I dropped Facebook.

[neo (4625)]

You can't spend much time on facebook without some third party application asking for personal information. More than that the "viral" content is vicious, asking to check your various mail accounts to send requests for more people to join. This is just friendster with a new twist, but the twist is dangerous. You have no idea who you are giving up your information to. Want Big Brother? Think about how facebook looks to the CIA or NSA and now you entire social network was mapped. Not by them, but by you.

No, I quit facebook. Deleted as much as I could before I left, but I know they still have it.

Facebook is dangerous. Period. Go ahead and be a pirate/ninja warrior... but take a look at who wrote that ap. They get your infomation.

Re:

[rucs_hack (784150)]

Given that the entire point of the site is to share information about yourself, I have a bit of a problem with people complaining that it shares information about them.

It's a free service, not a charity. They need to turn a profit, like any other company, and the only commodity is the information that you *chose* to give them in the first place. Don't like it? Don't use it, it's ever so simple...

What's next, people deliberately setting themselves on fire and then suing the company they bought the matches f

Re:

[Intron (870560)]

Yes. But it isn't the stuff people put on Facebook that is being published, is it? It's messages like "Rucs_hack just rented Gigli from Blockbuster!" posted on your Facebook site. To use a typical /. (strained) metaphor, if I let you drive my car, can't I complain when you start sleeping in my house?

Re:

[rucs_hack (784150)]

That does go too far, yes, but as I said, thew whole point of the website is to share your information. If we paid Facebook for an account I'm sure it would be a lot easier to control what of your information they use, but we don't, and as a result they will data mine you for all your worth.

Anyone who didn't think this would happen is fooling themselves. ANy compaany will try first, and back off only if they have to. Companies that play nice will get dropped by investors. Besides, how long before it happens

Re:

[Intron (870560)]

I believe there is work underway to advertise to you by your location, determined from your cell phone. I'm sure Verizon would sell me out in an instant if there was a buck to be made.

Re:

[Jeff DeMaagd (2015)]

Parts of it do bother me. I have to allow the "app" access to my information just to see a video or to look at a picture. They don't explain why they need that access either, you can't say "no access" and still see the video or picture.

Re:

[mini me (132455)]

I have to allow the "app" access to my information just to see a video or to look at a picture.

That's the fault of a poorly developed application. Facebook applications technically do not require you to allow access to your information just to view a video or look at a picture.

Re:

[Tim C (15259)]

More than that the "viral" content is vicious, asking to check your various mail accounts to send requests for more people to join.

I've not seen this at all - the worst I've seen is the apps that invite you to invite your Facebook friends to add the application. I've not had a single application ask me to supply my email address book details (and of course I wasn't stupid enough to supply them to Facebook when I joined).

Go ahead and be a pirate/ninja warrior... but take a look at who wrote that ap. They

Re:

[iluvcapra (782887)]

Think about how facebook looks to the CIA or NSA and now you entire social network was mapped. Not by them, but by you.

I've posted this before on this topic, but since you mentioned it...

The Okhrana, the Czarist predecessor of the GPU, is reported to have invented a filing system in which every suspect was noted on a large card in the center of which his name was surrounded by a red circle; his political friends were designated by smaller red circles and his nonpolitical acquaintances by green ones; brown circles indicated persons in contact with friends of the suspect but not known to him personally; cross-relationships between the suspect's friends, political and nonpolitical, and the friends of his friends were indicated by lines between the respective circles. Obviously the limitations of this method are set only by the size of the filing cards, and, theoretically, a gigantic single sheet could show the relations and cross-relationships of the entire population. And this is the utopian goal of the totalitarian secret police: a look at the gigantic map on the office wall should suffice at any given moment to establish, not who is who or who thinks what, but who is related to whom and in what degree or kind of intimacy.

Hannah Arendt, Origins of Totalitarianism

only blockbuster is at fault

[Greenisus (262784)]

in this case, facebook is more of a common carrier. blockbuster is the one who broke the law; they just used Beacon as the tool.

Better sue now

[huckamania (533052)]

Cause they me be Chapter 11 in a few more quarters...

Re:

[Petey_Alchemist (711672)]

This isn't exactly true. I was privy to the academic listserv that gave rise to the article in the OP. Here is a segment from the discussion that lays out the argument for both Facebook and Blockbuster's culpability here, from a cyberlaw professor who I'll keep anonymous.

"This is the reasoning:

1. Blockbuster is a "video tape service provider" under the statute.

2. Blockbuster is prohibited from "knowingly disclosing, to any person,
personally identifiable information concerning any consumer of such
provider

Question for any expert...

[by Anonymous Coward]

This may be a naive question, but I've searched the Facebook developer documents and can't get a straight answer: Do the third-party developers of Facebook apps get access to your profile information?

For that matter, where does the code for these third-party apps run? Is it uploaded to the Facebook servers (and run from there), or are these third-party developers running code on their own webserver that uses hooks into the Facebook API?

If I install a Facebook app, does this mean that the developer has acces

Re:Question for any expert...

[Skidge (316075)]

Third-party applications run on third-party servers. They have access to most of your profile information, but aren't allowed to save all but the most basic pieces (user id, network id, etc.) because of the Terms of Service. They aren't supposed to store your friends, even. However, any info that you enter in the app is fair game. For example, if you enter the books you've read in this app [facebook.com], they can store that information.

The question is, do you trust these 3rd party apps to not store your personal info from your profile?

For reference, halfway down this page [facebook.com] is a decent list of profile information available to developers.

Short answer

[j00r0m4nc3r (959816)]

Can? Yes. Lose? Who knows.

Facebook is screwed?

[192939495969798999 (58312)]

If this is what we know about publicly that Facebook is up to, how long will it be before something surfaces about them collecting DNA or some other ungodly personal info and selling it? Won't someone think of the children?!

haven't looked at in a while

[superwiz (655733)]

But does Facebook rent movies now? Otherwise, how does this apply (other than stretching the law to mean what you want to mean)?

Answer

[Daimanta (1140543)]

Can they be sued?

Yes

Will Facebook lose?

I don't think so Tim

What about Netflix?

[Wordplay (54438)]

I can see my friends' rental histories on Netflix, and I'm sure they can see mine. I probably checked a box somewhere, but I don't think I consented to this sort of thing "in writing."

Re:

[syntaxeater (1070272)]

Doubt it. If anything, I would guess this will be the case where they decide the term "Specific Written Consent" is synonymous with any EULA or application of your signature to a document.

Re:is this

[faedle (114018)]

.. except there is mountains of case law that says otherwise: that EULAs are, in essence, only marginally enforceable.

This being in some hidden Facebook EULA, or on some 'policy page' for Blockbuster does not mean "the user notifies us in writing". That has specific legal meaning: if they don't have a SIGNED PIECE OF PAPER with the words "I allow you do release my video rental records", they don't have notification in writing of permission.

All this is irrelevant, anyway: the worst that's likely to happen here is some states' attorney general will file a lawsuit, get it certified as "class action", and Blockbuster will settle out-of-court and pay some piddly fine + attorney's fees and send everybody who asks a $5 for free rentals. Big deal.

Re:

[Shakrai (717556)]

Blockbuster will settle out-of-court and pay some piddly fine + attorney's fees and send everybody who asks a $5 for free rentals. Big deal.

Eh, those settlements usually cost the offending company millions of real dollars (i.e: the attorney's fees and fines) and millions of implied dollars (the cost of offering all those free rentals).

Granted, a few million bucks is a different animal for a company like Blockbuster (631 million market cap [google.com]) then it would be for you or me, but it's not pocket change for them either.

Re:

[jedidiah (1196)]

The problem with the BlockBuster model is that it assumes that the
local brick and mortar store will have what you want. If it is
popular then it is likely already out of stock. If it is unpopular
then it is likely not even carried by your local store.

Netflix -> Amazon.

Re:

[jedidiah (1196)]

10 Copies of Asshole the Movie and Freddy Got Fingered doesn't count.

Re:

[jedidiah (1196)]

They also have to have not only WHAT you want by WHEN you want it.

There is a temporal element here that is non-trivial.

A fat PVR that handles PPV well makes more sense than either of them (netflix or blockbuster).

Re:

[onemorechip (816444)]

I never liked Blockbuster because of their past history of censorship (see "Last Temptation of Christ"). Maybe they don't do that anymore but there's still a bad vibe for me there. Before Netflix, I always preferred Hollywood Video. And with Netflix, I've never had a problem getting the movies I want. Why take the trouble with going to the video store -- one or two movies delivered to my mailbox every week is as much as I ever find time to watch these days, anyway.

Re:

[cayenne8 (626475)]

I'm more surprised at this LAW that I never knew existed preventing a movie rental place from sharing your rentals without consent.

For once, a law I applaud, I only wish (at least in the US) that they would take this law and expand on it. Make it illegal for ANY commercial (and possibly most govt.) entities from sharing your personal information without express consent. It sure would cut down on a lot of unpleasant things we have due to all the customer information sharing. Junk mail....credit card applica

Pissed off the wrong guy

[stabiesoft (733417)]

From what I read, maybe we just need to publish the Supreme court credit card #'s and maybe we can get stronger credit protections too. I don't think this law wouldv'e existed if Justice Bork's video rental habbits had not been published in the newspaper.

Re:

[M. Baranczak (726671)]

You're thinking of Clarence Thomas.

Re:Pissed off the wrong guy

[KingAdrock (115014)]

No he isn't.

From Wikipedia...

During debate over his nomination, Bork's video rental history was leaked to the press, which led to the enactment of the 1988 Video Privacy Protection Act. His video rental history was unremarkable, and included such harmless titles as A Day at the Races, Ruthless People and The Man Who Knew Too Much. The list of rentals was originally printed by Washington D.C.'s City Paper.[5]

Re:

[Shakrai (717556)]

I'm more surprised at this LAW that I never knew existed preventing a movie rental place from sharing your rentals without consent.

The Video Privacy Protection Act [wikipedia.org] was passed after the contentious nomination hearings for Robert Bork [wikipedia.org] to the US Supreme Court. During the hearings somebody leaked his video rental history to the press. Shortly afterwards Congress passed the law.

For once, a law I applaud, I only wish (at least in the US) that they would take this law and expand on it. Make it illegal for ANY commercial (and possibly most govt.) entities from sharing your personal information without express consent

Call me a cynic, but the only reason it passed was because somebody disclosed the rental history of a prominent person. We won't see similar legislation in other areas unless there is a negative impact on someone fairly high up the "food chain". One can on

Re:

[CastrTroy (595695)]

I didn't say anything about blockbuster's business practices, just their business model. I don't rent from them personally, I use a smaller local place to rent movies from.

Re:is this

[onemorechip (816444)]

I don't have a problem with Company X choosing not to produce Movie Y because they don't see commercial potential. Studios have to make those decisions all the time (and bad business decisions are inevitable). After all, they have to put up a lot of resources to get a movie made. But if Movie Y does get made, and Company Z, that is in the mainstream movie rental business, refuses to make that movie available to its customers, only to appease some rabid bunch of loonies, then I have a problem with Company Z. I can also understand it if Movie Y is in some niche market that Company Z doesn't play in. It's the caving in to special interest threats like these that I don't like (this holds, whether or not I had any interest in seeing Movie Y).

Re:

[onemorechip (816444)]

These two cases aren't the same. One case is self-censorship. I'm not even sure that such a broad use of the term "censorship" is a good thing. Maybe "self-representation" is more accurate. I fully support anyone's right to publish or not publish submitted materials, as they see fit. Call it an agenda if you like, but it doesn't matter: it's a basic freedom. The other case is caving to blackmail. It only opens the door to further blackmail and reduction of freedom.

Re:

[sqlrob (173498)]

Hollywood Video has been dropping like flies here, so it's possible. They were founded the same year

Re:1988?

[spiritraveller (641174)]

What exactly has changed since 1988 that should make this law different?

If the law says that this information must be kept private, the internet and computers don't make it any less private.

Rather, the newfound popularity of the internet and computers should make privacy even more important, because once information is released, it spreads far more quickly and easily.

Less ironic than you think.

[by Anonymous Coward]

> People complain that the US's laws aren't keeping up with technology. And yet in this case, a law from 1988 is being applied today. Does anybody else smell the irony?

The only reason the VPPA [wikipedia.org] exists is because the video records of Supreme Court nominee Robert Bork [wikipedia.org] were leaked. To this day, the act of invading the privacy of a politician for political advantage is called "borking".

Bork's video rentals were unremarkable, so there were no skeletons in Bork's closet. But from that day on, every Senator and Congressman knew that their video rental histories were also subject to exposure to news agencies, and Washington acted to protect itself. If you've got something to hide, you've got plenty to fear, and Washington was evidently so terrified that they made the VPPA apply to regular citizens, not just politicians.

The only way we're going to get a pro-privacy law out of the government is for some enterprising hacker to leak the clickstream of everyone in the government about 20 years from now. Today, that won't work -- because 99% of government officials don't even use the "series of tubes", let alone depend on it for their gay hookers and pr0n. 20 years from now, that will have changed, and a similar Bork-style scandal will erupt. Just imagine the kinds of privacy laws we'd have if someone like Sen. Larry "I'm Not Gay" Craig (R-estroom) had been bound for higher office, NSA leaked their logs of his Intertube traffic.

We know when you've been sleeping,
We know when you're awake,
We know if you've been bad or good,
So be good for goodness' sake!
Oh, you better not surf!
And zip up your fly!
Stop tappin' your toes and trollin' for guys,
Election season's comin' to town!

Re:

[hyades1 (1149581)]

R-estroom...DAMN I wish I'd thought of that.

Like Bill Mahr's version of that old board game, Clue: "A Republican, in the Men's Room, with his Cock".

Re:

[eples (239989)]

What irony? Dude, there were supreme court cases decided in the 1880's that still apply to software today. The Lotus 1-2-3 vs. Excel lawsuit from a couple decades ago, for one classic example. I don't know why anyone would find this ironic at all. It's not even a new phenomenon.

Re:

[Myopic (18616)]

If anything more, we are valuing privacy more than we did in 1988.

Yeah, I wish.