• by Wendy Davis  @wendyndavis, October 16, 2014

The Cartoon Network doesn't violate Android users' privacy rights by transmitting the names of videos they view to the analytics company Bango, a federal judge has ruled.

The decision, issued last week by U.S. District Court Judge Thomas Thrash, Jr., dismissed a potential class-action lawsuit by Android user Mark Ellis, who alleged that the Cartoon Network violated the federal Video Privacy Protection Act.

That law, which dates to 1988, prohibits video rental companies from disclosing users' “personally identifiable information” without their permission.

Ellis alleged that Cartoon Network's Android app transmitted his Android ID, combined with the titles of the videos he watched, to Bango. He said that Bango was able to mesh this data with other information, and “attribute their private viewing habits to their existing digital dossier.”

“Bango not only knows each class member’s location, demographics, email and phone number; it also knows everything they watched in the CN App,” he alleged.

But Thrash dismissed the case, ruling that Android IDs aren't personally identifiable information. “The Android ID is a randomly generated number that is unique to each user and device,” Thrash wrote. “It is not, however, akin to a name. Without more, an Android ID does not identify a specific person.”

Attorney Jay Edelson, who brought the lawsuit on behalf of Ellis, says he will appeal. “We don't believe the ruling takes into account the realities of the technologies at issue or how data analytics companies process and understand data,” Edelson says in an email to Online Media Daily. “We are hopeful that the appellate court is more receptive to our position.”

Ellis unsuccessfully argued to Thrash that a device identifier should be viewed as comparable to a home address -- which tends to be stable for long periods, even though it can change over time. “Android IDs are static and for that very reason are used by entities like Bango to identify specific individuals at specific times across multiple services,” Ellis argued in papers filed in July.

But Thrash said in his ruling that Bango would have had to “take extra steps” -- and draw on information from outside sources -- in order to link an Android ID to a user's identity. “From the information disclosed by the defendant alone, Bango could not identify the plaintiff or any other members of the putative class,” he wrote.

U.S. District Court Judge Laurel Beeler in California recently confronted similar questions about “personally identifiable information” in a video-privacy lawsuit against Hulu. That company allegedly transmitted certain information about users and the videos they viewed to Facebook and comScore.

In April, Beeler dismissed allegations that Hulu violated the video-privacy law by transmitting a seven-digit “User ID” to comScore. She said in the ruling that the Hulu users hadn't shown that comScore connected any information between people's names and their User IDs.

But Beeler also decided that the consumer could proceed with allegations that Hulu wrongly transmitted cookies to Facebook that contained a Facebook ID -- which revealed users' screen names. Beeler said Hulu potentially was liable for those transmissions, depending on whether it knew what data it was sending to Facebook. The lawsuit against Hulu is still pending.