Everyone's looking over your shoulder.

Photographer: Matthew Mirabelli/AFP/Getty Images

What You Watch on Your Phone Might Not Be Private

Noah Feldman is a Bloomberg View columnist. He is a professor of constitutional and international law at Harvard University and was a clerk to U.S. Supreme Court Justice David Souter. His books include “Cool War: The Future of Global Competition” and “Divided by God: America’s Church-State Problem -- and What We Should Do About It.”
Read More.
a | A

If you download a free app to your phone or tablet and watch videos without registering, can the service share your viewing preferences with a third party? The answer is now yes in the 11th Circuit, which covers Alabama, Florida and Georgia. The appeals court held last week that the Video Privacy Protection Act doesn’t cover viewers who aren't registered, because they aren't  “subscribers” under the meaning of the law. The decision is doubtful as a matter of logic, but it’s also now the law, so watch at your own risk.

The video privacy law has a quirky history. It was enacted in 1988 after a reporter for the Washington City Paper asked the assistant manager at his video store to give him the rental history of U.S. Supreme Court nominee Robert Bork, and then published it. Congress was so horrified at this invasion of privacy -- or so worried about what members' rental records would show -- that it passed a law prohibiting video providers from passing on “personal identifiable information” about consumers.

The law defined “consumer” to include “any renter, purchaser, or subscriber of goods or services.” It didn’t define subscriber. Even though Congress has updated the law, it hasn’t bothered to define “subscriber” for the contemporary gray area of online video accessibility.

The case before the 11th Circuit, Ellis v. The Cartoon Network, resulted from a suit by a man who objected to the way the network deals with information provided by your mobile device when you download CN’s free application and watch the cartoons provided there without charge or a registration requirement.

What CN does is fairly basic and unsurprising to any user of online services. It takes the registration number of your device -- in Ellis’s case, his Android ID -- and passes it on to a third-party service called Bango. In turn, Bango coordinates that number with who you are and what you watch, and makes use of the information across platforms and devices, presumably reselling it to make a profit.

We who use the contemporary Internet know there’s no such thing as a free lunch. If you’re getting something for no money and not seeing any ads, you’re usually providing your information, which is itself a valuable commodity.

It seems logical that under these ubiquitous conditions, you should count as a subscriber when you download an app and watch.

Yet the 11th Circuit thought otherwise. It reasoned that although a subscriber need not be paid, subscription nevertheless must involve “some type of commitment, relationship, or association.” Downloading a free app, the court said, didn’t create that kind of relationship.

The court emphasized that Ellis hadn’t created a login. It didn’t expressly say that if he had, then he would’ve been a subscriber. The implication, however, was there.

The distinction between downloading an app and creating a specific login seems overstated -- as does the refusal to consider watching free videos a kind of subscription for privacy purposes. After all, paying would certainly have created a subscription -- and Ellis was compensating the network in the form of his own information.

Indeed, the fact that CN had his Android ID and was passing it along strongly suggests that he was a subscriber with a relationship to the company. A login wouldn’t have told CN any more than it could find out from his Android ID.

Because the court said there was no subscription relationship, it concluded that there was no reason the network couldn’t pass along Ellis’s ID. As a result, the court didn’t have to address the legally separate question of whether an Android ID would count as “personally identifiable information.”

The district court that considered the case below held that Ellis was a subscriber, but that his Android ID wasn’t personally identifiable information. This result was a bit better, but also wrong for roughly the same reason that the appeals court was wrong: Your Android ID is personally identifiable, at least in the hands of an analytics company like Bango.

The 11th Circuit in an attempt to be cartoon-cute said Bango is “smarter than your average bear,” which is why it can identify you from your Android ID and your video usage. But big-data statistical analysis is as much about gathering “identifiable” raw data as it is about running well-constructed algorithms on the data collected.

The right result, then, would’ve been for the court to say that video privacy applies when you download an app. And it should apply across the range of free video services -- for the same reason Congress wanted to apply it to people like Robert Bork. What you watch should be no less private if you watch it on the Internet than it should be if you rented it at a video store. The 11th Circuit’s judgment makes us all a little more susceptible to violations of our privacy. Somewhere, Robert Bork is sadly shaking his head.

This column does not necessarily reflect the opinion of the editorial board or Bloomberg LP and its owners.

To contact the author of this story:
Noah Feldman at nfeldman7@bloomberg.net

To contact the editor responsible for this story:
Stacey Shick at sshick@bloomberg.net