NBC, Peacock SDKs Let 3rd Parties Secretly Collect Users' Viewing History: Class Action

Software development kits (SDKs) in NBC apps allow app and website developers to “surreptitiously collect and transmit data to third parties,” said a privacy class action (docket 1:23-cv-09433) Thursday in U.S. District Court for Southern New York in Manhattan.

The NBC apps “surreptitiously collected and transmitted” subscribers’ video viewing history, including titles and identifiers of specific videos watched, and personally identifiable information (PII), said the complaint. Defendants collected and disclosed subscribers’ Adobe ID, Apple’s identifiers for advertisers and vendors, Android’s advertiser identifier, New Relic ID, GPS location and email addresses, said the complaint.

Information provided by defendants NBCUniversal and Peacock TV gave third parties information “sufficient to identify the specific individuals who watched the videos,” the complaint said. NBC’s Peacock TV app discloses a subscriber’s Adobe ID and user account identifiers, along with their Android and Apple iOS advertising identifiers, to Adobe, with video IDs and video titles, it said. Adobe and mParticle maintain individual profiles on users, which they can use to match information transmitted by the NBC apps to a specific individual using the PII “to identify specific users,” it said.

NBC “knows that Adobe and mParticle maintain profiles” of individuals and that the individuals can be identified using the information disclosed, “revealing their video watching history” in violation of the Video Privacy Protection Act (VPPA), the complaint said. The VPPA and New York Video Consumer Privacy Act (NY VCPA) prohibit videotape service providers such as NBC from knowingly disclosing consumers’ PII, “including ‘information which identifies a person as having requested or obtained specific video materials or services from a video tape provider,’ without the person having expressly given consent in a standalone consent form,” the complaint said. NBC didn’t request or obtain consent to disclose plaintiffs’ and class members’ video viewing history or PII in compliance with the VPPA or the NY VCPA, alleged the complaint.

Plaintiff Amma Afriyie of Hamilton, Ohio, subscribed to NBC’s Peacock TV and CNBC apps on her iOS mobile device in 2021, said the complaint. She pays an annual subscription for Peacock, and NBC collected her name, email address, payment information and date of birth in connection with her use of the app. She also subscribed to the CNBC app in 2021, and NBC collected her name and email address in connection with that app, it said. The defendant disclosed the title or video IDs of prerecorded videos she viewed, plus her PII, to third parties through the SDKs it incorporated in the apps, without her knowledge or consent, the complaint said.

Plaintiff Roy Campbell of Glens Falls, New York, subscribed to the Peacock app in 2022 and gave his name and email address in connection with his monthly subscription for use of the app on his iPhone, said the complaint. He viewed video content exclusive to Peacock app subscribers on his phone. Defendants disclosed his video-viewing history to third parties through the SDKs it incorporated in the apps, or by other means, without consent, it said.

The PII NBC discloses to Adobe “is sufficient for Adobe to link the subscriber’s video history to individual subscribers,” said the complaint. Adobe is able to identify subscribers through its Experience Cloud platform, which contains profiles of individual consumers without their knowledge, it said. Adobe’s platform gives businesses and brands “an open and extensible system for customer experience management that transforms customer data into robust customer profiles that update in real time,” said the complaint. The platform uses AI-driven insights “to enable the delivery of personalized digital experiences across various channels in milliseconds,” it said.

Adobe’s cloud platform maintains unique customer profiles for individuals, and its website touts that its real-time customer data platform “makes data across the organization available and actionable to marketers.” Adobe customers can “securely collect, manage, resolve, and organize customer data from any source -- including personally identifiable information -- into unified profiles with real-time insights that can be used for personalization and segmentation, and activated across channels, at scale,” the company states. Customer profiles link “multiple records to create ‘unified person profiles’ featuring ‘linked identities, along with all your customer’s real-time consumer, professional, or combined attributes or behavioral data across channels and all lines of business,’” Adobe says.

Adobe’s Experience Cloud ID (ECID) allows the analytics company to “identify app users even if they have turned off collection of advertising identifiers on their mobile devices, which is offered by both Android and iOS devices,” said the complaint. In 2021, Apple made ad tracking “opt-in,” meaning that users have to “affirmatively enable such tracking” to allow advertisers to track Apple’s identifier for advertisers. Five months after iOS version 14.5 was released, only 21% of people had opted in to ad tracking, said the complaint. The advent of opt-in tracking by Apple “has led to efforts by third parties to circumvent privacy controls by tracking using third party identifiers such as the ECID,” it said.

Plaintiffs allege that without subscribers’ knowledge, Adobe assigns an “ECID persistent identifier to subscribers” when NBC and Peacock “surreptitiously transmit subscribers’ video viewing history and PII.” Using the PII provided to it, Adobe “was able to identify Plaintiffs and Class members and attribute their video viewing history to an individualized profile in its databases,” the complaint said.

NBC subscribers’ video history and PII are also disclosed to third-party data company mParticle, which can also identify subscribers with their viewing history, the complaint said. MParticle’s IDSync “allows marketers to accurately identify customers in key moments of their journey in order to support robust targeting and personalization, and to deliver consistent user experiences across all devices” and touchpoints, said the complaint, citing the mParticle website.

The personal information NBC obtained from the plaintiffs is valuable, said the complaint. Because it places ads alongside its prerecorded video content and embeds commercials within its video content, NBC is “incentivized to enhance the ‘targeting’” of ads, allowing companies that pay NBC to advertise to “reach their ‘ideal’ audience,” the complaint said. NBC benefits at the expense of subscribers who “never consented to NBC’s disclosure of their PII,” it said.

In addition to VPPA and NY VCPA violations, plaintiffs claim violation of New York’s Uniform Deceptive Trade Practices Act and unjust enrichment. They seek injunctive relief, including “reformation of practices and an accounting and purging of wrongfully obtained personal information”; actual, general, special, incidental, statutory, treble, punitive, liquidated and consequential damages; disgorgement of monies obtained as a result of wrongful conduct; pre- and post-judgment interest; and attorneys’ fees and legal costs.