Calif. Plaintiffs Sue Univision for Sharing Viewing Data With Analytics Firm

Univision “secretly discloses” the titles and URLs of videos subscribers view on the Univision Now video streaming platform, in violation of the Video Privacy Protection Act, alleged a class action Tuesday (docket 5:24-cv-01517) in U.S. District Court for Northern California in San Jose.

Dinorath Villalobos, a San Jose resident, has subscribed to Univision Now for four years, and Ezequiel Palomino, of San Bernardino, California, has subscribed for about three years, said the complaint. Each pays $11.99 monthly for Spanish-language series and movies, it said. Because Univision owns and operates an online streaming service where subscribers can watch online video content, it's “essentially delivering or renting access" to its library of “audio visual materials,” qualifying it as a videotape service provider under the VPPA, it said.

When the plaintiffs watched videos through their Univision Now accounts, Univision disclosed their event data, “which recorded and disclosed the video’s URL and title” as well as their email addresses to Endeavor Streaming, an analytics company that helps digital marketers “uncover critical user behavior patterns,” said the complaint. Univision embeds the code on each page where it provides video content; the code tracks a user’s personally identifiable information (PII) and the name of the video, said the complaint. Univision generates an identification token for its users and shares them with Endeavor Streaming in Base64 computer language that transfers the data by compressing it into a “simple, long string of plain text,” it said.

By publishing the identification token in Base64 instead of encrypting the PII, Univision makes subscribers’ email addresses “readily translatable into English,” said the complaint. “Any ordinary person can cut and paste Base64 text into any one of a myriad Base64 decoding websites and figure out what the Base64 text means,” it said. When Univision shares plaintiffs’ email addresses with Endeavor Streaming in Base64, the email addresses are PII "because the email addresses are easily translated into English and can then be used to identify a subscriber,” it said.

Any ordinary person can also input Base64 text into generative AI chatbots like ChatGPT, which can “instantly recognize” Base64 text, the complaint said. “ChatGPT can then translate the text for the person,” it said.

When each plaintiff watched videos on Univision Now, Univision disclosed their event data, “which recorded and disclosed the video’s URL and title as well as Plaintiff’s email address to Endeavor Streaming in Base64,” alleged the complaint. By disclosing the event data and identifiers, Univision disclosed plaintiffs’ PII to a third party, Endeavor Streaming, in violation of the VPPA, it said. Univision "knowingly disclosed" plaintiffs’ PII "because it used the data and installed Endeavor Streaming’s Neulion Tracking Code in the background of its webpages ... for targeted advertising and remarketing," it said.

Both plaintiffs discovered this month that Univision “surreptitiously collected and transmitted” their PII, the complaint said. In addition to VPPA violations, plaintiffs claim Univision violated the California civil code, which prohibits any person providing video recording sales or services from disclosing “any personal information or the contents of any record," it said. The plaintiffs seek statutory and punitive damages with prejudgment interest, plus injunctive relief and attorneys’ fees and court costs.