Dodging the Thought Police: Privacy of Online Video and Other Content Under the "Bork Bill"
There's a gut feeling that people ought to be able to read books and watch films without the whole world knowing. Books and films are the intellectual vitamins that fuel the growth of individual thought. The whole process of intellectual growth is one of privacy—of quiet, and reflection. This intimate process should be protected from the disruptive intrusion of a roving public eye. What we're trying to protect with this legislation are usage records of content-based materials—books, records, videos, and the like. . . . [T]here is an element of common decency in this legislation. It is really nobody else's business what people read, watch, or listen to.
But books, records, and other materials were subsequently removed from the scope of this bill.{{1}} The final version was adopted to regulate only the “rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials” (emphasis added). Given its history, the legislation was dubbed the “Bork Bill.” This comment argues that recent technological developments warrant an extension of the Bork Bill to protect records of online content consumption. The early view of the Internet as a space where “nobody knows you're a dog” enabled people to freely browse online content, resulting in more “creativity and innovation.” Professor Eben Moglen has likened this anonymous space to cities as the historic destination for individuals who wanted to “escape the surveillance of the village” and “experiment autonomously in ways of living.” But as online exploration of content is increasingly being logged and those logs are being exposed, the Internet as a source of intellectual vitamins is under threat. More than ever, we now need to prevent the logging of media consumption that is not necessary for making the media available. This applies not only to media that existed in 1988 when the Bork Bill was adopted, such as books and music records, but to any material used for intellectual pursuit of knowledge, including blogs, tweets, podcasts, and other new sources of information. It is further critical that records of our intellectual curiosity not be shared with others without our permission to disclose that particular material. I. The “Bork Bill” in the Information Age The Bork tape reporter claimed to have been motivated by Bork’s own assertion that “Americans enjoy only those privacy protections conferred by legislation.” Acting on similar concerns, Congress enacted the Bork Bill to protect the privacy of video cassette rental records. As discussed below, today this statute likely applies to online video services even though they do not distribute “video cassette tapes.” It does not, however, cover the sharing of user information strictly for marketing purposes. A pending amendment, supported by Netflix, seeks to make the statute even more marketing-friendly by permitting “frictionless sharing.” However, as I will argue, frictionless sharing does not provide users with helpful information, but rather deters them from freely consuming content. A. Which Video Services Are Covered? The Bork Bill requires that a user consent to have her “video tape service provider” disclose “information which identifies [her] as having requested or obtained specific video materials or services from [the] provider.” A problem with legislation that refers to specific technology—like videotapes—is that it can rapidly become outdated. So far, no court has decided whether this law applies to online video. But some commentators have argued that because online video businesses did not exist when the Bork Bill was adopted, it literally only applies to videotapes.{{2}} Yet, the language of the law suggests that it nonetheless anticipated the development of new technologies.{{3}} It defines a “video tape service provider” as someone engaged in the “rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials.” Given that the downloading or streaming of videos serves the same basic function as the sale or rental of videotapes—namely, transmitting video content to users—it would seem to qualify as “delivery of . . . similar audio visual materials.” Online video content is of course just “bits of information” that are stored on a company’s hard drive and streamed or downloaded to a user’s computer. Thus, online video providers engage in the delivery of seemingly covered materials. This interpretation is further supported by the bill’s legislative history, which shows that although the legislators could not foresee the future online distribution of video, they intended this law to cover “any distribution, be that retail, store-front, [or] mail order.” Online video providers take different positions on this issue. Netflix recently settled a class action suit over an alleged violation of the Bork Bill, wherein it claimed to have complied with what it recognized as “its duties” under this law. Netflix has also supported an amendment to the Bork Bill that would allow it to seek electronic consent to share customers’ rental histories. This suggests that Netflix’s attorneys fear the statute otherwise applies to its online services. Hulu, on the other hand, has claimed that the law does not apply to online video at all in response to allegations that Hulu violated the Bork Bill by sharing customer data with Facebook and market research and analytics companies. "Had Congress intended to regulate businesses that dealt in digital content,” Hulu reportedly argued, “it would have defined video tape service provider to include businesses that traffic in audio-visual information or data." But on August 10, 2012, the Court for the Northern District of California rejected Hulu’s argument and held that the Bork Bill indeed applies to online video. It stated that this law was intended to “protect[] the confidentiality of private information about viewing preferences regardless of the business model or media format involved.” As such, this law would likely also apply to user-generated video content in YouTube and Vimeo because these sites also hold records about users’ “viewing preferences.” B. Contemporaneous Consent versus Frictionless Sharing Provided that the Bork Bill applies to online video, a provider must first get permission from a user before sharing personal information about that user with another person. That permission must be: (1) “informed”; (2) “written”; and (3) “given at the time the disclosure is sought.” As video content was not being sold online when this bill was passed, it is unclear whether electronic consent provided over the Internet is sufficient to allow disclosure of this information. Services like Google Play, Hulu, and YouTube seem to be relying on the sufficiency of electronic consent when they share video material that their users watched with their acquaintances in social networks. But Netflix—previously slammed with class action lawsuits and a Federal Trade Commission investigation with respect to other provisions of this law—is not willing to take this risk. Instead, Netflix supports an amendment to the Bork Bill clarifying that written consent can be obtained “through an electronic means using the Internet.” At the same time, this “Netflix amendment” leaves intact the archaic definition of “video tape service provider” and does not clarify whether the Bork Bill applies to online video services. More controversially, the proposed amendment would also allow sites like Netflix to get blanket consent from users to automatically share all videos they subsequently watch with their social network connections, through a process called “frictionless sharing.” It would thus eliminate the requirement that permission be “given at the time the disclosure is sought,” which was intended to shield customers from inadvertently disclosing all their rental records due to a hidden clause in the rental agreement. In an attempt to preserve this protection, the Netflix amendment was revised to require that the consent be “in a form distinct and separate from any form setting forth other legal or financial obligations.” But even if the blanket consent is provided in a separate form, a user may still not anticipate all videos she may watch on a site in the future. A user could unwittingly click on a link and automatically broadcast the fact that she watched some embarrassing video to all her friends, family, and colleagues on Facebook, Google+, or Twitter.{{4}} In that situation, it could also be argued that the user did not actually provide “informed” consent—a requirement of the Bork Bill that the Netflix amendment does not touch. But shared videos can also serve as helpful suggestions—so long as users are in control over what they share. Netflix has argued that frictionless sharing over “social media offers a powerful new way for consumers to enjoy and discover movies and TV shows they will love.” Indeed, while the Netflix amendment has brought sharing of viewing records into the limelight, Internet users have been sharing links to videos and other content for some time. Facebook was by no means first to encourage this activity when it expanded its “like” button to other sites in 2010. At that point, social news websites like Digg and Reddit had already been offering similar services for half a decade. What is new about Facebook’s frictionless sharing—albeit not unique—is users’ lack of intent to share. Users now merely enable an application once to read an article or watch a video clip and the application thereafter automatically reports everything they watch or read to their Facebook friends. Commentators have therefore argued that frictionless sharing is actually antisocial because it essentially spams users with useless information about everything their friends do, without any indication of whether they enjoyed it.{{5}} When the feature was first introduced, it was even found to promote dated articles with weird headlines rather than more current content. On the other hand, “viral” content on social networks generally appears to be of questionable quality even when users share material by choice. Worse still, frictionless sharing also deters “intellectual exploration.”{{6}} With frictionless sharing, a user’s friends, family, and colleagues are with her when she wants to watch a particular movie clip in the privacy of her home to avoid peer pressure. As Professor Neil Richards pointed out, this “means we’ll always watch the movie [our friends] choose, and we won’t choose the movie we want to see if they’d make fun of us for it.” Frictionless sharing thus enlists our friends as an Orwellian “Thought Police”—deterring our exploration of unpopular ideas. Supporters of frictionless sharing, however, claim that it helps users learn about new media and bond with their friends over common interests. They claim that the Bork Bill is outdated and “places a drag on social video innovation that is not present in any other medium.” But, as argued above, frictionless sharing does not yield helpful recommendations to friends and merely creates a landscape where users cannot pursue their curiosity for fear of being watched. Therefore, there is good reason for preserving the contemporaneous consent requirement in the Bork Bill.{{7}} Without frictionless sharing, users can still share what they enjoy (by actively sharing a particular story on a social network) and need not turn into involuntary advertisers of online content. In fact, as discussed in the next section, the Bork Bill already contains one significant marketing exception that benefits advertising. C. Information Disclosed for Advertising Purposes The Bork Bill specifically allows providers to disclose a user’s contact information and the “subject matter” of what she watched “to any person” if the purpose is to advertise products to the user and she has a clear opportunity to opt out. Yet, the providers may not disclose the “title” or “description” of any video viewed. This advertising provision was the result of strong lobbying by the Direct Marketing Association, which argued that “[v]ideo tapes are emerging as a major element of the marketing business” and “the direct marketing industry itself is a major contributor to increased employment.” Today, online video providers like Hulu and Vimeo likely share users’ information with advertisers and other service providers.{{8}} YouTube and Google Play, on the other hand, do not appear to share this type of information as Google’s privacy policy only reserves the right to share “aggregated, non-personally identifiable information publicly and with [its] partners.” Indeed, as a big player on the online advertising market, Google has no reason to disclose its users’ personal information to advertisers when it can sell advertising space and match ads to user profiles internally. But personal information stored in company databases can be demanded by government agencies. And even non-personally identifiable information—which Google and other companies occasionally share with the public—can sometimes be aggregated to ultimately identify the individuals to whom it pertains.{{9}} That being the case, users should have the option to avoid the collection of data altogether. II. Better Protection for Our “Intellectual Vitamins” As the Supreme Court once eloquently articulated, the Internet provides users with “a vast library including millions of readily available and indexed publications and a sprawling mall offering goods and services.” On the flip side, it also has mechanisms for tailing a user around this virtual “mall” or “library” and observing her every selection. These can deter the user from pursuing her interests and curiosity in seeking to grasp our culture and may ultimately inhibit the intellectual growth of our society as a whole. The American Library Association, Electronic Frontier Foundation, American Civil Liberties Union, and other digital and civil rights organizations have therefore called for a “privacy revolution” in online and offline “access to information.” Likewise, Professor Richards has argued that our viewing and reading habits ought to be classified as “sensitive data” that requires particular notice and consent before it may be used and disclosed. This comment further argues that users’ consent should be required before that data is ever collected and stored beyond what is necessary to provide the service. A. No Superfluous Data Collection Without Consent The Bork Bill—which was adopted in the aftermath of the release of handwritten rental records—simply did not anticipate the online data aggregation we have experienced in the following decades. It was drafted long before the growth of e-commerce and the development of expansive databases with personal information. This information is now stored in the cloud, which often transcends both corporate and national borders. Further, while in 1987 Judge Bork could probably watch his local video store clerk scribble down the titles of the movies he was renting over the counter, today, information about users’ viewing and reading habits is collected without their knowledge. Their computers transfer this data directly to companies’ websites.{{10}} And companies can get a much fuller picture of users’ watching habits—including their favorite scenes—when they rewind a movie or watch it several times.{{11}} Companies can further process this data together with personal information from other sources to get a far more precise view of a user’s psyche. This information can then be sold to third parties for marketing purposes{{12}} or be exposed to security breaches and used in elaborate identity fraud schemes.{{13}} The records could also be subject to government surveillance with minimal privacy protections. Rather than conducting painstaking McCarthyist interrogations to determine a person’s ideological reading habits, the Government can now simply subpoena that kind of records from a company.{{14}} For all these reasons, regulators have begun to focus on data collection—and not only disclosure—as they design the next generation data protection laws.{{15}} To the extent that the Bork Bill aims to prevent our viewing records from providing a peek into our thinking process, the law also needs to protect against excessive collection of this type of data by making such collection more transparent. Companies should explain to users how they plan to use their information beyond simply providing the requested service and get users’ approval before they place their personal information in a database. And once personal information has served the purpose for which it was collected, companies should be required to delete it. Further, rather than encouraging long privacy policies in small font and pop-up consent windows—a practice that tends to overwhelm users—regulators should consider how web design can be used to make the notice and consent framework a more fruitful process. The crux of the Bork Bill is that it carves out an exception for the sharing of data for marketing purposes. But if the video providers’ data collection were restricted, there may be less data to share with advertisers—which contravenes the spirit of this marketing-friendly law. However, when the marketing industry secured its exception for advertising in the Bork Bill, its representatives had no idea of the gold mine they would discover when e-commerce would provide them with immensely detailed information of users’ viewing habits. To continue this metaphor, rather than purging the earth of valuable minerals, the marketers have been digging into users’ individuality without their knowledge or consent. As users are beginning to realize that their online behavior is being watched, they may avoid pursuing certain interests that they do not want to end up in a database.{{16}} So the balance struck between users’ privacy and marketers’ commercial interests when the Bork Bill was adopted has been destabilized by subsequent technological developments. It now needs to be readjusted to allow users to freely browse the Web. A new balance may, for example, be struck by regulations requiring users’ specific opt-in consent before particular information may be collected and selectively shared with advertisers, perhaps in exchange for discounts.{{17}} Of course, this could be addressed by new legislation rather than an amendment to the Bork Bill. But regardless of how the balance is regained, the need to share viewing data with advertisers cannot be the justification for secretly collecting superfluous data on users without their consent. Focusing on collection of data would take the Bork Bill discussion into the much-debated issue of tracking. Without engaging in that debate here, it is worth noting that the main argument for online tracking is that it pays for “free” online content. But much online video, reading, and audio content is offered to users for a fee. So by both selling content and using customers’ personal information, companies are getting to have their cake (or rather cookie) and eat it too. B. Protection of Other “Intellectual Vitamins”—Not Just Video Although the legislative history of the Bork Bill indicates that it was intended to protect “records of [all] content-based materials,” the final version of the bill only applied to videos and not books, magazines, and music. Recent developments in frictionless sharing of users’ consumption of them over social media call for more protection of a broader range of materials. As the Bork story shows, in 1987, leaked rental records could show the exact title of every video that a person watched. Those titles could be innocuous—like Bork’s—or, more controversially, porn.{{18}} The titles could also be generally harmless, but particularly embarrassing for the person renting. On the other hand, there were no comprehensive records of what articles a person read or what songs she listened to back in 1987. To be sure, there may have been records showing that a person subscribed to the Los Angeles Times or had purchased the Beatles’ White Album by mail order. But they would not show that the person only read the “Dating” pages of the paper or repeatedly listened to the Beatles’ “Why Don't We Do It in the Road?” every night. Not so anymore. Today, we regularly access our “intellectual vitamins” through various digital devices. We may download a song on our computer using iTunes to listen to it on our iPhone or stream it from Spotify or Last.fm. We may also read news articles through a New York Times app on our tablet or directly on our computer. These practices create a digital paper trail of our intellectual consumption. Facebook’s frictionless sharing brings an additional dimension to this issue as this paper trail is automatically shared with all our friends on Facebook when we use an app to access songs or articles. As illustrated above, users can inadvertently consent only once to access an article or a song and subsequently automatically share embarrassing materials. Indeed, many users have expressed frustration over the ease with which materials they read are shared on Facebook.{{19}} The Bork Bill currently prohibits this sort of automatic sharing of videos. And users’ experience with frictionless sharing of news and music illustrates why the Netflix amendment to eliminate the contemporaneous consent requirement is a bad idea. Indeed, it would seem wise to extend this requirement to the online sharing of “reading and listening habits.” The privacy of listening records does not appear to be as obvious as that of reading records. But though broadcasting a person’s listening records may seem rather harmless at first glance, music can often reveal a person’s political views or specific mood.{{20}} Extending the protection to listening records would also ensure equal protection for people with disabilities that need to access some information in audio format. Professor Susan Crawford has cautioned that the proposed Netflix amendment has opened the “Pandora’s Box of Privacy” such that “affirmative opt-ins required by [the Bork Bill may] someday be applied to absolutely everything we do on social networks and every possible device we use to connect to them.” This is an important concern and we should try to minimize regulation of Internet activity as much as possible. But limited regulation in this context is needed to protect Internet users’ ability to privately seek information and pursue unpopular interests. Librarians have long offered such protection by “treat[ing] as confidential any private information obtained through contact with library patrons.” The California Legislature has also recently introduced such protection, but only against government agency requests with respect to purchase and browsing records of books, including audio and e-books. The Bork Bill, however, should be extended to protect against disclosure of any reading and listening material, which would be consistent with its original purpose and compelled by recent technological developments. That extended scope would ensure that users can fully take advantage of the generous supply of information available online to freely explore their interests without the fear of being watched. * Special thanks to Professor Urs Gasser and Cindy Cohn for their insightful comments. [[1]] While the precise reason for the amendment of the bill is not apparent from its legislative history, according to the Electronic Privacy Information Center (the President of which drafted the original bill while working for Senator Patrick Leahy), “pressure from marketers and other groups” led to its amendment.[[1]] [[2]] Harold Abelson, Ken Ledeen, Harry R. Lewis, Blown to Bits: Your Life, Liberty, and Happiness After the Digital Explosion 65 (2008) (“The Video Privacy Act applies only to videotape rentals, but not to “On Demand” movie downloads”); see also Gabe Rottman, Who Watches the Watchers (As They Watch You, Watching Television)? Law Enforcement Access to Cable Records at the Dawn of IP-Based TV, 95 Geo. L. J. 1671, 1700 (2006)(arguing that “Congress [has] create[d] a system in which a record disclosing your affinity for the film Waterworld receives different privacy treatment depending on whether it is held by Blockbuster, iTunes, or AT&T”(internal footnotes omitted)).[[2]] [[3]]See Daniel Solove & Paul Schwartz, Information Privacy Law 794 (2008) (noting that the Bork Bill “should also cover online delivery of movies and other content”).[[3]] [[4]]By way of comparison, services like YouTube and Google Play instead allow their users to share content with their friends on a one-time basis. Hulu—while using frictionless sharing—disables it by default, requiring specific consent from users.[[4]] [[5]]See also Margot Kaminski, Reading Over Your Shoulder: Social Readers and Privacy Law, 2 Wake Forest L. Rev. Online 13 (2012); Molly Wood, How Facebook is ruining sharing, CNET News, Nov. 18, 2011; Marshall Kirkpatrick, Why Facebook's Seamless Sharing is Wrong, ReadWriteWeb, Nov. 19, 2011; but see Jon Constine, Facebook and the Age of Curation Through Unsharing, Techcrunch, Nov. 19, 2012 (arguing that frictionless sharing simply needs to be complimented by an “unshared button”).[[5]] [[6]]See also Julie Cohen, A Right to Read Anonymously: A Closer Look at “Copyright Management” in Cyberspace, 28 Conn. L. Rev. 981, 1010 (1996).[[6]] [[7]]Perhaps the Bork Bill could be amended to allow users to opt-in to frictionless sharing through separate settings for online applications that otherwise allow users to access the content without sharing it. The precise language of such an amendment is outside the scope of this comment. The point here is merely to show that the contemporaneous consent requirement need not be completely eliminated to accommodate the users who wish to frictionlessly share. But given that frictionless sharing appears to be unpopular with users, it is unclear why there should be any amendments to the law to allow it. As one Netflix user put it, “[h]ow about we have Congress deal with more important matters.”[[7]] [[8]]Hulu’s and Vimeo’s privacy policies do not explain how users can opt out of the sharing. But the privacy policy language does not necessarily mean that these companies do not comply with the Bork Bill. Their practices may still be in compliance provided that users have an opportunity to opt out to have their data disclosed for advertising purposes.[[8]] [[9]]However, Professor Jane Yakowitz has argued that there is only a slim risk that non-personally identifiable information can be pieced together to reveal people’s identities because the de-identification techniques are unreliable and expensive.[[9]] [[10]]Joel Brenner, America the Vulnerable: Inside the New Threat Matrix of Digital Espionage, Crime, and Warfare 15 (2011).[[10]] [[11]]Amazon Kindle, for example, tracks “most highlighted” sections in e-books.[[11]] [[12]]As discussed above, transferring limited data subject to certain conditions is permitted under the Bork Bill.[[12]] [[13]]See also Brenner, America the Vulnerable: Inside the New Threat Matrix of Digital Espionage, Crime, and Warfare, supra note 10, at 15 (“There are multiple copies of every record, stored in multiple places, in databases whose level of security is a mystery to most users, and sometimes even to company officials”).[[13]] [[14]]See, e.g., Michael Lesk, Reading Over Your Shoulder, 7 IEEE Security & Privacy 78, (2009).[[14]] [[15]]The U.S. government recently declared that companies should not collect or retain more personal information than what is necessary to perform their services. A similar aspiration can be found in the EU Data Protection Directive, which is in the process of being superseded by more stringent data collection regulations.[[15]] [[16]]See also Cohen, A Right to Read Anonymously: A Closer Look at “Copyright Management” in Cyberspace, supra note 6, at 1010 (“The right to read anonymously implicit in Lamont and Stanley is predicated on the likely chilling effect that exposure of a reader's tastes would have on expressive conduct, broadly understood — not only speech itself, but also the information-gathering activities that precede speech.”).[[16]] [[17]]But see Brenner, America the Vulnerable: Inside the New Threat Matrix of Digital Espionage, Crime, and Warfare, supra note 10, at 11 (criticizing how users had been giving up their privacy in exchange for discounts).[[17]] [[18]]It should of course be noted that as the Bork Bill was being debated, the Congressmen were careful to point out that “God forbid, none of [them were] supporting pornography.”[[18]] [[19]]Spotify users have also complained that: “Some of us only want to listen to music. Given Facebook's desire to make us share things by default, this is not a good idea.”[[19]] [[20]]Instances of state censorship of music prove this point. For example, the Soviet government sought to silence Vladimir Vysotsky’s music, just as it did with certain literary works.[[20]]