Last week, the Senate quietly agreed to allow video streaming companies such as Netflix to share data on of their customers’ streaming histories for up to two years — after only asking their permission once. The Video Privacy Protection Act (VPPA), had previously mandated that consent be obtained from an individual each time their video-watching history was shared. It also requires law enforcement to obtain a warrant, court order, or grand jury subpoena to acquire that history, and prevents companies from sharing it for marketing purposes — provisions which all appear to remain in place.
The new bill has already been adopted by the House, and is now on its way to President Obama’s desk. Adam Serwer at Mother Jones has the latest:
Last Tuesday, the Senate quietly altered a key privacy law, making it much easier for video streaming services like Netflix to share your viewing habits. How quietly? The Senate didn’t even hold a recorded vote: The bill was approved by unanimous consent. (Joe Mullin of Ars Technica was among the first to note the vote.) [...] Video streaming companies that want to share your data now only need to ask for your permission once. After that, they can broadcast your video-watching habits far and wide for up to two years before having to ask again.
VPPA was originally passed in 1988 following outrage at the publication of Supreme Court nominee Robert Bork’s video rental history by a Washington newspaper. (An irony, as Serwer notes, given Bork’s own hostility to privacy rights.) The law caused headaches for Netflix’s attempt to integrate their services with Facebook, an arrangement the company has brought to over 40 countries but has yet to debut in the United States. Netflix recently challenged the application of the law to online streaming video, but was rebuffed by a federal district court.
Both Facebook and Netflix lobbied enthusiastically in the second half of 2012 for the changes to the VPPA, spending $1.6 million dollars and $400,000, respectively. Those efforts paid off with last week’s alteration.
The change was originally intended as a trade-off: Sen. Patrick Leahy (D-VT) inserted language that would’ve strengthened privacy protections for email and other personal online documents under the Electronic Communications Privacy Act (EPCA), even as it declawed the VPPA. But then the House passed a version of the VPPA update without the balancing update to the EPCA. That forced a negotiation, and the Senate eventually gave in to the House’s version.
Leahy has called for the Congress to take up the issue of strengthening EPCA’s online protections again next year. But as Serwer dryly points out, “not even the CIA director losing his job in the wake of an FBI investigation that led to no actual charges could provoke Congress into updating the country’s digital privacy laws. So Leahy’s calls for reform appear likely to go unanswered.”
Wording in the first paragraph has been altered for clarity. As far as ThinkProgress is aware, the provision concerning consent to share data is the only aspect of VPPA that has been altered of those listed.