HBO Max Allegedly Sent Subscriber's Viewing Behavior to 3rd Parties

Wendy Aston-Martin, a Tennessee resident, created a subscription profile with HBO Max and streamed at least one prerecorded video on the streaming service, said the complaint. The plaintiff also has a Facebook account and remained logged in to the account while she streamed videos on HBO, it said. When Aston-Martin streamed a video from HBO Max, HBO transmitted to Meta -- via the Meta Pixel tracking tool installed on the HBO Max platform -- her Facebook User ID and the title of the video she watched, the complaint said. Because the plaintiff's Facebook User ID is unique to her, it identifies her personally, the complaint alleged.

HBO uses the individualized data of HBO Max users to target them with content the streaming service knows they will like. In addition, it uses the data to target similar non-users with the same content, “to draw them to HBO's offerings,” the complaint said. To provide that data, HBO “made the business decision to share its users' personal information with third-party companies, including a user's identity and the specific videos they watched on HBO Max,” it said. But HBO “never asked for its users' informed written consent to share their specific video watching histories with third parties,” it alleged.

HBO’s data-sharing practices violate the VPPA, which prohibits the company, as a “video tape service provider,” from knowingly disclosing to any person, personally identifiable information (PII) without that person's informed written consent, alleged the complaint. HBO violated the statute when it disclosed Aston-Martin’s identity and HBO video watching history without her consent, it said.

Meta’s value proposition to advertisers is that it can “accurately target consumers by building an ‘audience’ of Facebook users who actually engage with the product or service being advertised,” said the complaint, referencing the approach as "surveillance advertising.”

As part of that approach, Meta offers companies like HBO audiences that are divided into core, custom and lookalike segments, said the complaint. A core audience of Facebook users is targeted based on location, demographics, interests and behavior. A custom audience of Facebook users has “already shown interest in [the Facebook customer’s] business"; the users are retargeted with ads for a product or service they viewed “until they make a purchase,” it said. A lookalike audience of Facebook users share demographics, and in the case of a video streaming platform, “can be targeted with the types of content users like them watch on the platform,” it said. The Meta Pixel tracks the audience data from its customers’ users, such as Aston-Martin, and transmits it to Meta, along with other tracking information, it said.

Aston-Martin is a "consumer" covered by the VPPA because she created an HBO Max subscription profile and used it to access the HBO video library, it said. The information HBO transmitted about Aston-Martin, including but not limited to her Facebook User ID, is PII under the VPPA because it allowed the third-party recipients of that information to identify her personally “as having watched specific videos,” it said.

The plaintiff makes a demand for arbitration, seeking relief for HBO's privacy violations, in accordance with the terms she was required to accept as a condition of using HBO Max, the complaint said. The terms of use she agreed to linked to the HBO Max privacy policy, which lists different legal obligations related to how HBO collects information from its users, “but HBO does not have a separate and distinct consent form explaining that it will share with third parties a user's identity and the specific videos that a user watched,” it said.