The 1988 Video Privacy Protection Act requires movie rental companies to get customers' written consent before disclosing information about the videos they have rented. The law also requires companies to shed users' video rental records within a year of the time the provider no longer needs the data.
Congress passed the VPPA after a newspaper obtained the video rental records of Robert Bork, who had been nominated (unsuccessfully) to serve on the U.S. Supreme Court. The statute provides for $2,500 in damages per violation.
Netflix says that the VPPA is "ambiguous" about how users can give permission for information on video viewing to be shared. The company also says it backs a proposed bill, HR2471, that would offer clarification.
That measure, introduced by Rep. Robert Goodlatte (R-Va.), would allow consumers to consent online to disclosure of their video rentals. It also would allow people to consent on an ongoing basis. The current statute requires consumers' to give written consent "at the time the disclosure is sought."
Both Facebook and Netflix have previously been sued for allegedly violating the VPPA. In Facebook's case, the lawsuit stemmed from the 2007 Beacon program, which told users about their friends' activity on outside sites, including Blockbuster.com. That case was resolved with a settlement agreement, but a Facebook user (who also is a privacy attorney) objected and the 9th Circuit is currently considering whether the agreement should go through.
Netflix also faces class-action litigation for retaining data about users' movie rental history and recommendations. That matter is ongoing.
Given that both Netflix and Facebook have been sued for violating users' privacy, it makes sense that the companies would tread carefully here.