CNN is asking a federal judge to dismiss a lawsuit alleging that the company's iPhone app violates a federal privacy law by sending information about users' devices to the analytics company Bango.
The company argues in papers filed on Friday that any information transmitted to Bango is “anonymous” and doesn't personally identify users. CNN argues that the federal Video Privacy Protection Act -- a 1988 law that prohibits video rental companies from disclosing consumers' personally identifiable information -- doesn't apply when companies transmit device identifiers.
“The history of the VPPA and recent case law confirm that a random numerical string associated with an electronic device is outside the VPPA’s scope,” CNN argues. “No court has accepted the contention that a number that identifies a device (e.g., a computer, tablet, modem, set-top-box or phone) constitutes PII.”
The lawsuit, filed this February by Illinois resident Rick Perry, centers on allegations that CNN sends Bango information about the clips that iPhone users watch, along with their 12-digit Media Access Control addresses.
Last August, Apple restricted app developers from using MAC addresses as identifiers by showing developers the same number for all iOS 7 devices. This year, the company also took aim at tracking in retail locations. The newest operating system now prevents third parties from accessing the MAC addresses that phones broadcast when searching for a WiFi network.
Perry says in his lawsuit that he began using the CNN app in “early” 2013 — presumably before Apple cut off developers' access to the MAC address. He is seeking class-action status.
Nick Larry, a lawyer representing Perry, says that even if MAC addresses are no longer sent to Bango, iPhone users could be entitled to monetary damages based on prior transmissions. The video privacy law calls for damages of up to $2,500 per violation.
“There's still quite a bit at stake here,” says Larry, an associate at the Edelson law firm.
He adds that Apple could always change its policy to allow third parties access to the information. “We want CNN itself to be prohibited from doing this.”
CNN also argues in its papers that Perry isn't covered by the VPPA, which says it applies to renters, purchasers and subscribers. The news company argues that Perry doesn't fit into any of those categories. “He did not register or sign-up with CNN. Nor does he allege that he provided personal information such as a name, email address or mailing address to CNN to use the App or watch videos,” the company argues. “Indeed, nowhere does plaintiff allege that CNN even knows his identity.”
A similar lawsuit against Dow Jones was dismissed in October. In that matter, U.S. District Court Judge Thomas Thrash, Jr. ruled that an Android ID isn't personally identifiable information. The consumer who sued, Mark Ellis, is appealing that ruling.