• by Wendy Davis  @wendyndavis, November 9, 2022

A Kansas resident can proceed with a lawsuit accusing online health publisher WebMD of disclosing visitors' video-viewing information to Facebook, a federal judge has ruled.

The decision, issued by U.S. District Court Judge Thomas Thrash, Jr., in Atlanta, came in a class-action complaint filed in February by Debra Lebakken, who alleged that WebMD ran afoul of the federal Video Privacy Protection Act -- a 34-year-old law that prohibits video companies from sharing personally identifiable information about subscribers, renters, or purchasers of videos.

Lebakken, who said she “subscribed” to WebMD by signing up for its free e-newsletter, alleged that the online publisher automatically transfers identifiable information about its visitors and the videos they view to Facebook -- providing the visitors have Facebook accounts and are logged in to them when they visit WebMD, or were logged in within 90 days of visiting WebMD.

The data -- which is transferred via cookies and other tracking technology, includes visitors' Facebook IDs and email addresses, according to the complaint.

WebMD unsuccessfully urged Thrash to throw out the lawsuit at an early stage, arguing that a federal appeals court previously ruled in a separate video privacy lawsuit that people who download a free mobile app aren't “subscribers.”

Thrash rejected that argument, writing that Lebakken's didn't merely allege she downloaded a free app.

“She alleges that she exchanged her email address to receive the WebMD e-newsletter and that she also created her own WebMD account,” Thrash wrote in a ruling issued late last week.

WebMD also contended the allegations, even if true, wouldn't prove that it disclosed personally identifiable information.

Thrash rejected that argument as well -- though suggested he might revisit the issue if it turns out that Lebakken hadn't logged into her Facebook account within 90 days of visiting WebMD.

“Lebakken adequately alleged that WebMD disclosed her Facebook ID and email address in connection with her video viewing information to Facebook and that the disclosure of such information constituted a disclosure of [personally identifiable information],” he wrote. “Whether Lebakken had recently logged into her Facebook account, such that transmission of her Facebook ID upon viewing WebMD videos would be possible, is a question of fact appropriate for resolution at a later stage in this litigation.”

The lawsuit against WebMD is one of several recent cases alleging that publishers violate the federal video privacy law by sending data about people who view online videos to Facebook. Other companies facing these claims include the National Basketball Association and Paramount.