• by Wendy Davis , Staff Writer @wendyndavis, December 12, 2007

Even though Facebook has retreated from its controversial Beacon program, which broadcasts news about members' online purchases to their friends, the fallout from the program is only just beginning.

The latest allegation: Blockbuster's participation in the program violates a 19-year-old law that bans merchants from divulging information about users' video rentals without their written consent.

The Video Privacy Protection Act of 1988 specifically prohibits releasing rental records of "prerecorded video cassette tapes or similar audio visual material." People whose records are disclosed in violation of this law are entitled to a minimum of $2,500 in damages.

New York Law School professor James Grimmelmann blogged about the issue earlier this week. "Facebook and Blockbuster should hunker down and prepare for the lawsuits," he concluded.

Facebook and Blockbuster might not be alone here. Several weeks ago, it came to light that Netflix also published enough information about its users that researchers were able to identify some movie renters. In an effort to improve its movie recommendation system, Netflix made available supposedly anonymous lists of users' reviews. But two University of Texas computer scientists were able to de-anonymize at least a portion of the list by comparing the user reviews of obscure movies on Netflix with reviews on IMDb.com.

The United States, unlike Europe, doesn't have a comprehensive privacy policy. Instead, a hodgepodge of laws protect privacy rights in a few key categories. Unfortunately for Facebook, Blockbuster and, perhaps, Netflix, one of those categories is movie rentals.