Class Action Alleges HBO Shares Subscriber Info with Facebook Without Consent

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action alleges HBO has knowingly disclosed HBO Max subscribers’ personally identifiable information, including a record of every video they watch, to Facebook without consent to do so in an effort to enhance its own targeted advertising. 

The 32-page lawsuit alleges Home Box Office, Inc. has run afoul of the federal Video Privacy Protection Act (VPPA) through its use of a Facebook “tracking pixel” that exists in the code of the HBO Max streaming service website. The lawsuit says that HBO Max subscriber actions that are captured by Facebook’s tracking pixel are sent to the social media company, who then processes, analyzes and assimilates the information into datasets used for targeted advertising purposes. 

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

According to the lawsuit, HBO, who reportedly outspent every other streaming service on advertising in the first half of 2021, coordinates with Facebook to target its ads via the platform’s Business Tools. The suit says that the tracking pixel on the back end of the HBO Max website relays to Facebook when a subscriber selects and watches a video, the URL of the video, the details—episode title, series name, season, etc.—of the video, and more. According to the case, the data shared with Facebook contains enough information so that individual viewers can be identified specifically. 

Per the complaint, HBO integrates two Facebook tracking pixels into its website, with either one or both activated, depending on the page. When a prospective subscriber first signs up for HBO Max, the defendant integrates both, and after sign-up HBO removes one tracking pixel while the other remains and “continues to track subscribers across the HBO Max website,” the case says. 

The suit relays that when an HBO Max subscriber selects and watches a video, HBO captures two events, called PageView and AuthenticatedTraffic, through which it discloses to Facebook the URL an individual has accessed. The lawsuit says that the information transmitted to Facebook via PageView and AuthenticatedTraffic events is sufficient to allow an ordinary person to identify a particular video’s title and content. 

Further, the Facebook tracking pixel used by HBO compels a subscriber’s browser to transmit cookies to the social media company if the person is currently logged into, or has recently logged into, a Facebook account, the case states. According to the suit, Facebook uses these cookies—specifically the fr, _fbp and c_user cookies—to link to particular subscribers’ Facebook IDs and corresponding profiles.

“A Facebook ID is personally identifiable information,” the complaint states. “Anyone can identify a Facebook profile—and all personal information publicly listed on that profile—by appending the Facebook ID to the end of https://www.facebook.com/.”

HBO also discloses personal identifiers through Facebook’s Automatic Advanced Matching for Web tool, which helps the social media company “better match visitors to their Facebook profiles, which in turn allows HBO to better target its advertisements,” the lawsuit says. 

The suit also alleges HBO uploads customer lists to Facebook to better match subscribers with their profiles. Per the case, HBO combines customer lists with offline event data—that is, information on a person’s activity with other apps and websites—to effectively target subscribers with advertising. 

The lawsuit looks to represent all individuals in the United States who subscribe to HBO Max. 

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.