Three in the morning, half a packet of biscuits deep into a streaming session, watching something that would raise eyebrows at Sunday dinner. Perfectly normal human behaviour. What isn’t normal is finding out that someone’s been keeping detailed notes on the whole thing and selling them to advertisers.
What Happened
On , a California court became the venue for what might charitably be called Crunchyroll’s “continued education in privacy law.” A new class action lawsuit alleges that the anime streaming service—recognisable by that distinctive orange logo—has been quietly piping user data to a marketing firm called Braze.
We’re not talking about anonymous aggregates here. We’re talking:
- Device IDs
- Email addresses
- Precise viewing histories — episode by episode, genre by genre
The Law Isn’t New
Here’s where the pattern becomes genuinely puzzling. The Video Privacy Protection Act dates back to the 1980s, born from an incident involving a Supreme Court nominee’s video rental records. It’s not new legislation. It’s not obscure. It exists precisely to stop companies from doing what Crunchyroll stands accused of doing.
The law is about as subtle as a brick through a window.
This Isn’t Their First Rodeo
In 2023, Crunchyroll settled a similar suit for $16 million, resulting in affected users receiving cheques for roughly $30—enough for a takeaway and perhaps a packet of crisps, if you’re being generous with the exchange rate.
Most corporate legal departments would treat a seven-figure settlement as a rather strong hint to clean up their act. Apparently, that particular message didn’t land. Apparently, that particular message didn’t land.
The Silence Strategy
The platform has maintained radio silence with the press. Strategic, certainly. But in an environment where consumer trust is the primary currency, silence isn’t a strategy so much as an admission that there’s nothing helpful to say.
The Larger Issue
This isn’t really about anime. It’s about the gap between what companies can do with technology and what they should do—and the recurring discovery that “don’t get caught” seems to remain the operative philosophy in corners of the tech sector.
When the VPPA was passed, legislators couldn’t have anticipated streaming algorithms or mobile device identifiers. But the principle remains straightforward: your viewing habits are your business until you decide otherwise.
About Braze
Braze markets itself as a customer engagement platform. Push notifications, personalised messaging, that sort of thing. Useful tools, in the right hands. The question is whether obtaining granular viewing data without explicit consent falls under “engagement” or something rather less savoury.
Where We Are Now
Another lawsuit. Another pool of potentially affected users. Another round of headlines about a company that had already been through this exact scenario.
One might reasonably ask what it takes for institutional behaviour to shift:
- Settlements clearly haven’t worked
- Publicity doesn’t seem to move the needle
Perhaps the real question is what happens when users simply stop believing that any data they share will remain private—and what that does to the streaming model more broadly.
If financial penalties and public exposure haven’t changed corporate data practices, what mechanisms actually drive behavioural change in the tech sector?
At what point does repeated privacy infringement shift from “corporate misstep” to a fundamental question about whether users can reasonably trust a platform at all?
Leave a Comment