By publishing the names of customers and the videos they rented, Facebook and Blockbuster may have violated the Video Privacy Protection Act of 1988, New York law professor James Grimmelmann explains on his blog. Don't worry Zuck, it's only $2,500 per violation.

Grimmelmann examines Facebook and Blockbuster's most likely defense: Facebook and Blockbuster did offer users a chance to opt out of the notifications with litte popups. But the VPPA requires "the informed, written consent of the consumer given at the time the disclosure is sought," and the popups don't quite pass that test. One presumes that Amazon.com and Netflix, which have allowed customers to share movie purchases and rentals for years, but voluntarily, have managed to satisfy this test.

Grimmelmann's conclusion? "Class action lawyers," he writes, "start your engines." Good thing Facebook allowed users to turn off Beacon when it did.