This year has seen a tremendous spike in the number of cases alleging violations of the Video Privacy Protection Act (“VPPA”), 18 U.S.C. § 2710, a statute enacted in 1988 in response to the Washington City Paper’s publication of a list of films that then-Supreme Court nominee Robert Bork had rented from a video store. The statute was intended to “allow[] consumers to maintain control over personal information divulged and generated in exchange for receiving services from video tape service providers.”
Despite brick-and-mortar video rental stores and video tapes becoming nearly extinct, the VPPA has been making a “blockbuster” comeback. Due in large part to its flexible language, the statute has been repurposed to enforce online privacy. Plaintiffs’ lawyers are using the VPPA to target a wide variety of companies with websites and mobile applications that offer video content. Plaintiffs are claiming that the sharing of consumer information, often obtained through tracking and data collection tools, with third parties, like data analytics companies, is a violation of the VPPA.
Understanding the VPPA
The VPPA makes it unlawful for a “video tape service provider” to knowingly disclose, to any person, “personally identifiable information” concerning any “consumer” of such provider without their consent and with a few exceptions. To realize the statute’s current significance, it is important to understand how the statute defines and courts have interpreted “video tape service provider,” “personally identifiable information,” and “consumer.”
- “Video tape service provider” means “any person, engaged in the business, in or affecting interstate or foreign commerce, of rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials.” Of particular importance is the phrase “similar audio video materials,” which has been interpreted by to encompass online videos, such as those streaming on websites, with the exception of livestreaming video content.
- “Consumer” means any renter, purchaser, or subscriber of goods or services from a video tape service provider. have required some sort of ongoing relationship between the user and entity which owns and operates the website or mobile app to be considered a “subscriber.” However, the level of commitment required varies from court to court. For example, require the subscription be related to the site’s audio-visual materials.
- “Personally identifiable information” or “PII” includes information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider. The types of information that constitute PII have evolved over time to reflect new technology and to incorporate new state privacy laws, such as the California Consumer Privacy Act. However, the courts are split when it comes to the test for assessing whether information “identifies a person.” According to the , a user’s device ID and GPS coordinates constituted PII because the data was “reasonably and foreseeably likely” to identify the user. Whereas the found that IP addresses, browser settings, and device ID would not constitute PII because it would not “permit an ordinary person to identify” a specific individual. Most courts appear to be going in the direction of the Third and Ninth Circuits.
Successful Defenses to the VPPA at the Motion to Dismiss Stage
The courts’ relatively expansive view of the VPPA and in particular, the meaning of “video tape service provider,” has made for mixed outcomes at the motion to dismiss stage. However, two defenses have been met with increasing success recently.
First, arguments that the plaintiff does not qualify as a “consumer” under the VPPA, or more specifically, a “subscriber” have been largely successful at the motion to dismiss stage. For example, in , a judge in the North District of Illinois granted defendant’s motion to dismiss holding that plaintiffs were not consumers under the VPPA because they merely subscribed to defendant’s website generally, not to audio visual materials, and plaintiffs did not receive anything in return for such subscription because video content was accessible to anyone. Similarly, in ., a case out of the Northern District of California, the court held that “a VPPA subscriber is not just someone who provides her name and address to a website, for some undisclosed purpose or benefit.” A similar understanding was reached in , in the Southern District of New York, holding that the definition of “consumer” under the VPPA applied to renters, purchasers, or subscribers of audio-visual goods or services, but “not goods or services writ large.” Applying this understanding, the Scripps court granted defendant’s motion to dismiss because there were no facts that plausibly alleged plaintiffs’ subscription to hgtv.com’s newsletters was a “condition to accessing the site’s videos, or that it enhanced or in any way affected their viewing experience.”
Second, defendants outside of the First Circuit have succeeded at the motion to dismiss stage with arguments that the information disclosed could not be used to identify the user and therefore did not constitute PII. For example, most recently, in a case pending in the Northern District of California, granted in part a motion to dismiss claims under the VPPA because the complaint did not adequately allege that the sharing of plaintiff’s Facebook IDs coupled with URLs of the videos plaintiffs watched, without plaintiffs’ consent, led to a Facebook page that disclosed personal and identifying information about the consumer.
Finally, while most courts have accepted that “video tape service provider” encompasses any company that offers recorded video content on their websites or mobile apps, defendants in the have successfully defended against VPPA claims by arguing that their business was not “centered, tailored, or focused around providing and delivering audiovisual content,” and therefore, they were not a “video tape service provider” under the statute. If more courts follow suit, this could prove to be a fruitful defense and effectively limit the scope of the VPPA.
In the meantime, it is important that all companies that offer recorded video content on their websites or mobile apps review their use of tracking and data collection tools, especially those used on webpages with audiovisual content, to determine whether information identifying a person and the video they viewed is being transmitted to a third party and take appropriate precautionary measures.