In brief
The recent surge in cases under the Video Privacy Protection Act (VPPA) underscores its critical role in addressing consumer privacy concerns in the digital age.
The 1988 Act prohibits a “video tape service provider”, with certain exceptions, from the disclosure of video rental or purchase records containing personally identifiable information of any “consumer”. The Second Circuit has recently held in Salazar v. National Basketball Association, that the federal statute is “no dinosaur” and is far from being outdated, regardless of how content consumption has evolved since the days of VHS tapes. “Our modem means of consuming content may be different, but the VPPA’s privacy protections remain as robust today as they were in 1988,” Judge Beth Robinson wrote. The court determined that by subscribing to the NBA newsletter and providing his personal information, Salazar fell within the VPPA’s broad definition of “consumer,” and was entitled to its protections against unauthorized disclosure of personal information.
In depth
In Salazar v. NBA, Michael Salazar filed a class action lawsuit against the National Basketball Association (NBA) for allegedly violating the VPPA. Salazar claimed that after signing up for NBA’s free online newsletter and providing personal information, including his Facebook email address, the NBA disclosed his video-watching history and Facebook ID to Meta Platforms, Inc. without his consent via the Facebook Pixel program. The US District Court for the Southern District of New York (SDNY) initially dismissed Salazar’s complaint on August 8, 2023, siding with the NBA’s argument and ruling he did not qualify as a “consumer” under the VPPA since the newsletter was not an audiovisual “good or service,” and signing up for it did not make him a VPPA “subscriber.”
On appeal, the US Court of Appeals for the Second Circuit reversed the SDNY court’s decision on October 15, 2024 and disagreed with its interpretation of the VPPA. As the term “goods or services” was not limited to audio video materials only, signing up to the NBA’s online newsletter with personal information (such as email address, IP address, and any cookies associated with his device) qualified Salazar under the broad protection of the VPPA. Salazar’s alleged injuries were found to be sufficiently concrete to confer Article III standing. The court acknowledged the core alleged harm of his personal information being disclosed to a third party without his consent. It found this harm comparable to the traditionally recognized basis for lawsuits in American courts: the public disclosure of private facts.
The ruling was narrow on this one issue. The case was remanded to the district court to consider other submissions by NBA, namely (i) the disclosure was not controlled by NBA, and not done “knowingly”; (ii) Salazar had consented to the disclosure by agreeing to the NBA privacy policy; (iii) Salazar had waived his rights to bring a class action under the NBA Terms of Use, which included a class action waiver.
This case, while binding within the Second Circuit (New York, Vermont, and Connecticut) is persuasive to courts nationwide. It follows the reasoning of the Eleventh Circuit (Ellis v. Cartoon Network, Inc.) and First Circuit (Yershov v. Gannett Satellite Information Network, Inc.) that payment is not a necessary element of subscription under the VPPA. Providing personal information in exchange for access to content establishes a qualifying relationship of being a “subscriber” or “consumer”. This interpretation aligns with the VPPA’s broad language and privacy-protective goals.
Comments
While the VPPA originally addressed privacy concerns of traditional video rental stores, courts are not shy of applying its provisions to a wide range of online platforms and services that gather, handle, or store customers’ personal information. There is no consensus yet on which way the tide of VPPA cases is turning. However, given the trend of class action lawsuits demanding statutory damages under the VPPA (USD 2,500 per violation), attorney fees and other damages, as well as the ensuing reputational harm, companies must take this risk seriously and implement measures to mitigate liability.
- Companies containing subscription and video content may want to review their technology tracking tools (such as Meta or Google pixels) and restrict the ability to share consumers’ personal information with third parties.
- A review of the privacy policy applicable to the website/platform is also prudent to include appropriate disclosures about use or possible sharing of the personally identifiable information with third parties.
- Companies should also explore options for obtaining express consent from consumers so that they understand the website’s tracking functions when they view the video content. Such consent should be in a “separate and distinct” form, and must provide the ability for the consumer to opt-out of such consent at any time.
