USA Video Privacy Protection Act claims: Blockbuster or busted flush?
Back in 1988 the United States congress enacted the Video Privacy Protection Act (“VPPA”), following the leak of a Supreme Court nominee’s Blockbuster video rental history. At that time, it is difficult to imagine they would have had in mind the wave of litigation which has come about recently relating to the use of tracking and data collection software on websites which provide video content.
Over the last couple of years, there has been a growing trend of enterprising plaintiff lawyers in the US using analogue-era legislation to bring class action claims relating to the use of modern technology. This is particularly so where defendant companies use software to track customer activity.
Such software often consists of an embedded piece of code which can be used to record customers’ interactions on their websites and use this for more personalised advertising for example. This can be problematic, as we shall see, when this data is collected without a customer’s explicit knowledge or consent.
However, the VPPA is not unique in this regard and we have also seen claims brought in relation to wire-tapping under the old California Invasion of Privacy Act arising out of companies’ use of chat technology.
So what does the VPPA provide?
The VPPA dictates that any video tape service provider who knowingly discloses, to any person, personally identifiable information concerning any consumer of such provider will be liable (subject to a few exceptions).
The consequences of being found liable are potentially dire, with courts being able to award consumers up to $2,500 per violation in addition to punitive damages and costs. At these amounts, even a class size of a few thousand would result in a substantial exposure, let alone potential class sizes of over a million which would result in existential problems for many companies.
Whether a plaintiff is successful or not will often come down to whether a court finds that a defendant is a video tape provider for the purposes of the statute.
The bill defines a video tape service provider as “any person, engaged in the business… of rental, sale or delivery of pre-recorded video cassette tapes or similar audio visual materials.”
The drafting of these last four words has significantly widened the scope of the VPPA, and allowed the statute to be applied to videos hosted online. However, at least to date, the courts have stopped short of allowing these claims to succeed against any defendant who hosts video content on their websites.
In particular, the focus of the defendant’s work or business needs to be the provision of audio-visual materials, and it is not sufficient if the videos only form a small part of their overall marketing strategy. As such, motions to dismiss have found success last year in cases against manufacturers General Mills and Hershey.
Subscription vs special access
Even if the defendant’s company is primarily engaged in the business of providing video content, it isn’t necessarily the end of the road for defendants. The court will also consider to what extent there lies a relationship between having a “subscription” to the website in question and gaining special access to video content, as this plays into whether the plaintiff is deemed to be a “consumer”.
If being a subscriber simply results in some other benefits which do not stretch to exclusive access to video content, then the current case law suggests the claim is unlikely to succeed. This approach was adopted by the court last year in both Kuzenski v Uproxx and Salazar v Paramount in dismissing class action complaints brought by the plaintiffs.
What constitutes personally identifiable information?
The final question to be addressed by the courts is whether the information disclosed to the third party constitutes personally identifiable information (PII).
Here the courts in different circuits have adopted different views, largely depending on whether or not they use the standard of an “ordinary person” to decide whether a consumer can be identified from the information.
For example, the First Circuit Court of Appeals has decided that a mobile device ID number, GPS coordinates, and the titles of the videos watched constituted PII on the basis that the data was “reasonably and foreseeably” likely to identify the user as having watched the videos (Yershov v Gannet, 2017).
Contrast this approach with that of the Ninth Circuit in Eichenberger v ESPN, a case also from 2017 involving Adobe analytics software, which held that the information would need to readily permit an ordinary person to identify the individual as having watched certain videos in order to constitute PII.
This was not the case since the information disclosed established a device serial number alongside the names of the videos watched, which would be useless in isolation to identify the individual without the other vast data in Adobe’s possession (and which had not been disclosed).
It is clear to see that the evolution of the types of information from simply the name or address of the consumer has a large part to play in the additional complexity of these claims and something which will undoubtedly develop further.
What can we expect in 2024
As we move further into 2024, we expect to see more rulings in relation to motions to dismiss, which have been pending throughout last year, and which will further shape the landscape around these kinds of claims.
In addition, there will be appeal decisions where the initial motion to dismiss has been successful. These cases should assist in providing clarity as to future exposure for companies and insurers, but there remains a question mark over the extent to which plaintiff consumers will succeed in widening the initially anticipated scope of legislation such as the VPPA.
Whilst there is certainly some cause for (cautious) optimism, it is clear that companies need to be very wary of the risks posed by the tracking and collection of customer data, especially if this is being conducted on their behalf by third party suppliers.
Companies cannot afford to ignore the risk of a successful class action claim being brought under the VPPA, particularly where the courts have shown a willingness to interpret the definition of PII very widely. We await further developments in the case law with interest.
