VPPA Litigation Trends and Defense Strategies
Video Privacy Protection Act (VPPA) litigation has become a major focus for class action lawyers targeting websites using Meta or Google Pixels that offer any kind of subscription for users and contain video content. Despite the recent litigation trend primarily favoring defendants, VPPA litigation remains persistent, and the steady flow of cases shows no signs of decreasing in the near term.
What is the VPPA? The VPPA is a 1988 law intended to prevent “video tape service providers” from knowingly disclosing to third parties which movies their customers rented without the customers’ consent. The VPPA was enacted in response to the Washington City Paper’s publication of then-Supreme Court nominee Robert Bork’s video rental history. In recent years, however, the VPPA has been reincarnated, being used by class action lawyers to sue companies for sharing user data with Meta and Google through tracking technologies such as Meta Pixel. Recent cases drifted far away from the “classic example” of a VPPA violation, which is “a video clerk leaking an individual customer’s video rental history[.]” In re Nickelodeon Consumer Priv. Litig., 827 F.3d 262, 290 (3rd Cir. 2016). The Courts have since applied the VPPA to video streaming providers and other modern platforms that Congress could not have anticipated in 1988.
The VPPA provides that a “video tape service provider who knowingly discloses, to any person, personally identifiable information (“PII”) concerning any consumer of such provider shall be liable to the aggrieved person.” 18 U.S.C. § 2710(b)(1). The legal definitions of the VPPA that are frequently litigated at the motion to dismiss stage are (1) whether a defendant is a “video tape service provider,” (2) whether a website user qualifies as a “consumer” under the VPPA, and (3) whether the defendant knowingly disclosed “personally identifiable information concerning any consumer” to any person. Defendants have moved to dismiss these cases on the grounds the plaintiff fails to plead facts alleging that defendant is a video tape service provider as defined by the VPPA, that the defendant knowingly disclosed the plaintiff's personally identifiable information to a third party, and/or that the plaintiff is a consumer.
A “video tape service provider” is defined in the VPPA as “any person, engaged in the business, in or affecting interstate or foreign commerce, of rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials.” Most arguments in VPPA litigation related to this definition center on the interpretation of “similar audio-visual materials.” There appears to be a consensus among courts that audio-visual materials must include some prerecorded video content to trigger the application of the VPPA, except in the context of livestreaming videos. Interestingly, this definition has been interpreted quite broadly to include even the prerecorded cut scenes[1] in video games. For example, in Aldana v. GameStop, Inc., No. 22-7063, 2024 WL 708589, at *6 (S.D.N.Y. Feb. 21, 2024), the court found that “GameStop is a ‘video tape service provider’ under the VPPA” because it sold video games that include cut scenes.
“Personally identifiable information”. The VPPA defines PII as including information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider. 18 U.S.C. § 2710(a)(3). A defendant knowingly discloses PII to a third party under the VPPA by transmitting “information that would readily permit an ordinary person to identify a particular individual’s video watching behavior” with the knowledge that the recipient can use the information in such a way. See In re Nickelodeon Consumer Privacy Litigation, 827 F.3d 262, 267 (3d Cir. 2016) (describing the history and purpose of the VPPA). Defendants usually argue the information collected by tracking pixels does not constitute PII under the VPPA. The courts, however, are split over what information “identifies a person.” The First Circuit adopted a broad definition, which covers technical data like user’s device ID because the data was “reasonably and foreseeably likely” to identify the user. In contrast, the Third and Ninth Circuits found that IP addresses, and device ID would not constitute PII because it would not “permit an ordinary person to identify” a specific individual. Recently some courts seem to have reached an apparent consensus that plaintiffs plausibly allege the disclosure of PII under the VPPA by alleging defendant incorporated Facebook Pixel into the code of its website.[2]
“Consumer.” The VPPA defines “consumer” as a “renter, purchaser, or subscriber of goods or services from a video tape service provider.” Most plaintiffs argue they qualify as “subscribers” of goods and services as defined in the VPPA where a service provides any kind of website subscription. The leading case on the definition of a “subscriber” is the Eleventh Circuit's decision in Ellis v. Cartoon Network, which holds that a subscription requires, at a minimum, “some type of commitment, relationship, or association (financial or otherwise) between a person and an entity.” In addition to the Ellis factors, some courts have found that the definition of a consumer under the VPPA requires a nexus between the subscription and the provision of audio-visual materials. See, e.g., Rodriguez v. JP Boden Servs. Inc., 2024 WL 559228, at *4 (S.D. Cal. Feb. 12, 2024); Kuzenski v. UPROXX LLC, 2023 WL 8251590, at *4 (C.D. Cal. Nov. 27, 2023). Some courts have held a subscription must grant access to video material that otherwise would not be available to users.[3] In at least two decisions, Georgia courts followed a broader definition of subscriber, finding that subscribing to non-video content such as an email list or newsletter can be sufficient to qualify user as a “subscriber” under the VPPA. See Harris v. Pub. Broad Serv., 662 F. Supp. 3d 1327, 1331–32 (N.D. Ga. 2023) and Lebakken v. WEBMD, 640 F. Supp. 3d 1335, 1340 (N.D. Ga. 2022).
How may companies minimize risk regarding VPPA claims? Although there is no bulletproof strategy, companies with websites using Meta or Google Pixels and containing subscription and video content may want to explore options for obtaining consumer consent before collecting data, or disable these data gathering options.
Under the VPPA, disclosure is permitted when the consumer has provided “informed, written consent” (§ 2710(b)(2)(B)). This consent must meet the following key requirements: (i) it must be given “in a form distinct and separate from any form setting forth other legal or financial obligations of the consumer”; (ii) it must be given at the time the disclosure is sought, or in advance for a set period of time (not to exceed 2 years or until consent is withdrawn by the consumer, whichever is sooner); and (iii) the video tape service provider must offer a clear and conspicuous opportunity for the consumer to withdraw consent on a case-by-case basis or from ongoing disclosures, at the consumer's election (§ 2710(b)(2)(B)(i)–(iii)).
Therefore, to comply fully with VPPA consent requirements, such consent would likely need to be written consent and appear in a separate document. Thus, relying on any existing terms and conditions (Terms of Use or Terms of Service, or a Privacy Policy) may not be adequate. This requirement differs from the disclosure and opt-out requirements for tracking technologies under most current state privacy laws. To comply with the VPPA consent requirements, companies would need to block third-party tracking scripts and technologies until the website visitor has provided their consent. The user interface for such opt-in consent also raises many questions. Since the consent must be given “in a form distinct and separate from any form setting forth other legal or financial obligations of the consumer,” it is unclear whether including this consent in the cookie banner would suffice as “distinct and separate,” or if a separate pop-up notification is needed. Further, since consumer consent is required, this consent needs to be tracked separate from any other consents, and be renewed every other year. Companies will need to figure out what works best for them, before implementing the consent method they chose.
One point on which courts have been consistent is that if the website host wishes to rely on its terms and conditions (as defined above), it must be able to establish from the outset the individual user gave consent. So, for companies that have a robust system for securing consent in place, hopefully only minor reprogramming is needed. Otherwise, these video tape service requirements may end up becoming a rather large headache to implement.
Recent trends. The case law on the VPPA is rapidly evolving. Some courts are siding with a growing trend of rulings dismissing these cases at the motion to dismiss stage by requiring the establishment of a clear nexus between the subscription and the video content. Other courts permit the VPPA claims to survive early motions to dismiss. Most cases defining these trends have not yet been reviewed on appeal, so we may see changes depending on the outcomes of cases that are currently on appeal, e.g., Salazar v. National Basketball Association, which is pending in the Second Circuit.
[1] “Cut scenes” are “video clips within a video game” that move the narrative of the game forward. See Aldana v. GameStop, Inc., 2024 WL 708589, at *2 (S.D.N.Y., 2024).
[2] See, e.g., Jackson v. Fandom, Inc., No. 22-04423, 2023 WL 4670285, at *4 (N.D. Cal. July 20, 2023); Feldman v. Star Tribune Media Co. LLC, 659 F. Supp. 3d 1006, 1020–1021 (D. Minn. Mar. 7, 2023); Belozerov v. Gannett Co., 646 F. Supp. 3d 310, 314–315 (D. Mass. 2022); Czarnionka v. The Epoch Times Ass'n, Inc., No. 22-6348, 2022 WL 17069810, at *3 (S.D.N.Y. Nov. 17, 2022).
[3] See Gardener v. MeTV, 681 F. Supp. 3d 864, 869 (N.D. Ill. 2023) (it is not sufficient to allege that website visitors created accounts on defendant's website, but these accounts did not provide access to video content); Salazar v. Nat'l Basketball Ass'n, No. 22-07935, 2023 WL 5016968, at *8 (S.D.N.Y. Aug. 7, 2023) ( subscription to Defendant's newsletter did not render him a consumer of goods or services from a video tape service provide because a subscriber under the VPPA consumes audio visual materials, not just any products or services from a video tape services provider); Salazar v. Paramount Glob., 683 F. Supp 3d 727, 745 (M.D. Tenn. 2023) (“an individual is a ‘subscriber’ under the VPPA only when he or she subscribes to audio visual materials.”); Carter v. Scripps Networks, 670 F. Supp. 3d 90, 98 (S.D.N.Y. 2023) (“a reasonable reader would understand the definition of ‘consumer’ to apply to a renter, purchaser or subscriber of audio-visual goods or services and not goods or services writ large”); Collins v. Toledo Blade, No. 23-302, 2024 WL 1094613, at *6 (N.D. Ohio March 13, 2024) (plaintiff sufficiently alleged he qualified as a subscriber because his subscription granted access to video material).