The Video Privacy Protection Act (“VPPA”), 18 U.S.C. § 2710, is a federal statute that was enacted in 1988 in response to the disclosure and publication of then-Supreme Court nominee Robert Bork’s video rental history without his consent.  To prevent repeats of the Bork incident, the VPPA generally prohibits any “video tape service provider” from disclosing a consumer’s viewing habits without a consumer’s written consent.

Despite its analogue origins, this decades-old statute has been recently targeted by the plaintiff’s bar (incentivized by the VPPA’s $2,500 per violation liquidated damages provision) in putative class action litigation brought against website operators.  At least under the broad interpretation of the VPPA urged by plaintiffs, any business that has a website with video capabilities could potentially be considered a “video tape service provider” under the VPPA.  In the view of the plaintiff’s bar, besides video streaming platforms and other entertainment companies, this also includes media companies, restaurant chains, professional sports organizations and a variety of e-commerce businesses.

At first blush these recent claims bear some similarities to a spate of VPPA cases filed ten years ago.  In these earlier cases, as is the case here, plaintiffs claim that defendants violated the VPPA by sharing information about visitors’ video viewing habits and history with third parties.  However, the underlying circumstances involved in this newest wave of VPPA cases contain some notable differences from prior litigation trends.  These newly filed cases also raise novel issues involving how key language used in the VPPA should be interpreted and whether Congress intended this statute’s private right of action apply to technologies that were nonexistent when the VPPA was enacted.

At least 70 VPPA actions have reportedly been filed in the past year alone against the operators of websites that offer online videos and use ubiquitous third-party analytics tools like tracking pixels, with more continuing to be filed.  The success of website operators in securing dismissal of VPPA claims has been a mixed bag thus far, with some courts expressing reluctance at dismissing these cases early on without discovery.

These lawsuits are a continuation of a growing trend of consumer privacy class action litigation being filed in courts across the U.S. and entail a significant risk to a wide variety of companies across industries.  Here, we give an overview of some of the issues being litigated in the current VPPA cases.

VPPA Background

The VPPA prohibits [1] a “video tape service provider” from [2] knowingly [3] disclosing [4] “personally identifiable information” of [5] a “consumer,” unless certain enumerated exceptions apply.  18 U.S.C. § 2710(b)(1).  The most prominent exceptions are the exceptions for disclosures “incident to the ordinary course of business of the video tape service provider,” § 2710(b)(2)(E), and where the consumer provides “informed, written consent,” § 2710(b)(2)(B).  For the consent exception, the written consent must be obtained “in a form distinct and separate from any form setting forth other legal or financial obligations of the consumer.”  § 2710(b)(2)(B)(i).

Aggrieved plaintiffs under VPPA have a private right of action in federal court. § 2710(c)(1). A court may award “actual damages but not less than liquidated damages in an amount of $2,500” as well as punitive damages and attorneys’ fees. § 2710(c)(2).  For claims brought on behalf of a putative class, damages would be assessed on a per class member, per violation basis.

Given the high stakes involved in cases recently brought against website operators, it is not surprising that nearly every element of the VPPA and potential defense is being vigorously litigated by the parties involved, as outlined in further detail below.

What Is a Video Tape Service Provider Under The VPPA?

The VPPA defines a “video tape service provider” as “any person, engaged in the business . . . of rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials.”  § 2710(a)(4).  The current wave of VPPA litigation exists because, as indicated above, this definition has been interpreted to include more than traditional video service providers like Blockbuster or even streaming companies.  Instead, in recently filed VPPA claims brought against website operators several courts have declined to dismiss cases against defendants who operate websites that host video content.  While this does not mean the argument that a defendant is not a video tape services provider as used in the VPPA is precluded entirely as a defense, at least some courts have found that a defendant’s status is a question of fact not appropriate for resolution on the pleadings.

For instance, in Stark, No. 22-cv-03131-JCS, 2022 WL 7652166 (N.D. Cal. Oct. 13, 2022), the defendant was alleged to “allow its users or members to ‘access a variety of content on defendant’s website, including music, podcasts, and video content posted by content creators’” whom plaintiff users subscribed to.  Id. at *1.  In that case, the defendant argued in its motion to dismiss that it was not a video tape service provider “because it instead merely providers a platform to allow creators to deliver their videos.” Id. at *6 (emphasis in original).  The Stark court disagreed, stating that the test for whether a defendant is a video tape service provider is whether “the defendant’s product [is both] substantially involved in the conveyance of video content to consumers [and] significantly tailored to serve that purpose.” Id. (alterations in original) (quoting In re Vizio, Inc., Consumer Priv. Litig., 238 F. Supp. 3d 1204, 122 (C.D. Cal. 2017)) (emphasis supplied). Using this test and drawing all inferences in favor of plaintiffs (as is required in most instances for purposes of a motion to dismiss), the court denied defendant’s motion, reasoning that the plaintiff’s it was “reasonable to think” from plaintiff’s allegations that defendant’s website was tailored to deliver pre-recorded video content from creators. Id. at *7.

In another recent case, a court denied a motion to dismiss a VPPA claim against a defendant who claimed that the videos on its website merely “serve[d] to promote [its] business” of selling movie tickets.  Order at 7, Goldstein, No. 9:22-cv-80569-KAM (S.D. Fla. Mar. 7, 2023), ECF No. 57.  The court held that determining whether the defendant was a video tape service provider would require “additional information regarding how much business Defendant devotes” to its ticket selling compares to its video making.  Id.

Defendants have had some success arguing that they do not qualify as a “videotape service provider” under the VPPA to the extent they broadcast live videos, which are arguably not similar to videotapes.  See, e.g., Louth, No. 1:21-cv-00405-MSM-PAS, 2022 WL 4130866 (D.R.I. Sept. 12, 2022) (granting motion to dismiss plaintiffs’ complaint to “the extent they rely upon the consumption of live content but denied as to pre-recorded content.”); Stark, 2022 WL 7652166, at *6 (granting dismissal with leave to amend).  Case law on this issue continues to evolve.

Outside of the live video domain, it remains to be seen what kind of businesses are so outside the understanding of a “video tape service provider” that a VPPA claim can be dismissed without discovery.

Does Website Analytics Data Disclose PII?

The VPPA provides that “the term ‘personally identifiable information’ [“PII”] includes information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider.” § 2710(a)(3).  Current litigation has focused on the nature of data disclosed to advertising platforms by websites that have configured third-party analytics tools like tracking pixels.  Courts are split on whether the information disclosed by such pixels constitutes PII under the VPPA.

One federal district court in New York recently granted a defendant’s motion to dismiss VPPA litigation, noting that a defendant merely disclosing a user ID and the name of a visited webpage excludes “essential information for a VPPA claim”: the title of the requested video.  Martin, No. 1:22-cv-04776-DLC, 2023 WL 2118074, at *3 (S.D.N.Y. Feb. 17, 2023).  Without identifying a video title, any information identifying a person is not PII for purposes of the VPPA.  Id.

However, most courts have denied motions to dismiss on this ground by reasoning that a plaintiff need only to allege that a tracking pixel discloses a user ID and that user ID is something an ordinary person can type into a website to identify an individual. See, e.g., Lebakken, No. 1:22-cv-00644-TWT, 2022 WL 16716151, at *4 (N.D. Ga. Nov. 4, 2022) (“[plaintiff] adequately alleged that [defendant] disclosed her [user ID] and email address in connection with her video viewing information to [advertising platform] and that the disclosure of such information constituted a disclosure of PII”); Czarnionka, No. 22-cv-06348, 2022 WL 17069810, at *3 (S.D.N.Y. Nov. 17, 2022) (finding similar allegations sufficiently plausible).

As litigation on this element results in more courts considering the merits of these cases and grappling with how the advertiser tracking pixels and other analytics software actually operate—rather than what is contained within four corner’s of a plaintiff’s complaint—it is possible that the split of authority will shift in favor of defendants upon factual findings that VPPA-type PII is not disclosed.

What Constitutes “Knowing” Disclosure?

Courts have held that if a defendant “did not think it was conveying [personally identifiable information], then there could be no” knowing disclosure under VPPA.  Bernardino v. Barnes & Noble Booksellers, Inc., No. 17-CV-04570-LAK-KHP, 2017 WL 3727230, at *9 (S.D.N.Y. Aug. 11, 2017), adopted by, 2017 WL 3726050 (S.D.N.Y. Aug. 28, 2017). Using this standard, website operators in pending VPPA litigations are frequently arguing that they cannot be liable under the VPPA because they did not know that a plaintiff’s PII was disclosed with third-party website analytics software.

However, many courts addressing the issue to date have allowed litigation to proceed past the motion to dismiss stage.  For example, in  Belozerov, the court rejected defendant’s argument that “plaintiff did not allege facts that [defendant] ever knew that users’ information was transmitted to [advertising platform]” based off the conclusory allegation in the complaint that “defendant . . . programmed [the advertising pixel and] knew that [it] disclosed Personal Viewing Information to [the advertising platform].”  No. 22-cv-10838-NMG, 2022 WL 17832185, at *4 (D. Mass. Dec. 20, 2022).

Case law on this issue is expected to continue to evolve as more courts grapple with VPPA claims.

Who Is a “Consumer” of Free Content?

“Consumer” is defined in the statute as “any renter, purchaser, or subscriber of goods or services from a video tape service provider.” § 2710(a)(1).  One question in current litigation is under what circumstances can a user of free services be considered a “subscriber” of those services and thus a “consumer” under the VPPA?

So far, several courts denied motions to dismiss where the user of a service created an account.  For example, in Lebakken, the court held that plaintiff had adequately pleaded she was a “subscriber” because she pleaded that she did more than just download a free mobile application: “she exchanged her email address to receive [defendant’s] e-newsletter and that she also created her own [] account [with defendant].”  No. 1:22-cv-644-TWT, 2022 WL 16716151, at *2 (N.D. Ga. Nov. 4, 2022).

Although other defendants in pending VPPA litigations have made arguments that a user’s account-less viewing of videos on a free website or app does not make the user a consumer under the VPPA, see, e.g., Ganaway v. Move, Inc., 1:22-cv-04859 (N.D. Ill. Nov. 7, 2022), ECF No. 19-1, but no courts have reached the issue yet.

First Amendment Challenges to the VPPA

Some defendants when confronted with claims under the VPPA have raised constitutional challenges to the statute, in addition to other defenses outlined above.

As a reminder, a litigant making a challenge to the constitutionality of a statute can make either a “facial” challenge or an “as-applied” challenge.  In a facial challenge, the litigant must show that a substantial number of the statute’s applications are unconstitutional.  How “substantial” applications of a statute are may be a fact-intensive question.  In an as-applied challenge, the litigant must show that the application of the statute would be unconstitutional when enforced against the litigant.  Defendant website operators have raised both type of challenges to the VPPA.

The Northern District of California recently held that a facial First Amendment challenge to the VPPA was “premature” at the motion to dismiss stage, but allowed the defendant to reassert its First Amendment challenge with the benefit of a more complete factual record later. Stark, No. 22-cv-03131-JCS, 2023 WL 2090979, at *15 (N.D. Cal. Feb. 17, 2023).  Interestingly, in Stark the U.S. Department of Justice filed a brief defending the constitutionality of the VPPA, arguing that (i) the statute only regulates “commercial” speech that is subject to lesser protections under the First Amendment, that (ii) the statute does not apply to Defendants such as “news organizations, advocacy groups, or other entities whose mission is to publicize information of public import.” U.S. Memorandum in Support of the Constitutionality of the Video Privacy Protection Act, No. 3:22-cv-03131-JCS (N.D. Cal. Dec. 5, 2022), ECF No. 49-1.

In Stark, the court accepted defendant’s argument that the VPPA prohibited certain noncommercial speech, such as personal conversations of a video tape service provider.  2023 WL 2090979, at *11–13.  “Since the VPPA implicates noncommercial speech by others besides [defendant], it is subject to overbreadth review to determine whether it substantially violates those potential speakers’ rights under the First Amendment.” Id. at *13.  An overbreadth review under the First Amendment requires a factual analysis not suitable for a motion to dismiss, but after a more completely record, the court could hold that the VPPA is facially unconstitutional.

By contrast, another defendant named in VPPA litigation has elected make an as-applied challenge to the constitutionality of VPPA.  Leslie, No. 1:22-cv-07936-JHR (S.D.N.Y. Jan. 18, 2023), ECF No. 23. In Leslie, the defendant news organization is arguing that the application of the VPPA to itself would be a violation of the First Amendment because it limits the distribution of sharing information of public interest.  The defendant news organization is predictably pointing to the U.S.’s brief in Stark as recognition by the federal government that the VPPA would be unconstitutional as applied to the defendant.

Conclusion

The rise in VPPA claims brought against website operators is anticipated to continue, given the lack of clear consensus among the courts for how these claims should be handled (particularly at the pleadings stage without the factual record from discovery). As a result, as a matter of best practices and to mitigate litigation risk should assess and understand their use of third-party cookies and/or any other software technology being used to potentially monitor website traffic, particularly on websites with video content.

Privacy World will be there to keep you in the loop.  Stay tuned.