This week, the Supreme Court of the United States agreed to hear an appeal concerning the definition of “consumer” under the Video Privacy Protection Act (VPPA), 18 U.S.C. § 2710; long one of the most frequently litigated privacy laws. If the Court affirms the lower court’s decision, it will defeat yet another attempt by the plaintiff’s bar to penalize companies who host audio visual content on their websites.
Continue Reading Supreme Court Agrees to Resolve VPPA Circuit Split
The federal Video Privacy Protection Act (“VPPA”) is one of the most frequently litigated data privacy statutes. This month, a California federal court dismissed VPPA claims brought against Hershey, making clear that VPPA liability does not extend to all websites with playable video clips. Rodriguez v. The Hershey Company, et al., No. 3:23-cv-00398-L-DEB, 2023 WL 6798506 (S.D. Cal. Oct. 12, 2023). Given the prolific number of VPPA cases filed this year, this decision will be persuasive to other website operators named in future filed and pending cases.
First, some background. As readers of Privacy World are already aware, the VPPA provides for liability for any “video tape service provider who knowingly discloses, to any person, personally identifiable information concerning any consumer of such provider.” 18 U.S.C. § 2710(b)(1). To plead a plausible claim for violation of the VPPA, a plaintiff must show as a threshold matter that a defendant is a “video tape service provider” under the statute.
In this case, the Court found this baseline requirement was not satisfied, notwithstanding creative pleading by the Plaintiff seeking to allege otherwise. Plaintiff’s Complaint alleged that Defendant Hershey is “an American multinational company and one of the largest chocolate manufacturers in the world”.
As such, Plaintiff alleged, Defendant’s core business model “involves persuading potential customers to try their products via the use of persuasive marketing videos” and that Defendant “create[s], host[s], and deliver[s] videos” on its website. Plaintiff asserted, Defendant is a “video tape service provider” for purposes of the VPPA and that Defendant violated the VPPA by disclosing Plaintiff’s information for purposes of targeted advertising.
The Court noted that under the plain language of the VPPA, a “video tape service provider” is “any person[ ] engaged in the business … of rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials.” Id. § 2710(a)(4). Consistent with other precedent from California district courts, the Court held that “[w]hen used in this context, ‘business’ connotes ‘a particular field of endeavor,’ i.e., a focus of the defendant’s work.” Because the Complaint was devoid of any alleged facts suggesting that the delivery of audiovisual material, regardless of medium, is a focus of Defendant’s business, the Complaint failed to plead a viable VPPA claim. Or, to put it otherwise, Plaintiff’s “allegation that Defendant uses videos to market their product indicates that delivering audiovisual material is ancillary to Defendant’s true business purposes.” (emphasis supplied).
Because VPPA claims filed against website operators have been an area of attention from the plaintiff’s bar in the past couple of years, this case is a useful reminder that VPPA liability does not arise merely because an entity has online video content. Instead, the focus of any website operator’s business must itself directly concern the delivery of audiovisual material. Moreover, the fact that a website operator used online videos to market its products does not suffice to satisfy the VPPA’s requirements. For more, stay tuned. Privacy World will be there to keep you in the loop.
In Eichenberger-v.-ESPN., Case No. 15-35499 (Nov. 29, 2017), the United States Court of Appeals for the Ninth Circuit affirmed the district court judgment holding that the serial numbers on a consumer’s video streaming device and the titles of the videos an individual watches do not constitute personally identifiable information (PII) under the Video Privacy Protection Act of 1988 (VPPA)—even if a third party has additional information that when coupled with the shared information can identify the individual.
Continue Reading While Ninth Circuit Finds No Additional Harm Required for Standing Under the VPPA, It Applies a Narrow Reading of What Constitutes PII Under the VPPA
For years, one of the most frequently litigated privacy laws has been the Video Privacy Protection Act (“VPPA”), 18 U.S.C. § 2710, a federal statute enacted in 1988 in response to the disclosure of then-Supreme Court nominee Robert Bork’s videotape rental history by a video store to a reporter, who published the list. Despite its analogue origins, this decades-old statute has been used by the plaintiff’s bar (incentivized by the VPPA’s $2,500 per violation liquidated damages provision) in putative class action litigation brought against any business whose website contains playable videos and third-party cookies.
This past year, there were several significant court rulings in litigation under the VPPA. These decisions addressed hotly contested VPPA elements while also laying the foundation for a potential circuit split. Squire Patton Boggs’ globally ranked “Elite” Data Disputes team is well experienced defending businesses and their data practices, including in the realm of VPPA litigation and (mass) arbitration. In this article, informed by our practical experience litigating and arbitrating VPPA cases, we: (I) provide a brief primer on VPPA elements and litigation theories, (II) cover a Second Circuit decision, and other district court decisions, on the definition of personally identifiable information under the VPPA (III) address decisions from the Sixth, Seventh, and D.C. Circuits on the scope of persons who can bring VPPA claims, and (V) give an update on a recent Eighth Circuit decision regarding which businesses are subject to the VPPA. These areas are all likely to bear upon VPPA claims and ongoing litigation in 2026, making this a must read for in-house counsel and practitioners in this space.
Continue Reading 2025 Video Privacy Protection Act Litigation Year in Review
Last month, the United States Court of Appeals for the Third Circuit, in an unpublished decision, undercut the latest attempt of the plaintiffs’ bar to penalize the common business practice of using tracking pixels on websites. These pixels are pieces of code created by third-party advertisers and analytics companies that can collect information about website visits such as a visitor’s IP address, when the visit occurred, and what links were clicked on within the site. Despite being used by most major U.S. businesses, tracking pixels have been increasingly targeted by plaintiffs for their alleged disclosure of certain information back to the company that operates them. Squire Patton Boggs’ Data Disputes team has significant experience defending these claims in litigation and arbitration (and obtaining dismissals for clients).
Read on for more about the Third Circuit’s decision in this case.
Continue Reading Third Circuit Strikes a Blow to Yet Another Attempt to Penalize the Use of Tracking Pixels
Mass arbitrations—where a plaintiffs’ firm brings dozens, hundreds, or thousands of identical claims against a business—is a mechanism increasingly relied upon by the plaintiffs’ bar in the past few years. This is because mass arbitrations enable a plaintiffs’ firm to create settlement pressure by leveraging unavoidable arbitration fees borne by a business regardless of the merits of the claims filed. Further powered by litigation funding, plaintiffs’ firms have used the mass arbitration device to bring vexatious claims and escape review of the merits or any downside risk.
Continue Reading 2025 Mass Arbitration Year in Review
This week a federal court in the Southern District of New York dismissed a privacy litigation brought against a website operator for claims under the federal Video Privacy Protection Act (“VPPA”), holding the allegation that plaintiffs had electronically subscribed to defendant’s newsletter was not sufficient for them to qualify as “subscribers” under the VPPA. Carter v. Scripps Network LLC, Case No. 1:22-cv-02031 (S.D.N.Y.)
As Privacy World has previously covered, dozens of website operators have been named as defendants recently in putative class actions, with claims also being filed in arbitration, for alleged violation of the VPPA. In many circumstances, plaintiff in such cases allege that the defendant improperly disclosed their video viewing history to social media companies for advertising purposes. Because this ruling limits the scope of claims that can be brought under the VPPA and is persuasive authority in other pending cases, it will likely be relied upon by defendants going forward.
The Video Privacy Protection Act (“VPPA”), 18 U.S.C. § 2710, is a federal statute that was enacted in 1988 in response to the disclosure and publication of then-Supreme Court nominee Robert Bork’s video rental history without his consent. To prevent repeats of the Bork incident, the VPPA generally prohibits any “video tape service provider” from disclosing a consumer’s viewing habits without a consumer’s written consent.
Despite its analogue origins, this decades-old statute has been recently targeted by the plaintiff’s bar (incentivized by the VPPA’s $2,500 per violation liquidated damages provision) in putative class action litigation brought against website operators. At least under the broad interpretation of the VPPA urged by plaintiffs, any business that has a website with video capabilities could potentially be considered a “video tape service provider” under the VPPA. In the view of the plaintiff’s bar, besides video streaming platforms and other entertainment companies, this also includes media companies, restaurant chains, professional sports organizations and a variety of e-commerce businesses.
At first blush these recent claims bear some similarities to a spate of VPPA cases filed ten years ago. In these earlier cases, as is the case here, plaintiffs claim that defendants violated the VPPA by sharing information about visitors’ video viewing habits and history with third parties. However, the underlying circumstances involved in this newest wave of VPPA cases contain some notable differences from prior litigation trends. These newly filed cases also raise novel issues involving how key language used in the VPPA should be interpreted and whether Congress intended this statute’s private right of action apply to technologies that were nonexistent when the VPPA was enacted.
At least 70 VPPA actions have reportedly been filed in the past year alone against the operators of websites that offer online videos and use ubiquitous third-party analytics tools like tracking pixels, with more continuing to be filed. The success of website operators in securing dismissal of VPPA claims has been a mixed bag thus far, with some courts expressing reluctance at dismissing these cases early on without discovery.
These lawsuits are a continuation of a growing trend of consumer privacy class action litigation being filed in courts across the U.S. and entail a significant risk to a wide variety of companies across industries. Here, we give an overview of some of the issues being litigated in the current VPPA cases.
The VPPA prohibits [1] a “video tape service provider” from [2] knowingly [3] disclosing [4] “personally identifiable information” of [5] a “consumer,” unless certain enumerated exceptions apply. 18 U.S.C. § 2710(b)(1). The most prominent exceptions are the exceptions for disclosures “incident to the ordinary course of business of the video tape service provider,” § 2710(b)(2)(E), and where the consumer provides “informed, written consent,” § 2710(b)(2)(B). For the consent exception, the written consent must be obtained “in a form distinct and separate from any form setting forth other legal or financial obligations of the consumer.” § 2710(b)(2)(B)(i).
Aggrieved plaintiffs under VPPA have a private right of action in federal court. § 2710(c)(1). A court may award “actual damages but not less than liquidated damages in an amount of $2,500” as well as punitive damages and attorneys’ fees. § 2710(c)(2). For claims brought on behalf of a putative class, damages would be assessed on a per class member, per violation basis.
Given the high stakes involved in cases recently brought against website operators, it is not surprising that nearly every element of the VPPA and potential defense is being vigorously litigated by the parties involved, as outlined in further detail below.
The VPPA defines a “video tape service provider” as “any person, engaged in the business . . . of rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials.” § 2710(a)(4). The current wave of VPPA litigation exists because, as indicated above, this definition has been interpreted to include more than traditional video service providers like Blockbuster or even streaming companies. Instead, in recently filed VPPA claims brought against website operators several courts have declined to dismiss cases against defendants who operate websites that host video content. While this does not mean the argument that a defendant is not a video tape services provider as used in the VPPA is precluded entirely as a defense, at least some courts have found that a defendant’s status is a question of fact not appropriate for resolution on the pleadings.
For instance, in Stark, No. 22-cv-03131-JCS, 2022 WL 7652166 (N.D. Cal. Oct. 13, 2022), the defendant was alleged to “allow its users or members to ‘access a variety of content on defendant’s website, including music, podcasts, and video content posted by content creators’” whom plaintiff users subscribed to. Id. at *1. In that case, the defendant argued in its motion to dismiss that it was not a video tape service provider “because it instead merely providers a platform to allow creators to deliver their videos.” Id. at *6 (emphasis in original). The Stark court disagreed, stating that the test for whether a defendant is a video tape service provider is whether “the defendant’s product [is both] substantially involved in the conveyance of video content to consumers [and] significantly tailored to serve that purpose.” Id. (alterations in original) (quoting In re Vizio, Inc., Consumer Priv. Litig., 238 F. Supp. 3d 1204, 122 (C.D. Cal. 2017)) (emphasis supplied). Using this test and drawing all inferences in favor of plaintiffs (as is required in most instances for purposes of a motion to dismiss), the court denied defendant’s motion, reasoning that the plaintiff’s it was “reasonable to think” from plaintiff’s allegations that defendant’s website was tailored to deliver pre-recorded video content from creators. Id. at *7.
In another recent case, a court denied a motion to dismiss a VPPA claim against a defendant who claimed that the videos on its website merely “serve[d] to promote [its] business” of selling movie tickets. Order at 7, Goldstein, No. 9:22-cv-80569-KAM (S.D. Fla. Mar. 7, 2023), ECF No. 57. The court held that determining whether the defendant was a video tape service provider would require “additional information regarding how much business Defendant devotes” to its ticket selling compares to its video making. Id.
Defendants have had some success arguing that they do not qualify as a “videotape service provider” under the VPPA to the extent they broadcast live videos, which are arguably not similar to videotapes. See, e.g., Louth, No. 1:21-cv-00405-MSM-PAS, 2022 WL 4130866 (D.R.I. Sept. 12, 2022) (granting motion to dismiss plaintiffs’ complaint to “the extent they rely upon the consumption of live content but denied as to pre-recorded content.”); Stark, 2022 WL 7652166, at *6 (granting dismissal with leave to amend). Case law on this issue continues to evolve.
Outside of the live video domain, it remains to be seen what kind of businesses are so outside the understanding of a “video tape service provider” that a VPPA claim can be dismissed without discovery.
The VPPA provides that “the term ‘personally identifiable information’ [“PII”] includes information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider.” § 2710(a)(3). Current litigation has focused on the nature of data disclosed to advertising platforms by websites that have configured third-party analytics tools like tracking pixels. Courts are split on whether the information disclosed by such pixels constitutes PII under the VPPA.
One federal district court in New York recently granted a defendant’s motion to dismiss VPPA litigation, noting that a defendant merely disclosing a user ID and the name of a visited webpage excludes “essential information for a VPPA claim”: the title of the requested video. Martin, No. 1:22-cv-04776-DLC, 2023 WL 2118074, at *3 (S.D.N.Y. Feb. 17, 2023). Without identifying a video title, any information identifying a person is not PII for purposes of the VPPA. Id.
However, most courts have denied motions to dismiss on this ground by reasoning that a plaintiff need only to allege that a tracking pixel discloses a user ID and that user ID is something an ordinary person can type into a website to identify an individual. See, e.g., Lebakken, No. 1:22-cv-00644-TWT, 2022 WL 16716151, at *4 (N.D. Ga. Nov. 4, 2022) (“[plaintiff] adequately alleged that [defendant] disclosed her [user ID] and email address in connection with her video viewing information to [advertising platform] and that the disclosure of such information constituted a disclosure of PII”); Czarnionka, No. 22-cv-06348, 2022 WL 17069810, at *3 (S.D.N.Y. Nov. 17, 2022) (finding similar allegations sufficiently plausible).
As litigation on this element results in more courts considering the merits of these cases and grappling with how the advertiser tracking pixels and other analytics software actually operate—rather than what is contained within four corner’s of a plaintiff’s complaint—it is possible that the split of authority will shift in favor of defendants upon factual findings that VPPA-type PII is not disclosed.
Courts have held that if a defendant “did not think it was conveying [personally identifiable information], then there could be no” knowing disclosure under VPPA. Bernardino v. Barnes & Noble Booksellers, Inc., No. 17-CV-04570-LAK-KHP, 2017 WL 3727230, at *9 (S.D.N.Y. Aug. 11, 2017), adopted by, 2017 WL 3726050 (S.D.N.Y. Aug. 28, 2017). Using this standard, website operators in pending VPPA litigations are frequently arguing that they cannot be liable under the VPPA because they did not know that a plaintiff’s PII was disclosed with third-party website analytics software.
However, many courts addressing the issue to date have allowed litigation to proceed past the motion to dismiss stage. For example, in Belozerov, the court rejected defendant’s argument that “plaintiff did not allege facts that [defendant] ever knew that users’ information was transmitted to [advertising platform]” based off the conclusory allegation in the complaint that “defendant . . . programmed [the advertising pixel and] knew that [it] disclosed Personal Viewing Information to [the advertising platform].” No. 22-cv-10838-NMG, 2022 WL 17832185, at *4 (D. Mass. Dec. 20, 2022).
Case law on this issue is expected to continue to evolve as more courts grapple with VPPA claims.
“Consumer” is defined in the statute as “any renter, purchaser, or subscriber of goods or services from a video tape service provider.” § 2710(a)(1). One question in current litigation is under what circumstances can a user of free services be considered a “subscriber” of those services and thus a “consumer” under the VPPA?
So far, several courts denied motions to dismiss where the user of a service created an account. For example, in Lebakken, the court held that plaintiff had adequately pleaded she was a “subscriber” because she pleaded that she did more than just download a free mobile application: “she exchanged her email address to receive [defendant’s] e-newsletter and that she also created her own [] account [with defendant].” No. 1:22-cv-644-TWT, 2022 WL 16716151, at *2 (N.D. Ga. Nov. 4, 2022).
Although other defendants in pending VPPA litigations have made arguments that a user’s account-less viewing of videos on a free website or app does not make the user a consumer under the VPPA, see, e.g., Ganaway v. Move, Inc., 1:22-cv-04859 (N.D. Ill. Nov. 7, 2022), ECF No. 19-1, but no courts have reached the issue yet.
Some defendants when confronted with claims under the VPPA have raised constitutional challenges to the statute, in addition to other defenses outlined above.
As a reminder, a litigant making a challenge to the constitutionality of a statute can make either a “facial” challenge or an “as-applied” challenge. In a facial challenge, the litigant must show that a substantial number of the statute’s applications are unconstitutional. How “substantial” applications of a statute are may be a fact-intensive question. In an as-applied challenge, the litigant must show that the application of the statute would be unconstitutional when enforced against the litigant. Defendant website operators have raised both type of challenges to the VPPA.
The Northern District of California recently held that a facial First Amendment challenge to the VPPA was “premature” at the motion to dismiss stage, but allowed the defendant to reassert its First Amendment challenge with the benefit of a more complete factual record later. Stark, No. 22-cv-03131-JCS, 2023 WL 2090979, at *15 (N.D. Cal. Feb. 17, 2023). Interestingly, in Stark the U.S. Department of Justice filed a brief defending the constitutionality of the VPPA, arguing that (i) the statute only regulates “commercial” speech that is subject to lesser protections under the First Amendment, that (ii) the statute does not apply to Defendants such as “news organizations, advocacy groups, or other entities whose mission is to publicize information of public import.” U.S. Memorandum in Support of the Constitutionality of the Video Privacy Protection Act, No. 3:22-cv-03131-JCS (N.D. Cal. Dec. 5, 2022), ECF No. 49-1.
In Stark, the court accepted defendant’s argument that the VPPA prohibited certain noncommercial speech, such as personal conversations of a video tape service provider. 2023 WL 2090979, at *11–13. “Since the VPPA implicates noncommercial speech by others besides [defendant], it is subject to overbreadth review to determine whether it substantially violates those potential speakers’ rights under the First Amendment.” Id. at *13. An overbreadth review under the First Amendment requires a factual analysis not suitable for a motion to dismiss, but after a more completely record, the court could hold that the VPPA is facially unconstitutional.
By contrast, another defendant named in VPPA litigation has elected make an as-applied challenge to the constitutionality of VPPA. Leslie, No. 1:22-cv-07936-JHR (S.D.N.Y. Jan. 18, 2023), ECF No. 23. In Leslie, the defendant news organization is arguing that the application of the VPPA to itself would be a violation of the First Amendment because it limits the distribution of sharing information of public interest. The defendant news organization is predictably pointing to the U.S.’s brief in Stark as recognition by the federal government that the VPPA would be unconstitutional as applied to the defendant.
The rise in VPPA claims brought against website operators is anticipated to continue, given the lack of clear consensus among the courts for how these claims should be handled (particularly at the pleadings stage without the factual record from discovery). As a result, as a matter of best practices and to mitigate litigation risk should assess and understand their use of third-party cookies and/or any other software technology being used to potentially monitor website traffic, particularly on websites with video content.
Privacy World will be there to keep you in the loop. Stay tuned.
Squire Patton Boggs (US) LLP has continued the growth of its globally recognized Data Privacy, Cybersecurity & Digital Assets and related litigation practices with the promotion of CPW’s Kristin Bryan and Kyle Fath to Partner.
Kristin Bryan is a litigation partner who is part of the firm’s Global Data Review-ranked data disputes practice. She has deep expertise representing clients in bet-the-company data privacy, cybersecurity and data breach disputes in federal and state courts nationwide. Kristin has obtained dismissals of multibillion-dollar privacy litigations where plaintiffs alleged that her client’s business practices violated federal and state privacy laws. She has litigated cases brought under the Electronic Communications Privacy Act (ECPA), the Video Privacy Protection Act (VPPA), the Driver Privacy Protection Act (DPPA), the Fair Credit Reporting Act (FCRA), the Computer Fraud and Abuse Act (CFAA) and the California Consumer Privacy Act (CCPA), as well as class actions asserting deceptive trade practice claims based on privacy practices. Kristin has also advised clients concerning claims brought under the Illinois Biometric Privacy Act (BIPA). Kristin is CIPP/US certified and Editor in Chief of Consumer Privacy World.
Kyle Fath is a partner in the firm’s globally preeminent Data Privacy, Cybersecurity & Digital Assets Practice. Companies across a broad spectrum of industries turn to Kyle for his in-depth and unique blend of experience in privacy compliance, technology transactions, and IP matters. A considerable portion of Kyle’s practice focuses on product counseling, in which he advises clients on the privacy, advertising, intellectual property, regulatory, and third-party risks associated with the development, operation, licensing, and other exploitation of technology, platforms, data, and other digital assets. As a go-to resource on emerging and complicated technologies, Kyle is an authority on the digital advertising ecosystem and the regulatory and industry challenges faced by advertisers, publishers, and AdTech companies. He also advises companies in the web3 and blockchain space, including having counseled dozens of brands, entertainment studios, gaming and e-sports companies, and prominent celebrities on various aspects of non-fungible token (NFT) drops.
Congratulations Kristin and Kyle!
As seasoned data privacy and biometric litigators are already aware, the United States does not have a comprehensive federal law regulating the collection, processing, disclosure, and security of personal information (“PI”)—typically defined as information that identifies, or is reasonably capable of being linked to, an individual. Rather, a patchwork of federal and state sectoral laws