Be Kind, Don’t Rewind: The VPPA’s Reemergence in Privacy Class-Action Litigation

Updates

March 28, 2023

Be Kind, Don’t Rewind: The VPPA’s Reemergence in Privacy Class-Action Litigation

After years out of circulation, class-action lawsuits asserting claims under the Video Protection Privacy Act (VPPA) are now back in reruns. But early critical assessment is mixed, so it remains to be seen whether VPPA-driven class actions are ready for prime time. A spate of litigation alleges that website publishers that share information with Facebook through the Meta pixel implicate the VPPA. The Meta pixel is a web cookie that tracks user activities across third-party sites and sends the information back to Meta to carry out site analytics and target ads. More than 100 complaints filed in the past year claim that Meta pixels on pages with video content may violate the VPPA because they relay information to Facebook that reveals which online videos a specific user has viewed and links those videos to the user's Facebook identifier. The law appeals to plaintiffs because, in addition to actual damages, it includes statutory damages of $2,500 per violation, opening up the possibility for claims seeking large settlements when VPPA cases are brought as putative class actions and then applied to widely used tracking cookies.

The VPPA's Enactment and the Bork Tapes

The VPPA is perhaps best known for its unusual back story. In 1987, during Robert Bork's highly publicized U.S. Supreme Court confirmation hearing, Washington City Paper published an article entitled "The Bork Tapes," surveying nominee Bork's video rental history, leaked by a video rental store clerk. Though the list of Judge Bork's 146 videotape rentals proved to be more banal than scandalous (e.g., Citizen Kane, Footloose), the article invited ire on the part of Bork himself, the public, and Reagan-era policymakers on both sides of the aisle, who decried the publication as "Big Brother." Congress responded by enacting the VPPA the following year, and in 1988, the VPPA became one of the first U.S. federal privacy laws.

The substance of the resulting law proved to be just as particularized as the circumstances that spawned it. While the VPPA banned the knowing disclosure "to any person, [of] personally identifiable information concerning any consumer," legislators limited its application to "Video Tape Service Providers" that provide "prerecorded video cassette tapes and similar audio visual materials." The VPPA also defined personally identifiable information (PII) narrowly, to include information that both identifies a consumer and links that consumer to "specific video materials or services" from a Video Tape Service Provider.

As the manner in which people consumed video content evolved, so too did the potential considerations raised by the VPPA. In 2013, as rising tech company Netflix was launching its streaming service, it successfully lobbied Congress for an exception that allowed for the disclosure of VPPA-covered PII with a consumer's consent, unlocking new possibilities for the social sharing of viewing information. Under this amendment, the consent had to be "distinct and separate" from other legal and financial obligations.

Early VPPA Litigation

As video streaming services grew in prominence and number, the mid-2010s saw a raft of VPPA-based litigation involving the disclosure of video information through pixels embedded in websites or applications. Those lawsuits culminated in three generally defendant-friendly circuit court holdings, providing that in order for device identifiers to qualify as PII for VPPA purposes, the device identifiers must be ones that an ordinary person could "reasonably and foreseeably" associate with a person's real-life identity. See In re Nickelodeon Consumer Priv. Litig., 827 F.3d 262 (3d Cir. 2016) and Eichenberger v. ESPN, Inc., 876 F.3d 979 (9th Cir. 2017). While the U.S. Court of Appeals for the Fifth Circuit found that identifier-based sharing could meet this standard, it took care to note that, in doing so, it was not departing from this standard, finding that the collection of precise geolocation information along with a device identifier "would enable most people to identify" an individual. See Yershov v. Gannett Satellite Info. Network, Inc., 820 F.3d 482, 489 (1st Cir. 2016).

These holdings quelled VPPA litigation for several years. However, in early 2022, plaintiffs began to file new cases against a wide variety of website publishers, alleging that they had shared PII without consent, in violation of the VPPA. According to the complaints, the website publishers qualified as Video Tape Service Providers because their websites featured video content, and they shared information about which videos consumers had watched through their use of the Meta pixel. Since 2022, 115 lawsuits have been filed alleging violations of the VPPA by online news outlets, streaming services retailers, and other defendants, almost all of which are based on use of the Meta pixel. The lawsuits allege that the information shared through the Meta pixel can be used to find a public Facebook page and thus to identify the consumer in question.

These cases—nearly always filed as putative class actions—are in their early stages, and there are no binding appellate rulings on the merits regarding the scope of the VPPA in this context.

Some district courts, however, have issued interstitial decisions that suggest attempts to limit the reach of these cases. For example, courts have held that "live" video streams are not covered by the VPPA—only prerecorded material. See Stark v. Patreon, Inc., — F. Supp.3d —, 2022 WL 7652166, at *6 (N.D. Cal. Oct. 13, 2022) (holding that "live broadcasts" are not covered by the VPPA, only prerecorded video content); accord Louth v. NFL Enterprises LLC, 2022 WL 4130866, at *4 (D.R.I. Sept. 12, 2022) (same). And courts have likewise refused to accept boilerplate allegations that the plaintiffs' PII, particularly the content they viewed, was disclosed. Instead, those facts must be pled with specificity. See Martin v. Meredith Corporation, 2023 WL 2118074 (S.D.N.Y., Feb. 17, 2023). But the basic theory that the operation of the Meta pixel can result in the disclosure of the plaintiff's PII has been treated as viable—at least with sufficiently specific allegations. See, e.g., Ambrose v. Boston Globe Media Partners LLC, 2022 WL 4329373 (D. Mass., Sept. 19, 2022) (district court denied the defendant's motion to dismiss, stating that the plaintiff had sufficiently alleged the Globe transmitted PII to Facebook).

Given the recency of the filings and the few resulting decisions, any prediction about the ultimate adequacy of the theory is premature. Other courts may view the pleadings differently, and even if the plaintiffs survive Rule 12 motions to dismiss, such victories are not necessarily an indicator of long-term viability.

For example, in Stark v. Patreon, one of the first of the pixel-related VPPA cases to reach a decision on motion to dismiss, a California court declined to dismiss the plaintiffs' VPPA claims on First Amendment grounds, but explained that the argument may have merit when considered on a full factual record. See Stark v. Patreon, Inc., 2023 WL 2090979 (N.D. Cal. Feb. 17, 2023). The defendant in Stark argued that the VPPA has the potential to restrict—and thus impermissibly chill—protected noncommercial speech. The court agreed, noting just one example of potential overbreadth that the VPPA could hypothetically be construed to impose civil liability on video store clerks casually discussing a customer's rental history. While seeming to agree with these and other concerns, the court ultimately ruled that the First Amendment analysis was too fact intensive to resolve on the pleadings. But it specifically noted that the defendant could "reassert[] its constitutional challenge on a factual record." Id. at *15. The constitutional arguments in Stark may yet serve to stem or slow the recent growth of VPPA lawsuits.

Next Steps

It remains too soon to tell what the most recent wave of VPPA litigation will mean, either for sharing via the Meta pixel or with other companies where the ability to look up a public profile page is not alleged. And, though indeterminate, the Stark court's holding paved the way for a possible successful challenge to the constitutionality of the law. In the meantime, web publishers and application developers that include video content should consider the pending litigation as a lesson in both the importance of, and challenges to, complying with a growing patchwork of state, federal, and international privacy laws that can apply to a single data processing activity. This is particularly important given the early indications that courts are willing to stretch concepts—like that of a Video Tape Service Provider—to modern contexts, even where they are an imperfect fit. The sharing instances alleged in these recent cases are both ubiquitous and a far cry from the Washington City Paper article that led to the VPPA's passage; nevertheless, depending on pending court decisions, they may be caught up in the law's rerun.