While “Video Killed the Radio Star,"¹ class action suits under the Video Privacy Protection Act (VPPA) of 1988 are enjoying a revival. The ever-creative class action plaintiffs’ bar has seized on this archaic statute to bring suits against companies using widely available and commonly used online tracking tools, such as Meta Pixel, to analyze consumer habits for purposes of targeted advertising.

Tracking technology is ubiquitous and occurs nearly every time someone is on the internet. Plaintiffs’ counsel reap the rewards of statutory damages and potentially sizeable attorneys’ fee awards by filing class action lawsuits against media outlets and other companies in a vast array of industry sectors (recently including fast food chain Chick-fil-A) with an online presence that offer prerecorded video content.

What Is Meta Pixel?

Recently, scores of VPPA class action lawsuits have been filed regarding the Meta Pixel tracking tool. As explained by Meta Platforms, Inc. (formerly Facebook): “The Meta Pixel is a piece of code you put on your website that allows you to measure the effectiveness of your advertising by understanding the actions people take on your website.”² Also known informally as the Facebook retargeting pixel, Meta Pixel helps drive and decode key performance metrics generated by a particular platform. Specifically, the Meta Pixel helps businesses with a Facebook page determine and improve the return on investment from the world’s biggest social network.

The Meta Pixel can collect the following data:

• Anything present in HTTP headers: Includes IP addresses and information about the web browser, page location, document, referrer, and person using the website.

• Pixel-specific data: Includes Pixel ID and the Facebook Cookie.

• Button-click data: Includes any buttons clicked by site visitors, the labels of those buttons, and any pages viewed as a result of the button clicks.

• Optional values: Developers and marketers opt to send additional information about the visit through Custom Data events, such as conversion value, page type, and others.

• Form-field names: Includes website field names such as email, address, quantity, etc., when individuals purchase a product or service.³

VPPA Class Action Lawsuits

VPPA suits are typically filed in federal court since VPPA is a federal statute. Class actions may be filed against a variety of types of companies that host a website or app containing online video content. Suits are typically brought on behalf of a “class” of individuals, including customers, members, or subscribers of the defendant company.

A common VPPA complaint may allege that:

• The defendant company uses Meta Pixel (or similar tracking technology) to track individuals’ viewing habits and history.

• The defendant knowingly shares this information with Meta (or similar technology platforms) and/or other third parties.

• This information is shared by the defendant without plaintiffs’ written informed consent.

• The information (personally identifiable information, or PII) tracked and transmitted may include, among other data:

  • Title of the video(s) and/or webpages viewed

  • Individual users’ Facebook ID

  • Users’ email address.

Legal Defenses to VPPA Claims

Court decisions on motions to dismiss VPPA lawsuits at the pleading stage are a mixed bag. Fortunately for defendants, there are a number of potential legal challenges to these cases.

Defendant is not a “video tape service provider”

Some courts have held that the test for determining whether a defendant is a “video tape service provider” under the Act is whether they are “substantially involved in the conveyance of video content to consumers.” However, other courts have held that this might be a question of fact to be addressed after discovery has been conducted. Video tape service providers are not limited to content “creators,” and may include content “distributors” – including companies that deliver video content on their website or an app created by others. As a general rule, the broadcast of “live” videos falls outside the scope of VPPA. An e-newsletter that features video content might fall within the scope of the VPPA.

“Ordinary course of business” exception

The VPPA provides that a video tape service provider’s knowing disclosure of PII is permitted if “incident to the ordinary course of business.” It narrowly defines “ordinary course of business” as debt collection, order fulfillment, request processing, and transfer of ownership. In other words, a video tape service provider that shares PII with a third party to perform any such functions will likely fall within the exception, regardless of whether a consumer’s prior written consent was obtained. Notably, some courts have held that disclosing PII to third parties (such as Google or Facebook) to measure analytics and increase advertising revenues does not fall within the “ordinary course of business” exception.

Plaintiffs are not “consumers”

Defendants may challenge the plaintiff’s classification as a “consumer” under the VPPA by arguing that the plaintiff did not “rent, purchase, or subscribe to goods or services” offered by the defendant in connection with video services. Some courts have adopted a multifactor test to determine whether someone is a “subscriber.” A subscriber relationship may include some sort of ongoing commitment or relationship between the user and the entity that owns and operates an app, website, etc. For instance, a subscriber relationship may exist when an individual pays, registers, or otherwise obtains access to restricted content offered by the defendant.

Importantly, however, a financial payment is not a prerequisite to qualify as a subscriber under the VPPA. Courts have recognized that users often sign up or register for complimentary content. For example, providing an email address in exchange for receiving free content and/or creating an online account might be sufficient to qualify as a “subscriber” under the VPPA. However, merely downloading a free smartphone application and watching videos at no cost does not automatically constitute a subscription.

No disclosure of PII

With respect to the disclosure of PII, such information must permit an “ordinary person” to identify a specific individual’s video-watching habits. Courts have held that PII is not limited to information that explicitly names a person and may include other unique identifiers. For example:

• A device serial number may not constitute PII because it is not sufficient for an ordinary person to identify a specific individual.

• GSP coordinates or geolocation of an individual at the time they are viewing video content might support a VPPA claim.

• Facebook ID might constitute PII because anyone who possesses one may use it to “quickly and easily locate, access, and view the corresponding Facebook profile,” which in turn can reveal a user’s name or other personal information.

One court recently held that the disclosure of a plaintiff’s Facebook ID and the name of the webpage(s) accessed is insufficient to state a claim under the VPPA without specifying the video content viewed. Merely disclosing the name of the webpage does not necessarily indicate that an individual requested or obtained specific video materials – even if the page did include some video content.

No “knowing disclosure” of PII to a third party

Some defendants have attacked VPPA claims on the basis that they did not make a “knowing disclosure” of PII to any third parties. However, to survive a motion to dismiss, a complaint need only allege that the defendant knew that the tracking pixel disclosed PII to a third party such as Facebook. One court recently held that whether a defendant or Facebook placed a tracking pixel on the website to collect PII is a question of fact to be decided at a later stage of the proceeding.

Conclusion

At least for the foreseeable future, it appears that plaintiffs intend to continue their fast and furious filings of VPPA class action lawsuits until more courts are willing to dispose of these cases at the pleading stage. To avoid potentially sizeable statutory damages awards, defendants should assess the tracking tools they use with respect to any prerecorded video content, and explore the possibility of requiring individuals to provide informed written consent by separately registering for access to such content.

^{1 "Video Killed the Radio Star" is a song written by Trevor Horn, Geoff Downes and Bruce Woolley in 1979.
2  https://www.facebook.com/business/help/742478679120153?id=1205376682832142.
3  https://developers.facebook.com/docs/meta-pixel/.}