In another ruling that adopts a narrow reading of the term “personally identifiable information” (“PII”) in the Video Privacy Protection Act (“VPPA), a New York district court held in Robinson v. Disney Online that a plaintiff failed to plead a VPPA claim against Disney based on Disney’s sharing a device ID and viewing information with a third party.

Plaintiff Robinson used a Roku, a video-streaming set-top box, to watch Disney videos on Disney’s Roku channel.  Each Roku device has a “Roku ID,” a unique serial number assigned to the device itself.  Robinson alleged that Disney sent a record of the videos he watched on its channel, along with a hashed version of his Roku ID, to Adobe, a third-party analytics company.  Adobe allegedly had the capability to use aggregated consumer data from various sources to identify users based on their hashed Roku IDs.  Robinson sued Disney under the VPPA.

The VPPA creates a cause of action against video service providers for knowingly disclosing consumers’ PII and video-viewing information to third parties without consumers’ consent.

A critical question under the VPPA is what constitutes PII.  The statute provides that names and home addresses are PII, but it is an open question whether other types of data, like unique device IDs, also count.  Although some courts have ruled that a unique device ID, plus GPS information, can be PII (and thus actionable under the VPPA when accompanied by video-viewing information), most courts have adopted a narrower approach, ruling that such information, without more, cannot be PII if subsequent combination with other information is necessary to identify a consumer.

Following this majority, the Robinson court ruled that PII may only be defined as “information which itself identifies a particular person as having accessed specific video materials.”  Even assuming that Adobe had actually identified Robinson, the court rejected Robinson’s argument that subsequent combination of different pieces of information to identify a person can render a lone device ID PII.  The court distinguished the lone Roku ID from the PII inherent in a person’s name or home address, or in an online identifier that itself stands in for a specific person, unlike a device ID.

However, the court explained that outcome might be different if other information is disclosed by the video service provider that would enable a third party to identify the specific device’s user, such as a correlated decryption table.

Although almost all of the recent VPPA decisions construing the meaning of PII covered under the statute are now on appeal, the decision in Robinson v. Disney Online is another clear decision in favor of a common-sense interpretation of the term.