WHAT YOU NEED TO KNOW IN A MINUTE OR LESS

Plaintiffs are making new use of an old statute, the Video Privacy Protection Act (VPPA), to challenge the use of pixel technology across a variety of websites that provide online video content. The VPPA was enacted in 1988 to protect the video viewing histories of customers of brick-and-mortar video rental providers. Over the years, litigants have sought to extend the VPPA to streaming services and, more recently, to any site offering video content, with consumer products companies, university sports programs, and health services websites as recent targets. 

In the last year, more than 80 VPPA class action lawsuits have been filed, asserting that the pixel tool use violates the VPPA by tracking a user’s viewing history and other protected personal information. Early rulings in these lawsuits have been a mixed bag, although some recent defense wins suggest viable strategies for associated risk mitigation. 

In a minute or less, here is an overview of this litigation trend. 

What Does the VPPA Do?

Under the VPPA, a “video tape service provider” is liable to any “consumer of such provider” for the knowing disclosure of the consumer’s personally identifiable information (PII) without the consumer’s written consent, subject to certain exceptions. 

Courts may award consumers US$2,500 in liquidated damages per violation—or actual damages if more—as well as punitive damages, reasonable attorney fees, litigation costs, and other equitable relief the court deems appropriate. 

Why Does It Matter?

The latest iteration of VPPA litigation makes a target of any website operator both offering video content and deploying pixel tools. Courts have held that plaintiffs need not purchase a subscription or product from a website operator to assert a VPPA claim. This has opened the door to serial litigants, who visit and review video content on multiple websites that deploy pixel tools, then serve demand letters or file suits asserting VPPA claims against the websites’ operators. 

The theoretical exposure under the VPPA can be substantial, given the availability of liquidated damages on a classwide basis, as well as punitive damages, attorney fees, and the potential for related claims under state wiretapping statutes.

What Defenses Are Available?

Defendants caught in this most recent wave of VPPA litigation have asserted a variety of defenses with mixed outcomes. Two threshold defenses have met with particular success: 

1. The website operator is not a videotape service provider subject to the VPPA; and
2. The plaintiff is not a consumer within the meaning of the VPPA. 

The first defense is most useful for companies whose primary business does not involve video content. Courts generally limit the VPPA’s reach to businesses and websites substantially involved in the conveyance of video content to consumers. For example, a VPPA lawsuit has been allowed to proceed against a gaming and entertainment website, which “hosts prerecorded video streaming content.”¹

By contrast, a VPPA lawsuit against General Mills was dismissed on the ground that the company’s business was making “cereals, yogurts, cake mixes, dog food, and other products,” with online videos produced only “as a peripheral part of its marketing strategy.”²

The second defense recognizes that the VPPA does not extend to the casual website visitor, but only to a consumer who rents, purchases, or subscribes to the site operator’s goods or services. Defendants have successfully dismissed VPPA claims where plaintiffs failed to adequately allege either a relationship with the business (such as registration or a subscription commitment) or access to restricted content. Courts have declined to advance cases where a plaintiff had only visited a website or downloaded a free application to view video content.

Plaintiffs must also allege a relationship between the subscription and the video content. Three courts recently dismissed VPPA cases for plaintiffs’ failure to allege that their newsletter subscriptions were related to or were required for access to video content.³

There are multiple critical defenses beyond these threshold pleading issues, including whether the pixel tool actually captures PII, as that term is defined by the VPPA. In most, but not all jurisdictions, courts use an “ordinary person” standard to determine whether the shared data can identify a person. The First Circuit, by contrast, has adopted a more expansive view of PII under the VPPA, finding that GPS coordinates and a device identifier amount to PII.⁴ This makes district courts within the First Circuit a particular hotbed for VPPA litigation based on the deployment of pixel technology. 

What Can Companies Do?

These recent VPPA decisions provide some guidance for compliance-minded companies to mitigate risk while displaying online content that website users demand. Pixel and other similar technologies can be tailored to minimize the PII they collect or disclose. Where a website may legitimately be subject to the VPPA’s restrictions, obtaining written consent for the sharing of data may be appropriate. Notably, the VPPA requires separate and distinct consent, and website operators may not be able to rely on privacy policies alone. 

Companies also may wish to evaluate the arbitration provision (including class action waivers) in their subscriber agreements or in other terms under which users access video content. We will explore these options in the context of specific industries in future installments.

¹ Jackson v. Fandom, Inc., No. 22-CV-04423-JST, 2023 WL 4670285, at *3 (N.D. Cal. July 20, 2023).

² Carroll v. Gen. Mills, Inc., No. CV231746DSFMRWX, 2023 WL 4361093, at *3 (C.D. Cal. June 26, 2023).

³ Carter v. Scripps Networks, LLC, --- F. Supp. 3d ----, No. 22-cv-02031 (PKC), 2023 WL 3061858, at *3 (S.D.N.Y. Apr. 24, 2023); Salazar v. Paramount Glob., No. 3:22-CV-00756, 2023 WL 4611819, at *11 (M.D. Tenn. July 18, 2023); Salazar v. Nat’l Basketball Ass’n, No. 1:22-CV-07935 (JLR), 2023 WL 5016968, at *9 (S.D.N.Y. Aug. 7, 2023).

⁴ See Yershov v. Gannett Satellite Info. Network, Inc., 820 F.3d 482, 486 (1st Cir. 2016).