The 1988 Video Privacy Protection Act (VVPA) prohibits the disclosure of VHS rental history; now, in a recent class action where the VPPA was invoked by the plaintiffs, the parties’ voluntary settlement signals developments related to this outdated privacy law.

A class of plaintiffs claimed that the NFL’s New England Patriots mobile sports application unlawfully and without authorization misappropriated personal information by sharing users’ video viewing data and geolocation without notice. Although the VPPA has been interpreted broadly to apply to digital programming, courts still wrestle with its applicability to modern technology. For example, the U.S. Court of Appeals for the Second Circuit previously narrowed the law’s applicability to include only video data that indicated a consumer’s viewing habits.

The key legal issue in the Patriots’ case was that, although the Patriots were not directly responsible for handling the data collected through the app, the team remained liable for third-party tools and plug-ins, especially those sharing personal information without consent. In addition to the VPPA, the plaintiffs also relied on the California Invasion of Privacy Act, the Illinois Biometric Information Privacy Act, and several general state and federal consumer protection statutes.

The sports industry is just another sector affected by the expansiveness of digital programming. Whether it is professional sports teams, arenas, or streaming channels, a strategy for handling personal information can serve both defensive and offensive roles for companies deploying fan interactive software.

Organizations may wish to consider the below actions:

• Following the data, and understanding its flow through internal systems.
• Drafting informative policies where consent is informed and specific with respect to data use and data type.
• Implementing Data Processing Agreements (DPAs) with vendors that are clear and require reasonable security measures.
• Vetting vendors to ensure third parties have been subject to privacy and cybersecurity due diligence.
• Looking for tools with transparent practices and security certifications.
• Reviewing standard procedures and vendor performance periodically.

The voluntary settlement of this class action settlement underscores the continued vitality of legacy privacy laws like the VPPA in today’s digital landscape. Despite being rooted in an era of VHS tapes, the statute’s broad interpretation and application to mobile and streaming technology reveal the legal risks organizations face when user data is shared, intentionally or otherwise. As courts and regulators expand the scope of older privacy statutes, companies must remain vigilant in how they collect, use, and disclose personal information.

For sports franchises and other businesses leveraging digital engagement platforms, this case serves as a reminder that data privacy is no longer a back-office compliance function: it is a strategic imperative. Adopting robust data governance practices, auditing vendor relationships, and proactively addressing privacy concerns can help organizations avoid costly litigation and preserve consumer trust in an increasingly connected world.

This post was co-authored by Mark Abou Naoum, Summer Associate. Mark is not admitted to practice law.