“VPPA Is No Dinosaur Statute” – Second Circuit Breathes New Life Into Federal Video Privacy Protection Act

“Our modern means of consuming content may be different, but the Video Privacy Protection Act (“VPPA”)’s privacy protections remain as robust today as they were in 1988,” wrote Second Circuit Judge Beth Robinson in the Court’s recent opinion reinstating Plaintiff Michael Salazar’s putative class action against the National Basketball Association. Though the Second Circuit cautioned that its ruling in Salazar is narrow, the impact of the Salazar decision on VPPA litigation nationwide will likely be anything but.

What is the VPPA?

The VPPA is a federal statute enacted in 1988 in response to the disclosure of then-Supreme Court nominee Robert Bork’s video rental history by a local Washington D.C. publication. To address the wrongful disclosure of this type of information, the VPPA prohibits any “video tape service provider” from disclosing a consumer’s viewing habits without a consumer’s written request. The statute includes a $2,500 per violation liquidated damages provision and a private right of action, allowing consumers to sue businesses directly for violations of the VPPA.

Recent years saw a large uptick in VPPA filings and mass arbitrations against businesses whose websites include online video content. These filings targeted not just video streaming platforms, but a host of ecommerce brands, restaurant chains, professional sports organizations, and media companies.

In contrast to other consumer privacy litigation, however, VPPA claims saw higher dismissal rates and individual settlements. District courts closely scrutinized whether a business was a “video tape service provider,” with some courts holding that if a company’s business model was not significantly tailored to delivering video content on its website, it would not qualify. Elsewhere, courts dismissed VPPA claims where the video content was live, and not pre-recorded, or where allegations regarding the type of personally identifiable information (PII) collected were vague and undefined. Towards the end of 2023, VPPA federal court filings began to dwindle.

But, the Second Circuit Court of Appeals may have breathed new life into this old statute with its decision in Salazar. 

The Salazar Decision: Subscriber Status

Another issue VPPA litigation contends with is who is considered a consumer. The VPPA narrowly defines “consumer” as “any renter, purchaser, or subscriber of goods or services from a video tape service provider.” Because most businesses targeted in VPPA litigation do not allow individuals to rent or purchase video content, plaintiffs instead focus on alleging their “subscriber” status to satisfy this element of a VPPA claim.

Courts have dismissed VPPA claims after finding that the plaintiff did not qualify as a “subscriber” under the statute. While courts generally do not require a plaintiff to allege that they paid money to the business to be considered a subscriber, there were conflicting judicial interpretations on the degree of engagement that a plaintiff must have with a business to be considered a consumer. Courts have struggled with whether downloading a business app, signing up for a newsletter, or otherwise providing the business with PII, is enough to be considered a “subscriber” under the VPPA.

The plaintiff in Salazar alleged that he visited the NBA’s official website (NBA.com) and signed up for the NBA’s free online newsletter. Then, Salazar alleged that he watched videos on the Website and his video-viewership history was disclosed via a tracking pixel to Facebook, without his consent, in violation of VPPA.

In granting the NBA’s Rule 12 motion, the United States District Court for the Southern District of New York held that Salazar had pleaded an injury that conferred Article III standing to pursue his claim, but that he was not a “consumer” under the VPPA in part because the NBA’s online newsletter was not a “good or service.”

But, on Oct. 15, the Second Circuit reversed the District Court’s decision on the merits.

According to the Second Circuit:

“The VPPA’s text, structure, and purpose compel the conclusion that that phrase is not limited to audiovisual ‘goods or services,’ and the NBA’s online newsletter falls within the plain meaning of that phrase. By trading personal information like his email and IP addresses in return for receiving the online newsletter, Salazar became a ‘subscriber of’ that newsletter.”

The Second Circuit included in its decision a lengthy discussion of the origin of the VPPA, including the Act’s original legislative history and 2012 amendment, which provided the basis for the collection of online consent from a consumer. From its analysis of the text, structure, and purpose of the VPPA, the Second Circuit adopted an intentionally broad reading of the VPPA’s relevant definitions at issue. Specifically:

• “Goods and Services:” The Second Circuit held that the use of the word “any” in the statute’s definition of consumer as “any renter, purchaser, or subscriber of goods and services” was intentionally expansive. And, by limiting other parts of the statute to audiovisual content, but not limiting the goods and services definition in this way, signaled Congress’s intent to convey a broader meaning to this term.
• “Subscriber:” The Second Circuit agreed with other circuit courts that someone does not need to spend money to be a subscriber under the VPPA. The Second Circuit then determined that by “trading” and “exchanging” his information with the NBA, specifically his IP address, email address, and device information, made Salazar’s relationship with the NBA “distinct from its relationship with casual NBA.com video-watchers who had not signed up for the newsletter.” This distinction was enough, at the pleading stage, to make Salazar a “subscriber” under the VPPA.

While the Second Circuit concluded its decision by noting that its “ruling is narrow,” the impact of the Salazar holding on VPPA litigation in the Second Circuit and beyond will likely not be.

From the plaintiffs bar perspective, this decision provides clarity that prospective plaintiffs need only sign up for a newsletter or otherwise engage in a business in a way that is “distinct” from how other website watchers engage, to satisfy this element of the claim. And, this “distinct” form of engagement may include the collection of basic information such as only an IP address, email address, and device ID – the type of information that is commonly collected by businesses for marketing and other campaigns.

Considerations for Businesses

The VPPA is a rapidly developing area of law, and continued monitoring of VPPA caselaw is critical. Additionally, businesses should be aware that VPPA claims are just one type of consumer privacy claim concerning the collection and disclosure of online information through the use of tracking technologies. We continue to see a high volume of California Invasion of Privacy Act (CIPA) and federal wiretap filings concerning search bars, chatbots, session replies, and other technologies.

At a minimum, website operators that use tracking technologies or have embedded videos should take steps to limit potential class action exposure. This includes:

• Evaluating and limiting the use of pixels and other tracking technologies to pages without video content
• Making sure pixels and cookies are properly configured and classified, including potentially to avoid sharing personally identifiable information with third parties
• Updating cookie preference centers, or similar mechanisms, to collect separate consent from users prior to disclosing video-watching data or where signing up for a newsletter, text blast, or other marketing lead
• Updating the website privacy policy to accurately disclose whether personally identifiable information is disclosed to third parties, and how that personally identifiable information is used
• As VPPA claims in particular are brought as mass arbitrations, updating arbitration and class action waiver provisions to minimize risk of mass arbitration claims.

Clark Hill Cyber, Privacy, and Technology team is able to advise on consent policies and practices, including technology website assessments and reviews.

The case is Salazar v. Nat’l. Basketball Assn., No. 23-1147, 2024 WL 4487971, *16 (2d Cir. Oct. 15, 2024).

This publication is intended for general informational purposes only and does not constitute legal advice or a solicitation to provide legal services. The information in this publication is not intended to create, and receipt of it does not constitute, a lawyer-client relationship. Readers should not act upon this information without seeking professional legal counsel. The views and opinions expressed herein represent those of the individual author only and are not necessarily the views of Clark Hill PLC. Although we attempt to ensure that postings on our website are complete, accurate, and up to date, we assume no responsibility for their completeness, accuracy, or timeliness.