"Stranger Things" has made many of us think back on the days when we waited at Blockbuster to pick the latest release of our favorite movies, sometimes at the return dropbox. And the use of the term "Borked" has probably not been thought of much lately since Oxford added it to the dictionary.

But plaintiffs counsel have caused many to reconsider both of these periods in time as they push forward with Video Privacy Protection Act, or VPPA, [1] litigation against companies with videos on their website that use common advertising technology data tools.

The VPPA was enacted in 1988 in direct response to the disclosure of U.S. Supreme Court nominee Robert Bork's videotape rental history during his confirmation hearings.

The VPPA, which prohibits a "video tape service provider" from "knowingly" disclosing "personally identifiable information concerning any consumer of such provider," was written when the Internet was still in its infancy — and certainly before the act's drafters knew anything about advertising technology or cookies.

Accordingly, few have thought about the VPPA since streaming services have put videotape rentals stores out of business. That has all changed.

Starting with the In re: Hulu Privacy Litigation case in the U.S. District Court for the Northern District of California in 2012, courts have applied the VPPA beyond brick and mortar stores to streaming services and websites that offer online videos. [2]

The VPPA's hefty penalties including statutory liquidated damages, punitive damages and reasonable attorney fees, have made this otherwise dormant statute the focal point of class actions against many companies that have websites that contain videos and targeted advertising.

This article discusses some of the recent case law on the VPPA, touchpoints we see in the cases and action items for companies that offer videos on their website to consider in their ongoing efforts to ensure compliance with the VPPA and reduce the risk of litigation.

Clarifying the Consumer

The VPPA applies to a consumer, which is defined as "any renter, purchaser, or subscriber of goods or services from a video tape service provider." [3] "Renter," "purchaser" and "subscriber" are undefined by the statute. While "renter" and "purchaser" seem to have fairly straightforward meanings, [4] the contours of "subscriber" is still unsettled.

For example, in Yershov v. Gannett Satellite Info. Network Inc., the U.S. Court of Appeals for the First Circuit held in 2016 that the plaintiff was a subscriber because he installed the defendant's app to view videos in exchange for providing his personal information. [5]

The provision of the consumer's personal information established a relationship with the defendant that was materially different from a consumer who views the defendant's videos through a web browser.

In Austin-Spearman v. AMC Network Entertainment LLC, the U.S. District Court for the Southern District of New York held the plaintiff was not a subscriber in 2015. [6] There, the plaintiff did not sign up for the defendant's content, register for an account, establish a user ID or profile, or download an app or program.

Citing the Oxford English Dictionary, the court stated:

Conventionally, "subscription" entails an exchange between subscriber and provider whereby the subscriber imparts money and/or personal information in order to receive a future and recurrent benefit, whether that benefit comprises, for instance, periodical magazines, club membership, cable services, or email updates.

While some courts have held that the provision of personal information may be sufficient to satisfy the definition of subscriber, the required type and circumstances of providing personal information is unsettled.

Characterizing PII Under the Statute

Another significant issue involves the scope of personally identifiable information, or PII, under the VPPA. The VPPA defines PII as "information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider."

Courts seem to agree that PII is not restricted to just a user's name and address [7], but beyond that recognition, there is significant disagreement. There are at least two schools of thought as to what information constitutes PII.

The first school of thought is the U.S. Court of Appeals for the Third Circuit's "ordinary person" approach, which looks to whether the information alone would "readily permit an ordinary person to identify a specific individual's video-watching behavior." [8]

The second is the First Circuit's broader approach in Yershov, which considers PII to encompass any "information reasonably and foreseeably likely to reveal" the videos a user obtains or watches and is passed along to third parties. [9]

The ordinary person approach has appeal because of the context in which the statute was passed — Judge Bork's Blockbuster video viewing history was provided to a reporter, and the reporter is clearly an "ordinary person" in colloquial English.

Nonetheless, there are at least two potential issues with the ordinary person approach — first, there is no agreement on who or what is an ordinary person, and second, the ordinary person approach potentially moves away from the text of the statute, which does not contain those terms.

The First Circuit's approach also has potential issues with its application. In Ellis, the First Circuit concluded two sets of specified GPS coordinates in conjunction with information about the consumer's video viewing history was sufficient to constitute PII "[g]iven how easy it is to locate a GPS coordinate on a street map." This conclusion raises several concerns, including:

• What if the consumer lived in an apartment building, or used a proxy to hide their IP address or engage a geo blocker?

• What if the consumer viewed videos while at work in an office building?

• Or, what if a consumer visiting a friend on a country farm viewed a video from the consumer's own device or stayed at an Airbnb?

In none of these scenarios would GPS coordinates likely identify the consumer, or at least the correct one.

Ultimately, the application of the VPPA to digital advertising remains murky at best. Although many recent filings [10] involve plaintiffs alleging that advertising technology companies collect and share personal information with third parties through cookies and/or pixels, there does not seem to be a consensus of whether this type of information definitively qualifies as PII under the VPPA.

At least for now, we can expect a patchwork of holdings among the circuit and district courts.

Mitigating Risks

With the widespread use of advertising technology, and the potential for $2,500 in statutory liquidated damages, not including punitive damages and attorney fees, VPPA litigation is here to stay.

Companies that use advertising technology and display videos on their websites should revisit their use of cookies and their privacy policies to ensure compliance with the statute. Some initial steps to take include:

1. Inventory video assets.

2. Determine whether videos are associated with subscribers.

3. Determine if this information is shared.

4. Determine the specific data elements shared and their purpose.

5. Analyze the shared data to determine if it constitutes PII under the VPPA's unique definition.

6. If the shared data may constitute PII under the VPPA, consider what actions might be needed such as consent or changing the information shared with third parties.

[1] 18 U.S. Code § 2710.

[2] No. C 11-03764 LB, 2012 WL 3282960, at *6 (N.D. Cal. Aug. 10, 2012).

[3] 18 U.S. Code § 2710(a)(1).

[4] See e.g., In re Vizio, Inc., Consumer Priv. Litig., 238 F. Supp. 3d 1204, 1223 (C.D. Cal. 2017).

[5] 820 F.3d 482 (1st Cir. 2016).

[6] 98 F. Supp. 3d 662, 669 (S.D.N.Y. 2015).

[7] 820 F.3d at 486.

[8] In re Nickelodeon Consumer Priv. Litig., 827 F.3d 262, 284 (3d Cir. 2016); Eichenberger v. ESPN, Inc., No. C14-463 TSZ, 2015 U.S. Dist. LEXIS 157106, at *15-16 (W.D. Wash. May 7, 2015).

[9] 820 F.3d at 486.

[10] See Ganaway v. Warner Bros. Discovery, Inc, Case No. 1:22-cv-04929. See also, Wright v. Buzzfeed, Inc., Case No. 1:22-cv-04927; Parcell v. Paramount Global, Case No. 1:22-cv-03666.

Published in Law360 on October 19, 2022. © Copyright 2022, Portfolio Media, Inc., publisher of Law360. Reprinted here with permission.