Over the past year, website operators have experienced a proliferation of lawsuits under the Federal Video Privacy Protection Act (“VPPA”), a Reagan-era statute prohibiting the nonconsensual disclosure of an individual’s video tape rental history. Despite its nondigital origin, litigation under the VPPA has successfully targeted the ubiquitous use of tracking technologies on businesses’ websites, creating a risk of significant class-action damages under VPPA’s $2,500 per violation statutory-damages clause. Read on for more details about the risk of litigation under the VPPA and how best to avert it.
Enacted in 1988, the VPPA arose from bipartisan antipathy towards the publication of Supreme Court nominee, Robert Bork’s video rental history during his confirmation hearing. Reflecting this highly particular origin, the VPPA, codified as 18 U.S.C. § 2710 (and statutorily entitled “Wrongful Disclosure of Video Tape Rental or Sale Records”), provides a private cause of action against a “video tape service provider who knowingly discloses, to any person, personally identifiable information” which “identifies a person as having requested or obtained specific video materials or services.” 18 U.S. Code § 2710(a), (b). Although ostensibly confined to antiquated media, the VPPA’s definition of “video tape service provider” as a person “engaged in the business . . . of rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials,” has permitted a modern interpretation. Beginning in 2022, a flood of litigation under the VPPA has targeted video content featured on websites that employ tracking technologies, like Google Analytics and Meta Pixel, which plaintiffs argue have the effect of disclosing identifiable information about the user’s video consumption to third parties.
Notwithstanding the tenuous analogy between renting videos and consuming online content, courts have been receptive to VPPA suits of this kind, and have adopted plaintiff-favorable standards. For example, to determine whether a defendant is “engaged in the business” of video delivery, courts amorphously analyze whether the defendant’s product “is substantially involved in the conveyance of video content to consumers [and] significantly tailored to serve that purpose.” E.g., Stark v. Patreon, Inc., No. 22-CV-03131-JCS, 2022 WL 7652166, at *7 (N.D. Cal. Oct. 13, 2022). On this basis, any website that features video content arguably renders its owner a “video tape service provider” and, regardless, the fact-intensive nature of the inquiry has been deemed incompatible with a motion to dismiss. Id. (“[I]t is reasonable to think that developing a website to deliver video content requires [some] significant ‘tailor[ing] to serve that purpose.’”).
In addition, courts have accepted that the mere use of Meta Pixel is sufficient to demonstrate, for purposes of a motion to dismiss, that a website has disclosed users’ “personally identifiable information” to Facebook. E.g., Belozerov v. Gannett Co., No. CV 22-10838-NMG, 2022 WL 17832185, at *4 (D. Mass. Dec. 20, 2022). This is because Facebook’s Meta Pixel can cause transmission of site interaction data along with the user’s Facebook ID, which can be used to identify the user’s Facebook profile and connect it with video viewing information. Of course, this technology and its disclosures to third-parties are highly fact-dependent and subject to change, so a business’ ultimate liability will depend on the actual practices in place at the time of an alleged violation.
In sum, it appears that any website that offers video content and utilizes tracking tools may be subject to litigation under the VPPA. For entities found liable, exposure can be significant: the VPPA provides for statutory damages of $2,500 per violation, which can rapidly accumulate, especially given that most cases are commenced as putative class actions.
Nonetheless, entities targeted under the VPPA have several defensive options:
1. The Material Must Be Pre-Recorded Video. Live Streaming Does Not Fall Within the VPPA.
Courts have interpreted the VPPA’s catchall language “similar audio visual materials” to incorporate the limitation that the video be “pre-recorded.” Louth v. NFL Enterprises LLC, No. 121CV00405MSMPAS, 2022 WL 4130866, at *4 (D.R.I. Sept. 12, 2022). Thus, as long as this interpretation continues, defendants cannot be held liable for offering live-video content.
2. The Claimant Must Be a Consumer of the Company’s Content.
To bring an action under the VPPA, the plaintiff must be a “consumer” of the defendant’s video content, defined as a “renter, purchaser, or subscriber.” On this basis, the plaintiff must have at least some relationship with the defendant in order to possess a viable claim. Note, however, that, by including mere subscribers in the definition of “consumer,” the relationship between plaintiff and defendant may be somewhat tenuous. E.g., Lebakken v. WebMD, LLC, No. 1:22-CV-644-TWT, 2022 WL 16716151, at *4 (N.D. Ga. Nov. 4, 2022) (plaintiff deemed “consumer” because “she exchanged her email address to receive [defendant’s] e-newsletter and that she also created her own account”).
3. Consent Is a Defense.
Finally, and perhaps most importantly, there can be no claim under the VPPA if the business obtains written consent from the consumer that meets various statutory requirements. Subject to additional nuances, the consent must be (1) in a form distinct and separate from any form setting forth other obligations of the consumer; (2) given at or before the time the disclosure is made, and (3) withdrawable at the consumer’s election. VPPA, § 2710(b)(2)(B).
Key Takeaways
Based the expansive view adopted by many courts, a broad sweep of entities may be subject to litigation under the VPPA. Any business with a website that includes video content and employs tracking tools (or otherwise permits third-party access) should be cognizant of the risks. Certain businesses may avoid liability on the basis that they offer only live-video content or do not have a relationship with a consumer, but the most reliable means of avoiding liability is to preemptively adopt a consent policy that meets statutory specifications.