Enacted in in 1988 after Judge Robert Bork’s video rental history was leaked by a store clerk and published in a newspaper profile about the Supreme Court nominee, the Video Privacy Protection Act (VPPA) was the result of public outcry and bipartisan action, and became one of the country’s first federal privacy laws. For decades, the VPPA did not attract much attention, as people became less concerned about publicizing their video rental history when they stopped renting videos. Now, long after almost all Blockbuster Video stores have shuttered for good,¹ enterprising plaintiffs’ attorneys have begun to deploy the VPPA to target a very different technology that did not exist in 1988: website cookies.

At a high level, the VPPA restricts the disclosure of video records without the watcher’s consent. Perhaps not surprising given the unique situation it was designed to address, the VPPA’s language is narrow in scope. Although it broadly prohibits the knowing disclosure of Personally Identifiable Information (PII) concerning any consumer, it only applies to Video Tape Service Providers (Providers) that provide “prerecorded video cassette tapes and similar audio visual materials.” It also limits PII to that which identifies a consumer and links that consumer to “specific video materials or services” from a Provider. In addition to actual damages, the law allows for recovery of $2,500 per violation. The availability of statutory damages has made the prospect of class action awards or settlements attractive to plaintiffs’ attorneys.

Indeed, and notwithstanding the seemingly limited reach of the VPPA, since 2022, plaintiffs have filed a spate of putative class actions targeting web cookies that track user activity in order to use that data for analytics and advertising, alleging that these practices violate the VPPA. For example, plaintiffs have claimed that the Meta pixel may violate the VPPA because it relays information to Facebook that exposes which online videos a user has watched. Over the past year, plaintiffs have filed more than 100 complaints against companies that deploy these types of pixels.

It is so far unclear whether courts will be receptive to the novel application of this 30-plus year old statute to new technology. As of now there are no binding appellate decisions regarding whether these claims fall within the scope of VPPA. District courts wrestling with these issues have signaled some efforts to curtail the scope of VPPA’s possible application. At least two courts have determined that live video streams fall outside the scope of VPPA, which only covers “prerecorded” material.² Courts have also required specificity in pleading claims under VPPA, rejecting boilerplate allegations that a plaintiff’s personally identifiable information was disclosed.³ But the majority of courts at the motion to dismiss stage have concluded that the plaintiff plausibly alleged a VPPA claim by asserting that video material they watched was disclosed without their consent via Meta pixel technology.⁴

Companies commonly deploy website cookies to try to understand how users are interacting with their website and to try to improve website functionality. Cookies can also be used to track users in order to understand their preferences and better personalize their experiences, including the ads they see. Studies have shown that even many government websites employ third-party trackers. Given the ubiquitous deployment of website cookies to track users, many consumer-oriented companies who operate and advertise online could be the targets of similar litigation. The scope of the VPPA as applied to modern-day cookies is in flux as courts continue to grapple with the contours of the law. In the meantime, companies can mitigate their risk under the VPPA by ensuring they secure consent from users prior to disclosing information regarding prerecorded videos that the user watched. 

___________________

[View source.]