A recent string of lawsuits filed against large companies including a major movie studio, a professional sports league, CNN, HuffingtonPost.com, ESPN and Buzzfeed have returned the federal Video Privacy Protection Act (VPPA) – enacted in 1988 to protect video tape rental histories – to the spotlight.

Plaintiffs in these new actions allege that these companies violated the law when their websites tracked their online video viewing habits and reported the data to companies such as Meta or Google for analytical purposes without their consent.

This emerging litigation trend should prompt companies that use Meta’s tracking Pixel, Google Analytics or other technologies that monitor website traffic, to review their policies and procedures.

Background on the Video Privacy Protection Act

In 1987, amid U.S. Supreme Court nominee Judge Robert H. Bork’s confirmation hearings, a journalist published Bork’s video tape rental history. In response, Congress swiftly passed the Video Privacy Protection Act (VPPA). Enacted in 1988, the VPPA prohibits the knowing disclosure by a video tape service provider of information identifying a person having requested or obtained specific video materials or services.

The law did not generate much attention until 2008-2011, when a series of lawsuits were filed against online video streaming services such as Hulu and Netflix alleging breaches of VPPA. These streaming services lobbied Congress for an amendment to VPPA to provide an exception so that they could obtain consent that would enable the user to opt in to share their video content viewing on third-party social networks.

In response to the lobbying, Congress amended the VPPA in 2013 to allow disclosure to third parties if the consumer elects to give “informed, written consent (including through an electronic means using the internet)” for such disclosure and “the user has to be given the opportunity, in a clear and conspicuous manner, to elect to withdraw on a case-by-case basis from ongoing disclosures.”

What Are the Details of the New Complaints?

This recent string of lawsuits targets major companies with websites that contain videos to be viewed by visitors, as well as Google Analytics and/or Meta Pixel code (Meta is commonly known as Facebook). The plaintiffs’ viewing of those videos on the websites was reported to Google and/or Meta for analytical purposes, which can be very useful for determining videos’ effectiveness.

The plaintiffs allege that their personal information was improperly shared with third parties, namely Google and Meta, without their consent, when their video watching activity was reported. The complaints also allege a violation of state wiretap laws through the interception of communications without appropriate disclosure to, and approval by, the consumer.

In the case of the professional sports league, the allegations include sending user data to the Google-affiliated video platform Anvato. The league's app forwards Android users’ “advertising ID” associated with their device, their geolocation down to the “street level” and an ID associated with the videos they watch.

The allegations against the movie studio, BuzzFeed and ESPN include that they targeted advertising and other content on their websites, gathered personally identifiable information, including the video viewing activities of subscribers who watched videos on their websites, and shared that data with Meta without their consent via a tracking pixel. This pixel reveals to Meta what videos individual account holders watched on those websites.

You Aren’t ESPN or BuzzFeed … Why Should You Care?

Almost any company with an online platform uses advertising and marketing pixels, cookies and similar tools. If you think your company uses Meta’s tracking Pixel or Google Analytics, you may be unknowingly violating the VPPA. Fines amount to $2,500 for every individual.

The available options are not desirable for companies that have videos, chat features or cookies that track the browsing activity of users (to name some affected technologies), or use Meta Pixel code or Google Analytics. To be clear, case law remains undecided and this wave of lawsuits is just the beginning. But it seems safe to say that the plaintiffs have a novel and possibly compelling argument. It is also clear that if the plaintiffs are correct, a passive agreement buried in online terms of use is insufficient to satisfy the standard of “informed, written consent (including through an electronic means using the internet)” for such disclosure and that “the user has to be given the opportunity, in a clear and conspicuous manner, to elect to withdraw on a case-by-case basis from ongoing disclosures.”

This should not be entirely new territory for marketing departments and web designers, which have grown increasingly accustomed to consulting with privacy-focused attorneys when it comes to data collection, usage and disclosure in privacy policies. The same goes for complying with American with Disabilities Act (ADA) requirements for website accessibility, which has been a hotbed of plaintiff class action cases for years.

Add another area to the list. It is quickly becoming clear that companies face legal and financial exposure if their compliance with the VPPA and state wiretap laws is not properly considered and addressed.

[View source.]