On June 27, the U.S. Court of Appeals for the Third Circuit, in a precedential opinion, rejected the allegation that Google and Viacom violated the Video Privacy Protection Act (“VPPA”) and federal and state wiretapping statutes by allegedly tracking children’s Internet activity.  The decision represents one of the first rulings under the VPPA to not stretch the definition of personally identifiable information (“PII”) to include attenuated digital identifiers, such as IP addresses, which other courts have accepted.  However, the appeals court’s refusal to establish a clear rule for what constitutes PII may leave the door open for future challenges to companies’ data collection practices. 

In In re: Nickelodeon Consumer Privacy Litigation, a multidistrict consolidated class action, the plaintiffs were children younger than 13 who alleged that the defendants, Google and Viacom, unlawfully collected personal information about them on the Internet, including what webpages they visited and what videos they watched on Viacom’s websites.  The court found that plaintiffs’ claims overlapped substantially with claims the court rejected in November 2015 in In re: Google.  However, the court concluded that two of the plaintiffs’ claims – one for violation of the federal VPPA, and one for invasion of privacy under New Jersey law – raised questions of first impression for the court. 

The VPPA, passed by Congress in 1988, prohibits the disclosure of PII relating to viewers’ consumption of video-related services.  Interpreting the Act for the first time, the Third Circuit first held that the law permits plaintiffs to sue only a person who discloses such information, not a person who receives such information.  The court then held that the VPPA’s prohibition on the disclosure of PII applies only to the kind of information that would readily permit an ordinary person to identify a specific individual’s video-watching behavior.  According to the court, the information that Viacom allegedly provided Google – which included links for viewed videos and “static digital identifiers” such as IP addresses and unique device identifiers – could not be considered PII under the VPPA. 

In reaching this decision, the panel noted that the 1988 statute is “not well drafted” and stressed that its interpretation of the term PII was intended to “articulate a more general framework” rather than establishing a “single-sentence holding capable of mechanistically deciding future cases.”  While the panel’s reading of the statute foreclosed plaintiffs’ VPPA claims in the case before it, the court’s failure to clearly define what types of disclosures run afoul of the VPPA may leave the door open for future plaintiffs to allege that other methods companies are using to maximize the value of data could indeed be linked to a specific user and thus constitute PII under the statute.