In the wake of recent lawsuits brought under the Video Privacy Protection Act (VPPA), companies with websites that display video content should evaluate their use of tracking technologies. Recently, creative class-action lawsuits have been filed against website operators that host videos—even where the website is not primarily intended as a streaming service—arguing that the websites have violated users’ rights under the VPPA.
History of the VPPA
The VPPA prevents providers from disclosing personally identifiable information (PII), like a viewer’s email address and the name of the video the user watched, derived from a consumer’s video-watching habits. Congress passed the VPPA in 1988 after Judge Robert Bork’s video rental history was leaked by a store clerk and published in the news during his Supreme Court confirmation hearing. The goal was to protect consumer privacy by preventing video rental companies from disclosing consumers’ rental history.
Thirty-five years ago, Congress didn’t know how we would consume media today, but the text of the VPPA left open the possibility for it to apply broadly. The Act applies to anyone in the business of, affecting the interstate or foreign commerce of, or engaged in the delivery of “prerecorded video cassette tapes or similar audio-visual material.”
Focusing on the term, “similar audio-visual material,” plaintiffs brought a flurry of lawsuits, in the late 2000s, against online streaming services, like Netflix and Hulu, arguing that the VPPA’s application to “similar audio-visual material” brought online streaming services under the scope of the VPPA. In response, Congress amended the VPPA in 2012 to allow for websites to obtain prospective consent, lasting two years, to track users’ PII.
Recent Developments
Plaintiffs are again testing the reach of the VPPA, this time by suing website operators, such as the Boston Globe, National Public Radio, Forbes and the National Football League, that track PII and share this information with Meta, Google or similar companies.
Over the past two years, hundreds of lawsuits have emerged, generally following a similar script: As part of a class action, plaintiffs allege that after initiating some relationship with the defendant company (for example, by signing up for an email list) and watching a video on the defendant’s website, they had their PII transmitted to a third-party through an embedded pixel or other tracking technology without their consent.
While these cases are in the early stages, most courts to have ruled on early motions to dismiss have allowed the cases to proceed into discovery. Settlements, some millions of dollars, have been common after that point.
There is some hope, however. Recent decisions show that courts are beginning to question whether plaintiffs have sufficiently alleged that signing up for non-video-specific services brings them under the VPPA’s protection. The VPPA applies only to “consumers,” which it defines as “any renter, purchaser, or subscriber of goods or services from a video tape service provider.” The Southern District of New York and Northern District of California have dismissed complaints on the grounds that the complaint didn’t make clear what “goods or services” the plaintiff received in exchange for signing up for an email list nor did it allege a connection between watching a video and signing up for the email list.
Companies that violate the VPPA may be held responsible for damages exceeding $2,500 per affected consumer. Thus, companies that embed video content on their website and use any of the widely available tracking technologies from Meta, Google or similar providers should review their privacy policies for appropriate disclosures and consider best practices in obtaining customer consent for online tracking.
