One may not think of a jewelry or toy retailer as a videotape service provider, or a person who subscribes to a newsletter about those products as a consumer of goods or services from a videotape service provider, or a piece of a code as akin to a list of names, but that is what a deluge of lawsuits brought under the Video Privacy Protection Act (“VPPA”) allege. Most of these cases in the past few years have involved the now ubiquitous “Meta pixel” – a piece of advertising code that plaintiffs allege sends Facebook information about them and the short video clips they watched on websites, but as company and consumer behavior shifts, so do the tactics of the plaintiff’s bar – and the newest round of cases involves the TikTok pixel and other tools.

Protecting Bork’s Video Rentals

The VPPA is a Blockbuster-era statute that contemplates a highly specific disclosure: the titles of movies rented from a video store. Why? A video rental store clerk leaked then-Supreme Court nominee Judge Robert Bork’s video rental history to a newspaper reporter, who published the list of “dull movies” during Judge Bork’s 1987 Senate confirmation hearings. The disclosure—which contained nothing salacious and had little to do with the Senate’s decision to reject Judge Bork’s controversial nomination—got Congress’ attention.  It enacted the VPPA in response the following year.  

The VPPA creates a private right of action for any “customer”—defined as “any renter, purchaser, or subscriber of goods or services from a video tape service provider” —to sue a “video tape service provider”—anyone “in the business” of the “rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials” —that “knowingly” discloses the customer’s “personally identifiable information” or “PII,” a term that includes any information “which identifies a person as having requested or obtained specific video materials or services.” 

A successful VPPA plaintiff can potentially recover either her actual damages or $2,500 in liquidated damages, whichever is greater, and may also be awarded punitive damages, reasonable litigation costs and attorneys’ fees, and any other preliminary and equitable relief deemed appropriate by the court. 

In the class action context, this means defendants with thousands of class members face significant potential damages.

Evolution of the VPPA Landscape

Despite its repeated references to “prerecorded video cassette tapes” and providers thereof, some courts have held that the VPPA does apply to videos delivered over the internet, provided other elements of this statutory claim are met.

Dentons prevailed in some of the first cases to grapple with the question of how to apply this analog-era law to digital videos. In Austin-Spearman v. AMC Network Ent. LLC, 98 F. Supp. 3d 662 (S.D.N.Y. 2015), the Southern District of New York granted a motion to dismiss filed by Dentons attorneys on the grounds that the plaintiff’s “casual consumption of video content” on the Defendant’s website was not enough to make her a “consumer” under the statute. Id. at 669-671. In another early case, the Northern District of Georgia accepted the Dentons team’s arguments that Roku serial numbers were not “personally identifying information,” because the third-party recipient of the information would need to link the serial number to information obtained from other sources in order to identify an individual in Locklear v. Dow Jones & Co. 101 F. Supp. 3d 1312, 1318 (N.D. Ga. 2015).

In a non-Internet case, Sterk v. Redbox Automated Retail, LLC, 770 F.3d 618, 625 (7th Cir. 2014), the court granted Dentons’ motion for summary judgment, finding that Redbox’s disclosures to a third party that handled customer support calls fell within the exception to the VPPA for disclosures made in the ordinary course of business, rejecting arguments that Congress’ intent to include customer service in this exception was somehow nullified simply because the defendant “replaced most live customer service interactions with a computer interface.”

Recent cases involve the Facebook Pixel and the delivery of information to Facebook about users’ views of clips on various sites. These cases raised similar questions related to the application of a decidedly brick-and-mortar-focused statute to digital technology. Most of those cases remain pending. Defendants have secured dismissals in a handful of cases after successfully persuading the courts to carefully consider how the VPPA applies to the technology at issue and the intended scope of the law.  But other courts have been reticent to dismiss at the pleadings stage; and while noting defendants may prevail later on summary judgment, in the meantime such decisions have encouraged the plaintiffs’ bar to keep going.

The Next Wave: TikTok Pixel, Google DoubleClick, and Google Analytics

Now, plaintiff’s firms have expanded beyond the Meta Pixel, targeting websites that have implemented other kinds of advertising or analytics code. They have recently filed complaints against companies in a wide variety of industries stemming from the use of the TikTok pixel, Google Analytics, Doubleclick and Blaze tools. The video clips at issue can be short as a few seconds long.

All of these technologies are materially different from the Facebook Pixel. Unlike Facebook User IDs, which can be appended to the end of “facebook.com” to locate a specific person’s profile, Google and TikTok IDs do not readily reveal a user’s identity, nor does other information transmitted by these technologies, such as IP addresses or browser or device identifiers. This information is unlikely to constitute “personally identifying information” under the statute—at least in the Third and Ninth Circuits, which adopted the “ordinary person” test.¹ Some courts in the Southern District of New York have adopted it as well.² IP addresses and device and browser identifiers do not satisfy the “ordinary person test.”

On the other hand, the First Circuit has adopted a broader definition of personally identifying information, which includes GPS information and information that the defendant knows the recipient will be able to use to identify the individual.³ On balance, at least in the Third and Ninth Circuits, unlike earlier cases involving the Facebook Pixel,⁴ cases in this new wave of VPPA are less likely to get beyond motions to dismiss for failure to allege disclosures of personally identifying information as required under the VPPA. 

Additionally, a transmission will not constitute “personally identifying information” if it does not sufficiently identify the video watched. In Martin v. Meredith, the Southern District of New York held that Facebook Pixel transmissions that fired when someone visited a webpage that included the name of a webpage did not identify that the user as having watched a specific video because many webpages did not have videos, and even if the webpage does have a video, “disclosing to a third party the title of the webpage does not reveal the title of a video on the page, let alone whether the website visitor requested or obtained the video instead of merely reviewing an article on the page.”⁵  This argument applies equally to the new wave of VPPA cases. In a recent case in the District of Massachusetts, however, the court held that the title of the video was in the URL, and “a simple visit to the URL would provide any third party who receives the information confirmation of the specific video requested or obtained” and the fact that the Pixel does not track whether a user “plays, pauses or otherwise interacts with the video is irrelevant to the alleged privacy violation…”⁶

Some defendants also have challenged that the plaintiff is a “customer”—defined as “any renter, purchaser, or subscriber”— under the VPPA. Following Dentons’ Austin-Spearman case, a court in the Southern District of New York recently held that “[i]n the statute’s full context, a reasonable reader would understand the definition of ‘consumer’ to apply to a renter, purchaser or subscriber of audio-visual goods or services, and not goods or services writ large.”⁷ That court rejected arguments that merely subscribing to an email newsletter was sufficient without more. Another court in the Northern District of California recently did the same, holding that plaintiff’s allegations of entering her name and email to subscribe to an email list were not sufficient to make her a “subscriber” under the VPPA,⁸ as did one in the Northern District of Illinois, holding that “open[ing] an account separate and apart from viewing video content” on Defendant’s website is not sufficient to render Plaintiffs subscribers under the VPPA.⁹ However, cases in the Northern District of Georgia, where signing up for newsletters gave the user access to video content, have come out the other way. ¹⁰

Defendants are also arguing that the entities being sued are not “video tape service providers” under the VPPA, and in one recent case in the Central District of California, the court held that General Mills is not a video tape service provider, stating that “Plaintiffs do not allege any facts suggesting that the delivery of audiovisual material is General Mills’ particular field of endeavor or that General Mills’ products are specifically tailored to serve audiovisual material.”¹¹

On the whole, as plaintiffs continue to press for application of the VPPA to browsing and purchases on websites for products that are far removed from the Bork family video store, courts may become increasing skeptical of these claims at the outset.

Where Does That Leave Website Operators?

For now, without any further congressional amendments to the VPPA, the legal landscape is in flux and the “in terrorem” effect of these putative class actions remains. The next round of decisions may provide some clarity, with courts seeing the flaws in these claims as new cases continue to attempt to stretch this law well beyond any recognizable relation to protecting individuals like Judge Bork from the disclosure of their movie-watching history.

If your company has concerns about whether technologies on your website risk VPPA liability or whether your terms of use could better protect you against VPPA litigation or arbitration claims, Dentons lawyers can assist you with a review of your website, terms of use, and privacy

1. In re Nickelodeon Consumer Priv. Litig., 827 F.3d 262, 284, 289-90 (3d Cir. 2016); Eichenberger v. ESPN, Inc., 876 F.3d 979, 985-86 (9th Cir. 2017). ↩
2. See, e.g., Wilson v. Triller, Inc., 598 F. Supp. 3d 82, 91 (S.D.N.Y. 2022). ↩
3. Yershov v. Gannett, 820 F.3d 482, 486 (1st Cir. 2016). ↩
4. See, e.g. Stark v. Patreon, Inc., No. 22-CV-03131-JCS, 2022 WL 7652166, at *8 (N.D. Cal. Oct. 13, 2022), ↩
5. Martin v. Meredith Corp., No. 22CV4776 (DLC), 2023 WL 2118074, at *3 (S.D.N.Y. Feb. 17, 2023). ↩
6. Adams v. America’s Test Kitchen, No. 22-CV-11309-AK, 2023 WL 4304675 (D. Mass. June 30, 2023). ↩
7. Carter v. Scripps Networks, LLC, No. 22-CV-2031 (PKC), 2023 WL 3061858, at *6 (S.D.N.Y. Apr. 24, 2023). ↩
8. Jefferson v. Healthline, No. 3:22-cv-05059 2023 WL 3668522 (N.D. Cal. May 24, 2023). ↩
9. Gardener v. MeTV, No. 22-cv-5963 (N.D. Ill. July 6, 2023). ↩
10. See Lebakken v. WebMD, LLC, No. 1:22-CV-644-TWT, 2022 WL 16716151, at *3 (N.D. Ga. Nov. 4, 2022); Harris v. Pub. Broad. Serv., No. 1:22-CV-2456-MLB, 2023 WL 2583118, at *4 (N.D. Ga. Mar. 20, 2023). ↩
11. Carroll v. General Mills, Inc., No. 2:23-cv-1746 DSF (C.D. Cal. June 26, 2023). ↩