Mapping VPPA Trends

In re Nickelodeon Consumer Privacy Litigation (3d Cir.) The Third Circuit found that potential PII falls on a spectrum, with a person’s actual name on one end, followed by information “from which it would likely be possible to identify a person” by consulting publicly available sources (such as an address or telephone number), and information “associated with individual persons” (such as social security numbers) that requires consultation with another entity. The court found that unique device identifiers fall even further down the spectrum because to the average person they would “likely be of little help in trying to identify an actual person,” and thus did not constitute “the kind of information that would readily permit an ordinary person to identify a specific individual’s video-watching behavior.” Read the opinion here.

Austin-Spearman v. AMC Network (S.D.N.Y.) The Southern District of New York found that a person who viewed free videos on AMC’s website without registering, paying, or otherwise establishing a relationship with AMC, was not a subscriber of AMC under the VPPA, because “the casual consumption of web content, without any attempt to affiliate with or connect to the provider” exhibited none of the critical characteristics of a subscription. Read the opinion here.

Eichenberger v. ESPN (9th Cir.) The Ninth Circuit issued an opinion affirming the district court’s dismissal of a VPPA case against ESPN relating to its Roku App. The panel concluded that a Roku device identifier was not PII under the statute. The court found that while the definition of PII does include at least some information that is capable of identifying a person (as opposed to only information that actually identifies a person), it still must be information “that would readily permit an ordinary person to identify a specific individual’s video watching behavior.” This was the same standard adopted by the Third Circuit in the Nickelodeon case. In reaching its conclusion, the court noted that the definition of PII “must have the same reasoning without regard to the recipients capabilities” and that “the advent of the Internet did not change the disclosing party focus of the statute.” Read the opinion here.

In re Hulu Privacy Litigation (N.D. Cal.) In the only VPPA case to directly address the VPPA’s “knowing” transmission requirement, the Northern District of California granted summary judgment to the defendant, Hulu, finding that Hulu’s transmission of a video URL and Facebook cookie could not constitute a “knowing” disclosure of PII, as required for VPPA liability, unless plaintiffs could establish that Hulu knew that Facebook would combine the data to ascertain viewing behavior of specific individuals. It was not enough that Hulu knew the underlying information was being disclosed or that Facebook could theoretically combine such information. Read the opinion here.

Ellis v. Cartoon Network (11th Cir.) In predecessor to the CNN case, the Eleventh Circuit held that plaintiff was not a subscriber of Cartoon Network entitled to VPPA protection. Specifically, the court held that downloading an app for free and using it to view content at no cost is not enough to make a user of the app a “subscriber” under the VPPA, as there is no ongoing commitment or relationship between the user and the entity which owns and operates the app. Read the opinion here.

Yershov v. Gannett (1st Cir.) The First Circuit reversed dismissal of VPPA claim against Gannett stemming from its USA TODAY App, holding that plaintiff’s allegation that he was required to disclose his device identifier and GPS information in order to watch videos was enough to plausibly allege transmission of PII and that Plaintiff was a subscriber under the VPPA to survive a motion to dismiss. However, plaintiff subsequently dismissed his claim with prejudice after discovery revealed no evidence that Gannett disclosed his Android ID and GPS coordinates to a third-party analytics company, as had been alleged. Read the opinion here. Read the dismissal here.

Robinson v. Disney Online (S.D.N.Y.) The Southern District of New York concluded that a Roku serial number was not PII under the VPPA. The court reasoned that “if nearly any piece of information can, with enough effort on behalf of the recipient, be combined with other information so as to identify a person, then the scope of [PII] would be limitless,” and that the information disclosed by the service provider “must itself do the identifying that is relevant for purposes of the VPPA.” Read the opinion here.