Plaintiffs Seek Expansion Of Video Privacy Laws

Keywords: personally identifiable information, PII, cookie tracing, video privacy protection, VPPA

Plaintiffs traditionally face an uphill battle in class actions alleging misuse of personally identifiable information (PII) gathered from Internet cookie tracking (i.e., data transferred between users' web browsers and companies' web sites). Courts often take the view that plaintiffs lack cognizable injury—and thus standing—as browsing history and demographic information have little to no intrinsic value.1 However, the plaintiff's bar is ever on the lookout for new PII hooks, and recent efforts have centered on the Video Privacy Protection Act, 18 USC § 2710 (VPPA).

Congress enacted the VPPA in 1988 after Judge Robert Bork's video rental history famously leaked during his candidacy for nomination to Supreme Court. The VPPA prohibits "video tape service providers" from knowingly disclosing PII, which includes any information that links a customer to particular video materials or services. The VPPA provides a private right of action and statutory damages of no less than $2,500 per violation. Several states also have enacted laws protecting video privacy, including California, Connecticut, Delaware, Iowa, Louisiana, Maryland, Michigan, New York and Rhode Island.

The scope of these statutes is unsettled, particularly with regard to new forms of video media. But several recent decisions from an action out of the Northern District of California suggest that the VPPA may extend beyond traditional video rentals to streaming video services. The court first determined that streaming-video provider Hulu qualified as a "video tape service provider," and allowed a case to go forward on the theory that the VPPA's statutory damages—even absent other alleged actual damages—were sufficient to confer standing.2 The court later rejected Hulu's argument that its PII was anonymous and thus immune from VPPA liability.3 Instead, the court found that users could be identified by information other than actual names: on Hulu's site, there was computer code that enabled Facebook to process "like" requests. This code contained cookies that potentially revealed users' identities on Facebook. The two Hulu decisions are significant given the increasing use of streaming video by all sorts of companies and web sites.

In the wake of these decisions, numerous putative class actions have been filed under the VPPA. For example, a Wall Street Journal subscriber filed a putative...