“Th-th-th-that’s All, Folks!” Federal Judge Dismisses Class Action against Cartoon Network, Finds Anonymous User IDs Don’t Qualify as Personal Information under VPPA

On October 8, Georgia Federal District Judge Thomas Thrash, Jr., dismissed a putative class action against The Cartoon Network, Inc., where the plaintiff alleged that the animation company violated the Video Privacy Protection Act ("VPPA") by sharing its mobile app users' data with third parties without consent. Specifically, the plaintiff in Ellis v. The Cartoon Network claimed that the Cartoon Network shared the viewing histories and Android mobile device IDs ("Android IDs") of individuals who used the company's mobile Cartoon Network App ("CN App") with Bango, a United Kingdom-based data analytics firm. Once Bango had this information, it was able to reverse engineer users' true identities by using data collected from other unrelated sources. At the heart of his claim, the plaintiff alleged that the Android IDs by themselves that the Cartoon Network transmitted to Bango constituted Personally Identifiable Information ("PII") under the VPPA, and that the Cartoon Network violated the statute by sharing it with Bango without users' consent.

What is PII under the VPPA?

While Judge Thrash agreed that the plaintiff was a "consumer" under the VPPA as he was subscriber of the Cartoon Network's services, the judge took issue with the plaintiff's assertion that an Android ID fit the VPPA's definition of PII. Under the statute, PII "includes information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider." In looking to how other district courts across the country have addressed what constitutes PII under the VPPA, Judge Thrash concurred with the Northern District of California's assessment in the In re Hulu Privacy Litigation that information can only be regarded as PII if it, by itself and without more, "links an actual person to actual video materials."

Judge Thrash noted that "where an anonymous ID was disclosed to a third party but that third party had to take further steps to match that ID to a specific person, no VPPA violation occurred." Unlike a Facebook ID that actually identifies an individual without having to use any additional means, the Android ID is randomly generated and does not identify a specific person on its own. Indeed, Judge Thrash noted that the plaintiff previously admitted that Bango would have to take further steps and use additional information to connect specific users with their Android ID.

Since an Android ID cannot identify an individual on its own, and because Bango had to use the Android ID in combination with additional third-party data to discern specific users, Judge Thrash ruled that an Android ID could not constitute PII under the VPPA and summarily dismissed the plaintiff's action. Judge Thrash did not give the plaintiff leave to amend his claim, finding that any amendments "would be futile" given that the disclosure of users' Android IDs still did not amount to a breach of the VPPA.

Plaintiffs Finding VPPA Ill-Suited to the Times

Judge Thrash's dismissal of the putative class action against the Cartoon Network marks yet another instance of federal courts recognizing that the VPPA should not be used as a means to hold content providers liable for sharing anonymized information with third parties.

Passed by Congress in 1988, the VPPA was created in the wake of an investigative reporter accessing the video tape rental history of then-Supreme Court nominee Robert Bork, and was designed to ensure individuals' privacy by prohibiting the disclosure of consumers' video tape rental or sale records. But in many ways the VPPA was created for another era, when the notion of being able to transmit gigabytes of digital information wirelessly to handheld devices with more computing power than the space shuttle seemed closer to science fiction than an everyday occurrence. Indeed, the corner video rental store closed long ago, replaced with services and apps that can stream content to users virtually anywhere in the world. But since that time the applicability of the VPPA has been stretched to cover technologies and transactions that its authors likely never envisioned. Indeed the definition of the term "video tape service provider" includes "any person, engaged in the business … of rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials…" Applying the VPPA definitions to online providers has clearly pushed the limit of what can be determined to be "prerecorded video cassette tapes." Although Hulu stands as the law, the sweep of the VPPA may well be going beyond the intent of the legislation and also make innocuous or desired sharing actionable.

Fortunately the lower courts have done well to recognize that the VPPA's coverage should not be extended beyond reason, and that even if the definition is expansive for covered entities, PII under the statute should not include anonymized information, regardless of whether a third party is able to use it plus additional means to discover the identity of an actual consumer. Until a higher court definitively steps in and affirms that anonymized data like the Android ID does not count as PII, however, the plaintiffs bar will likely continue to bring further class action suits under the statute in courts across the country. But at least the Cartoon Network can breathe a sigh of relief and say that for this suit, "Th-th-th-that's all, folks!" At least for now!