Appellate Courts Being Drawn Into VPPA Fray

Cartoon Network Plaintiff’s Arguments May Signal Plaintiffs Bar’s Approach in Other Pending VPPA Cases and Appeals

Last week the Third and Eleventh Circuit Courts of Appeals assigned case numbers to the appeals of In re Nickelodeon Privacy Litigation and Locklear v. Dow Jones & Co., Inc., two recently dismissed class actions in which plaintiffs alleged violations of the Video Privacy Protection Act (“VPPA”). The district courts in both cases dismissed plaintiffs’ respective claims with prejudice, finding that they had not alleged sufficient facts that the defendants’ improperly disclosed users’ personally identifiable information (“PII”), as defined by the VPPA. In both cases the district courts found that information such as user IDs, gender, age, IP addresses, or persistent identifiers such as a device identifier, without more, do not identify individual persons and any videos he or she viewed.

Plaintiff’s brief in Dow Jones is currently due by March 30, while the briefing schedule in Nickelodeon has not yet been issued.

Though the plaintiffs in Nickelodeon and Dow Jones have yet to present the courts their legal arguments as to why the dismissals should be reversed, an appellate brief submitted by the plaintiff in Ellis v. The Cartoon Network, Inc., another appeal of a decision dismissing VPPA claims that is currently pending before the Eleventh Circuit, may shed light into how the plaintiffs’ bar will approach VPPA-related cases in the future.

Is Ellis A Roadmap for Future Plaintiff VPPA Arguments?

The appeal in Ellis stems from the dismissal of a class action claiming that defendant Cartoon Network violated the VPPA by impermissibly sharing with a third party firm the video viewing histories and associated Android IDs of persons who used the company’s mobile app. The district court dismissed the claim saying no VPPA violation occurred because the Android ID cannot, without more, identify an individual and thus is not PII under the statute.

The district court dismissed the claim saying no VPPA violation occurred because the Android ID cannot, without more, identify an individual and this is not PII under the statute.

Ellis argues that the district court erred in holding that a disclosure must on its face identify a specific individual in order to qualify as PII under the VPPA; instead, Ellis claims that “where the recipient of a disclosure understands to whom the information refers, the information is personally identifiable.” Thus, “where the recipient of video viewing records knows whose records those are because they understand a unique [identifier] . . . there has been a disclosure of [PII].” (emphasis in both) Under Ellis’s so-called “recipient understanding test,” it would not matter if the disclosing party never gave a third party the means to associate a particular identifier – like an Android ID – with a specific individual, such as by handing over a correlating key or look-up table.  In fact, Ellis argues that in In re Hulu Privacy Litig. the court suggested in dicta that “if an anonymous, unique ID were disclosed to a person who could understand it, that might constitute PII.”.”

The consequence of Ellis’ proposed test is that if any third party, on its own, uses additional methods and means to tie an otherwise unintelligible user ID to an actual individual and learn the person’s video viewing history, the disclosure of an otherwise unspecified user ID would be actionable, without taking into account the VPPA’s requirement that any such disclosure must be “knowing.”  Fortunately, most of the courts that have pondered whether a defendant would be liable for disclosing an identifier that by itself does not identify a particular person have not embraced anything as broad as Ellis’ theory. Instead those courts have analogized that the disclosure of a user ID might be actionable where a defendant discloses both the ID and the corresponding key that would allow attribution to a particular person, or even potentially where the user ID correlates directly to an identifiable person, such as a Facebook user ID that correlates to a specific user’s account and profile.

Courts have said that disclosure of a user ID might be actionable under the VPPA where a defendant discloses both the ID and the corresponding key that would allow attribution to a particular person.

VPPA in the Lower Courts – Hulu Moves Closer to Resolution

In order to be actionable under the VPPA, there must not only be a disclosure of PII, but the disclosure must be “knowing.”  In the ongoing class action In re Hulu Privacy Litig., U.S. Magistrate Judge Laurel Beeler heard argument on Hulu’s renewed motion for summary judgment and reportedly stated that she did not believe enough facts had been offered to show that Hulu had “knowingly” disclosed users’ PII to Facebook. If Judge Beeler grants Hulu’s summary judgment motion, the Ninth Circuit may join the Third and Eleventh Circuits in analyzing the sufficiency of claims under the VPPA.