VPPA Decisions Not Always Centered Around Term Definitions, Privacy Lawyers Say

For example, the 2nd U.S. Circuit Court of Appeals case Solomon v. Flipps Media solidified the ordinary person standard, which holds that an average person must be able to interpret and understand the identity of a person from the personal information shared for it to be a VPPA violation (see 2508110052 and 2505010046). In the case, plaintiff Detrina Solomon, a subscriber to defendant Flipps Media's streaming service, alleged her personal information was sent to Facebook unlawfully. However, since the information sent was a sequence of characters and numbers, an average person couldn't identify the plaintiff by it, the court decided (see 2508110052).

“Solomon is a pretty significant ruling because it takes a little bit less technical approach to what the website ad tech is doing,” said Matthew Wolfe, a Shook Hardy privacy attorney. “It's a good ruling for defendants, and you're going to see people arguing it all over the place and trying to get other courts around the country to apply it.”

He added the ruling surprised him since the argument was made previously in district courts, but “hadn't gotten a lot of traction to the degree that the 2nd Circuit took it.” For the appeals court “to be willing to go there on an appeal from a motion to dismiss the complaint and not say, ‘Well, it's a fact issue. Well, I don't really know’ but just jump into it and say, ‘This isn't enough’ ... was really interesting.”

Ian Ross, a Sidley attorney specializing in commercial litigation and consumer class actions, said that whether "a court adopts [the ordinary person] standard really can be, in many cases, outcome-determinative of whether or not there is an alleged violation of the VPPA.”

Ross said Solomon “is a very well-reasoned decision,” and noted it followed the 3rd U.S. Circuit Court of Appeals’ decision in In re Nickelodeon. “What Flipps involved that Nickelodeon did not is that Flipps specifically involved the Meta pixel, and that is where so many of the VPPA cases are focused on right now." It “took the bull by the horns for what is the main issue right now in VPPA litigation.”

The Flipps ruling came is an example of the 2nd Circuit taking a broader view of the definition of ‘consumer.’ It shows “judges have different philosophies, and [differences in] the way they just interpret the plain language of the statute,” David Krueger, privacy litigator at Benesch, said. “They say, ‘All right, we endorsed a broader reading of what it means to be a subscriber and consumer, but by the same token, here's how we feel the statute says in terms of whether or not an ordinary consumer applies.’ And the answer is that it does, and the average person can't make heads or tails out of that data being sent to … Meta.”

Another recent VPPA decision came in Pileggi v. Washington Newspaper, where plaintiff Nicole Pileggi alleged the newspaper shared users’ private video viewing information from its online site with Facebook without consent. Since she had a subscription to the paper’s newsletter, disclosing her information violated the VPPA (see 2502280051). The D.C. Circuit ruled for the Washington Examiner and dropped the suit, deciding that Pileggi was not a consumer under the statute simply because she had a subscription to the site's newsletter (see 2508120030).

Something that struck Wolfe about the case is that the court said, “The fact that the statutory damages are so severe should be taken into account in construing the statute.” The judges “took the point of view [that] these damages are pretty punitive, and so we should be careful about applying [the] statute broadly.”

Wolfe said that it's “a really interesting idea that is potentially applicable to other statutory damages situations like [the] Wiretap Act or California Invasion of Privacy Act claims [or] Illinois [Biometric Information Privacy Act] claims.”

“People have tried that argument in various contexts, and it doesn't always work, but for the D.C. Circuit to apply that [means], I think, you're going to see people trying to pick up that argument again and use it in these other contexts, especially where it's these emerging privacy theories that the plaintiffs’ bar is pushing that are taking old statutes and trying to apply this [to] a new tech,” Wolfe said. The appeals court is essentially saying, “'We should be careful applying these statutory damages, which were made up in one context, to a new context.'”

Originally, the VPPA was meant to protect the history of consumers who rented or purchased videotapes from video stores (see 2501100009).

Krueger also thought the court’s argument made sense. “Just from a practical standpoint, there's already significant enough liability, if you're just looking at renting or subscribing to videotapes [or a] videotape service provider,” he said. “That by itself ... is already enough to explode it [and] create significant exposure. Are we going to explode it even more, beyond what Congress probably would have rationally intended?”

Ross said another interesting question litigated a lot is whether website developers can be sued for allegedly disclosing information to a third party when developers hire service providers that embed video players or other tools on their websites. “Plaintiffs are bringing VPPA claims saying that these service providers should be treated as third parties but, in many cases, they are not. They are being hired to assist the website developer and not collecting or using the data except to provide it to the website developer.” he said. “The VPPA has an exception for this type of service provider, but a number of cases are considering how narrowly or broadly that exception should apply.”