VPPA Complaints Not Going Away Anytime Soon, Says Wiley Attorney

“Most of the cases that have been filed in this wave are still in their early stages,” said Bridegan. “It’s unclear how courts will ultimately come out on the legal theories, but a few of the cases have already had their VPPA claims survive motions to dismiss,” he said. It means VPPA lawsuits aren't going away, he said, "and attorneys will continue bringing these claims.”

Heightened attention to data privacy in areas of tracking and targeted advertising helped bring the latest wave of VPPA suits, data security and privacy lawyers told us last week (see 2210260008). Trying to apply VPPA to the digital world has left questions about what's considered personal information for purposes of the statute as well as wrangling over what VPPA means in the context of new technologies, they said.

A few courts dismissed VPPA claims “in part to the extent they allege a violation based on a defendant’s utilization of live video,” said Wiley's Bridegan. “This represents a pretty plain reading of the VPPA, which explicitly applies to personal information related to prerecorded video.” It’s an “important limitation that excludes a potential amount of video services,” he said. It shows that courts are “somewhat willing to limit the reach of the VPPA,” he said.

The current wave of lawsuits “that we’ve seen in this area are using a very broad reading of the statute,” said Wiley of counsel Joan Stewart. The VPPA was originally enacted in 1988 to protect video rental information, but courts “have construed the VPPA broadly in other contexts,” she said. “As of this point, precedent allows the VPPA to be applied to technologies that weren’t even in existence when the law was passed in the '80s.”

The current wave of complaints “all home in on the same few business practices, which are really quite common across many types of organizations,” said Stewart. That’s why “we’re seeing suits filed against companies that operate across a broad swath of sectors and industries,” she said.

Plaintiffs are claiming “that a business that allows a consumer to watch a prerecorded video on its website or mobile app is a video service provider for the purposes of the VPPA,” said Stewart. “They’re alleging that these companies’ websites and apps are using third-party tracking and data collection technologies,” including social-media pixels and cookies, “all of which are commonly used by many organizations that maintain an online presence,” she said.

Plaintiffs typically allege these third-party technologies “are configured in a manner that results in the unauthorized sharing of VPPA-covered information,” said Stewart. Most of the claims allege the business “has knowingly disclosed the VPPA-protected consumer information when it uses these tracking technologies,” she said. “Even with the basic allegations of these complaints being largely identical, there are steps that companies can take to limit the risk of having one of these suits brought against them, especially while this litigation continues to play out. There also are preemptive steps businesses can take to frustrate that all-important class certification process and ultimately, hopefully, minimize damages.”

Short of “taking down or disabling” all prerecorded videos from a website, “at a high level, companies should first evaluate how a consumer accesses videos,” said Stewart. “Courts have been more likely to find an individual qualifies as a consumer under the law if they provide something of value in order to use a video,” she said. “This could be their name, their email, the action of setting up an account or downloading an app or, of course, paying for access. Conversely enough, free access in this context is less risky.”

If a company generally has consumers create an account or download an app before being able to access prerecorded videos, “you could include an arbitration provision in your business’s terms and conditions,” said Stewart. “This could potentially frustrate the class certification process,” she said. “Courts are more likely to honor arbitration provisions where consumers actually have to opt in to the provision, as opposed to an arbitration provision that’s merely contained in a public-facing T&C,” she said of corporate statements of terms and conditions.

The VPPA was amended in 2013 to allow a business “to obtain a consumer’s consent” to share personal information with third parties, said Stewart. “That consent could be electronic, so it can happen through your website or app, but it also must be informed, written, given at the time of disclosure and revocable,” she said. “So consider adding in a consent mechanism” before enabling consumers access to prerecorded videos, she said.

Companies that use tracking technologies to collect data for sharing with third parties should “consider removing them from prerecorded videos,” said Stewart. “Any potential limitation that a company can impose on its tracking technology of choice when used in connection with a prerecorded video could frustrate or mitigate the risk of a future VPPA claim,” she said. “The goal here is to head off a suit altogether or preemptively put in place practices that could limit damages in the event a suit is filed against your business.”