While "Video Killed the Radio Star,"1 class action suits under the Video Privacy Protection Act (VPPA) of 1988 are enjoying a revival. The ever-creative class action plaintiffs' bar has seized on this archaic statute to bring suits against companies using widely available and commonly used online tracking tools, such as Meta Pixel, to analyze consumer habits for purposes of targeted advertising.
Tracking technology is ubiquitous and occurs nearly every time someone is on the internet. Plaintiffs' counsel reap the rewards of statutory damages and potentially sizeable attorneys' fee awards by filing class action lawsuits against media outlets and other companies in a vast array of industry sectors (recently including fast food chain Chick-fil-A) with an online presence that offer prerecorded video content.
What Is Meta Pixel?
Recently, scores of VPPA class action lawsuits have been
filed regarding the Meta Pixel tracking tool. As explained by Meta
Platforms, Inc. (formerly Facebook): "The Meta Pixel is a
piece of code you put on your website that allows you to measure
the effectiveness of your advertising by understanding the actions
people take on your website."2 Also known
informally as the Facebook retargeting pixel, Meta Pixel helps
drive and decode key performance metrics generated by a particular
platform. Specifically, the Meta Pixel helps businesses with a
Facebook page determine and improve the return on investment from
the world's biggest social network.
The Meta Pixel can collect the following data:
- Anything present in HTTP headers: Includes IP addresses and information about the web browser, page location, document, referrer and person using the website.
- Pixel-specific data: Includes Pixel ID and the Facebook Cookie.
- Button-click data: Includes any buttons clicked by site visitors, the labels of those buttons and any pages viewed as a result of the button clicks.
- Optional values: Developers and marketers opt to send additional information about the visit through Custom Data events, such as conversion value, page type and others.
- Form-field names: Includes website field names such as email, address, quantity, etc., when individuals purchase a product or service.3
VPPA Class Action Lawsuits
VPPA suits are typically filed in federal court since VPPA
is a federal statute. Class actions may be filed against a variety
of types of companies that host a website or app containing online
video content. Suits are typically brought on behalf of a
"class" of individuals, including customers, members or
subscribers of the defendant company.
A common VPPA complaint may allege that:
- The defendant company uses Meta Pixel (or similar tracking technology) to track individuals' viewing habits and history.
- The defendant knowingly shares this information with Meta (or similar technology platforms) and/or other third parties.
- This information is shared by the defendant without plaintiffs' written informed consent.
- The information (personally identifiable information, or PII)
tracked and transmitted may include, among other data:
- Title of the video(s) and/or webpages viewed
- Individual users' Facebook ID
- Users' email address.
Legal Defenses to VPPA Claims
Court decisions on motions to dismiss VPPA lawsuits at the
pleading stage are a mixed bag. Fortunately for defendants, there
are a number of potential legal challenges to these cases.
Defendant is not a "video tape service
provider"
Some courts have held that the test for determining whether a
defendant is a "video tape service provider" under the
Act is whether they are "substantially involved in the
conveyance of video content to consumers." However, other
courts have held that this might be a question of fact to be
addressed after discovery has been conducted. Video tape service
providers are not limited to content "creators," and may
include content "distributors" - including companies that
deliver video content on their website or an app created by others.
As a general rule, the broadcast of "live" videos falls
outside the scope of VPPA. An e-newsletter that features video
content might fall within the scope of the VPPA.
"Ordinary course of business" exception
The VPPA provides that a video tape service provider's
knowing disclosure of PII is permitted if "incident to the
ordinary course of business." It narrowly defines
"ordinary course of business" as debt collection, order
fulfillment, request processing and transfer of ownership. In other
words, a video tape service provider that shares PII with a third
party to perform any such functions will likely fall within the
exception, regardless of whether a consumer's prior written
consent was obtained. Notably, some courts have held that
disclosing PII to third parties (such as Google or Facebook) to
measure analytics and increase advertising revenues does not fall
within the "ordinary course of business" exception.
Plaintiffs are not "consumers"
Defendants may challenge the plaintiff's classification as
a "consumer" under the VPPA by arguing that the plaintiff
did not "rent, purchase, or subscribe to goods or
services" offered by the defendant in connection with video
services. Some courts have adopted a multifactor test to determine
whether someone is a "subscriber." A subscriber
relationship may include some sort of ongoing commitment or
relationship between the user and the entity that owns and operates
an app, website, etc. For instance, a subscriber relationship may
exist when an individual pays, registers or otherwise obtains
access to restricted content offered by the defendant.
Importantly, however, a financial payment is not a prerequisite to qualify as a subscriber under the VPPA. Courts have recognized that users often sign up or register for complimentary content. For example, providing an email address in exchange for receiving free content and/or creating an online account might be sufficient to qualify as a "subscriber" under the VPPA. However, merely downloading a free smartphone application and watching videos at no cost does not automatically constitute a subscription.
No disclosure of PII
With respect to the disclosure of PII, such information must
permit an "ordinary person" to identify a specific
individual's video-watching habits. Courts have held that PII
is not limited to information that explicitly names a person and
may include other unique identifiers. For example:
- A device serial number may not constitute PII because it is not sufficient for an ordinary person to identify a specific individual.
- GSP coordinates or geolocation of an individual at the time they are viewing video content might support a VPPA claim.
- Facebook ID might constitute PII because anyone who possesses one may use it to "quickly and easily locate, access, and view the corresponding Facebook profile," which in turn can reveal a user's name or other personal information.
One court recently held that the disclosure of a plaintiff's Facebook ID and the name of the webpage(s) accessed is insufficient to state a claim under the VPPA without specifying the video content viewed. Merely disclosing the name of the webpage does not necessarily indicate that an individual requested or obtained specific video materials - even if the page did include some video content.
No "knowing disclosure" of PII to a third
party
Some defendants have attacked VPPA claims on the basis that
they did not make a "knowing disclosure" of PII to any
third parties. However, to survive a motion to dismiss, a complaint
need only allege that the defendant knew that the tracking pixel
disclosed PII to a third party such as Facebook. One court recently
held that whether a defendant or Facebook placed a tracking pixel
on the website to collect PII is a question of fact to be decided
at a later stage of the proceeding.
Conclusion
At least for the foreseeable future, it appears that
plaintiffs intend to continue their fast and furious filings of
VPPA class action lawsuits until more courts are willing to dispose
of these cases at the pleading stage. To avoid potentially sizeable
statutory damages awards, defendants should assess the tracking
tools they use with respect to any prerecorded video content, and
explore the possibility of requiring individuals to provide
informed written consent by separately registering for access to
such content.
footnotes
1 "Video Killed the Radio Star" is a song written by Trevor Horn, Geoff Downes and Bruce Woolley in 1979.
2 https://www.facebook.com/business/help/742478679120153?id=1205376682832142.
3 https://developers.facebook.com/docs/meta-pixel/.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.