On April 2, 2025, the United States District Court for the Northern District of California granted Defendant's Motion to Dismiss in Lakes et al. v. Ubisoft, Inc. In Lakes, Among other eavesdropping claims, Plaintiffs alleged that Defendant violated the Video Privacy Protection Act ("VPPA") and California Invasion of Privacy Act ("CIPA") by: 1) disclosing their personally identifiable information ("PII") to a third party; and 2) enabling this third party to intercept their communications with Defendant without their knowledge or consent. As compensation for the alleged harm, Plaintiffs sought statutory damages and injunctive relief, together with reasonable attorneys' fees and costs. Among its other findings, the Court ruled that Plaintiffs had, in fact, provided their consent to the subject capture and disclosure of their personal information. Because consent is a complete defense to the various privacy claims alleged by Plaintiffs, the Court dismissed their VPPA lawsuit.
As our readers are aware, a flurry of eavesdropping lawsuits have been filed in the wake of the Ninth Circuit decision in Javier v. Assurance IQ, LLC. A common refrain is that businesses are illegally gathering data by tracking and recording consumer website activity without consent. As was the case in Lakes, many plaintiffs allege privacy law violations after accessing websites that utilize Meta Pixels. The Order dismissing the Lakes VPPA lawsuit highlights the importance of obtaining consumer consent before utilizing Meta Pixels, or any other website tracking technology.
What is the VPPA?
The VPPA, a federal privacy statute enacted in 1998, was originally drafted to protect consumers who did business with video tape service providers. Although the vast majority of consumers no longer rent video tapes, the last few years have seen a spike in VPPA lawsuits. Plaintiffs are now alleging violations of the VPPA against websites that provide video content.
To properly state a VPPA claim, a plaintiff must demonstrate that: "(1) the defendant disclosed 'personally identifiable information concerning any customer' to 'any person,' (2) the disclosure was made knowingly, (3) the disclosure was not authorized", and (4) the defendant is a "video tape service provider" within the meaning of the statute. Under the VPPA, a "video tape service provider" is a person or entity engaged in the business of rental, sale, or delivery of "prerecorded video cassette tapes or similar audio visual materials," or one that receives a consumer's PII from a video tape service provider.
The VPPA allows a video tape service provider to disclose a consumer's PII if the disclosure is made with a consumer's "informed, written consent." "Informed, written consent" must be: 1) obtained in a form separate and distinct from any form setting forth other legal or financial obligations of the consumer; 2) provided at the time of disclosure or in advance for a set period of time not to exceed two years; and 3) accompanied with an opt out provision.
Why did the Court Dismiss Plaintiffs' VPPA Lawsuit
Defendant operates a website that allows consumers to purchase video games containing pre-recorded audiovisual content. Plaintiffs claimed that Defendant violated the VPPA by utilizing Meta Pixels on its website to record and subsequently disclose PII to third parties for marketing purposes. Defendant argued that Plaintiffs failed to state a VPPA claim because they consented to the tracking activity upon arrival at the website (via a cookie banner), during account creation, and while purchasing Defendant's products.
The Court found that: 1) the cookie banner satisfied the "informed, written" requirement of the VPPA; 2) the Website Privacy Policy contained the requisite consent disclosures, including opt out provisions, in a form "distinct and separate" from other legal obligations; and, most importantly, 3) that Plaintiffs provided their consent to the allegedly violative conduct each and every time that they completed a transaction on the subject website, including during account creation. Accordingly, it dismissed Plaintiffs' claims in their entirety.
Obtain Consumer Consent When Utilizing Website Tracking Technology
Lawsuits filed pursuant to the VPPA and other consumer data privacy statutes are on the rise. The takeaway from Lakes is clear: to safeguard against being named in a VPPA lawsuit, businesses should: 1) provide consumers with adequate disclosures concerning their use of third-party tracking technology; and 2) obtain informed consumer consent to the use of such tracking technology. The attorneys at Klein Moynihan Turco have decades of experience in: 1) defending clients against lawsuits involving consumer protection statutes; and 2) keeping clients compliant with federal and state consumer privacy and marketing laws.
Similar Blog Posts:
Papa John's Sued for Alleged Unauthorized Website Recording
California Data Broker Registration Requirements
The CPRA Sensitive Personal Information Data Category
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
