10/24/2024 | News release | Distributed by Public on 10/24/2024 13:28
The U.S. Court of Appeals for the Second Circuit reinstated a proposed class action by Michael Salazar against a professional sports organization on October 15, 2024, alleging violations of the Video Privacy Protection Act (VPPA). The decision clarifies key aspects of the VPPA, specifically regarding what it means to be a "subscriber of goods or services" under the Act, and broadens the scope of potential VPPA claims against commercial websites. The Second Circuit's decision is notable in that it signals a reversal of the recent trend of dismissals of VPPA claims in courts across the country and could trigger a significant increase in VPPA lawsuits. Although organizations have grappled with VPPA claims for several years, this decision is another red flag to organizations to take immediate steps and ensure compliance with privacy laws to mitigate the risks of VPPA claims.
Michael Salazar filed a class action lawsuit against a professional sports organization alleging that it violated the VPPA by disclosing his personal viewing information to a third-party social media provider without his consent. Salazar had signed up for the organization's free online newsletter and visited the organization's website, where he watched videos. Salazar alleges that his video viewing history and social media ID were shared with the third party through pixel tracking software embedded in the organization's website without his permission. The district court dismissed Salazar's claims largely on the basis that the organization's online newsletter was not an audiovisual "good or service" and there was no nexus between subscribing to the online newsletter and the provision of video content on the organization's website. The rationale for the dismissal was similar to what many other courts have cited in dismissing VPPA claims in other jurisdictions.
The central issue on appeal with the Second Circuit was whether Salazar qualified as a "subscriber of goods or services" under the VPPA by only being a subscriber to the organization's email newsletter and not purchasing any video services. The Second Circuit rejected the district court's narrow interpretation that only audiovisual "goods or services" could qualify a person as a subscriber under the VPPA. Instead, the appellate court held that the term "goods or services" was not limited to audiovisual content and, because Salazar had provided personal information in exchange for access to the organization's newsletter, he was considered a "subscriber" under the VPPA. Accordingly, the court held that the organization must comply with the VPPA when Salazar watches videos on its website.
The Second Circuit's decision in Salazar significantly expands the scope of who qualifies as a "consumer" under the VPPA. Under this interpretation, any individual who registers or subscribes to a free newsletter or other digital service from an organization that also provides video content may be considered a subscriber and, thus, would be protected by the VPPA. The ruling increases the risk for organizations that provide video content on their websites or other digital platforms. It is important to note that the Second Circuit did not address whether the organization's disclosure of subscriber data to the third-party social media company was a violation of the VPPA, and the decision did not impact other common defenses asserted by organizations to VPPA claims. Nonetheless, an expanded scope of potential claimants means an expanded scope of potential exposure and risk to organizations that collect and share personal information related to video content.
Organizations that provide video content through websites and other digital platforms should take immediate steps to assess how they use pixels and other tracking technologies on such platforms. Below are some recommended best practices to mitigate the increased risks associated with VPPA claims in light of the Salazar decision:
The Second Circuit's decision in Salazar further clouds what were already muddy waters regarding VPPA claims. Courts will likely continue to disagree on the application of the VPPA and the interpretation of its defined terms. Therefore, additional confusion is expected and a jurisdictional split is not out of the question. Organizations would benefit greatly by engaging experienced counsel to help implement the best practices outlined above in an effort to mitigate the risks amid this growing uncertainty. Please contact Alex Koskey, Al Leiva, or any member of Baker Donelson's Data Protection, Privacy, and Cybersecurity team if you have any questions concerning these issues or any aspect of your privacy or cybersecurity programs.