In recent years, courts have been inundated with class action lawsuits filed against a broad range of companies in which the plaintiffs allege that routine web browsing activities resulted in the illegal collection and sharing of their personal information. Some of these suits allege violations of the Video Privacy Protection Act, 18 U.S.C. § 2710 (VPPA), enacted in 1988 following publication of former U.S. Supreme Court nominee Robert Bork’s video tape rental history while his nomination was pending. 

The VPPA provides a private right of action to “any consumer” whose “personally identifiable information” is “knowingly disclose[d]” by a “video tape service provider” to any person without the consumer’s informed written consent. The product of a bygone technological era involving video cassette tapes, the VPPA defines “consumer” as “any renter, purchaser, or subscriber of goods or services” from a video tape service provider. The VPPA does not, however, define “goods or services” or “subscriber.” Moreover, the standards for alleging a concrete injury for intangible harms – such as purportedly unauthorized information sharing – remain disputed in the wake of the Supreme Court’s ruling in TransUnion LLC v. Ramirez, 594 U.S. 413 (2021).

On October 15, 2024, the Second Circuit waded into these questions and the VPPA’s applicability “in an increasingly online world” in Salazar v. National Basketball Association. 

The plaintiff in Salazar filed a putative VPPA class action in the Southern District of New York, alleging that he signed up to receive an email newsletter from the NBA for no monetary payment and, separately, that he visited the NBA’s website and watched videos. The plaintiff further asserted that while logged into his Facebook account, the NBA shared with Facebook (Meta) his video-watching history from the NBA website, as well as his Facebook ID, without his permission, thus violating the VPPA. According to the complaint, the sharing was facilitated by computer code called a Facebook tracking pixel, which the NBA installed on its site. Meta purportedly then used the shared information to send the plaintiff targeted ads, with the NBA receiving financial remuneration from the arrangement.  

The NBA moved to dismiss on the grounds that the plaintiff lacked standing and had failed to state a claim. Although the district court found that the plaintiff had sufficiently alleged standing to sue, it dismissed his claims on the merits. Specifically, the district court ruled that to qualify as a “subscriber” and “consumer” for VPPA purposes, the plaintiff needed to be a consumer of audiovisual goods or services. The newsletter, according to the district court, did not qualify as an audiovisual good or service, and video links in the newsletter did not change the calculus given the lack of allegations that the newsletter provided exclusive content or enhanced access beyond what was generally available on the site. The plaintiff appealed. 

The Second Circuit vacated the district court’s decision and remanded the case for further proceedings. 

On standing, the Second Circuit agreed with the district court’s determination that the plaintiff had alleged a concrete injury sufficient to confer standing per Article III of the U.S. Constitution. Under TransUnion, the plaintiff was required to allege an injury with a “close historical or common-law analogue.” The court found the plaintiff’s claim closely related to the traditionally recognized intangible harm of public disclosure of private facts. The court rejected the NBA’s argument that the alleged disclosures to Meta were not sufficiently “public,” focusing on Meta’s size, the plaintiff’s allegations that Meta would use the information to show him targeted ads for its own purposes, and other unspecified “potential uses” by Meta. 

On the merits, the court rejected the NBA’s argument that “it makes no sense that the VPPA can be triggered by a consumer transaction unrelated to videos,” ruling that the plaintiff qualified as a “subscriber” under the VPPA based on his allegations that he signed up for the NBA newsletter – even if the newsletter did not relate to audiovisual goods or services. The court reasoned that the VPPA's “text, structure, and purpose” indicated that Congress meant for the VPPA to apply broadly, and if Congress had intended for “goods or services” to be limited to audiovisual content, it would have said so explicitly. The court also rejected the NBA’s policy argument that failing to cabin “goods or services” to audiovisual goods or services would lead to anomalous results – for example, a consumer who bought a hammer at a company’s physical store and then watched a free video on the company’s website being considered a “consumer” under the VPPA. The court disagreed that this result was “anomalous” or that it was sufficient to “justify artificially cabining the statute’s scope” given what the court characterized as the VPPA’s plain text and broad purpose. 

The court also rejected the NBA’s assertion that the plaintiff was not a “subscriber” because signing up for the newsletter did not signify a sufficient relationship between the plaintiff and the NBA. Citing decisions from the Eleventh and First Circuits, the court held that payment of money was not a prerequisite to being a VPPA “subscriber”; otherwise, the term “subscriber” would be superfluous to the terms “renter” and “purchaser.” The court also cited examples of subscriptions that did not require monetary payments (e.g., subscribing to a YouTube channel) and credited the plaintiff’s allegations that in exchange for the newsletter, he provided his email and IP addresses and cookies associated with his device, which the NBA could allegedly use to identify his city, zip code, and physical location. The court said this “valuable personal information” increased the NBA’s potential to urge the plaintiff to visit its website and watch videos, thus “making the NBA’s relationship with him distinct from its relationship with casual NBA.com video-watchers who had not signed up for the newsletter.” 

Finally, the court punctuated its decision by stating that although current means of consuming content may be different, “[t]he VPPA is no dinosaur statute,” that its privacy protections remain “robust,” and that Congress “did not intend for [it] to gather dust next to our VHS tapes.”

To be clear, the Second Circuit’s ruling on the merits was limited to the issue of whether the plaintiff had plausibly alleged he was a “subscriber,” leaving it to the district court to address in the first instance certain alternative arguments raised by the NBA. The court also noted that its conclusions were conditioned on the necessary pleading-stage presumption that the plaintiff’s allegations were true, and that discovery might “ultimately paint a different picture.” 

Nevertheless, the court’s expansive construction of the VPPA’s text and purpose is cause for concern, along with dicta indicating that the court might be receptive to even broader interpretations in future matters (“That is not to say that a NBA.com video-watcher who does not sign up for the online newsletter is not also a VPPA ‘subscriber.’”). Indeed, plaintiffs have asserted VPPA violations against companies whose businesses have little if anything to do with the provision of video content, relying on user interactions significantly more tenuous than the newsletter subscription alleged in Salazar.

Thus, while defendants facing VPPA claims should continue to resist implausible attempts to plead the VPPA’s elements or allege a concrete harm, they can reasonably expect to face headwinds on motions to dismiss. Accordingly, potential defendants should also consider taking steps to monitor and, if appropriate, modify their website content and functionality, including terms of service and privacy policies, arbitration clauses and class action waivers, cookie banners and consents, and other disclosures and business practices. Further, defendants should be prepared to build a factual record to substantiate their defenses to class certification and the merits in the event pleading challenges fail.