The VPPA May Be a Dinosaur Statute, But It’s Very Much Alive in the Second Circuit–Salazar v. NBA

NBA.com passed along video viewing information to Facebook using the Facebook Pixel, including “(1) the title of the NBA.com video a user watched, (2) that video’s URL, and (3) the user’s “Facebook ID” (FID)—a number unique to each individual Facebook account.” The plaintiffs sued for VPPA violations.

The court says the plaintiff had standing: “Salazar’s alleged injury stems from the unauthorized disclosure of his personal viewing information, which is closely related to at least one common-law analog traditionally recognized as providing a basis for a lawsuit in American courts: public disclosure of private facts.”

Salazar subscribed to the NBA;s email newsletter. The court says the qualifying VPPA subscription doesn’t need to include audiovisual material (even though it’s the VIDEO Privacy Protection Act), though the protection only applies to video-related personal information.

In its conclusion, the court makes some defensive statements about its ruling:

• “Our ruling is narrow.” I disagree. It dramatically expands the potential universe of VPPA plaintiffs, which ought to trigger lots of activity from the plaintiff’s bar. Something to look forward to.
• “The VPPA is no dinosaur statute.” 🐱‍🐉🐱‍🐉🐱‍🐉 Say what? The VPPA is a quintessential dinosaur statute.  It was written for a different social and tecnnology era based on assumptions that are mockable today. It has aged horribly.

Implications

This ruling expands the VPPA to include customers who have a “subscription” relationship with the business, even if that ongoing relationship has nothing to do with the video-watching, and even if those same customers would not be covered by the VPPA if they just browsed to the website and watched videos. For example, the court says “Congress cast a wide net in defining “video tape service provider,” to ensure that businesses dealing in audiovisual goods or services satisfy the definition even if they also deal in non-audiovisual goods or services.”

Thus, the NBA offers video content and separately offers an email subscription list. The court ruling means that the NBA must comply with the VPPA for every subscriber to the email list if they ever consume video, even if its emails never promote videos. By collapsing these two different relationships, businesses that offer video on their sites (pretty much every business nowadays) must carefully think how they are approaching their relationships with any customer who might access the video content. That’s not a “narrow” decision at all.

Note: the VPPA does allow for consent to disclosures of the personal information, so some of these problems are avoidable.

Case Citation: Salazar v. NBA, No. 23-1147 (2d Cir. Oct. 15, 2024)