SCOTUS Declines VPPA Review as New York Advances Sweeping Health Privacy Bill

Want to receive these privacy recaps in your inbox each week? Subscribe here.

The Supreme Court declined to review the NBA’s petition under the Video Privacy Protection Act, leaving unresolved conflicting circuit court decisions on whether recipients of free non-audiovisual materials qualify as “consumers” under the decades-old law. Meanwhile, New York lawmakers passed comprehensive health privacy legislation that could impose stricter consent requirements than Washington’s My Health My Data Act.

Keep reading for a complete breakdown, including my takeaways.

United States

SCOTUS Declines to Resolve VPPA Circuit Split

The U.S. Supreme Court denied the NBA’s petition to review a case under the Video Privacy Protection Act (VPPA), leaving circuit decisions in conflict regarding the law’s scope. 

Specifically, the 2nd Circuit Court of Appeals, in an October 2024 reversal of a lower court decision, held that a “consumer” under the VPPA (defined as “any renter, purchaser or subscriber of goods or services from a video tape service provider“) encompasses a renter, purchaser or subscriber of any of the provider’s goods or services, not just audiovisual materials. The court also held that a person doesn’t have to spend money to be a “subscriber.” 

Accordingly, the 2nd Circuit found that the plaintiff’s signing up for a free NBA online newsletter was sufficient to make him a “consumer” under the VPPA, even though the newsletter didn’t contain audiovisual materials. The information allegedly disclosed in violation of the VPPA related to videos the plaintiff watched on the NBA’s website, not via the newsletter or any other subscription. 

This ruling conflicts with rulings in the D.C. and 6th Circuits and aligns with the 7th Circuit, leaving a 2-2 circuit split. The NBA’s petition also requested review of the 2nd Circuit’s ruling that merely disclosing covered information to a third party, without more, was sufficient injury to establish standing under the VPPA, a departure from decisions in most other circuits.

TAKEAWAY

The Supreme Court’s refusal to review the NBA case does not necessarily mean that the circuit split will remain unresolved. Multiple other cases have pending petitions for Supreme Court review of the same issue, so the Supreme Court may rule in response to one of them.

In the meantime, companies with third-party pixels embedded on their websites that contain video content may fall within the scope of the VPPA, regardless of whether the video content itself is part of a subscription.

United states

New York Sends Health Privacy Bill to the Governor

The New York Health Information Privacy Act, a health privacy law broader in some respects than Washington’s My Health My Data Act, will take effect one year after the Governor signs it.

TAKEAWAY

If signed, Regulated Entities will be required to obtain “valid authorization” to process or sell Regulated Health Information unless strictly necessary for certain purposes listed in the law (e.g., for fraud, security, legal claims, to provide a product or service requested by the consumer, or for internal business operations, but specifically excluding marketing, advertising, research or providing products to third parties).

Valid authorization must be signed by the consumer, separate from any transaction, and made at least 24 hours after the individual creates an account or first uses a product or service. Individuals must be able to give or withhold consent to each category of processing individually.

Both the scope of Regulated Health Information and Regulated Entities are broad, potentially reaching much further than Washington’s My Health My Data Act. Regulated Health Information encompasses “any information that is reasonably linkable to an individual or a device and is collected or processed in connection with the physical or mental health of an individual.”

Regulated Entities include entities located in New York or that control the processing of regulated health information of a New York resident or someone physically present in New York. Unlike Washington’s My Health My Data Act, New York does not explicitly provide for a private right of action, but it also doesn’t limit enforcement to the Attorney General.

A LITTLE MORE PRIVACY, IF YOU PLEASE

• The Data (Use and Access) Act 2025: Everything businesses should know 
• Zillow Fixes Privacy Disclosure Issues in Response to DAA Inquiry
• CalPrivacy Publishes Guidance for the Delete Act DROP Platform
• European Commission Comments on Meta Pay-or-Consent Model
• Australia Conducts First Privacy Compliance Sweep

A Little Privacy, Please weekly recaps are provided for general, informational purposes only, do not constitute legal advice, and should not be relied upon for legal decision-making. Please consult an attorney to determine how legal updates may impact you or your business.