VPPA in the Spotlight: Courts Diverge, Roku Faces AG Action, CPPA Backs Four New California Privacy Bills

Want to receive these privacy recaps in your inbox each week? Subscribe here.

UNITED STATES

The 2nd Circuit Takes a Side in the VPPA Circuit Split Over Defining PII

Adopting the position of the Third and Ninth Circuits, the Second Circuit Court of Appeals held that “personally identifiable information” under the Video Privacy Protection Act (VPPA), encompasses information that would allow an ordinary person to identify a consumer’s video-watching habits, but not information that only a sophisticated technology company could use to do so. This “ordinary person” standard differs from the First Circuit’s “reasonable foreseeability” standard, under which personally identifiable information includes information that is reasonably and foreseeably likely to reveal which videos the plaintiff has obtained. The First Circuit applied the “reasonable foreseeability” standard in Yershov v. Gannett to hold that Gannett’s disclosure to Adobe of video title information, along with device IDs and GPS coordinates, was sufficient to constitute disclosure of personally identifiable information under the VPPA, because it was reasonably and foreseeably likely that Adobe, a sophisticated technology company, would have the ability to identify the video-watching habits of the plaintiff in that case. Conversely, the Second Circuit applied the “ordinary person” standard to hold that Flipps Media’s disclosure of a Facebook ID and video titles to Facebook was not sufficient to constitute disclosure of personally identifiable information, because the plaintiff in the case failed to allege how an ordinary person would use a Facebook ID to identify the plaintiff.

TAKEAWAY

Although the Second Circuit’s adoption of the ordinary person standard creates additional hurdles for plaintiffs in VPPA pixel litigation, it does not entirely eliminate risk for companies incorporating third-party pixels or other tracking technologies onto digital properties containing video content. First, the “ordinary person” standard has only been adopted by three out of thirteen circuit courts, leaving a lot of room for plaintiffs to test the boundaries in other jurisdictions. Second, even the circuit courts that have adopted the “ordinary person” standard agree that the definition of personally identifiable information under the VPPA is not limited to information that, standing alone, identifies a person, but that it also includes information that can be used by an ordinary person to identify a person. Therefore, tracking technologies that collect enough information (or that provide user-friendly platforms) to enable an ordinary person to identify a person from the information collected could still potentially violate the VPPA under this standard.

Michigan AG Sues Roku for Multiple Alleged Privacy Violations

The Michigan Attorney General filed a lawsuit against Roku, alleging violations by the television content platform of the Children’s Online Privacy Protection Act (COPPA), the Video Privacy Protection Act (VPPA), Michigan’s Preservation of Personal Privacy Act (resembling the VPPA) and Consumer Protection Act, as well as common law claims of intrusion upon seclusion and unjust enrichment. The claims are based on the collection and disclosure of personal information, voice data and video title information by Roku and by third-party trackers without user or parental consent, including from users of sections of the platform and content directed to children, and misrepresentation of the platform’s data collection practices..

TAKEAWAY

This case is a reminder that AG privacy enforcement is not limited to those states that have passed a comprehensive privacy law. Although there is a lot to unpack from the 54-page complaint, one particularly notable element demonstrating a clash of state laws is the Attorney General’s analysis of Roku’s “Your Privacy Choices” screen, which gives all users (regardless of jurisdiction) the ability to enable a “Do not share or sell my personal information” setting–a setting required under California law. Although the Michigan Attorney General would not be able to make a claim based on a company’s failure to offer this setting (since it is not required under Michigan law), Roku’s decision to offer this setting to Michigan users and alleged failure to effectuate the setting as described has opened the platform up for liability under Michigan’s consumer protection act. Specifically, the complaint alleges that, by failing to disclose on the “Your Privacy Choices” screen that enabling the setting only opts the user out of disclosures of personal information that support targeted advertising (rather than all personal information sharing), Roku engages in unfair, unconscionable, or deceptive methods, acts or practices in violation of Michigan law. 

A LITTLE MORE PRIVACY, IF YOU PLEASE

United States

• The California Privacy Protection Agency Votes to Support Four California Privacy Bills

Europe

• The French CNIL Publishes its 2024 Activity Report
• The Irish DPA Fines TikTok over transfers of personal data to China   

A Little Privacy, Please weekly recaps are provided for general, informational purposes only, do not constitute legal advice, and should not be relied upon for legal decision-making. Please consult an attorney to determine how legal updates may impact you or your business.