The U.S. Court of Appeals for the Ninth Circuit held in Eichenberger v. ESPN that allegations that the Video Privacy Protection Act was violated are sufficient to establish Article III standing, but that the definition of “personally identifiable information” under the statute should be limited to information that would readily permit an ordinary person to identify a specific individual’s video-watching behavior. In its Nov. 29, 2017 ruling, the court held that PII does not include numerical identifiers that websites providing streaming video services use to track users’ viewing habits. Thus, while the ruling would appear to lower the bar for plaintiffs to establish standing to bring claims under the VPPA, it limits the application of the law to video streaming tracking practices.
Video Privacy Protection Act
The VPPA prohibits a “video tape service provider” from knowingly disclosing “personally identifiable information concerning any consumer of such provider.” 18 U.S.C. § 2710(b)(1). The statute defines “personally identifiable information” as “information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider.” 18 U.S.C. § 2710(a)(3). The VPPA also provides for a private right of action by “aggrieved” parties. 18 U.S.C. § 2710(b)(1).
In addition to its television channel, ESPN Inc. offers access to sports-related video content through its application “WatchESPN Channel,” which is available on the Roku digital streaming device. Roku allows users to view videos and other content on their televisions through internet streaming.
The plaintiff downloaded the WatchESPN Channel application on his Roku device and used it to watch sports-related content but did not consent to ESPN’s sharing his information with a third party. However, every time the plaintiff used his Roku device to watch an ESPN video, ESPN disclosed his Roku device serial number and the name of the video that he watched to Adobe Analytics, which the plaintiff alleged combined with information from sources other than ESPN to identify the plaintiff. Adobe gave the resulting data back to ESPN in an aggregated form. ESPN, in turn, provided advertisers with aggregated information about the demographics of its users.
The plaintiff sued ESPN, alleging that it had violated the VPPA and knowingly disclosed his PII by sharing his Roku device serial number and the videos he watched with Adobe because ESPN knew that Adobe could and would use this information to identify him. The district court dismissed the action, holding that the information that ESPN disclosed did not constitute “personally identifiable information” within the meaning of the VPPA.
Ninth Circuit Decision
The Ninth Circuit affirmed the district court’s dismissal, not for lack of standing, but for failing to state a claim. The court began by addressing the issue of standing. Citing Spokeo v. Robins (2016), the Ninth Circuit explained that Article III standing required that a plaintiff allege a “concrete and particularized” injury, which may be intangible, in the context of statutory violations, and not simply “bare procedural violation[s].” In determining whether an intangible injury is concrete, the court elaborated that “both history and the judgment of Congress play important roles.” Turning to the VPPA, the Ninth Circuit found that “Congressional judgment leaves little doubt that [the VPPA] is a substantive provision that protects concrete interests” as it protects a consumer’s substantive privacy right in his or her video-viewing history, and “every disclosure of an individual’s ‘personally identifiable information’ and video-viewing history offends the interests that the statute protects.” Accordingly, the court held that, similar to privacy torts which historically did not require “additional consequences” to be actionable, allegations of VPPA violations without any further harm, such as the one in the present case, were sufficient to confer Article III standing.
The Ninth Circuit then addressed whether the information shared by ESPN constituted “personally identifiable information” under the VPPA. In making this determination, the court employed the “ordinary person” test, which limits “personally identifiable information” to only information that “would readily permit an ordinary person to identify a specific individual’s video-watching behavior.” The court noted that this test looked to “what information a video service provider discloses, not to what the recipient of that information decides to do with it,” and “provides video service providers with enough guidance to comply with the VPPA’s requirements.” Applying the “ordinary person” test, the Ninth Circuit found that the plaintiff’s Roku device serial number and the names of the videos that he watched did not constitute “personally identifiable information” under the VPPA because an “ordinary person” could not use this information to identify a specific individual “unless it is combined with other information in Adobe’s possession – data that ESPN never disclosed and apparently never even possessed.”
The ESPN decision offers something for both plaintiffs and defendants. In holding that the VPPA protects a concrete privacy interest and allegations of VPPA violations without further harm are sufficient to meet Article III standing requirements, the Ninth Circuit has made clear that plaintiffs need not allege any economic or emotional injury to establish Article III standing under the VPPA. However, at the same time, by adopting the “ordinary person” test, the ESPN decision has narrowed the categories of information that would constitute “personally identifiable information” under the VPPA and provided clearer guidance for streaming video services to comply with the statute. Under the ESPN decision, not only will fewer categories of information fall under the VPPA, but video service providers will also be able to identify those categories that do more easily. In addition, the ESPN decision eliminates secondary VPPA liability for video service providers in the event that third parties with whom they disclose non-personally identifiable information later use that information in combination with other independently acquired information to identify specific individuals and their video-watching activity.