On October 15, 2024, the United States Court of Appeals for the Second Circuit issued an opinion in Salazar, et al. v. National Basketball Association, Docket No. 23-1147, a class action lawsuit brought under the Video Privacy Protection Act, 18 U.S.C. § 2710 (VPPA). The recent Salazar opinion expands the definition of a “consumer” under the VPPA and may reignite litigation under the statute which saw a decrease in activity recently. 

According to the Second Circuit’s ruling, a consumer with standing to sue under the VPPA is not limited to individuals that paid to consume video content and, rather, extends to those that consume any goods or services—audiovisual or not—from a business that subsequently shares identifying information about individuals’ video viewing behavior.

This alert explains the Salazar opinion and the impact it may have on businesses providing video content on their websites. 

The VPPA

The VPPA is a federal statute that was enacted in 1988, in the era of brick-and-mortar video rental stores. The VPPA prohibits video tape service providers from disclosing consumers’ personally identifiable information to third parties. The VPPA generally defines a “video tape service provider” as “any person, engaged in the business, in or affecting interstate or foreign commerce, of rental, sale, or delivery of prerecorded cassette tapes or similar audio visual materials,” and a “consumer” as “any renter, purchaser, or subscriber of goods or services from a video tape service provider.” The VPPA defines “personally identifiable information” as “information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider.”

The VPPA imposes severe statutory penalties, including $2,500 in liquidated damages per violation, which consumers may pursue directly via a private right of action.

Pre-Salazar Litigation Landscape 

Prior to the recent Salazar opinion, a number of courts declined to find businesses that passively offer video-based content on their websites meet the statutory definition of a “video tape service provider” under the VPPA. Similarly, other lawsuits were dismissed on the grounds the plaintiff failed to satisfy the statutory definition of a “consumer” with standing to sue under the VPPA. 

Salazar has now turned those rulings on their head.

The Salazar Opinion

The critical question addressed by the Second Circuit is whether Salazar successfully alleged he is a “consumer” with standing to sue under the VPPA. The Second Circuit answered that question in the affirmative. According to the Second Circuit, the phrase “goods or services” under the VPPA is not limited to audiovisual goods or services, and, thus, Salazar became a “subscriber” of goods or services, i.e. a “consumer,” when he signed up for the NBA’s online newsletter. According to Salazar, he viewed NBA.com videos “while logged into his Facebook account,” and the NBA—via a website pixel—disclosed his personal viewing information to Facebook without his informed consent. Salazar, pp. 9-10.

The Second Circuit grappled with two central questions in reversing the lower court ruling: “Is the [NBA’s] digital newsletter a ‘good or service,’” and “is Salazar a subscriber?” Salazar, p. 27. 

In ultimately disposing the first question, the Second Circuit held the “plain meaning” of “goods or services” as written in the text of VPPA does not limit the phrase to “audiovisual content.” Salazar, pp. 28-29. Likewise, the Second Circuit held that a “consumer” under the VPPA “should be understood to encompass a renter, purchaser, or subscriber of any of the provider’s ‘goods or services’—audiovisual or not.” Salazar, p. 34.  

Salazar’s Impact and Risk Mitigation Strategies

Litigants pursuing VPPA claims will undoubtedly feel encouraged by the Second Circuit’s expansion of the VPPA’s most critical statutory definitions, and businesses offering video content on their websites should be prepared for a renewed wave of VPPA lawsuits. 

However, there are numerous steps that businesses may take to mitigate their potential exposure, including:

• Understand the pixel, cookie and other advertising technologies on their websites, including what information is being collected and whether that information is being shared with third parties.
• Limit or remove advertising technologies that may collect data relevant to audiovisual content.
• Review and update privacy disclosures and website privacy settings.
• Review agreements with third parties, including advertising technology providers.
• Clearly disclose the use of advertising technologies, and where applicable, obtain informed consent from consumers.
• Implement or update arbitration and class action waiver provisions on website terms of use and other consumer-facing agreements and notices.

As a best practice, it may be advisable to schedule a standing quarterly meeting between your company’s legal, marketing, IT/website development, and compliance functions. Ideally, the meeting should be moderated by privacy counsel (under privilege) who can talk about these trends/risks and how to mitigate them. 

If you have questions, are facing a potential lawsuit, or need someone to help ensure your company is in compliance with the most current recommendations and regulations, Shook’s Privacy & Data Security team stands ready to assist. 

Jad Sheikali has recently joined Shook, Hardy & Bacon as a partner in the firm's Privacy & Cybersecurity team. He has experience defending class actions arising under the VPPA and advising clients on VPPA compliance strategies.