In the 1997 futuristic thriller “Gattaca,” character Vincent Freeman, played by actor Ethan Hawke, falls victim to genetic discrimination after the government begins to track and monitor human DNA strands via the Internet in a scheme to control and manipulate societal trends.
While the film’s plot seems nothing short of fantastical, the idea behind it—that the Internet has become an unguarded playground for identity thieves and major corporations to obtain unauthorized information in a quest to influence consumer behavior—echoes recent plaintiffs’ suits regarding the protection of personal privacy under the Video Privacy and Protection Act (VPPA) that have become increasingly popular in federal courts.
The VPPA, which Congress enacted in 1988, is designed to protect consumer privacy against the disclosure of personally identifiable information (PII). Congress passed amendments to the law in 2013 that made it easier for companies to obtain consumer consent.
In In re Nickelodeon Privacy Litigation, plaintiffs sued Google and Viacom in the United States District Court of New Jersey, alleging that the companies improperly tracked and disclosed children’s user data and PII in order to improve and expand their target audiences. The court held that the disclosure of PII such as serial numbers, browser settings, and IP addresses, to a third party adviser, could not violate the VPPA since such information failed to connect a person’s identity to actual video materials. The plaintiffs argued that Google could “de-identify” the information. The court found this claim to be “entirely theoretical” and “wholly speculative,” in large part because the plaintiffs did not allege that they had even registered with Google, a key first step in any possible “de-identification.”
While the Nickelodeon suit remains one of the more widely known VPAA class actions, other video providers, Internet service companies, and multimedia corporations have also been targets of such lawsuits. Federal district courts have dismissed those suits too, including Locklear v. Dow Jones & Co., In re Hulu Privacy Litigation, and Ellis v. Cartoon Network, Inc., on the ground that the respective plaintiffs failed to allege sufficient facts to substantiate their charges. Those rulings, along with In re Nickelodeon, have narrowed the scope of who can be found liable and what properly qualifies as PII under the VPPA.
The losing plaintiffs in In re Nickelodeon and Dow Jones have appealed to the U.S. Court of Appeals for the Third and Eleventh Circuits, respectively. The outcomes of these appeals will have a significant impact on the future of VPPA class actions.
If either or both appellate courts reverse the lower courts, information that was previously deemed anonymous in disclosing an otherwise unidentified customer (such as zip codes, user ID’s, gender, age, and IP addresses), would be covered under the law. Given the ubiquity of that type of data collection online, a ruling for either appellant will inspire a flood of copycat class actions and imperil widespread business practices that can enhance consumers’ online experiences.
On the other hand, appellate court rulings that affirm the well-reasoned and definitive lower court decisions would create a virtual road block to future plaintiffs. Class-action plaintiffs’ law firms are, at bottom, businesses, and they will likely make the rational choice to abandon this line of “business” for lawsuits that offer fewer risks and greater likelihood of profit.
We trust that the Third and Eleventh Circuits, as well as district court judges in any other ongoing cases will judicially hit the stop button instead of “rewind and repeat” when it comes to VPPA lawsuits.