In depth
In Salazar v. NBA, Michael Salazar filed a class action lawsuit against the National Basketball Association (NBA) for allegedly violating the VPPA. Salazar claimed that after signing up for NBA’s free online newsletter and providing personal information, including his Facebook email address, the NBA disclosed his video-watching history and Facebook ID to Meta Platforms, Inc. without his consent via the Facebook Pixel program. The US District Court for the Southern District of New York (SDNY) dismissed Salazar’s complaint on August 8, 2023, siding with the NBA and ruling that he did not qualify as a “consumer” under the VPPA because the newsletter was not an audiovisual “good or service” and signing up for it did not make him a VPPA “subscriber.”
On appeal, the US Court of Appeals for the Second Circuit reversed the SDNY court’s decision on October 15, 2024 and disagreed with its interpretation of the VPPA. As the term “goods or services” was not limited to audiovisual materials only, signing up for the NBA’s online newsletter with personal information (such as email address, IP address, and any cookies associated with his device) qualified Salazar under the broad protection of the VPPA. The Second Circuit held that Salazar’s alleged injuries were sufficiently concrete to confer Article III standing because the disclosure of his personal information to a third party without his consent constitutes harm. It found this harm comparable to the traditionally recognized basis for lawsuits in American courts: the public disclosure of private facts.
The ruling was narrow and limited to this single issue. The case was remanded to the district court to consider other submissions by NBA, namely (i) the disclosure was not controlled by NBA and not done “knowingly”; (ii) Salazar had consented to the disclosure by agreeing to the NBA privacy policy; (iii) Salazar had waived his rights to bring a class action under the NBA Terms of Use, which included a class action waiver.
This case, while binding within the Second Circuit (New York, Vermont, and Connecticut), is persuasive to courts nationwide. It follows the reasoning of the Eleventh Circuit (Ellis v. Cartoon Network, Inc.) and First Circuit (Yershov v. Gannett Satellite Information Network, Inc.) that payment is not a necessary element of a subscription under the VPPA. Providing personal information in exchange for access to content establishes a user’s status as a “subscriber” or “consumer.” The courts have found that this interpretation aligns with the VPPA’s broad language and privacy-protective goals.
Comments
While the VPPA originally addressed privacy concerns of traditional video rental stores, courts have not been reluctant in applying its provisions to a wide range of online platforms and services that gather, handle, or store customers’ personal information. There is no consensus yet on which way the tide of VPPA cases is turning. However, given the trend of class action lawsuits demanding statutory damages under the VPPA (USD 2,500 per violation), attorneys’ fees, and other damages, as well as the ensuing reputational harm, companies must take this risk seriously and implement measures to mitigate risk, including the following:
- For companies with subscription and video content, review their technology tracking tools (such as Meta or Google pixels) and restrict the ability to share consumers’ personal information with third parties;
- Review the privacy policy applicable to the website/platform to include appropriate disclosures about use of personally identifiable information, including any possible sharing with third parties; and
- Explore options for obtaining express consent from consumers so they are required to acknowledge their understanding of the website’s tracking functions before they view the video content. Such consent should be in a “separate and distinct” form and must provide the ability for the consumer to opt-out of such consent at any time.
