The Second Circuit’s decision in Salazar v. NBA, No. 23-1147 (2d Cir. Oct. 15, 2024) creates significant risk for companies that offer videos for viewing on their websites and significantly expands potential liability under the Video Privacy Protection Act (VPPA). In Salazar, the Second Circuit held that a “subscriber” as defined by the VPPA means a “consumer” who is provided with any good or service from a website—whether or not audiovisual—and who has exchanged something of value (e.g., an email address or an IP address, but not necessarily money) in order to receive this good or service.
The implications of this reading of the statute cannot be overstated: essentially, if a website hosts video, and a user provides that website with something of relatively minimal value in exchange for the regular receipt of, say, marketing emails, the website can be liable for data transfer to third parties under the VPPA.
Given the number of users who regularly provide websites with their IP addresses or emails for regular, everyday transactions and the number of websites that host video content, this interpretation can potentially create nearly unbounded liability under the VPPA.
What is the VPPA?
The history of the VPPA began with Robert Bork’s Supreme Court nomination in 1987 when a reporter persuaded the clerk at Bork’s local video store to provide him with a list of video tape titles that Bork and his family had rented. Congress found that to be an “outrageous invasion of privacy” (notwithstanding that Bork’s nomination was ultimately rejected for other reasons).
In response, Congress passed the VPPA, which makes it unlawful for a “video tape service provider” to “knowingly disclose, to any person, personally identifiable information concerning any consumer of such provider.” The statute defines “consumer” as “any renter, purchaser, or subscriber of goods or services from a video tape service provider.” It does not define “goods or services” or “subscribers.”
What Happened in the Case?
In Salazar, the plaintiff signed up for an online email newsletter offered by the NBA for free, and he later visited the NBA’s website, where he watched videos. He alleges that his video-watching history and “Facebook ID” were then disclosed to Meta Platforms, Inc. (Meta) without his permission via an embedded scripting known as the “Meta pixel” that was running in the background on the NBA’s site. The plaintiff asserted that the NBA’s alleged disclosure of his information via the Meta pixel violated the VPPA.
In granting the NBA’s motion to dismiss, the district court reasoned that the VPPA only applies to subscribers of audio video services. It held that the plaintiff’s act of signing up for a free online newsletter did not make him a “subscriber” to the NBA’s video services. The district court also found that the newsletter’s links to videos on the NBA’s website were irrelevant because the videos were publicly accessible and did not provide exclusive content or enhanced access that would invoke the protections of the VPPA. Thus, the district court concluded that because the plaintiff was not a “subscriber” of goods or services from a “video tape service provider,” he was not a “consumer” under the VPPA, and therefore, the plaintiff’s claims failed as a matter of law.
Second Circuit Reverses
In a dramatic expansion of VPPA liability, the Second Circuit reversed. First, the panel held that, under the VPPA, a “subscriber of goods or services” is anyone who subscribes to any “goods or services.” The court reasoned that, while other portions of the statute—in particular, the definition of a “video tape service provider”—specifically required the provider to offer “audio visual materials,” the absence of that verbiage in the definition of a “consumer” meant there was no similar restraint required to understand the proper definition of “consumer” under the statute. Thus, the panel concluded that a subscription to any goods or services of a business—including the digital newsletter at issue in Salazar—was sufficient to merit VPPA protection for otherwise covered videos, even if the subscription had nothing to do with videos.
The court also held that the plaintiff was a “subscriber” to the newsletter, even though he paid nothing for it. In reaching this conclusion, the court found that in return for receiving the newsletter, the plaintiff offered his email address, IP address, and cookies associated with his device. The court also reasoned that, in the modern age, individuals regularly “subscribe” to services without any monetary payment, using the example of subscribing to a YouTube channel for free.
Thus, because the court found that the plaintiff had plausibly alleged that he was a “subscriber of goods or services” under the VPPA definition, it reversed the district court and remanded for further consideration.
Impact of Salazar and Key Takeaways
The Second Circuit described its ruling in Salazar as “narrow.” It is not. On the contrary, the decision represents a dramatic expansion of the statute.
There is much to criticize in the court’s reasoning. For example, if a person “providing” their IP address is enough to qualify as a “subscriber” to a website, then any user viewing any video on the internet could arguably expose a website to liability under the VPPA since any company hosting videos on its site “obtains” the IP addresses of users who visit. This is almost certainly a broader definition of “subscriber” than either the general public or companies would agree to. Neither a user who has visited a site once and watched one video on it, nor the company that owns that website, is likely to consider that user a subscriber.
Yet, this broad interpretation of "goods or services" and "subscriber" means that even non-paying users could be classified as consumers, subjecting companies to VPPA requirements if they share personally identifiable information related to video content without proper consent. Regardless of how overbroad this interpretation may be, Salazar is now precedent in the Second Circuit, and the decision will invariably be used to try and expand the scope of the VPPA nationwide, subjecting companies of all shapes and sizes to vastly increased liability.
Companies operating websites with audio visual materials should, therefore, review their use of tracking pixels, cookies, and any other technologies that may inadvertently collect and share video viewing histories with third parties. Making necessary changes to websites sooner rather than later is key. Statutory damages are significant under the VPPA at $2,500 per violation, and companies face significant class action exposure from potential missteps. Making changes now can mitigate the risk of substantial liability down the line. As the legal landscape continues to evolve, staying informed and proactive is the best defense.
For more information on this topic, please contact:
David M. Krueger at dkrueger@beneschlaw.com or 216.363.4683.
Nathalie M. Gorman at ngorman@beneschlaw.com or 646.593.7050.