IAPP-GDPR Web Banners-300x250-FINAL
DPI16_Banner_300x250 WITH COPY

By Venkat Balasubramani

The Video Privacy Protection Act (VPPA) has spawned plenty of litigation over the past couple of years; but this litigation has resulted in a few relevant recent rulings. One hot-button area has been lawsuits brought by plaintiffs to enforce the “purging requirement” imposed by the VPPA. Another has been the applicability of the statute to online streaming services. Plaintiffs have achieved mixed results in these cases.

Lawsuits alleging failure to purge

Sterk v. Best Buy Stores, LP, 11 C 1894 (N.D. Ill. Oct. 17, 2012): This lawsuit is a putative class action alleging that plaintiff purchased DVDs from Best Buy and that Best Buy retained the purchase history for over a year, and disclosed this information to an affiliated entity, Best Buy Co., Inc.

  • No private right of action for improper retention of personal information. Section 2710(e) of the VPPA is a loosely worded provision that requires covered entities to purge personally identifiable information “as soon as practicable but no later than one year from the date the information is no longer necessary for the purpose for which it was collected.” The Seventh Circuit in Sterk v. Redbox held that section 2710(c) does not provide for a private right of action under 2710(e). Given that this court is bound by the Seventh Circuit’s ruling, plaintiff tried to argue that he could assert a claim under the Stored Communications Act, which is part of the same chapter as the VPPA, as opposed to the VPPA. The judge considered and rejected plaintiff’s argument in Sterk v. Redbox, on remand, and the court follows suit here. Another court in the Northern District of California recently came to the same conclusion.
  • Plaintiffs lack standing to pursue injunctive relief. Plaintiffs also sought injunctive relief, which required the court to address the issue of standing. The court runs through the classic test for standing, but importantly says that Congress cannot create standing for plaintiffs who do not satisfy Article III’s minimum standing requirement. The court also notes—citing the Seventh Circuit’s opinion in Sterk, and to Van Alstyne v. Elec. Scriptorium, an e-mail privacy case—that under the VPPA, only plaintiffs who are “aggrieved” may seek relief. Here, any injury from retention is nonexistent and shouldn’t support standing. Plaintiffs’ disclosure claim similarly did nothing to establish injury—the data was being disclosed to a 100-percent parent corporation. Plaintiffs also tried to rely on the diminution of value of their information and the fact that they allegedly overpaid for the services provided by Best Buy, but the court easily rejects these arguments. Apart from a few stray rulings, these rulings have rarely gotten any traction in courts.
  • Plaintiffs also brought a breach of contract claim. The court says that claims based on older purchases were time-barred. Claims based on later purchases were dismissed due to lack of alleged damages. Plaintiffs are permitted to replead these.

Does the VPPA apply to streaming services?

In re Hulu Privacy Litigation, C 11-03764 LB (N.D. Cal.; Aug. 10, 2012), Hulu is facing a putative class action alleging that it improperly disclosed the video viewing choices of its users without obtaining consent. Hulu initially argued that plaintiffs lacked standing. Relying on the Ninth Circuit’s decision in First American Fin’l Corp. v. Edwards, the court said that alleging a violation of a federal statute was sufficient to satisfy Article III standing. Now the court looks at whether the allegations state a claim under the statute.

  • Is Hulu a “video tape service provider”? The VPPA only covers the rental, sale or delivery of “prerecorded video cassette tapes or similar audiovisual materials.” Hulu argued that this language does not cover online providers. The court disagrees. The court looks to the language of the statute and finds that the phrase “similar audiovisual materials” focuses on the content, not the means of delivery. While the dictionary definition of the word “material” is inconclusive, and everyone agrees that online delivery wasn’t around when the VPPA was enacted, the court looks to the legislative intent:

Congress was concerned with protecting the confidentiality of private information about viewing preferences regardless of the business model or media format involved. The question is whether the mechanism of delivery here—streaming versus bricks-and-mortar delivery—ends this case at the pleading stage…Given Congress’s concern with protecting consumers’ privacy in an evolving technological world, the court rejects (Hulu’s) argument (that it’s not covered by the statute because the statute does not cover digital distribution).

  • Other defenses: Hulu raised two other defenses, neither of which the court buys, at least at the initial stages of the litigation. First, Hulu says that its disclosures fall within the VPPA’s “ordinary course of business” exception. The statute defines ordinary course of business to include “debt collection activities, order fulfillment, request processing and the transfer of ownership.” Hulu’s disclosures—to Facebook, Doubleclick, QuantCast, Google Analytics and ScoreCard—do not clearly fall under this definition. The court declines to dismiss at the pleading stage based on this defense.

Second, Hulu argued that plaintiffs were not “consumers” as defined by the VPPA. The statute defines consumers as “any renter, purchaser or subscriber,” and since the proposed class did not involve paying Hulu customers, Hulu argued that they were not consumers. The court disagrees with Hulu, saying, “[I]f Congress wanted to limit the word ‘subscriber’ to ‘paid subscriber,’ it would have said so.”


It’s interesting to see courts give a broad reading to the VPPA and conclude that it applies to online service providers. This means that a whole lot of entities are potentially subject to its prohibition; e.g., Vimeo; YouTube. Given the uncertainty around its consent provisions, this puts online service providers in a tricky position when it comes to sharing viewing histories. There has been at least one proposal floated to legislatively tweak the VPPA’s consent provisions, but it has not passed to date. As a side note, courts have rejected two lawsuits in this space. First, a lawsuit brought against Netflix for disclosing viewing habits within a household, and second, a lawsuit brought against Pandora for allegedly violating Michigan’s version of the VPPA.

Claims alleging failure to purge under the VPPA represent the far extreme of privacy lawsuits. As the Seventh Circuit’s ruling from Sterk, as well as the rulings in Rodriguez and Sterk v. Best Buy demonstrate, courts will not be very enthusiastic about these claims. The majority of courts have rejected claims for damages on the basis that the VPPA does not provide for a private right of action. Interestingly, the court here cited the Supreme Court’s decision in First American Finance Corp. v. Edwards in concluding that plaintiffs lacked standing to pursue claims for injunctive relief. Although First American Finance dealt with standing to sue under the Real Estate Settlement Procedures Act, in advance of the ruling, many thought this case would alter the landscape for privacy lawsuits and standing. The ruling from the Supreme Court was largely viewed as anti-climactic from a broader privacy standpoint, but maybe it has more vitality than originally thought. The court’s decision illustrates one thing: Courts will not hesitate to use standing to kick out lawsuits that they view as alleging inadequate harm.

Venkat Balasubramani is a cofounder of Focal PLLC, a Seattle-based law firm focusing on media, technology and Internet-related clients. He blogs at Eric Goldman’s Technology & Marketing Law Blog. You can also follow him on Twitter, @VBalasubramani.

Read more by Venkat Balasubramani:
Northern District of California confirms Pineda v. Williams-Sonoma applies retrospectively
Mass. Court: ZIP Code is personal identification info under credit card statute but plaintiff must still allege harm—Tyler v. Michaels Stores


If you want to comment on this post, you need to login.


Board of Directors

See the esteemed group of leaders shaping the future of the IAPP.

Contact Us

Need someone to talk to? We’re here for you.

IAPP Staff

Looking for someone specific? Visit the staff directory.

Learn more about the IAPP»

Daily Dashboard

The day’s top stories from around the world

Privacy Perspectives

Where the real conversations in privacy happen

The Privacy Advisor

Original reporting and feature articles on the latest privacy developments

Privacy Tracker

Alerts and legal analysis of legislative trends

Privacy Tech

Exploring the technology of privacy

Canada Dashboard Digest

A roundup of the top Canadian privacy news

Europe Data Protection Digest

A roundup of the top European data protection news

Asia-Pacific Dashboard Digest

A roundup of the top privacy news from the Asia-Pacific region

Latin America Dashboard Digest

A roundup of the top privacy news from Latin America

IAPP Westin Research Center

Original works. Groundbreaking research. Emerging scholars.

Get more News »

Find a KnowledgeNet Chapter Near You

Network and talk privacy at IAPP KnowledgeNet meetings, taking place worldwide.

Women Leading Privacy

Events, volunteer opportunities and more designed to help you give and get career support and expand your network.

IAPP Job Board

Looking for a new challenge, or need to hire your next privacy pro? The IAPP Job Board is the answer.

Join the Privacy List

Have ideas? Need advice? Subscribe to the Privacy List. It’s crowdsourcing, with an exceptional crowd.

Find more ways to Connect »

Find a Privacy Training Class

Two-day privacy training classes are held around the world. See the complete schedule now.

Online Privacy Training

Build your knowledge. The privacy know-how you need is just a click away.

The Training Post—Can’t-Miss Training Updates

Subscribe now to get the latest alerts on training opportunities around the world.

New Web Conferences Added!

See our list of upcoming web conferences. Just log on, listen in and learn!

Train Your Staff

Get your team up to speed on privacy by bringing IAPP training to your organization.

Learn more »

CIPP Certification

The global standard for the go-to person for privacy laws, regulations and frameworks

CIPM Certification

The first and only privacy certification for professionals who manage day-to-day operations

CIPT Certification

The industry benchmark for IT professionals worldwide to validate their knowledge of privacy requirements

Certify Your Staff

Find out how you can bring the world’s only globally recognized privacy certification to a group in your organization.

Learn more about IAPP certification »

Get Close-up

Looking for tools and info on a hot topic? Our close-up pages organize it for you in one easy-to-find place.

Where's Your DPA?

Our interactive DPA locator helps you find data protection authorities and summary of law by country.

IAPP Westin Research Center

See the latest original research from the IAPP Westin fellows.

Looking for Certification Study Resources?

Find out what you need to prepare for your exams

More Resources »

GDPR Comprehensive: Spots Going Fast

With the top minds in the field leading this exceptional program, it's no wonder it's filling quickly. Register now to secure your spot.

Be Part of Something Big: Join the Summit

Registration is open for the Global Privacy Summit 2016. Discounted early bird rates available for a short time, register today!

Data Protection Intensive Returns to London

Registration is now open for the IAPP Europe Data Protection Intensive in London. Check out the program!

P.S.R. Call for Speakers Open!

P.S.R. is THE privacy + cloud security event of the year, and you can take a leading role. Propose a session for this year's program.

Sponsor an Event

Increase visibility for your organization—check out sponsorship opportunities today.

Exhibit at an Event

Put your brand in front of the largest gatherings of privacy pros in the world. Learn more.

More Conferences »

Become a Member

Start taking advantage of the many IAPP member benefits today

Corporate Members

See our list of high-profile corporate members—and find out why you should become one, too

Renew Your Membership

Don’t miss out for a minute—continue accessing your benefits

Join the IAPP»