Image used under license from Shutterstock.com.
An NBA fan’s legal battle over his rights to consumer protections is back into play following the Second Circuit’s recent decision. In August 2023, Judge Jennifer L. Rochon of the Southern District of New York dismissed Michael Salazar’s lawsuit, stating the NBA newsletter subscriber did not show he was a “protected consumer”[1] under the Video Privacy Protection Act (“VPPA”). On October 15, 2024,[2] the U.S. Court of Appeals for the Second Circuit vacated the district court’s dismissal giving Salazar and his purported class a second chance.[3]
Salazar initially filed the lawsuit in September 2022, alleging to represent “[a]ll persons in the United States with a digital subscription to an online website owned and/or operated by [the NBA] that had their Personal Viewing Information [sic] disclosed to [Meta] by [the NBA].”[4] Salazar claimed he signed up for NBA.com to send him email newsletters,[5] which required him to provide identifying information, including his email and IP address.[6] The lawsuit claimed NBA.com contains a tracking pixel, owned by Meta and known as the “Facebook Pixel”[7]–a code tracking visitor activity for marketing purposes.[8] Salazar asserted NBA.com discloses data concerning its subscribers’ identities and media consumption to Facebook [9] and that this unauthorized disclosure violates the VPPA.[10]
In 1988, President Ronald Reagan enacted the VPPA in response[11] to a newspaper publishing a profile on Supreme Court nominee Judge Robert Bork and his family’s video rental history from a video store.[12] The VPPA’s initial purpose was to “allow[] consumers to maintain control over personal information divulged and generated in exchange for receiving services from video tape service providers.”[13] The idea was simple–people did not want their video rental history associated with their name without their consent.[14] However, the Second Circuit’s recent opinion carries broad implications for the VPPA.[15]
The court stated the legislature’s use of broad language in the VPPA when defining “consumer,” suggests the statute should not “gather dust next to our VHS tapes”[16] and instead should adapt to changing technologies and consumption patterns.[17] The VPPA is intended to be a robust tool for addressing privacy protections in today’s digital atmosphere, where personal viewing data can be monitored easily and shared across online platforms.[18] Consequently, the Second Circuit’s decision expands the VPPA to cover customers who have a “subscription relationship,” even if the relationship does not include or has a relation to watching videos.[19]
In turn, the Second Circuit agreed with Salazar in his claim that he is a “consumer” within the VPPA and reversed the district court’s conclusion that the VPPA exclusively applies to subscribers of audiovisual services.[20] Further, the court concluded Salazar sufficiently alleged he was a “subscriber of goods or services” from the NBA[21] and stated that by exchanging personal information in exchange for a newsletter, a relationship formed beyond that of a typical website visitor.[22] The court then vacated the district court’s judgment of dismissal and remanded the case consistent with its opinion.[23]
The NBA is no stranger to collecting data. It tracks fan engagement on various social media platforms and websites to learn about its consumers–the fans.[24] Additionally, the NBA has various data-tracking practices: storing information about merchandise, tickets, and concessions that fans previously purchased; monitoring fans’ viewing patterns; and gathering users’ demographic information, such as age and geographic locations.[25] Specifically, the NBA processes significant amounts of personal information; every click a user makes to support a transaction creates a fragment of the fan’s self.[26] The NBA, like any other business, wants more information about its users, their tracking activity, their viewing habits, and more to improve its targeted advertising.[27]
Accordingly, concerns surrounding data privacy in the sports and entertainment sectors are not new, however, these issues remain underdeveloped. Users are consistently providing their information to professional sports leagues with the hope that their data will be protected.[28]
Salazar’s suit is one of many VPPA class actions filed nationwide in which plaintiffs allege that software embedded in defendants’ websites secretly recorded their online viewing histories and shared it with online advertising agencies.[29] In recent years, plaintiffs have filed claims against companies such as Netflix, Warner Bros, Discovery, and recently, Paramount Global.[30] There, the plaintiffs alleged Paramount “knowingly and intentionally” shared users’ viewing data without their consent.[31]
Like the present case, in May 2023, a federal judge in the Southern District of New York dismissed a lawsuit against Scripps Network, which claimed unauthorized disclosure of plaintiffs’ identities and viewing patterns.[32] Ultimately, the court found that consumers who subscribed to HGTV.com’s newsletter do not fall under the VPPA because they are not considered “subscribers” within the meaning of the statute.[33]
However, following the Second Circuit’s decision, more VPPA actions are likely to be filed in the future with a special focus on website-tracking technologies.[34] Because the court’s decision expanded the scope of the VPPA by broadening the definitions of “subscriber” and “consumer” and found that “goods or services” under the statute are not limited to audiovisual content, but include services such as online newsletters,[35] many companies may be under fire. A recent FTC report revealed that video streaming services and social media platforms engage in extensive consumer surveillance, monetizing information while maintaining lax privacy protections.[36]
Technology changes so rapidly leaving the legal field struggling to stay updated with new laws and regulations. Instead, this responsibility is left to the courts, which may adapt existing statutes to reflect today’s digital landscape. Nevertheless, the significance of privacy regulations remains paramount. In the words of Judge Beth Robinson, “The VPPA is no dinosaur statute”[37] and nor should it be treated as such.
[1] D. Darrell Hill, 2nd Circuit Revives Privacy Class Action Over NBA Video Streaming Data, Westlaw Today: Data Privacy Daily Briefing (Oct. 17, 2024), https://today.westlaw.com/Document/I8c3fff9e8c8411efb5eab7c3554138a0/View/FullText.html?transitionType=Default&contextData=(sc.Default)&firstPage=true.
[2] Salazar v. Nat’l Basketball Ass’n, 118 F.4th 533, 533 (2d Cir. 2024).
[3] Id. at 536.
[4] Id. at 539.
[5] Hill, supra note 1.
[6] Id.
[7] Salazar, 118 F.4th at 537.
[8] Hill, supra note 1.
[9] Id.
[10] Id.
[11] Michael McCann, NBA, Facebook Video Privacy Case Revived by Appeals Court, Sportico (Oct. 16, 2024), https://www.sportico.com/law/analysis/2024/nba-video-privacy-case-second-circuit-1234801476/.
[12] Gerald L Maatman, Jr. et al., Second Circuit Holds That The VPPA Applies To Subscribers of Non-Audiovisiual Content, Duane Morris: Class Action Defense (Oct. 17, 2024), https://blogs.duanemorris.com/classactiondefense/2024/10/17/second-circuit-holds-that-the-vppa-applies-to-subscribers-of-non-audiovisual-content/.
[13] Amy Gordon, The Return of the Video Privacy Protection Act (VPPA), Proskauer: Minding Your Business (Oct. 2, 2023), https://www.mindingyourbusinesslitigation.com/2023/10/the-return-of-the-vppa/.
[14] Pravin Chandiramani, Video Privacy Protection Act. Good Omens Caused Unexpected Challenges, Simulmedia (Oct. 21, 2024), https://www.simulmedia.com/blog/video-privacy-protection-act.
[15] Id.
[16] Salazar, 118 F.4th at 553.
[17] Vaidehi Mehta, Video Privacy Protection Act Ruling May Signal Safer Online Browsing, FindLaw (Oct. 29, 2024), https://www.findlaw.com/legalblogs/federal-courts/video-privacy-protection-act-ruling-may-signal-safer-online-browsing/.
[18] Id.
[19] Eric Goldman, The VPPA May Be a Dinosaur Statute, But It’s Very Much Alive in the Second Circuit – Salazar v. NBA, Technology & Marketing Blog (Oct. 22, 2024), https://blog.ericgoldman.org/archives/2024/10/the-vppa-may-be-a-dinosaur-statute-but-its-very-much-alive-in-the-second-circuit-salazar-v-nba.htm.
[20] Maatman, Jr. et al., supra note 12.
[21] Mehta, supra note 17.
[22] Id.
[23] Id.
[24] Dharmendra Vishwakarma, The New NBA Paradigm of Fan Information Protection, Coin Gabbar (Mar. 3, 2024), https://www.coingabbar.com/en/crypto-sponsored/nbas-data-privacy-efforts-shape-the-future-of-fan-engagement?srsltid=AfmBOoqFnWt86JeURTkqVadoTi1pVANlAc1Rjn1wFMtRedwfb7KOyZb1.
[25] Id.
[26] Id.
[27] Chandiramani, supra note 14.
[28] Id.
[29] Maatman, Jr. et al., supra note 12.
[30] Winston Cho, Paramount Hit With Class Action Lawsuit Over Sharing Subscriber Viewing History, The Hollywood Reporter (Nov. 1, 2024), https://www.hollywoodreporter.com/business/business-news/paramount-class-action-lawsuit-user-sharing-viewer-history-1236051852/.
[31] Cho, supra note 31.
[32] Class Actions Team, Federal Court Finds That Plaintiffs Aren’t “Subscribers” Under The Video Privacy Protection Act, Covington & Burling: Inside Class Actions (May 8, 2023), https://www.insideclassactions.com/2023/05/08/federal-court-finds-that-plaintiffs-arent-subscribers-under-the-video-privacy-protection-act/.
[33] Id.
[34] Dolce et al., “VPPA Is No Dinosaur Statute” – Second Circuit Breathes New Life Into Federal Video Privacy Protection Act, JD Supra (Oct. 21, 2024), https://www.jdsupra.com/legalnews/vppa-is-no-dinosaur-statute-second-8518106/.
[35] Karena Ioannau, The VPPA Lawsuit Wave: Old Laws Meet New Tech, Darrow (Nov. 17, 2024), https://www.darrow.ai/resources/vppa-settlement.
[36] Federal Trade Commission Staff, FTC Report Finds Large Social Media and Video Streaming Companies Have Engaged in Vast Surveillance of Users with Lax Privacy Controls and Inadequate Safeguards for Kids and Teens, Federal Trade Commission (Sept. 19, 2024), https://www.ftc.gov/news-events/news/press-releases/2024/09/ftc-staff-report-finds-large-social-media-video-streaming-companies-have-engaged-vast-surveillance.
[37] Salazar v. Nat’l Basketball Ass’n, 118 F.4th 533, 553 (2d Cir. 2024).