Southern District of Florida Adopts Reasonableness Standard in VPPA Suit

The Video Privacy Protection Act (“VPPA”) penalizes sharing a consumer’s personally identifiable information that can identify that a person sought or obtained specific video content without their consent. As discussed in a prior blog, the Supreme Court plans to hear arguments on VPPA’s definition of “consumer.”

Exceptions

Under 18 U.S.C. §2710(b)(2)(A)-(F), a video tape service provider may disclose personally identifiable information in six circumstances: 

1. To the consumer; 
2. To a person with the consumer’s informed written consent; 
3. To a law enforcement agency pursuant to a valid warrant, subpoena, or court order; 
4. To any person if the  provide only discloses consumer’s name and address if the video provider provided the consumer with the opportunity to prohibit disclosure;
5. If disclosed in the video provider’s ordinary course of business; and 
6. Pursuant to a court order in a civil proceeding, upon a compelling showing of need and after the consumer is given reasonable notice and an opportunity to contest the claim.

However, when these exceptions do not apply, what types of personally identifiable information can a video provider not share?  As the First Circuit remarked in Yershov v. Gannett, (“Yershov”) “[m]any types of information other than a name can easily identify a person.” In turn, courts of appeals nationwide have taken two approaches to determine whether the information identifies a person.

Florida Federal Courts have Adopted the Reasonableness Standard

Currently, a circuit split exists between whether to apply a “reasonableness” standard or an “ordinary person” standard when determining whether a disclosure sufficiently links a person to a particular video title. The Eleventh Circuit has yet to adopt any standard. However, the Southern District of Florida, in Kueppers v. Zumba Fitness, LLC (“Kueppers”)—a May 2025 decision, applied the “reasonableness” standard. Kuepper provides advisory precedent for the other district courts in Florida and indicates which standard the Eleventh Circuit may adopt.

1. The “Reasonableness” Standard.

The reasonableness standard assesses whether a defendant disclosed information that would reasonably and foreseeably reveal the plaintiff’s viewing habits. Liability attaches if the intended recipient can connect the numerical ID to the individual under this broader standard. In Yershov, the First Circuit illustrated this blurry standard by way of an interesting analogy:

Thus, “[r]evealing a person’s social security number to the government, for example, plainly identifies the person. Similarly, when a football referee announces a violation by ‘No. 12 on the offense,’ everyone with a game program knows the name of the player who was flagged.”

Yershov v. Gannett Satellite Info. Network, Inc., 820 F.3d 482, 486 (1st Cir. 2016).

District courts have also found that a plaintiff must simply allege that the disclosed information allows the recipient to easily ascertain the individual’s identity. Across the board, the reasonableness standard provides a notably lower hurdle than the ordinary person standard. As the North District of California in the In re Hulu Privacy Litig. observed, “if an anonymous, unique ID were disclosed to a person who could understand it, that might constitute PII.”

2. The “Ordinary Person” Standard.

The Third and Ninth Circuits, by contrast, utilize the rigorous “ordinary person” standard, noting that the VPPA “applies only to the kind of information that would readily permit an ordinary person to identify a specific individual’s video-watching behavior.”

The Second Circuit, in Solomon v. Flipps Media, Inc., adopted the ordinary person standard after analyzing both the reasonableness standard and the ordinary person standard. There, the court reiterated that the VPPA “views disclosure from the perspective of the disclosing party,” and consequently, that “[i]t does not make sense that a videotape service provider’s liability would turn on circumstances outside of its control and the level of sophistication of the third party.”

Concluding Thoughts

With VPPA class action lawsuits on the rise, businesses utilizing subscription services—such as email newsletters or offering video materials–must carefully consider disclosing user’s personally identifiable information. For example, in Kueppers, the defendant intentionally installed Meta Pixel which transmitted the plaintiff’s Facebook ID with the video’s URL link. Courts recognize that “Meta can easily ‘link’ the FID to a specific user.” Moving forward, businesses using pixel trackers must be conscious of which types—and combinations—of personal data they transmit to third-parties. VPPA non-compliance can be costly, with statutory damages reaching $2,500 per violation—particularly when pled as a class action with numerous class members alleging one or more violations. Businesses utilizing video content and tracking pixels should assess their VPPA exposure. Contact us to speak with Jimerson Birr’s privacy and litigation attorneys about pending VPPA litigation, compliance strategies, and litigation risk mitigation.