The Video Privacy Protection Act (“VPPA”) penalizes sharing a consumer’s personally identifiable information that can identify that a person sought or obtained specific video content without their consent. As discussed in a prior blog, the Supreme Court plans to hear arguments on VPPA’s definition of “consumer.”
Exceptions
Under 18 U.S.C. §2710(b)(2)(A)-(F), a “video tape service provider” may disclose personally identifiable information in six circumstances:
- To the consumer;
- To a person with the consumer’s informed written consent;
- To a law enforcement agency pursuant to a valid warrant, subpoena, or court order;
- To any person if the provide only discloses consumer’s name and address, if the consumer could object to disclosure;
- If disclosed in the video provider’s ordinary course of business; and
- Pursuant to a court order in a civil proceeding, upon a compelling showing of need and after the consumer is given reasonable notice and an opportunity to contest the claim.
However, when these exceptions do not apply, what types of personally identifiable information can a video provider not share? As the First Circuit remarked in Yershov v. Gannett (“Yershov”), “[m]any types of information other than a name can easily identify a person.” In turn, a circuit split exists between appellate courts with respect to how to determine whether the information identifies a person.
Florida Federal Courts have Adopted the Reasonableness Standard
Currently, appellate courts are split on whether to apply a “reasonableness” standard or an “ordinary person” standard when determining whether a disclosure sufficiently links a person to a particular video title. The Eleventh Circuit has yet to adopt any standard. However, in May 2025, the Southern District of Florida, in Kueppers v. Zumba Fitness, LLC (“Kueppers”), applied the “reasonableness” standard. Kuepper provides advisory precedent for the other district courts in Florida and indicates which standard the Eleventh Circuit may adopt.
The “Reasonableness” Standard
The reasonableness standard assesses whether a defendant disclosed information that would reasonably and foreseeably reveal the plaintiff’s viewing habits. In Yershov, the First Circuit illustrated this blurry standard by way of an interesting analogy:
Thus, [r]evealing a person’s social security number to the government, for example, plainly identifies the person. Similarly, when a football referee announces a violation by ‘No. 12 on the offense,’ everyone with a game program knows the name of the player who was flagged.
Yershov v. Gannett Satellite Info. Network, Inc., 820 F.3d 482, 486 (1st Cir. 2016).
District courts have also found that a plaintiff must simply allege that the disclosed information allows the recipient to ascertain the individual’s identity. Across the board, the reasonableness standard provides a notably lower hurdle than the ordinary person standard. As the North District of California in the In re Hulu Privacy Litig. observed, “if an anonymous, unique ID were disclosed to a person who could understand it, that might constitute PII.”
The “Ordinary Person” Standard
The Third and Ninth Circuits, by contrast, utilize the more rigorous “ordinary person” standard, where the VPPA “applies only to the kind of information that would readily permit an ordinary person to identify a specific individual’s video-watching behavior.”
The Second Circuit, in Solomon v. Flipps Media, Inc., adopted the ordinary person standard after analyzing both the reasonableness standard and the ordinary person standard. There, the court reiterated that the VPPA “views disclosure from the perspective of the disclosing party,” and consequently, that “[i]t does not make sense that a videotape service provider’s liability would turn on circumstances outside of its control and the level of sophistication of the third party.”
Concluding Thoughts
With VPPA class action lawsuits on the rise, businesses offering audio-visual materials or services (particularly those that also utilize subscription services)must carefully consider disclosing users’ personally identifiable information. For example, in Kueppers, the defendant intentionally installed Meta Pixel on its website, which transmitted the plaintiff’s Facebook ID with the video’s URL link. Courts recognize that “Meta can easily ‘link’ the FID to a specific user.” Moving forward, businesses using pixel trackers must be conscious of which types and combinations of personal data they transmit to third parties. VPPA non-compliance can be costly, with statutory damages starting at $2,500 in liquidated damages with an attorney’s fees hook for the prevailing party. The recent spike in consumer class action litigation only amplifies exposure for non-compliant.
Businesses offering video content in a business capacity with tracking pixels should assess their VPPA exposure. Contact us to speak with Jimerson Birr’s privacy and litigation attorneys about pending VPPA litigation, compliance strategies, and litigation risk mitigation.