"And That's the End!" 11th Circuit Ends VPPA Action in Ellis, But Leaves the Question of What is PII Unresolved
Digital content and media providers got some good news from the U.S. Court of Appeals for the 11th Circuit in October when the court held that plaintiffs must be "subscribers" and not just users of a provider's service to assert a claim under the Video Privacy Protection Act ("VPPA"). While the decision sets a higher procedural hurdle for plaintiffs to clear, the 11th Circuit's ruling leaves one of the most pressing VPPA question for digital media companies unresolved – namely, what is personally identifiable information ("PII") under the VPPA?
On October 9, the 11th Circuit issued its ruling in Ellis v. The Cartoon Network, Inc., where the plaintiff appealed the dismissal of his putative class action claiming that the company had violated VPPA by impermissibly sharing its mobile app users' video viewing histories and associated Android IDs with a third party analytics firm without consent. A federal district judge held in 2014 that the plaintiff was a "subscriber" of the Cartoon Network App ("CN App") and was thus a "consumer" under the VPPA, but the data collected and shared by the CN App was not protected from disclosure under the Act. In dismissing the plaintiff's action, the district court found the CN App shared a user's viewing history and their mobile device's randomly-generated Android IDs, which was not PII as defined by the VPPA because it did not, without more, identify the viewing history of a particular individual.
In a surprising decision, the 11th Circuit did not reach the question of whether the data shared by the CN App was PII under the VPPA, but affirmed the lower court's dismissal by holding that the plaintiff was not a "consumer" protected by the Act since he was not a "subscriber" to the CN App or any Cartoon Network services. Yet the 11th Circuit's decision not to address what is or is not PII under the Act leaves one of the VPPA's biggest questions in the digital area unresolved by a federal circuit court.
"[T]he Circuit Court's ruling leaves one of the VPPA's biggest questions – what constitutes PII in the digital era – unresolved by a federal circuit court."
Until that question is decided, it is likely that the plaintiffs' bar will try to find new ways to show that every aggrieved user of a website or service is in fact a subscriber to counteract the 11th Circuit's holding. Companies should examine how they provide digital media services in the context of determining whether their users might be deemed "subscribers" under the 11th Circuit's decision.
Is Your User a "Subscriber"?
As we've written about previously, nearly all of the VPPA cases examined by federal district courts in recent years have focused specifically on whether the information shared by a company constitutes PII under the VPPA. Indeed, Ellis' initial brief before the 11th Circuit argued that the district court erred in its analysis of what constitutes PII under the VPPA, and maintained that there is a disclosure of PII where "the recipient of a disclosure understands to whom the information refers," not if the information is personally identifiable on its face.
The 11th Circuit relied upon a recent VPPA decision by a Massachusetts federal district court that found that a user of an app is not automatically a "consumer" of the app provider. In Yershov v. Gannett Satellite Info. Network, Inc., the Massachusetts district court noted that the VPPA defines a "consumer" as one who is a "renter, purchaser, or subscriber of goods or services" of the provider, and held that the common understanding of "subscription" involves "payment, registration, commitment, delivery, and/or access to restricted content." The district court held that the plaintiff in Yershov was not a subscriber as he did not have to pay, register, or make any commitments to use the defendant's app; instead, "[t]he App appears to merely be a more convenient form of visiting the [defendant's] website."
The 11th Circuit held that Ellis similarly was not a "subscriber" under the VPPA because he also did not have to pay, register, or establish an account to use the CN App, or sign up for any periodic services or transmissions; rather, "Mr. Ellis simply watched video clips on the CN App, which he downloaded onto his…smartphone for free." According to the Circuit Court, "downloading an app for free and using it to view content at no cost is not enough to make a user…a ‘subscriber' under the VPPA, as there is no ongoing commitment or relationship between the user and the entity that owns and operates the app."
"Downloading an app for free and using it to view content at no cost is not enough to make a user…a ‘subscriber' under the VPPA, as there is no ongoing commitment or relationship between the user and the entity that owns and operates the app."
The Good and the Bad of the Ellis Decision
Although the provider prevailed, the Circuit Court's dodge of the PII question unfortunately leaves many companies in murky waters. First, what constitutes PII under the VPPA has been the major point of contention in plaintiff class actions against companies like Cartoon Network that provide users digital access to content through computers and mobile platforms. Up until now no federal circuit court had confronted the definition of PII in this context. The 11th Circuit's decision not to speak to the issue leaves the district courts without any guidance from a higher court.
Second, the Yershov court's decision broke with the other federal district courts that have recently pondered the PII issue and found for the first time that device identifiers that by themselves do not identify their user but which can be linked with other information by a third party to name a particular person do constitute PII under the VPPA. Given the conflicting decisions from federal district courts, any guidance from a circuit court would have helped achieve some clarity.
Other Cases That May Shape PII Definition
Ellis is not the only case asking a circuit court to weigh in on the VPPA's definition of PII, however. The 3rd Circuit has tentatively scheduled oral arguments in In re Nickelodeon Privacy Litigation for December 7, while the 11th Circuit has one more opportunity to rule on the scope of PII in the case of Locklear v. Dow Jones & Co. The 11th Circuit had stayed further action in Locklear until a ruling was issued in Ellis, but it is unclear whether it will rest on its subscriber holding in Ellis or use Locklear to forge ahead and analyze the VPPA's definition of PII.
The 9th Circuit, however, will not be considering the matter any time soon, as the remaining parties in the In re Hulu Privacy Litigation moved the 9th Circuit on October 23 to voluntarily dismiss the plaintiff's appeal. In her March 31 order, U.S. Magistrate Judge Laurel Beeler held that the plaintiff failed to present "any issue of material fact that Hulu actually knew that Facebook might combine information that identified Hulu users separate information specifying which video that user was watching, so as to identif[y] a person as having requested or obtained specific video materials." With In re Hulu dismissed, the lower court decision that a defendant must knowingly transmit information that constitutes PII will continue to be a persuasive – but not binding – ruling to guide future VPPA cases.
Meanwhile, other federal district courts continue to hold that device identifiers that do not themselves identify the end user are not PII under the VPPA, suggesting that the Yershov court's analysis of PII may be more of an aberration rather than breaking new ground. Most recently in Robinson v. Disney Online d/b/a Disney Interactive, New York Federal District Judge Ronnie Abrams granted Disney's motion to dismiss the plaintiff's case alleging that Disney had violated the VPPA by sharing the plaintiff's viewing history with third parties. In looking at the text and legislative history of the VPPA, Judge Abrams agreed with the majority of district courts that PII under the VPPA "must itself identify a particular person as having viewed specific video materials." Judge Abrams further stated that the Yershov court's interpretation of PII "is at odds with the VPPA's particularized definition of PII and is overly expansive." Indeed, Judge Abrams noted that "[i]f nearly any piece of information can, with enough effort on behalf of the recipient, be combined with other information so as to identify a person, then the scope of PII would be limitless."
Please revisit Davis Wright Tremaine's Privacy & Security Blog for the latest information on the how the federal courts are interpreting the VPPA, the scope of PII, and how they apply in the modern digital context.