A federal appellate court has ruled that the National Basketball Association (NBA) may have violated a consumer’s privacy rights when that consumer signed up for the NBA’s online newsletter and shared personal identifiable information in exchange for NBA-related updates and content. In so ruling, the court applied and reconciled to modern online technology the language in a decades-old technology statute enacted by Congress. ABA Litigation Section leaders agree that the court’s interpretation of the statute was consistent with its legislative history and congressional intent. Further, leaders agree that, despite a circuit split on the interpretation of the statute, the interpretive dispute may not yet be ripe for U.S. Supreme Court review but should prompt online technology businesses to update privacy disclosures.
In Salazar v. NBA, the plaintiff signed up for an online email newsletter offered by the defendant. The plaintiff also visited the defendant’s website, NBA.com, to view content. After viewing content on NBA.com, the plaintiff alleged that his video-watching history and “Facebook ID” were disclosed to a third party, Meta Platform, Inc. (Meta), without the plaintiff’s permission. The plaintiff did not pay a subscription fee to watch videos on the defendant’s website; however, the plaintiff alleged that the defendant used “tracking pixel” code—code embedded in a website someone visits—to extract data about the plaintiff that was shared with Meta. Meta owns the tracking pixel that is coded to collect and send to Meta the title of the video a subscriber watches on NBA.com, the video URL from that video, and that subscriber’s Facebook ID—a number unique to each Facebook account. Since Meta knows the video title and URL of a video that a subscriber watches, it can link a subscriber’s Facebook ID to those videos watched and target that subscriber with advertisements.
Based on these facts, the plaintiff filed a lawsuit against the defendant in the U.S. District Court for the Southern District of New York, alleging a violation of his privacy by the defendant under the Video Privacy Protection Act (VPPA). In ruling against the plaintiff on a motion to dismiss pursuant to Federal Rule of Civil Procedure 12(b)(6), the district court found that the plaintiff had constitutional standing but found that the plaintiff failed to plead sufficient facts that he was a “consumer” under the VPPA. On appeal to the U. S. Court of Appeals for the Second Circuit, the issues presented were whether the plaintiff had constitutional standing and was a “subscriber of goods and services” as defined under the VPPA.
The Second Circuit began its analysis with the threshold question of whether the plaintiff had Article III constitutional standing to bring the lawsuit under the VPPA. Citing U.S. Supreme Court precedent, the circuit court noted that, to establish constitutional standing, the plaintiff must have suffered “an injury-in-fact” that was “traceable to the defendant’s challenged conduct,” and that injury “would be redressed by judicial relief.” Here, the court concluded that the plaintiff’s personally identifiable information was exposed to Meta through the defendant’s website, and judicial relief would redress the plaintiff’s injury. Therefore, the court concluded that the plaintiff established constitutional standing. Accepting the plaintiff’s allegations against the defendant as true—as it must on a 12(b)(6) motion to dismiss—the appellate court next considered whether the plaintiff pleaded sufficient facts to conclude that he was “subscriber of good and services” as defined under the VPPA.
Tracing the legislative history of the VPPA to privacy issues prompted by the 1987 Supreme Court hearings of Robert Bork, the court noted that the VPPA, enacted in 1988, prevents a “video tape service provider” from “knowingly disclosing, to any person, personally identifiable information concerning any consumer of such provider.” Further, the court noted, the VPPA was amended in 2012 to encompass internet businesses that provide goods and services online. In addition, said the court, the VPPA defines a “consumer” to include a “subscriber of goods and services,” and so the question was whether the defendant’s digital newsletter is a “good or service” and whether the plaintiff is a “subscriber.”
Citing Supreme Court precedent, the court noted that, since the term “goods and services” is not defined in the VPPA, the plain meaning of that term applies in the broader context of the statute. The court concluded that Congress “cast a wide net in defining ‘video tape service provider’ to allow for businesses dealing in audio goods and services” and those that do not deal in audiovisual goods and service to come within the ambit of the VPPA so long as such business is disclosing a consumer’s personally identifiable information. In rejecting the defendant’s argument that the plaintiff was not a “subscriber” of goods and services, the court distinguished and reconciled precedents from other circuits.
First, in Ellis v. Cartoon Network, Inc., the plaintiff downloaded an Android application to watch video clips. The Ellis plaintiff did not pay a subscription fee but the application downloaded his unique “Android ID” and analytics and shared them with a third party. The Eleventh Circuit Court of Appeals concluded that the plaintiff was not a “subscriber” under the VPPA because “subscription involves some type of commitment, relationship, or association between a person and an entity.”
Reaching a different result, in Yershov v. Gannett Satellite Information Network, Inc., the First Circuit Court of Appeals concluded that the plaintiff who downloaded an app to watch videos was a “subscriber” under the VPPA because the plaintiff “established a relationship” with the defendant by giving the latter “consideration in the form of . . . information.”
Here, the court agreed with both circuits that a subscriber does not have to pay money to be a “subscriber” under the VPPA, but similar to the Yershov plaintiff, the Second Circuit concluded that the plaintiff here was a subscriber because his personal information was shared with the defendant and disclosed to Meta without the plaintiff’s consent.
Although Litigation Section leaders conclude that the court broadly interpreted the VPPA, leaders reason that litigation will continue under the statute and that it is too early to prognosticate that the Supreme Court will decide the circuit split. “The court’s opinion is well reasoned,” opines Jason K. Kellogg, Miami, FL, Co-Chair of the Section’s Class Action & Derivative Suits Committee. “It’s unlikely [to reach the Supreme Court] just on the basis of percentages,” he adds.
“The circuit split is too granular right now to warrant Sup-reme Court review,” offers Mark E. Rooney, Washington, DC, Co-Chair of the Section’s Consumer Litigation Committee. “The three circuits to have examined the issue closely seem to agree on a lot of the basics. It will take further development of cases in the lower courts before this is ripe for the high court,” says Rooney.
In a clever observation of the court’s ruling and the fact that the litigation is ongoing, Rooney analogizes that “the NBA tried to box out this plaintiff, but its arguments were like a half-court heave that clanged off the rim.” “Fortunately for the NBA, it was only the first quarter buzzer,” he quips. “They are down now, but the litigation will continue, and they may well claim victory in the end,” adds Rooney.
Another Section leader observes what the case signifies and the impact it may have on online businesses. “The Salazar case shines a spotlight on tracking transparency,” says Dimple T. Shah, Morristown, NJ, Co-Chair of the AI Task Force Subcommittee of the Section’s Privacy & Data Security Litigation Committee. “Now is the time to evaluate technology tracking tools [such as pixels] and update privacy policies. Creating express consent acknowledgements allows consumers to understand website tracking before they view video content, regardless of subscription,” says Shah.
