Photo by Guilherme Alvares on Unsplash
A National Basketball Association (NBA) website user has filed a class action lawsuit against the NBA. Originally filed in the Southern District of New York (SDNY), the action was dismissed at the district court, but the action was later appealed to the Second Circuit Court of Appeals. Plaintiff Michael Salazar signed up for the website’s newsletter. He claims that his “digital subscription to a website owned and/or operated by the NBA…had [his] personal viewing information disclosed to Facebook.” Plaintiff claims his privacy rights were violated under the Video Privacy Protection Act (VPPA). As concerns about user privacy continue to rise, especially with the increasing prevalence of AdTech—technology that companies use to deliver targeted advertisements based on user data—cases like this have become more frequent.
It is imperative to know how the NBA interacts with its users online. The NBA, beyond being a globally recognized major sports league, provides a wide array of digital content through its official website, NBA.com. The platform includes video content such as game highlights, player interviews, player stats, and live game updates. In addition to its media offerings, the website also features a newsletter that delivers updates on league news, game schedules, and special promotions. Users can subscribe to the NBA’s newsletter by entering their personal details, such as their name, age, city, and email address, allowing them to stay informed about the latest happenings in the league.
This massive class action lawsuit revolves around whether Salazar, by signing up for the NBA’s newsletter, qualifies as a “subscriber” under the VPPA. This case brings to light a burning debate over what constitutes a “good or service” under the VPPA, particularly in the context of modern digital platforms that offer free content in exchange for personal data.
The Video Protection Privacy Act
In 1988, Congress enacted the VPPA in response to growing privacy concerns raised by The Bork Tapes, a scandal where a Supreme Court justice nominee’s videotape rental history was leaked. Decried as a violation of Judge Robert Bork’s right to privacy by both sides of the aisle, senators soon introduced a bipartisan bill that would become the VPPA.
With the rise of the internet and digital media, legislators saw a need to update the VPPA. In 2012, Congress amended the Act to allow video service providers to obtain consumers’ informed, written consent for their video history on a continuous online basis. However, the definition of a “consumer” is ambiguous in today’s digital landscape.
The VPPA defines a consumer as “any renter, purchaser, or subscriber of goods or services from a video tape service provider.” It fails to assert how an individual qualifies as a “subscriber.” Traditionally, courts have interpreted “subscribers” as users who sign up for paid services, either renting directly from a brick-and-mortar store or making monthly subscriptions to a streaming service. However, the rise of digital platforms and increased accessibility to free content has sparked divergence among the courts as to the scope of a “subscriber.”
The Act prohibits video service providers from “knowingly disclos[ing], to any person, personally identifiable information concerning any consumer of such provider.” The Act now applies to streaming platforms, video sharing sites, and social media platforms that offer video content, such as Meta or Instagram.
Changing Tides in Litigation
Beginning in 2022, courts witnessed a surge in class action lawsuits against Meta for allegedly using tracking software to obtain users’ video-watching data. Notable lawsuits include Ambrose v. Boston Globe and Stark v. Patreon, both alleging that the defendants unlawfully disclosed users’ personally identifiable information (PII) to Meta. Meta’s Pixel allows Meta and other third parties to collect video-watching data from companies like the NBA. This data continues to be used to target individuals with personalized advertisements and marketing campaigns. These class action plaintiffs claimed their status as “subscribers” under the VPPA, with each plaintiff seeking damages of up to $2,500 per violation. Many of these cases were dismissed due to an unfavorable ruling on the definition of a “subscriber.”
However, the Second Circuit’s decision in Salazar has opened the door for revived litigation. The central question on appeal was whether Salazar had plausibly pled his case as a “subscriber” under the VPPA. The NBA argued that simply watching free videos on its website did not make Salazar a “subscriber.” Salazar argued that he had established subscriber status when he signed up for the NBA’s newsletter. Circuit courts remain split on this definition, particularly when the plaintiff merely downloads an app to watch videos. However, the boundary is more defined in the Salazar action. Here, the Second Circuit agreed with Salazar that signing up for the newsletter made him a “subscriber,” vacating the district court’s dismissal and remanding the case to trial court to continue the legal dispute. .
The Future of AdTech
While the Second Circuit’s ruling is narrow, it sets a precedent that could lead to broader interpretations of who qualifies as a “subscriber,” encouraging future plaintiffs to test the VPPA’s boundaries in court. The courts may refine the definition by considering users who register for free trials or accounts, but the courts are unlikely to radically expand the definition to include any individual who simply accesses a website to view free content. As the boundary lines shift, companies will approach user consent and data collection practices differently.
The divergence between circuit courts on the definition of a “subscriber” and the remaining ambiguities in the VPPA create challenges for businesses operating across multiple jurisdictions. This uncertainty increases the risk of non-compliance and class action lawsuits. As a safeguard, businesses offering digital newsletters or similar services may need to reassess its methods for obtaining consent to ensure clarity. Proper consent for data collection may now require more explicit disclosures, informing users when their video-watching data is being collected, which third party companies have access to it, and how those companies are using it. Additionally, companies may need to consider offering clearer opt-out mechanisms.
Courts have not decided what “appropriate consent” looks like under the VPPA. Businesses may need to reassess its use of tracking technologies like Meta Pixel. Stacey Chuvaieva, an associate at Mitchell Silberberg & Knupp, suggests one way of mitigating these risks would be to implement “some sort of pop-up banner,” effectively disclosing data sharing practices. As platforms like X or Meta roll out new data policies or AI features, users have seen more pop-up banners and transparent user interface measures to encourage users to actively engage with their privacy settings.
Because of how lucrative it is for large tech companies, advertisement technology continues to force the legal landscape to evolve, shaping the digital world we live in today. Proactive adjustments to AdTech will not only help to incentivize companies to remain vigilant in data collection practices, but it will also mitigate risks–contributing to consumer trust. As legislation evolves and privacy litigation escalates, large companies will need to either adapt its policies to stay afloat or risk paying hefty settlements in the future.
*The views expressed in this article do not represent the views of Santa Clara University.
Comments