If your company posts videos on its website and uses a Facebook tracking pixel in them to transmit data to Facebook for advertising purposes, your company could find itself on the receiving end of a class action lawsuit.

This is the basis of no fewer than 13 class action lawsuits filed over the last year against all types of companies including Chick-Fil-A, Discovery Communications, Nexstar Media Group, Paramount, iHeartMedia, FloSports, Inc., Insider, Inc., Bloomberg, Boston Globe, WebMD, Gannett Company (owner of USA Today), HBO and Patreon. The lawsuits generally allege that embedding a Facebook tracking pixel into the code of a video on a website is a violation of the Video Privacy and Protection Act (“VPPA”).

The VPPA is a 1988 statute that Congress enacted in response to a scandal surrounding the leak of Robert Bork’s video rental list (think: Blockbuster). during his failed Supreme Court nomination. With only one Blockbuster store in the world still in existence (Bend, Oregon), you would be forgiven for thinking that this statute is a relic, since the wrong it aimed to prevent relates to a video distribution method that has all but ceased to exist.

The law generally says that a “video tape service provider” cannot, without consent, disclose “personally identifiable information” (“PII”) about a consumer. “Video tape service provider” is defined to include “any person, engaged in the business … of rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials.” The statute provides for statutory damages of $2,500, a figure that can add up quickly if applied to website visitors in a class action lawsuit.

The suit against Chick-Fil-A is representative of many of the recently filed VPPA lawsuits and provides a good example of how even a non-media company can find itself on the receiving end of a VPPA lawsuit. The Complaint alleges that Chick-Fil-A is a “video tape service provider.” On the surface, this seems nonsensical; Chick-Fil-A is a fried chicken sandwich provider.

However, like most modern companies, it has a website and that website contains pre-recorded videos. Therefore, according to the Complaint, Chick-Fil-A is a “video tape service provider” because it is engaged in the business of the “delivery of prerecorded video cassette tapes or similar audio visual materials” (emphasis in the Complaint).

The complaint goes on to allege that videos on the Chick-Fil-A website use an embedded Facebook tracking pixel to share PII with Facebook about viewership. These pixels are most effective if a user is logged into Facebook while watching a video on the website. In such an instance, the pixel causes information about the Chick-Fil-A videos watched and the user’s Facebook ID and corresponding Facebook profile to be transmitted to Facebook. The use of this marketing technology thus appears to fall within a broad reading of the behavior that the VPPA was intended to forbid.

Chick-Fil-A has not yet responded to the complaint but there are potential defenses that modern “video tape service providers” may have to defeat actions such as these. For example, Patreon presented an argument in a motion to dismiss that the VPPA violates the First Amendment. Although the court denied Patreon’s motion to dimiss on that basis, it did so without prejudice to Patreon’s right to develop a factual record and revisit the argument, presumably in a motion for summary judgment. The First Amendment Argument therefore remains live for any VPPA defendant.

Chick-Fil-A will undoubtedly argue that its users have consented to this sharing of data, noting that the VPPA only forbids such sharing without consent. Chick-Fil-A’s website includes a privacy policy that discloses that the company collects information about its visitors and may share that information with Facebook and other social media companies. Like many sophisticated websites, this one contains a maze of policies that few users are likely to read in detail before watching a video. The question of effective consent to the sharing of PII may be a difficult one for the court to resolve.

Chick-Fil-A’s website also has a Conditions and Terms of Use page that contains both an arbitration provision and class action waiver provision. Very recently, the United States District Court for the Southern District of New York granted HBO’s motion to enforce an arbitration provision in its Terms of Use and HBO’s motion to dismiss the class action complaint in light of the class action waiver, also contained in the Terms of Use. These are viable defense that could stop these class action litigation in their tracks.

Of course, some of these arguments may not be available to all defendants, in which case negotiating an early settlement may be the best litigation strategy in light of the potentially astronomical statutory damages available under the VPPA. The Boston Globe, after losing a motion to dismiss, appears to be engaged in mediation with the plaintiff. Mediation can be a wise strategy in settling cases like these early for a fraction of the cost that would attach to a finding of liability by the court or a jury. Sunstein recently settled a case on behalf of a publisher based upon a violation of Michigan’s version of the federal VPPA.

Any company that posts videos online should pay careful attention to this new wave of VPPA litigation. Time will tell if the Constitutional argument has merit but, in the meantime, companies can shore up their defenses by among other things, eliminating the use of Facebook (or similar) tracking pixels and strengthening their terms of use, including expressly identifying the use of Facebook (or similar) tracking pixels and amending their terms of service, if necessary, to include arbitration an waiver of class action provisions.

Photo by Josh Edelson/AFP via Getty Images