The New England Patriots have found themselves on the receiving end of a purported class action lawsuit alleging a violation of the Video Privacy and Protection Act (“VPPA”). Congress enacted the VPPA in 1988 in response to a scandal surrounding the leak of Robert Bork’s video rental list (think: Blockbuster) during his failed Supreme Court nomination. Although the statute was enacted long before the advent of the internet as we know it, the VPPA has had a resurgence over the last decade and, in particular, over the last few years. In the first weeks of 2024 alone, plaintiffs have filed at least 11 VPPA class actions, adding to the more than 70 that were filed in 2023.

Despite the VPPA’s origination and application to VHS tapes, plaintiffs have found a way to adapt the VPPA to modern, and common, means of information disclosure. Plaintiffs pursue VPPA claims because the statute provides for statutory damages of $2,500 per violation, a figure that can add up quickly in a class action lawsuit based on the use of a popular downloadable app.

The VPPA says that a “video tape service provider” cannot, without consent, disclose “personally identifiable information” (“PII”) about a consumer. “Video tape service provider” is defined to include “any person, engaged in the business … of rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials.” (Emphasis added). Plaintiffs rely on the “or similar audio visual materials” as a hook to bring defendants, like the New England Patriots, within the purview of the VPPA. Courts have found that providing access to pre-recorded videos through a downloadable application are “similar audio visual materials” to a “prerecorded video cassette tape,” such that the VPPA applies.

PII is defined as “information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider,” and “consumer” is defined as “any renter, purchaser, or subscriber of goods or services from a video tape service provider.”

The complaint against the New England Patriots follows a familiar pattern. It alleges that the plaintiff downloaded the New England Patriot’s app (the “App”), watched a pre-recorded video made available through the App, and that the App shared PII with third parties. The PII that complaint alleges to have been shared includes a user’s precise geolocation, a unique advertising ID, and the titles of the videos reviewed. The complaint also alleges that the plaintiff is a “consumer” under the VPPA because he is a “subscriber of goods or services” in that he downloaded and used the App.

These facts are likely to survive a motion to dismiss, at least in the First Circuit. Earlier this month, Judge Burroughs denied a motion to dismiss a VPPA class action lawsuit against an app owned by the popular cooking website, Allrecipes.com. Judge Burroughs relied heavily on the First Circuit’s 2016 VPPA decision in Yershov v. Gannett, the only precedential VPPA decision in this Circuit. He found that (1) geolocation data are PII and (2) that users of downloadable applications are subscribers, making them consumers under the statute. Because of this precedent, a motion to dismiss based on the premise that the VPPA does not apply to the facts as pleaded is likely to fail.

Although such a motion to dismiss is likely to fail, other defenses may be available to the New England Patriots. For example, the complaint identifies a privacy policy. If that policy informs users that certain PII may be shared with third parties, the Patriots may have a viable defense that users consented to the disclosure of their PII. In addition, in a similar litigation pending against Patreon in the Central District of California, Patreon is arguing that the VPPA violates the First Amendment and is therefore unconstitutional. Briefing on that issue recently closed and the court has not yet rendered a decision.

There are certainly other defenses the Patriots could make, but that will depend on the specific facts of the case. Often times, negotiating an early settlement may be the best litigation strategy in light of the potentially astronomical statutory damages available under the VPPA. In September 2023, the Boston Globe, after losing a motion to dismiss, settled a similar VPPA case for $4,000,000, amounting to about $7.75 per class member, a far cry from the statutory damages of $2,500 per class member. And in the Allrecipes case, just two weeks after losing the motion to dismiss, the parties filed a joint motion to stay pending settlement discussion. Settlement can be a wise strategy if an early motion to dismiss is not successful because settlement can likely be obtained for a fraction of the statutory damages, not to mention the costs to litigate.

As discussed in this related article, some VPPA class actions have alleged violations of the VPPA through the use of Facebook tracking pixels embedded in online videos. Since that article was published, the United States District Court for the Northern District of California dismissed the case at the center of that article because 1) the defendant, Chick-fil-A, was not a video tape service provider merely because it posted a video to its website, and 2) the plaintiff was not a consumer. Notably, the law within the 9th Circuit is a bit more defendant friendly than it is in the 1st Circuit with respect to VPPA cases, and the Chick-fil-A case did not involve a downloadable app, just the company’s website.

The case against the Patriots is one example of many that should cause all companies with an online presence, and in particular those with downloadable apps, to pay careful attention to their data sharing practices and privacy policies. Time will tell if the Constitutional argument being litigated in other cases has merit but, in the meantime, companies can shore up their defenses by, among other things, not sharing PII with third parties, strengthening their terms of use, and amending their terms of service, if necessary, to include arbitration and waiver of class action provisions. The Patriot’s deadline to respond to the complaint is April 30, 2024. It will be interesting to see what approach they take in responding.