The Second Circuit’s Salazar v. NBA decision: expanding liability under the VPPA

The Second Circuit’s long-awaited decision in Salazar v. NBA, No. 23-1147 (2d Cir. Oct. 15, 2024), has set a new precedent that broadens the scope of liability under the Video Privacy Protection Act (VPPA).  By significantly expanding the definition of a “subscriber,” the ruling introduces fresh compliance challenges for businesses offering video content on their websites.

The VPPA and its scope

As businesses increasingly rely on digital platforms to engage with consumers, understanding the foundational framework of the VPPA becomes critical. This section delves into the origins and applicability of the VPPA, providing essential context for how the Act regulates the use of personal information in connection with video services. By exploring its legislative intent and the nuances of its key definitions, we can better understand how courts are shaping its interpretation in today’s digital landscape.

Origins and applicability

The VPPA was enacted in 1988, spurred by public outrage over the unauthorized disclosure of video rental records during Robert Bork’s Supreme Court nomination process. It prohibits “video tape service providers” from knowingly disclosing personally identifiable information (PII) about consumers without consent.

Under the VPPA, a “consumer” is defined as “any renter, purchaser, or subscriber of goods or services from a video tape service provider.” However, the statute does not define key terms like “goods or services” or “subscribers,” leaving room for interpretation.

Facts of the Salazar case

The plaintiff’s allegations

In Salazar, the plaintiff subscribed to a free NBA email newsletter and later watched videos on the NBA’s website. He alleged that his video-watching history and Facebook ID were disclosed to Meta Platforms, Inc. through the Meta pixel embedded in the NBA’s website, violating the VPPA.

Salazar alleges that:

1. He signed up for the NBA’s free online newsletter, meaning he exchanged information including his email address in return for periodic emails from the NBA.
2. He visited the NBA’s website, NBA.com, where he watched videos.
3. The NBA violated the VPPA by knowingly disclosing, without Salazar’s permission, certain information about Salazar and the videos he watched.

The parties contest whether the online newsletter Salazar signed up for qualifies as “goods or services” as that phrase is used in the VPPA. The NBA doesn’t contend that the newsletter is not a good or service generally; rather, it insists that statutory context compels the conclusion that a consumer under the VPPA must specifically rent, purchase, or subscribe to audiovisual “goods or services.” The NBA reasons that because the VPPA defines a “consumer” as one who rents, purchases, or subscribes to services “from a video tape service provider,” id. at § 2710(a)(1) (emphasis added), those services must, by definition, be audiovisual services. Salazar disagrees and argues that nothing in the statute limits the definition of “consumer” to those who rent, purchase, or subscribe to a particular class of services—namely, audiovisual content.

District Court dismissal

The United States District Court for the Southern District of New York dismissed Salazar’s suit. The reasoning for dismissing the claim, was that the Salazar’s newsletter subscription did not qualify him as a “subscriber” of video services and that the VPPA protections did not apply. Although it concluded that Salazar had standing to sue, it ruled for the NBA on the merits, holding that Salazar had not plausibly pled that he is a “consumer” under the VPPA. The court held that the phrase “goods or services” within the VPPA’s definition of “consumer” is limited to audiovisual “goods or services”—which the online newsletter is not—and that signing up for an online newsletter did not make Salazar a VPPA “subscriber.” See generally Salazar v. National Basketball Association, 685 F. Supp. 3d 232 (S.D.N.Y. 2023).

The Second Circuit, however, reversed this decision, expanding the interpretation of “subscriber” and setting a potentially sweeping precedent.

The Second Circuit key holdings

The Second Circuit reversed the lower court’s decision, adopting a broader interpretation of the term “subscriber” under the VPPA.

1. Expanding the definition of a subscriber
   The decision has broadened the definition of a subscriber. The Second Circuit held that a “subscriber of goods or services” under the VPPA includes anyone who subscribes to any goods or services from a provider, even if those goods or services are unrelated to video content. The court emphasized that the statute’s definition of “video tape service provider” specifies a connection to audiovisual materials, but the definition of “consumer” does not, allowing for a broader interpretation.

2. Recognizing non-monetary subscriptions
   The decision further expands the VPPA to include non-monetary exchanges. Salazar does not allege that he paid the NBA money, he does allege that he provided the NBA with his personal information when he signed up for the newsletter.
   In return for receiving periodic NBA-related updates, Salazar exchanged, at a minimum, his email address,  his IP address, and cookies associated with his device. The court found that providing an email address, IP address, or device cookies in exchange for receiving services constitutes a subscription, even without monetary payment. It cited modern practices like subscribing to YouTube channels for free as examples of non-monetary subscriptions. “That information is not insignificant,” the court noted. Specifically, the court reasoned by receiving it, the NBA learned how to directly reach out to Salazar.  It discovered where his device was. It gained access to additional information stored in any cookies on his device.  These tools increased the NBA’s potential to urge Salazar to visit NBA.com and watch videos on it, making the NBA’s relationship with him distinct from its relationship with casual NBA.com video-watchers who had not signed up for the newsletter.

3. Non-exclusive content is protected
   Additionally, the VPPA protections extend to non-exclusive content. By deeming the plaintiff’s subscription to the NBA’s newsletter sufficient to qualify for VPPA protections, the court ruled that the VPPA applies even if the videos accessed are publicly available and not tied to exclusive content.

Impact and recommendations for businesses

The Second Circuit’s decision significantly expands the scope of the VPPA, creating new compliance challenges and liability risks for businesses.

Impact of the decision

1. Broader liability for PII sharing
   Pertinently, the decision created a broader Consumer definition by classifying a user who exchanges minimal information—such as an email address, IP address and cookies— for content as a “subscriber,” companies hosting videos could face potential liability for any PII disclosure to third parties.

2. Increased exposure to class actions
   This ruling may cause increased exposure to class actions. The statutory damages under the VPPA are $2,500 per violation. With the vast number of users visiting video-hosting websites, businesses could face class action lawsuits with substantial financial exposure.

3. Compliance challenges with tracking technologies
   Many websites use tracking technologies like pixels and cookies that could inadvertently share subscriber data with third parties. These practices now risk violating the VPPA if they involve video viewing histories. This would require companies to overhaul its tracking policies to comply with this new interpretation of the VPPA.

What companies should do? Review and Update Data Practices: Businesses should conduct comprehensive audits of their websites to identify tracking technologies that may collect or share video-related PII. Removing or modifying these features can mitigate potential liability. Strengthen User Consent Mechanisms: Implementing robust consent mechanisms for data collection and sharing is critical to comply with the VPPA and similar privacy laws. Enhance Legal and Technical Monitoring: As Salazar may influence other jurisdictions, staying informed about evolving interpretations of the VPPA is essential. Train Employees on Privacy Obligations: Educate teams about the expanded scope of the VPPA to ensure proper handling of consumer data and reduce the risk of inadvertent violations.

Conclusion

The Second Circuit’s decision in Salazar v. NBA marks a significant expansion of the VPPA’s reach. By broadening the definition of “subscriber” to include users who provide even minimal non-monetary value, the ruling exposes companies to significant liability risks. Businesses must act swiftly to proactively review their practices. In the evolving landscape of privacy law, vigilance and adherence to robust compliance frameworks and proactive measures remain the best defense against potential litigation and penalties.