The VPPA Gets Dragged Into Overtime

The VPPA Gets Dragged Into Overtime¹

Running for office, former New York City Mayor Bill de Blasio was upfront about his his Boston Red Sox fandom.² Imagine, though, if he had wanted to keep it private and, instead, a scrappy journalist persuaded an MLB Network (or Apple TV+ or ESPN) employee to disclose his streaming history. If this were how the public found out that de Blasio preferred the Boston Red Sox to the New York Yankees or Mets, the revelation could have been embarrassing and politically disastrous. Fortunately for de Blasio, the Video Privacy Protection Act of 1988 (VPPA)³ would have protected him against such a risk.

The VPPA’s Origins

This oddball law from the 1980s was passed in the era of video rental stores like Blockbuster.⁴ The statute’s operative language prohibits a “video tape service provider” from knowingly disclosing “personally identifiable information concerning any consumer” including records of the video materials or services the consumer requested or obtained. ⁵ Disclosure is permitted if the service provider obtains the consumer’s prior consent, but such consent cannot be obtained through boilerplate language in a form that sets forth “other legal or financial obligations of the consumer.” ⁶ Disclosure is also permitted under other specified circumstances including a court order, law enforcement agency warrant, and “incident to the ordinary course of business of the video tape service provider.”⁷

Until recently, the VPPA did not get much playing time, with a few cases brought during the Blockbuster-era⁸ and most early cases involving video records used in police investigations.⁹ Yet, the law has reemerged in recent years as a vehicle to sue a wide range of companies.¹⁰ Several sports-related organizations, including ESPN, the NBA, MLB Advanced Media (MLBAM), the NFL, and FloSports, have gotten caught up in the VPPA’s crosshairs, along with a long list of other organizations, such as the AARP, Hulu, General Mills, PBS, and Blockbuster. In a Venn diagram, the differences among these entities would overwhelm any areas of overlap. However, the VPPA somehow applies to them all, according to the deluge of recent class-actions lawsuits under the statute.¹¹

Let’s rewind: In 1987, President Ronald Reagan nominated Judge Robert Bork to fill a seat on the Supreme Court.¹² Bork’s controversial stances on privacy inspired a reporter to investigate his video rental records.¹³ The reporter successfully convinced a manager at Bork’s local video store to share the family’s rental history. Though the resulting article, “The Bork Tapes,”¹⁴ revealed nothing salacious, the realization that the breach of privacy was not illegal shocked Congress into action.¹⁵ While Bork’s nomination to the Supreme Court ultimately failed, Congress enacted the VPPA to address concerns that third parties could get their hands on individuals’ rental records and use that information to embarrass them. ¹⁶

Fast-forwarding to the 2010s, the volume of VPPA-related claims exploded.¹⁷ Further, a 2012 amendment to the VPPA clarified that the law applied to video content delivered online.¹⁸ As a result, plaintiffs began using the Blockbuster-era law to bring mostly class action lawsuits not only against the modern analog of video rental stores—streaming platforms—but also, and increasingly, against any websites that hosted digital video content, including the NBA, Vizio, Patreon, TikTok, Meta, WebMD, and General Mills.¹⁹

What and Whom Does the VPPA Cover?

The VPPA is short, but far from clearcut. Its ambiguity has left it open to broad application and inconsistent interpretation. ²⁰ Many of the VPPA’s terms have been a source of debate, and courts have varied in interpreting these terms, leading to several circuit splits that make it difficult to come to a clear idea of what falls under the VPPA’s purview. ²¹ These include:

Consumer

According to the VPPA, a “‘consumer’ means any renter, purchaser, or subscriber of goods or services from a video tape service provider.”²² While it may have been abundantly clear in the context of 1980s video rental stores, modern cases have destabilized the term, especially the word “subscriber.” The First and Eleventh Circuits are split in how they define a subscriber.²³ In Ellis v. Cartoon Network, Inc., the Eleventh Circuit held that “a person who downloads and uses a free mobile application on his smartphone to view freely available content, without more, is not a ‘subscriber’(and therefore not a ‘consumer’).”²⁴ In contrast, six months later, in Yershov v. Gannett Satellite Network, Inc., the First Circuit held that a plaintiff in almost identical circumstances was a subscriber, and thus a consumer under the VPPA.²⁵ The term continues to elude consistent treatment in more recent cases. ²⁶

In two recent Southern District of New York cases, the court dismissed claims against the NBA and NFL because the plaintiffs in both cases had not sufficiently pled that being a subscriber to the NBA and NFL newsletters meant they were subscribers to the NBA’s or NFL’s video content.²⁷

Personally Identifiable Information (PII)

Of the VPPA’s key terms, the most ink has probably been spilled over the question of what constitutes PII, which is defined as “information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider.”²⁸ In recent VPPA cases, courts have split on whether information collected by cookies and third-party tracking pixels, including usernames, IP addresses, unique identifiers, and other web analytics, qualify as PII.²⁹ The two opposing approaches to this question are exemplified in the split between the First and Third Circuits.³⁰ In Yershov, the First Circuit found the definition of PII “awkward and unclear” but nevertheless interpreted it broadly to mean more than a person’s name and to include unique device identifiers and GPS coordinates that third-party data-recipients could connect to a specific individual’s “name, address, phone number, and more.”³¹ In contrast, in In re Nickelodeon Consumer Privacy Litigation, the Third Circuit held that static digital identifiers, like IP addresses did not qualify as PII because an “ordinary recipient” would not be able to use that data to identify an individual.³²

Several PII-related cases have emerged in the sports context in recent years. In Eichenberger v. ESPN, ³³ the Ninth Circuit adopted the Third Circuit’s “ordinary person” standard in rejecting the plaintiff’s claim that the Roku device identifier ESPN disclosed to a third party for analytics purposes was PII. ³⁴ However, a district court in Rhode Island, within the First Circuit, allowed a claim to proceed against the NFL because the NFL app transmitted user’s video history along with their geolocation data and advertising ID to Google for marketing and advertising purposes. ³⁵ In addition, FloSports faced allegations that the company violated the VPPA by using a Facebook tracking pixel to transmit users data without consent, ultimately settling the case, which was brought in the Massachusetts district court, in late 2023. ³⁶

Video Tape Service Provider (VTSP)

The VPPA defines VTSP to mean “any person, engaged in the business, in or affecting interstate or foreign commerce, of rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials.”³⁷ Courts have found that streaming platforms are VTSPs.³⁸

Recent lawsuits have attempted with mixed success to extend the definition of VTSP to include websites with video content.³⁹ In October 2023, a federal court in California dismissed a case against Hershey, whose website contained video clips, finding that Hershey was not a VTSP because “delivering audiovisual material is ancillary to [Hershey’s] true business purpose.”⁴⁰ Cases against companies like Google and General Mills have been dismissed on similar grounds.⁴¹
However, in November 2022, the federal district court in Georgia denied the motion to dismiss a VPPA claim against WebMD, which hosts health information and news in written and video form, holding that WebMD was a VTSP.⁴² Courts have similarly refused early attempts to dismiss cases against companies like Viacom and the Boston Globe, finding it at least plausible that they are VTSPs.⁴³

Ordinary Course of Business (OCB) Exception

The VPPA grants an exception when PII is shared in the ordinary course of a company’s business. According to the statute, OCB “means only debt collection, order fulfillment, request processing, and the transfer of ownership.” ⁴⁴ Courts have tended to adhere closely to these categories when assessing claims based on the OCB exception. ⁴⁵ However few cases have discussed what “ordinary” means in a digital world that looks considerably different than the one in which the VPPA originated. ⁴⁶ Because many VPPA cases that make it past the motion to dismiss or summary judgment stage end up settling, the OCB exception, which is a fact-specific question, has not truly had its day in court. ⁴⁷

In a 2023 case against gaming and entertainment website Fandom, the district court dealt with the permissibility of disclosing customers’ information and viewing behavior to Meta, Facebook’s parent company. ⁴⁸ In its motion to dismiss, Fandom argued that “analytic data [collected through a Meta tracking pixel] allows Fandom to better understand the types of requests a given user makes,” and so fell within the “request processing” category of OCB. ⁴⁹ However, the court ultimately denied Fandom’s motion. ⁵⁰

Despite a dearth of successful defenses on OCB grounds, defendants continue to push courts to consider changes in technology and business models since the VPPA’s passage. In Hayes v. Major League Baseball Advanced Media,⁵¹ MLBAM called for a broad interpretation of the OCB terms “order fulfillment” and “request processing” to recognize that businesses can use third parties to support operations. MLBAM argued that Facebook was exactly the kind of permitted third party the Senate Judiciary Committee contemplated when passing the VPPA—one that helped the company “market[] to [its] customers.”⁵² The parties voluntary dismissed the action in 2023, leaving the issue unresolved.

What Is the Penalty for Violating the VPPA?

The VPPA allows consumers to sue alleged violators of the law and potentially win awards of actual damages that are equal to at least $2,500 in liquidated damages, as well as punitive damages, attorneys’ fees and costs, and other equitable relief.⁵³ These statutory damages are attractive to plaintiffs’ attorneys because of the lucrative awards or settlements in class-action suits, which explains the profusion of VPPA class actions.⁵⁴ Recent reports have found that there were at least seventy class-action VPPA cases filed in the U.S. in the past year with twenty federal court filings in April 2023 alone.⁵⁵

What’s Next for the VPPA?

The VPPA has subjected a wide array of companies to potential liability, perhaps beyond its initial purpose. This may be because, in the absence of a comprehensive privacy law in the U.S., the VPPA is one of few attractive vehicles available for consumers to hold companies to account for using their data in unexpected ways, even if the statute was not designed to be a comprehensive privacy law or to apply as widely as it has been. It is unclear how far off the U.S. is passing a federal privacy law; a privacy bill proposed in 2022, the American Data Privacy and Protection Act (ADPPA)⁵⁶ looked promising coming out of committee but ultimately failed when Nancy Pelosi refused to bring the bill to a floor vote. More recently, in April 2024, lawmakers unveiled a bipartisan, bicameral privacy bill, the American Privacy Rights Act, which includes compromises on some of the issues that doomed the ADPPA—but it remains to be seen what will happen in the long legislative process.⁵⁷ However, if Congress fails to enact a comprehensive federal privacy law that applies across sectors and states, the public will likely continue to seek privacy protection, perhaps misguidedly, from the VPPA, and businesses will have to continue to scramble to determine legal uses of data in the modern era.

Businesses could advocate for Congress to amend the VPPA to modernize it or allow for updates to its definitions every few years that track new technologies and provide companies clear guidance. However, given Congress’s inability to act, that seems unlikely. In the meantime, any company that hosts video content while also handling consumers’ personal information should make sure they are complying with the VPPA’s terms, anachronistic as they may seem.

Written by: Elizabeth Gemdjian
Elizabeth is a 2025 J.D. Candidate at Brooklyn Law School.

Article Sources

¹ I have written more extensively on the VPPA in Elizabeth Gemdjian, Note, The Extraordinary Extension of the Video Privacy Protection Act, 90 Brooklyn L. Rev. (forthcoming 2024). For more scholarship on the VPPA, see also Marc Chase McAllister, Modernizing the Video Privacy Protection Act, 25 Geo. Mason L. Rev. 102 (2017); Yarden Z. Kakon, Note, “Hello, My Name Is User #101”: Defining PII Under the VPPA, 33 Berkeley Tech. L.J. 1251 (2018); Schooner Sonntag, Note, A Square Peg in a Round Hole: The Current State of the Video Privacy Protection Act for Videos on the Internet and the Need for Updated Legislation, 37 Loy. L.A. Ent. L. Rev. 237 (2017); Jeremiah P. Ledwidge, Note, Video Review: Routine Data Sharing Practices Place Video-Streaming Providers in the Crosshairs of the Video Privacy Protection Act, 12 Brook. J. Corp. Fin. & Com. L. 161 (2017).
² Joe Coscarelli, Bill de Blasio Admits He’s a Huge Boston Red Sox Fan, New York Magazine (Aug. 20, 2013),https://nymag.com/intelligencer/2013/08/bill-de-blasio-is-a-red-sox-fan.html.
³ 18 U.S.C. § 2710.
⁴ Thomas Germain, Is Every Website that Plays Videos Breaking an ‘80s Privacy Law?, GIZMODO (Oct. 15, 2022), https://gizmodo.com/video-privacy-protection-act-class-action-lawsuits-1849660417; Justine Young Gottshall & Chloé Nelson, VPPA Claims: Could Your Site Be Next, InfoLawGroup (June 13, 2023), https://www.infolawgroup. com/insights/2023/6/13/vppa-claims-could-your-site-be-next.
⁵ 18 U.S.C. § 2710(b)(1)
⁶ 18 U.S.C. § 2710(b)(2)(B).
⁷ 18 U.S.C. § 2710(b)(2)(C), (E), (F).
⁸ Schooner Sonntag, Note, A Square Peg in a Round Hole: The Current State of the Video Privacy Protection Act for Videos on the Internet and the Need for Updated Legislation, 37 Loy. L.A. Ent. L. Rev. 237, 250 (2017) (citing Evan Wooten & Zachariah DeMeola, A New Chapter in Video Privacy Protection Act’s History, Law360 (June 23, 2014, 10:40 AM), http://www.law360.com/articles/550346/a-new-chapter-in-video-privacy-protection-act-s-history). In 2012, Blockbuster quietly settled a suit over retaining customers’ information longer than necessary. Missaghi v. Blockbuster L.L.C., No. 11-CV-02559, 2012 WL 12895564 (D. Minn. Nov. 27, 2012); see also, Sarah Mirando, Blockbuster Agrees to Settle in Privacy Class Action Lawsuit, Top Class Actions (May 9, 2012), https://topclass actions.com/lawsuit-settlements/lawsuit-news/blockbuster-agrees-to-settlement-in-privacy-class-action-lawsuit/.
⁹ Schooner Sonntag, Note, A Square Peg in a Round Hole: The Current State of the Video Privacy Protection Act for Videos on the Internet and the Need for Updated Legislation, 37 Loy. L.A. Ent. L. Rev. 237, 250 (2017). “[I]t was not until 1996 that the first case, Dirkes v. Borough of Runnemede, [was] actually brought under the [VPPA].” Kathryn Elizabeth McCabe, Just You and Me and Netflix Makes Three: Implications for Allowing Frictionless Sharing of Personally Identifiable Information under the Video Privacy Protection Act, 20 J. Intell. Prop. L. 413, 428 (2013) (citing Dirkes v. Borough of Runnemede, 936 F. Supp. 235 (D.N.J. 1996)).
¹⁰ Eriq Gardner, How Entertainment Companies Are Fighting Lawsuits Over Disclosures of Who’s Watching, Hollywood Rep. (Oct. 21, 2014, 1:18 PM), https://www.hollywoodreporter.com/business/business-news/how-entertainment-companies-are-fighting-742131/; 18 U.S.C. § 2710(a)(3).
¹¹ See, e.g., Def. Mot. to Dismiss, Hayes v. Major League Baseball Advanced Media, L.P., No. 1:22-cv-05822, at 17–18 (N.D. Ill. dismissed Feb. 13, 2023); Louth v. NFL Enters. LLC, No. 121CV00405MSMPAS, 2022 WL 4130866 (D.R.I. Sept. 12, 2022); Salazar v. Nat’l Basketball Ass’n, No. 1:22-CV-07935, 2023 WL 5016968 (S.D.N.Y. Aug. 7, 2023).
¹² Andrea Peterson, How Washington’s Last Remaining Video Rental Store Changed the Couse of Privacy Law, Wash. Post (April 28, 2014, 2:21 PM), https://www.washingtonpost.com/news/the-switch/wp/2014/04/28/how-washingtons-last-remaining-video-rental-store-changed-the-course-of-privacy-law/.
¹³ Id.
¹⁴ Michael Dolan, The Bork Tapes, Wash. City Paper (Sept. 25–Oct. 1, 1987), https://web.archive.org/web/20160313041803/http://theamericanporch.com/bork5.htm; [https://perma.cc/37V2-T2ZD]
¹⁵ Peterson, supra note 6.
¹⁶ See Kristian Stout, Pushing Ad Networks Out of Business: Yershov v. Gannett and the War Against Online Platforms, Truth on the Mkt (May 10, 2016), https://truthonthemarket.com/2016/05/10/pushing-ad-networks-out-of-business-yershov-v-gannett-and-the-war-against-online-platforms/. Peterson, supra note 6.
¹⁷ Gardner, supra note 10; 18 U.S.C. § 2710(a)(3).
¹⁸ H.R. 6671, ll2th Cong. (2012); The Video Privacy Protection Act Amendments: A Final Analysis, Inside Privacy (Jan. 11, 2013), https://www.insideprivacy.com/united-states/the-video-privacy-protection-act-amendments-a-final-analysis/.
¹⁹ See, e.g., In re Hulu Priv. Litig., C 11-03764 LB, 2012 WL 3282960 (N.D. Cal. Aug. 10, 2012); Mollett v. Netflix, Inc., 795 F.3d 1062 (9th Cir. 2015); Eichenberger v. ESPN, Inc., 876 F.3d 979 (9th Cir. 2017); In re Nickelodeon Consumer Priv. Litig., 827 F.3d 262 (3d Cir. 2016);Rebecca Hughes Parker et al., Plaintiffs Continue to Test the Limits of a Vintage Video Privacy Law Against Diverse Industries: Defendants Score Some Victories but Challenges Remain, Dentons (July 18, 2023), https://www.dentons.com/en/insights/alerts/2023/july/18/plaintiffs-continue-to-test-the-limits.
²⁰ Germain, supra note 4.
²¹ See Anna O’Donnell, Note, Why the VPPA and COPPA Are Outdated: How Netflix, YouTube, and Disney+ Can Monitor Your Family at No Real Cost, 55 GA. L. REV. 467, 473 (2020).
²² 18 U.S.C. § 2710(a)(1).
²³ See, e.g., Anna O’Donnell, Note, Why the VPPA and COPPA Are Outdated: How Netflix, YouTube, and Disney+ Can Monitor Your Family at No Real Cost, 55 GA. L. REV. 467, 475–77 (2020).
²⁴ Ellis v. Cartoon Network, Inc., 803 F.3d 1251 (11th Cir. 2015).
²⁵ Yershov v. Gannett Satellite Network, Inc., 820 F.3d 482 (1st Cir. 2016).
²⁶ In April 2023, the U.S. District Court for the Southern District of New York (“SDNY”) dismissed a claim against Warner Bros. Discovery-owned Scripps Networks, finding that the plaintiffs were not consumers under the VPPA because they had subscribed to HGTV.com newsletters, not video content. Carter v. Scripps Networks, LLC, No. 22-CV-2031 (S.D.N.Y. (Apr. 24, 2023); See also Winston Cho, Who Counts as a Subscriber? A Judge Explains in a Data Privacy Suit Involving Facebook Tracking Tool, Hollywood Rep. (April 25, 2023, 5:12 PM), https://www.hollywoodreporter.com/business/business-news/scripps-network-lawsuit-dismissed-data-privacy-suit-facebook-tracking-tool-1235402327/; Salazar v. Glob., No. 3:22-CV-00756, 2023 WL 4611819 (M.D. Tenn. July 18, 2023) (distinguishing between a subscriber to a newsletter and a subscriber to audio-visual content).
²⁷ Salazar v. Nat’l Basketball Ass’n, No. 1:22-CV-07935, 2023 WL 5016968 (S.D.N.Y. Aug. 7, 2023); Alex v. NFL Enters. LLC, No. 1:22-CV-09239, 2023 WL 6294260 (S.D.N.Y. Sept. 27, 2023).
²⁸ 18 U.S.C. § 2710(a)(3). See e.g.,Marc Chase McAllister, Modernizing the Video Privacy Protection Act, 25 Geo. Mason L. Rev. 102, 145–46 (2017); Yarden Z. Kakon, Note, “Hello, My Name Is User #101″: Defining PII Under the VPPA, 33 Berkeley Tech. L.J. 1251 (2018); Daniel L. Macioce Jr., Note, PII in Context: Video Privacy and a Factor-Based Test for Assessing Personal Information, 45 PEPP. L. REV. 331 (2018).
²⁹ Kristin L. Bryan et al., Sites, PII, and Videotape: Litigation Trends Under the Federal Video Privacy Protection Act, 13 Nat’l L. Rev (Apr. 4, 2023), https://www.natlawreview.com/article/sites-pii-and-videotape-litigation-trends-under-federal-video-privacy-protection-act (the Southern District of New York has dismissed VPPA litigation when a user ID and website name were disclosed without the video title but allowed a case to proceed when a user ID and email address were disclosed alongside video viewing information). The Third and Ninth Circuits have interpreted PII narrowly to mean information that an ordinary person would be able to use to find out an individual’s viewing behavior. The Video Privacy Protection Act as a Model Intellectual Privacy Statute, 131 Harv. L. Rev. 1766, 1781 (2018). However, the First Circuit has adopted a broader reading of PII to include “any ‘information reasonably and foreseeably likely to reveal,’ directly or indirectly, an individual consumer’s identity.” The Video Privacy Protection Act as a Model Intellectual Privacy Statute, 131 Harv. L. Rev. 1766, 1781 (2018) (quoting Yershov v. Gannett Satellite Information Network, Inc., 820 F.3d 482 (1st Cir. 2016)).
³⁰ Ronald Raether et al, Ad Technology Compliance Tips from Video Privacy Claims, Law360 ((Oct. 19, 2022, 5:28 PM), https://www.law360.com/articles/1538988/ad-technology-compliance-tips-from-video-privacy-claims.
³¹ Yershov v. Gannett Satellite Information Network, Inc., 820 F.3d 482, 486 (1st Cir. 2016) (quoting S.Rep. No. 100-599, at 12 (1988), as reprinted in 1988 U.S.C.C.A.N. 4342, 4342-12).
³² In re Nickelodeon Consumer Privacy Litig., 827 F.3d 262, 284 (3d Cir. 2016), cert. denied, 580 U.S. 1048 (2017).
³³ Eichenberger v. ESPN, Inc., 876 F.3d 979 (9th Cir. 2017).
³⁴ Allison Grande, ESPN Ruling Further Narrows Video Privacy Law’s Reach, Law360 (Dec. 4, 2017, 4:09 PM), https://www.law360.com/articles/990643.
³⁵ Louth v. NFL Enters. LLC, No. 121CV00405MSMPAS, 2022 WL 4130866 (D.R.I. Sept. 12, 2022); Andrew G. Simpson, Judge Allows Claim that NFL App Violates Privacy by Disclosing Personal Data to Google, Ins. J. (Sept. 15, 2022), https://www.insurancejournal.com/news/east/2022/09/15/685004.htm.
³⁶ Fiorentino v. FloSports Inc., No. 1:22-cv-11502-AK (D. Mass.); Frequently Asked Questions, Fiorentino v. FloSports Settlement (last updated Mar. 6, 2024, 2:54 PM), https://flosportsvppasettlement.com/Home/FAQ.
³⁷18 U.S.C. § 2710(a)(4).
³⁸ Bryan, supra note 29;. See also In re Hulu Priv. Litig., C 11-03764 LB, 2012 WL 3282960, at *4–6 (N.D. Cal. Aug. 10, 2012).
³⁹ Bryan, supra note 29; Germain, supra note 4.
⁴⁰ Rodriguez v. Hershey Co., No. 23-CV-398-L-DEB, 2023 WL 6798506, at *2 (S.D. Cal. Oct. 12, 2023). See also Kristin Bryan & James Brennan, Court Dismisses Video Privacy Claims Brought Against Candy Company, Making Clear VPPA Liability Does Not Extend to All Websites with Video Content, Privacy World (Oct. 19, 2023), https://www.privacyworld.blog/2023/10/court-dismisses-video-privacy-claims-brought-against-candy-company-making-clear-vppa-liability-does-not-extend-to-all-websites-with-video-content/.
⁴¹ In re Nickelodeon Consumer Privacy Litig., 827 F.3d 262 (3d Cir. 2016); Carroll v. Gen. Mills, Inc., No. CV231746DSFMRWX, 2023 WL 6373868 (C.D. Cal. Sept. 1, 2023).
⁴² Lebakken v. WebMD, LLC, 640 F. Supp. 3d 1335 (N.D. Ga. 2022).
⁴³ Nickelodeon, 827 F.3d; Ambrose v. Boston Globe Media Partners LLC, No. CV 21-10810-RGS, 2022 WL 4329373 (D. Mass. Sept. 19, 2022).
⁴⁴ 18 U.S.C. § 2710(a)(2).
⁴⁵ In re Hulu Priv. Litig., No. C 11-03764 LB, 2012 WL 3282960, at *6–7. (N.D. Cal. Aug. 10, 2012).
⁴⁶ However, the argument has been made in motions to dismiss. See, e.g., Def. Mot. Dismiss 17–19, Hayes v. Major League Baseball Advanced Media, L.P., No. 1:22-cv-05822 (N.D. Ill. dismissed Feb. 13, 2023).
⁴⁷ See, e.g., Hulu, 2012 WL 3282960; Jackson v. Fandom, Inc., No. 22-CV-04423-JST, 2023 WL 4670285 (N.D. Cal. July 20, 2023).
⁴⁸ Fandom, 2023 WL 4670285, at *5.
⁴⁹ Id.
⁵⁰ Id. It remains to be seen if this case will proceed to trial, and, if so, how the court will treat the OCB question.
⁵¹ See, e.g., Def. Mot. to Dismiss, Hayes v. Major League Baseball Advanced Media, L.P., No. 1:22-cv-05822, at 17–18 (N.D. Ill. dismissed Feb. 13, 2023).
⁵² Def. Mot. to Dismiss, Hayes v. Major League Baseball Advanced Media, L.P., No. 1:22-cv-05822, at 18 (N.D. Ill. dismissed Feb. 13, 2023) (quoting S.Rep. No. 100-599, at 14 (1988), as reprinted in 1988 U.S.C.C.A.N. 4342, 4342-14).
⁵³ 18 U.S.C. § 2710(c). A private right of action allows a private individual who was harmed by a law’s violation to sue law’s violator. Private Right of Action, IAPP, https://iapp.org/resources/article/private-right-of-action/ (last accessed Nov. 10, 2023, 1:57 PM).
⁵⁴ Francis X. Nolan, IV & Melissa L. Fox, A Blockbuster Privacy Law? VPPA’s Scope Remains Unclear, Eversheds Sutherland (Apr. 13, 2023), https://us.eversheds-sutherland.com/NewsCommentary/Legal-Alerts/257931/A-blockbuster-privacy-law-VPPAs-scope-remains-unclear.
⁵⁵ See Ryan Joe and Lara O’Reilly, A Blockbuster-Era Video Law Is Being Used to Ding Big-Name Brands Like General Mills, Geico, and Chick-Fil-A With Privacy Lawsuits, Insider (Sept. 7, 2023, 12:23 PM), https://www.businessinsider.com/vppa-privacy-legal-threat-major-brands-2023-9; Tal S. Benschar and Efrem Schwalb, Strategies to Defending VPPA Claims, Bloomberg L. (July 2023), https://www.bloomberglaw.com/external/document/X513MFL0000000/litigation-professional-perspective-strategies-to-defending-vppa.
⁵⁶ Joseph Duball, US Lawmakers Unveil Bipartisan American Data Privacy and Protection Act, IAPP (June 6, 2022), https://iapp.org/news/a/congress-unveils-american-data-privacy-and-protection-act/.
⁵⁷ Jedidiah Bracy, New Draft Bipartisan US Federal Privacy Bill Unveiled, IAPP (Apr. 7, 2024), https://iapp.org/news/a/new-draft-bipartisan-us-federal-privacy-bill-unveiled/.,