First Circuit panel significantly expands VPPA definitions

Data Protection, Privacy and Security Alert


The First Circuit Court of Appeals on June 7, 2016 denied a petition for rehearing en banc of a panel opinion with potentially significant consequences for providers of video services under the Video Privacy Protection Act of 1988 (VPPA). 

The panel opinion, released in late April, adopts very broad interpretations of the terms “personally identifiable information” (PII) and “consumer” to include, respectively, PII that is not tied directly to an individual and consumers who merely use a provider’s short video service without registering. 

Case background

In Yershov v. Gannett Satellite Info. Network, Inc., No. 15-1719 (1st Cir., Apr. 29, 2016), the appellant, Alexander Yershov, downloaded and installed the free USA TODAY app, provided by appellee Gannett, on his mobile phone.  Yershov alleged that each time he viewed a video on the app, Gannett disclosed to Adobe the title of the video, his unique device ID, and the GPS coordinates of his phone.  In ruling on Gannett’s motion to dismiss, the district court of Massachusetts held that the device ID was “personally identifiable information” under the VPPA  − but it granted Gannett’s Rule 12(b)(6) motion on grounds that Yershov was not a “consumer.”  

The First Circuit agreed with regard to PII but reversed the dismissal on grounds that, under Yershov’s complaint, it is sufficiently plausible that he was a “consumer” under the meaning of the VPPA.

Meaning of “personally identifiable information”

A three-judge panel for the First Circuit agreed with the district court’s conclusion regarding the meaning of PII.  The court acknowledged that the definition of PII under the VPPA is “awkward and unclear” and that GPS coordinates and a device identifier alone may not permit Gannett to identify subscribers.  However, it said that the VPPA does not limit PII “to information that explicitly names a person.”  Moreover, it noted that Adobe had the ability to link GPS coordinates and device identifier information to particular people and, therefore, “[w]hile there is certainly a point at which the linkage of information to identity becomes too uncertain….here the linkage, as plausibly alleged, is both firm and readily foreseeable to Gannett.”

In deciding that the complaint adequately alleges that Gannett disclosed PII, the First Circuit did not cite any VPPA precedent.  Rather, it relied on canons of statutory interpretation in reaching its conclusion.  This could potentially expand the definition of PII to include not only information that is tied to an identifiable person but also information that could be, even by someone else, tied to an identifiable person.  Such an interpretation is broader than the interpretations by a number of other courts.  For example, in In re: Hulu, No. 3:11-cv-03764-LB, at 12 (N.D. Cal. Apr. 28, 2014), the district court for the Northern District of California said, “[T]he [statutory] language supports the conclusion that the disclosure must be pegged to an identifiable person (as opposed to an anonymous person).”

Meaning of “consumer”

The First Circuit panel, however, disagreed with the district court, finding that Yershov was a consumer under the VPPA.  The First Circuit’s analysis hinged on whether Yershov was a “subscriber.”  The district court had found that subscriptions require “payment, registration, commitment, delivery, and/or access to restricted content.”  The First Circuit disagreed, finding that if payment were required, then it would render the other terms in the definition of consumer (i.e., “purchaser” or “renter”) superfluous, as a paying subscriber is either a purchaser or a renter.  It further noted that in downloading the app, Yershov’s access to the app was “not free of a commitment to provide consideration in the form of [his PII].”

In addition, the First Circuit pointed to a definition of “subscribe” that did not require payment.  Looking to the American Heritage Dictionary 1726 (4th ed. 2000 – an edition that postdated enactment of the statute by 12 years), the court determined that to “subscribe” means “[t]o receive or be allowed to access electronic texts or services by subscription” with “subscription” defined as “[a]n agreement to receive or be given access to electronic texts or services.” 

The First Circuit’s expansive interpretation of a “subscriber” is in line with some other courts but in disagreement with others.  For example, in Ellis v. Cartoon Network, Inc., 803 F.3d 1251 (11th Cir. 2015), the Eleventh Circuit agreed with the district court’s ruling in Yershov, finding that merely downloading and watching videos at no cost does not make a person a subscriber.

However, the panel made clear that its interpretation of the terms PII and subscriber is in the context of a motion to dismiss, and the court admitted that its “actual holding, in the end, need not be quite as broad as our reasoning suggests,” as it simply must hold “that the transaction described in the complaint….plausibly pleads a case that the VPPA’s prohibition on disclosure applies.” 

Nonetheless, the First Circuit panel’s ruling has troubling implications for video service providers.  Now that the First Circuit has denied rehearing en banc, this decision could very well lead to a de facto requirement that online video sites to obtain express consent from consumers for disclosures of website visitor information to Internet advertising and analytics companies, and even a requirement to include mandatory arbitration clause language in any terms of use for these services.  

Find out more about the potential implications of this decision by contacting either of the authors.