If you offer a mobile application that allows consumers to watch videos of any kind, and if you share that video-viewing information with an analytics firm, take careful note: On April 29, in Yershov v. Gannett Satellite Information Network, Inc., No 15-1719, a panel of the First Circuit Court of Appeals that included retired Justice Souter took a very broad reading of the federal Video Privacy Protection Act (VPPA), and allowed a potentially mega-damages VPPA claim to proceed against the parent of the USA Today newspaper.

The VPPA, enacted in 1988 after a reporter printed a list of videos rented by then-Supreme Court nominee Robert Bork, is a video rental store-era statute containing terms like “video tape service provider.” The legislative history shows that its framers had emerging technologies in mind, too, and Congress amended the statute just a few years ago to make it easier for streaming services to obtain user consent to share information with analytics firms for the purpose (among other things) of displaying targeted advertising. If the furnisher of videos shares “information which identifies a person as having requested or obtained specific video materials,” and that “person” is a “renter, purchaser, or subscriber,” the company may be liable to all such “persons” to the tune of $1500 per violation, even absent any actual damages.

Several courts, including the Eleventh Circuit just a few months ago, held that simply downloading a mobile app does not make one a “subscriber.” But the First Circuit disagreed: “[B]y installing the app on his phone, thereby establishing seamless access to an electronic version of USA Today, [the plaintiff] established a relationship with Gannett that is materially different from what would have been the case had USA Today simply remained one of millions of sites on the web that [the plaintiff] might have accessed through a web browser.” The 11^th Circuit held apps to be no more “subscriber”-worthy than websites, but the First Circuit asked “[w]hy, after all, did Gannett develop and seek to induce downloading of the app,” if not to create a quantifiably different experience?

The First Circuit also took a broad view of what constitutes personally identifiable information under the VPPA. It already was clear that video providers need not necessarily disclose an actual name, if they disclosed enough information that would allow the recipient to more or less discover that name. In Yershov, the plaintiffs alleged that Gannett provided analytics firm Adobe with the unique device identifier of app users’ Android phones as well as GPS information showing where each user was located. That, the court held, was enough. It acknowledged that “there is certainly a point at which the linkage of information to identity becomes too uncertain, or too much yet-to-be-done, or unforeseeable detective work,” but thought that the plaintiffs has “plausibly alleged” enough knowledge by Adobe to get them over the hump.

We encourage all mobile app providers, if users can view videos on the app, to determine if they are sharing video viewing information with any third party, and if so, whether they are obtaining user consent for that sharing in the manner called for under the VPPA.

Mobile App Providers Encouraged to Obtain User Consent Before Sharing Video Viewing Information with Any Third Party After Gannett Mega-damages VPPA Claim Moves Forward