Congress makes compliance with the confusing Video Privacy Protection Act Easier

By Jim Halpert

Congress has amended the Video Privacy Protection Act (VPPA) to make it easier for businesses to obtain consent to share personally identifying information regarding consumers’ video viewing choices.

The VPPA is a 1988 law passed in response to the disclosure of video rental records of the Supreme Court nominee Judge Robert H. Bork during his confirmation hearings.  (Judge Bork passed away on December 19, two days before the amendment passed.)  The bill (the VPPA Amendment) has been sent to President Barack Obama for his signature.

The VPPA establishes fairly strict limits on the disclosure by “video tape service providers” of personally identifying consumer information that links a consumer to particular materials or services. This range of regulated entities is defined to include persons “engaged in the business . . . of rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials.” The scope of application of the VPPA to various online video service delivery models is unclear, primarily due to the statute’s failure to define the term “other audio visual materials.” Only disclosures of personally identifying information for “debt collection activities, order fulfillment, request processing, and the transfer of ownership” are exempt. Other disclosures require a warrant, court order, or the affirmative consent of the consumer, except that disclosures of the names and addresses of customers can be conducted with notice and opt-out.

Moreover, remedies for violation of the VPPA include statutory damages of $2,500 per violation plus attorneys’ fees and potential punitive damages that make it an attractive claim for the plaintiffs’ class action bar to bring. Enacted in the heyday of video rental stores, the VPPA was little used until the rise of online video rental and video streaming services, which some courts have interpreted to be covered by the statute.

The VPPA Amendment was prompted by two principal developments. First, Congress recognized the significant expansion of platforms for delivery of video content from video tapes to Internet streaming, cable on-demand and online downloads to a variety of devices. These contexts can involve many more entities in delivering content and a greater degree of information sharing than occurs in the traditional video rental business. Second, the VPPA contained language that appeared to require consumer opt-in consent before each disclosure. This in turn created significant uncertainty regarding consumers’ ability voluntarily to share their video preferences without giving consent prior to each decision to share video selection preferences on a social network, such as Facebook or Twitter. This also created a barrier to the delivery of sharing services by social networks and content providers. In contrast, the sharing of literary or musical preferences is not subject to an opt-in consent barrier.

The VPPA Amendment permits video service providers to obtain one-time consent that applies on an ongoing basis for up to two years. Congress preserved the statute’s existing protections requiring informed, written consent (opt-in) to the sharing, although under the federal E-SIGN law electronic consent will suffice.

However, Congress added an additional privacy protection by requiring video service providers to notify consumers “in a clear and conspicuous manner” of the ability to opt-out of consent to further sharing. This new requirement responds to concerns expressed in congressional hearings on the legislation that, once provided, ongoing consent would be difficult for a consumer to withdraw. Video service providers must offer the opportunity to withdraw consent on either a case-by-case (per title) basis or on an ongoing basis. The Senate Judiciary Committee Report explains that it was not the intent of the committee to dictate how or in what format a video service provider offers the ability to opt-out of the sharing. The opt-out choice can be offered at the time of a transaction or, for consumers who have already consented to ongoing sharing, it can be offered through a persistent mechanism on the provider’s web site.

Although the VPPA Amendment will provide significantly more certainty to video service providers in the face of mounting VPPA class action suits, we expect that the statute will continue to be tested by the privacy class action bar as questions over the scope and applicability of the statute to online video distribution methods persist. During December, three suits were filed against companies alleging violations of the VPPA by the companies through the use of tracking cookies, which resulted in disclosure of children’s video viewing information without consent.

Recommended actions going forward

Although the VPPA’s reach remains very unclear for reasons set out above, the statute’s significant potential class action exposure counsels in favor of complying with its provisions even if the statute may not apply. Entities that are or might be considered video service providers and who wish to engage in non-exempt disclosures of personally identifying information to other entities or to enable sharing on social networking sites should consider:

  • Obtaining the informed, written or electronic consent of the consumer to these disclosures in a form separate from privacy policies, terms and conditions or payment information.  In doing so, the provider should also inform that consumer of the details surrounding the sharing that will occur should the consumer provide consent to the sharing.
  • Obtain the consent at the time the disclosure is sought (unless consent was obtained within two years prior to the disclosure and that consent was not withdrawn).
  • Clearly and conspicuously provide the consumer with an opportunity to withdraw consent to sharing either on an ongoing basis (for example, on the website where the transaction is taking place or in an online user privacy preference site) or a case-by-case basis.
  • Track the data showing that consent has been received and remember to request a new, informed consent well before the two-year consent period expires.

For more information about the VPAA Amendment and its effect on your business, please contact Jim Halpert or Sydney White.