Video Privacy Protection Act

Prior to 2007, VPPA had not been cited by privacy attorneys as a cause of action involving electronic computing devices. With the emergence of new-age computing technology and devices in the early 2000s came websites, 3rd party advertising, and tracking firms that posed a possible risk to the user's privacy. While computer technology was progressing rapidly, federal and state laws had failed to stay up to date. As such, legal actions for violations were minimal to non-existent. A new method to litigate Federal privacy cases was needed to protect the hundreds of millions of people violated by the unauthorized tracking of user's activities online. No law firms had litigated cases involving the computer technology inherent within the exchange of user data between third-party affiliated entities, thus there was no case precedent, no "blueprint" to follow. Earlier cases, such as the double-click "cookie" case in 2001, had relied on using a wiretap statute, the Electronic Communication Privacy Act ("ECPA"). While a plausible allegation, it was not a legally and evidentially appropriate allegation since the website user had granted such permissible use (dismissing such allegation with legal reasons) within the website's terms of service ("TOS").

In 2007, Texas attorney Joseph H. Malley wanted to develop a "template" to use for filing Federal Data Privacy Class Actions, but none existed. After months of researching state and Federal case law and statutes, Malley determine that VPPA could be the "lynch-pin" to control unauthorized access to user's personal data collected online. He then filed a Federal Class Action lawsuit against Facebook and thirty-three companies; including Blockbuster, Zappos, and Overstock.com, due to privacy violations caused by the Facebook Beacon program citing VPPA.[4][5], the program resulted in users' private information, obtained from third-party affiliate marketing websites, being posted on Facebook without consent. This act was referenced in the Lane v. Facebook, Inc. class action lawsuit. Based on this act, it is generalized to other forms of rental records such as DVDs, video games, and more. This was the FIRST time VPPA had been used in litigation for such purposes, and would forever change Federal Data Privacy litigation.

Malley had previously litigated in the early 2000s using another federal privacy law, the Driver's Privacy Protection Act ("DPPA"), which provided statutory damages for to the unauthorized access of DMV records. This law allowed Malley to successfully file numerous federal class actions against hundreds of companies, but a new theory of liability was needed for added assurance to survive a motion to dismiss. The problem, no case law involving this new-age type of technology. Substantial research was thus required, eventually revealing an "archaic" statute created in 1988: Video Privacy Protection Act ("VPPA"). Arguably unrelated to present technology, VPPA concerned about obtaining information from a physical location and involved VHS and Betamax recordings. As such, lawsuits involving online entities that used audio-video would need to plead comparisons between the "old-new" technologies for advertising.

The online advertising industry, in association with analytic companies, had begun using video ads to conduct its ubiquitous tracking, consumer's attention shown to be drawn to such as opposed to written content, In later years, these tracking methods would expand to photos and audio, IE., In 2008, cell phones were re-designed to include a new method of tracking, the use of social apps to collect photos, a process which now permitted a one-step "click" process to uploading a photo as opposed to the previous six steps. This allowed content to be provided for free and which formed the basis for the tracking, IE., Exif data."). Such acts were captured when Malley used software applications to log HTTP/HTTPS traffic between a computer's web browser and the Internet, analytic tests using two computers interfaced, producing indisputable evidence of such activities: moreover, detailed reports of any and all parties involved in such nefarious activities, IE., "tracking the trackers". In the continuing research of the Industry's business practices to determine its monetization interests, such revealed the incorporation of complex graphics within online ads, and the exchange of data derived from video ads not confined to an internal network, used via a TCP/IP protocol. This unauthorized activity would become the core allegation.

Extensive research and case analysis of Federal and State laws, regulations, and Court Opinions, yielded limited assistance. An adaptation of the law was needed to litigate this new computer technology involving unauthorized access to online consumer's data. Malley seized on an archaic law written concerning the technology of the 1980s involving video cassettes, VHS, and Betamax, the Video Privacy Protection Act ("VPPA"), 18 U.S. Code § 2710 - Wrongful disclosure of video tape rental or sale records, (1988), envisioning that the websites and any affiliated third-parties, which used the audio and/or video within its marketing ads were "video-providers"; moreover, this content, ads, and online games, merely a video; moreover, the essential functionality of the illegal transfer, a "wrongful disclosure", (core elements needed to prove-up a VPPA violation).

In December 2009, Joseph H. Malley representing an anonymous plaintiff, filed a lawsuit against the online DVD rental company Netflix over its release of data sets for the Netflix Prize, alleging that the company's release of the information constituted a violation of the VPPA.[6]

Netflix cited the VPPA in 2011 following the announcement of its global integration with Facebook. The company noted that the VPPA was the sole reason why the new feature was not immediately available in the United States, and it encouraged its customers to contact their representatives in support of legislation that would clarify the language of the law.[7] In 2012, Netflix changed its privacy rules so that it no longer retains records for people who have left the site. This change was due directly to a lawsuit indicating violation of the act.[8] Joseph H. Malley was contacted by the U.S. House of Representatives Chief Counsel of the Democratic Subcommittee on IP to provide legal assistance related to blocking the 2012 VPPA Amendment proposal. In January 2013, President Barack Obama signed into law H.R. 6671, which amended the Video Privacy Protection Act to allow video rental companies to share rental information on social networking sites after obtaining customer permission. Netflix had lobbied for the change.[9] While VPPA was amended, efforts to limit the extent of the VPPA amendments were successful. To date, when a Netflix consumer desires to share their viewing history to the accounts of their Facebook friends, an indicator on the Netflix site provides notice of the actual use by Netflix of their data.

In a continuing effort to limit consumer's privacy violations, Malley filed a class action involving Hulu in 2012. A San Francisco federal trial court found the VPPA's subscriber protections apply to users with Hulu accounts.[10] In 2015, the United States Court of Appeals for the Eleventh Circuit found that those protections do not reach the users of a free Android app, even when the app assigns each user a unique identification number and shares user behavior with a third-party data analytics company.[10]