Last week, the U.S. Court of Appeals for the Eleventh Circuit held that allegations that personally identifiable information was disclosed without consent in violation of the Video Privacy Protection Act were sufficient to confer standing at the pleading stage. However, the court also found that users of free mobile apps did not qualify as subscribers under the VPPA.
The Video Privacy Protection Act prohibits a “video tape service provider… [from] knowingly disclos[ing] to any person, personally identifiable information concerning any consumer of such provider[.]” 18 U.S.C. § 2710(b). The statute defines a consumer as “any renter, purchaser, or subscriber from a video tape service provider[,]” and “personally identifiable information” as “information which identified a person as having requested or obtained specific video materials or services from a video tape provider[.]” Id. § 2710(a)(1) & (a)(3). The VPPA provides a private right of action for “[a]ny person aggrieved by any act of a person in violation of [the statute].” Id. § 2710(d)(1).
Cable News Network, Inc. and CNN Interactive Group, Inc. (collectively, “CNN”) offer media content on a mobile application that is available for free download on mobile devices. The CNN app does not request users’ consent to disclose their personal data.
The plaintiff, Ryan Perry, downloaded the CNN app in early 2013 on his iPhone and never consented to allow CNN to disclose his personally identifiable information. On February 18, 2014, Perry filed a putative class action complaint, alleging that CNN violated the VPPA. The complaint alleged that the CNN app tracked users’ views of news article and videos and collected records of this viewing activity without users’ knowledge or consent. The complaint also alleged that CNN sent the collected records of users’ viewing activity and mobile device MAC addresses to a data analytics company, which used the data to construct profiles of the users based on their online activity.
On April 20, 2016, the district court dismissed Perry’s amended complaint with prejudice, reasoning that further amendments to the complaint would be futile under Ellis v. Cartoon Network, Inc., 803 F.3d 1251 (11th Cir. 2015).
Although it found that Perry had standing to bring his lawsuit, the Eleventh Circuit affirmed the district court’s dismissal of the complaint in Perry v. Cable News Network, Inc., et. al., No. 16-13031 (11th Cir. April 27, 2017), concluding that Perry was not a subscriber under the VPPA.
Citing Spokeo v. Robins, 136 S. Ct. 1540, 1549 (2016), the Eleventh Circuit noted that plaintiffs must allege a concrete injury, which may be intangible, even in the context of a statutory violation and not simply a “bare procedural violation.” Perry, No. 16-13031, at 6. However, the court observed that “the violation of a procedural right granted by statute can be sufficient in some circumstances to constitute an injury in fact” so that “a plaintiff in such a case need not allege any additional harm beyond the one Congress has identified.” Id. (citations omitted).
The Eleventh Circuit found that “the structure and purpose of the VPPA supports the conclusion that it provides actionable rights” and a “violation of the VPPA constitutes a concrete harm.” Id. at 7. The court noted that the harm caused by a violation of the VPPA was similar to “a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts.” Id. (citation omitted). It observed that the right of privacy had long been recognized by “the great majority of American jurisdictions that have considered the question” and the common law tort of intrusion upon seclusion existed for invasion of privacy rights even absent publication or disclosure of private affairs or concerns (as opposed to the more invasive requirements for a VPPA violation which required actual disclosure of personal information). Id. at 8. Moreover, the Eleventh Circuit observed that “Supreme Court precedent had recognized in the privacy context that an individual has an interest in preventing disclosure of personal information.” Id. (citations omitted). Therefore, the court held that “a plaintiff… has satisfied the concreteness requirement of Article III, where the plaintiff alleges a violation of the VPPA for wrongful disclosure.” Id. at 8-9.
The Eleventh Circuit then addressed whether Perry was a “subscriber” under the VPPA. Relying on Ellis v. Cartoon Network, Inc., 803 F.3d 1251 (11th Cir. 2015), the court held that users of a free mobile apps do not qualify as “subscribers” under the VPPA. In Ellis, a plaintiff alleged that he was a subscriber of the Cartoon Network free mobile app which he used to view views and Cartoon Network had violated the VPPA by sending his viewing history and mobile device identification number to Bango without his consent. See Id. at 1253-54. The Eleventh Circuit held that the plaintiff was not a “subscriber” because “downloading an app for free and using it to view content at no cost is not enough to make a user of the app a ‘subscriber’ under the VPPA… [as] such a user is free to delete the app without consequences whenever he likes, and never access its content again.” Id. at 1257. Being a “subscriber” under the VPPA requires an “ongoing commitment or relationship between the user and the entity which owns and operates the app.” Id.
Turning to the factual allegations, the Eleven Circuit observed that Perry “did not ‘sign up for or establish an account with’ CNN, ‘provide any personal information to’ CNN, ‘make any payments’ to CNN, in using the app, ‘become a registered user’ of CNN or its app, ‘receive a [CNN] ID,’ ‘establish a [CNN] profile,’ ‘sign up for any periodic services or transmissions,’ nor ‘make any commitment or establish any relationship that would allow him to have access to exclusive or restricted content.’” See Perry, No. 16-13031, at 11. In short, Perry “ha[d] not demonstrated an ongoing commitment or relationship with CNN.” Id.
Perry proposed to amend his complaint to allege that he received access to certain features and content on the CNN app because of his cable television subscription and that CNN received an indirect monetary benefit through his payments to his cable television provider. However, the Eleventh Circuit found that these proposed amendments were futile because they only established a commitment between Perry and his cable television provider, and not a relationship with Perry. In affirming the district court's dismissal with prejudice, the Eleventh Circuit held that “the ephemeral investment and commitment associated with Perry’s downloading of the CNN App on his mobile device, even with the fact that he has a separate cable television subscription that includes CNN content, is simply not enough to consider him a ‘subscriber’ under Ellis.” Id. at 14.
The significance of Perry is twofold. First, Perry lowers the Article III standing bar (at least in the Eleventh Circuit) for violations of the VPPA, and potentially, other congressional statues that establish a right of privacy and provide a private cause of action. Under Perry, it may be sufficient for plaintiffs to establish a concrete injury that will confer Article III standing at the pleading stage simply by alleging a violation of the statutory protections created by federal privacy statutes, even in the absence of economic or personal injury. Second, Perry limits the scope of the VPPA to exclude users who do not register for a video service. By holding that a user does not establish a commitment or relationship that rises to the level of being a “subscriber” when an unregistered user downloads an app and watches content on his or her mobile device, the Eleventh Circuit narrows the reach of the VPPA to mobile apps that require users to sign up, register, establish a profile, or pay for the use of that app. Despite Perry, companies and organizations that offer free mobile apps should still act cautiously and obtain consent from their users for any collection and disclosure of their users’ personal information.