The Ninth Circuit Court of Appeals has joined the Third and Eleventh Circuits in ruling that any disclosure of an individual’s online viewing history along with their personally identifiable information confers standing to bring a suit for violation of the Video Privacy Protection Act (VPPA) in federal court. The case, Eichenberger v. ESPN, Inc., Case No. 15-35449, concerned ESPN’s alleged practice of disclosing to Adobe Analytics the device serial numbers and viewing history of consumers who used its “WatchESPN Channel” application on Roku streaming devices. Adobe is alleged to have used the information provided by ESPN, in combination with information gathered from other sources, to identify the subscribers and then provide aggregated data to ESPN that was in turn shared with advertisers. The plaintiff alleged that this practice violated the VPPA’s prohibition on knowing disclosure of personally identifiable information of consumers. ESPN attacked plaintiff’s claim on two fronts: first, arguing that he did not have standing because he had not suffered an injury, and second, that even if he had standing, it had not shared his “personally identifiable information.” The district court ruled in his favor on the second point, and the Ninth Circuit took up both issues on appeal.
With respect to the threshold issue of whether the plaintiff had standing to bring a claim based on a bare violation of the statute, the Ninth Circuit ruled that such a violation was sufficient to confer Article III standing. The court distinguished the case from the Supreme Court’s decision in Spokeo, Inc. v. Robins, where the high court ruled that a procedural violation of a statute, without more, did not grant a plaintiff standing to seek redress in federal court. Here, in contrast, according to the Ninth Circuit, ESPN’s alleged conduct violated the substantive provisions of the VPPA—the right to “retain control over their personal information.” In so ruling, the court rejected ESPN’s argument that the VPPA requires an allegation of some harm in addition to the privacy violation.
Plaintiff, however, did not fare so well on the second issue presented in the appeal—whether his Roku device serial number constituted “personally identifiable information” under the statute. The court observed that this term can cover information that can be used to determine a person’s identity, but ultimately concluded that it was not to expansive as to include the serial number of a device, even if a data aggregator could use that number to ferret out an individual’s identity. The court adopted the Third Circuit’s “ordinary person” test, which asks whether an ordinary person could use the information to identify an individual. Concluding that an ordinary person could not use a serial number to identify the owner of the device, the Ninth Circuit affirmed the district court’s dismissal of the action.
This decision automatically confers standing on plaintiffs in the states covered by the Ninth Circuit to bring actions against video content providers who share their personally identifiable information without authorization, even absent some other form of harm. But, it provides some room for those providers to share such information with third parties if an “ordinary person” would not be able to use the information to identify an individual, apparently even if it is disclosed to a third party expressly for the purpose of de-anonymizing it. Internet video content providers located within the Ninth Circuit would do well to review their data-sharing practices and privacy disclosures in light of this decision, particularly given the steep statutory penalties available to consumers for violation of the VPPA.