In the past year, Plaintiff firms have initiated a new wave of class action lawsuits alleging that companies using Facebook’s ad targeting tool, Pixel, are violating data privacy laws. These lawsuits seek millions of dollars in damages and demonstrate the legal and financial risks of using ad-targeting technology.
The Video Privacy Protection Act (VPPA)
The new wave of lawsuits alleges that companies using Facebook’s Pixel are violating the federal Video Privacy Protection Act (the “VPPA”). 18 U.S.C. § 2710. Congress enacted the VPPA in the 1980s – well before the modern internet era – following the contentious Senate confirmation hearings for President Reagan’s Supreme Court nominee, Robert Bork . After Bork debated before Congress whether Americans have a right to privacy under the law, a journalist challenged Bork’s view by obtaining and publishing a copy of the Bork family’s movie rental history from their local video rental store. Elected officials then rushed to enact the VPPA and prevent similar disclosures of video viewing histories.
As written, the VPPA prohibits “video tape service providers” from disclosing the personally identifiable information of any consumer, unless the provider obtains the consumer’s informed, written consent. Notably, the VPPA requires companies to use a standalone consent form that is “distinct and separate from any form setting forth other legal or financial obligations of the consumer.”
The VPPA creates a private right of action, authorizing the recovery of attorney’s fees, punitive damages, and statutory damages in the amount of $2,500.
While the VPPA’s regulation of “video tape service providers” may seem outdated in the internet streaming era, Congress defined “video tape service provider” broadly to include any business that rents, sells, or delivers “audiovisual materials.” Courts today have found that this broad definition includes websites and mobile applications with video content, making the VPPA applicable to the modern age of the internet.
VPPA Ad-Targeting Litigation is Not New
The Plaintiffs’ bar previously sought to leverage the VPPA to assert a wave of data privacy class actions based on ad targeting tools. Generally, those earlier lawsuits alleged that web tracking tools monitored activity on websites, including the videos that a user watched, and disclosed that activity to third parties without the user’s consent in violation of the VPPA.
While companies raised numerous defenses to those claims, one defense, in particular, was often successful. Companies argued that the trackers did not disclose “personally identifiable information,” because the technology did not track activity by a user’s name. Rather, the technology tracked activity by an IP address or a device’s serial number. Many (although not all) courts found that these types of device numbers did not constitute PII, because the device numbers alone could not be traced back to a specific individual without using some other external source of information.
What is New with the Pixel Wave of Litigation?
What separates the Pixel wave of lawsuits from the prior waves is that Pixel leverages the users’ Facebook ID to track their activity, as opposed to serial numbers and IP addresses. Many judges addressing Pixel litigation have found that a Facebook ID constitutes PII for purposes of the VPPA, even if the Facebook ID itself is coded because Facebook can tie the ID back to a specific individual. Following this analysis, courts are denying motions to dismiss VPPA lawsuits against companies using Pixel, exposing those companies to further litigation.
Not Limited to Video
A recent industry study found that Pixel records more than just video viewing history. In particular, this analysis found that popular online tax preparation platforms may be inadvertently disclosing their customer’s income and other financial information to Facebook via the Pixel tracking technology.
Takeaways
Given the U.S.’ patchwork of industry-specific privacy laws, as well as state-by-state variations, the widespread use of tracking tools, like Pixel, creates the risk of implicating legal obligations beyond just the VPPA. It is important for companies to review their marketing technologies and know what types of data those technologies are generating.
Octillo’s experienced team of privacy professionals routinely works with companies to evaluate data privacy concerns that may emerge as part of their technology platforms, including ad targeting technology. If you have any questions or concerns regarding the privacy implications of ad targeting tools or similar technology, please contact a member of our team.
*Attorney advertising: prior results do not guarantee future outcomes.
