The First Circuit Court of Appeals’ recent decision in Yershov v. Gannett Satellite Information Network, Inc. may carry important implications for mobile app providers seeking to navigate federal privacy laws—in particular, the Video Privacy Protection Act of 1988 (“VPPA”). Although Yershov is not the first case to consider how the VPPA applies to mobile apps, the opinion contains two key holdings regarding (1) the scope of protectable personally identifiable information and (2) the treatment of free app downloaders under the statute.
The VPPA
The VPPA was passed in 1988, after the video rental history of then-Supreme Court nominee Judge Robert Bork was disclosed in a newspaper article during debate over his nomination. Quoting the VPPA, the Yershov opinion explains that the statute is intended to preserve personal privacy in connection with the rental, purchase or delivery of video and audio materials and creates a “civil remedy against a ‘videotape service provider’ for ‘knowingly disclos[ing], to any person, [personally identifiable information] concerning any consumer of such provider.’” Of relevance in Yershov, the statute defines “consumer” as “any renter, purchaser, or subscriber of goods or services from a videotape service provider.” The VPPA defines personally identifiable information to “include[] information which identifies a person as having requested or obtained specific video materials or services from a videotape service provider.”
Case Background
According to the allegations in Yershov’s operative complaint, which were taken as true for purposes of the First Circuit’s opinion, Yershov downloaded the free USA Today mobile app (“the app”) on his Android mobile device in late 2013. The app is offered by Gannett via the Google Play Store and allows the user to access various USA Today media and content, including videos, on the user’s mobile device.
Yershov claims that he watched numerous video clips on the app. Each time, Yershov’s operative complaint states, Gannett and its third-party marketing and analytics vendor collected three pieces of data: (1) the title of the video Yershov viewed; (2) the GPS coordinates of the device Yershov used; and (3) Yershov’s unique Android ID. According to Yershov, the vendor used this information to create “digital dossiers” for Yershov and similarly situated users, which Gannett in turn used to provide targeted advertising. Yershov says he never consented to the collection of this data. He filed a putative class action lawsuit as a result, claiming that Gannett’s actions violated the VPPA.
Gannett successfully moved to dismiss Yershov’s VPPA claim. The district court held that the information Gannett collected and disclosed to its vendor constituted personally identifiable information, but nevertheless concluded that Yershov was not a “consumer” with a right of action under the VPPA because he failed to allege that he was a renter, purchaser or subscriber of Gannett’s video content. Yershov appealed.
First Circuit Revives Yershov’s Claim
The First Circuit reversed the district court’s dismissal order and remanded for further proceedings.
First, the panel agreed with the district court that the information conveyed to the vendor by Gannett constituted personally identifiable information under the VPPA. According to the panel, the VPPA’s “abstract formulation” of personally identifiable information does not require the information at issue to “explicitly name[] a person” to come within the ambit of the statute. Rather, it is sufficient if the information “effectively reveal[s] the name,” or identity “of the video viewer” without too much uncertainty or “yet-to-be-done, or unforeseeable detective work.”
Because Yershov alleged that Gannett’s vendor could connect the GPS coordinates and Android ID with a given person’s “name, address, phone number, and more,” the panel concluded that he sufficiently alleged a “firm and readily foreseeable” link between the data collected and the user’s identity.
Second, the panel addressed the “closer question” of whether Yershov is a “subscriber” and, therefore, a consumer under the VPPA. Lacking a clear statutory definition, the panel evaluated various dictionary definitions of “subscribe,” which “include as an element a payment of some type and/or presume more than a one-shot transaction.”
The panel expressly rejected the notion that the term “subscriber” incorporated a monetary payment requirement. Requiring monetary payment as an element, the panel reasoned, would render “subscriber” superfluous since the statute also lists “purchaser” and “renter” under its definition of “consumer” and those terms necessarily imply the payment of some monetary amount. According to the panel, “Congress would have had no need to include a third category of persons [i.e., subscribers] protected under the Act if it had intended that only persons who pay money for videos be protected.”
The panel also found it significant that, in 2012, Congress considered the impact of the VPPA on video content in the age of the Internet and left the definition of “consumer” untouched—an indication, according to the panel, that “Congress understood its originally-provided definition to provide at least as much protection in the digital age as it provided in 1988.”
In the end, the panel concluded that qualifying as a “subscriber” requires some kind of relationship between the individual and the video provider that gives the individual some form of special access to the video content. As the panel stated:
[B]y installing the App on his phone, thereby establishing seamless access to an electronic version of USA Today, Yershov established a relationship with Gannett that is materially different from what would have been the case had USA Today simply remained one of millions of sites on the web that Yershov might have accessed through a web browser.
Looking Ahead
The Yershov decision is not without its critics. Its holdings conflict with the opinions of other courts that have considered similar issues.
For example, federal district courts including the Northern District of California and the District of New Jersey have concluded that a unique, numerical device identifier is not personally identifiable information under the statute. Yershov does not address these contrary decisions.
Further, in the 2015 case Ellis v. Cartoon Network, Inc., the Eleventh Circuit adopted a narrower reading of “subscriber,” requiring more of a “commitment” than that which arises from downloading a free app. Yershov distinguished the process associated with downloading and installing the apps in the Ellis case, but the Yershov and Ellis courts’ diverging conclusions could indicate a more fundamental disagreement aboutwhat it means to download and use free software.
Yershov shows the continuing split among courts interpreting the scope of the VPPA. As a result, B2C website operators and mobile app developers that deal with video and audio materials will want to continue to monitor VPPA case law developments, and to seek to identify and address associated legal risks.
* * *
For other Socially Aware blog posts on the Video Privacy Protection Act, please see Court Nixes VPPA Claim and If You Host Videos on Your Website, Read This Blog Post Regarding the Video Privacy Protection Act.