Ninth Circuit Ruling Limits VPPA’s Scope by Narrowly Defining “Personally Identifiable Information”

The Ninth Circuit recently affirmed a lower court’s decision that “personally identifiable information” does not include a streaming device’s serial number for purposes of the Video Privacy Protection Act (VPPA). A consumer who downloaded and watched videos from the WatchESPN channel on his Roku device filed a lawsuit against ESPN alleging ESPN disclosed his Roku’s serial number and video titles to Adobe Analytics in violation of VPPA.

The Ninth Circuit first considered whether the plaintiff had Article III standing under Spokeo to bring his case. Because the court determined that every disclosure of personally identifiable information “offends the interests” that VPPA protects, the plaintiff was able to establish standing. However, in determining whether the data included information that could be used to identify an individual, the Ninth Circuit followed the Third Circuit’s “ordinary person” test. This test focuses on “what information a video service provider discloses, not what the recipient of that information decides to do with it.” The court ultimately determined that an ordinary person would not be able to identify a specific individual’s video-watching behavior from the Roku device serial number. Thus, the data did not constitute “personally identifiable information.”

TIP: Although the Ninth Circuit affirmed the dismissal of this VPPA case, its ruling on standing suggests that plaintiffs may continue to bring these suits against video service providers.