Salazar v. NBA and the Second Circuit's Game-Changing Decision

In October 2024, the U.S. Court of Appeals for the Second Circuit adopted a broad interpretation of the term "consumer" under the Video Privacy Protection Act (VPPA), significantly expanding potential liability under the Act. The decision Salazar v. National Basketball Association is a sharp divergence from earlier federal district court decisions that had dismissed VPPA claims on the grounds that plaintiffs were not "consumers" of video materials or services.

The VPPA

Congress passed the VPPA in 1988 after a Washington, D.C., newspaper reporter obtained the video rental history of Supreme Court nominee Robert Bork from a video rental store and published a profile about Bork based on "the titles of 146 films his family had rented" from the store. Following swift public outcry, legislators passed the VPPA, which permits a "consumer" (a renter, purchaser or subscriber of goods or services from a video tape service provider) to assert a claim against a "video tape service provider" (VTSP) – defined as a person "engaged in the business … of rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials" – for knowingly disclosing the consumer's "personally identifiable information" ("including information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider") to third parties without express consent.

Salazar v. NBA

Background

In Salazar v. National Basketball Association, plaintiff Michael Salazar alleged that he signed up for a free email newsletter from the NBA and later watched videos on the NBA's website. He claimed that by using the Facebook Pixel on its website, the NBA improperly disclosed information about his video viewing habits to Facebook (or Meta) in violation of the VPPA.

In August 2023, the U.S. District Court for the Southern District of New York dismissed the case, finding that Salazar failed to state a claim because he could not qualify as a consumer by subscribing to non-video content. The District Court found that the term "consumer" is cabined by the definition of "video tape service provider," and is focused on the rental, sale or delivery of audiovisual materials. It agreed with past case law from the Southern District to find that the definition of "consumer" applies only to a renter, purchaser or subscriber of audiovisual goods or services, not goods or services writ large. Accordingly, the District Court dismissed Salazar's claim for failure to plausibly allege his subscription to a non-video newsletter qualified him as a "consumer."

The District Court's decision was consistent with the rulings of multiple other district courts around the country, including in New York, which had dismissed VPPA actions where plaintiffs failed to allege they subscribed to video-related content from a VTSP. However, the Second Circuit reversed this decision, ruling that the term "consumer" is not limited to consumers of video content.

The Second Circuit's Decision

The Second Circuit's decision provided an expansive interpretation of the term "consumer" under the VPPA, explicitly rejecting the argument that the phrase "goods and services" must be limited to audiovisual goods and services. The Court wrote that "consumer" should be understood to encompass a renter, purchaser or subscriber of any of the provider's "goods or services" – audiovisual or not.

In supporting its argument, the Second Circuit first touched upon the background and legislative history of the VPPA, citing language from various legislators regarding the VPPA's reflection of the "central principle" that information collected for one purpose may not be used for a different purpose without the individual's consent.

The Court further justified its expansive interpretation of "consumer" with the statute's use of inclusive terms like "any" and "or." It contrasted this with the definition of VTSP to highlight that, unlike the definition for consumer, the VTSP definition specifically requires dealing in "audio visual materials." This difference, the Court reasoned, indicates that Congress intentionally included a video-related limitation in the VPPA where applicable.

Additionally, although not at issue in this appeal, the Court, in dicta, provided its view on the scope of the term "video tape service provider," noting that a business doesn't need to primarily deal with video goods and services to be considered a VTSP. This dicta is generally inconsistent with the readings of other district courts that have dismissed VPPA claims on the basis that the defendant was not sufficiently "engaged in the business" of video rentals to qualify as a VTSP.

Implications and Key Takeaways

The Second Circuit's broad interpretation of protected "consumers" exposes a wide range of businesses to VPPA liability and has significant implications for businesses with websites that provide online accounts or newsletters and feature any kind of video. For example, a retail company that offers free email newsletters and provides online promotional videos about its products might find itself in the crosshairs of VPPA litigation, should it use any of the commonplace website tracking tools that are standard practice among website operators. Plaintiffs bring these VPPA class actions on behalf of thousands or millions of putative class members and seek statutory damages of $2,500 per violation. The threat of costly litigation, driven by steep statutory damages, serves as a pressing reminder for businesses to prioritize data privacy practices or else risk not complying with the VPPA's protections.

This is the first federal appellate court decision to define the scope of a VPPA "consumer." However, there are active appeals pending in other circuit courts on similar or nearly identical issues regarding whether a plaintiff is a VPPA "consumer," including in the Six, Seventh, Ninth and D.C. Circuit Courts of Appeals.

It remains to be seen whether other circuits will agree with the Second Circuit or if a circuit split will be created on this issue.

In the meantime, businesses should take multiple steps to mitigate risk:

1. Data Privacy Practices: Robust consent mechanisms and transparent privacy disclosures are key to ensuring compliance with the VPPA. Adequate consent mechanisms involve clear, explicit and informed consent from users before collecting or sharing their data, ensuring users understand what data is collected and how it will be used. Website privacy policies should include appropriate disclosures about the use of cookies, pixels and other tracking tools.
2. Compliance and Legal Risks: Ongoing discussion around management of data practices is now more important than ever. Each organization's legal and marketing teams should have an understanding of which web tracking technologies are being used on their website, what information is collected and with which third parties the information is being shared.

The Salazar v. NBA decision represents a significant shift in the interpretation of the VPPA, with wide-ranging implications for businesses with online platforms. As the legal landscape continues to evolve, stakeholders must stay informed and prepared to adapt to new legal precedents. This decision underscores the importance of vigilance in data privacy practices, as well as the need for businesses to reassess their compliance strategies in light of the Second Circuit's expansive definition of "consumer" under the VPPA.