A Blockbuster-era video law is being used to ding big-name brands like General Mills, Geico, and Chick-Fil-A with privacy lawsuits

• Brands like Chick-Fil-A and Geico are being accused of violating 1980s privacy law the VPPA.
• Companies that use online tracking codes like Meta Pixel or Google Analytics are potentially at risk.
• It can cost companies millions of dollars to resolve these cases.

Broadcasters have long been wary of violating the Video Privacy Protection Act, which went into effect in 1988 after the video rental history of then-Supreme Court nominee Judge Robert Bork was leaked to a newspaper. A “customer” may sue a “video tape service provider” if they have knowingly disclosed personal information that links them to requested or obtained video materials.

VPPA has recently been used against a new group of businesses: advertisers who post marketing videos on their websites. Since November of last year, companies as diverse as Hallmark, Folgers, Mattel, Chick-Fil-A, General Mills, Mars, La-Z-Boy, Geico, and Fossil have faced VPPA lawsuits.

According to the new lawsuits, those websites use tracking technologies such as Meta’s Pixel or Google Analytics to knowingly pass personal information about their video viewers to third parties.

General Mills did not respond to requests for comment. A request for comment from the other companies was not returned.

Scott Ferrell, the founder of Pacific Trial Attorneys, which represents the plaintiffs in many of those cases, declined to comment.

A previous lawsuit against Hulu found the online streamer to be a “video tape service provider,” but recent cases against non-broadcasters are expanding that definition to include brands that host marketing videos on their websites.

For website owners, the stakes are potentially high. In a successful VPPA case, plaintiffs can recover $2,500 in damages, which can add up to several thousands or even millions in a large class action suit.

Even settlements are expensive. According to the trade publication Law360, the streaming sports broadcaster FloSports agreed to pay $2.6 million in July to settle a class action lawsuit alleging VPPA violations.

Some of the early tests to determine whether non-broadcasters are vulnerable to VPPA violations have already been dismissed by courts for a variety of reasons. According to court documents, a VPPA lawsuit filed against Folger’s parent company, J.M. Smucker, was dismissed in June because the California-based District Court lacked the authority to render a judgment affecting Virginia-based plaintiff Keith Carroll. The addition of a California-based plaintiff named Rebeka Rodriguez to the complaint did not sway the court.

A lawsuit against General Mills was dismissed in early September after the court ruled that the food manufacturer is not a “video tape service provider,” according to court documents.

“We have noticed that the rate of new complaints has slowed, and we expect that trend to continue as more adverse decisions are issued,” a law firm source familiar with VPPA cases said.

However, these dismissals do not completely eliminate the threat of VPPA lawsuits. “Some defendants have escaped on motions to dismiss, but many courts have allowed the claims to proceed, signaling to the plaintiffs’ bar that there may be gold in these hills, spurring more litigation,” Eversheds Sutherland counsel Melissa Fox said.

According to Bloomberg Law, at least 70 VPPA class action lawsuits have been filed in the last year.

In an ironic twist, law firms and consumer groups seeking to file VPPA lawsuits have used Meta’s own ad platforms to encourage users to join class actions. Insider discovered ads from Classaction.org, Consumers Protection Law, and the law firm Labaton Sucharow LLP encouraging Facebook and Instagram users to join class actions against AMC, Us Magazine, Coursera, Corepower Yoga, GameStop, and Disney+ using the Meta Ads Library.

With seemingly any company at risk of being hit with a similar suit, there are some safeguards that brands can take. Companies can remove tracking technologies from their pages, reconfigure those technologies to obfuscate information about the video or the individual user, or obtain VPPA-compliant consent for the use of trackers, according to experts.

IRIS.TV, for example, has a solution that anonymizes content so that specific shows cannot be linked to specific viewers. Field Garthwaite, the company’s CEO, is collaborating with law firms to see if it can protect businesses from the consequences of VPPA lawsuits.

“It’s being investigated as a legal means of protecting against damages,” Garthwaite explained. “It won’t stop people from suing, but it will limit the damages.”

According to Fox, the best way to mitigate risk under the VPPA is to obtain user consent before disclosing any information — including through pixels, analytics tools, and other technology — about pre-recorded videos that the user watched.

To be sure, suing under the VPPA isn’t the only way for plaintiffs to seek privacy protection.

“The VPPA is just another tool in the class action toolbox to attack web tracking from every possible angle,” said Julie Rubash, chief privacy counsel at Sourcepoint, a privacy technology platform. “I believe this trend will continue and likely accelerate.”