On Monday October 20, the Eastern District of Missouri dismissed a proposed class action based on the federal Video Privacy Protection Act (“VPPA”) against CoStar, the company behind Apartments.com. This decision further cements the Circuit courts’ split in determining which entities are subject to the VPPA, with the Eighth Circuit (where Missouri is located) taking a narrow view, and the Ninth Circuit, including California’s federal courts, favoring a much broader interpretation. We break down the Missouri court’s reasoning below.
Alleged Unauthorized Use of Tracking Technologies
CoStar did not dispute that it uses several pixels on Apartments.com, including the Meta Pixel. The plaintiff alleged that “when he watched videos on Apartments.com, CoStar disclosed his information, including which videos he watched on Apartments.com, to third parties, though he specifically names only Facebook and TikTok,” thereby “disclosing [his] personal identifying information... to third parties” without his consent, in violation of the VPPA.
VPPA Claim’s Three Required Elements Not Satisfied
The Missouri court stated that a successful VPPA claim for failure to obtain consent requires (1) the defendant to be a “video tape service provider”, (2) the plaintiff to be a “consumer,” and (3) the defendant to have disclosed “personally identifiable information" to third parties. The court found that the plaintiff did not sufficiently argue that any of the three elements were satisfied, and dismissed, with prejudice, for failure to state a claim under VPPA.
Costar is Not a Video Tape Service Provider
The court found CoStar is not a “video tape service provider” because its business does not involve “prerecorded video cassette tapes or similar audio-visual materials,” or even if it did, it is not “in the business... of... deliver[ing]” them (emphasis added).
Not similar: Not convinced that the video tours at issue in this case and prerecorded cassette tapes had any similarity beyond them both being “audio visual materials,” the court emphasized that “[t]he [VPPA’s] statutory context... includes the consistent mention of the noun phrase “video tape,” demonstrating “that ‘audio visual materials’ must be stored in a physical format to be ‘similar’ to ‘prerecorded video cassette tapes.’” In reaching this conclusion, the court looked at the “plain meaning [of words in the definition of video tape service provider] at the time of the VPPA’s enactment,” noting the 1981 dictionary definition of “similar” was “having characteristics in common; very much alike; comparable.”
Not in the business: Even if it accepted CoStar’s video tours as “similar” to prerecorded cassette tapes, the court found “[t]he prerecorded videos that CoStar delivers are in service of its business, but that does not render CoStar ‘in the business’ of delivering them.... prerecorded video tours are not, as [the plaintiff] claims, CoStar’s ‘primary method’ of connecting property owners and potential rentals.” Instead, “prerecorded video tours are a fraction of a fraction of how CoStar conducts its business... [CoStar is in fact in the business of] connect[ing] house-seekers with property owners and managers.”
To find CoStar to be “in the business” as required by VPPA, the court wanted to see that CoStar’s “conveyance of video content of [any type] is significantly tailored to its business purpose... even if the business purpose is completely unrelated to the rental, sale, or delivery of prerecorded cassette tapes or similar audio-visual materials” subject to VPPA (internal quotes omitted). [HL1]
The court took great issue with the plaintiff’s reliance on recent case law from courts in other federal Circuits, primarily Mata v. Zillow Grp, which takes a broad view of VPPA to include websites with “non-video aspects to their business model.” Sharpening the Circuit split on the question of which companies count as a “video tape service provider,” the Eastern District of Missouri categorized Mata as “misinterpret[ing] the language of” VPPA, partially because its analysis fully omitted the statutory language of “similar” and relies on an interpretation of the statute that “strays from the plain language of the VPPA.”
The Plaintiff is Not a Consumer
The court found the plaintiff is not a “consumer” because, even though he is viewing video tours on a logged-in Apartments.com account, he does not have “a subscription to [the defendant’s] video services.” This analysis emphasized the VPPA’s protections against disclosure of “rental” and “sale” information to imply a more tangible commercial relationship than simple interaction.
CoStar did Not Disclose Personally Identifiable Information via Pixels
Finally, the court found CoStar did not disclose “personally identifiable information” to third parties because the plaintiff failed to allege “anything about” how CoStar’s use of the Meta Pixel could identify him. The court also noted that in any case, “personally identifiable information” is “definitionally constrained to ‘specific video materials or services... from a video tape service provider,’ which... [the court found] CoStar is not.”
VPPA Compliance Moving Forward
VPPA continues to be an appetizing source of litigation for plaintiffs’ attorneys and consumers alike, though the success of these efforts now seems relatively less likely—at least in front of a court in the Eight Circuit. All companies with an online presence should continue to check in on VPPA’s constantly-evolving case law. In the meantime, below are some additional measures your company can take to mitigate risk under VPPA, particularly if you have large customer bases in the western U.S. (which comprises the Ninth Circuit).
If you are a traditional video tape service provider or offer related products/services, look at how personally identifying information subject to VPPA is leaving your company and make sure each disclosure is covered by an appropriate consent.
For other companies, consider taking an inventory of the audiovisual materials your business offers on its websites. Ensure you’re gathering informed consents required by other laws to collect personal data on those pages and potentially disclose that personal data to third parties, including via tracking technologies such as cookies and pixels.
Cameron Cantrell is an Associate at Hintze Law PLLC, counseling companies on global data protection issues, including health (consumer, biotech, genetics), business (CCPA, GDPR), and areas of ongoing federal regulation (HIPAA, GLBA, the DOJ Cross-Border Data Transfers Rule, human subject research).
Hintze Law PLLC is a Chambers-ranked and Legal 500-recognized, boutique law firm that provides counseling exclusively on global privacy, data security, and AI law. Its attorneys and data consultants support technology, ecommerce, advertising, media, retail, healthcare, and mobile companies, organizations, and industry associations in all aspects of privacy, data security, and AI law.