The First Circuit Court of Appeals’ recent decision in Yershov v. Gannett Satellite Information Network, Inc., — F.3d —-, Case No. 15-1719, 2016 WL 1719825 (1st Cir. Apr. 29, 2016), may carry important implications for mobile app providers seeking to navigate federal privacy laws—in particular, the Video Privacy Protection Act of 1988 (VPPA). Although Yershov is not the first case to consider how the VPPA applies to mobile apps, the opinion contains two key holdings regarding (i) the scope of protectable personally identifiable information (PII) and (ii) the treatment of free app downloaders under the statute.
The VPPA. The VPPA was passed in 1988, after the video rental history of then-Supreme Court nominee Judge Robert Bork was disclosed in a newspaper article during debate over his nomination. The VPPA is intended to preserve personal privacy in connection with the rental, purchase, or delivery of video and audio materials and creates a “civil remedy against a
‘videotape service provider’ for ‘knowingly disclos[ing], to any person, [PII] concerning any consumer of such provider.’” Yershov, 2016 WL 1719825, at *2 (quoting 18 U.S.C. § 2710(b)(1), alterations in opinion). Of relevance in Yershov, the statute defines “consumer” as “any renter, purchaser, or subscriber of goods or services from a videotape service provider.” 18 U.S.C. § 2710(a)(1). The VPPA defines PII to “include[] information which identifies a person as having requested or obtained specific video materials or services from a videotape service provider.” Id. § 2710(a)(3).
Case Background.[1] In late 2013, Yershov downloaded the free USA Today Mobile App (the “App”) on his Android mobile device. The App is offered by Gannett via the Google Play Store and allows the user to access various USA Today media and content, including videos, on the user’s mobile device. Yershov claims that he watched numerous video clips on the App. Each time, he says Gannett and its third-party marketing and analytics vendor collected three pieces of data: (i) the title of the video Yershov viewed; (ii) the GPS coordinates of the device Yershov used; and (iii) Yershov’s unique Android ID. According to Yershov, the vendor used this information to create “digital dossiers” for Yershov and similarly situated users, which Gannett in turn used to provide targeted advertising. Yershov says he never consented to the collection of this data. He filed a putative class action lawsuit as a result, claiming that Gannett’s actions violated the VPPA.
Gannett successfully moved to dismiss Yershov’s VPPA claim. Although the district court held that the information Gannett collected and disclosed to its vendor constituted PII, it concluded that Yershov failed to allege that he was a renter, purchaser, or subscriber of Gannett’s video content and, therefore, he was not a “consumer” with a right of action under the VPPA. Yershov appealed.
First Circuit Revives Yershov’s Claim. The First Circuit reversed the district court’s dismissal order and remanded for further proceedings. First, the panel agreed with the district court that the information conveyed to the vendor by Gannett constituted PII under the VPPA. According to the panel, the VPPA’s “abstract formulation” of PII does not require the information at issue to “explicitly name[] a person” to come within the ambit of the statute. Yershov, 2016 WL 1719825, at *2. Rather, it is sufficient if the information “effectively reveal[s] the name,” or identity, “of the video viewer” without too much uncertainty or “yet-to-be-done, or unforeseeable detective work.” Id. at *3. Because Yershov alleged that Gannett’s vendor could connect the GPS coordinates and Android ID with a given person’s “name, address, phone number, and more,” the panel concluded that he sufficiently alleged a “firm and readily foreseeable” linkage between the data collected and the user’s identity. Id.
Second, the panel addressed the “closer question” of whether Yershov is a “subscriber” and, therefore, a consumer under the VPPA.[2] Lacking a clear statutory definition, the panel evaluated various dictionary definitions of “subscribe,” which “include as an element a payment of some type and/or presume more than a one-shot transaction.” Id. at *4. The panel expressly rejected the notion that the term “subscriber” incorporated a monetary payment requirement. Requiring monetary payment as an element, the panel reasoned, would render “subscriber” superfluous vis-à-vis the terms “purchaser” and “renter,” both of which necessarily require monetary payment. According to the panel, “Congress would have had no need to include a third category of persons [i.e., subscribers] protected under the Act if it had intended that only persons who pay money for videos be protected.” Id. The panel also found it significant that, in 2012, Congress considered the impact of the VPPA on video content in the age of the Internet and left the definition of “consumer” untouched—an indication, according to the panel, that “Congress understood its originally-provided definition to provide at least as much protection in the digital age as it provided in 1988.” Id.
In the end, the panel concluded that qualifying as a “subscriber” requires some kind of relationship between the individual and the video provider that gives the individual some form of special access to the video content. As the panel stated:
- [B]y installing the App on his phone, thereby establishing seamless access to an electronic version of USA Today, Yershov established a relationship with Gannett that is materially different from what would have been the case had USA Today simply remained one of millions of sites on the web that Yershov might have accessed through a web browser.
Id. at *5.
Looking Ahead.Yershov is not without its critics and, indeed, its holdings conflict with those of other courts that have considered similar issues. For example, multiple courts have concluded that a unique, numerical device identifier is not PII under the statute. See, e.g., In re Hulu Privacy Litig., Case No. C 11-03764 LB, 2014 WL 1724344, at *6-7 (N.D. Cal. Apr. 28, 2014); In re Nickelodeon Consumer Privacy Litig., Case Nos. 12-07829, 13-03755, 13-03729, 13-03757, 13-03731, 13-03756, 2015 WL 248334, at *3 (D.N.J. Jan. 20, 2015). Yershov does not address these contrary decisions.
Other courts have also adopted a narrower reading of “subscriber,” requiring more of a “commitment” than that which arises from downloading a free app. See Ellis v. Cartoon Network, Inc., 803 F.3d 1251, 1256-58 (11th Cir. 2015). Yershov distinguished Ellis on its facts—in particular, the alleged process associated with downloading and installing the apps involved in each case—but the diverging conclusions could indicate a more fundamental disagreement regarding what it means to download and use free software.
Yershov shows the continuing split among courts interpreting the scope of the VPPA.
[1] This background comes from Yershov’s allegations in the operative complaint, which were taken as true for purposes of the Court’s opinion.
[2] Yershov did not claim to be a renter or purchaser for purposes of the statute.