Mind Your Analytics: VPPA Liability for 3rd Party Website Analytics Tools

Recently, a class action was filed in Los Angeles against The Container Store for alleged violation of the Video Privacy Protection Act with damages alleged at $2,500 per class member. The basis of the claims stems from the container retailer’s use of TikTok’s Pixel code to report visitors’ personally identifiable information to TikTok’s parent company, ByteDance, Ltd., which is partly owned by the Chinese government. The submission of user data is triggered when a video is played on the website, and the Complaint alleges that the video in this case is configured to play automatically.

The lawsuit is just one of at least 70 VPPA cases filed in the past year against companies whose websites have video with third-party analytics tools, and many more are expected. While website owners can control what data the TikTok Pixel collects and reports back, website owners are commercially motivated to allow those tools to collect more information. For example, in The Container Store lawsuit, it alleges that the retailer reports page views and titles watch to TikTok’s Pixel because that data creates “events” which allow The Container Store to build marketing audiences, measure campaign performance, and thereby improve advertisement delivery. The problem is that if the videos are configured to play automatically, the Complaint contends that every single visitor’s personally identifiable information is reported, even though they did not knowingly give their consent.

The VPPA is not new; it was passed in Congress in 1998 after the video rental history of Supreme Court nominee Robert Bork was leaked to the press without his consent. The act prohibits the disclosure of video rental records containing personally identifiable information, and allows the $2,500 in actual damages sought in The Container Store lawsuit, plus punitive damages. But with the proliferation of social media and data scouring tools and their embedded use across the Internet, the VPPA has found new life in a post-Blockbuster world.

So far, retailers have had mixed results in trying to get rid of claims in this novel use of the statute when the related technology was non-existent when the VPPA was enacted. Companies using third-party analytics tools need to be mindful of the potential consequences when leveraging visitor data and clearly disclose in their terms of use opt-ins for having such data shared. While it is no guarantee to avoid a lawsuit, such clear disclosures can serve as affirmative defenses if claims are brought.