The U.S. Court of Appeals for the Eleventh Circuit ruled that a Video Privacy Protection Act (VPPA) plaintiff was not a “subscriber” as defined by the statute and therefore could not sue when an app shared his data without his permission.
Ryan Perry downloaded the CNN app in early 2013 to read news stories and watch video clips. The CNN app maintains a record each time a user views a news story, video clip or headline. When a user closes the app, a complete record of the user’s activities and a media access control address is sent to a third-party data analytics company that specializes in tracking the behaviors of individual users via the Internet and mobile applications.
When Perry learned about the data sharing, he filed suit under the VPPA, asserting that CNN contravened the statute by not obtaining his consent to disclose any of his personally identifiable information to third parties by transferring his viewing history and MAC address.
CNN countered with a motion to dismiss, arguing that Perry was not a “subscriber” as defined by the statute, nor was the data passed along “personally identifiable information.” A district court agreed with the defendant, granting the motion.
While the Eleventh Circuit found that Perry had established standing to file suit because his alleged injury was sufficiently concrete, the unanimous panel affirmed dismissal. The court has previously interpreted the term “subscriber” to require “some sort of ‘ongoing commitment or relationship between the user and the entity which owns and operates the app,’” the court said, and the plaintiff failed to meet that standard.
“Perry is not a ‘subscriber’ of CNN because he has not demonstrated an ongoing commitment or relationship with CNN,” the court wrote. Perry did not sign up for or establish an account with CNN, provide any personal information to CNN, make any payments to CNN in using its app, become a registered user of CNN or its app, receive a CNN ID, establish a CNN profile, sign up for any periodic services or transmissions, or make any commitment or establish any relationship that would allow him to have access to exclusive or restricted content.
To strengthen his position, Perry argued that he was also a cable subscriber to CNN’s television network and therefore had a relationship that involved commitment and indirect payments to the defendant. But this relationship “shows a commitment to only his cable television provider, rather than to CNN,” the panel found. Even if Perry were entitled to special features on the app, that fact was due to his separate relationship with the cable television provider.
“Perry’s argument that CNN indirectly receives a monetary benefit by virtue of Perry’s direct payments to his cable television provider similarly misses the mark,” the court added. “Perry’s distinct financial relationship with his cable television provider does not shed light on his commitment to CNN because, for instance, if his cable television provider removed CNN from Perry’s cable package, it would not affect Perry’s ability to use the CNN App for free video content.”
Finally, the panel distinguished a decision from the First Circuit, where the court found a plaintiff to be a subscriber under the VPPA because he provided his mobile device identification number and GPS location to the app. “That fact was sufficient to ‘establish a relationship’ with the proprietor of the app,” the Eleventh Circuit explained. “Perry admitted before the district court that he was never required to register for the CNN App, even stating that the CNN App did not request his email address, his credit card number, or his GPS location.”
“We decide that the ephemeral investment and commitment associated with Perry’s downloading of the CNN App on his mobile device, even with the fact that he has a separate cable television subscription that includes CNN content, is simply not enough to consider him a ‘subscriber,’” the court concluded. “Perry still ‘is free to delete the app without consequences whenever he likes, and never access its content again.’”
The panel did not reach the question of whether the information at issue met the definition of “personally identifiable information” under the statute, finding it sufficient that Perry was not a “subscriber” under the VPPA as a basis for dismissal.
To read the opinion in Perry v. CNN, click here.
Why it matters: Courts continue to struggle with the application of the VPPA—enacted in 1988—to 21st-century technology. While the Eleventh Circuit reiterated its position in the Perry case, the First Circuit has reached a contrary decision, and a California federal court recently determined that Vizio could be liable under the statute for allegedly installing software on smart TVs and collecting viewing data on millions of consumers without their knowledge and consent.