On July 15, 2024, a class of plaintiffs filed a lawsuit against Walmart claiming that the company violated the Video Privacy Protection Act (VPPA) by sharing customer personal data and the titles of videos that they purchased with Meta. Interestingly, Walmart is not the first company to be sued under the VPPA, a privacy law passed in 1988 that was meant to prevent the disclosure of video tape rental records. Since the VPPA allows damages of up to $2,500 per consumer, this lawsuit provides important lessons learned to businesses everywhere. In this article, we will discuss the important points of the VPPA and this lawsuit, including:
- The claims made against Walmart;
- Who the VPPA applies to and why it was passed;
- How the VPPA has been adapted to modern technology;
- Other VPPA lawsuits; and
- How to protect your business from similar lawsuits.
Class action lawsuit against Walmart
In this lawsuit, the plaintiffs claim that Walmart’s website has a Meta Pixel code. The plaintiffs allege that the Meta Pixel code tracked what videos the plaintiffs purchased on the Walmart website and that the Meta Pixel obtained this purchase history as well as the plaintiff’s personal data such as the plaintiff’s Facebook ID, which directly links to an individual’s Facebook profile. The plaintiffs allege that they never consented nor agreed to Walmart sharing the video purchase history with Meta. The plaintiffs allege that the sharing of video purchase histories by Walmart with Meta violates the Video Privacy Protection Act.
The Video Privacy Protection Act
The VPPA was originally passed in 1988 to protect individuals from the sharing of video tape rental records with third parties. This federal privacy law was spurred when a Supreme Court nominee, Judge Robert Bork, had the list of the video tapes that he rented published in a newspaper. A reporter obtained this list through a store clerk and the list contained 146 video tapes. While the list of video tapes was not as damning as the reporter hoped (it showed that the Judge was a fan of spy thrillers and Alfred Hitchcock films), this leak drew bipartisan support for the protection of intellectual privacy, which led to the passage of the VPPA.
The VPPA applies to anyone that has records of video viewership and prohibits the sharing of such records with third parties. The VPPA states that it applies regardless of the medium over which the content is delivered, meaning that it can apply not just to the renting or purchasing of videos in a store, but also to the viewing, renting and purchasing of videos online. For example, if a website has a meta Pixel that fires whenever someone watches a video so that ads can be shown to an individual, that may be a violation of the VPPA as well, as a record of whether a video was watched is shared with a third party, Meta.
Other VPPA lawsuits
Due to the fact that the VPPA allows consumers to sue businesses directly for violations, there have been more than 170 court decisions citing the VPPA. For example, Blockbuster Video was sued in 2008 for sharing video rental records with Facebook. The lawsuit was settled for $50,000 and Blockbuster video was prohibited from using the Facebook Beacon (the predecessor to the Facebook Pixel). In another lawsuit, plaintiffs alleged that TikTok disclosed video viewership to third parties without permission, in violation of the VPPA. This lawsuit was settled for $92 million. In addition, Chick-fil-A lawsuit settled a lawsuit for sharing the video watching habits of website visitors with Meta through the Meta Pixel.
How to protect your business from similar lawsuits
Since the VPPA prohibits the sharing of video viewership records with third parties, and the number of lawsuits for such practices are only increasing, there are several ways to protect your business from a similar fate:
- Avoid implementing Meta Pixeles or any similar tools on videos. The lawsuits stem from the sharing of video viewership records. If those records are not shared, then the likelihood of your business getting sued under the VPPA are very slim;
- Obtain the consent of the individual prior to tracking them with similar tools. The VPPA was amended in 2013 to state that if an individual provides their consent to the sharing of their video viewership records, then there is no VPPA violation. If you would like to continue tracking individuals and their video views and sharing that data with a third party such as Meta, make sure that you obtain the consent of the individual prior to doing so. This can be achieved through a cookie consent banner that blocks the cookie from firing until the user has provided their consent.
