WTF is the Video Privacy Protection Act?

“So much of what we do from an advertising perspective is underpinning by helping [to] target, helping [to] understand. And now here’s this old law that was literally the Blockbuster law, and yet it’s being applied to a very different digital space,” said one streaming executive.

WTF is the Video Privacy Protection Act?

The VPPA is a law passed by the U.S. Congress in 1988 that places restrictions on video providers’ abilities to disclose what the titles of the videos, such as a movie or TV show, that a person requested or obtained from the provider in combination with the person’s name. For example, a store selling physical copies of movies or theoretically a streaming service is barred from sharing that J. Doe bought, rented or streamed “The Dark Knight” or “The Office” without J. Doe’s written consent.

If the law was passed before streaming services were even around, how can it apply to streaming services?

The law applies to “video tape service providers,” which it defines as anyone who rents, sells or delivers “prerecorded video cassette tapes or similar audio visual materials.” The “similar audio visual materials” language is what opens up its application to streaming services since they deliver “audio visual materials” via the internet.

Cases in point: HBO Max and Hulu have faced lawsuits alleging the streamers violated the VPPA. In both cases, the streamers were sued for sharing people’s viewing data with Facebook. Hulu was able to beat its lawsuit because the judge ruled that Hulu did not connect a person’s identity to their viewing data when sharing both pieces of information with Facebook. The lawsuit against HBO Max was filed in March and is ongoing.

Would it apply to all types of streaming services?

The VPPA seems to pretty clearly apply to subscription-based streamers as well as those who rent or sell movies and TV shows. It’s less clear whether it applies to free streaming services.

“There’s some question on the free space,” said Sarah Bruno, partner at law firm Reed Smith. She added, “I haven’t seen that played out, which is if it’s a free service does the VPPA not apply?”

OK. And how does the VPPA apply to advertising?

This is where the matter gets even greyer. The VPPA provides an exception for a video provider to share “the subject matter” of the videos that a person obtained “if the disclosure is for the exclusive use of marketing goods and services directly to the consumer,” per the law’s text. In this case, the video provider would not need a person’s consent ahead of time and would instead simply need to provide a way for someone to opt out of the information being shared for this purpose.

Yeah, “subject matter” sounds a little vague. What’s that mean?

Oh, “subject matter” just means descriptors like genres and content categories. So a video provider like Netflix couldn’t say someone streamed “Stranger Things,” but it could say someone streamed a TV drama in the science-fiction category. 

But “subject matter” isn’t the only vagary. “The exclusive use of marketing goods and services directly to the consumer” also leaves some room for interpretation of this exception. Does the use of “directly” refer to the video provider being the one doing the marketing or to the marketing being done strictly on the video provider’s platform? Or does it allow for third-party advertisers to use this data to advertise to someone outside of the video provider?

“When this was drafted, it was contemplated that it would be the company who is streaming that’s marketing to the consumer different products possibly through the use of a third-party possibly,” Bruno said. “But now we’ve got this downstream use of data through the ad tech ecosphere that I think wasn’t contemplated at the time. So it’ll be interesting to see how limited that exception is.”

So the problem is if a video provider says, “Hey advertisers, I’ve got someone who watched ‘Stranger Things;’ who wants to advertise to them?”

Yes, and then some. The issue isn’t a video provider saying they’ve got someone who watched “Stranger Things” but saying that J. Doe watched “Stranger Things” since the VPPA is only triggered if a person’s name and address are shared at the same time as the video title. 

Why’s that a problem?

Because advertisers want to be able to target ads to people watching specific shows or movies and to know which specific shows or movies people were watching when they saw a brand’s ad. “This has been my frustration with Hulu because we’ve been asking Hulu to let us target against specific shows for years, but they only give us content categories,” said an agency executive.

Why do advertisers want to know if a specific person watched a given show or movie? It seems like if a streaming service were to block people’s names or addresses from being shared, this wouldn’t be an issue.

Viewing habits are another data point that can be added to the profile of a given person or household. In the same way that the ad industry likes to compile audience graphs that group people based on their age, location and household income, whether they watch “Yellowstone” is another piece of information that can flesh out advertisers’ understanding of them and their interests.

However, compiling these audience graphs requires associating this information with an identifier, such as a person’s name. This is what would trigger the VPPA’s application.

But I thought the ad industry uses other identifiers, like email addresses and IP addresses. Isn’t the VPPA only triggered if a person’s name or address — oh.

You see it now?

The VPPA was passed when an address just meant someone’s physical address, but today people also have email addresses and IP addresses, and these could be considered addresses under VPPA in the same way that streaming services are considered video providers under VPPA.

Yup. To be clear, it’s not clear whether the VPPA considers email addresses and IP addresses to be addressed under the law. However, privacy laws like the California Consumer Privacy Act do consider email addresses and IP addresses to be personally identifiable information. 

Furthermore, the VPPA somewhat open-ended definition of PII “includes information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider,” per the text of the law. That language appears to leave open the door to an email address or IP address being the means of identifying that person and tying them to their video records, and this opening is what would have the streaming ad industry on edge given the rise in privacy regulation and legislation.

“There’s a question as to whether that trigger would mean that the disclosure of any of these identifiers falls within the definition of personal information of the VPPA, which would be somewhat of a shift from those older cases that were more limited to traditional personal information [such as a person’s] name, for example,” Bruno said. “That’s why I think we’re going to see some new lawsuits until that’s been determined definitively.”