NBA case on Facebook video privacy revived by appeals court

A case accusing the NBA of violating federal law by sharing a Californian’s video recording history with Meta while he was visiting NBA.com was reopened Tuesday by the U.S. Court of Appeals for the Second Circuit.

Michael Salazar accuses the NBA of violating the Video Privacy Protection Act (VPPA), which President Ronald Reagan signed into law in 1988 after a newspaper exposed U.S. Supreme Court nominee Robert Bork’s video rental history during his (ultimately unsuccessful) confirmation hearings and who succeeded. It is unlawful for a provider of video recording services to knowingly disclose a consumer’s personal information. U.S. District Judge Jennifer L. Rochon dismissed Salazar’s lawsuit last year on the grounds that he was not a consumer under the VPPA.

Judge Beth Robinson, speaking on her own behalf and on behalf of her colleagues Reena Raggi and Eunice Lee, concluded that Salazar had plausibly indicated that he was a consumer because he subscribed to NBA goods and services. The Second Circuit reversed Rochon’s dismissal and remanded the case to Rochon for further proceedings consistent with Robinson’s opinion.

To that end, Robinson emphasized that Salazar traded personal information such as his email address, his IP address (which can record physical location) and cookies associated with Salazar’s device in exchange for receiving an NBA online newsletter. Salazar’s history of watching videos on NBA.com, including while logged into his Facebook account, was also shared with Facebook, allegedly without his permission or notification

Salazar acknowledges that he paid nothing to watch videos or receive the newsletter, but his sharing of personal information in exchange for watching videos and receiving the newsletter was also a valuable form of barter, the Second Circuit argued. Robinson wrote “pieces of code” — including a “Facebook pixel” that is embedded on NBA.com and many websites that tracks how a person browses the Internet — and sent to Meta. In return, Meta uses the data to more specifically target advertising to someone on Facebook. The judge emphasized that “the NBA receives financial compensation from this agreement.”

The NBA insists that Salazar’s case amounts to a legal airball. From the league’s perspective, Salazar is not considered a consumer under the VPPA because he has not rented, purchased, or subscribed to any good or service provided by a video service provider. The newsletters did not contain videos and did not provide Salazar with expanded access to videos on NBA.com.

To that end, the league says that simply watching a free video on a website “with no other relationship to the company” is well outside the intended scope of the VPPA. The law was enacted in response to privacy concerns because a video rental store employee leaked Bork’s rental history to a journalist. It affects renters, buyers and subscribers, not free viewers.

The NBA also argues that Salazar’s interpretation of the law leads to nonsensical results. To illustrate, the league says it would be silly that someone who “previously and unrelatedly” purchased a hammer from a brick-and-mortar chain store would be protected by the VPPA if that person later watched a free video on the chain’s website. The alleged analogy is that Salazar, an NBA fan, simply watched a video on NBA.com. In this sense, the NBA is of the opinion that an online newsletter is not considered an audiovisual good or service within the meaning of the VPPA. Salazar also accepted a privacy policy from NBA.com that specifically states that the site collects personal information from visitors.

Still, Robinson found that these arguments missed the point. She argued that the term “video service provider” should be interpreted broadly. The term applies to companies, even if they primarily operate in the industry not-audiovisual materials (the judge said this would apply to “a general store that rents out a few movies” and not just large rental companies like Blockbuster in its heyday). Robinson also repeatedly emphasized that Salazar had revealed his personal information, adding that the VPPA is “not a dinosaur law” and Congress does not intend for it to “gather dust next to our VHS tapes.”

Robinson also flatly rejected the NBA’s Hammer example – Borked, you might say.

“Take the NBA’s hypothesis: A consumer purchases a hammer and then watches free videos on the seller’s website,” the judge wrote. “The NBA notes that it is unusual for this consumer to be subject to privacy protections under the VPPA. However, given the VPPA’s privacy goals regarding individuals’ video viewing information, this scenario does not seem unusual to us. Particularly given the broad definition of consumer in the VPPA, allow Disclosing the consumer’s video viewing information would be inconsistent with the objectives of the law.”

Salazar intends to qualify his case as a class action on behalf of fellow Americans whose personal viewing information was leaked to Meta through access to NBA.com, but he faces a hurdle on that front. The NBA’s terms of service contain a class action waiver clause that Salazar would have to overcome.

Salazar’s potential damage could prove modest. The VPPA provides for statutory damages of at least $2,500 per violation, plus reasonable attorneys’ fees, litigation costs, and possible punitive damages.

Of course, the parties could press the pause button at any time and come to an agreement.