Overview of the Case

On August 23, 2024, a proposed class action lawsuit was filed by Kamilah Jolly, against FurtherEd, Inc., doing business as Lawline, which centers on allegations that Lawline violated the Video Privacy Protection Act (VPPA). The complaint, filed in the United States District Court for the Southern District of New York, accuses Lawline of unlawfully disclosing its users' personal viewing information to third parties, including Facebook, without obtaining proper consent. The case is 1:24-cv-6401. 

Nature of the Complaint

The VPPA (18 U.S. Code § 2710), which was originally enacted after the senate confirmation hearings of Supreme Court candidate Robert Bork, was passed in 1988 to protect consumers' privacy regarding their video rental and viewing habits. The statute prohibits "video tape service providers" (broadly defined within the law itself to include "any person . . .  engaged in the business . . . of prerecorded video cassette tapes or similar audio visual materials) from knowingly disclosing personally identifiable information (PII) concerning a consumer to third parties without the consumer's informed, written consent. The complaint alleges that Lawline, a provider of online continuing legal education (CLE) courses, violated the VPPA by sharing users' video viewing history and unique identifying information with Facebook and other third parties.

The complaint alleges a number of behaviors that violate the VPPA:

Unauthorized Disclosure of Personal Viewing Information:

• Lawline is accused of using analytics tools to track and disclose users' personal viewing information, including unique identifiers and specific video content viewed, to third parties without users' consent. 
• The complaint highlights that this disclosure occurs automatically and invisibly, depriving users of the ability to make informed decisions about their privacy. Absent a technical investigation of the website (that is, the use of development or other tools in order to view the underlying code) a user would be unaware that their information is being shared. 

Use of Facebook Tracking Pixel:

• Lawline allegedly installed the Facebook Tracking Pixel on its website, which captures and transmits users' viewing data to Facebook. This data includes the user's unique Facebook ID (FID) and the specific videos watched. Facebook's pixel has been the subject of numerous VPPA complaints in the past. 
• The complaint asserts that this practice allows Facebook to link users' viewing habits on Lawline with their Facebook profiles, thereby violating their privacy by sharing (without the users' knowledge or consent) browsing habits with Facebook, and its parent company, Meta. 

Failure to Obtain Informed Consent:

• The VPPA requires that any disclosure of PII must be preceded by informed, written consent from the consumer in a form distinct from other legal or financial obligations. The complaint alleges that Lawline did not obtain such consent from its users. 
• Lawline's privacy policy does not adequately inform users about the sharing of their personal viewing information with third parties like Facebook.

Monetization of User Data:

• The complaint claims that Lawline profits from the unauthorized disclosure of users' personal viewing information by leveraging this data for targeted advertising and other business purposes.

Legal Claims Under the VPPA

Violation of 18 U.S.C. § 2710:

• The VPPA prohibits video tape service providers from knowingly disclosing PII concerning any consumer to third parties without informed, written consent. The complaint alleges that Lawline's actions constitute a clear violation of this provision. 
• The disclosed information includes users' unique identifiers and specific video materials requested from Lawline's website, which are considered PII under the VPPA. 

Lack of Opt-Out Mechanism:

• The VPPA mandates that consumers must be provided with an opportunity to opt out of ongoing disclosures. The complaint asserts that Lawline failed to offer such an opt-out mechanism to its users.

Damages and Relief Sought:

• The complaint seeks actual damages or liquidated damages of not less than $2,500 per plaintiff, as well as punitive damages, attorney's fees, and other litigation costs.
• Additionally, the complaint requests injunctive relief to prevent further unauthorized disclosures and to ensure compliance with the VPPA.

Takeaways

This complaint highlights a growing trend in data privacy litigation - use of the VPPA to target allegedly improper disclosure of PII through the use of third-party tracking cookies. As a result, an adequate data privacy policy increasingly requires a detailed understanding of a company's own website usage tools - since many development tools may include these tracking cookies as defaults or companies may implement them as part of an advertising campaign without recognizing the legal implications.

Without an understanding of whether and how a company is utilizing these third-party cookies, they may be left open to legal risks under the VPPA or similar laws (such as the California Invasion of Privacy Act), which increasingly target advertising cookies used by companies who might not otherwise significantly collect or utilize PII.

This class action lawsuit against underscores significant concerns about digital privacy and the unauthorized sharing of personal viewing information.  By allegedly failing to obtain informed consent and disclosing sensitive data to third parties like Facebook, Lawline is accused of violating the VPPA and infringing on users' privacy rights. The outcome of this case could implicater the broader VPPA trends that we have begun to see over the country, and emphasizes the importance of a legal department's role in all aspects of a company's consumer facing components.