ontentious Supreme Court nominations began with that of Robert Bork, whose originalist views led him to proclaim that there is no constitutional right to privacy. Americans, he believed, have only such privacy rights as may be conferred by statute. Little did he imagine that his own personal experience would lead to just such a statute.

While Judge Bork’s nomination to the Supreme Court was in the balance and with his views on privacy very much in the news, a reporter obtained a list of the videos that Judge Bork and his family had rented from a local video store and published the list. The backlash from this incident led to the 1988 Video Privacy Protection Act (VPPA).

The VPPA provides a civil remedy against a “video tape service provider” that knowingly discloses personally identifiable information (PII) concerning its “consumers.” “Consumer” is defined to include “any renter, purchaser, or subscriber of goods or services” from the video tape service provider. The VPPA authorizes courts to award punitive damages and attorneys’ fees to successful plaintiffs.

Given the demise of Blockbuster, this piece of legislation might be no more than an historic curiosity. But judges with a penchant for more imaginative interpretations of statutes than Judge Bork would have countenanced have breathed new life into this statute, making it relevant to today’s cellphone app developers.

Two ongoing class action lawsuits have resulted in opinions that represent a lively conversation among those trial judges and appellate courts that have considered the VPPA’s vitality in the mobile phone era. The most recent opinion was a breakthrough success for privacy advocates.

Cartoon Network and USA Today each developed free cellphone apps that allowed users to access video content. The apps would also transmit data to aggregators that would identify the videos that were watched. The data included the Android ID¹ and, in the case of USA Today, the GPS coordinates, of the user’s device.

Users of these apps filed class action lawsuits alleging violations of the VPPA. In both cases, the defendants argued that the plaintiffs were not “subscribers” within the meaning of the VPPA because the services were free, and that sharing the Android ID was not the disclosure of PII for purposes of that statute. Earlier cases had held that a device identifier was not PII, so precedent seemed to be on their side.

The first of these cases to go to trial involved The Cartoon Network. In 2014, a federal trial court in Georgia granted a motion to dismiss the complaint. The court said the user qualified as a “subscriber” to the Cartoon Network service even though it was free, but that the Android ID was not PII.

Next up was Gannett, the publisher of USA Today. Gannett contended that the Android ID cannot be PII because it identifies an object, rather than a human being. A federal judge in Massachusetts rejected that argument, pointing out by analogy that, while a home address describes an object, not a person, there can be little doubt that it is PII.

Gannett also contended that the Android ID cannot be PII because it cannot be linked to a specific person without also knowing who owns the phone in question. The court responded that the same could be said of every identifier other than a person’s name. For example, the court pointed out, a social security number is a string of nine numbers that only takes on meaning if it can be identified as the number of a specific person, but it is unquestionably PII.

The court in the Gannett case then considered whether the plaintiff was a subscriber. After reviewing several definitions, the court concluded that subscriptions involve payment, registration, commitment, delivery, and access to restricted content, or some combination of these attributes. The USA Today app had none of these characteristics, so it “appears to merely be a more convenient form of visiting the USA Today website.” Under these circumstances, an individual who downloads and uses the USA Today app was deemed not to be a “subscriber” within the meaning of the VPPA.

Following this ruling, the Eleventh Circuit Court of Appeals decided the appeal of the Cartoon Network case. It first considered whether the plaintiff, using a free app that required no registration, was a subscriber. It was persuaded by the reasoning in the USA Today decision and concluded that the plaintiff was not a subscriber. On that basis, the trial court’s dismissal of the complaint was affirmed. The Court of Appeals made no mention of whether the Android ID was PII.

In April 2016, the Court of Appeals for the First Circuit decided the appeal of the district court’s ruling about the USA Today app. The panel agreed with the trial court that the Android ID constitutes PII, a conclusion that was bolstered by the simultaneous transmission of GPS data that would make it easier to locate the user’s home.

On the question of whether the plaintiff was a “subscriber,” the court flatly disagreed with the Eleventh Circuit decision in Cartoon Network: “[B]y installing the App on his phone, thereby establishing seamless access to an electronic version of USA Today, [the plaintiff] established a relationship with Gannett that is materially different from what would have been the case had USA Today simply remained one of millions of sites on the web that [he] might have accessed through a web browser.”

While the First Circuit allowed for the possibility that further facts might ultimately lead to a different conclusion, it held that, for purposes of Gannett’s motion to dismiss the complaint, the plaintiff should be considered a subscriber and thus the motion to dismiss should be denied.

Gannett is the first case in which a VPPA plaintiff complaining about a free app has survived a motion to dismiss the complaint. Previous plaintiffs, like the one in Cartoon Network, have stumbled either on the question of whether PII was disclosed or of whether they were subscribers for purposes of the VPPA.

The VPPA is attractive to class action lawyers because it not only confers explicit privacy rights but allows judges to grant attorneys’ fees to successful plaintiffs. Until now, the VPPA has been like a mirage to these lawyers and their clients – tempting but frustrating because of the difficulties associated with applying a statutory vocabulary from the 1980s to the world of cellphone apps.

Now that a plaintiff has survived a motion to dismiss its class action, and now that a court has held both that the Android ID may be PII and that a user of a free app may be a subscriber, we can expect the VPPA to become a prominent player in privacy litigation. Judge Bork might well wonder how a statute aimed at video tape stores could ensnare cellphone app developers, but alas he is no longer with us to warn against taking liberties with statutory language.

The VPPA does not forbid sharing data about an individual’s video watching; it merely requires the consent of that individual. However, the manner in which that consent must be obtained is intricate. If your app is passing along device identifiers and data that includes video usage, consult with an attorney about this sensitive question.

^{[1] The Android ID is established on devices that use Google’s Android operating system. It is created when a user first boots up the device and it remains unchanged unless the user does a “factory reset” of the device, which deletes the phone’s data and settings.}