Why the Vppa and Coppa Are Outdated: How Netflix, Youtube, and Disney+ Can Monitor Your Family at No Real Cost

• Publication year: 2020

Why the VPPA and COPPA Are Outdated: How Netflix, YouTube, and Disney+ Can Monitor Your Family at No Real Cost

Anna O'Donnell
University of Georgia School of Law

WHY THE VPPA AND COPPA ARE OUTDATED: HOW NETFLIX, YOUTUBE, AND DISNEY+ CAN MONITOR YOUR FAMILY AT NO REAL COST

Anna O'Donnell^*

[Page 467]

Video-streaming services like Netflix, YouTube, and Disney+ dominate the current media landscape. This Note explains why current laws likely cannot effectively prevent these streaming services from collecting and sharing users' private information. The Video Privacy Protection Act (the VPPA) contains language that has baffled courts when applying its text to streaming services, resulting in multiple circuit splits. The Children's Online Privacy Protection Act (COPPA) has a clearer application to streaming services, yet its enforcement has resulted in small settlements with companies that have been charged with collecting children's private information. Both the VPPA and COPPA need to be updated to address modern privacy concerns.
This Note analyzes the historic 2019 settlement between YouTube and the Federal Trade Commission over YouTube's alleged COPPA violations. When placed in context, this settlement, while historic, remains paltry due to YouTube's revenue and the extent of the alleged wrongdoing. This illustrates the problems with COPPA enforcement generally. While the VPPA could potentially restrict streaming services' behavior, case law interpreting that legislation severely limits its applicability. This Note concludes by suggesting changes to be made to the VPPA for effective use against streaming services and how COPPA settlement guidelines could be updated to result in more reasonable settlements for any future issues with streaming services.

[Page 468]

Table of Contents

I. Introduction....................................................................469

II. History and Case Law of the Video Privacy Protection Act..............................................................471

III. History and Enforcement of the Children's Online Privacy Protection Act..............................................479

IV. The YouTube Settlement and the Blatant Inadequacies of the VPPA and COPPA.....................485

A. THE NUMBERS AND (LACK OF) LOGIC BEHIND THE FTC'S SETTLEMENT WITH YOUTUBE..........................486
B. APPLYING THE VPPA TO THE YOUTUBE SETTLEMENT 491
C. NECESSARY CHANGES TO THE VPPA AND COPPA........495

V. Conclusion......................................................................497

[Page 469]

I. Introduction

It's a common story: After a long day, you're glad to be home. Looking for something to do, you flip on Hulu, Netflix, or YouTube and finally start to decompress. If you're unlucky, you might have to sit through some ads before the video starts. Maybe you notice the ads, maybe not—but have you wondered how those ads are picked for your video-watching experience? Or what information the video provider has collected from you and sold to those advertisers?

Whether you've thought about it or not, laws exist to regulate what personal information video providers are allowed to collect and share with the world: the Video Privacy Protection Act (the VPPA) protects consumers from the video provider disclosing their personal information,¹ and the Children's Online Privacy Protection Act (COPPA) punishes online providers who collect and disclose the personal information of children under thirteen.² However, both the VPPA and COPPA (collectively, the Acts) are increasingly incapable of responding to today's online privacy concerns and evolving technology.

The VPPA, originally enacted in 1988, was drafted to protect the disclosure of rental and sales records from brick-and-mortar video rental stores.³ Applying a law that was intended for physical video tape providers to modern streaming services⁴ has proved to be confusing: two separate circuit splits exist concerning definitions within the VPPA and how to apply them to current technology.⁵

[Page 470]

Congress must amend the VPPA to resolve these circuit splits. This amendment must come soon, as the streaming market is rapidly expanding.⁶ The video-streaming marketplace needs to be properly monitored, and the VPPA must be updated to protect consumers' online privacy from new video-watching technology.

COPPA, originally enacted in 1998 to protect children's privacy on the new world wide web,⁷ is in a similarly dismal situation, although for very different reasons. The Federal Trade Commission (FTC) has updated COPPA for modern technology and privacy concerns, but its enforcement procedures are lacking.⁸ For example, based on the 2019 FTC settlement with YouTube and its parent company, Google, it is apparent that the FTC's shockingly small settlements ineffectively address alleged COPPA violations.⁹ This futile enforcement must also be addressed quickly if COPPA is to protect children in the growing video-streaming marketplace.¹⁰

Both the VPPA and COPPA are critical weapons in the arsenal to combat the incoming barrage of video-streaming services and other media providers. Both Acts must be modernized to effectively protect Americans' privacy going forward. Part II of this Note

[Page 471]

describes the case law interpreting the VPPA and the story behind the circuit splits. Part III introduces COPPA and its enforcement history. Part IV focuses on YouTube by breaking down the numbers behind the settlement with the FTC, by discussing the confusion of applying the VPPA in its current state to YouTube, and by analyzing needed improvements to the VPPA and COPPA. Part V briefly concludes.

II. History and Case Law of the Video Privacy Protection Act

Congress began crafting the VPPA in 1987 when a newspaper published a list of the videos rented by the family of Judge Robert Bork, a nominee to U.S. Supreme Court.¹¹ While the videos rented by Judge Bork's family were innocuous,¹² Congress immediately feared the Orwellian abuses of letting such private information be collected and shared freely.¹³ The VPPA was enacted in 1988¹⁴ during the height of brick-and-mortar video rental stores, and its statutory language reflects the technology of the era.¹⁵

Unforeseeable by the Congressmembers of 1988, traditional video rental stores would gradually fade as new rental methods gained popularity.¹⁶ One of the largest changes in the market

[Page 472]

occurred in the 2000s when Netflix and other video providers began offering online streaming services.¹⁷ By the early 2010s, traditional video rental stores were almost completely replaced by online providers of digital media.¹⁸ As of 2019, 69% of American consumers paid for a streaming service, with the number increasing to 88% for Americans between ages 22 and 35.¹⁹ This high percentage is a result of the increasing expansion of the streaming market: as of 2019, half a dozen major streaming service providers exist, and new providers are coming on the scene.²⁰ Among all of these changes in the video provider market, the VPPA has remained largely the same.²¹

[Page 473]

The VPPA is codified at 18 U.S.C. § 2710, which is split into six subsections.²² These subsections have stayed true to their versions from 1988, with only minor amendments in 2013.²³ While each subsection is independently important, the most controversy and litigation surrounds the first subsection: § 2710(a).²⁴

The drama and excitement of the VPPA case law—particularly in the last few years—involves two of the four definitions in § 2710(a): "consumer" and "personally identifiable information."²⁵ Courts have interpreted these definitions in light of the ever-changing technology of video sales and rentals, and they have come to different conclusions.²⁶ The three big cases that have split the circuits—In re Nickelodeon Consumer Privacy Litigation,²⁷ Ellis v. Cartoon Network, Inc.,²⁸ and Yershov v. Gannett Satellite Information Network, Inc.²⁹ —discuss the definitions of "consumer" and "personally identifiable information" at length and how the VPPA should apply to modern video-streaming providers.³⁰

[Page 474]

While cases prior to 2012 addressed the VPPA, they mostly involved police efforts to obtain video rental and sales records for investigations and did not address the ambiguity of the definitions in the VPPA's first subsection.³¹ For this Note's purposes, the real story began on August 10, 2012, when the District Court for the Northern District of California found merit in a claim against Hulu for violating the VPPA.³² The court made the critical decision that Hulu counted as a "video tape service provider" under the VPPA,³³ applying the law to Internet video providers for the first time.³⁴ Additionally, the court held that "consumers" under the VPPA—which are defined as "any renter, purchaser, or subscriber of goods or services from a video tape service provider"³⁵ —do not have to be paying subscribers to a video provider in order to count under the VPPA.³⁶ While the case against Hulu fizzled out over several years,³⁷ the district court's decision proved to be the first spark of the privacy litigation fire involving streaming services and the VPPA.

[Page 475]

What does a VPPA violation consist of? A video tape service provider can violate the VPPA by knowingly disclosing a consumer's personally identifiable information (PII) to a third party.³⁸ If the video tape service provider is found liable, they can be subject to actual damages not less than $2500, punitive damages, attorney's fees, and any other equitable relief the court deems appropriate.³⁹ Generally, plaintiffs in VPPA cases argue that streaming service providers collected their online information through "trackers, cookies, and algorithms designed to capture and monetize the information [consumers] generate."⁴⁰ Such plaintiffs commonly argue that these websites or apps collected revealing personal information and proceeded to sell that information to an advertising firm or another entity that...