Consumer protection – Video Privacy Protection Act – PII

Listen to this article

Where a plaintiff who downloaded an app has filed a Video Privacy Protection Act complaint, the defendant should be awarded summary judgment despite the plaintiff’s argument that his geolocation data, advertising ID, and email address are all personally identifiable information.

“Plaintiff Charles Therrien claims that defendant Hearst Television, Inc. (HTV or Hearst), unlawfully disclosed his personally identifiable information to two third parties, Braze and Google, in violation of the Video Privacy Protection Act, 18 U.S.C. §2710 (VPPA). Before the court is HTV’s motion for summary judgment. For the following reasons, the court will allow the motion. …

“… Therrien argues that his geolocation data, AAID, and email address are all PII. …

“Here, the record shows only one geolocation data point for Therrien. … The datapoint reveals the location of a church, which Therrien testified he attends with at least 75 other congregants. … If someone learned that a WMUR App user watched a video on the App at this 75-member church, that simple shard of information would not ‘enable most persons to identify’ the user’s home and work address and ultimately identify Therrien. … Thus, the court finds on this record that there is an insufficient amount of evidence for a reasonable juror to find that Therrien could ‘reasonably and foreseeably’ be identified from the geolocation data alone. …

“The cellphone Therrien produced in this litigation has four AAIDs. … However, Therrien claims only one of the AAIDs was in use while he owned the phone and that he never reset his AAIDs. … On this record, there is no evidence to suggest which of the AAIDs was active from February of 2022 to August of 2024 or that GAM connected any of the four AAIDs to Therrien personally. … While AAIDs can uniquely distinguish a device at a point in time, they do not provide data that identifies any individual person. … Without more, such as a name, home, or work address, one cannot identify Therrien based simply from his phone’s AAID. … Lastly, there is insufficient evidence in the record that the AAIDs, even if they were combined with the one geolocation data point in the record — which pointed to Therrien’s church — would be ‘reasonably and foreseeably likely to’ reveal Therrien’s identity. …

“Therrien contends that an email address is per se identifying under the VPPA. … Here, Therrien disclosed his email address to Braze only. While Therrien relies on a screenshot of a Google search of his email address to reveal his full name, address, age, and phone number, there is insufficient evidence in the record that Braze could have used Therrien’s email address to identify him specifically or would have had any incentive to do so. … Unlike in Yershov [v. Gannett Satellite Info. Network, Inc., 820 F.3d 482, 487 (1st Cir. 2016)], Therrien has not provided any evidence that Braze has a ‘game program’ that allows it ‘to link the [email address] to a certain person by name, address, phone number, and more.’ …

“Moreover, the VPPA has a narrow exception for disclosures made ‘incident to the ordinary course of business of the video tape service provider.’ 18 U.S.C. §2710(b)(2)(E). … Video tape service providers may use third parties in their business operations without giving rise to liability under the VPPA. …

“Even if the court were to assume that Therrien’s email address is PII, the fully developed record shows that HTV’s disclosure of the email address to Braze was incident to order fulfillment or request processing. Braze acts as HTV’s vendor to assist HTV in sending push alerts to Therrien’s phone, along with newsletters and updates to Therrien’s email address. … HTV’s disclosures to Braze were not ‘part of [a] targeted advertising campaign which is intended to drive revenue.’ … Therrien purposefully disclosed his email address and signed up to receive such newsletters and updates — he was not required to provide his email address (or grant geolocation services) to HTV to install or use the App, and was free to unsubscribe from emails (and opt out of location sharing) at any time. … Thus, the court finds that even if Therrien’s email address was PII, its disclosure to Braze falls within the ordinary course of business exception.

Therrien v. Hearst Television, Inc. (Lawyers Weekly No. 02-236-25) (12 pages) (Stearns, J.) (Civil Action No. 23-10998-RGS) (April 25, 2025).

Click here to read the full text of the opinion.