Who counts as a video tape service provider?

A video tape service provider is any business engaged in the rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials, in or affecting interstate or foreign commerce. A person who receives a disclosure under the names-and-addresses or ordinary-course exceptions is also treated as a provider, but only with respect to the information contained in that disclosure.

How long can a consumer's consent to disclosure last?

Consent given in advance lasts at most 2 years, or until the consumer withdraws it, whichever is sooner. The consumer may instead elect to give consent at the time the disclosure is sought.

Does a disclosure the statute permits create liability?

No. The statute says that no liability results from lawful disclosure permitted by it.

What can a plaintiff recover for a violation?

The court may award actual damages but not less than liquidated damages of $2,500. It may also award punitive damages and reasonable attorneys' fees and other litigation costs reasonably incurred.

How long does a person have to sue under the statute?

An action must begin within two years from the date of the act complained of or the date of discovery.

Does the statute override state privacy laws?

Only in a narrow way: the statute preempts only the provisions of State or local law that require disclosure the statute prohibits.

Do platform terms ever require VPPA compliance?

They can. Facebook's Statement of Rights and Responsibilities included a term under which, if applicable, the reader would comply with the VPPA and obtain any opt-in consent necessary from users so that user data subject to the VPPA could be shared on Facebook. The same term had the reader represent that any disclosure to Facebook would not be incidental to the ordinary course of the reader's business.

Data PrivacyAct or rule

Video Privacy Protection Act (VPPA)

Berkeley Robinson, Managing Attorney at Robinson Law Firm PLLC

Author

Berkeley Robinson, Esq.

Managing Attorney, Robinson Law Firm PLLC

Berkeley has served as the go-to counsel for many scaling businesses in a transactional and litigation management capacity. Before becoming an attorney, Berkeley grew sales teams, ran online marketing campaigns, and did everything else an entrepreneur does—and still does today as the founder of two online businesses.

Definition

Video Privacy Protection Act (VPPA) is the federal statute that makes a video tape service provider liable to the aggrieved person when it knowingly discloses, to any person, personally identifiable information concerning any consumer of that provider, unless the statute permits the disclosure. Source: 18 U.S.C. § 2710

A “consumer” under the statute is any renter, purchaser, or subscriber of goods or services from a video tape service provider, and personally identifiable information includes information that identifies a person as having requested or obtained specific video materials or services from such a provider. Source: 18 U.S.C. § 2710 Congress enacted the statute as the Video Privacy Protection Act of 1988, which added section 2710 to Title 18, and later amended that section through the Video Privacy Protection Act Amendments Act of 2012. Source: 18 U.S.C. § 2701 note (Pub. L. 100–618, § 1, Nov. 5, 1988, 102 Stat. 3195)

Key legal rules

These are the main rules the VPPA sets for a business that handles customers' video records:

A video tape service provider may disclose personally identifiable information concerning a consumer with the consumer's informed, written consent, which must be in a form distinct and separate from any form setting forth other legal or financial obligations of the consumer, may be given in advance only for a set period not to exceed 2 years or until the consumer withdraws it, whichever is sooner, and must come with a clear and conspicuous opportunity to withdraw. Source: 18 U.S.C. § 2710
A provider may disclose solely the names and addresses of consumers if it has given the consumer a clear and conspicuous opportunity to prohibit the disclosure and the disclosure does not identify the title, description, or subject matter of any video tapes or other audio visual material, although subject matter may be disclosed if the disclosure is for the exclusive use of marketing goods and services directly to the consumer. Source: 18 U.S.C. § 2710
A provider may disclose personally identifiable information to any person if the disclosure is incident to the ordinary course of business, which the statute defines to mean only debt collection activities, order fulfillment, request processing, and the transfer of ownership. Source: 18 U.S.C. § 2710
A person subject to the statute must destroy personally identifiable information as soon as practicable, but no later than one year from the date the information is no longer necessary for the purpose for which it was collected, unless there are pending requests or orders for access to the information under subsection (b)(2) or (c)(2) or pursuant to a court order. Source: 18 U.S.C. § 2710

For the sake of space, this page lists only the primary rules related to this term that most businesses should follow. More may apply to your situation, and your unique facts affect how they apply.

Send us a message through our online form to talk through yours.

Send a message

Response within 24 hours

Why these rules exist

The duties give the consumer control over a record of what he or she has requested or obtained from a video provider. Disclosure generally needs consent that is separate from other legal or financial terms and that the consumer can withdraw, and personally identifiable information must be destroyed within a year after it is no longer necessary for its purpose, so a viewing history is not passed along or kept indefinitely without the consumer's say. Source: 18 U.S.C. § 2710 A court reviewing financial-privacy regulations drew on the same interest, treating the VPPA as an example of a specific privacy interest Congress has articulated, one that prohibits video stores from disclosing information about a customer's rentals without that individual's consent. Source: Memorandum Opinion (First Amendment challenge to financial privacy regulations)

Enforcement examples

Netflix VPPA settlement (online video rental history records)

Attachment A to FTC Privacy Shield Letter: Overview of the U.S. Privacy and Security Landscape

The FTC's overview of the U.S. privacy landscape recounted that Netflix allegedly kept rental history records in violation of the Video Privacy Protection Act of 1988. Source: Fed. Trade Comm'n, The EU-U.S. Privacy Shield Framework in Context: An Overview of the U.S. Privacy and Security Landscape, § II That kind of retention is what the statute's destruction duty addresses. A person subject to the VPPA must destroy personally identifiable information as soon as practicable, but no later than one year from the date the information is no longer necessary for the purpose for which it was collected, unless there are pending requests or orders for access to the information under subsection (b)(2) or (c)(2) or pursuant to a court order. Source: 18 U.S.C. § 2710

Outcome. A federal court approved a $9 million payment by Netflix for those allegations. Source: Fed. Trade Comm'n, The EU-U.S. Privacy Shield Framework in Context: An Overview of the U.S. Privacy and Security Landscape, § II

Exposure

Enforcement under the statute runs through private litigation, so any person aggrieved by a violation may bring a civil action in a United States district court. Source: 18 U.S.C. § 2710 If the plaintiff wins, the court may award actual damages but not less than liquidated damages of $2,500, together with punitive damages, reasonable attorneys' fees and other litigation costs reasonably incurred, and such other preliminary and equitable relief as the court determines to be appropriate. Source: 18 U.S.C. § 2710

A plaintiff has a limited window to sue, because no action may be brought unless it is begun within 2 years from the date of the act complained of or the date of discovery. Source: 18 U.S.C. § 2710 The totals can still run large, as the Netflix matter shows: a federal court approved a $9 million payment by Netflix for allegedly keeping rental history records in violation of the Video Privacy Protection Act of 1988. Source: Fed. Trade Comm'n, The EU-U.S. Privacy Shield Framework in Context: An Overview of the U.S. Privacy and Security Landscape, § II

FAQs

1.18 U.S.C. § 2710. Wrongful disclosure of videotape rental or sale records. 18 U.S.C. § 2710
2.18 U.S.C. § 2710. Wrongful disclosure of videotape rental or sale records. 18 U.S.C. § 2710See also 18 U.S.C. § 2710. Wrongful disclosure of videotape rental or sale records. 18 U.S.C. § 2710
3.18 U.S.C. § 2701, Short Title of 1988 Amendment. 18 U.S.C. § 2701 note (Pub. L. 100–618, § 1, Nov. 5, 1988, 102 Stat. 3195)See also 18 U.S.C. § 1, Short Title of 2013 Amendment. 18 U.S.C. § 1 note (Pub. L. 112–258, § 1, Jan. 10, 2013, 126 Stat. 2414)