On March 2, 2015, The Cartoon Network Inc. ("Cartoon Network") filed its response brief in Mark Ellis v. Cartoon Network Inc., asking the Eleventh Circuit Court of Appeals to uphold the district court's dismissal of the lawsuit for failure to state a claim. The lower court dismissed the suit on the grounds that an "Android ID" is not equivalent to a name and, without any additional information, cannot be considered "personally identifiable information" under the Video Privacy Protection Act ("VPPA"). In addition to denying that it even has possession of personally identifiable information, Cartoon Network argues that "information that is not personally identifiable when held by [it] cannot become personally identifiable when given to some recipients and not others."
Rapid technological advances have triggered an increase in cell phone privacy litigation brought pursuant to the VPPA, and Ellis is just one of the many cases challenging its role in the 21st century. The VPPA was enacted in 1988, during a time when video cassette players were the most common device used to watch movies. The Act was passed in response to Justice Robert Bork's entire Potomac Video store rental history being released to a newspaper reporter, without his permission, during his 1987 Supreme Court nomination hearings. The Act prohibits "video tape service providers" from knowingly disclosing "personally identifiable information" concerning their consumers. 18 U.S.C. § 2710(b). Personally identifiable information is defined as "information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider." Id. § 2710(a)(3).
With the rise of social media and its widespread accessibility on cell phones, the ancient law is faced with a new and unanticipated application. Thus, cue the latest hot button issue surrounding the VPPA and mobile devices – Should a mobile device identifier (i.e. an Android ID, Apple ID, Blackberry ID, etc.) be considered "personally identifiable information" under the VPPA, such that the transfer of that identifier and any related consumer video viewing history to third-party marketing companies, without user consent, would be a violation of the Act?
Last year, a potential class action lawsuit was filed against Cartoon Network. In Ellis v. The Cartoon Network, Inc., 1:14-CV-484-TWT, 2014 U.S. Dist. LEXIS 143078, at *9 (N.D. Ga. Oct. 8, 2014), Plaintiff Mark Ellis ("Ellis") filed suit against Cartoon Network alleging that the company violated the VPPA by providing his Android ID, a 64-digit device identifier assigned to his cell phone, along with his video viewing history to a third party data analytics company, Bango. Id. at 2-3. Ellis further alleged that Cartoon Network failed to seek or obtain his consent prior to automatically sending a record of his video viewing activity and Android ID to Bango, each time he watched a television show or video clip through the company's mobile application, the "CN App." Id. Thus, Bango, a company that "specializes in tracking individual user behaviors across websites and mobile applications," was allegedly enabled to determine his identity using his Android ID and information previously collected from other sources. Id.
The district court dismissed the action with prejudice for failure to state a claim under the VPPA, ultimately holding that the "the Android ID, without more, is not personally identifiable information." In making its decision, the court determined that the issue boiled down to whether a video tape service provider could identify a specific person based on his or her anonymous ID alone, without taking any further steps to determine identity. Id. at *7. The court found that although an Android ID is unique to each user and device, it is not "akin to a name," as it fails to identify a specific person without more information. Id. at *8. Finally, the court highlighted Ellis' own admission that Bango has to use information from other sources, or take "extra steps," to match Android ID's with the names of specific individuals. Id. at *8.
Ellis promptly appealed on November 6, 2014, asking the Eleventh Circuit to reverse the lower court's decision. Drawing on rules of statutory interpretation, Ellis argued in his brief that information is personally identifiable where "the recipient of a disclosure understands to whom the information refers." Additionally, Ellis contended that "numbers like an Android ID are actually a better identifier than a name, because names are not necessarily unique to particular individuals."
With the changing landscape of technology, it seems that privacy laws have remained stagnant. The terminology of the VPPA itself, with references to "video tapes" and "rentals," is a stark reminder of the seemingly olden days of Friday nights at the local video rental store. As consumers become more and more dependent on mobile devices, consumer data compilation is becoming bigger business. The Ellis case will certainly be one to follow using your mobile device, although do so at your own risk, as your article viewing history may be tracked as well.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
