Roku Anonymous ID, Watching History Not Video Act-Protected Personal Data

Bloomberg Law: Privacy & Data Security brings you single-source access to the expertise of Bloomberg Law’s privacy and data security editorial team, contributing practitioners,...

May 12 — An ESPN Inc. video streaming service user's Roku device serial number and record of videos watched don't constitute personally identifiable information protected by the Video Privacy Protection Act (VPPA), the U.S. District Court for the Western District of Washington held May 7.

“In light of the VPPA's text and legislative history, ‘personally identifiable information' under the VPPA means information that identifies a specific individual and is not merely an anonymous identifier,” Judge Thomas S. Zilly wrote in dismissing the putative class case with prejudice.

The court said its conclusion that PII doesn't include anonymous identifiers within the meaning of the VPPA is consistent with the conclusions of other federal district courts that have faced the same question.

Disclosure to Third Party 

The VPPA, 18 U.S.C. § 2710, prohibits a “video tape service provider” from knowingly disclosing a consumer's PII. The statute defines PII to include “information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider.”

In November 2014, the court dismissed Plaintiff Chad Eichenberger's first amended complaint, concluding that the disclosure of his Roku serial device number wasn't sufficient to establish a VPPA violation.

In a second amended complaint, Eichenberger alleged that a third party, Adobe Analytics, was able to identify him by combining the information it was sent by ESPN with its existing user information.

No Identifying Information Disclosed 

The ordinary meaning of PII encompasses “information that identifies an individual and does not extend to anonymous IDs, usernames, or device numbers,” the court said. According to the VPPA's legislative history, the court said, the statute focuses “on whether the disclosure by itself identifies a particular person as having viewed a specific video.”

Many other district courts have reached the conclusion that PII within the meaning of the VPPA doesn't include anonymous identification information, the court said. For example, the court in Locklear v. Dow Jones & Co., No. 1:14-cv-00744-MHC, 2015 BL 34428 (N.D. Ga. Jan. 23, 2015), considered a identical claim involving a Roku serial number.

The additional allegation that Adobe combined the plaintiff's ESPN information with other information to identify him didn't remedy the plaintiff's complaint. Other courts—such as Locklear—have addressed such claims and have concluded that this doesn't amount to PII, the court said.

Edelson PC and Clifford A. Cantor, in Sammamish, Wash., represented the named plaintiff. Munger, Tolles & Olson LLP and Cairncross & Hempelmann PS represented ESPN.

Full text of the court's opinion is available at http://www.bloomberglaw.com/public/document/Eichenberger_v_ESPN_Inc_No_C14463_TSZ_2015_BL_134605_WD_Wash_May_.