This post was also written by Frederick Lah.
On January 10, 2013, President Obama signed the Video Privacy Protection Act Amendments Act of 2012 (“VPPAA”), which makes it easier for companies to obtain consumer consent to share video viewing information. At the same time, the amendment left in place many of the pitfalls traditionally associated with the VPPA, and added some new ones.
More specifically, the VPPAA makes the following changes:
- Consent Via Internet: It clarifies that a company can obtain informed, written consent to disclose the consumer’s video viewing information through electronic means, such as by the consumer signing an agreement over the Internet
- Consent Must Be Separate And Distinct: It requires that such consent be in a form “distinct and separate” from any form setting forth other legal or financial obligations of the consumer
- Consent Can Be Given In Advance: It allows consent to be given in advance for a set period of time, not to exceed two years, or until consent is withdrawn by the consumer, whichever is sooner
- Consent Can Be Withdrawn: It requires the company to provide an opportunity for the consumer to withdraw consent on a case-by-case basis, or to withdraw from ongoing disclosures, at the consumer’s election
Previously, the VPPA had not allowed for advanced consent to sharing. Since all disclosures had to be consented to “at the time” of disclosure, companies could not even obtain consent to sharing video history by way of their account formation documents or terms of use. Because of this Amendment, it is now possible for video content platforms to obtain valid, upfront consent from all of their customers to share individual video viewing histories with third parties. Properly done, this could result in a substantial benefit both to the sharing company and to the consumer, who will receive more highly personalized marketing offers. And, consumers will retain an opt-out as of right.
But this benefit is not without its dangers. The Amendment imposes many requirements both for obtaining advance consent and for allowing revocation of consent. Many nuts-and-bolts questions concerning how to meet these requirements are left unanswered by the plain text of the amendment. When is a consent form sufficiently “separate and distinct”? Can a company require consent for video history sharing as a take-it-or-leave-it term of using the service at all? What does it mean that the customer must be allowed to withdraw consent “on a case-by-case basis”? Given that the VPPA provides for a private cause of action, statutory penalties of $2,500 per person, attorneys’ fees, and punitive damages, any failure to comply with these new consent provisions (which are surely not defined by case law yet), could expose a company to significant liability.
All companies looking to take advantage of this Amendment should carefully consider the design and operation of its consent mechanisms, drawing not only from the Act, but from all relevant sources of guidance as well.