EPIC Tells Ninth Circuit That Video Providers Can’t Rely on Flimsy “Consent” Prompts to Disclose Personal Data

Last week, EPIC filed an amicus brief with the Ninth Circuit explaining that the Video Privacy Protection Act (VPPA)—which prohibits video service providers’ disclosure of sensitive consumer data to third parties—cannot be circumvented by disclaimers buried in cookie banners and clickwrap privacy policies.

The appeal, Lakes v. Ubisoft, stems from a lawsuit alleging that the video game company Ubisoft shared its customers’ personally identifiable information to third parties like Facebook. The VPPA prohibits such disclosures unless they fall under one of the statute’s narrow exceptions. One of these exceptions applies where the consumer has given specific consent that is written, informed, time-limited, and distinct and separate from any other agreement. Yet Ubisoft claimed it had obtained the necessary consent through its use of a cookie banner buried at the bottom of the screen and a checkbox (linking to Ubisoft’s privacy policy) when users created an account.

In the amicus brief, EPIC traces the history of the VPPA, which was adopted in direct response to the high-profile release of Supreme Court nominee Robert Bork’s video rental history. Congress was outraged by the leak and, recognizing the highly sensitive nature of the information involved, crafted the VPPA with one of the strictest consent standards anywhere in American law.

The brief goes on to explain that Ubisoft’s consent solicitations—which were not informed, not time-limited, not distinct and separate, and arguably not even written—not only fall far short of this exacting consent standard, but also fail to satisfy even the general consent standard commonly used in the Ninth Circuit in common law privacy cases.

Video service providers have many non-burdensome methods to obtain meaningful consent from consumers that would satisfy the VPPA, but courts should not allow companies to circumvent important privacy laws through hidden small print and interfaces deliberately designed to prompt consumers to hit “agree” without reading or understanding.