In two cases last week, two courts entered widely divergent rulings on the central question of the specific definition of “personally identifiable information,” or “PII,” under the Video Privacy Protection Act (“VPPA”).  The VPPA defines PII as information that “identifies a person as having [obtained a video]” from a video tape service provider (“VTSP”).
In Yershov v. Gannett, the First Circuit took a broad view of that definition, deciding that even information such as unique device IDs in connection with GPS coordinates can be PII. 
In Perry v. CNN, issued just a few days before Yershov, a federal district court in Georgia took a far more limited view under Eleventh Circuit precedent, holding that MAC addresses are not PII because they are tied to devices, not specific individuals.
Yershov v. Gannett
Gannett owns USA Today.  Yershov, the plaintiff, downloaded and used the USA Today App on his Android phone.  He never created an account or subscribed to the print version of USA Today.  He alleged that when he watched videos on the free app, Gannett transmitted the video’s title, plus his device’s unique ID and GPS coordinates, to non-party Adobe.  Adobe provides analytics servants to its customers by building user profiles, which Yershov alleges it does by taking unique IDs provided by its customers such as Gannett, and using them to track users across different devices and apps.
Yershov claimed that Gannett violated the VPPA in disclosing his information to Adobe.  The trial court granted Gannett’s motion to dismiss.  First, assuming Yershov’s facts as true, it found that Yershov had adequately pled that the device ID and GPS coordinates could constitute PII because smartphones tend to be closely associated with specific people (and include substantial information about them), so those two bits of information together could tie a specific person to video-viewing information.  Second, however, the court held that Yershov was not a “subscriber” because although he watched videos on the USA Today App, he never paid Gannett money, registered any information, agreed to periodic delivery, or obtained access to restricted content.
On appeal, the First Circuit adopted the lower court’s broad decision on PII but rejected its narrow definition of “subscriber,” thus taking a very high-profile minority position on both of those issues.
Yershov:  Unique IDs and GPS Coordinates Can Be PII.
The Yershov court ruled that although “awkward and unclear,” the VPPA’s definition of the term—“identifies a person as having [obtained a video]”—“reasonably conveys the point that PII is not limited to information that explicitly names a person.”  The court also cited the statute’s legislative history to explain that the drafters meant VPPA “to establish a minimum, but not exclusive” definition of PII because many types of information other than a name can identify a person.  The court explained that GPS coordinates can serve to identify specific individuals’ home and work addresses, and that, according to Yershov, Gannett knew Adobe could link a GPS address and unique ID to a specific person.  So, the court ruled that Yershov had plausibly alleged that Gannett disclosed his PII.
Users that Disclose PII for Free Access Can Be Subscribers.
The Yershov court also ruled that although the VPPA does not define “subscriber,” Congress meant to use the “plain and ordinary meaning” of the word.  Reading several dictionaries, the court settled on the basic definition (for the app context) that a subscriber is a person who enters an agreement to receive access to electronic texts or services.
The court noted that its definition did not require that a subscriber pay any money because the other two categories of consumers under the VPPA, “purchasers” and “renters,” encompassed the whole universe of people who paid money to possess videos.  Purchasers pay for permanent possession, and renters pay for temporary possession.  So, the court ruled that including “subscribers” as a third option would have been superfluous if Congress only wanted people who paid for videos to be protected.
The court also rejected the Eleventh Circuit’s decision in Ellis v. Cartoon Network, in which that court ruled that a “subscriber” had to pay money or establish some sort of ongoing relationship with a video provider, e.g., by registering an account or entering some other type of ongoing relationship with the provider.  In concluding that Yershov was a “subscriber,” the court analogized the download of a mobile app to the installation of a dedicated phone line between Gannett’s offices and the subscriber’s home:  “Imagine that Gannett had installed a hotline at Yershov’s home, for free, allowing him to call Gannett and receive instant delivery of videos in exchange for his name and address, and he then used the hotline over the course of many months to order videos.”  The court ruled that Yershov did pay to use the USA Today App—just not with money.  Instead he gave Gannett his PII in exchange for free access to Gannett’s content, and Gannett monetized that PII in other ways.
However, the court noted that development of the facts as the case moves past the pleadings could reveal that the plaintiff is not correct about everything he alleged in his complaint.  (Because the Yershov decision arose on an appeal from a decision granting a motion to dismiss, the court assumed that all facts pled by the plaintiff were true.)  For example, Adobe might not be able to identify users such as the plaintiff based on the information Gannett provides.
Perry v. CNN Applies the Majority Rule
The ruling in Gannett is a significant outlier in VPPA case law that departs considerably from the clear majority rules in VPPA cases: that unique IDs (without more) cannot be PII, and that free app users (without more) cannot be subscribers.
A Georgia federal district court’s recent ruling in Perry v. CNN demonstrates a straightforward application of the majority rule.  That court addressed exactly the PII and subscriber issues as the First Circuit in Gannett.  The facts were also very similar.  Perry had watched videos on CNN’s free app but did not create an account.  CNN allegedly disclosed the user’s mobile ID and video-viewing information to Bango, a company that performed data analytics similar to those undertaken by Adobe in Gannett.  (Perry did not allege that CNN disclosed his GPS coordinates.) Perry was decided in the Eleventh Circuit, where Ellis v. Cartoon Network is binding precedent.  Ellis held that even though payment is not a necessary element of subscription, the ordinary meaning of “subscription” “involves some type of commitment, relationship, or association (financial or otherwise) between” a provider and user.
The Perry court reached opposite conclusions from the Gannett court on PII and subscribers, just days before the Gannett opinion issued.  First, the Perry court ruled that under Ellis, because Perry neither paid to use CNN’s app, nor created account, nor entered any other sort of commitment, relationship, or association with CNN, he was not a “subscriber.”  Nor was he a “renter” (another type of consumer) under his alternative argument because to “rent” videos implies paying for them, as the court found.  Second, the court held that even if Perry were a subscriber or renter, MAC addresses are not PII because they are tied to devices, not specific individuals.
Given that Gannett is an outlier, it is unclear how influential it will be over the development of VPPA law.  Gannett is not particularly clear on two points, which could lead to more litigation.  First, the court was not clear on whether, to be PII, device IDs must be linked to GPS coordinates or something similar.  (That would be like the “something more” standard of the majority rule.)  Second, as to the subscriber issue, both Gannett and Ellis ultimately say the decision is fact-dependent.  That suggests we will see more rulings on that point as VPPA litigation renders summary judgment orders and trial verdicts.