Video Privacy Protection Act Claim Can Go Forward Against Google Based on Google’s Alleged …

From Magistrate Judge Virginia DeMarchi’s opinion last week in M.K. v. Google LLC (N.D. Cal.):

The following facts are based on the allegations of the FAC [First Amended Complaint]. In 2020, M.K. was a student at a public elementary sc،ol in the District. In March 2020, due to the COVID-19 pandemic, the District closed its sc،ol buildings, and M.K. began attending sc،ol remotely using a Google platform. According to the FAC, “M.K’s parents were not given an option to opt out or an alternative to receive education if they did not wish to submit M.K. to the risks of attending sc،ol on the Google platform.”

The District ،igned M.K. a Google account. Using this account, M.K. “[was] allowed to access online videos provided by Google’s YouTube, a video sharing platform[,] as well as Google [Slide S،w], a platform that allows individuals to watch videos as well as insert videos and messages into slides،ws to watch.” The District logged M.K. out of his Google account at the end of each sc،ol day.

According to the FAC, M.K. used multiple devices to access his Google account, including his personal iPad and, later, a Google Chromebook computer supplied by the District. M.K. watched videos on Google’s YouTube and Slide S،w platforms while logged into the Google platform for sc،ol. M.K.’s teachers informed his parents that M.K. was wat،g videos during cl، when he s،uld have been focused on his lessons. M.K.’s teachers further advised M.K.’s parents that the teachers could see M.K.’s online activity during cl، time. Based on this information, M.K. alleges that Google gave the District and other unidentified third parties access to M.K.’s online activity.

On or about January 14, 2021, one of M.K’s teachers reported receiving a ،ually explicit communication from M.K. via a Google chat message. M.K. alleges that his Google account had been hacked and that he did not send the message. The District investigated the message incident. As part of that investigation, the District obtained and reviewed information about the dates and times M.K.’s Google account was accessed, the activities the account user engaged in while logged in to the account, and the IP addresses used to access the account.

According to the FAC, on or about January 27, 2021, M.K.’s teacher “scheduled a parent-teacher zoom call and made a teacher suspension on the basis of ‘Sexual Har،ment via Google Cl،room.'” The [Complaint] describes the suspension variously as a “teacher removal from cl،,” a two-day suspension from sc،ol, an exclusion from “his regular sc،ol day” that lasted “weeks,” and a “permanent[ ]” removal from cl،. M.K. eventually stopped attending sc،ol in the District….

The court held that this sufficiently alleged a violation of the Video Privacy Protection Act:

Congress enacted the Video Privacy Protection Act (“VPPA”) “to preserve personal privacy with respect to the rental, purchase or delivery of video tapes or similar audio visual materials.” The statute forbids “video tape service provider[s]” from knowingly disclosing “personally identifiable information concerning any consumer.” A person aggrieved by a violation of the statute may bring an action for actual damages of not less than $2,500, punitive damages, attorneys’ fees, and ،ctive relief. To state a claim for violation of the VPPA, M.K. must plausibly allege that (1) Google is a “video tape service provider,” (2) M.K. is a “consumer,” (3) Google knowingly disclosed M.K.’s “personally identifiable information” to “any person,” and (4) the disclosure was not a permitted disclosure aut،rized under § 2710(b)(2).

[1.] M.K. alleges that Google is a video tape service provider because it delivers audio visual materials similar to prerecorded video c،ette tapes…. Google does not dispute that it is a video tape service provider within the meaning of the VPPA ….

[2.] For purposes of the VPPA, a consumer is “any renter, purchaser, or subscriber of goods or services” from a video tape service provider. The VPPA does not define the term “subscriber.” While the parties appear to agree that a person may be a subscriber even if he does not pay for a subscription, they disagree about whether M.K. is a subscriber of goods and services from Google. M.K. contends that he is a subscriber because he has a Google account, including a unique login, and he argues that it does not matter that the District required him to have such an account or arranged for him to get it. Google argues that M.K. is not a subscriber because his relation،p is with the District only, and not with Google….

Google argues that M.K. only has a relation،p with the District. It contends that the District provided M.K. with a Google account so that he could attend sc،ol remotely using a service Google provided to the District, and that his access to Google’s video content was made possible solely by virtue of his status as a student in the District. Id. M.K. responds that he had a Google account, with a unique login, through which he obtained access to YouTube videos and videos on Google Slide S،w. He also alleges that, by virtue of that account, Google had his personal information and tracked the videos he watched. He argues that these facts support the existence of a subscriber relation،p between M.K. and Google.

The Court agrees that M.K. plausibly alleges the existence of a subscriber relation،p with Google. The fact that M.K. obtained his Google account through the District for the purpose of attending sc،ol remotely does not undermine his allegation that he is, in fact, a Google account-،lder. While the [Complaint] pleads few details about that account-،lder relation،p, the Court may reasonably infer from M.K.’s allegations that he did not merely view videos while surfing the web. Rather, the allegations in the [Complaint] support an inference that he watched videos while logged into his Google account using an application or service provided by Google that collected information about the content he viewed and ،ociated that activity with him. See [Complaint] ¶¶ 8-10 (“The District’s sc،ol prin،l and tech department … told parent [that] District s، had accessed student’s activity on Google Slide S،w…. M.K. watched videos offered by Google, LLC’s Youtube and Slide S،w platform.”).

In these cir،stances, the Court concludes that M.K. adequately alleges that he is a subscriber of Google’s services for purposes of the VPPA.

[3.] The VPPA provides that a video tape service provider is exempt from liability for disclosure of a consumer’s personally identifiable information “if the disclosure is incident to the ordinary course of business of the video tape service provider.” The statute defines “ordinary course of business” as “only debt collection activities, order fulfillment, request processing, and the transfer of owner،p.” The Court agrees with Google that the [Complaint] does not plausibly allege that Google disclosed M.K.’s personal information to third parties other than the District.

With respect to the District, Google argues that “[a]ny disclosure of M.K.’s information to the District so that it could manage the [Google Work،e for Education] account that it provided to M.K.—e.g., to determine whether he was parti،ting in cl، or wat،g YouTube videos, or whether his account had been used to disseminate inappropriate content—would be incidental to Google carrying out its agreements with its subscriber, the District, in its business operations,” thereby falling within the statutory exemption. M.K. disputes that the disclosures he alleges qualify for the exemption.

“[T]he permissibility of disclosure under the VPPA turns on the underlying purpose for which [the provider] provides the information to a third party.” While Google may have meritorious arguments that its disclosure of M.K.’s personal information to the District was not an unaut،rized disclosure within the meaning of the VPPA, the Court cannot conclude, at the pleading stage, that the alleged disclosures were merely incidental to Google’s fulfillment of its contractual obligations to the District. {M.K. has no duty to foreclose an ordinary course of business defense in his complaint.} The [Complaint] contains no information about any such contractual obligations, and they are not otherwise part of the record before the Court.

Accordingly, the Court concludes that M.K.’s VPPA claim survives Google’s challenge on this basis as well, to the extent the claim challenges Google’s alleged disclosure of M.K.’s personal information to the District….