11th Circuit Has Yet to Define Contours of PII

In 2012, Congress amended the VPPA "to reflect the realities of the 21st century. The amendment reflected modern society’s shift from “corner video stores,” such as Blockbuster and Redbox, to streaming platforms and other forms of digital media. Crucially, for business owners, courts have held that websites qualify as a video tape service provider within the VPPA. Indeed, as the Northern District of Texas remarked in Frawley v. Nexstar Media Grp. Inc.[DS1] “electronic disclosures of a person's video-viewing history, even if not explicit, can violate the VPPA.”

I. What Qualifies as “Personally Identifiable Information” under the VPPA?

18 USC § 2720(a)(3), the definitions section of the VPPA, provides that “personally identifiable information” (“PII”) includes information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider. Thus, to state a claim under the VPPA, a plaintiff must allege facts showing the defendant actually knew it was disclosing: (1) a user's identity; (2) the identity of the video material; and (3) the connection between the two—i.e., that the given user had 'requested or obtained' the given video material.

II. What Constitutes “Specific Video Materials” under 18 USC § 2720(a)(3)?

As an initial comment, the Eleventh Circuit, the Court of Appeals most relevant to Florida businesses, has expressly declined to comment on what qualifies as “specific video materials.” However, in Kueppers v. Zumba Fitness, LLC[DS2] (“Kueppers”)—a May 2025 decision, the Southern District of Florida provided some insight. In Kueppers, the court addressed whether the disclosure of a URL webpage containing a video qualifies as disclosure of “specific video materials” within the meaning of the VPPA. After acknowledging the 11th Circuit’s lack of definition, the Southern District discussed non-binding—but advisory—cases from other federal districts.

The Southern District noted several relevant holding, including rulings that denied dismissal of the Plaintiff’s complaint where the plaintiff plead (1) a disclosure of Facebook ID, URL address, and website title, (2) a disclosure which linked a Facebook ID to a specific person, a URL to a particular video, and the specific person to the particular video; (3) disclosure of a website visited via the Facebook tracking pixel—in that case, the Plaintiff was not even required to plead the name of the viewed video.

The Knueppers opinion provides significant insight for businesses who utilize the Meta Pixel for advertising purposes. There, the court held that the plaintiff sufficiently alleged that the Defendants disclosed URLs containing when they plead the following:

102. When the purchase of an on-demand video instructor course is complete, the customer is routed to a new webpage (also hosted on Defendant's Website). This page says "YOU'RE ALL SET." It also prominently displays: (1) the name of the individual who purchased the on-demand video materials and (2) the name of the specific video materials that the person purchased.

103. The "YOU'RE ALL SET" pages also have the Meta Pixel installed. Defendant uses the Meta Pixel to transmit the URLs of these webpages, along with the FIDs of the individuals who purchased the on-demand video materials and hwo [sic] are named on each page, to Meta.

The Court also clarified that advisory precedent does not directly address whether disclosure of the video title is required to state a claim under the VPPA. However, they do state that “the statute protects personally identifiable information that identifies a specific person and ties that person to particular videos that the person watched.” In closing, the Southern District noted that “[c]onversely, the courts to directly considered the issue (above) found that there is no technical requirement that the name of the video and not a URL link to the video page must be disclosed.”

For businesses, this opinion instructs that plaintiffs have broader avenues to allege VPPA violations. If a business utilizes Meta Pixel and transmits the person’s Facebook ID and either (1) the URL link to the video; or (2) the name of the video, they are opening themselves up to liability. Crucially, for businesses using analytics tools which capture personal information and who also utilize some form of video content, this information must not be disclosed together to a third-party.