Download A Free App, Use It And Say Goodbye To Your PII
October 29, 2015
by Jerry Glover
Have you ever downloaded a free app that allows you to watch video clips or full length shows on one or more of your digital devices? Would you consider yourself a “subscriber” to that app even though you don’t pay a fee to access it? That’s an important question because if you’re not considered a subscriber, then any personally identifying information (PII) the app owner might obtain from your use of the app can be disclosed to other parties.
Or at least that’s what the U.S. Court of Appeals for the Eleventh Circuit recently held (the Eleventh Circuit covers Alabama, Georgia, and Florida). Ellis v. The Cartoon Network, Inc., 2015 WL 5904760 (11th Cir. October 9, 2015). In Ellis, the plaintiff downloaded a free mobile app from the Cartoon Network that allowed him to watch clips or episodes of television programs on the Network. No login account had to be established and no information about the user had to be provided to the Network.
The Network tracks each user of the free app though the user’s mobile device identification or Android ID, a 64-bit number that is randomly generated when a user initially sets up the mobile devise and remains throughout the device’s lifetime. The Network uses this ID to track the user’s viewing history by making a record of every clip or episode viewed. The Network sends this information to a third-arty data analytics company. This company, Bango, can link an Android ID to a particular person by compiling information about that person from other websites, applications and sources. The Network provided Ellis’ information, the ID, to Bango.
So what’s the problem? In 1988 Congress enacted the Video Privacy Protection Act (VPPA). It was spurred to action when a newspaper published a profile of U.S. Supreme Court nominee Judge Robert H Bork which contained the titles of films he and his family had rented from a local video store (Bork was not confirmed although it had nothing to do with the films he rented). Essentially a piece of privacy legislation, the VPPA prohibits a video tape service provider from disclosing PII about any consumer to a third party (the phrase “video tape service provider” has been construed by courts to mean, among other things, companies that make mobile apps available; the Network in Ellis did not dispute its status as a video tape service provider). 18 U.S.C. Sec. 2710(b). If a company violates this provision of the Act, consumers can seek and recover damages of at least $2,500 along with additional punitive damages, attorneys’ fees and costs and secure injunctive relief.
The Act also defines PII as information that identifies a person as having requested or obtained specific video materials from a video tape service provider. 18 U.S.C. Sec 2710(a)(3).
Ellis sued the Network alleging violation of the VPPA. He claimed he was a subscriber to the Network. The trial court held that he was a subscriber noting that a subscriber does not have to be a paying customer or create an account with the app owner. But the court also ruled that the Android ID corresponding to Ellis’ phone was not PII because it did not link Ellis to particular video materials he may have downloaded through the app.
The 11th Circuit disagreed, holding that Ellis was not a subscriber. It, therefore, did not have to reach the second issue of whether Ellis could be linked through his ID to particular video materials he may have downloaded.
The appellate court noted that the VPPA does not define the term “subscriber.” It noted that courts seemed to be divided on the definition. So the court turned to the dictionary. The court noted that some definitions state that a subscriber is someone who makes a payment of some sort but added that not all definitions do so. The court cited Webster’s Third New International Dictionary for the following subscriber definition: “one that favors, aids or supports (as by money, contribution, moral influence, [or] personal membership)”.
The court agreed with the trial court that payment is not necessary for someone to label a subscriber especially since the work “paid” does not precede the word “subscriber” in the VAA. But the court noted that the word “subscription”; always involves some type of “commitment, relationship or association (financial or otherwise) between a person and an entity.” But people who simply use an app do not fit within that understanding of subscription.
Here, the court noted several things Ellis did not do. He did not
- sign up or establish an account with the Cartoon Network,
- provide any PII to the Network,
- make payments to the Network for use of the app,
- register to use the app,
- get a Network ID,
- establish a Network profile,
- sign up for any periodic services or transmission and
- make any commitment or establish any relationship that would allow him to have access to exclusive or restricted content.
Ellis could have deleted the app without consequence. The appeals court found that downloading the app under these circumstances was like adding a particular website to an Internet browser as a favorite.
Since Ellis was not a “subscriber” as that term is used in the federal law, the Cartoon Network was free to share any PII they were able to glean from Elli’s use of the app. So beware what you download; don’t be enticed by the fact that there’s no subscription fee. You use of that app which has been so generously “donated” by some app developer may lead to the gathering and use of your PII without your knowledge and especially without your permission.