Class Action Alleges NFL App Secretly Disclosed User Info to Google, Other Third Parties

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action alleges NFL Enterprises LLC has unlawfully disclosed to unrelated third parties the personally identifiable information of NFL app users, including a record of every highlight, live game and replay a person has viewed through the app. 

The 17-page complaint alleges NFL Enterprises has run afoul of the Video Privacy Protection Act (VPPA), a law that prohibits a “video tape service provider” from knowingly disclosing any personally identifiable information about any consumer of the entity’s videos. Personally identifiable information includes information that identifies someone as having requested or obtained specific video materials or services from a video tape service provider, the lawsuit states. 

Similarly, a law specific to Rhode Island, the state’s Video, Audio, and Publications Rentals Privacy Act, prohibits any person from revealing, transmitting, publishing or disseminating in any manner any records that would identify the names and addresses of individuals “with the titles or nature of video films … or the like” that they purchased, leased, rented or borrowed, the case adds.

According to the suit, the NFL app does not at any point request permission from a user to share their location or video viewing information with any third party, nor does NFL Enterprises “disclose this at any point” to users. 

The suit claims the plaintiff’s counsel retained a private research company last summer to conduct a dynamic analysis of the NFL app. That analysis, centered on the app’s source code, revealed that NFL Enterprises, through the use of multiple application programming interfaces (APIs), transmits information that could sufficiently identify NFL app users and the videos they watch to an unrelated third party, the case alleges.  

Per the filing, APIs enable companies to open their apps’ data and functionality to external third-party developers or business partners, including Google Analytics, who might seek to use a company’s data and any insights gained for other purposes: 

“When developers, like Defendant, integrate the Google Analytics API into their applications, Google will ‘create reports to answer questions like: How many daily active users has my Android app had in the last week? How many page views has each of the top 10 page URLs for my site received in the last 28 days?’ In exchange, Google retains and repurposes data the application transmits, which Google then uses to support other ventures, like targeted advertising.” 

The lawsuit says NFL Enterprises integrates into the NFL the Anvato API, which is owned by Google. When a user enables location services on their device, NFL Enterprises “allows Google, through the Anvato API, to access a user’s geolocation and advertising ID, and unique video identifier of the video(s) viewed by the user,” the suit claims. 

The complaint alleges NFL Enterprises partners with Google because its analytics services offer insights into the behaviors and demographics of the NFL App’s user base and helps the defendant accurately target advertisements. 

Given Google’s “omnipresence” across the internet, the company can associate a user’s advertising ID with their corresponding Google profile and then use that aggregated information to identify a particular person, the lawsuit alleges.

The case looks to represent all persons in the United States who used the NFL App with location services enabled to watch videos and had their personally identifiable information transmitted to a third party.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here