Katherine Forrest: Oh so, actually, you'd think I was away forever. I was not away forever. But I think I know what you are going to talk about. You're going to talk about the White House and some recent news on AI.
Scott Caravello: Exactly. And so you've been saying for a while, and I remember last year at about this time, that there was likely to be some form of federal preemption for AI, and that would be the preemption of state AI laws and regulation.
Katherine Forrest: And that, that didn't really happen. In fact, it didn't happen at all. We thought for a little while that there'd be a moratorium on the enforcement of state AI laws as part of the budget bill, you know, what people in Washington were calling the one big, beautiful bill.
Scott Caravello: But that got taken out before it was passed. And so while you were gone...
Katherine Forrest: I mean, I—again, I wasn't gone for that long, although I was eating a lot of cheese pie.
Scott Caravello: Well, it turns out it was just long enough, just a few days ago.
Katherine Forrest: All right, it's actually—just for the audience to put things in context—we're taping this on November 21st.
Scott Caravello: Right, right. So just a few days ago, the White House announced that it might issue an executive order that would be aimed at those state-level AI laws. And since everything comes back to the AI action plan, this is a follow-on to that document that the White House issued in July of 2025.
Katherine Forrest: As part of that action plan, the AI action plan, there's a provision that says if state-level AI laws are going to get in the way of innovation that the federal government was trying to provide a smooth path for, that those who felt that things were being interfered with could approach the states, and then there could be a request for assistance of some kind from the federal government.
Scott Caravello: Yeah, and so the White House announced that they may form a task force that would potentially launch challenges to state laws or could withhold federal funding, which, as you remember, was the lever that had been part of that failed legislative moratorium over the summer, but the executive order might even seek passage of a single federal standard on AI, potentially by the Federal Communications Commission. And so a draft of the executive order was released, and it was entitled “Eliminating State Law Obstruction of National AI Policy.”And it's even been floated that the crucial elements would be part of a must-pass defense bill.
Katherine Forrest: It sort of tells you the whole concept in the title there, Eliminating State Law Obstruction of National AI Policy. And, of course, that policy is the AI action plan that we were just talking about, which had as its stated goal the intent to win the international race for dominance in AI. And, it's not all smooth sailing, even though that executive order came out while I was gone eating cheese pie in Serbia, which is incredibly good. But there have been a whole group of senators that have included Senator Warren, Blumenthal, Markey, Wyden, Van Hollen, Sanders—you know, whole crowd of folks—who have been rallying behind an effort to try to do a couple of things: 1. try to prevent this executive order, but also that have been—they've been really speaking about getting information from the federal government about how much AI data centers are causing electricity bills to rise. I haven't seen any data that actually causally ties rising electricity bills to these data centers, but that is right now what a bunch of these senators are pursuing. So, you know, we've got that effort in the works.
Scott Caravello: Yep, so we'll see how this plays out and what's eventually issued.
Katherine Forrest: Yeah, interesting, interesting stuff. So I'm particularly interested in, if they do do some sort of federal law and they actually pass it through the legislature, what it would be. I sort of imagine it would need to be some sort of light-touch law with little regulation, maybe some principles and things like that. But, you know, who knows? So there we'll—we'll come back to that in future episodes. But let's move on then to the topic of the day, which is the V.P.P.A., the Video Privacy Protection Act.
Scott Caravello: Absolutely, and so the VPPA is an old law that's been on the books since the 1980s.
Katherine Forrest: Yeah, you know, it was originally passed as sort of an analog privacy law that penalized revealing the kinds of videos—the titles of videos—that a person rented from those old VHS rental stores like Blockbuster, although it could also have been DVDs, you know, but that was sort of the original derivation of the law.
Scott Caravello: Right, so there was a concern that what people rented could reveal things about them that were private and not intended for the public to know about. So the VPPA was passed to set up a regulatory scheme that penalized a videotape service provider who knowingly disclosed to any person personally identifiable information concerning any consumer.
Katherine Forrest: Right, and that's four phrases to pause on right there that I think really sort of underlie what we're about to get to, which is a bunch of cases that have been filed in this area. The first of the phrases is a videotape service provider. The second is the concept of knowing disclosure or knowingly disclosing. The third is PII or personally identifiable information, and the fourth is consumer. And we're going to come back to those. But one of the reasons I think the VPPA has really reared its head now in this new digital era is that it provides for actual damages, but not less than $2,500. So it's got sort of a floor, but not a ceiling. And then it actually has the possibility of punitive damages and the provision for an award of attorney's fees. As somebody who is a former federal judge and has dealt with statutes that have provisions for attorney's fees—you know, when a statute provides for that, it's a signal to lawyers to go ahead and get on board and to bring suits to enforce the statute, and many of them do.
Scott Caravello: Absolutely. And so you would think that since VHS tapes and video rental stores are all gone, that this law would have floated into obscurity.
Katherine Forrest: Yup, but no.
Scott Caravello: But no, it turns out that there are certain AI technologies that relate to tracking what video content an individual might see on a website, right? Either intentionally because they're seeking it out or unintentionally because they're looking for something else. And so there have been some lawsuits popping up claiming these AI tracking technologies violate the VPPA.
Katherine Forrest: It seems a little far afield, you know, the way these current cases are poking at the VPPA, given its origin in the time of VHS. But let's pause first on what kind of AI technology the lawsuits are claiming can violate the VPPA and, we know that it's possible to track what consumers do on websites—which websites they visit, for how long, how they interact with them.
Scott Caravello: Yeah, and so that's part of what gave rise to some of the requirements that if a website uses tracking cookies, that they disclose the use of those cookies and let the website visitor choose to accept some, all, or none.
Katherine Forrest: All right, and so when you get those, like, consent to the cookies, don't consent to the cookies, modify my preferences—which would send you off on a goose chase with a hyperlink—like, what do you do, Mr. Caravello? What are you—a cookie acceptor or a cookie denier?
Scott Caravello: Putting me on the spot, I would say 90% of the time I'm accepting all cookies, and then the 10% of the time where, you know, I'm being very diligent about what data I'm giving up, I might do only those that are necessary.
Katherine Forrest: You know, I accept the cookies too. And it's funny, I'm sure there are all kinds of studies out there about people's, you know, preferences and how many people accept cookies or don't, but I wonder if most people go ahead and just accept the cookies. But let's pause on what cookies are for a moment because they're kind of a relative
Scott Caravello: Like a second cousin.
Katherine Forrest: Well, like a second cousin or a first cousin—once removed, something like that—they're a relative of what we're gonna be talking about here, because website cookies are code. They're small text files, but they're not executable files. And so what they're doing is they're storing information about you. They are not AI, right? Cookies are not considered to be AI. They'll store information about you in this little text file, this little teeny-weeny text file, about, like, your login status, how long you visit a site, you know, what you navigate to, what's in your shopping cart—stuff like that. And it's tracking data that is usually used for direct advertising, to measure audience, and things like that.
Scott Caravello: Absolutely. So the first thing that happened was that there were some VPPA cases about web tracking generally, but those were met with mixed success.
Katherine Forrest: Right, and we'll get into how the law has developed, but let's pause on that newer AI angle, because we know that these older cookies now—they're not AI. So how does the AI get in there?
Scott Caravello: Right, so there are new ways to collect data about a website viewer's activities that do involve AI. And so these are types of AI fingerprinting, cross-device graphing, AI-enhanced contextual tracking, and most of all, there are pixels that are like cookies that are more often used. But really, most of the time, AI at issue under the VPPA these days is happening behind the scenes. It's the collection of information that's being gathered by the pixels that are tracking the user, and then that information is run through machine learning or AI algorithms.
Katherine Forrest: Right, and the issues that are being raised now about AI and the VPPA concern the analytical use of the information that's used, among other things, and the fact that if a collector or aggregator is able to collect enough information about a person, they can build a profile about him or her—you know, how long they're watching, what they're watching, how they interact with things. And so what's interesting is, in a way, the VPPA has gotten new life because there are these AI technologies that are using these pixels that are run through these machine learning algorithms. I don't know that the plaintiffs' lawyers care about the AI, frankly, that is behind the VPPA. What they care about is the ability to try and take some form of a tracker and to try to make a case out of it.
Scott Caravello: It's a great point. But there have been a few cases in the AI era, though, that have sought to make that combination of tracking and machine-learning analytics fit into the VPPA framework. Though, as you noted, not–not clear that that AI fact really matters that much to them.
Katherine Forrest: Right, and there are a couple of issues, I think, for our audience that are worth pausing on. And we're going to talk about 2025—a bunch of cases that have been dealing with these issues. And so I just wanted to point that out because it really shows how current these cases are. And the first has to do with, is there a consumer, as the statute, the VPPA, intended that term to be defined? So remember, when the VPPA was passed, a consumer went to a local VHS store and actually rented a tape. And now someone might find themselves on a website and be reading an article, and there might be a video playing on the left-hand side or the right-hand side or the top banner or the lower part of the screen. And part of the question that at least some of these cases is raising is that, is that person now a consumer as the VPPA intended? And just this year, the Seventh Circuit reversed a dismissal of a case where the key issue was whether the viewers of a video streaming service were consumers under the VPPA. In that case, the viewers were subscribers of a service, and pixels collected information about their viewing habits. And this was a service that actually was a subscription service for classic video programming. And the pixels did collect information about the individuals, and it then was sent to a social media company to advertise. And that's actually how this classic video programming service made its money. It didn't make its money through subscription fees. And so the court said, even though the lower court actually then dismissed the case and said there's no consumer here, the appellate court said that you didn't have to pay for your subscription with money. You could actually just give something of value, such as, for instance, a zip code or other kinds of PII. And that's the Gardner vs. MeTV, M-E-TV case of 2025. But it's not been universally followed, or at least different fact patterns have led to different results, because the Sixth Circuit, in a case called Salazar vs. Paramount Global—in that case, the Court of Appeals affirmed a dismissal for a digital subscriber who'd filed a lot of these are putative class actions on the basis that he was not a consumer under the statute because he had, in fact, signed up just for a newsletter that had some videos. But it wasn't a video website. So it wasn't sort of analogous to just a digital, you know, Blockbuster store, if you will. And because he was not a subscriber to an audiovisual site but to a site that was like sort of a newsletter site that had audiovisual material, the Sixth Circuit affirmed a dismissal that he was not a consumer, and that was the Pelagi vs. Washington Newspaper Publishing Company case, also of 2025. I'm gonna do one more. Getting sick of me. I tell you, it's all the cheese pie. If you eat a lot of cheese pie from Serbia, it actually allows you just to go on and on. You can really—you just pack that information in your head. The cheese causes it to stay in your head in this extraordinary way. I'm like, I've been made a genius for a short period of time.
Scott Caravello: I’m starting to get a little insulted that you didn’t bring any back.
Katherine Forrest: Well, I don't think they are allowed. I think they have, like, those signs, and customs is like, you know?
Scott Caravello: No cheese pie?
Katherine Forrest: They have a special one that says no cheese pie, right? But boy, I would have brought it back. But anyway, the second issue that's been coming up in these cases is who or what is a videotape service provider? Because, again, the VPPA was about renting pre-recorded videos. And so these cases—some of these cases—are asking: does a website that's displaying all kinds of content, but not just video content—does that constitute a videotape service provider? So there's this Ninth Circuit case, also from 2025, in which an individual purchased a movie ticket—so it did relate to videos, so to speak. It was a movie ticket on a theater operator's website, and certain information about that individual was sent to a social media site, and it included the name of the film. It did not include the individual's name, but included a unique purchase ID. And the case was dismissed both in the lower court and in the Ninth Circuit without leave to amend on the basis that the theater operator was not a videotape service provider. And that's the... Oshesky vs. Silver Cinemas case. Again, all of these are from 2025, so this is a hot current issue. And, you know, there are some takeaways here for companies that might be in the business of using pixels and also, you know, sophisticated algorithms that are analyzing information that's gathered. And the key question comes down to how much you can tell about a person's video-viewing habits.
Scott Caravello: Totally, and so companies that are using video tracking should look carefully at the combination of what they're collecting and how they analyze it to be sure that PII that can be associated clearly with the viewing habits of a particular person should be avoided and aggregate. And so it just shows that aggregated and anonymized data is the safer course.
Katherine Forrest: Right, and then, of course, something that's also really useful to stay on top of is consent, because you can use consent that you obtain in a variety of ways to get around—or I wouldn't say get around; it's not sort of avoiding it in some nefarious way—it's just not being on the hook for...an improper disclosure. So getting consent is also something that people can really stay on top of.
Scott Caravello: Well, all important considerations, and, like with so many other laws, when they intersect with AI, the questions and issues will continue to change as the tech also continues to evolve.
Katherine Forrest: Exactly, and that's all we have time for today, Scott. I'm Katherine Forrest.
Scott Caravello: And I'm Scott Caravello. Thanks for joining us, and don't forget to like and subscribe.
Katherine Forrest: And I would suggest that if you have time to go to Serbia and get a cheese pie, that you do so.
Scott Caravello: Alternatively, if any listeners in New York City have suggestions for where to go to get the cheese pie, please reach out.
