The New England Patriots are famous for studying film, but a privacy lawsuit asked a different question: who was studying the fans watching that film? A federal class action alleged that the team’s mobile app disclosed information about users’ video viewing, device identifiers, and precise location to third-party technology providers without the consent required by the Video Privacy Protection Act, or VPPA.
The case, Serra v. New England Patriots LLC, ended in a $2.16 million settlement that received final approval in November 2025. The Patriots denied violating the law, and the settlement was not an admission of wrongdoing. Even so, the agreement matters far beyond Foxborough. It shows how an ordinary sports app can become the center of a serious privacy dispute when video analytics, advertising tools, and location services all join the same huddle.
The Patriots VPPA Settlement at a Glance
The lawsuit was filed in the U.S. District Court for the District of Massachusetts by Anthony Serra in February 2024. It claimed the Patriots App transmitted personally identifiable information to third parties through Google’s Anvato technology and Rover’s software development kit. The alleged disclosures connected video activity with data such as precise geolocation, advertising identifiers, or unique device identifiers.
The parties eventually agreed to create a $2.16 million non-reversionary settlement fund. Eligible class members who submitted valid claims were entitled to equal, pro rata shares of the net fund after court-approved fees, expenses, administration costs, and the class representative’s service award were deducted. The final individual payment was not guaranteed in advance because it depended on the number of approved claims.
The court granted final approval on November 14, 2025. It approved $720,000 in attorneys’ fees, $39,855.06 in litigation costs and expenses, and a $5,000 service award for Serra. The order also noted that no class member filed a formal objection or requested exclusion. The claim deadline was November 23, 2025, so the settlement is no longer open for new claims.
How the App Data-Sharing Lawsuit Began
Serra alleged that he downloaded the Patriots App, watched football-related videos, and did not know that information tied to his viewing activity was allegedly being sent outside the app. His complaint focused on the combination of three types of information: what a user watched, a persistent identifier associated with the user or device, and precise location data.
Google Anvato and Video Delivery Data
Anvato is a video platform used to deliver and manage streaming content. According to the complaint, an analysis of the app’s network traffic indicated that the app sent information through Anvato that could reveal the specific video a user opened. The plaintiff also alleged that location and advertising-related identifiers could travel with or alongside that activity.
That combination was the heart of the privacy theory. A video title by itself may look like a harmless line in a server log. A device identifier by itself may resemble random alphabet soup. A set of coordinates may appear to be just numbers. Put them together, however, and the data can begin to tell a much more personal story: a particular device, at a particular place, requested a particular video at a particular time. That is a lot of baggage for a button labeled “Watch.”
Rover SDK and Precise Geolocation
The complaint also discussed Rover technology embedded in the app. It alleged that Rover received unique device information and titles of content viewed. For part of the relevant period, the filing claimed, precise location information was also transmitted when location services were enabled.
The Patriots disputed the allegations and moved to dismiss the complaint in April 2024. While that motion remained pending, the parties exchanged information about how the app worked, the third-party tools involved, and the potential size of the class. They reached an agreement in principle in January 2025, formally documented the deal in May, and obtained preliminary approval later that month.
Why a 1988 Video Privacy Law Applies to a Football App
The VPPA was enacted in 1988 after a newspaper obtained and published the video rental history of then-Supreme Court nominee Robert Bork. Congress responded with a law restricting a video tape service provider from knowingly disclosing personally identifiable information about a consumer’s video choices without an applicable exception or valid consent.
The statute sounds as though it belongs beside a rewinding machine and a stack of late-fee receipts. Yet its language reaches “similar audio visual materials,” and courts have spent years deciding how its terms apply to websites, streaming platforms, newsletters, mobile apps, pixels, APIs, cookies, and software development kits. The VHS shelf is gone; the privacy question is very much alive.
What Counts as Personally Identifiable Information?
Under the VPPA, personally identifiable information includes information that identifies a person as having requested or obtained specific video materials or services. Modern disputes often turn on whether digital identifiers can actually identify an ordinary person, whether the recipient can connect those identifiers to an individual, and whether the disclosed information reveals a specific video rather than general browsing behavior.
The Patriots case carried extra significance because it arose in the First Circuit, where earlier litigation involving a mobile news app addressed the combination of video titles, GPS coordinates, and an Android advertising identifier. That background gave both sides real litigation risk. The plaintiff still had to prove the statute covered the conduct, while the Patriots had substantial defenses concerning identification, consent, statutory definitions, and how the technologies operated.
Why Consent Is More Than a Privacy-Policy Paragraph
VPPA-compliant consent is unusually specific. It must be informed, written, and presented separately from other legal or financial obligations. It may be obtained at the time of disclosure or in advance for a limited period, and users must receive a clear opportunity to withdraw ongoing consent.
In practical terms, burying a broad statement on page 38 of a privacy policy may not solve the problem. Companies that connect video viewing with third-party analytics need to examine not only what their policy says, but also what the app actually transmits, when it transmits it, why the recipient receives it, and whether the user gave legally sufficient permission.
What the $2.16 Million Settlement Required
Cash Relief for Approved Claims
The Patriots agreed to fund $2.16 million in cash. After authorized deductions, the remaining amount was to be divided equally among class members with approved claims. Payment options included PayPal, Venmo, or a paper check. Early filings illustrated how a payment might be calculated under assumed participation rates, but those examples were never guaranteed payouts.
The class generally covered U.S. residents who used the Patriots App with location services enabled and requested or obtained prerecorded videos, including on-demand replays, from February 1, 2022, through May 30, 2025. Live video alone was not the defining criterion; the settlement language focused on prerecorded content.
Changes to App Data Transmissions
The agreement also included prospective relief. The Patriots were required to suspend any known transmission of precise geolocation data through the Anvato API or Rover SDK in connection with a user’s viewing of prerecorded video, subject to specified legal and technical conditions.
Those conditions matter. The restriction could change if the VPPA were amended, repealed, or invalidated; if controlling courts ruled that the relevant geolocation was not personally identifying; if the disclosure no longer identified specific prerecorded videos; or if the Patriots obtained VPPA-compliant consent. In other words, the settlement did not ban analytics forever. It required the app’s practices to stay on the correct side of the law or obtain the kind of consent the law demands.
No Admission of Wrongdoing
The Patriots consistently denied the allegations. Settlement agreements routinely include this language because defendants may prefer a predictable resolution to the cost and uncertainty of class certification, expert discovery, summary judgment, trial, and appeals. A settlement proves that a dispute was resolved; it does not automatically prove the allegations were true.
The court approved the agreement as fair, reasonable, and adequate after reviewing the notice program, proposed relief, and litigation risks. It then dismissed the case with prejudice while retaining authority to oversee implementation of the settlement.
Why the Case Matters to Sports Teams and App Developers
Professional sports organizations increasingly operate as media companies. Their apps stream interviews, press conferences, highlights, documentaries, replays, and behind-the-scenes programming. They also sell tickets, guide fans through stadiums, send location-based offers, support loyalty programs, and measure engagement. That creates a powerful data ecosystemand a very crowded locker room of vendors.
A team may integrate one provider for video delivery, another for mobile engagement, another for advertising attribution, another for push notifications, and still another for analytics. Each component may be legitimate on its own. Trouble begins when the combined data flow reveals more than anyone intended or when a vendor receives information that was never necessary for its assigned job.
The Patriots settlement is therefore a warning about software supply chains. A privacy review cannot stop at the app’s visible screens. Developers and legal teams need to inspect network calls, default SDK settings, permission prompts, event names, URL parameters, advertising identifiers, and data retained by third parties. “We did not mean to send it” is not a particularly inspiring defensive strategy after a packet capture says otherwise.
Practical Compliance Lessons
Companies offering video inside an app should create a data map that follows each viewing event from the user’s tap to every external destination. Precise geolocation should be disabled unless it is genuinely necessary, and video analytics should be separated from advertising identifiers whenever possible. Contracts should define what vendors may collect, use, retain, and combine.
Consent screens should also be clear enough for a normal person, not merely survivable by a team of privacy lawyers armed with espresso. Users should understand whether their video activity will be linked to location or advertising data, who will receive it, and how to withdraw permission. Regular testing is essential because SDK updates can quietly change data flows even when the app’s interface looks identical.
What App Users Can Learn From the Settlement
Fans do not need to abandon every team app or conduct forensic analysis during halftime. They can, however, make a few sensible choices. Review location permissions and select “Only While Using” or deny access when location is unnecessary. Reset or restrict mobile advertising identifiers where the operating system permits it. Check whether the app offers privacy choices for analytics or targeted advertising.
It is also worth remembering that deleting an app stops future use on that device but does not necessarily erase information already collected. Users may need to submit a separate deletion or privacy request, depending on the company’s policies and applicable state law. Permission settings are not exciting, but neither is discovering that a highlight clip brought three analytics vendors along for the ride.
A Fan’s Experience: What App Tracking Can Feel Like in Real Life
Imagine a Patriots fan named Jordan preparing for Sunday’s game. Jordan opens the official app to watch a prerecorded injury update, checks a replay from the previous week, and reads a stadium guide. The app asks for location access because it offers venue directions and game-day features. Jordan taps “Allow While Using App,” a familiar choice that feels narrower and safer than permanent access.
From Jordan’s perspective, the interaction is simple: open app, watch clip, close app. Nothing on the screen looks unusual. There is no dramatic warning saying, “Your viewing event may now be paired with precise coordinates and a device identifier.” The technology works quietly, which is exactly why these cases can surprise users. The data-sharing experience is not like handing a stranger a folder. It is more like leaving faint footprints that several systems can collect and compare.
Later, Jordan notices Patriots-related ads in other places. That does not prove the app disclosed protected information; advertising can be triggered by many signals, including searches, websites, general interests, or broad location. Still, the timing makes Jordan curious. A quick visit to the phone’s privacy dashboard shows that the app accessed location recently. Jordan changes the permission to “Never” outside game days and turns off personalized advertising where possible.
The most frustrating part is uncertainty. A privacy policy may describe categories such as identifiers, usage data, geolocation, service providers, and business partners without showing the exact packet that left the phone after a particular video played. Jordan can understand each word and still struggle to picture the combined result. That gap between formal disclosure and practical understanding is one reason consent remains such a contested issue.
Now consider the company’s side. The product team may have added a video platform to make clips load smoothly and an engagement SDK to send useful stadium notifications. The marketing team may have wanted campaign measurement. No single employee necessarily decided to create a detailed profile of Jordan. Yet software integrations can combine fields automatically, and default configurations can be surprisingly chatty. Privacy failures often emerge from systems, not cartoon villains twirling mustaches in a server room.
A better experience would be easy to recognize. The app would request location only when Jordan uses a location-dependent feature. A separate, plain-language prompt would explain any connection between video activity and third-party analytics. Nonessential tracking would remain off unless Jordan actively agreed. The settings page would let Jordan reverse that choice without hunting through a maze designed by an escape-room enthusiast.
The practical lesson is not that every data transfer is unlawful. It is that trust depends on alignment: the app should collect what users reasonably expect, disclose it clearly, limit it to a genuine purpose, and obtain the right consent when sensitive combinations are involved. Fans came for football, not a graduate seminar in mobile advertising architecture. The closer an app gets to honoring that expectation, the less likely its privacy practices are to become the next headline.
Conclusion
The Patriots VPPA class action turned a routine mobile experience into a major lesson about modern video privacy. The $2.16 million settlement resolved allegations that the Patriots App connected prerecorded video viewing with precise geolocation and device-related data sent to third-party tools. The Patriots admitted no wrongdoing, but the agreement provided monetary relief, required limits on certain data transmissions, and ended the litigation after final court approval.
For app operators, the message is straightforward: inventory every tracker, test actual network traffic, minimize location collection, and obtain consent that matches the law rather than merely decorating a privacy policy. For users, the case is a reminder that app permissions deserve occasional attention. The VPPA may have been born in the age of videotapes, but it can still throw a very modern penalty flag.
