USA – U.S. District Court for the Southern District of New York allows NY Times AI case to go forward; denies motion to dismiss case as time-barred.
The New York Times Company v. Microsoft Corporation – Civil Action No. 23-cv-11195 (SHS) (April 4, 2025). The U.S. District Court for the Southern District of New York decided the defendants’ motions to dismiss in the New York Times’ high-profile case against Microsoft and OpenAI, allowing the plaintiffs’ copyright claims for direct infringement and contributory infringement to move forward. The complaint accuses the defendants of using millions of New York Times articles without permission in order to train their language learning models (“LLMs”) and to develop OpenAI’s artificial intelligence platform, ChatGPT, and Microsoft’s AI platform, Copilot. Plaintiffs allege that defendants sought to “free-ride on The Times’s massive investment in its journalism” to build “substitutive products without permission or payment.”
Although the defendants have publicly countered that their use of news articles is protected by fair use, their motions to dismiss did not raise that issue and instead raised a statute of limitations defense. The defendants argued that claims involving conduct occurring more than three years prior to the filing of the complaint are time-barred under 17 U.S.C. § 507(b). The Court held that, although the defendants were training the LLMs for their AI platforms in 2019 and 2020, the defendants failed to show that plaintiffs “discovered, or with due diligence should have discovered” that any infringement was taking place over three years before they filed their complaint in December 2023. The defendants also moved to dismiss plaintiffs’ claim for alleged contributory infringement on the basis that the defendants’ AI platforms had been used to generate output that reproduced the plaintiffs’ articles verbatim or nearly verbatim. The parties clashed over the appropriate standard for establishing whether defendants knew end users were infringing the plaintiffs’ copyrighted works. While the plaintiff maintained that the standard is actual or constructive knowledge, the defendants urged the court to adopt a higher standard that requires “actual knowledge of or willful blindness to specific acts of infringement.” Applying Second Circuit precedent, the District Court held that the complaint was sufficient in that it plausibly alleged the defendants knew or had reason to know of infringement by end users.
DATA PRIVACY
USA – Virginia Consumer Protection Act Now Includes Private Right of Action for Reproductive Health Data
Businesses operating in the health or wellness sectors should take note. Virginia’s Senate Bill 754, which amends the Virginia Consumer Protection Act (the “VCPA”) and becomes effective on July 1, 2025, will limit the processing of certain sensitive health data, most significantly “reproductive or sexual health information,” in transactions involving Virginia consumers. Virginia Governor Glenn Youngkin signed the bill on March 24, 2025. Now, covered consumer-facing and business-to-business entities are prohibited from “[o]btaining, disclosing, selling, or dissemination any personally identifiable reproductive or sexual health information without the consent of the consumer.” Importantly, the VCPA provides Virginia consumers a private right of action for enforcement.
Information covered under HIPAA and patient records concerning treatment for substance-use disorders are excluded from the VCPA. However, the statute’s category of “reproductive or sexual health information” is broad. It includes information relating to the past, present, or future reproductive health of the individual even if extrapolated from other non-health-related information such as data collected by apps, wearable devices, or other consumer-directed technologies. Without obtaining proper consent from the consumer, such collection or processing may be deemed a violation of the VCPA.
The amendment covers “suppliers,” namely entities that advertise, solicit, or engage (or advertise, sell, lease, or license goods or services to be resold, leased, or sublicensed) in consumer transactions. Unlike Virginia’s comprehensive privacy law , the VCPA covers businesses regardless of the number of Virginia consumers whose data it collects and regardless of whether it is solely a business-to-business operation. Consequently, this general consumer protection statute affects significantly more businesses than the state’s comprehensive privacy law.
The VCPA amendment underscores a notable and growing legislative trend at the state level to empower consumers to hold businesses accountable for privacy infringements related to health data. The amendment is generally modeled on Washington State’s 2023 My Health My Data (“WMHMD”) Act, which prohibits the unauthorized processing of sensitive health information not otherwise covered by HIPAA and provides consumers a private right of action regarding such processing. Nevada, Connecticut and, now, Virginia join Washington in specifically regulating health data from a privacy perspective. A proposed bill in Minnesota, if signed, would amend that state’s comprehensive privacy law (effective July 2025) to incorporate a notably broad definition of health data subject to heightened regulation as sensitive data. We anticipate that still more states will follow, enacting or amending similar laws and regulations.
Takeaways: For companies processing data associated with reproductive or sexual health of Virginia consumers, the VCPA’s expansion presents both regulatory compliance and litigation risks, particularly because enforcement may be initiated by consumers through civil litigation. At a minimum, companies should review the data they process to determine whether any falls within the broad definition of “reproductive or sexual health information,” even indirectly or by inference. If so, companies should review their data processing and privacy practices to mitigate such risks. For example, they should consider (i) conducting data mapping exercises to identify where and how health data is stored and flows through internal systems; (ii) updating their privacy notices; (iii) performing regular privacy impact assessments and internal employee trainings on the proper handling of sensitive health information; and (iv) implementing appropriate consent mechanisms for the collection and processing of health data covered by the VCPA and other applicable laws.
USA – Circuit Circus – Split Among Video Privacy Protection Act Decisions Emerges
The federal Video Privacy Protection Act (“VPPA”) was originally enacted in 1988 in the wake of a reporter’s disclosure of Supreme Court nominee Robert Bork’s video rental history. The statute was intended to protect personal privacy over one’s rental, purchase, or delivery of audiovisual materials from a video tape service provider (such as the erstwhile Blockbuster franchise). Three recent appellate decisions in the Second, Sixth, and Seventh Circuits have revealed a circuit split over whether the VPPA’s scope includes the viewing of internet videos.
In particular, the circuit courts differently interpret key terms in the statute, such as “consumer,” subscriber,” and “goods and services,” including as to whether a website user must make a monetary payment to be deemed a subscriber, whether a subscriber to an online newsletter is a consumer under the statute, and how related a defendant’s goods and services need be to the video content offered on its website. The result is an uneven national landscape of VPPA litigation.
In March 2025, the Seventh Circuit in Gardner v. MeTV addressed the district court’s dismissal of a putative VPPA class action brought by visitors to MeTV’s website. The plaintiffs viewed videos on the site and signed up, without cost, to receive additional website features. They provided an email address and zip code. This information was not required to view the videos, only to access the optional “extras.”
Plaintiffs alleged that MeTV disclosed their personally identifiable viewing information to Facebook through use of the Meta pixel. The Meta pixel is a tracking technology Facebook uses widely to serve targeted ads. In the Seventh Circuit’s view, consumers who provided their email address and zip code created the requisite “subscriber” relationship, especially given that, as the court interpreted the VPPA, no monetary exchange is needed to become a subscriber and the personal information provided sufficed as an exchange for value. The court also held that the goods or services to which a user subscribes need not be video-related, provided that the defendant can be deemed a video tape service provider, which the court here held was adequately alleged. Accordingly, the Seventh Circuit reversed the lower court’s dismissal.
The Seventh Circuit’s decision in Gardner found support in the Second Circuit’s December 2024 holding in Salazar v. NBA that a visitor to the NBA’s website who subscribed to the NBA’s email newsletter was a “consumer” for VPPA purposes. The newsletter contained links to video content. However, the videos were also available to non-subscribers and the newsletter itself contained no video content. The Second Circuit also stressed that “good and services” weren’t necessarily limited to audiovisual materials.
In contrast to Gardner and to Salazar v. NBA and a few days after the Seventh Circuit’s decision in Gardner, the Sixth Circuit affirmed a lower court’s far narrower reading of “consumer” under the VPPA. In this putative VPPA class action, Salazar v. Paramount Global, the same plaintiff alleged that his registering for a daily email newsletter on Paramount-owned 247Sports.com facilitated the defendant’s transmission (without consent) of his video-viewing history and Facebook ID to Meta through the Meta pixel on the website. Again, the newsletter in question did not contain audiovisual material. The lower court dismissed the claim with prejudice. The Sixth Circuit affirmed dismissal and held that (a) the “goods and services” in a VPPA action must be audiovisual in nature; and (b) that simply subscribing to a newsletter that does not provide an audiovisual service is insufficient for a plaintiff to qualify as a “consumer” under the VPPA, even if video content is available elsewhere on a defendant’s website.
While it is remarkable that serial plaintiff Michael Salazar created his own split among the federal circuits, the divergent holdings between the Sixth Circuit, on the one hand, and the Second and Seventh Circuits, on the other, pose a challenging environment for companies navigating privacy and ad tech obligations. For now, much depends on where a case is filed, and this unpredictability is likely to continue unless the VPPA is amended to squarely address plaintiffs’ current use of its provisions, or this split reaches the Supreme Court.
Takeaways: Until then, companies that provide video content on their websites should evaluate the tracking technologies they employ, e.g., the Meta pixel, to determine whether any are linked to video-viewing histories passed to third parties. Additionally, if website visitors can create accounts or sign up to receive content (such as newsletters or updates), companies should determine whether any personal data obtained in this manner can be linked to viewing history such that the Second and Seventh Circuits may consider it a “subscription.” And if a company’s website contains videos whose views are tracked and shared, it should consider implementing a robust consent mechanism for the collection and sharing of video viewing history. As VPPA class actions continue to mount, companies should be mindful the statutory damages of $2,500 per occurrence, which can add up rapidly.
INTERNATIONAL
European Union – New Regulation and Directive on Designs – Update
As reported in our February FZLZ Minute, on December 8, 2024, the European Union adopted a new Regulation and Directive on Designs. The first phase of the amendments will become effective on May 1, 2025. Among the many changes in the first phase are (1) a broader definition of “design,” reflecting advances in technology, (2) use of “European Union Design” or EU Design, rather than “Community Design,” (3) adoption of the “D” registration symbol, and (4) broader definitions of “product” including those comprising “spatial arrangements” and consideration of “non-physical” (virtual) forms. For further information, the text of the EU Design Directive 2024/2823 is here, and the text of Regulation 2024/2822 is here. You can also contact us with any questions.
Turkey – Amendments to IP Code for Administrative Revocation of Trademarks
On January 10, 2024, the Turkish Patent and Trademark Office (“Office”) became the sole forum for processing trademark cancellation actions (previously exclusively handled by the IP Courts). And although the Office began accepting “preliminary” requests for revocation as of that date, requests for cancellation were not being processed until March 15, 2025, when amendments to the implementing regulations on administrative revocation of trademarks were finally published. Given the substantial backlog dating back to January 2024 and the need for preliminary review of pre-March 15 applications, there will likely be some delay before the Office begins examining revocation applications on the merits.
Under the new regulation, a revocation application must be filed by payment of official fees (including a filing fee and an escrow fee), accompanied by a form with the following information: (1) registration number and goods/services subject to the request, (2) ID and contact information of applicant or representative, and (3) grounds for revocation (non-use or other). Once notified of the request, the trademark owner will have one month to respond, a period that is extendable by one month. An additional month may be allowed if the Office seeks further information, documents, and/or argument. The decision by the Trademarks Department may be appealed to the Re-Examination and Evaluation Board. Further appeal would need to be to the Ankara IP Courts.
South Korea – Important Reminder: As of July 22, 2025 Opposition Deadline Shortened to 30 Days from Publication
South Korea – Effective July 22, 2025, the deadline for filing oppositions will be shortened from two months to 30 days from publication. Extensions of time to prepare and submit a detailed opposition petition remain unchanged, i.e., an additional 30 days for local opposers and 60 days for foreign opposers. Extensions, however, will be available only if the opposed mark is a national application, not a Madrid extension. Takeaway: Trademark owners active in this jurisdiction should bear this important change in mind when considering publication notices for South Korea.
Singapore – Expedited Track – Faster Adjudication
The Intellectual Property Office of Singapore (IPOS) launched a pilot initiative (effective January 2, 2025) for expediting the handling of certain proceedings before the Registrar of Trade Marks, including opposition, revocation, and invalidation actions. Access to this Expedited Track requires, among other things, the consent of all parties, commitment to shorter deadlines, and limitations on the volume of evidence and length of submissions. In addition, hearings would be granted only in “exceptional cases” but without cross-examination. For now, the new procedure is a temporary trial, and access will be limited to a small number of cases filed in 2025 (we are advised that eight are anticipated), subject to the Registrar’s assessment of suitability. The expedited procedure is expected to result in shorter and less costly proceedings. Takeaway: Whether the new fast track will be incorporated into the regulations will likely depend on feedback from the field as well as the IPOS. We are monitoring this development as it unfolds.