## Facts

- Redbox rented physical DVDs and Blu-ray discs through self-service kiosks, typically located at or near retail establishments.
- To complete a rental, customers used a touchscreen, selected titles, swiped a payment card, and could optionally provide an email address.
- During checkout, customers had to click an on-screen box indicating acceptance of Redbox’s Terms of Use and Privacy Policy, which were available to view.
- The Terms of Use incorporated the Privacy Policy by reference.
- The Privacy Policy disclosed that Redbox collected and used customer information to process transactions, personalize services, and for sales and marketing, and that it could share information with third parties for service-related purposes.
- Redbox shared customer email addresses and rental information with third-party vendors to provide services such as email receipts, analytics, marketing, and customer service (including vendors identified as ExactTarget, Experian, Adobe, and Stream).
- Plaintiffs brought a putative class action alleging that these disclosures violated Michigan’s Video Rental Privacy Act (VRPA) and also constituted breach of contract and unjust enrichment.
- The parties filed cross-motions for summary judgment.

## Issues

1. Whether Redbox’s disclosures of customer identifying information and rental records to third-party service providers violated Michigan’s VRPA, or were permitted because customers gave written consent through acceptance of the Terms of Use and incorporated Privacy Policy.
2. Whether customers were bound by the kiosk click-through Terms of Use and Privacy Policy (including the effect of an Illinois choice-of-law clause and arguments based on Michigan’s UETA).
3. Whether Redbox’s disclosures constituted breach of contract or unjust enrichment given the disclosures and permissions stated in the Terms of Use and Privacy Policy.

## Decision

- The court granted Redbox’s motion for summary judgment and denied plaintiffs’ motion for partial summary judgment.
- The court held the VRPA claim failed because plaintiffs consented to the disclosures by accepting the Terms of Use, which incorporated a Privacy Policy authorizing the challenged sharing for vendor-provided services.
- The court upheld enforceability of the click-through agreement and treated electronic assent as sufficient written permission for VRPA purposes under the governing law.
- The court rejected the breach-of-contract claim because the Terms of Use and Privacy Policy disclosed and allowed the complained-of uses and disclosures.
- The court rejected unjust enrichment because an express, valid contract governed the subject matter and Redbox’s conduct was consistent with the parties’ agreement.

## Legal Principles

- A statutory prohibition on disclosure of video-rental records is not violated where the customer provides written permission; click-through acceptance of terms incorporating a privacy policy can satisfy that consent requirement when the disclosures are stated.
- A click-through process requiring affirmative assent can form a binding agreement when the terms and incorporated privacy policy are presented in a manner allowing review.
- Where the operative contract expressly authorizes the defendant’s use and disclosure of customer data for identified purposes, a breach-of-contract claim based on those disclosures fails.
- Unjust enrichment generally does not lie when an express contract governs the same subject matter, and cannot be used to override conduct permitted by the contract.

## Conclusion

The court entered judgment for Redbox, holding that customers’ click-through acceptance of the Terms of Use and incorporated Privacy Policy provided written consent for vendor-related disclosures under Michigan’s VRPA and foreclosed parallel contract and unjust-enrichment theories based on the same disclosed practices.


Cain v. Redbox Automated Retail, LLC, 136 F. Supp. 3d 824 (E.D. Mich. 2015)