Gannett may have violated a video privacy law by allegedly sending Adobe information about people who downloaded USA Today’s app, a federal appellate court has ruled.

The court’s ruling, issued Friday, reinstates a potential class-action lawsuit filed by Massachusetts resident Alexander Yershov. He alleged in a 2014 complaint that the USA Today app for Android violates the Video Privacy Protection Act by transmitting device identifiers, geolocation data and video viewing history to Adobe. That law prohibits video companies from sharing personally identifiable information about “subscribers” with third parties.

Gannett argued that the case should be dismissed at an early stage for two reasons. The company argued that Android device identifiers — a string of numbers unique to each device — are not personally identifiable information. The company also argued that the video privacy law only applies to users who are considered “subscribers” to a service.

A three-judge panel of 1st Circuit Court of Appeals unanimously rejected both of those arguments.

“The transaction described in the complaint — whereby Yershov used the mobile device application that Gannett provided to him, which gave Gannett the GPS location of Yershov’s mobile device at the time he viewed a video, his device identifier, and the titles of the videos he viewed in return for access to Gannett’s video content — plausibly pleads a case that the VPPA’s prohibition on disclosure applies,” the panel wrote. The ruling reversed a trial judge’s order dismissing the case.

Attorney Jay Edelson, who heads the law firm that represents Yershov, tweeted news of the court’s decision late Friday afternoon. “App developers now in panic mode,” he wrote.

If the ruling stands, it could affect a broad array of app developers, University of Minnesota law professor Bill McGeveran.

The decision makes it “very easy to come under the Video Privacy Protection Act, provided you have any video content,” McGeveran says. “You don’t have to know the names of the people who are using your app in order for them to be subscribers.”

The 1st Circuit’s ruling against Gannett conflicts with a recent decision by the 11th Circuit Court of Appeals in a lawsuit involving the Cartoon Network. That court ruled last October that the Cartoon Network’s app didn’t violate the law by allegedly sharing data about consumers with the analytics company Bango. The judges in that case said that people who download the Cartoon Network’s free mobile app aren’t “subscribers” to the service.

But the 1st Circuit judges found that Yershov was a subscriber. “To use the app, Yershov did indeed have to provide Gannett with personal information, such as his Android ID and his mobile device’s GPS location at the time he viewed a video, each linked to his viewing selections,” the judges wrote. “While he paid no money, access was not free of a commitment to provide consideration in the form of that information, which was of value to Gannett.”

The judges also ruled that the information allegedly transmitted — geo-location data combined with device identifiers — was personally identifiable, even though it didn’t include users’ names.

“The statutory term ‘personally identifiable information’ is awkward and unclear, the judges wrote. “Nevertheless, the language reasonably conveys the point that PII is not limited to information that explicitly names a person.”

The ruling continued: “Imagine Gannett had disclosed that a person viewed 146 videos on a single device at 2 sets of specified GPS coordinates. Given how easy it is to locate a GPS coordinate on a street map, this disclosure would enable most people to identify what are likely the home and work addresses of the viewer.”

The appellate judges also pointed to allegations that Adobe has other information enabling it to link data like GPS addresses and device identifiers to particular names, addresses and phone numbers.

McGeveran notes that the ruling seems to reflect the view that geolocation information is particularly sensitive. “Location privacy gets treated with special sensitivity — even though it is data that is passively and routinely collected,” he says.

While the decision means Gannett will have to continue with the litigation, the company could ultimately prevail. The 1st Circuit judges noted in the opinion that “further development” of the underlying facts — including whether Adobe “foreseeably can identify” users — might result in dismissal of the case at a later date.