There are two possible sources of VPPA trouble here . First, in step (4) when Facebook found out that Ethan had purchase The Producers, that might have been a disclosure either by Ethan or by Blockbuster. Second, in step (6) when Ethan's friends found out that he'd bought it, that might have been a disclosure by Ethan or by Facebook.Link (Thanks, James!)
Let's start with the disclosure to Facebook (step (4)). Blockbuster looks like it has a strong argument here that Ethan was the discloser, not it. After all, it was Ethan's browser that told Facebook what he'd rented, not Blockbuster's web site. Since Ethan isn't a video tape service provider, that's the end of the story.
I don't think that argument works, though, because Ethan's disclosure to Facebook is pretty much a textbook example of an involuntary act.
I write books. My latest is a YA science fiction novel called Homeland (it's the sequel to Little Brother). More books: Rapture of the Nerds (a novel, with Charlie Stross); With a Little Help (short stories); and The Great Big Beautiful Tomorrow (novella and nonfic). I speak all over the place and I tweet and tumble, too.