There are two possible sources of VPPA trouble here . First, in step (4) when Facebook found out that Ethan had purchase The Producers, that might have been a disclosure either by Ethan or by Blockbuster. Second, in step (6) when Ethan's friends found out that he'd bought it, that might have been a disclosure by Ethan or by Facebook.Link (Thanks, James!)
Let's start with the disclosure to Facebook (step (4)). Blockbuster looks like it has a strong argument here that Ethan was the discloser, not it. After all, it was Ethan's browser that told Facebook what he'd rented, not Blockbuster's web site. Since Ethan isn't a video tape service provider, that's the end of the story.
I don't think that argument works, though, because Ethan's disclosure to Facebook is pretty much a textbook example of an involuntary act.