136 F.4th 41
2d Cir.2025Background
- Plaintiff Detrina Solomon, a subscriber to Flipps Media’s (FITE TV) digital streaming service, alleged that FITE violated the Video Privacy Protection Act (VPPA) by disclosing her video viewing history and Facebook ID (FID) to Facebook via the Facebook Pixel ("Pixel").
- The information transmitted included coded URLs and video titles, along with her FID—numbers that are used to identify Facebook profiles.
- The district court dismissed Solomon’s complaint under Fed. R. Civ. P. 12(b)(6) on grounds that she had not plausibly alleged disclosure of "personally identifiable information" (PII) under the VPPA.
- The court also denied her request for leave to amend, noting it was made in a conclusory footnote and Solomon had multiple prior opportunities to amend.
- On appeal, the Second Circuit considered what constitutes PII under the VPPA and which legal test (reasonable foreseeability vs. ordinary person standard) should govern.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Definition of PII under VPPA | Information enabling FITE to identify users to Facebook (i.e., FID + video title) qualifies as PII under a reasonable foreseeability standard. | Only information that permits an ordinary person (not just a sophisticated data aggregator) to identify an individual’s video viewing qualifies as PII. | "Ordinary person" standard applies: PII means information that would permit an ordinary person to identify a consumer’s video-watching history. |
| Whether complaint sufficiently alleges disclosure of PII | The complaint pleads enough because an FID can identify a Facebook profile and the URL reveals the video watched. | The combination of FID and video titles in code is not readily understandable to an ordinary person; thus, not PII under the VPPA. | The complaint fails to plausibly allege disclosure of PII: an ordinary person could not use the information to identify Solomon’s viewing habits. |
| Leave to Amend Complaint | Should be allowed to amend if deficiencies are found, as requested in a footnote. | No sufficient amendment proposed; multiple opportunities were available; footnote request inadequate. | No abuse of discretion in denying leave to amend; request was conclusory and not diligently pursued. |
| Effect of third party’s sophistication (Facebook’s capability) | Recipient’s ability to link data should matter if the disclosing party knows this. | Disclosing party’s liability shouldn’t depend on recipient’s skills; focus is what’s disclosed, not what recipient might infer. | Court declines to adopt reasonable foreseeability standard; recipient’s sophistication does not broaden VPPA liability. |
Key Cases Cited
- Yershov v. Gannett Satellite Info. Network, Inc., 820 F.3d 482 (1st Cir. 2016) (defines PII under VPPA using reasonable foreseeability standard, but rejected here)
- In re Nickelodeon Consumer Privacy Litigation, 827 F.3d 262 (3d Cir. 2016) (adopts ordinary person standard for PII under the VPPA)
- Eichenberger v. ESPN, Inc., 876 F.3d 979 (9th Cir. 2017) (ordinary person standard; rejects liability based on sophisticated recipient’s abilities)