Robinson v. Disney Online, 152 F. Supp. 3d 176

Background

Plaintiff James Robinson downloaded the Disney Channel app on his Roku and alleges Disney transmitted his viewing records plus a hashed (anonymized) Roku serial number to Adobe, a third‑party analytics company.
Robinson claims Adobe linked Disney’s disclosures with other data to identify him and attribute a viewing history to his profile; he brought a VPPA class action alleging Disney knowingly disclosed personally identifiable information (PII).
Disney moved to dismiss under Rule 12(b)(6), arguing Robinson was not a “consumer” under the VPPA (not addressed) and that the disclosed data (hashed device ID + viewing history) is not PII as a matter of law.
The VPPA prohibits disclosure of PII by a “video tape service provider”; PII is defined to “include[] information which identifies a person as having requested or obtained specific video materials.”
The court assumed, for purposes of the motion, that Adobe could and did identify Robinson by combining Disney’s disclosure with other data, but held that liability under the VPPA requires the information disclosed by the provider itself to identify a particular person.
The court granted Disney’s motion, dismissing the Amended Complaint because the hashed device serial number and viewing history disclosed by Disney identified a device (and viewing activity) but not a particular person without additional data obtained by a third party.

Issues

Issue	Plaintiff's Argument	Defendant's Argument	Held
Whether the disclosed data (hashed device ID + viewing history) is "personally identifiable information" (PII) under the VPPA	Robinson: data is PII because Adobe could link disclosures with outside data to identify him	Disney: PII must be information that itself identifies a person; anonymized device IDs are not PII	Held: PII must itself identify a particular person; Disney’s disclosures were not PII because they identified a device, not a person
Whether third‑party aggregation making the data identifying converts an otherwise anonymous disclosure into PII	Robinson: VPPA covers disclosures that enable third parties to identify users when combined with other sources	Disney: VPPA targets the information actually disclosed by the provider, not hypothetical uses by recipients	Held: Third‑party aggregation does not convert non‑identifying disclosures into PII for VPPA liability absent the provider’s disclosure of identifying information
Whether context or correlated lookup tables can render an anonymized identifier PII	Robinson: context and recipient capabilities can make an identifier identifying	Disney: absent disclosure of a lookup table or other identifying data by the provider, context alone is insufficient	Held: Context can matter if the provider discloses additional correlating information (e.g., a lookup table); here no such correlated information was disclosed by Disney
Pleading sufficiency that Adobe actually identified Robinson	Robinson: allegations and public info suffice to plausibly allege Adobe identified him	Disney: allegation is conclusory and fails Rule 8	Held: Court assumed identification for the motion, but even so Robinson’s claim fails as a matter of law because Disney’s disclosure itself was not PII

Key Cases Cited

Bell Atlantic Corp. v. Twombly, 550 U.S. 544 (pleading must be plausible)
Ashcroft v. Iqbal, 556 U.S. 662 (plausibility standard for complaints)
Yershov v. Gannett Satellite Info. Network, Inc., 104 F. Supp. 3d 135 (D. Mass. 2015) (held that device identifiers plus location could be PII when third‑party linking can identify user)
In re Hulu Privacy Litig., 86 F. Supp. 3d 1090 (N.D. Cal. 2015) (context can render a unique anonymized ID identifying; disclosure of correlated lookup table maintains liability)
Locklear v. Dow Jones & Co., 101 F. Supp. 3d 1312 (N.D. Ga. 2015) (Roku serial number without more is not PII)
Pruitt v. Comcast Cable Holdings, LLC, 100 Fed. Appx. 713 (10th Cir. 2004) (unique anonymous IDs in isolation are not identifying absent correlated internal data)