DETRINA SOLOMON, оn behalf of herself and all others similarly situated, Plaintiff-Appellant, v. FLIPPS MEDIA, INC., dba FITE, dba FITE TV, Defendant-Appellee.
Docket No. 23-7597-cv
UNITED STATES COURT OF APPEALS FOR THE SECOND CIRCUIT
Decided: May 1, 2025
August Term 2023 (Argued: May 13, 2024)
Appeal from a judgment of the United States District Court for the Eastern District of New York (Azrack, J.), dismissing, pursuant to
AFFIRMED.
NICOMEDES S. HERRERA (Bret D. Hembd, on the brief), Herrera Kеnnedy LLP, Oakland, CA, and Burbank, CA, and Christopher J. Cormier, Burns Charest LLP, Washington, DC, for Plaintiff-Appellant.
DAVID N. CINOTTI (Brendan M. Walsh, on the brief), Pashman Stein Walder Hayden, P.C., Hackensack, NJ, for Defendant-Appellee.
CHIN, Circuit Judge:
In 1987, a newspaper published an article that identified 146 films that a Supreme Court nominee and his family had rented from a local video store. Although the rental information disclosed in the article was “not at all salacious,”1 the invasion of privacy prompted Congress to enact the Video Privacy Protection Act of 1988,
In this case, plaintiff-appellant Detrina Solomon, a subscriber to a digital video streaming service, contends that her rights under the VPPA were violated when the service, operated by defendant-appеllee Flipps Media, Inc., dba FITE, dba FITE TV (“FITE“),2 sent certain information to Facebook, Inc. (“Facebook“)3 each time she streamed a video. The information consisted of (1) a sequence of characters, letters, and numbers that, if correctly interpreted, would identify the title and URL (uniform resource locator, or web address) of the video, and (2) her “Facebook ID” (“FID“), a unique sequence of numbers linked to her Facebook profile.
The district court granted FITE‘s motion to dismiss pursuant to
We agree in both respects and, accordingly, we affirm.
STATEMENT OF THE CASE
I. Statutory Background
The VPPA was enacted to “preserve personal privacy with respect to the rental, purchase or delivery of video tapes or similar audio visual materials.” S. Rep. No. 100-599, at 1 (1988) (Judiciary Committee); see Wilson v. Triller, Inc., 598 F. Supp. 3d 82, 90 (S.D.N.Y. 2022). To that end, it provides that:
[a] video tape service provider who knowingly discloses, to any person, personally identifiable information concerning any consumer of such provider shall be liable to the aggrieved person . . . .
To state a claim under the VPPA, a plaintiff must plausibly allege that (1) a video tape service provider (2) knowingly disclosed to any person (3) personally identifiable information concerning her use of the service. See
The VPPA defines several key terms:
(1) the term “consumer” means any renter, purchaser, or subscriber of goods or services from a video tape service provider;
. . .
(3) the term “personally identifiable information” includes information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider; and
(4) the term “video tape service provider” means any person, engaged in the business, in or affecting interstate or foreign commerce, of rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials, or any person or other entity to whom a disclosure is made under subрaragraph (D) or (E) of subsection (b)(2), but only with respect to the information contained in the disclosure.
The VPPA does not ban all disclosure of personally identifiable information. A video tape service provider may disclose personally identifiable information in six circumstances: (1) to the consumers themselves; (2) to any person with the informed written consent of the consumer; (3) to a law enforcement agency pursuant to a valid warrant, subpoena, or court order; (4) to any person if the disclosure is solely of the names and addresses of consumers and if the video tape service provider has provided the consumer with the opportunity to
In recent years, the VPPA has generated extensive litigation, as numerous class actions have been filed against a wide variety of entities alleging that they impermissibly disclosed to third parties the personally identifiable information and video-viewing histories of their consumers.5
II. The Facts6
FITE is a digital streaming company that provides subscribers with an array of sports, entertainment, and music video content through its website and applications. It offers video content, pay-per-view events, and live streaming events.
Facebook is an unrelated third party that, among other things, creates and sells products such as the Facebook Pixel (thе “Pixel“) to operators of websites.7 The Pixel is a “unique string of code” that can be used to collect information about subscribers’ interactions on websites. Joint App‘x 17 ¶ 50. In other words, the Pixel is a tool that can be used to relay certain information to websites about the websites’ consumers, including whether consumers initiate purchases, what items they view, and the content consumers access on a particular webpage.
“PageView” is an optional feature that allows the Pixel to capture the URL and title of each video that a user accesses on a provider‘s website, along with that user‘s FID, which identifies the individual more precisely than a name or email address. A user‘s FID is associated with a small text file that stores information, also known as a Facebook “c_user cookie” or “сookie.” Because these c_user cookies are created and placed by Facebook on the Facebook users’ browsers, only Facebook‘s servers can access them.
During the installation process, FITE configured the Pixel on its website to include PageView. Since the implementation of the Pixel, every time a FITE consumer accesses a video on a FITE application or
Joint App‘x at 20.
The underlined code following the word GET (also known as a GET request) in Box A is generated when a hypothetical user requests a certain video on FITE‘s website. Within the GET request in Box A, the string оf characters includes the specific title of the video that the user accesses. In Box B (which starts in the lower right and continues in the lower left), the phrase “c_user=” is followed on the next line by a partially redacted string of numbers -- the user‘s FID.
The Pixel relays this information to Facebook regardless of whether the site‘s users are logged onto Facebook and even after they clear their browser histories. Facebook then uses this information to build detailed profiles about FITE‘s consumers, which enables FITE to present those same consumers with targeted advertisements. FITE does not disclose or discuss the Pixel specifically in its Terms of Use, Privacy Policy, or any other material provided to subscribers, nor does FITE provide an opportunity for its consumers to decline or withdraw consent to FITE‘s use of the Pixеl.
Entering “facebook.com/[an individual‘s FID]” into any web browser provides access to a specific individual‘s Facebook profile. This basic method of accessing a person‘s Facebook profile is “generally and widely known among the public.” Joint App‘x at 10, 21.
Solomon was a Facebook user and subscriber of FITE‘s TrillerVerzPass digital video streaming service during the two years before the Complaint was filed in 2022. The Complaint uses a hypothetical Facebook profile to illustrate Solomon‘s claims but does not depict Solomon‘s personal Facebook profile or specify any identifiable information that exists in her profile.
III. Proceedings Below
On September 14, 2022, Solomon brought this consumer privacy class action on behalf of subscribers and purchasers of FITE‘s video streaming services who (1) obtainеd specific video materials from FITE‘s website and applications, and (2) had a Facebook account during the time that FITE used the Facebook Pixel.8 The
On November 14, 2022, FITE submitted to the district court a pre-motion letter identifying numerous purported defects in the Complaint, including that the Complaint did not identify what information on Solomon‘s Facebook page would lead anyone to connect data in the alleged transmissions to her. Solomon did not offer to amend the Complaint upon receipt of FITE‘s pre-motion letter, nor did she amend of right as permitted under
On February 7, 2023, FITE moved to dismiss the Complaint pursuant to
On September 30, 2023, the district court granted FITE‘s motion to dismiss and denied Solomon leave to amend. Solomon, 2023 WL 6390055, at *1, *6. The district court held that Solomon did not plausibly allege that her public Facebook profile page contained personally identifiable information or that Solomon accessed prerecorded videos within the meaning of the VPPA. Id. at *2-5. The district court also denied Solomon‘s request for leave to amend the Complaint because she had addressed the issue only in “a conclusory footnote” and had failed to take advantage of “multiple opportunities to propose amendments.” Id. at *6. The district court entered judgment in favor of FITE on October 3, 2023.
This appeal followed.
DISCUSSION
Two issues are presented: first, whether the district court erred in holding that the Complaint failed to plausibly allege that FITE disclosed “personally identifiable information” to Facebook in violation of the VPPA, and, second, whether the district court abused its discretion in denying Solomon leave to amend the Complaint.
We review a district court‘s grant of a motion to dismiss pursuant to
I. The Motion to Dismiss
The principal question, with respeсt to the first issue, is what constitutes “personally identifiable information” for purposes of the VPPA. It is undisputed that FITE is a video service provider that knowingly disclosed certain information about Solomon to Facebook -- namely, computer code that denoted the titles and URLs of the videos Solomon accessed and her FID. If
A. Applicable Law
The VPPA does not specifically define “personally identifiable information,” providing only that it “includes information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider.”
This Court has not defined personally identifiable information beyond the statutory definition,10 but other circuits have provided further explanation. The First, Third, and Ninth Circuits have held that personally identifiable information constitutes more than just information that identifies an individual, but also information that can be used to identify an individual. See Yershov, 820 F.3d at 485-86; In re Nickelodeon, 827 F. 3d at 290; Eichenberger v. ESPN, Inc., 876 F.3d 979, 984 (9th Cir. 2017). Accordingly, to define personally
identifiable information, circuits have endeavored to interpret what information Congress intended to cover as “‘cаpable of’ identifying an individual” under the VPPA. Eichenberger, 876 F.3d at 984. Two approaches have emerged: (1) the reasonable foreseeability standard and (2) the ordinary person standard. Id. at 985.
1. The Reasonable Foreseeability Standard
The First Circuit established the reasonable foreseeability standard in Yershov, holding that personally identifiable information is “not limited to information that explicitly names a person,” but also includes information disclosed to a third party that is “reasonably and foreseeably likely to reveal which . . . videos [the plaintiff] has obtained.” 820 F.3d at 486.
In Yershov, the defendant was an international media company that produced news and entertainment media, including the newspaper USA Today and the USA Today Mobile App (the “App“). Id. at 484.
The court first held that personally identifiable information includes information that can be used to identify a specific individual. The court reasoned that the word “includes” in the text of the definition implies that personally identifiable information is not limited to information that explicitly names a person. Id. at 486. Indeed, the court cited the Senate Report, which expressly stated that the drafters’ aim was “to establish a minimum, but not exclusive, definition of personаlly identifiable information.” Id. (quoting S. Rep. No. 100-599, at 12 (1988)). Had Congress intended a narrow and simple construction, the court concluded, it would have had no reason “to fashion the more abstract formulation contained in the statute.” Id. The court also noted that many types of information, other than a name, can easily identify a person. “Revealing a person‘s social security number to the government, for example, plainly identifies the person. Similarly, when a football referee announces a violation by ‘No. 12 on the offense,’ everyone with a game program knows the name of the player who was flagged.” Id.
The First Circuit subsequently established the reasonable foreseeability standard as the framework to determine what information can be used to identify an individual under the VPPA. The court concluded that the plaintiff in Yershov had plausibly alleged that the defendant impermissibly disclosed personally identifiable information when it supplied Adobe with information about the videos the plaintiff watched on the App, along with “GPS coordinates of the device at the time the video was viewed,” and “certain identifiers associated with the user‘s device.” Id. at 484. The court explicitly relied on the allegation that the defendant knew that Adobe had the “game program,” or the mechanism necessary to “allow[] it to link the GPS address and device identifier information to a certain person by name, address, phone number, and more.” Id. at 486. The court concluded that the plaintiff thus plausibly alleged that the defendant violated the VPPA because it was reasonably and foreseeably likely to the defendant that Adobe, a sophisticatеd technological company, would have the ability to identify the plaintiff‘s video-watching habits. Id.
2. The Ordinary Person Standard
In In re Nickelodeon, the Third Circuit took a different approach by holding that “the [VPPA‘s] prohibition on the disclosure of personally identifiable information applies only to the kind of information that would readily permit an ordinary person to identify a specific individual‘s video-watching behavior.” 827 F.3d at 267.
In that case, the plaintiffs (children under thirteen) brought a putative class action alleging that Viacom disclosed information to Google that effectively revealed the videos they had watched on Nickelodeon‘s websites. Id. at 279. The plaintiffs argued that static digital identifiers (such as internet protocol (“IP“) addresses, browser fingerprints, and unique device identifiers) were personally identifiable information that enabled Google to link those videos to their real-world identities. Id.
The Third Circuit thus did not adopt Yershov‘s reasonable foreseeability standard, concluding that the VPPA did not “sweep[] quite so broadly.” Id.11 Instead, the court adopted the ordinary person standard -- holding that static digital identifiers were not personally identifiable information protected from disclosure by the VPPA because an ordinary person, as opposed to a sophisticated internet company such as Google, could not use the static
digital identifiers to identify a specific individual‘s video-watching habits. Id. at 289-90.
In Eichenberger, the Ninth Circuit also adopted the ordinary person standard, concluding that it “better informs video service providers of their obligations under the VPPA.” 876 F.3d at 985. In that case, defendant ESPN produced sports-related news and entertainment programming through its television channel and application, which were available on the Roku digital streaming device. Id. at 981. Every time a consumer watched a video, ESPN knowingly disclosed to Adobe Analytics (“Analytics“) the consumer‘s Roku device serial number and the identity of the video that he watched. Id. Analytics also obtained email addresses, account information, Facebook profile information, photos, and usernames, from sources other than ESPN. Id. Analytics could identify the consumer by connecting both sources of information with other data already in Analytics’ profile of the consumer. Id. Analytics then gave that compiled information back to ESPN, which used it to provide advertisers with information about its user demographics. Id.
The Ninth Circuit agreed that the word “include” signifies that the definition of personally identifiable information must encompass “more information than that which, by itself, identifies an individual as having watched certаin videos.” Id. at 984. Instead of just explicitly identifying information, the court reasoned, the statute‘s use of the word “identifiable,” where “the suffix ‘able’ means ‘capable of,‘” reinforces that the definition of PII also “covers some information that can be used to identify an individual.” Id. at 979, 984.
Accordingly, the court held that the plaintiff did not plausibly allege that the information that ESPN disclosed to Analytics constituted personally identifiable information under the ordinary person standard because the information disclosed “cannot identify an individual unless it is combined with other data in [Analytics‘] possession.” Id. at 986 (emphasis omitted).
B. Application
Although she did not advocate for a particular standard in the district court, Solomon now argues that this Court should adopt a variation of Yershov‘s reasonable foreseeability standard and hold that “personally identifiable information under the VPPA encompasses specific information about a consumer, disclosed by a video tape service provider to a particular recipient, that the provider knows the recipient сan use to personally identify that consumer.” Brief of Plaintiff-Appellant at 13-14. FITE contends that if this Court reaches the question, we should adopt the Third and Ninth Circuits’ ordinary person standard. Both parties contend that, regardless of the standard to be applied, they should prevail -- Solomon argues that the Complaint states a plausible claim and FITE argues that it does not.
First, we do reach the question of which standard applies, and we adopt the Third and Ninth Circuits’ ordinary person standard. Second, applying that standard, we conclude that the Complaint fails to state a claim for violation of the VPPA.
1. The Applicable Standard
“When interpreting a statutory provision, we begin with the words of the statute.” Soliman v. Subway Franchisee Advert. Fund Tr., LTD., 101 F.4th 176, 181 (2d Cir. 2024). If the words are clear, we construe the statute according to their plain meaning. Id. If the words are not clear, we may consider legislative history and the tools of statutory construction. Id.; accord Greenery Rehab. Grp., Inc. v. Hammon, 150 F.3d 226, 231 (2d Cir. 1998). We assess plain meaning “by reference to the language itself, the specific context in which that language is used, and the broader context of the statute as a whole.” Zepeda-Lopez v. Garland, 38 F.4th 315, 320 (2d Cir. 2022) (citation omitted).
As an initial matter, and as the parties appear to agree, we conclude that Congress intended the VPPA to cover not just information that, by itself, identifies a consumer‘s video-viewing history, but also information capable of being used to do so. The VPPA states that “the term ‘personally identifiable information’ includes information which identifies a person as having requested or obtained specific video materials
In addition, based on the words of the statute, the specific context in which the language is used, and the broader context of the statute as a whole, we conclude that “personally identifiable information” encompasses information that would allow an ordinary person to identify a consumer‘s video-watching habits, but not information that only a sophisticated technology company could use to do so.
First, the words of the definition surely can be read to refer to the “kind of information that would readily permit an ordinary person to identify a specific individual‘s video-watching behavior.” In re Nickelodeon, 827 F.3d at 290. The definition provides that “‘personally identifiable information’ includes information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider.”
Second, the specific context in which those words are used suggests that the definition encompasses information that would permit an ordinary person to identify a specific individual‘s video-watching behavior, as opposed to information that only a technologically sophisticated third party could use to identify specific consumers. The VPPA imposes liability on a “video tape service provider” that “knowingly discloses” a consumer‘s information to a third party.
Finally, the broader context of the statute as a whole squarely supports the conclusion that liability under the VPPA should be limited to the disclosure of information that would permit an ordinary person to learn a specific individual‘s video-watching history. The VPPA was enacted in 1988, when “the Internet had not yet transformed the way that individuals and companies use consumer data -- at least not to the extent that it has today.” Eichenberger, 876 F.3d at 985; accord In re Nickelodeon, 827 F.3d at 284 (“We do not think that, when Congress passed the [VPPA], it intended for the law to cover factual circumstances far removed from those that motivated its passage.“); see also Twentieth Century Music Corp. v. Aiken, 422 U.S. 151, 156 (1975) (“When technological change has rendered its literal terms ambiguous, the [statute] must be construed in light of [its] basic purpose.“) (interpreting Copyright Act).
The evolution of the VPPA provides additional insights into its purpose. In 2013, some twenty-five years after its inception, Congress amended the VPPA in recognition that “the Internet ha[d] revolutionized the way that American consumers rent and watch movies and television programs.” Salazar, 118 F.4th at 545 (quoting S. Rep. No. 112-258, at 2 (2012)).13 Congress, however, declined to amend the definition of personally identifiable information, even in the face of testimony asking for an expansion of the definition to include IP addresses. See In re Nickelodeon, 827 F.3d at 288 (“Despite this recognition [that the Internet has revolutionized the way that Americans rent and watch movies and television programs], Congress did not update the definition of personally identifiable information in the statute.“).
The decision to not amend the VPPA suggests that Congress believed that the VPPA “serves different purposes, and protects different constituencies, than other, broader privacy laws.” Id. This is especially notable when we compare the VPPA to other, later privacy statutes that included a more expansive definition of personally identifiable information or related terms. For example, in 1998, ten years after the VPPA was enacted, Congress passed the Children‘s Online Privacy Protection Act (“COPPA“), and defined “personal information” to include:
- a first and last name;
- a home or other physical address . . . ;
- an e-mail address;
- a telephone number;
- a Social Security number;
- any other identifier that the [Federal Trade Commission] determines permits the physical or online contacting of a specific individual; or
- information concerning the child or the parents of that child that the website collects online from the child and combines with an identifier described in this paragraph.
2. FITE‘s Use of the Pixel
Turning to the facts of this case, we consider whether the Complaint plausibly alleges that FITE‘s disclosure of Solomon‘s FID and video titles “would, with little or no extra effort, permit an ordinary recipient to identify [Solomon‘s] video-watching habits.” In re Nickelodeon, 827 F.3d at 284. We conclude it does not.
The information transmitted by FITE to Facebook via the Pixel‘s PageView is set forth in the “exemplar screenshot” reproduced in the Complaint. See page 9 supra; Joint App‘x at 20. The exemplar depicts some twenty-nine lines of computer code, and the video title is indeed contained in Box A following the GET request. The words of the title, however, are interspersed with many characters, numbers, and letters. It is implausible that an ordinary person would look at the phrase “title%22%3A%22-%E2%96%B7%20The%20Roast%20of%-%20Ric%20Flair” -- particularly if the highlighting in Box A is removed -- and understand it to be a video title.14 It is also implausible that an ordinary person would understand, “with little or no extra effort,” the highlighted portion to be a video title as opposed to any of the other combinations of words within the code, such as, for example, “%9C%93%20In%20the%20last%20weekend%20of%20-July%2C.” Id.; Joint App‘x at 20.
Nor does the Complaint plausibly allege that an ordinary person could identify Solomon through her FID. Because the redacted sequence of numbers in the second line of Box B is not labeled, the FID would be just one phrase embedded in many other lines of code. And if the numbers in the exemplar were not redacted, what an individual would see is, for example, a phrase such as “c_user=123456” or “c_user=00000000.” Although a section of the code in Box A does state “[h]ost: www.facebook.com,” it is not plausible that an ordinary person, without the annotation of Box B, would see the “c_user” phrase on FITE‘s servers and conclude that the phrase was a person‘s FID.
Notably, the Complaint lacks any details about how an ordinary person might access the information on the Pixel‘s PageView. But even assuming, arguendo, that an ordinary person could somehow gain access to the Pixel‘s PageView, the Complaint is also devoid of any details about how an ordinary person would use an FID to identify Solomon. The Complaint merely states that entering “facebook.com/[Solomon‘s FID]” into any web browser would result in Solomon‘s personal Facebook
Accordingly, we hold that Solomon failed to plausibly allege that FITE disclosed “personally identifiable information” in violation of the VPPA and we therefore affirm the district court‘s dismissal of the Complaint.
II. Leave to Amend
We find no abuse of discretion in the district court‘s decision to deny Solomon leave to amend the Complaint. Although FITE sent Solomon a pre-motion letter advising her of the deficiencies in the Complaint, she waited until her opposition to the motion to dismiss to request leave, and she did so only in a single footnote on the final page of her brief, stating that “[i]f the Court grants Defendant‘s motion in any respect, Solomon should be granted leave to amend the Complaint to remedy any perceived deficiencies.” Joint App‘x at 94 n.4. In denying Solomon leave to amend, the district court observed that Solomon “has had more than ample opportunity to address the deficiencies identified [in the Complaint], but has not identified any proposed amendments.” Solomon, 2023 WL 6390055, at *5.
In light of these facts, the district court acted wholly within its discretion in denying leave to amend. See, e.g., Noto v. 22nd Century Grp., Inc., 35 F.4th 95, 107 (2d Cir. 2022) (denial of leave to amend is proper “where the request gives no clue as to how the complaint‘s defects would be cured” (internal quotation marks omitted)); Porat v. Lincoln Towers Cmty. Ass‘n, 464 F.3d 274, 276 (2d Cir. 2006) (holding that the district court did not abuse its discretion in denying leave to amend where the request was made only in a footnote and with no explanation as to how the complaint‘s defects would be cured).
Solomon relies on this Court‘s decision in Mandala v. NTT Data, Inc. to argue that the district court abused its discretion in denying her leave. 88 F.4th 353 (2d Cir. 2023). The reliance is misplaced. In Mandala, this Court held that a district court abused its discretion in denying a motion to vacate a judgment of dismissal pursuant to
[Mandala] is one of the exceptional cases necessitating relief from judgment:
Plaintiffs have yet to be afforded a single opportunity to amend their pleading; the original dismissal of the Complaint was premised on grounds subject to reasonable, actual, and vigorous debate; Plaintiffs diligently prosecuted their case at all times; and Plaintiffs’ proposed amendments address the sole pleading deficiency identified by the district court.
Mandala is distinguishable and of no help to Solomon. First, Mandala involved a motion to vacate a judgment of dismissal, rather than a request for leave to amend a complaint. Second, the plaintiffs there actually made a motion and did not rely solely on a footnote. Third, the plaintiffs in Mandala wеre not “afforded a single opportunity to amend their pleadings,” id., while here Solomon was put on notice of the deficiencies in the Complaint and had “ample opportunity” to address them. Joint App‘x at 124. Finally, we concluded that Mandala was “one of the exceptional cases necessitating relief from judgment,” 88 F.4th at 365, and the instant case does not present similar exceptional circumstances.
Accordingly, we hold that the district court did not abuse its discretion in denying Solomon‘s request for leave to amend the Complaint.
CONCLUSION
For the reasons set forth above, the judgment of the district court is AFFIRMED.