OPINION & ORDER
Plaintiff James Robinson brings this class action against Defendant Disney Online (“Disney”), alleging violations of the Video Privacy Protection Act (the “VPPA”), 18 U.S.C.. § 2710. He claims that Disney unlawfully disclosed personally
BACKGROUND
Robinson’s Amended Complaint concerns videos he purportedly viewed using a Roku, a “digital media-streaming device that delivers videos, news, games, and other content to consumers’ televisions via the Internet.” Am. Compl. (Dkt. 20) ¶ 1 n. 1. Through the Roku Channel Store — an “online digital media platform” — Robinson downloaded the Disney Channel application, which, once installed on his Roku, allowed him to view Disney’s proprietary video content. Id. ¶¶ 9-10.
“Unbeknownst to its users,” Robinson claims, “each time they use the Disney Channel to watch. videos or television shows, Disney discloses their personally identifiable information — including a record of eveiy video clip viewed by the user ... to unrelated third parties.” Id. ¶ 2; see also id. ¶ 13. He further claims that this record is “sent each time that a user views a video clip,” and is accompanied by the “hashed serial number associated with the user’s Roku device.” Id. ¶ 13. This hashed — or anonymized — serial number is “unique to a ... device and remain[s] constant for the lifetime of that device.” Id. ¶ 18. ■
Disney, according to Robinson, programmed its Roku channel to send this information to Adobe, a third-party data analytics company. See id. ¶¶ 3, 13. Adobe, and companies like it, purportedly maintain “massive digital dossiers on consumers” by aggregating consumer data collected from an array of sources, including applications like the Disney Channel. See id. ¶¶ 22-29. Robinson claims that “Adobe has the capability to use” this aggregated data to “personally identify .,. users and associate their video viewing selections with a personalized profile in its databases.” Id: ¶ 29. ■ . ‘
Robinson “downloaded and began using the Disney Channel on his Roku” device beginning in December 2013. Id. ¶39. He claims that Disney disclosed the hashed serial number of his dfevice and his viewing history to Adobe without his consent, id. ¶ 40, and that this information constitutes PII “in this content because it allows Adobe to identify users ... and to attribute their video viewing records to their existing profiles,” id. ¶ 56. He further alleges that Adobe actually identified him and “attribute[d] his viewing choices to his profile” using the information disclosed. by Disney. Id. ¶ 57.
LEGAL STANDARD
To survive a motion to dismiss under Fed.R.Civ.P. 12(b)(6), a pleading must contain “a short and plain statement of the claim showing that the pleader is entitled to relief,” Fed.R.Civ.P. 8(a)(2), and be “plausible on its face,” Bell Atl. Corp. v. Twombly,
DISCUSSION
The VPPA prohibits a “video tape service provider” from “knowingly disclosing], to any person, personally identifiable information concerning any consumer of such provider.” 18 U.S.C. § 2710(b)(1). Its impetus was the publication in “a weekly newspaper in-Washington” of-a> “profile of Judge Robert H. Bork based on the titles of 146 films his family had rented from a video store.” Sen. Rep. 100-599, at 5(1988).
As defined in the VPPA, a “video tape service provider” is “any person, engaged in the business, in or affecting interstate or foreign- commerce, of rental, sale; or delivery of prerecorded video cassette tapes or similar audio visual matérials;’”18 U.S.C. § 2710(a)(4); a “consumer” is “any renter, purchaser, or subscriben* of goods or services from a video tape service provider,” 18 U.S.C. § 2710(a)(1); and “personally identifiable information” (“PII”) “includes information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider,” 18 U.S.C. § 2710(a)(3). Disney contends that Robinson’s VPPA claim is statutorily precluded, both because he was not a consumer and because the information Disney transmitted to Adobe was not PII. See Mem. (Dkt. 31) 7-10, 16-17. The Court declines to address the former argument, as it concludes that the information Disney disclosed did hot amount to PII.
The precise scope ' of PII under the VPPA is difficult to discern from the face of the statute — whether read in isolation or in its broader statutory context. As defined in Section 2710(a)(3), PII “includes information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider.”
This language suggests that the information disclosed by a video tape service provider must, at the very least, identify a particular person — not -just an anonymous individual — and connect this particular person with his or her viewing history. See In re Hulu Privacy Litig.,
Less clear is the scope of information encompassed by PII, and how, precisely, this information must identify a person. Importantly, Robinson does not argue that the information disclosed by Disney — a “record of [his viewing] activities ... along with the hashed serial number associated with [his] Roku device,” Am. Compl. ¶¶ 13, 42 — constitutes PII in its own right. Instead, he argues that the information constitutes PII because Adobe, the recipient of Disney’s disclosures, can identify him by “linking]” these disclosures with “existing personal information” obtained elsewhere. See Am. Compl. 27, 29; Opp. 8-10. Indeed, the Court assumes, for the purposes of this motion, that Adobe has actually identified him in this manner. See infra note 1. Disney responds that the VPPA is not targeted at what non-defendant third parties might do -with disclosures by video tape service providers, as PII is solely limited to information which, in and of itself, identifies a person. See Mem. 7-10. Because the anonymized disclosures here do not themselves identify a specific person, Disney contends, they are not prohibited. See id.
Robinson’s theory of liability is not without support in the existing case law. Indeed, Yershov v. Gannett Satellite Info. Network, Inc.,
A discussion of Yershov is nevertheless instructive. The district court there began its analysis with the premise, rooted in the statutory text, that “a consumer’s name and address are both PII, and ... that the universe of PII is greater than the consumer’s name and address.”
The question for the Court.is whether this premise necessarily leads to the, Yer-shov court’s conclusion’ that information can amount to PII even when it does not, on its own, identify a specific person.. As a practical matter, - it is surely right — or at least often so — that addresses and even names “cannot be linked to a specific person without access to certain additional information.” 104 F.Supp.3d- at 142. Which John Smith, or which Main Street, among thousands? And there is, undoubtedly, an intuitive appeal to the Yershov court’s conclusion that it would thus be “unrealistic to refer to PII as information which must, without more, itself link an actual person to. actual video materials.” Id. at 146. As that court stated, defining PII so narrowly would “preclude a finding that home addresses ... are. PII,” and thus conflict with the VPPA’s plain statutory language. Id. at 142-43.
But in the end, this conclusion is at odds with the VPPA’s particularized definition of PII and is overly expansive. If nearly any piece of information can, with enough effort on behalf of the recipient, .be combined with other information so as to identify a person, then the scope of PII would be- limitless. Accord Nickelodeon,
It is true, of course, that liability would not be imposed on providers like Disney unless tliey also knew that the information disclosed was personally identifying, see 18 U.S.C. § ’2710(a)(3), but this knowledge requirement would not operate as any real limitation on liability; if virtually all information can, in the end, be identifying, -it is hard to conceive of a case in.which a disclosure would not be considered knowing. Other limiting principles might plausibly be read into the VPPA to address the concern of overbreadth. For instance, information might constitute PII only if the third-party recipient has the ability, at the moment of disclosure (and not just theoretically), to combine it with other information and identify the underlying consumer. But such a principle would necessarily ei
Indeed, the most natural reading of PII suggests that it is the information actually “disclos[ed]” by a “video tape service . provider,” 18, U.S.C. §. 2710(b)(1), which must itself do the. identifying that is relevant for purposes of the VPPA (literally, “information which identifies”) — not information,, disclosed by a provider, plus other pieces of information collected elsewhere by non-defendant third parties. This is the argument urged by Disney, and it is the definition of PII tha]; this Court now adopts. PII is information which itself identifies a particular person as having-accessed specific video materials'. ,
That names and addresses are expressly included within the definition of PII, as is clear from the face of the VPPA, see 28 U.S.C. § 2710(b)(2)(D), does not foreclose this construction, even .recognizing that names and addresses may, as the Yershov court noted, require additional information before they identify specific people. Instead, the inclusion of names and addresses as examples of PII in the VPPA suggests that Congress considered names and addresses to be sufficiently identifying without more. That is, -a stronger reading of the VPPA suggests that these pieces of information' are per se ' identifying ' such that their knowing disclosure amounts to a violation of the statute. ■
Nor is the Court’s reading foreclosed by the VPPA’s use of the word “includes” in the statutory definition of PII. The Senate Report’ accompanying the VPPA, which notes that “paragraph (a)(3) uses the word ‘includes’ to -establish la minimum, but not exclusive, definition of personally identifiable information,” makes clear that “includes” is used 'not' to suggest' that PII encompasses moré' ‘ than “information which identifies a person as having requested ... specific video materials,” but instead to signal that PII must, at'the very least, “identiffy] a particular person as having- engaged in a specific transaction.” Sen. Rep. 100-599, at 11-12, To be PII, information must identify a specific person and must tie- this person-to specific video materials; it can do no less, but the scope of what constitutes PII is not otherwise limited.
None of which is to say that' context is irrelevant. ’ Context may matter, for instance, to the extent other information disclosed by the provider permits a “mutual understanding that there has been a disclosure” of PII. In re Hulu Privacy Litig.,
Pruitt v. Comcast Cable Holdings, LLC,
Even, assuming the Tenth Circuit had endorsed this second theory, however, Pruitt does not stand for the. proposition that unique, anonymous IDs, when disclosed to third-parties, become PII. It merely reaffirms the Hulu .court’s suggestion, discussed above, that “[o]ne could not skirt liability under the VPPA, for example, by disclosing a unique identifier and a correlated look-up table.”
The definition of PII the Court hereby adopts readily distinguishes between names and addresses, on the one hand, and an anonymized device serial number, on the other. If PII is. information which must itself, identify a particular person as having viewed specific video materials, the primary question for the re-
Finally, Robinson has not alleged that the hashed serial number of his Roku device amounts to a geographic identifier. See Am. Compl. ¶ 13. It is thus unlike a home address, which ties a specific person to a specific place. Nor is the information disclosed by Disney equivalent to a Face-book ID. A “Facebook user — even one using a nickname — generally is an identified person on a social network platform.” Hulu,
CONCLUSION
As alleged, the disclosures at issue here indicate only that a specific device somewhere was used by someone to watch specific videos. Id. ¶ 13. An unrelated third party equipped with the information purportedly disclosed by Disney, and nothing more, could not identify Robinson. The third party would not know his name, his age, his gender, his social security number, his home address or any other information tantamount to a physical location, or any similar details that would enable it to identify Robinson as the specific person accessing specific videos on his specific Roku device. The somewhere and someone remain unknown until Adobe purportedly combines Disney’s disclosure with other information collected from elsewhere. See Am. Compl. ¶¶ 27, 29, 55-57. Thus, Robinson’s allegations, as measured against the definition of personally identifiable information adopted by the Court, fail to show th,at he is entitled to relief. Accordingly, Robinson cannot make out a viable claim under the VPPA, and his Amended Complaint must be dismissed.
In dismissing this action, the Court is sensitive to the policy implications posed by the increasing ubiquity of digital technologies, which, as Robinson ably alleges, have dramatically expanded the depth, range, and availability of detailed, highly personal consumer information. There is no doubt that the world of Roku devices, streaming video, and data analytics is a very different one from that of the physical video stores and tape rentals in which the VPPA was originally passed, and that, as the Yershov court noted, deciding VPPA cases today is thus akin to placing “a square peg ... into a round hole.”
For the reasons stated above, Disney’s motion to dismiss is granted. The Clerk of Court is requested to terminate the motion pending at Dkt. 30 and close the case.
SO ORDERED.
ORDER
On November 18, 2015, Plaintiff James Robinson moved for the Court to reconsider its October 20, 2015 order, which granted Defendant’s motion to dismiss. In its October 20 order, the Court held that Robinson failed to state a claim under the Video Privacy Protection Act (the “VPPA”), 18 U.S.C. § 2710, because the information Disney had allegedly disclosed — a “hashed” serial number of a digital device Robinson used to access Disney content together with his viewing history — did not constitute personally identifiable information (“PH”), as defined by the VPPA, Robinson now urges the Court to reconsider its ruling, on the grounds that it “overlooked” certain “matters ‘that might reasonably be expected to alter the [Court’s] reasoning.’” PL’s Mem. 2-3 (internal citation omitted). In particular, he argues that the Court failed to understand the “subtle — but important — distinction between singling out and identifying” an individual, and that the test articulated by the Court is “unworkable.” Id. at 3, 10. Under Robinson’s theory, whether a disclosure identifies an individual is a question,for the jury. For the reasons articulated in its October 20 order, the Court disagrees.
“A motion for reconsideration should be granted only when the defendant identifies ‘an intervening change of controlling law, the availability of new evidence, or the need to correct a clear error or prevent manifest injustice.’” Kolel Beth Yechiel Mechil of Tartikov, Inc. v. YLL Irrevocable Trust,
SO ORDERED.
Notes
. The parties disagree about whether Robinson has adequately alleged that Adobe actually identified him. Disney argues that this allegation — to the extent it is even made in the Amended Complaint — is conclusory and thus insufficient to satisfy the pleading requirements of Fed.R.Civ.P. 8, while Robinson contends that in light of the informational asymmetries in this case, as well as the publicly available information about Adobe's identification capabilities documented in his Amended Complaint, he has sufficiently alleged ■ actual ■ identification. ■ Even if the Court were to resolve this dispute in Robinson's favor, however, his allegations would not be sufficient, a;s a matter of law, to survive Disney’s motion to dismiss. The Court thus assumes, for the purpoáe of deciding this- motion, that-Adobe-did actually identify Robinson,
. Plaintiff's contention, at oral argument; that hashed serial numbers are, like names or social security numbers, just randomized strings of numbers and/or letters, similarly goes too far. Plaintiff's argument merely demonstrates what should already be obvious: Much of human language is symbolic, communicated through systems of letters and numbers. But such a generalized principle is not particularly useful in determining what PII — a statutorily defined term — means in this ■ context.
. The Hulu court's discussion of “context” is consistent with the agency regulations implementing The Family Educational Rights and Privacy Act of 1974 (FERPA), which bars, in part, the disclosure of PII in educational records. Pursuant to these, regulations, PII includes a range of so-called “personal identifiers,” such as a student’s social security .number or biometric record, as well as “other information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of. the relevant circum