Salazar v. National Basketball Association
1:22-cv-07935
S.D.N.Y.
Oct 6, 2025
Check Treatment
Docket
Case Information

UNITED STATES DISTRICT COURT

SOUTHERN DISTRICT OF NEW YORK

MICHAEL SALAZAR, individually and on behalf of

all others similarly situated,

Plaintiff, Case No. 1:22-cv-07935 (JLR) -against- OPINION AND ORDER NATIONAL BASKETBALL ASSOCIATION,

Defendant.

JENNIFER L. ROCHON, United States District Judge:

Plaintiff Michael Salazar (“Plaintiff”) brings claims on behalf of a putative class against Defendant National Basketball Association (“Defendant” or the “NBA”), the owner of NBA.com, under the under the Video Privacy Protection Act (VPPA), 18 U.S.C. § 2710. Dkt. 72 (“SAC”). The NBA moves to dismiss the Second Amended Complaint pursuant to Federal Rule of Civil Procedure (“Rule”) 12(b)(6). Dkt. 74. For the reasons that follow, the Court GRANTS the motion to dismiss.

BACKGROUND [1]

I. Factual Allegations

The NBA is an American sports league that owns the website NBA.com. SAC ¶¶ 1, 17. NBA.com provides “a broad selection of video content” in the “Videos” section of the site. SAC ¶ 17(e). Through NBA.com and the NBA mobile application (the “NBA App”), the NBA delivers “countless hours of video content to its digital subscribers.” SAC ¶ 17(g).

To register for NBA.com, users sign up for an online newsletter using their email address.

SAC ¶ 39. According to Plaintiff, all digital subscribers provide the NBA with their IP address, a “unique number assigned to all information technology connected devices,” that informs the NBA of a subscriber’s “city, zip code, and physical location.” SAC ¶ 41. Digital subscribers “have access to a variety of NBA.com Video Media” on NBA.com. SAC ¶ 44.

Nonparty Meta “promotes its ability to allow businesses to target their ads to specific audiences,” SAC ¶ 98, including through the Meta Pixel tracking tool (the “Pixel”), “a snippet of JavaScript code” that lets online businesses “track visitor activity on [their] website[s],” SAC ¶ 100 (citation omitted). Once activated, the Pixel “tracks the people and [the] type[s] of actions they take,” including the pages users visit and the “buttons they click.” SAC ¶ 101 (citation omitted). Websites can also program the Pixel to track “conversions,” actions that visitors to a website take, which can “be used to analyze the effectiveness of ad campaigns and to define custom audiences to adjust and create new campaigns.” SAC ¶ 103.

Plaintiff alleges that the NBA installed the Pixel on NBA.com and that it uses the Pixel to collect users’ data, including the videos viewed and their Facebook ID (“FID”), a “unique and persistent identifier that Facebook assigns to each user,” which it then shares with Meta, the owner of Facebook and Instagram. SAC ¶¶ 7, 130; SAC at 1. Specifically, Plaintiff alleges that when a digital subscriber watches video media on NBA.com, the Pixel sends Meta “the video content name, the URL of the pre-recorded video that was viewed . . . , [and] the viewer[’s] [FID],” SAC ¶ 120, through a “c_user_” cookie, SAC ¶ 131. See, e.g. , SAC ¶ 155 (example of HTTP communication sent from the NBA to Meta when a user watches a video).

Plaintiff became a digital subscriber to NBA.com in 2022. SAC ¶ 16. He has had a Facebook account since approximately 2010. SAC ¶ 16. Plaintiff did not discover that the NBA had disclosed his alleged personal viewing information to Meta until August 2022. SAC ¶ 176.

II. Procedural History

Plaintiff filed this suit on September 16, 2022. Dkt. 1. On December 2, 2022, the NBA moved to dismiss under Rules 12(b)(1) and 12(b)(6). Dkt. 20. The Court denied the motion to dismiss under Rule 12(b)(1) but granted the motion to dismiss under Rule 12(b)(6) because Plaintiff failed to plead that he was a consumer of goods and services from a video tape service provider within the meaning of the VPPA. See Salazar v. Nat’l Basketball Ass’n ( Salazar I ), 685 F. Supp. 3d 232, 246 (S.D.N.Y. 2023), vacated and remanded , 118 F.4th 533 (2d Cir. 2024). An appeal followed, Dkt. 53, and on October 15, 2024, the Second Circuit vacated the Court’s judgment and remanded for further proceedings, holding that Plaintiff had plausibly pleaded that he was a consumer under the VPPA by alleging that he had subscribed to the NBA’s digital newsletter. See Salazar v. Nat’l Basketball Ass’n ( Salazar II ), 118 F.4th at 546-53.

Plaintiff filed a First Amended Complaint on December 13, 2014. Dkt. 61. The NBA moved to dismiss the First Amended Complaint on January 13, 2025. Dkt. 62. After the motion was fully briefed, but before the Court had rendered a decision, Plaintiff moved to file a Second Amended Complaint on May 23, 2025, Dkt. 68, and the parties subsequently agreed to a stipulated schedule for Plaintiff to file a Second Amended Complaint and for a briefing schedule for any motion to dismiss, Dkt. 71.

Plaintiff filed the Second Amended Complaint (the “SAC”) on June 12, 2025. See generally SAC. The NBA moved to dismiss on July 24, 2025. Dkt. 74; Dkt. 75 (“Br.”). Plaintiff filed his opposition on September 4, 2025, Dkt. 79 (“Opp.”), and the NBA filed its reply on September 25, 2025, Dkt. 80 (“Reply”). The motion is thus fully briefed. [2]

LEGAL STANDARD

Under Rule 12(b)(6), a complaint must contain “sufficient factual matter, accepted as true, to state a claim to relief that is plausible on its face.” Francis v. Kings Park Manor, Inc. , 992 F.3d 67, 72 (2d Cir. 2021) (en banc) (quoting Ashcroft v. Iqbal , 556 U.S. 662, 678 (2009)). The court draws all reasonable inferences in the plaintiff’s favor and accepts as true all nonconclusory allegations of fact. Id. However, a complaint must allege “more than a sheer possibility that a defendant has acted unlawfully” and more than “facts that are ‘merely consistent with’ a defendant’s liability.” Iqbal , 556 U.S. at 678 (quoting Bell Atl. Corp. v. Twombly , 550 U.S. 544, 556, 557 (2007)). Determining whether a complaint states a plausible claim is “a context-specific task that requires the reviewing court to draw on its judicial experience and common sense.” at 679.

DISCUSSION

Plaintiff alleges that the NBA violated the VPPA when it disclosed his personally identifiable information to Meta through the Pixel. SAC ¶¶ 186-197. The NBA moves to dismiss the SAC, arguing that Plaintiff has failed to state a claim under the VPPA. Dkt. 74.

The VPPA provides that “[a] video tape service provider who knowingly discloses, to any person, personally identifiable information concerning any consumer of such provider shall be liable to the aggrieved person.” 18 U.S.C. § 2710(b)(1). “To state a claim under the VPPA, a plaintiff must plausibly allege that (1) a video tape service provider (2) knowingly disclosed to any person (3) personally identifiable information concerning her use of the service.” Solomon v. Flipps Media, Inc. , 136 F.4th 41, 44 (2d Cir. 2025).

The NBA argues that Plaintiff’s claims should be dismissed because (1) under binding Second Circuit precedent, there was no disclosure of personally identifiable information under the VPPA, Br. at 11-15; and (2) Plaintiff does not allege knowing disclosure, id. at 15-18. The NBA also argues that even if the Court declines to dismiss the SAC in its entirety, it should dismiss the SAC’s claims on behalf of a putative class, since Plaintiff waived them by accepting NBA.com’s terms of use. Id. at 19-23. The Court need only address the NBA’s first argument, that Plaintiff’s claim is foreclosed by binding Second Circuit precedent because he has not alleged the disclosure of personally identifiable information under the VPPA.

The VPPA defines “personally identifiable information” as “information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider.” 18 U.S.C. § 2710(a)(3). The Courts of Appeals have diverged in their interpretation of this term. See Nixon v. Pond5, Inc. , No. 24-cv-05823 (JLR), 2025 WL 2030303, at *4 (S.D.N.Y. July 21, 2025) (summarizing “reasonable foreseeability” standard used in the First Circuit and “ordinary person” standard used in the Third and Ninth Circuits). The Second Circuit recently adopted the “ordinary person” standard and held that “‘personally identifiable information’ encompasses information that would allow an ordinary person to identify a consumer’s video- watching habits, but not information that only a sophisticated technology company could use to do so.” , 136 F.4th at 52. Thus, to survive a motion to dismiss, plaintiffs must “plausibly allege[] that [the defendant]’s disclosure of [information] ‘would, with little or no extra effort, permit an ordinary recipient to identify [the plaintiff]’s video-watching habits.’” at 54 (quoting In re Nickelodeon Consumer Priv. Litig. , 827 F.3d 262, 284 (3d Cir. 2016)); see Nixon , 2025 WL 2030303, at *5 (applying standard articulated in Solomon ).

The Second Circuit has now twice rejected Pixel-based VPPA claims like those brought here. In Solomon , the plaintiff brought a VPPA claim against a defendant that had installed the Pixel on its website. See Solomon , 136 F.4th at 54. Among other things, the Second Circuit found that the complaint did not “plausibly allege that an ordinary person could identify [the plaintiff] through her FID,” since an ordinary person would not see the “c_user” cookie and the corresponding string of letters “and conclude that the phrase was a person’s FID.” Id. ; see also In re Nickelodeon , 827 F.3d at 283 (“To an average person, an IP address or a digital code in a cookie file would likely be of little help in trying to identify an actual person.”). Shortly thereafter, in Hughes v. National Football League , No. 24-2656, 2025 WL 1720295 (2d Cir. June 20, 2025) (summary order), the Second Circuit affirmed the dismissal of another VPPA action on this basis. Id. at *2. The Second Circuit declared that “ effectively shut the door for Pixel-based VPPA claims.” ; see id. at *3 (rejecting the argument that “a viewer’s FID can be identified based on the string of numerals following the ‘c_user’ field” since it was “not plausible that an ordinary person, without [] annotation . . . , would see the ‘c_user’ phrase on [this communication] and conclude that the phrase was a person’s FID” (alterations and omission in original) (quoting , 136 F.4th at 54)).

Faced with this landscape, Plaintiff principally argues that the Court should decline to apply Solomon and Hughes because those decisions purportedly contravened the Supreme Court’s recent warnings against judge-made tests unsupported by statutory text and are inconsistent with Salazar II . See Opp. at 4-11. But this Court — like all district courts within the Second Circuit — is bound by stare decisis “to follow decisions of the Second Circuit until that court says otherwise.” Rappaport v. Guardian Life Ins. Co. of Am. , No. 22-cv-08100 (JLR), 2024 WL 4872736, at *12 (S.D.N.Y. Nov. 22, 2024); see United States v. Diaz , 122 F. Supp. 3d 165, 179 (S.D.N.Y. 2015) (explaining that where “the Second Circuit has spoken directly to the issue presented by this case . . . this Court is required to follow that decision unless and until it is overruled in a precedential opinion by the Second Circuit itself or unless a subsequent decision of the Supreme Court so undermines it that it will almost inevitably be overruled by the Second Circuit.” (citation and internal quotation marks omitted)), aff’d , 854 F.3d 197 (2d Cir. 2017). Plaintiff has not cited any decision of the Second Circuit indicating that it is “all but certain to overrule” Solomon . Diaz , 122 F. Supp. 3d at 179 (citation omitted). Nor does the Court find inconsistent with Salazar II , as Plaintiff argues, Opp. at 7, given that the Salazar II court expressly acknowledged the distinction between the VPPA’s broad definition of “consumer” and narrower definition of “personally identifiable information,” Salazar II , 118 F.4th at 548, but deferred the question of “what exactly is ‘personally identifiable information’” for a later day, id. at 549 n.10 (noting “we need not and do not explore” on this appeal “what exactly is ‘personally identifiable information’”). See also id. at 548 (“[I]t’s the definition of ‘personally identifiable information’ that limits what can be shared, not the definition of ‘consumer.’”); id. at 549 (noting that while “consumer” should be understood broadly, “[t]his is not to say that the VPPA’s reach is boundless,” given that “the statute only prohibits video tape service providers from ‘knowingly disclos[ing] personally identifiable information ’” (alteration in original) (quoting 18 U.S.C. § 2710(b)(1))). That later day came in .

In addition, the recent Supreme Court decisions to which Plaintiff cites do not persuade the Court that Solomon has been “so undermine[d] . . . that it will almost inevitably be overruled by the Second Circuit.” Diaz , 122 F. Supp. 3d at 179. Ames v. Ohio Department of Youth Services , 145 S. Ct. 1540 (2025), CC/Devas (Mauritius) Ltd. v. Antrix Corp. , 145 S. Ct. 1572 (2025), and A.J.T. ex rel. A.T. v. Osseo Area Schools , 145 S. Ct. 1647 (2025), each dealt with unrelated and distinct statutes — Title VII, the Foreign Sovereignty Immunities Act, and the Americans with Disabilities Act of 1990 — and do not call into question the Second Circuit’s interpretation of the term “personally identifiable information” in the VPPA. See In re Guo , 965 F.3d 96, 106 (2d Cir. 2020) (explaining that Supreme Court’s “emphasis on the primacy of plain textual meaning” in decision involving statutory interpretation was “based on general principles of statutory construction that cast no doubt on [the Second Circuit’s] precedent”). Moreover, in each case, the Supreme Court rejected the lower courts’ tests because they were inconsistent with the text of the statute. See Ames , 145 S. Ct. at 1546 (rejecting “background circumstances” rule because it could not “be squared with the text of Title VII”); Antrix , 145 S. Ct. at 1576, 1580 (holding that Foreign Sovereign Immunity Act’s personal jurisdiction provision did not import the “minimum contacts” analysis because there was no reference to “minimum contacts”); A.J.T. , 145 S. Ct. at 1655-56 (rejecting “bad faith or gross misjudgment rule” as inconsistent with broad statutory language making remedies available to “any person”). There is no basis for this Court to find that the Second Circuit’s decision in runs afoul of the statutory text of the VPPA, and thus Plaintiff’s reliance on these cases does not convince the Court that is soon to be overruled. Indeed, Plaintiff’s same counsel made the identical arguments in their petition for panel rehearing or rehearing en banc to the Second Circuit in Hughes , and the request was denied. See Petition for Panel Rehearing or Rehearing En Banc at 10-12, Hughes , 2025 WL 1720295 (No. 24-2656), Dkt. No. 53 (citing Ames , Antrix , and A.J.T. ); Order, Hughes , 2025 WL 1720295 (No. 24-2656), Dkt. No. 54 (denying petition for panel rehearing and the request for rehearing en banc ). [3] As such, the Court rejects Plaintiff’s invitation to disregard Solomon and Hughes and applies the Second Circuit’s ordinary-person standard to evaluate Plaintiff’s complaint.

Plaintiff’s allegations mirror those found insufficient in and Hughes , as well as in post- decisions considering Pixel-based VPPA claims. Recently, in Nixon v. Pond5, Inc. , this Court dismissed a VPPA claim based on allegations that “the Meta Pixel automatically caused the [p]laintiffs’ . . . personal identifiers, including the c_user . . . cookie[], to be transmitted to Meta, attached to the fact that the [p]laintiffs . . . had viewed the website and the titles of the videos the [p]laintiffs . . . viewed.” 2025 WL 2030303, at *5 (omissions in original) (citation omitted). The Court rejected the plaintiffs’ argument that the FIDs could “be identified from the c_user cookie and [could] thus be used to identify their individual video-watching habits,” since the Second Circuit had twice rejected the theory and held that an ordinary person “would not plausibly be able to identify [p]laintiff’s video-watching habits as a result of the Pixel transmissions.” And just last month, two other courts in this district rejected similar claims, relying on Solomon and Hughes . See Golden v. NBCUniversal Media, LLC , No. 22-cv-09858 (PAE), 2025 WL 2530689, at *6-7 (S.D.N.Y. Sept. 3, 2025) (dismissing Pixel-based VPPA claims because allegations that “a person with the right tools can use an FID to identify a specific Facebook user” did not satisfy the ordinary-person standard based on Solomon , Hughes , and Nixon ); Taino v. Bow Tie Cinemas, LLC , No. 23-cv-05371 (VSB), 2025 WL 2652730, at *7-8 (S.D.N.Y. Sept. 16, 2025) (dismissing Pixel- based VPPA claims based on allegations that were “essentially identical . . . to the allegations made by the plaintiff in ”). Like the complaints in , Hughes , Nixon , Golden , and Taino , the SAC here alleges that the NBA “disclosed users’ video-viewing activity to [Meta] via the Pixel, specifically by transmitting URLs, FIDs, and video-watching history without [Plaintiff’s] knowledge or consent.” Golden , 2025 WL 2530689, at *7; see SAC ¶¶ 155-156. It includes an example of an alleged transmission to Facebook with lines of computer code. SAC ¶ 155. And it alleges that since a person with the right know-how can use an FID to identify a specific Facebook user, the data is personally identifiable information for purposes of the VPPA. Id. ¶¶ 156-158. Plaintiff insists that the information is personally identifiable information because a person can use a simple online search to identify a specific Facebook user using an FID or use ChatGPT to do so. ¶¶ 132-133, 144. Yet the Second Circuit rejected near-identical arguments in Hughes on the ground that such allegations did not make it plausible that “an ordinary person would be able to understand the actual underlying code communication itself,” Hughes , 2025 WL 1720295, at *3 (rejecting that potential use of “ubiquitous internet-based tools like ChatGPT” to translate the code was sufficient), and courts considering similar contentions since have likewise found them unpersuasive, see, e.g. , Taino , 2025 WL 2652730, at *8 (claim that “someone could perform ‘a Google search using the word “Facebook” plus a given Facebook ID number’ to identify the user’s Facebook profile, [was] likewise insufficient to demonstrate that an ordinary person would know what to do with the c_user information to pinpoint an individual’s identity” (citation omitted)); Golden , 2025 WL 2530689, at *7 (“[D]isclosures comprehensible only to Facebook or other sophisticated actors are not [personally identifiable information].”). There is no basis for the Court to reach a different result here. Because an ordinary person would not plausibly be able to identify Plaintiff’s video-watching habits as a result of the Pixel transmissions, Plaintiff has not plausibly alleged that the NBA disclosed personally identifiable information in violation of the VPPA.

CONCLUSION

For the foregoing reasons, the Court GRANTS the NBA’s motion to dismiss. The Second Amended Complaint is dismissed with prejudice. The Clerk of Court is respectfully directed to terminate the motion at Dkt. 74 and close the case.

Dated: October 6, 2025

New York, New York SO ORDERED. JENNIFER L. ROCHON United States District Judge

Notes

[1] Unless otherwise noted, the following facts are drawn from the Second Amended Complaint, which the Court “constru[es] . . . liberally, accepting all factual allegations in the complaint as true, and drawing all reasonable inferences in the plaintiff’s favor.” Herrera v. Comme des Garcons, Ltd. , 84 F.4th 110, 113 (2d Cir. 2023) (quoting Miller v. Metro Life Ins. Co. , 979 F.3d 118, 121 (2d Cir. 2020)).

[2] Plaintiff requested oral argument via notation on his motion. The Court declines this request because the parties’ briefing was sufficient and oral argument would not materially assist the Court. See Dotson v. Griesa , 398 F.3d 156, 159 (2d Cir. 2005) (“[A] district court acts well within its discretion in deciding dispositive motions on the parties’ written submissions without oral argument.”).

[3] Similarly unhelpful are Plaintiff’s citations to out-of-Circuit cases that engage in statutory interpretation of statutes other than the VPPA, almost all of which, like Ames , involved the interpretation of civil rights statutes. See McDaniel v. Preserve Prop. Mgmt. Co., LLC , --- F. Supp. 3d ---, 2025 WL 2052642, at *2 (D.R.I. July 22, 2025) (interpreting state-law equivalent to Title VII); United States v. Abdullahi , 144 F.4th 1034, 1044-45 (8th Cir. 2025) (Stras, J., concurring in part) (interpreting federal kidnapping statute); Moore v. United States , 177 Fed. Cl. 89, 104 (2025) (Equal Pay Act); Frutoz v. Valley Children’s Hosp. , No. 25-cv-00016, 2025 WL 1767953, at *5-6 (E.D. Cal. June 26, 2025) (EMTALA); Charlton-Perkins v. Univ. of Cincinnati , No. 20-cv-00179, 2025 WL 2390365, at *11 n.9 (S.D. Ohio Aug. 18, 2025) (Title IX and Equal Protection Clause). Simon v. Ivey , No. 25-cv-00067, 2025 WL 2345845 (N.D. Ala. Aug. 13, 2025), merely applied Ames ’s holding that “there is not a heightened standard for showing discrimination against a member of a majority group” in a First Amendment case, id. at *60, and has no relevance to the Court’s interpretation of the VPPA.