Facts
- Phil Thuku Kamau was appointed an attorney for his representation in an appeal [lines="20-21"].
- The attorney moved to withdraw and filed an Anders brief, which evaluated potential issues for appeal [lines="20-21"].
- Kamau submitted a response to his attorney's brief [lines="22-23"].
- The appellate court reviewed the counsel's brief and relevant portions of the record alongside Kamau's response [lines="31-30"].
- The court found that the appeal presented no nonfrivolous issues for appellate review [lines="32"].
Issues
- Whether the appeal presented any nonfrivolous grounds for review [lines="31-32"].
Holdings
- The court granted the motion to withdraw, excused the counsel from further responsibilities, and dismissed the appeal due to a lack of nonfrivolous issues [lines="33-35"].
OPINION
MICHAEL SALAZAR, INDIVIDUALLY AND ON BEHALF OF ALL OTHERS SIMILARLY SITUATED v. NATIONAL BASKETBALL ASSOCIATION
Docket No. 23-1147
United States Court of Appeals For the Second Circuit
October 15, 2024
August Term, 2023
(Argued: April 2, 2024 Decided: October 15, 2024)
Before: RAGGI, LEE, and ROBINSON, Circuit Judges.
Salazar alleges that (1) he signed up for the NBA‘s free online newsletter, meaning he exchanged information including his email address in return for periodic emails from the NBA; (2) he visited the NBA‘s website, NBA.com, where he watched videos; and (3) the NBA violated the VPPA by knowingly disclosing, without Salazar‘s permission, certain information about Salazar and the videos he watched.
We must answer two questions on appeal. First, has Salazar pled that he suffered a sufficiently “concrete” injury to confer Article III standing under TransUnion LLC v. Ramirez, 594 U.S. 413 (2021)? Second, did the district court err in holding that Salazar is not a “subscriber of goods or services” based on its reasoning that the online newsletter is not an audiovisual “good or service,” and that signing up for the newsletter did not make Salazar a VPPA “subscriber“?
We answer both questions in the affirmative. Salazar‘s alleged injuries are sufficiently concrete to confer Article III standing. And the district court erred by holding that Salazar is not a “subscriber of goods or services” from the NBA. Accordingly, we VACATE the district court‘s judgment and REMAND for further proceedings.
JOSHUA I. HAMMACK (Michael L. Murphy, on the brief), Bailey & Glasser, LLP, Washington, D.C., for Plaintiff-Appellant.
MATTHEW X. ETCHEMENDY, Vinson & Elkins LLP, Washington, D.C. (Hilary L. Preston, Marisa Antonelli, Vinson & Elkins LLP, New York, NY, on the brief), for Defendant-Appellee.
Jordan L. Von Bokern, U.S. Chamber Litigation Center, Washington, D.C.;
ROBINSON, Circuit Judge:
The Video Privacy Protection Act (VPPA) makes it unlawful for a “video tape service provider” to “knowingly disclose[], to any person, personally identifiable information concerning any consumer of such provider.”
Plaintiff-Appellant Michael Salazar says he signed up for an online email newsletter offered by Defendant-Appellee the National Basketball Association (NBA). He further alleges he visited the NBA‘s website, NBA.com, where he watched videos. After he watched those videos, his video-watching history and “Facebook ID” (we describe both below) were disclosed to Meta Platforms, Inc. (Meta) without his permission. Those disclosures, Salazar contends, violated the VPPA.
The central question in this appeal is whether Salazar is a “consumer” under the VPPA so that the knowing disclosure by a video tape service provider of his video viewing history violates that statute. The VPPA defines “consumer” to mean “any renter, purchaser, or subscriber of goods or services from a video tape service provider.”
Salazar contends that when he signed up for the NBA‘s online newsletter through NBA.com, he exchanged personal information in return for emailed NBA-related updates, thereby making him a “subscriber of goods or services,” and, accordingly, a VPPA “consumer.” And by offering videos on NBA.com, the NBA became a “video tape service provider” prohibited by the VPPA from disclosing the personally identifiable information of consumers like Salazar. So, Salazar submits, when he watched NBA.com videos, and when the NBA then disclosed his Facebook ID and video-watching history to Meta without his consent, the NBA violated the VPPA.
The NBA counters that Salazar is not a VPPA “consumer” because the online newsletter he signed up for is not an audiovisual “good or service,” and signing up for the newsletter did not in any event make him a “subscriber” under the statute. It also asserts that Salazar has not pled a sufficiently “concrete” injury to confer Article III standing under the standards set forth by the Supreme Court in TransUnion LLC v. Ramirez, 594 U.S. 413 (2021).
The United States District Court for the Southern District of New York (Rochon, J.) dismissed Salazar‘s suit in an August 8, 2023 judgment. Although it concluded that Salazar had standing to sue, it ruled for the NBA on the merits, holding that Salazar had not plausibly pled that he is a “consumer” under the VPPA. The court held that the phrase “goods or services” within the VPPA‘s definition of “consumer” is limited to audiovisual “goods or services“—which the online newsletter is not—and that signing up for an online newsletter did not make Salazar a VPPA
As a threshold matter, we hold that Salazar has pled an injury that confers Article III standing. His core alleged harm—that his personal information was disclosed to a third party, without his consent, in violation of the VPPA—“has a ‘close relationship’ to a harm traditionally recognized as providing a basis for a lawsuit in American courts“: public disclosure of private facts. TransUnion, 594 U.S. at 417. Salazar‘s injury therefore satisfies Article III standing‘s concreteness requirement.
On the merits, we hold that the district court erred in determining that Salazar failed to plausibly plead that he is a “consumer” under the VPPA because we conclude that he satisfactorily alleged he was a “subscriber of goods or services” from the NBA. The VPPA‘s text, structure, and purpose compel the conclusion that that phrase is not limited to audiovisual “goods or services,” and the NBA‘s online newsletter falls within the plain meaning of that phrase. And by trading personal information like his email and IP addresses in return for receiving the online newsletter, Salazar became a “subscriber of” that newsletter. Accordingly, we VACATE the district court‘s judgment and REMAND for further proceedings.
BACKGROUND1
I. The NBA, NBA.com, the “Facebook Pixel,” and the NBA‘s Online Newsletter
The NBA is a professional sports league headquartered in New York. It owns the website NBA.com, on which people can watch “a broad selection of video content.” Jt. App‘x at 10.2 The NBA says these videos are free.
Salazar doesn‘t allege that he had to pay any money to watch the videos. But he does plead that the NBA, using certain bits of code, extracts information from NBA.com video-watchers like him.
The code most relevant to this case is a “tracking pixel“—a piece of code embedded on a website someone visits. As its name suggests, a tracking pixel tracks users as they navigate the website, reporting back to the pixel‘s owner. The information tracked depends on the tracking pixel‘s configuration.
Here, Salazar alleges that Meta owns a tracking pixel, which we call the “Facebook Pixel.” The NBA has installed the Facebook Pixel on NBA.com. Meta coded that pixel to collect and send to it (1) the title of the NBA.com video a user watched,
By possessing the video title and URL of watched videos associated with a given FID, Meta can link a given Facebook profile to those watched videos. And with that information, Meta can send a user targeted advertisements. The NBA receives financial remuneration from this arrangement.
The NBA also allows people to sign up for an “online newsletter.” Id. at 12. Here too, Salazar doesn‘t contend that he had to pay any money to sign up for the newsletter. Instead, he alleges that he gave the NBA certain personal information, and in return, the NBA sent him “emails and other communications.” Id. at 12, 19.
II. Salazar‘s Allegations
Salazar‘s VPPA claim rests on three primary allegations: (1) he has a Facebook account; (2) he signed up for the NBA‘s online newsletter; and (3) he watched NBA.com videos while logged into his Facebook account.
First, since 2010, Salazar “has had a Facebook account.” Id. at 10, 20. He therefore has an FID associated with that account.
Second, starting in 2022, Salazar “signed up for a digital subscription to NBA.com.” Salazar, 685 F. Supp. 3d at 237; see also Jt. App‘x at 10, 19–20. In doing so, he gave NBA.com information including his email address, IP address, “and any cookies associated with his device” in return for “emails and other communications” from the NBA. Jt. App‘x at 19.
An IP address is “the numeric address of a computer on the Internet” that typically consists of “four parts separated by dots and containing up to three digits in each part.” IP Address, Merriam-Webster‘s Unabridged Dictionary, https://unabridged.merriam-webster.com/unabridged/ip%20address [https://perma.cc/8DK2-U6F9] (last visited Sept. 4, 2024). Salazar alleges that his IP address “informs Defendant as to the city and zip code he resides in as well as his physical location.” Jt. App‘x at 19.
A “cookie” is “a small file or part of a file that is stored on the computer of a World Wide Web user, that is created and subsequently read by a website server, and that contains personal user information (such as a user identification code, customized preferences, or a record of pages visited).” Cookie, Merriam-Webster‘s Unabridged Dictionary, https://unabridged.merriam-webster.com/unabridged/cookie [https://perma.cc/GFE3-ALB9] (last visited Sept. 4, 2024).
There are presently no allegations in Salazar‘s complaint that he watched or accessed NBA.com videos through the online newsletter. He has, however, submitted that he could amend his complaint to plausibly allege that “the NBA‘s online newsletter gave subscribers ‘exclusive content or enhanced access’ to video content.” Appellant‘s Br. at 34–35 (quoting Jt. App‘x at 210).
Third, also starting in 2022, Salazar has watched NBA.com videos through NBA.com “while logged into his Facebook account.” Jt. App‘x at 10. Watching videos while logged into his Facebook account caused his personal viewing information to be transmitted to Meta.3 See id. Salazar
Putting the pieces together, Salazar alleges that signing up for the online newsletter made him a “subscriber of goods or services,” and, therefore, a
“consumer” under the VPPA. And watching videos on NBA.com caused his “personally identifiable information“—his personal viewing information—to be disclosed to Meta without his consent. So, Salazar says, the NBA violated the VPPA.
III. District Court Proceedings
Salazar filed his putative class action complaint in September 2022, purporting to represent “[a]ll persons in the United States with a digital subscription to an online website owned and/or operated by [the NBA] that had their Personal Viewing Information disclosed to [Meta] by [the NBA].” Id. at 20. He raised a single cause of action: violation of the VPPA.
The NBA moved to dismiss pursuant to
On the merits, the NBA primarily argued that Salazar was not a “consumer” under the VPPA since he was not a “renter, purchaser, or subscriber of goods or services from a video tape service provider.” Id. at 49 (quoting
In an August 2023 opinion, the district court denied the NBA‘s motion to dismiss for lack of standing but granted its motion
With respect to Article III standing, the court explained that Salazar‘s alleged harm—deprivation of privacy rights based on the NBA‘s non-consensual disclosure of his personal viewing information—was closely related to two
traditionally recognized common-law analogs: disclosure of private facts and intrusion upon seclusion. See id. at 239–42. Accordingly, the court held that Salazar pled a concrete Article III injury under TransUnion. Id. at 242.
On the merits, the court concluded that Salazar failed to plead a VPPA claim because he had not plausibly alleged that he was a VPPA “consumer.” Id. at 246. It rejected Salazar‘s argument that his signing up for the online newsletter made him a “subscriber” under the VPPA, reasoning that “the VPPA only applies to consumers (including subscribers) of audio video services.” Id. at 244. The court also rejected Salazar‘s argument that the newsletter‘s links to videos available on NBA.com affect the calculus. It reasoned that the newsletter‘s inclusion of links to content otherwise “generally accessible on the NBA.com website” did not constitute a sufficient exchange of value to create a subscriber relationship “given the lack of allegations regarding exclusive content or enhanced access” to audiovisual services through the newsletter. Id. at 245–46.
Because the court concluded that Salazar had not plausibly alleged that he was a VPPA “consumer,” it did not address the NBA‘s remaining arguments. Id. at 246. It further denied Salazar‘s “blanket request for leave to amend his Complaint ‘to address any issues the Court raises in its Order‘” since Salazar had the opportunity to view the NBA‘s arguments for dismissal and didn‘t describe the substance of a proposed amendment. Id. at 246–47. The court therefore entered judgment dismissing the case, which Salazar timely appealed.
DISCUSSION
The NBA argues that the district court erred by concluding that Salazar has Article III standing to sue. Salazar contends that the court erred on the merits by holding that he is not a “consumer” as defined in the VPPA.
We hold that Salazar sufficiently pled that he has Article III standing and that he is a “subscriber of goods or services from a video tape service provider” and therefore a “consumer” under the VPPA.
I. Standing
We start by evaluating whether Salazar has adequately pled injury as necessary to demonstrate Article III standing to sue for a violation of the VPPA. He has. Salazar‘s alleged injury stems from the unauthorized disclosure of his personal viewing information, which is closely related to at least one common-law analog traditionally recognized as providing a basis for a lawsuit in American courts: public disclosure of private facts.
Since “standing is challenged on the basis of the pleadings, we accept as true all material allegations of the complaint,” which we construe “in favor of the complaining party.” Bohnak v. Marsh & McLennan Companies, Inc., 79 F.4th 276, 283 (2d Cir. 2023) (internal quotation marks omitted). We do so in this context without deferring to the district court. Id.
A federal court lacks subject matter jurisdiction—and therefore cannot consider a lawsuit‘s merits—unless three constitutional standing requirements are met. First, the plaintiff must have suffered an “injury in fact that is concrete, particularized, and actual or imminent.” TransUnion, 594 U.S. at 423. Second, that injury must be traceable to the defendant‘s challenged conduct—it must have been “likely caused by the defendant.” Id. And third, it must be likely that the injury would “be redressed by judicial relief.” Id. As “[t]he party invoking federal jurisdiction,” Salazar bears the burden of establishing Article III standing. Lujan v. Defenders of Wildlife, 504 U.S. 555, 561 (1992).
The NBA argues that Salazar has not alleged that he has suffered a “concrete” injury in fact. We disagree.
Article III standing requires that “[o]nly those plaintiffs who have been concretely harmed by a defendant‘s statutory violation may sue that private defendant over that violation in federal court.” TransUnion, 594 U.S. at 427; see also Bohnak, 79 F.4th at 283 (explaining that ”TransUnion is the touchstone for” assessing the concreteness requirement). To allege a concrete harm, a plaintiff must point to “a close historical or common-law analogue for their asserted injury.” TransUnion, 594 U.S. at 424. But they need not present an “exact duplicate.” Id. at 433. Rather, “what matters is ‘whether the alleged injury to the plaintiff has a ‘close relationship’ to a harm ‘traditionally’ recognized as providing a basis for a lawsuit in American courts.‘” Packer on behalf of 1-800-Flowers.Com, Inc. v. Raging Capital Management, LLC, 105 F.4th 46, 52 (2d Cir. 2024) (quoting TransUnion, 594 U.S. at 424).
Both tangible and intangible harms can satisfy the concreteness requirement. “[T]raditional tangible harms” like physical and monetary harms “readily qualify as concrete.” TransUnion, 594 U.S. at 425. So do “[v]arious intangible harms” closely related to a traditionally recognized harm. Id.
One intangible harm that readily qualifies as concrete is the public disclosure of private facts. Id. This “well-established common-law analog,” Bohnak, 79 F.4th at 285, is triggered when one “gives publicity to a matter concerning the private life of another, . . . if the matter publicized is of a kind that (a) would be highly offensive to a reasonable person, and (b) is not of legitimate concern to the public,” id. (quoting Restatement (Second) Torts § 652D).5
Our conclusion that Salazar has pled that he suffered an injury closely related to the public disclosure of private facts analog is guided by our recent decision in Bohnak. There, Bohnak had sued her former employer for failing to adequately protect and warn her about the vulnerability of personal information including her social security number, driver‘s license, and passport information. That information was stolen when her employer was targeted in a data breach. Id. at 280–82.
We had “no trouble” concluding that “Bohnak‘s alleged harm [wa]s sufficiently concrete to support her claims for damages” because her core alleged injury—exposure of her personally identifiable information to unauthorized third parties—“bears some relationship to a well-established common-law analog: public disclosure
that ‘disclosure of private information’ was an intangible harm ‘traditionally recognized as providing a basis for lawsuits in American courts.‘” Id. at 286 (quoting TransUnion, 594 U.S. at 425). And because Bohnak‘s alleged harm was closely related to a common-law analog, it did not matter whether she had “assert[ed] a common law claim for public disclosure of private facts” against her employer or whether the relevant “common law recognize[d] a tort relating to publication of private facts.” Id. at 286.
For these reasons, we similarly have “no trouble” holding here that Salazar‘s alleged harm is sufficiently concrete to withstand dismissal. Id. at 285. Like Bohnak, Salazar‘s core allegation is that his personally identifiable information was exposed to an unauthorized third party. Jt. App‘x at 24. And Salazar doesn‘t just allege that his data was exposed to a third party; rather, he asserts that it was disclosed as a result of an arrangement between the NBA and Meta pursuant to which the NBA deliberately uses the Facebook Pixel. This alleged harm is closely related to the public disclosure of private facts analog.
The NBA‘s arguments to the contrary are unpersuasive. To the NBA, the disclosure in Bohnak—to hackers through a data breach—is quite different from “limited disclosures to a single legitimate business” like Meta because hackers have a “known penchant for trading illegally acquired [personally identifiable information] ‘through the dark web,‘” thereby making the disclosure in Bohnak more analogous to a public disclosure of private facts than the disclosure of Salazar‘s information to Meta. Appellee‘s Br. at 24 n.7 (quoting Bohnak, 79 F.4th at 281).
Based on this asserted lack of publicity, the NBA insists that Salazar‘s allegations of injury are more like those held insufficient in cases from other circuits involving mail vendor corporations and a different statute: the Fair Debt Collection Practices Act (FDCPA). In those cases, plaintiffs sued debt collection agencies for violating the FDCPA by giving their personal information to mail vendors, which then used the disclosed information to send the plaintiffs prewritten letters notifying them about their outstanding debts. See Appellee‘s Br. at 21–25 (citing Hunstein v. Preferred Collection & Management Services, Inc., 48 F.4th 1236, 1240 (11th Cir. 2022) (en banc); Shields v. Professional Bureau of Collections of Maryland, Inc., 55 F.4th 823, 827 (10th Cir. 2022); Nabozny v. Optio Solutions LLC, 84 F.4th 731, 733 (7th Cir. 2023).6 These courts concluded that any
limited disclosures—to mail vendors who then sent the information back to its owner—was not closely related to harm from the public disclosure of private facts analog. See Hunstein, 48 F.4th at 1245–49; Shields, 55 F.4th at 828–29; Nabozny, 84 F.4th at 735–38.
(en banc) (holding that Hunstein‘s alleged harm wasn‘t closely related to the public disclosure of private facts tort because his allegations were “missing an element essential to liability“: “disclosure to the public“) (internal quotation marks omitted). Not every circuit has adopted that approach. See, e.g., Shields v. Professional Bureau of Collections of Maryland, Inc., 55 F.4th 823, 829 (10th Cir. 2022) (“Shields did not have to plead and prove the tort‘s elements to prevail. But to proceed, she had to at least allege a similar harm.“); Barclift v. Keystone Credit Services, LLC, 93 F.4th 136, 145 (3d Cir. 2024) (“We believe that if the Court wanted us to compare elements, it would have simply said so. So when asking whether a plaintiff‘s intangible injury is ‘concrete,’ we will examine the kind of harm at issue.“), petition for cert. filed, No. 23-1327 (June 20, 2024).
Nor have we. This Court has applied TransUnion in at least four published opinions to determine whether an alleged harm satisfies Article III standing‘s concreteness requirement. We did not, in any of those cases, hold that TransUnion demands that a plaintiff adequately plead every element of a common-law analog to satisfy the concreteness requirement. See Maddox v. Bank of New York Mellon Trust Company, N.A., 19 F.4th 58, 62–66 (2d Cir. 2021); Bohnak v. Marsh & McLennan Companies, Inc., 79 F.4th 276, 283–87 (2d Cir. 2023); Saba Capital Cef Opportunities 1, Ltd. v. Nuveen Floating Rate Income Fund, 88 F.4th 103, 114–17 (2d Cir. 2023); Packer on behalf of 1-800 Flowers.Com, Inc. v. Raging Capital Management, LLC, 105 F.4th 46, 51–56 (2d Cir. 2024); see also Stafford v. International Business Machines Corporation, 78 F.4th 62, 67–69 (2d Cir. 2023) (applying TransUnion to the mootness doctrine, which “is standing set in a time frame“) (internal quotation marks omitted). Instead, we followed the Supreme Court‘s directive in TransUnion that the concrete injury requirement for standing does not demand that a plaintiff alleging intangible harm identify and establish an “exact duplicate” in common law, but asks “whether a plaintiff‘s asserted harm has a ‘close relationship’ to a harm traditionally recognized as providing a basis for a lawsuit in American courts.” TransUnion LLC v. Ramirez, 594 U.S. 413, 433–34 (2021) (stating that “publication is essential to liability” in explaining why “mere presence of an inaccuracy in an internal credit file” that was not disclosed to third-party was not analogous to harm from defamatory statement, without suggesting that plaintiff must satisfy all elements of defamation to show “close relationship” to defamation analog (internal quotation marks omitted)); see id. at 433 (holding dissemination of misleading credit reports is analogous to harm from defamation even though defendant asserted reports were “only misleading and not literally false,” because harm from misleading statement of “being labeled a ‘potential terrorist’ . . . bears a sufficiently close relationship to the harm from a false and defamatory statement“).
Glossing over the numerous factual and legal distinctions between the mail vendor cases and Salazar’s allegations, the NBA submits that the mail vendor “cases are on all fours” with this one because they all involve “limited disclosures to a single legitimate business.” Appellee’s Br. at 23, 24 n.7. The analogy is inapt. Meta isn’t a “ministerial intermediary” like a mail vendor, Nabozny, 84 F.4th at 736—it’s one of the world’s largest companies, employing more than 67,000 people, with 2024 revenues exceeding $142 billion, see Forbes, Profile, Meta Platforms, https://www.forbes.com/companies/meta-platforms/?list=global2000 [https://perma.cc/8S94-9M7A] (last visited Sept. 4, 2024).
More to the point, Meta’s use of the disclosed data is very different from that of the mail vendor. Unlike in the mail vendor cases, Salazar doesn’t allege that his personal viewing information was disclosed to an intermediary so that it could be bounced back to him on behalf of the entity that properly possessed the information. One of Salazar’s allegations is that the NBA discloses users’ personal viewing information to Meta, which then harnesses that information “to show the user targeted ads”—ads that Meta chooses for its own commercial purposes, not the NBA’s or the user’s purposes. Jt. App’x at 15 (emphasis added). Moreover, nothing in the complaint suggests that Meta can’t sell, disclose, or otherwise use Salazar’s data for additional purposes. In addition, Salazar alleges that Meta “cross-referenc[es]” “this highly sought-after information” “to the data it already has in [its] own detailed profiles.” Id. at 16–17. And the information is being used for digital advertising, id. at 15–16, an industry that “underlies many of the Internet’s most widely used services,” Brief of the Chamber
Given the nature of the companies involved, intended and potential uses of the disclosed information, and resulting enhanced disclosure risks, we see little daylight between the nature of the harm Salazar alleges and the harm flowing from the public disclosure of private facts common-law analog. Therefore, Salazar has satisfactorily pled a concrete injury sufficient to confer Article III standing and to withstand dismissal under
The NBA does not argue that Salazar has otherwise failed to plead that his alleged injury satisfies Article III standing requirements at the motion to dismiss stage. That makes sense. His alleged injury in fact is particularized and actual—his personal viewing information was disclosed without his consent to a third party. That alleged harm is traceable to the NBA’s installation of the Facebook Pixel on NBA.com. And Salazar’s requested relief—declaratory, injunctive, and monetary relief for violating the VPPA—would likely redress his injury. Accordingly, Salazar has alleged a sufficient harm to confer Article III standing, and the district court correctly denied the NBA’s motion to dismiss for lack of subject matter jurisdiction.
II. Merits
To survive
Applying these standards, we must determine whether Salazar plausibly pled that he was a “subscriber of goods or services” as understood in the VPPA. For the reasons set forth below, we conclude that he did. The phrase “goods or services” in the VPPA is not cabined to audiovisual goods or services, but also reaches the NBA’s online newsletter. By alleging that he exchanged personal information in return for periodically receiving the online newsletter, Salazar plausibly pled that he is a “subscriber of” that newsletter.
A. The VPPA
In 1987, a newspaper published an article called The Bork Tapes, see Michael Doland, The Bork Tapes, Washington City Paper (Sept. 25, 1987), which identified 146 films that Judge Robert Bork and his family had rented from a video store. At the time of publication, the Senate Judiciary Committee was holding hearings on Judge Bork’s nomination to the Supreme Court. See S. Rep. No. 100-599, at 5 (1988); Ellis v. Cartoon Network, Inc., 803 F.3d 1251, 1252–53 (11th Cir. 2015); Yershov v. Gannett Satellite Information Network, Inc., 820 F.3d 482, 485 (1st Cir. 2016).
Senators quickly decried the publication. As Senator Patrick Leahy commented during the nomination hearings:
It is nobody’s business what Oliver North or Robert Bork or Griffin Bell or Pat Leahy watch on television or read or think about when they are home. . . . In an era of interactive television cables, the growth of computer checking and check-out counters, of security systems
and telephones, all lodged together in computers, it would be relatively easy at some point to give a profile of a person and tell what they buy in a store, what kind of food they like, what sort of television programs they watch, who are some of the people they telephone. . . . I think that is wrong. I think that really is Big Brother, and I think it is something that we have to guard against. . . . Privacy is not a conservative or a liberal or moderate issue. It is an issue that goes to the deepest yearnings of all Americans that we are free and we cherish our freedom and we want our freedom. We want to be left alone.
S. Rep. No. 100-599, at 5–6 (quoting Hearings on Nomination of Robert H. Bork to be Associate Justice of the Supreme Court of the United States Before the Senate Committee on the Judiciary, 100th Cong. 1374 (1987)) (alterations adopted).
The Bork Tapes was the catalyst for the VPPA. See id. at 5; S. Rep. No. 112-258, at 2 (2012); Ellis, 803 F.3d at 1252–53. A bipartisan group of Senators, including Senator Leahy, introduced legislation in May 1988 “to preserve personal privacy with respect to the rental, purchase, or delivery of video tapes or similar audio visual materials.” S. 2361, 100th Cong. (1988); see also S. Rep. No. 100-599, at 1 (same). That bill became the VPPA. See Video Privacy Protection Act of 1988, Pub. L. No. 100-618, 102 Stat. 3195.
The VPPA prohibits a “video tape service provider” from “knowingly disclos[ing], to any person, personally identifiable information concerning any consumer of such provider,” subject to certain enumerated exceptions, such as in cases where the provider has obtained a consumer’s “informed, written consent.”
By 2012, Congress recognized that “the Internet ha[d] revolutionized the way that American consumers rent and watch movies and television programs,” such that the way “Americans used to watch videos in 1998—the VHS cassette tape—[wa]s now obsolete.” S. Rep. 112-258, at 2. These new technologies had created a problem: Americans couldn’t “share information about their video preferences on social media sites on an ongoing basis” without violating the 1988 VPPA, which required obtaining consent from the consumer for each disclosure of viewing information. Id. at 2-3. The solution? Amend the statute “to clarify that a video tape service provider may obtain a consumer’s informed, written consent on an ongoing basis and that consent may be obtained through the Internet.” Video Privacy Protection Act Amendments Act of 2012, Pub. L. 112-258, 126 Stat. 2414; see
Otherwise, much of the 1988 VPPA’s text remains unchanged. Like the original version, the current VPPA holds liable “[a] video tape service provider who knowingly discloses, to any person, personally identifiable information concerning any consumer of such provider.”
Central to this case is the VPPA’s “Definitions” section. See
B. “Goods or Services”
The parties contest whether the online newsletter Salazar signed up for qualifies as “goods or services” as that phrase is used in the VPPA. The NBA doesn’t contend that the newsletter is not a good or service generally; rather, it insists that statutory context compels the conclusion that a consumer under the VPPA must specifically rent, purchase, or subscribe to audiovisual “goods or services.” The NBA reasons that because the VPPA defines a “consumer” as one who rents, purchases, or subscribes to services “from a video tape service provider,”
Considering the text, structure, and purpose of the VPAA, we agree with Salazar. And we conclude that the NBA’s policy based counterarguments are unpersuasive.
i. Text, Structure and Purpose
When interpreting a statutory provision, we start with the text. See Wisconsin Central Limited v. United States, 585 U.S. 274, 277 (2018). Because the VPPA does not define the phrase “goods or services,” we presume that its plain meaning applies. See Perrin v. United States, 444 U.S. 37, 42 (1979) (“A fundamental canon of statutory construction is that, unless otherwise defined, words will be interpreted as taking their ordinary, contemporary, common meaning.”). In assessing the words’ plain meaning, we consider “the language itself, the specific context in which that language is used, and the broader context of the statute as a whole.” Robinson v. Shell Oil Co., 519 U.S. 337, 341 (1997). Applying this guidance, we conclude that the plain language of the “consumer” definition, the VPAA’s terminology in other sections, and the structure of the statute as a whole support Salazar’s view. And his read is entirely consistent with the statute’s purpose.
Congress defined “consumer” as “any renter, purchaser, or subscriber of goods or services from a video tape service provider.”
(quoting Southwest Airlines Co. v. Saxon, 596 U.S. 450, 458 (2022)) (alterations adopted)).
This textual divergence highlights the flaw in the NBA’s argument that the “consumer” and “video tape service provider” definitions share “a suggestively parallel structure” that supports reading an audiovisual limitation into the definition of “goods or services.” Appellee’s Br. at 31. To the NBA, the phrase “renter, purchaser, or subscriber” in the “consumer” definition is parallel to the “rental, sale, or delivery” language in the “video tape service provider” definition. That means, the NBA says, the term “goods or services” must be parallel to “prerecorded video cassette tapes or similar audio visual materials,” with a similarly cabined scope. Compare
We need not decide whether the phrase “renter, purchaser, or subscriber” in the definition of “consumer” is intended to mirror the phrase “rental, sale or delivery” in the definition of “video tape service provider.”8 Even if that were correct, it
services” in the definition of “consumer” mirrors the term “prerecorded video cassette tapes or similar audio visual materials” in the “video tape service provider” definition. Tellingly, Congress chose to deviate from any parallelism by using the terms “goods or services” in the “consumer” definition and “prerecorded video cassette tapes or similar audio-visual materials” in the “video tape service provider” definition. Again, Congress’s decision to use different words in different definitions strongly signals its intent to convey different meanings. See Jama, 543 U.S. at 341.
In addition, the NBA’s interpretation is hard to harmonize with other language in the statute. The definition of “personally identifiable information” includes “information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider.”
We are likewise unpersuaded by the NBA’s reliance on the title of the VPAA’s liability provision: “Video Tape Rental and Sale Records.”
There are at least two problems with this argument. First, headings and titles in statutes “cannot limit the plain meaning of the text.” Rajah v. Mukasey, 544 F.3d 427, 436 (2d Cir. 2008) (internal quotation marks omitted). Second, the title of the liability provision tells us little about the meaning of “consumer” in the VPPA. The parties agree that sharing information that is not about video materials or services is beyond the scope of the statute. But as explained further below, it’s the definition of “personally identifiable information” that limits what can be shared, not the definition of “consumer.”
Nor are we persuaded by the NBA’s argument that the phrase “from a video tape service provider” somehow cabins “goods or services” to audiovisual goods or services.” The definition of “video tape service provider” is broad, encompassing “any person[] engaged in the business . . . of rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials.”
This is not to say the VPPA’s reach is boundless. As noted above, the statute only prohibits video tape service providers from “knowingly disclos[ing]
personally identifiable information.”
Our read of the statute not only reflects the language and structure of the VPAA; it’s also “consistent with Congress’s intended purpose.” Bustamante v. Napolitano, 582 F.3d 403, 410 (2d Cir. 2009). As we explained above, Senate
Judiciary Committee members understood the VPPA to “prohibit[] video service providers from disclosing personally identifiable information except in certain, limited circumstances.” S. Rep. No. 100-599, at 5; see also S. Rep. No. 112-258, at 2 (same). Grafting unstated limitations on the broad definition of “consumer,” and by extension, “goods or services,” would be inconsistent with Congress’s purpose here.
ii. NBA’s Policy Arguments
Given the clear meaning of the VPPA evidenced by its statutory text and context, we are unpersuaded by the NBA’s policy arguments for a different construction. The NBA insists that failing to cabin “goods or services” to audiovisual goods or services would produce anomalous results. It contends that under a broad construction of the term, someone who just watches a video on a website “with no other relationship to the company would
Even presuming that merely watching a free video—and giving up personal information in the process—does not make someone a VPPA “consumer,”11 the purportedly anomalous results identified by the NBA do not justify artificially cabining the statute’s scope in a way that is inconsistent with its plain meaning and purpose.
For starters, the statute’s express terms control. See Bostock v. Clayton County, Georgia, 590 U.S. 644, 653 (2020) (“When the express terms of a statute give us one answer and extratextual considerations suggest another, it’s no contest. Only the written word is the law, and all persons are entitled to its benefit.”); Pennsylvania Department of Corrections v. Yeskey, 524 U.S. 206, 212 (1998) (“[T]he fact that a statute can be applied in situations not expressly anticipated by Congress does not demonstrate ambiguity. It demonstrates breadth.” (internal quotation marks omitted)).
We’re also unconvinced that broadly defining “goods or services” produces anomalous results. Take the NBA’s hypothetical: a consumer buys a hammer, then watches free videos on the vendor’s website. The NBA suggests that it is
anomalous that this consumer is subject to privacy protections under the VPPA. But considering the privacy protective goals of the VPPA with respect to individuals’ video viewing information, this scenario does not strike us as anomalous. Especially given the broad definition of consumer in the VPPA, allowing disclosure of the consumer’s video viewing information would be out of sync with the statute’s goals.
To summarize: The phrase “goods or services” in the VPPA’s definition of “consumer” is not cabined to only audiovisual “goods or services.” The NBA’s online newsletter therefore is a qualifying good or service.
C. “Subscriber”
Even if the NBA digital newsletter is a “good or service,” we still must decide whether Salazar is a subscriber of that good or service such that he is a “consumer” within the VPPA. Salazar alleges that he “became a digital subscriber of NBA.com by providing, among other information, email address and IP address, . . . and any cookies associated with his device.” Jt. App’x at 19. The NBA contends these actions do not signify a sufficient relationship between Salazar and the NBA, and therefore don’t make Salazar a “subscriber” under the VPPA.12
otherwise “ma[d]e any commitment or establish[ed] any relationship that would allow him to have access to exclusive or restricted content.” Id. at 1257. All he did was download a free app and use it to view content. So, the court concluded, he was not a VPPA “subscriber.” Id. at 1258.
The First Circuit faced a similar set of facts in Yershov. There, someone also downloaded an app in order to, among other things, watch videos. 820 F.3d at 484. Each time the plaintiff used the app to watch videos, the video’s title, his device’s GPS coordinates, and his device’s unique Android ID were sent to a third-party data analytics company, which used the information for, among other things, targeted advertising. Id. at 484-85. The First Circuit agreed with the Eleventh Circuit that someone does not have to pay money to be a VPPA subscriber. Id. at 487–88. But unlike the Eleventh Circuit, the First Circuit held that the Yershov plaintiff was a VPPA subscriber. Id. at 487. It explained:
To use the App, Yershov did indeed have to provide Gannett with personal information, such as his Android ID and his mobile device’s GPS location at the time he viewed a video, each linked to his viewing selections. While he paid no money, access was not free of a commitment to provide consideration in the form of that information, which was of value to Gannett. And by installing the App on his phone, thereby establishing seamless access to an electronic version of USA Today, Yershov established a relationship with Gannett that is materially different from what would have been the case had USA Today simply remained one of millions of sites on the web that Yershov might have accessed through a web browser.
We agree with both the Eleventh and First Circuits that someone doesn’t have to spend money to be a VPPA “subscriber.” Otherwise, the term “subscriber” would be rendered superfluous by the terms “purchaser” and “renter” in the definition of “consumer.” Someone in 1988 (or 2012, for that matter) who paid money for permanent access to audiovisual material would be a “purchaser,” and someone who exchanged money for temporary access would be a “renter.” If the payment of money was an essential condition of being a “subscriber,” then anyone who was a
It’s also easy to imagine subscriptions that don’t require monetary payment. Someone can, for example, subscribe to a YouTube channel by signing into a YouTube account (which requires no monetary payment) and clicking the “subscribe” icon on a content creator’s channel. YouTube Help, Subscribe to YouTube channels, https://support.google.com/youtube/answer/4489286
[https://perma.cc/RM2E-FMX8] (last visited Sept. 4, 2024). Subscribing causes YouTube to “automatically send . . . notifications about the highlights from that channel.” Id.
These types of subscriptions aren’t only a feature of the modern internet. As the First Circuit explained, they existed in the 1980s through “the reasonably common retailing practice of introductory enticements”:
Suppose a customer in 1988 obtained several videos from a new commercial supplier at no charge, or with money back. We can discern no reason why Congress would have wanted different disclosure rules to apply to those transactions than to ones where a monetary payment is made. And because we think that Congress cast such a broadly inclusive net in the brick-and-mortar world, we see no reason to construe its words as casting a less inclusive net in the electronic world when the language does not compel that we do so. See Barr v. United States, 324 U.S. 83, 90 (1945) (“[I]f Congress has made a choice of language which fairly brings a given situation within a statute, it is unimportant that the particular application may not have been contemplated by the legislators.”).
Here, although Salazar does not allege that he paid the NBA money, he does allege that he provided the NBA with his personal information when he signed up for the newsletter. In return for receiving periodic NBA-related updates, Salazar exchanged, at a minimum, (1) his email address, (2) his IP address, and (3) cookies associated with his device. He further alleges that through his IP address, the NBA can identify “the city and zip code he resides in as well as his physical location.” Jt. App’x at 19.
That information is not insignificant. By receiving it, the NBA learned how to directly reach out to Salazar. It discovered where his device was. It gained access to additional information stored in any cookies on his device. These tools increased the NBA’s potential to urge Salazar to visit NBA.com and watch videos on it, making the NBA’s relationship with him distinct from its relationship with casual NBA.com video-watchers who had not signed up for the newsletter.14
Accepting these allegations as true and drawing all reasonable inferences in Salazar’s favor, as we must at the pleadings stage, Salazar plausibly alleged that he gave the NBA valuable personal information in exchange for access to the online newsletter. Cf. Yershov, 820 F.3d at 489 (reasoning that
CONCLUSION
Our ruling is narrow: We hold on the merits only that Salazar has plausibly pled that he is a “subscriber of goods or services” and that the district court therefore erred in dismissing his complaint pursuant to
The VPPA is no dinosaur statute. Congress deployed broad language in defining the term “consumer,” showing it did not intend for the VPPA to gather dust next to our VHS tapes. Our modern means of consuming content may be different, but the VPPA’s privacy protections remain as robust today as they were in 1988.
The district court’s judgment is VACATED, and the case is REMANDED for further proceedings consistent with this opinion.
Notes
The NBA also argued in the alternative to the district court that Salazar had consented to disclosure of his personally identifiable information by assenting to the NBA‘s privacy policy. Salazar concedes that NBA.com‘s privacy policy states that it collects certain “Personal Information” from site visitors. But he contends that this policy doesn‘t say that the NBA “will share digital subscribers’ private and protected Personal Viewing Information with third parties, including [Meta].” Jt. App‘x at 14–15. As a result, he alleges, the NBA failed to satisfy the VPPA‘s consent requirements. The NBA does not raise this argument on appeal and concedes the argument should be left for the district court to address in the first instance given that its resolution will require “detailed examination of the NBA‘s Privacy Policy and Mr. Salazar‘s factual allegations showing his acceptance of that policy.” Appellee‘s Br. at 52 n.16. We agree.
The NBA also argued before the district court that it should dismiss Salazar‘s class allegations because the NBA‘s Terms of Use provision, to which it says Salazar agreed, includes an enforceable class action waiver. The NBA concedes here that this “argument is not an alternative basis for affirming the” court‘s dismissal “of the entire complaint,” so “it is not properly resolved on this appeal.” Id. Accordingly, this argument is not before us in this appeal.