GHANAAT v. NUMERADE LABS INC (2023)

Order Granting in Part and Denying in Part the Motion to Dismiss

Dkt. No.: 21

Before the Court is defendant Numerade Labs Inc.’s motion to dismiss plaintiffs’ complaint. (Dkt. No. 21.) For the reasons given herein, the motion is granted in part and denied in part.¹

I. Background

Plaintiffs allege the following:

Defendant is a company with a website providing educational videos on subjects such as physics. Defendant discloses its subscribers’ personal information to Meta without plaintiffs’ consent, in violation of the Video Privacy Protection Act (“VPPA”). (Dkt. No. 1, Comp. at ¶ 1.) Specifically, defendant uses a tool created by Meta called the “Meta Pixel” or “Pixel,” which allows online businesses to track actions of customers on their websites. (Id. at ¶ 18.) The information collected includes the pages visited, actions taken on those pages, information users put into the website, and, where relevant, the user's Facebook ID (“FID”). (Id.) A FID is a numerical identifier. If appended to the URL “facebook.com/” it will lead to the associated user's Facebook page. (Id. at 21.)

Meta ² “warns companies installing the Pixel on their websites that the Pixel is a personal identifier because it enables Meta ‘to match your website visitors to their respective Facebook User accounts.’ ” (Id. at ¶ 19.) When a business installs Pixel, it chooses what information about the user's activity to share with Facebook.

Defendant chose to disclose to Facebook its subscribers’ unencrypted FIDs and the URLs of the videos that plaintiffs watch. (Id. at ¶¶ 21 and 24.³ ) Defendant could have chosen not to share this information with Meta. (Id. at ¶ 23.) When a user requests or obtains a video, defendant sends the URL, which includes the name of the video within it and links to the video, and the subscriber's FID to Meta in a single transmission. (Id. at ¶ 26.) When subscribers create accounts, or subsequently request videos, defendant does not inform them that their information will be shared with Meta or request their consent to such disclosure. (Id. at ¶¶ 30-31.)

Plaintiffs Star Ghanaat and Vedant Thakkar registered for accounts with defendant by providing, “among other information, their name and email address.” (Id. at ¶ 33.) During the time they were Numerade subscribers, plaintiffs had Facebook accounts. (Id. at ¶ 36.) Plaintiff Ghanaat “purchased a paid subscription in October 2021 and requested, obtained and/or watched prerecorded videos on the Numerade website.” (Id. at ¶ 34.) Plaintiff Thakkar “subscribed to Numerade on or about October 7, 2021 and requested, obtained and/or watched prerecorded videos on the Numerade website.” (Id. at ¶ 35.) Defendant disclosed to Meta plaintiffs’ FIDs coupled with the video URL without plaintiffs’ consent. (Id. at ¶ 37.)

II. Legal Framework

The standard on motion to dismiss, including the burdens and inferences, is well-known and not in dispute.

The VPPA prohibits knowing disclosure of “personally identifiable information” by a “video tape service provider.” 18 U.S.C. § 2710. The act's purpose is to allow “consumers to maintain control over personal information divulged and generated in exchange for receiving services from video tape service providers.” Mollett v. Netflix, Inc., 795 F.3d 1062, 1065 (9th Cir. 2015) (citation and internal quotation marks omitted). “The Act reflects the central principle of the Privacy Act of 1974: that information collected for one purpose may not be used for a different purpose without the individual's consent.” Id.

To state a claim for unlawful disclosure under the VPPA, “a plaintiff must allege that (1) a defendant is a ‘video tape service provider,’ (2) the defendant disclosed ‘personally identifiable information concerning any customer’ to ‘any person,’ (3) the disclosure was made knowingly, and (4) the disclosure was not authorized by section 2710(b)(2)⁴ .” Id. at 1066.

A video tape service provider is “any person, engaged in the business, in or affecting interstate or foreign commerce, of rental, sale, or delivery of prerecorded video cassette tapes or similar audio-visual materials.” 18 U.S.C. § 2710(a)(4). This Court agrees with the many others that have found “similar audio-visual materials” includes videos provided for streaming on websites,⁵ where doing so is “substantially involved in the conveyance of video content to consumers but also significantly tailored to serve that purpose.” Lucinda Jackson, 2023 WL 4670285, at *3 (quoting In re Vizio, Inc., Consumer Priv. Litig., 238 F. Supp. 3d 1204, 1221 (C.D. Cal. 2017)); see also Stark, 2022 WL 7652166, at *7. In the absence of circuit court guidance, the Court further finds that “video-hosting websites need not charge fees to viewers to qualify as video tape service providers under the VPPA.” Jackson, 2023 WL 4670285, at *3 (citing In re Hulu Priv. Litig., No. 11-03764 LB, 2012 WL 3282960, at *7 (N.D. Cal. Aug. 10, 2012) (“Hulu I”) (holding that a video streaming website is a video tape service provider, even though plaintiffs did not pay for streaming services)).

A “consumer,” within the meaning of the VPPA, is “any renter, purchaser, or subscriber of goods or services from a video tape service provider.” Id. § 2710(a)(1). Notable here, the term “subscriber” is not defined in the statute. The Ninth Circuit has yet to address its meaning. Many courts in this district have applied the Eleventh Circuit's standard under which a “ ‘subscription’ involves some type of commitment, relationship, or association (financial or otherwise) between a person and an entity.” Ellis v. Cartoon Network, Incorporated, 803 F.3d 1251, 1256 (11th Cir. 2015). Put another way, “[s]ubscriptions involve some or [most] of the following [factors]: payment, registration, commitment, delivery, [expressed association,] and/or access to restricted content.” Id. (citation omitted).

Personally identifiable information (“PII”) is defined in the statute to include “information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider.” Section 2710(a)(3). In this circuit, PII includes information which “readily permits an ordinary person to identify a particular individual as having watched certain videos.” Eichenberger v. ESPN, Inc., 876 F.3d 979, 985 (9th Cir. 2017) (cleaned up). That is, the PII disclosed must include information from which the identity of the subscriber and the video watched can be readily discerned. In Eichenberger, the Ninth Circuit held that a serial number on a Roku box (a device that enables video streaming) was not PII because the information creates only a “sizable ‘pool’ ” of possible viewers and was insufficient for the average person to determine users on an individual level. Id. Though a sophisticated actor could possibly use a serial number to identify a specific user, the information could not be used by the average person as a means of identification. That said, the Ninth Circuit recognizes that “modern technology may indeed alter—or may already have altered—what qualifies under the statute.” Id. at 986.

The statute also does not define what constitutes knowing transmission or disclosure of PII.

III. Analysis

Defendant argues that plaintiffs’ claims must be dismissed for failure to state a claim under Rule 12(b)(6) and for lack of standing under Rule 12(b)(1). With a few exceptions, defendant's arguments under each section overlap. Defendant's motion under 12(b)(6) asserts that plaintiffs fail to adequately allege the elements of their VPPA claim. From their perspective, those specifically include that defendant is a video tape services provider, that FIDs and video URLs are PII, and that plaintiffs are subscribers. From that perspective, defendant then argues that plaintiffs fail to allege an injury in fact as required for Article III standing and dismissal is also appropriate under Rule 12(b)(1). Further, defendant argues that plaintiffs’ must allege the specific videos they watched.

As a preliminary matter, the Court notes that defendant's motion relies extensively on a declaration of a Numerade employee which purportedly contains information about how Numerade functions and about plaintiffs’ accounts. (Dkt. No. 21-1.) The Court does not consider this declaration in addressing the motion.⁶

A. Video Tape Services Provider

Defendant argues that it is not a video tape service provider because it does not distribute video cassette tapes and the “minutes-long video clips uploaded by educators and available on the Website are not ‘similar audio visual materials’ to video cassette tapes and bear no resemblance to the content the VPPA regulates.” (Dkt. No. 21 at 13.) Defendant opines that the VPPA was created with consumption of VHS tapes of feature films and television in mind and that the short, education-focused videos provided by defendant are too distinct to constitute audio-visual content under the statute. Notably, despite the proliferation of similar cases in recent years, defendant's motion does not cite a single case finding that the length or subject matter of a video is relevant to determining coverage by the VPPA. In contrast, plaintiffs cite multiple cases finding that a claim may be based on the sort of brief, online video content at issue here. See, e.g., In re Facebook, Inc., Consumer Priv. User Profile Litig., 402 F. Supp. 3d 767, 799 (N.D. Cal. 2019). The Court finds plaintiffs plausibly allege defendant is a video tape service provider.

B. Personally Identifiable Information

Defendant next argues that FIDs and URLs are not PII or personally identifiable information under the VPPA. It argues that plaintiffs thus fail to allege that their PII was shared, as required to state a claim, and fail to allege an injury, as required for standing.

Most, if not all,⁷ courts to address the question have found at the pleading stage that Facebook IDs are PII. See e.g. Jackson, 2023 WL 4670285, at *5 (explaining that the ID can readily be used by the average person to access a consumer's Facebook page, which may contain substantial personal information); Feldman v. Star Trib. Media Co. LLC, No. 22-CV-1731 (ECT/TNL), 2023 WL 2388381, at *10 (D. Minn. Mar. 7, 2023) (stating “most district courts that have addressed the use of Facebook Pixel specifically reached this same result in the context of Rule 12(b)(6) motions”) (collecting cases). This Court agrees that a FID can constitute PII where it leads to a Facebook page that discloses personal and identifying information about the consumer.

Here, plaintiffs’ allegations are inadequate because they do not allege their Facebook pages contain any personal information, such as their names or email addresses. Accordingly, the complaint does not adequately allege that their FIDs result in the sharing of any personal information. Plaintiffs thus fail to allege this element of their claim or state an injury. The motion is Granted With Leave to Amend to add such allegations.

Next, with respect to the URL, plaintiff argues that the URL is adequate to constitute PII because it contains the name of the video and readily enables the average person to view the video.⁸ In response, defendant proffers two arguments. One, it claims the complaint must allege that defendant disclosed information indicating that plaintiffs actually watched the video. Defendant cites no authority for this proposition. The VPPA applies to disclosure of videos a plaintiff “requested or obtained.” 18 U.S.C. § 2710(a)(3). The defendant need not disclose if the plaintiff watched the video once obtained in order to state a claim and have an injury. This argument fails.

Two, defendant argues the URL itself does not disclose that the content it links to is a video, thus, it is indistinguishable from a URL for a webpage with no video content. Using this logic, an ordinary person could not discern from the URL that the subscriber viewed a video and therefore is distinguishable from a list of videos rented from a video store, which are clearly identifiable as films. Defendant relies on Martin v. Meredith Corp., No. 22-CV-04776-DLC, 2023 WL 2118074, at *3–4 (S.D.N.Y. Feb. 17, 2023). There, the court found that URLs to the defendant's website were inadequate to disclose that the webpage included a video. Id. at *3–4 (“simply disclosing the name of a webpage and an associated Facebook ID leaves off essential information for a VPPA claim, including at least: (1) whether the webpage contains a video ․”). In response, plaintiffs cite numerous cases to the contrary finding that “electronic disclosures of a person's video-viewing history, even if not explicit, can violate the VPPA.” Feldman, 2023 WL 2388381 at *10 (collecting cases finding same). This Court agrees. Whether a URL sufficiently identifies a video is ultimately a factual question that should not be resolved on motion to dismiss. Harris v. Pub. Broad. Serv., No. 1:22-CV-2456-MLB, 2023 WL 2583118, at *6 (N.D. Ga. Mar. 20, 2023).⁹

C. Knowing Transmission

The parties debate the knowledge element. Plaintiffs contend they are only required to allege defendant knowingly installed the Meta Pixel knowing that it transmits the alleged PPI. Defendant claims the complaint must allege defendant knowingly transmitted plaintiffs’ PII to Meta.

Defendant proffers a set of elements without any authority ¹⁰ or a coherent definition of “knowing transmission.” Defendant suggests that the complaint must allege that “Meta was pairing this information,” such that the information constituted PII and that:

(a) certain Website users with Facebook accounts could allow Facebook to incorporate cookies into their browsers; (b) Facebook could pair the c_user cookie information with URL information; or (c) Facebook could navigate to that URL, identify a video clip, and infer that a particular user watched the clip.

(Dkt. No. 21 at 22.) That said, defendant fails to address or distinguish plaintiffs’ contrary authority finding allegations that defendant knowingly used the Pixel, provided FIDs and URLs to Meta sufficiently alleges a knowing disclosure. See, e.g., Czarnionka v. Epoch Times Ass'n, Inc., No. 22 CIV. 6348 (AKH), 2022 WL 17069810, at *4 (S.D.N.Y. Nov. 17, 2022), motion to certify appeal denied, No. 22 CIV.6348 (AKH), 2022 WL 17718689 (S.D.N.Y. Dec. 15, 2022). This Court joins others to find plaintiffs sufficiently allege this element.

D. Subscriber

Defendant argues that Thakkar's claim should be dismissed under both Rule 12(b)(6) and 12(b)(1) because he is not a “subscriber” and therefore defendant could not have injured him. Unlike Ghanaat, Thakkar did not have a paid account or other basis for showing an ongoing commitment or relationship with defendant. (Dkt. No. 21 at 11.) However, plaintiffs respond that Thakkar is a subscriber because he “provided [defendant] with his personal information, including his name and email address.” (Dkt. No. 24 at 11 (citing Comp. at ¶¶ 33, 35).)

As noted above, in Ellis, the Eleventh Circuit held that a subscriber must allege some “ongoing commitment or relationship between the user and the entity.” Ellis, 803 F.3d at 1257. The articulation is reasonable and consistent with the statute. The Court finds this standard met here. In defendant's own cited cases, Perry and Ellis, the court found a relationship insufficiently alleged because no information was provided to the defendant by the subscriber. Id. at 1258 (“the free downloading of a mobile app on an Android device to watch free content, without more, does not a ‘subscriber’ make”); Perry v. Cable News Network, Inc., 854 F.3d 1336, 1342 (11th Cir. 2017) (finding plaintiff not a subscriber where he did not provide any personal information to CNN). Those cases do not address the question at hand: whether someone who provides personal information can constitute a subscriber under the VPPA.¹¹

IV. Conclusion

For the reasons given herein, the motion to dismiss is Granted to the extent plaintiff can allege that their Facebook accounts contain the kind of personally identifying information described in this order. On this basis, the motion is granted With Leave to Amend, otherwise the motion is denied.

Within five (5) business days, counsel for plaintiffs shall file a notice advising whether the complaint will be amended. If it is, an amended complaint shall be filed no later than September 25, 2023. Plaintiff shall comply with the Court's standing order relative to amended complaints.

Defendant shall respond within fourteen days of the filing of an amended complaint and is prohibited from reasserting any ground already resolved and from introducing new arguments which could have been made in the first instance.

This terminates docket number 21.

It Is So Ordered.

FOOTNOTES

1.   The Court has reviewed the papers submitted by the parties in connection with the instant motion and has determined it appropriate for decision without oral argument, as permitted by Civil Local Rule 7-1(b) and Federal Rule of Civil Procedure 78. See Lake at Las Vegas Investors Group, Inc. v. Pacific Malibu Dev. Corp., 933 F.2d 724, 729 (9th Cir. 1991).

2.   Plaintiffs inconsistently refer to Meta as both Facebook and Meta. For ease of reference, the Court uses “Meta” to refer to the company Meta and “Facebook” only to refer to the Facebook website.

3.   The complaint alleges that defendant discloses the “name” of the video watched. However, the screen shots provided by plaintiff as well as plaintiffs’ dismissal briefing indicate that defendant discloses the URL to the video, which contains the video name in it. For example, the URL for a video entitled “Orbital Motion – Intro” is “numerade.com/courses/physics-101-mechanics/gravitation/orbital-motion-intro/.” (Id. at ¶¶ 24-27.)

4.   These include where the disclosure is made “with the informed, written consent ․ of the consumer ․ in a form distinct and separate from any form setting forth other legal or financial obligations of the consumer,” 18 U.S.C. § 2710(b)(2)(B), and where the disclosure is “incident to the ordinary course of business of the video tape service provider,” 18 U.S.C. § 2710(b)(2)(E).

5.   “Courts have generally construed ‘similar audio visual materials’ broadly, finding that streaming video delivered electronically falls within that definition.” Lucinda Jackson v. Fandom Inc., 2023 WL 4670285, at *3 (N.D. Cal. July 20, 2023) (cleaned up) (quoting Stark v. Patreon, Inc., ––– F. Supp. 3d ––––, No. 22-cv-03131-JCS, 2022 WL 7652166, at *6 (N.D. Cal. Oct. 13, 2022)).

6.   Counsel knows full well, that aside from judicial notice and incorporation by reference, considering extrinsic “evidence” is generally not allowed. Perhaps this is why defendant does not clearly request that this declaration be noticed, explain what is in the declaration, or why it is properly considered under the applicable standards. Defendant attempts some argument in reply (including the appropriateness of considering extrinsic evidence), but such argument will also not be considered by the Court. See Tovar v. U.S. Postal Serv., 3 F.3d 1271, 1273 n. 2 (9th Cir. 1993) (presenting new information in a reply is improper and deprives the opposing party of an opportunity to respond). Accordingly, this order does not address arguments raised in defendant's motion that are entirely dependent on facts alleged in the declaration and not included in the complaint.

7.   Defendant has not cited a single case finding to the contrary and this Court is not aware of any.

8.   Defendant also appears to argue that plaintiffs need to allege the specific video content they requested or obtained from defendant and that plaintiffs’ allegations that they “requested, obtained and/or watched prerecorded videos on the Numerade website” (Comp. at ¶¶ 3-35) are insufficient. The Court finds this argument, which defendant does not support with authority or significant analysis, unpersuasive.

9.   The Court declines to address defendant's argument that the pages of its site that have videos also have non-video content and that disclosure of the URL does not disclose whether a subscriber viewed video or non-video content, as this argument is based on factual allegations from outside the complaint.

10.   Defendant does cite a case for its claim that plaintiffs must allege defendant had knowledge that the information shared constitutes PII. That case decided a motion for preliminary injunction and thus applied a higher standard than applies at motion to dismiss. Bernardino v. Barnes & Noble Booksellers, Inc., No. 17CV04570LAKKHP, 2017 WL 3727230, at *9 (S.D.N.Y. Aug. 11, 2017), report and recommendation adopted, No. 17-CV-4570 (LAK), 2017 WL 3726050 (S.D.N.Y. Aug. 28, 2017).

11.   Defendant additionally argues that Thakkar lacks standing because videos are only accessible through a paid account. As this argument relies on facts outside the complaint, the Court does not consider it.

Yvonne Gonzalez Rogers, United States District Court Judge