LAKES v. UBISOFT INC (2025)

ORDER GRANTING MOTION TO DISMISS

Re: ECF 22

On October 23, 2024, Plaintiffs Trevor Lakes and Alex Rajjoub (collectively, “Plaintiffs”) filed a class action complaint against Defendant Ubisoft, Inc. (“Ubisoft” or “Defendant”), alleging violations of federal and state privacy laws. ECF 1, ¶¶ 141–217.

Before the Court is Defendant's motion to dismiss Plaintiffs’ complaint in its entirety. ECF 22. The Court heard the parties’ oral argument on April 1, 2025. ECF 40. After review and consideration of motions, briefings, attachments and exhibits thereto, the Court GRANTS Defendant's motion to dismiss in its entirety with prejudice.

I. BACKGROUND

A. Factual Background

1. The Parties

Ubisoft, Inc. is headquartered in San Francisco, CA and serves as a business office and video game development studio, with nearly 500 employees in marketing, sales, business development, communications, finance, licensing, and game development. ECF 1, ¶ 23.

Trevor Lakes is a citizen of California who resides in North Hills, California. Id. ¶ 21. Alex Rajjoub is a citizen of West Virginia who resides in Morgantown, West Virginia. Id. ¶ 22. Both Plaintiffs allege that they visited https://www.ubisoft.com/ (the “Website”) to download games that contained “cut scenes and cinematics,” while logged into their Facebook account. Id. ¶¶ 21–22. Their Facebook profiles contain their name, location, occupation, photos, relationship status, friend list, and posts. Id.

2. The Website

Ubisoft operates the Website to allow users to purchase video games containing pre-recorded audiovisual content. Id. ¶¶ 1, 3, 21–22, 38. Plaintiffs allege that Ubisoft took overt steps to put the Meta Platforms, Inc. (“Meta” or “Facebook”) tracking Pixel (the “Pixel”) on the Website and agreed to the Meta Business Tools Terms as condition of using the Pixel. Id. ¶¶ 4, 9, 73. The Pixel employed on the Website allegedly disclosed (1) users’ unique and unencrypted Facebook ID (“FID” or “UID”), (2) users’ fr_ cookie containing an encrypted Facebook ID (the “fr cookie”), and (3) users’ Video Request Data, all in a single transmission to Meta. Id. ¶¶ 10–11, 89–95, 97, 105–08.

Plaintiffs allege that Ubisoft violated the Video Privacy Protection Act (“VPPA”) when it “knowingly and systematically disclosed Plaintiffs’ personally identifiable information to Meta, without obtaining their consent, by purposely placing the Pixel on the Website with the knowledge it would collect user information.” Id. ¶ 40. Plaintiffs also allege that Ubisoft violated the California Invasion of Privacy Act and the Federal Wiretap Act because it “purposefully included the Pixel on the Website to intercept Plaintiffs’ communications and redirect them to Meta” without Plaintiffs’ knowledge or consent. Id. ¶¶ 125, 126. Plaintiffs further claim that these alleged disclosures constitute an invasion of privacy under California Common Law and violate the California Constitution. Id. ¶ 16.

3. Cookies Banner and Privacy Policy

Defendant contends that Plaintiffs consented to cookies and pixels on the Website. ECF 22, at 3. The first time a user arrives at the Website, the user is presented with a Cookies Banner notifying him or her that by clicking “OK” and “continuing to navigate on the site” that “you accept the use of cookies by Ubisoft and its partners to offer advertising adapted to your interests.” ECF 22-2, Exhibit (“Ex.”) A. If a user clicks on the “set your cookies” hyperlink, in the above banner, a pop-up appears with more detailed options to change cookies consent preferences, as shown in the following image. ECF 22-5, Ex. D. If the user does not want to share his or her information with Ubisoft and third parties, the user can click the “set your cookies” hyperlink to adjust the cookies he or she permits on the browser or click “OK” to accept the default settings. ECF 22-2, Ex. A.

To make any purchases on the Website, including purchasing a subscription to Ubisoft+, a user must first create a Ubisoft account. ECF 1, ¶ 86. No user can create a Ubisoft account without checking the box next to “I accept Ubisoft's Terms of Use, Terms of Sale, and Privacy Policy,” which hyperlinks to the policies mentioned on the Website. ECF 22-9, Ex. H. After agreeing to the Privacy Policy and consenting to the sharing of personal and game data during account creation, every time a user then makes a purchase, the user is again presented with the Privacy Policy during the Ubisoft Website store checkout process. ECF 22-10, Ex. I.

Ubisoft's Privacy Policy, which all Ubisoft account holders must agree to, informs users that their information will be shared with third parties. ECF 22-13, Ex. L, ¶ 5. The Privacy Policy also outlines for users how they can give or withdraw their consent. Id. ¶ 6.

B. Procedural Background

On October 23, 2024, Plaintiffs filed a class action complaint against Defendant alleging the following causes of action: (1) violation of the Video Privacy Protection Act (“VPPA”), 18 U.S.C. § 2710, et seq.; (2) violation of common law invasion of privacy, intrusion upon seclusion; (3) violation of the California Constitution, Art. 1, § 1; (4) violation of the Federal Wiretap Act, Electronic Communications Privacy Act (“ECPA”), 18 U.S.C. § 2510, et seq.; and (5) violation of California's Invasion of Privacy Act (“CIPA”), Cal. Penal Code § 631. ECF 1, ¶¶ 141–217. Plaintiffs bring the following Nationwide Class and California Subclass:

All PII Users on the Website that had their PII, search terms, and detailed webpage information improperly intercepted by and disclosed to Facebook through the use of the Pixel (the “Class”).

All PII Users, who reside and used the Website in California, that had their PII, search terms, and detailed webpage information improperly intercepted by and disclosed to Facebook through the use of the Pixel (the “California Subclass”).

Id. ¶ 127.

On December 16, 2024, Defendant filed a motion to dismiss Plaintiffs’ complaint. ECF 22. With its motion, Defendant filed requests for judicial notice of 12 exhibits. ECF 22, at 2–3. The Court granted two stipulations to extend briefing schedule. ECF 26, 31. Thereafter, Plaintiffs timely filed an opposition, ECF 32, and Defendant timely filed a reply. ECF 33. After briefing concluded, Plaintiffs filed a notice of supplemental legal authority. ECF 34. The Court heard oral argument on April 1, 2025. ECF 40.

II. LEGAL STANDARD

Under Rule 12(b)(6), a party may move to dismiss for “failure to state a claim upon which relief can be granted.” Fed. R. Civ. P. 12(b)(6). To overcome a motion to dismiss, a plaintiff's “factual allegations [in the complaint] ‘must ․ suggest that the claim has at least a plausible chance of success.’ ” Levitt v. Yelp! Inc., 765 F.3d 1123, 1135 (9th Cir. 2014) (citing Ashcroft v. Iqbal, 556 U.S. 662 (2009) and Bell Atlantic Corp. v. Twombly, 550 U.S. 544 (2007)). “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Iqbal, 556 U.S. at 678 (citing Twombly, 550 U.S. at 556). The Court “accept[s] factual allegations in the complaint as true and construe[s] the pleadings in the light most favorable to the nonmoving party.” Manzarek v. St. Paul Fire & Marine Ins. Co., 519 F.3d 1025, 1031 (9th Cir. 2008). However, “conclusory allegations of law and unwarranted inferences are insufficient to avoid a Rule 12(b)(6) dismissal.” Cousins v. Lockyer, 568 F.3d 1063, 1067 (9th Cir. 2009) (citations omitted).

III. REQUEST FOR JUDICIAL NOTICE

“The [C]ourt may judicially notice a fact that is not subject to reasonable dispute because it: (1) is generally known within the trial court's territorial jurisdiction; or (2) can be accurately and readily determined from sources whose accuracy cannot reasonably be questioned.” Fed. R. Evid. 201(b). Alternatively, the Court may “consider materials that are submitted with and attached to the Complaint. [The Court] may also consider unattached evidence on which the complaint ‘necessarily relies’ if: (1) the complaint refers to the document; (2) the document is central to the plaintiff's claim; and (3) no party questions the authenticity of the document.” United States v. Corinthian Colls., 655 F.3d 984, 999 (9th Cir. 2011). The Ninth Circuit has cautioned against the “unscrupulous use of extrinsic documents” under these exceptions, which “risks premature dismissals of plausible claims.” Khoja v. Orexigen Therapeutics, Inc., 899 F.3d 988, 998–99 (9th Cir. 2018).

As part of their motion to dismiss, Defendant requests judicial notice of Ubisoft's Website, and the policies publicly available on that Website including Ubisoft's Privacy Policy, Ubisoft's Cookies Settings, Ubisoft's Website Cookies Banner and related screens, as well as screens showing the account creation and purchase process. ECF 22, at 2–3; Id., Exhibits (“Exs.”) A–I, K–L. In the alternative, Defendant requests that the Court should consider these documents as incorporated by reference into the complaint. ECF 22, at 3 n.1. Plaintiffs do not provide an opposition to these requests. See ECF 32.

Defendant argues that Plaintiffs’ complaint relies on highly selective portions of the Website in a number of factual allegations and claims. See, e.g., ECF 1, ¶¶ 1, 2, 3, 85–97. Defendant seeks to introduce additional portions of its publicly available Website, so the Court has a complete picture of the user's journey, what the user consents to, and the policies they are provided and agree to. ECF 22, at 2.

“[A]s a general matter, websites and their contents may be proper subjects for judicial notice” provided that the party submits a copy of the relevant webpage to the court. Caldwell v. Caldwell, No. 05-cv-04166-PJH, 2006 WL 618511, at *4 (N.D. Cal. Mar. 13, 2006); see also In re Google Location Hist. Litig., 428 F. Supp. 3d 185, 189–90 (N.D. Cal. 2019) (granting defendant's request for judicial notice of publicly available websites in CIPA and California constitution invasion of privacy class action); Jones v. Tonal Sys., Inc., No. 3:23-cv-1267-JES-BGS, 2024 WL 4357558, at *2–3 (S.D. Cal. Sept. 30, 2024) (granting request for judicial notice of four printouts of publicly available website pages because plaintiff's “characterization of the [website] feature form the basis of her lawsuit.”) (internal quotations omitted).

Here, Defendant has provided copies of the relevant webpages to the Court in Exhibits A to I and K to L. Accordingly, the Court GRANTS request for judicial notice of Exhibits A to I and K to L. However, Defendant does not provide any authority to support a blanket judicial notice of the entirety of Ubisoft's Website. The Court DENIES request for judicial notice of Ubisoft's Website.

IV. DISCUSSION

As a threshold matter, Defendant contends that all of Plaintiffs’ claims fail because an essential element of each of Plaintiffs’ claims is lack of consent, but Plaintiffs repeatedly consented to, and were informed of, the use of cookies and pixels on the Website. ECF 22, at 9. Plaintiffs counter the sufficiency of their consent. ECF 32, at 7–10, 11–16, 18–19.

Defendant also argue that independent of the issue of consent, Plaintiffs did not have a reasonable expectation of privacy; Plaintiffs’ CIPA claim fails as a matter of law; and Plaintiffs’ VPPA claim fails to allege that Defendant is a video tape service provider. ECF 22, at 14–22. Plaintiffs provide counterarguments to each of Defendant's contentions. ECF 32, at 4–23.

Finally, Defendant argues that Plaintiffs cut and pasted from a previous complaint irrelevant allegations related to a healthcare defendant. ECF 22, at 22–23. Defendant seeks to have these allegations stricken pursuant to Federal Rule of Civil Procedure 12(f). Id. Plaintiffs do not provide a counterargument. See ECF 32.

The Court will first address the issue of consent. If necessary, the Court will then turn to the remaining arguments.

A. Plaintiffs’ consent defeats all of Plaintiffs’ claims.

“Consideration of consent is appropriate on a motion to dismiss where lack of consent is an element of the claim.” Silver v. Stripe Inc., No. 4:20-CV-08196-YGR, 2021 WL 3191752, at *2 (N.D. Cal. July 28, 2021); Smith v. Facebook, Inc., 745 F. App'x, 8, 9 (9th Cir. 2018) (affirming motion to dismiss based on consent).

Defendant argues that Plaintiffs consented to the use of cookies and pixels that could share their activity on the Website at least three times during the purchase process. Plaintiffs were presented with a Cookie Banner when they first arrived at the Website. ECF 22-2, Ex. A. This Cookie Banner gave Plaintiffs notice as to the use of cookies and provided Plaintiffs the option to change cookie consent preferences. Id.; ECF 22-5, Ex. D. Plaintiffs had to consent to the use of cookies prior to use of the Website.

Plaintiffs also had to create an account prior to making any purchase. ECF 1, ¶ 86. During account creation, Plaintiffs had to check the box next to “I accept Ubisoft's Terms of Use, Terms of Sale, and Privacy Policy,” which hyperlinks to the policies mentioned on the Website. ECF 22-9, Ex. H; see ECF 22-1, ¶ 11 (The Privacy Policy at issue has been in place since May 2020). After agreeing to the Privacy Policy and consenting to the sharing of personal and game data during account creation, every time Plaintiffs made a purchase, they were again presented with the Privacy Policy during the Ubisoft Website store checkout process. ECF 22-10, Ex. I.

In Lee v. Ticketmaster, the Ninth Circuit examined whether a plaintiff validly assented to Ticketmaster's Terms of Use each time he clicked the “Sign In” button when signing into his Ticketmaster account. Lee v. Ticketmaster L.L.C., 817 F. App'x 393, 394 (9th Cir. 2020). Below the “Sign In” button, the website displayed the phrase, “By continuing past this page, you agree to our Terms of Use.” Id. Similarly, each time plaintiff clicked the “Place Order” button on the site, the website displayed the phrase, “By clicking ‘Place Order,’ you agree to our Terms of Use.” Id. at 394–95. In both contexts, “Terms of Use” was displayed in blue font and contained a hyperlink to Ticketmaster's Terms. Id. The Ninth Circuit found that plaintiff did indeed “affirmatively acknowledge the agreement before proceeding,” and the “website contain[ed] an explicit textual notice that continued use will act as a manifestation of the user's intent to be bound.” Id. at 395.

Like in Ticketmaster, Defendant argues that Plaintiffs knowingly consented to the use of cookies and pixels on the Website (including sharing information with third parties) when they interacted with the Cookies Banner, created their accounts, and made purchases. See also Silver, 2021 WL 3191752, at *3 (“Courts have found that a binding contract is created if a plaintiff is provided with an opportunity to review the terms of service in the form of a hyperlink, and it is sufficient to require a user to affirmatively accept the terms, even if the terms are not presented on the same page as the acceptance button as long as the user has access to the terms of service.”) (internal quotations and citations omitted).

For each claim, Plaintiffs challenge the sufficiency and scope of their consent. ECF 32, at 7–10, 11–16, 18–19. The Court will determine whether Plaintiffs’ consent defeats each of Plaintiffs’ claims.

1. Plaintiffs’ consent bars their ECPA claim.

Plaintiffs assert several arguments against the Defendant's consent defense as to their ECPA claim. ECF 32, 11–16. The ECPA provides a consent exception, allowing for the interception of a communication “where such person is a party to the communication or where one of the parties to the communication has given prior consent to such interception unless such communication is intercepted for the purpose of committing any criminal or tortious act ․” 18 U.S.C. § 2511(2)(d).

a. Defendant has established the consent exception to ECPA.

“[A]s the party seeking the benefit of the exception, it is [Defendant]’s burden to prove consent.” Brown v. Google LLC, 525 F. Supp. 3d 1049, 1063 (N.D. Cal. Mar. 12, 2021) (internal quotations and citations omitted). Consent “can be explicit or implied, but any consent must be actual.” In re Google Inc., No. 13-MD-02430-LHK, 2013 WL 5423918, at *12 (N.D. Cal. Sept. 26, 2013). In order for consent to be actual, the disclosures must “explicitly notify” users of the practice at issue. Id. at *13. The disclosures must have only one plausible interpretation for a finding of consent. In re Facebook, Inc., Consumer Privacy User Profile Litig., 402 F. Supp. 3d 767, 794 (N.D. Cal. 2019). “[I]f a reasonable ․ user could have plausibly interpreted the contract language as not disclosing that [the Defendant] would engage in particular conduct, then [the Defendant] cannot obtain dismissal of a claim about that conduct (at least not based on the issue of consent).” Id. at 789–90.

Plaintiffs argue that it is not enough for Defendant to inform users that it will collect their information and share it with third parties. ECF 32, at 13. Rather, Defendant must establish that its terms and notices “explicitly notified” Plaintiffs of Defendant's specific practice of exposing Plaintiffs’ PII—consisting of video game titles combined with unique Facebook identifiers—to interception by Meta. Id. Plaintiffs also argue that the disclosures state that Defendant will collect data and share it with third parties—not that Meta itself will collect it through the Pixel. Id. at 13–14. Here, Plaintiffs envision a highly granular disclosure for the Pixel to be permitted.

Defendant argues that the ECPA does not require it to specifically disclose the disclosure of “video game titles combined with unique Facebook identifiers.” ECF 33, at 7. Defendant asserts that “Congress intended the consent requirement to be construed broadly” such that granular disclosures as requested by Plaintiffs are not required. Id. (quoting U.S. v. Amen, 831 F.2d 373, 378 (2d Cir. 1987)). Defendant's disclosures clearly disclose that it allows partners to use cookies on the Website, that specific analytics and personalization cookies would be used, and that cookie identifiers and other similar data connected to the use of the site could be collected and shared. See ECF 22-12, Ex. K; ECF 22-13, Ex. L; ECF 22-6, Ex. E.

Plaintiffs cite to three cases in support of their assertion that a granular disclosure stating that Meta will collect Plaintiffs’ “video game titles combined with unique Facebook identifiers” is required to obtain actual consent.

In Brown v. Google, plaintiffs brought several privacy violations for Google's alleged collection of their data while they were in private browsing mode. Brown v. Google, LLC, 525 F. Supp. 3d 1049, 1055 (N.D. Cal. 2021). Google asserted a consent defense, arguing Plaintiffs expressly consented to Google's Terms of Service, which incorporated Google's Privacy Policy and disclosed that Google would receive the data from its third-party services. Id. at 1064. However, the court rejected Google's consent defense, finding that “neither Google's Privacy Policy nor any other disclosure to which Google points states that Google engages in the alleged data collection while users are in private browsing mode.” Id. at 1068.

However, the Court finds that Brown is distinguishable because in Brown, Google's Privacy Policy never even mentioned private browsing. Id. at 1064. In contrast, here, the Privacy Policy explicitly states that Defendant “use[s] various types of technologies such as cookies to collect [game data and login and browsing data] when you use our services” and Defendant also “allow[s] some of our partners to set and access their Cookies on your device.” ECF 22-13, Ex. L. Brown does not require a more granular disclosure than the Defendant's disclosure.

In Calhoun v. Google, LLC, plaintiffs were Google Chrome users who “chose not to ‘Sync’ their [Chrome] browsers with their Google accounts while browsing the web.” Calhoun v. Google, LLC, 113 F.4th 1141, 1143 (9th Cir. 2024). Plaintiffs believed that, based on Google's Chrome Privacy Notice, their choice not to sync Chrome with their Google accounts meant that certain “personal information” would not be collected and used by Google but in fact was. Id. Google asserted a consent defense, arguing that its Privacy Policy, Consent Bump Agreement, and the New Account Creation Agreement disclosed the alleged data collection. Id. at 1146. The court rejected the consent defense, finding that “when the disclosures are read together and in the light most favorable to Plaintiffs, a reasonable user would not necessarily understand that they were consenting to the data collection at issue.” Id. at 1150.

In In re Meta Pixel Healthcare Litigation, plaintiffs alleged that Meta improperly acquired their confidential health information though the Meta Pixel which was installed on their patient portals of each of their healthcare providers. In re Meta Pixel Healthcare Litig., 647 F. Supp. 3d 778, 784 (N.D. Cal. 2022). Meta asserted a consent defense, arguing that its policies notify Facebook users that Meta collects and uses their personal data, including data about their browsing behavior on some third-party websites, at least in part for targeted advertising. Id. at 793. The court rejected the consent defense, holding that a reasonable user would not have understood from Meta's generalized notice that Meta was collecting protected health information. Id. at 793–94.

Here, the Court finds Calhoun and Meta to be distinguishable. Unlike in Calhoun and Meta, only the Privacy Policy is at issue here and a reasonable user would understand from the Privacy Policy that he or she is consenting to the use of cookies including by third parties. Calhoun and Meta do not require a more granular disclosure than the Defendant's disclosure.

None of Plaintiffs’ cited cases support Plaintiffs’ request for a highly granular disclosure that notifies the user that Meta will collect Plaintiffs’ “video game titles combined with unique Facebook identifiers.” The Court finds that Defendant has carried its burden in establishing consent.

b. Plaintiffs have not shown that the crime-tort exception applies.

In their fallback argument, Plaintiffs argue that even if consent was obtained, consent cannot a defense where the “communication is intercepted for the purpose of committing any criminal or tortious act in violation of the Constitution or laws of the United States or of any State.” 18 U.S.C. § 2511(2)(d). Under this exception, Plaintiffs must allege that either the “primary motivation or a determining factor in the interceptor's actions has been to injure plaintiffs tortiously.” Brown, 525 F. Supp. 3d at 1067 (internal quotations and citations omitted).

Plaintiffs allege that Ubisoft used Meta's tools to intercept Ubisoft's communications with Plaintiffs, resulting in violations of the VPPA and an intrusion into Plaintiffs’ seclusion. ECF 32, at 16–17; ECF 1, ¶¶ 39–40, 88, 174. Plaintiffs assert that the criminal purpose is underpinned through Defendant's business arrangement with Meta, which reveals Defendant's intent to profit commercially from exploiting PII, in violation of the VPPA. ECF 32, at 17.

However, Plaintiffs cannot assert the crime-tort exception simply by arguing that Defendant's conduct was illegal or tortious. Sussman v. Am. Broad. Companies, Inc., 186 F.3d 1200, 1202 (9th Cir. 1999). “[T]he focus is not upon whether the interception itself violated another law; it is upon whether the purpose for the interception—its intended use—was criminal or tortious.” Id. (quoting Payne v. Norwest Corp., 911 F.Supp. 1299, 1304 (D. Mont. 1995), aff'd in part and rev'd in part, 113 F.3d 1079 (9th Cir. 1997)).

Defendant argues that Plaintiffs only allege that Defendant's purpose was economic benefit. ECF 33, at 8. The complaint alleges that the motivation underlying the Pixel installation was “economic benefit”—or specifically “to improve the effectiveness of its and Meta's advertising and marketing” and to “monetiz[e] the information via targeted advertising, and other means.” ECF 1, ¶¶ 124, 126.

Plaintiffs cite to several out of district cases to argue that crime-tort exception applies even when Defendant's primary motivation was economic benefit. See ECF 32, at 17–18. The Court does not find these cases to be persuasive as every case cited by Plaintiffs relates to violations of the Health Insurance Portability and Accountability Act (“HIPAA”) by healthcare companies—not a violation of VPPA. See Cooper v. Mount Sinai Health Sys., Inc., 742 F. Supp. 3d 369, 379 (S.D.N.Y. 2024) (alleging violation of HIPAA); Kane v. Univ. of Rochester, No. 23-CV-6027-FPG, 2024 WL 1178340, at *5 (W.D.N.Y. Mar. 19, 2024) (same); Kurowski v. Rush Sys. for Health, No. 22-c-5380, 2024 WL 3455020, at *6 (N.D. Ill. July 18, 2024) (same); Gay v. Garnet Health, No. 23-CV-06950 (NSR), 2024 WL 4203263, at *4 (S.D.N.Y. Sept. 16, 2024) (same); Castillo v. Costco Wholesale Corp., No. 2:23-CV-01548-JHC, 2024 WL 4785136, at *5 (W.D. Wash. Nov. 14, 2024) (same); R.C. v. Walgreen Co., 733 F. Supp. 3d 876, 901 (C.D. Cal. 2024) (same).

The Court finds that the complaint alleges that the purpose of the interception was not “to perpetuate torts on millions of Internet users, but to make money.” In re Google Inc. Gmail Litig., No. 13-MD-02430-LHK, 2014 WL 1102660, at *18 n.13 (N.D. Cal. Mar. 18, 2014). The Court finds that Plaintiffs have failed to meet their burden to show that the crime-tort exception applies. The Court GRANTS the motion to dismiss as to Plaintiffs’ ECPA claim.

2. Plaintiffs’ consent bars their common law invasion of privacy, California Constitution invasion of privacy, and CIPA claims.

Plaintiffs allege violation of common law invasion of privacy, intrusion upon seclusion; violation of the California Constitution, Art. 1, § 1; and violation of CIPA, Cal. Penal Code § 631. Plaintiffs’ consent is a defense to all three claims. See Opperman v. Path, Inc., 205 F. Supp. 3d 1064, 1072 (N.D. Cal. 2016) (user consent is a defense under CIPA); Smith, 262 F. Supp. 3d at 955 (user consent is a defense under privacy protections under the California Constitution as well as common-law tort claims for intrusion upon seclusion).

Here, because the Court finds that Defendant has established consent as a defense, the Court GRANTS the motion to dismiss as to Plaintiffs’ common law invasion of privacy, California Constitution invasion of privacy, and CIPA claims. See supra Section IV.A.1.a.

3. Plaintiffs’ consent bars their VPPA claim.

A properly pleaded VPPA claim requires a plaintiff to allege that “(1) the defendant disclosed ‘personally identifiable information concerning any customer’ to ‘any person,’ (2) the disclosure was made knowingly, (3) the disclosure was not authorized elsewhere in the statute, and (4) the defendant is a ‘video tape service provider.’ ” Fan v. NBA Properties Inc., No. 23-CV-05069-SI, 2024 WL 1297643, at *2 (N.D. Cal. Mar. 26, 2024) (quoting Mollett v. Netflix, Inc., 795 F.3d 1062, 1066 (9th Cir. 2015)).

The VPPA allows for disclosure of a consumer's personally identifiable information when the disclosures are made with a consumer's “informed, written consent.” 18 U.S.C. § 2710(b)(2)(B). Under § 2710(b)(2)(B), the written consent must (1) be “in a form distinct and separate from any form setting forth other legal or financial obligations of the consumer;” (2) be given at the time disclosure is sought or given in advance for a set period of time not to exceed two years, and (3) provide the consumer with the ability to opt out from disclosures “in a clear and conspicuous manner.” Id.

Defendant argues that Plaintiff's consent also fulfills the VPPA standard. ECF 22, at 12. Defendant contends that its Cookies Banner, account creation, and checkout consent flow satisfy all of the requirements of VPPA's consent provision. Id. Further, the Privacy Policy informs users that they can “refuse Cookies or request their deletion as well as obtain the list of partners who are permitted to store and/or access these Cookies, please see the Cookies page.” ECF 22-13, Ex. L. It also explains that “You can also adjust your browser settings to understand when these Cookies are stored on your device or to disable the Cookies by consulting your browser's ‘Help’ menu.” Id. Finally, section 6 states that Website users have the “right to object and withdraw [their] consent” to the “sharing of your Data” through (a) the Privacy and Communication Section of their Account management page, (b) on the Cookies page, or (c) in the settings of their devices. Id.

Plaintiffs provide counterarguments to § 2710(b)(2)(B)’s “distinct and separate,” “written” or “informed,” and temporal requirements. ECF 32, at 7–10. Plaintiffs first argue that the Privacy Policy does not comply with § 2710(b)(2)(B) because it is rife with other legal obligations of the consumer. Id. at 8 (listing twelve purported legal obligations).

Defendant argues that Plaintiffs do not cite any authority to support their contention that these statements are legal obligations. ECF 33, at 8. Defendant argues that courts routinely classify such policies as “disclosures” or “statements” by companies, not as obligations of the users. See, e.g., Libman v. Apple, Inc., No. 22-CV-07069-EJD, 2024 WL 4314791, at *5 (N.D. Cal. Sept. 26, 2024) (deeming privacy policies “disclosures”). The Court agrees and finds that the Privacy Policy and Cookie Banner comply with the “distinct and separate” requirement.

Plaintiffs next contend that the Cookie Banner fails to meet the VPPA requirement that the consent be “written.” ECF 32, at 8–9. Plaintiffs concede that the VPPA allows for the obtainment of “written” consent to include “through an electronic means using the Internet.” Id. However, Plaintiffs argue that nothing in the record reflect any affirmative consent by Plaintiffs to the Cookie Banner. Id. at 9.

Defendant argues that Plaintiffs’ consent to the Cookie Banner was “written” and “informed.” ECF 33, at 9. Website users are prompted with the option to “Set Cookie Preferences.” ECF 22-4, Ex. C. This allows users to individually permit or decline particular cookie types, including essential cookies, analytics cookies (i.e. “cookies to measure the traffic to [the] website”), personalization cookies (i.e. cookies that allow a personalized experienced based on “browsing history and the products offered”), targeted advertising cookies, and multimedia player cookies. See ECF 22-5, Ex. D; ECF 22-6, Ex. E; ECF 22-7, Ex. F. Further, Plaintiffs do not sign onto any legal or financial obligations via the Cookie Banner (or Privacy Policy) that would distract from their consent to the use of cookies and pixels on the Website. ECF 33, at 9. The Court agrees and finds that the Cookie Banner complies with the “written” and “informed” requirement for the VPPA.

Finally, Plaintiffs contend that the Privacy Policy and the Cookie Banner run afoul the timing requirements for proper VPPA consent. ECF 32, at 9. Under the VPPA, consent may be given either at the time disclosure is sought or given in advance of disclosure, for a set period of time not to exceed 2 years. 18 U.S.C. § 2710(b)(2)(B)(ii)(I)–(II). Plaintiffs argue that the Cookie Banner does not obtain consent at the time of disclosure or for future disclosures. ECF 32, at 9. Further, the Privacy Policy does not contain language to suggest that it attempts compliance with the 2-year outside limit for advance consent. Id.

Defendant counters that Plaintiffs ignore that consent is elicited with each and every purchase on the Website—including a purchase of a Ubisoft+ subscription—which for every class member, must have fallen within the last two years. ECF 33, at 9; see also 18 U.S.C. § 2710(c)(3) (the statute of limitations for VPPA claims is two years). The Court finds Defendant's counterargument to be persuasive.

The Court finds that Defendant's Cookies Banner, account creation, and checkout consent flow satisfy all of the requirements of VPPA's consent provision. Plaintiffs’ consent defeats their VPPA claim. Accordingly, the Court GRANTS motion to dismiss for Plaintiffs’ VPPA claim.

B. Leave to amend is futile.

Pursuant to Rule 15(a)(2), a party may amend its pleadings with the opposing party's written consent or the court's leave. Fed. R. Civ. P. 15(a)(2). “The court should freely give leave when justice so requires.” Id. This policy is applied with “extreme liberality.” Eminence Capital, LLC v. Aspeon, Inc., 316 F.3d 1048, 1051 (9th Cir. 2003) (internal citation omitted). The nonmovant bears the burden of demonstrating why leave to amend should not be granted. DCD Programs, Ltd. v. Leighton, 833 F.2d 183, 187 (9th Cir. 1987). The Supreme Court has outlined five factors to consider in deciding whether leave to amend is warranted: (1) bad faith on the part of the movant, (2) undue delay by the movant, (3) repeated amendments by the movant, (4) undue prejudice to the nonmovant, and (5) futility of the proposed amendment. Foman, 371 U.S. 178 at (1962).

Plaintiffs request leave to amend if any of their claims are dismissed. ECF 32, at 23. Defendant opposes granting leave because amendment would be futile. ECF 33, at 12. Here, the Court agrees with Defendant and finds that amendment is futile. Plaintiffs cannot amend their complaint to overcome the issue of consent. See Smith, 262 F. Supp. 3d at 956 (finding leave to amend to be futile when plaintiffs consented to the conduct at issue). Accordingly, the Court DENIES Plaintiffs’ request for leave to amend.

V. CONCLUSION

For the reasons stated above, the Court GRANTS Defendant's motion to dismiss the complaint in its entirety with prejudice. The issue of consent defeats all of Plaintiffs’ claims.

This Order resolves ECF 22.

IT IS SO ORDERED.

TRINA L. THOMPSON, United States District Judge