A federal judge from the Southern District of New York has dismissed a putative class action lawsuit brought by a man who subscribed to NBA.com and claimed his personal viewing information from the site (along with his Facebook ID, which he alleges is personally identifiable information) was disclosed to third party Facebook without his knowledge or consent in violation of the Video Privacy Protection Act (VPPA).
The court dismissed the suit, pursuant to federal Rule of Civil Procedure 12(b)6, or failure to state a claim.
Plaintiff Michael Salazar alleged specifically that in 2022 he digitally subscribed to NBA.com,
a website that has approximately 14.5 million unique monthly visitors. On NBA.com, viewers can watch video content under a section of the website fittingly titled, “Videos.” Id. The NBA also has a phone application (App) that is downloadable on Android and iPhone devices.
An individual may register on NBA.com by signing up for an online newsletter. To sign up, an individual provides personal information, including an email address. When individuals sign up for this digital subscription, they provide the NBA with their IP address, which is an individualized number assigned to “all information technology connected devices.” The IP address provides the NBA with the user’s city, zip code, and physical location.
The NBA’s Data Policies
NBA.com has a Privacy Policy that states the website collects “Personal Information” from users. The relevant part of the policy lists the types of data collected as follows:
- This data will vary, but typically consists of name, email address, postal address, phone number and other similar contact data. We also receive data from the communications you send to us, such as customer service inquiries, product reviews and other feedback regarding the Services.
- User credentials, such as username, password, password hints and similar security information used to create an account and authenticate users of the Services.
- Demographic data, such as age, gender, country and language preference.
- Payment data, such as credit card information and billing address.
- Device data, such as type of device, operating system and other software installed on the device, device settings, IP address, device identifiers and error reports.
- Usage data, such as the programs and features you access, items you purchase, and the timing, frequency and duration of your interactions through the Services.
- Location data, such as IP addresses received from your device.
- Information about your interests and preferences, such as your favorite teams and players, your home city or your communications preferences. In addition to what you provide directly, we may infer your interests and preferences from other data we collect, such as the content and advertisements you interact with while using the Services.
Plaintiff alleged that when an individual creates an account with NBA.com, the NBA does not disclose in the Privacy Policy (or Terms of Service) that it will share personal data with third parties, nor are parties asked to consent to this practice.
Furthermore, he alleged, the NBA collects and shares data and personal information of its users with third parties through cookies, software development kits (“SDKs”), and tracking pixels.
Specifically, Salazar claimed that the NBA installed Facebook’s tracking pixel on NBA.com. Therefore, when a digital subscriber uses NBA.com and watches videos, “the website sends to Facebook certain information about the viewer, including, but not limited to, their identity and the media content the digital subscriber watched.”
The court, citing the complaint, noted that the Personal Viewing Information (PVI) is comprised of two sources of data: (1) personally identifiable information including a Facebook ID (FID); and (2) “Video Media” meaning “the computer file containing video and its corresponding URL viewed.”
Salazar claimed the NBA “purposefully used Facebook’s pixel code on NBA.com and the App, knew that PVI would be disclosed to Facebook, and financially benefited from it.”
He also alleged that the pixel “enabled NBA.com and accompanying app to show targeted advertising to its digital subscribers based on the products those digital subscriber’s [sic] had previously viewed on the website or app, including Video Media consumption for which Defendant received financial remuneration.” The PVI is not anonymized and therefore Facebook can either add the data to the information it already has for specific users or use the data to generate new user profiles, according to the complaint.
Plaintiff’s Use of NBA.com
By doing so, Plaintiff alleged that his PVI was disclosed to Facebook and that he “never consented, agreed, authorized, or otherwise permitted Defendant to disclose his PVI to Facebook.” Furthermore, he claimed he was never provided written notice that his PVI would be disclosed, nor did Plaintiff receive any written notice that he could opt out of the disclosure of his PVI.
Salazar initiated this putative class action on September 16, 2022. The NBA moved to dismiss, pursuant to Rules 12(b)(1) and 12(b)(6) shortly thereafter. The former is not addressed here.
The NBA argued that Salazar failed to plead a plausible claim under the VPPA because “he fails to allege facts that qualify him as a protected consumer; . . . he fails to allege facts showing the NBA disclosed PVI; . . . or did so knowingly; and even if it did, the facts alleged indicate the disclosures were subject . . . to a consent exception.”
The parties disagree as to whether Plaintiff qualifies as a consumer receiving the protections of the VPPA. The VPPA defines consumer as “any renter, purchaser, or subscriber of goods or services from a video tape service provider.” 18 U.S.C. § 2710(a)(1). Neither party asserts that Plaintiff is a “renter” or “purchaser,” but they instead focus on whether Plaintiff qualifies as a “subscriber.”
Specifically, Salazar argued that he “has sufficiently pleaded a VPPA claim as a consumer given that he subscribed to NBA.com newsletters, he provided personal information to do so, and NBA.com provides video services. This is sufficient to qualify as a ‘subscriber’ under the VPPA, according to the plaintiff.”
The court disagreed with Plaintiff, citing statutory framework and case law. One of the opinions that was most central to its ruling was Carter v. HealthPort Techs., LLC, 822 F.3d 47, which suggested that being a subscriber entitles one to access to video content. In this case, Plaintiff did not have to be a subscriber to have access to video content.
In that case, because the complaint “did not support a claim that the ‘the plaintiffs acted as subscribers when they viewed the videos on the hgtv.com, it did not plausibly allege they were consumers under the VPPA.” 2023 U.S. Dist. LEXIS 71150, [WL] at *7.
“The same result holds here. The plaintiff had the same access to videos on the NBA.com site as any other visitor to the site.
“Because the plaintiff does not allege that his newsletter subscription allowed him access to the videos on the NBA.com site that any member of the public would not otherwise have,” the claim under the VPPA fails.
Michael Salazar v. NBA; S.D.N.Y.; No. 1: 22-cv-07935 (JLR); 8/7/23
