For a second time, a federal judge from the Southern District of New York has dismissed a class action lawsuit brought by a man who subscribed to NBA.com and claimed his personal viewing information from the site (along with his Facebook ID, which he alleged was personally identifiable information) was disclosed to third-party Facebook without his knowledge or consent. This, he claimed, violated the Video Privacy Protection Act (VPPA).
This time, the court found that the plaintiff “failed to plausibly allege that the NBA disclosed personally identifiable information in violation of the VPPA.” The district court reasoned that, following Second Circuit precedent, an “ordinary person” would not be able to identify the plaintiff’s video-watching habits from the alleged Pixel transmissions, wrote attorneys Gerald L. Maatman, Jr., Ryan T. Garippo, and Elizabeth G. Underwood—all of Duane Morris—who recently analyzed the decision.
They added that the “ruling illustrates that district courts in the Second Circuit continue to interpret the phrase ‘personally identifiable information’ contained within the VPPA narrowly, and that the uphill burdens plaintiffs face in adtech and VPPA claims against corporate defendants are continuing to grow steeper.”
Background
Plaintiff Michael Salazar alleged that in 2022 he digitally subscribed to NBA.com, a website with approximately 14.5 million unique monthly visitors. On NBA.com, viewers can watch video content under a section fittingly titled “Videos.” The NBA also operates a mobile application (App) available for Android and iPhone devices.
An individual may register on NBA.com by signing up for an online newsletter. To do so, an individual provides personal information, including an email address. When individuals sign up for this digital subscription, they also provide the NBA with their IP address—an individualized number assigned to “all information technology connected devices.” The IP address provides the NBA with the user’s city, ZIP code, and physical location.
The NBA’s Data Policies
NBA.com has a Privacy Policy stating that the website collects “Personal Information” from users. The relevant portion lists the types of data collected as follows:
• This data will vary, but typically consists of name, email address, postal address, phone number, and other similar contact data. We also receive data from the communications you send √to us, such as customer service inquiries, product reviews, and other feedback regarding the Services.
• User credentials, such as username, password, password hints, and similar security information used to create an account and authenticate users of the Services.
• Demographic data, such as age, gender, country, and language preference.
• Payment data, such as credit card information and billing address.
• Device data, such as type of device, operating system and other software installed on the device, device settings, IP address, device identifiers, and error reports.
• Usage data, such as the programs and features your access, items you purchase, and the timing, frequency, and duration of your interactions through the Services.
• Location data, such as IP addresses received from your device.
• Information about your interests and preferences, such as your favorite teams and players, your home city, or your communication preferences. In addition to what you provide directly, we may infer your interests and preferences from other data we collect, such as the content and advertisements you interact with while using the Services.
The plaintiff alleged that when an individual creates an account with NBA.com, the NBA does not disclose in its Privacy Policy (or Terms of Service) that it will share personal data with third parties, nor are users asked to consent to this practice.
Furthermore, he alleged, the NBA collects and shares users’ data and personal information with third parties through cookies, software development kits (SDKs), and tracking pixels.
Specifically, Salazar claimed that the NBA installed Facebook’s tracking pixel on NBA.com. Therefore, when a digital subscriber used NBA.com and watched videos, “the website sent to Facebook certain information about the viewer, including, but not limited to, their identity and the media content the digital subscriber watched.”
Personal Viewing Information (PVI) is comprised of two sources of data: (1) personally identifiable information, including a Facebook ID (FID); and (2) “Video Media,” meaning “the computer file containing video and its corresponding URL viewed.”
Salazar claimed the NBA “purposefully used Facebook’s pixel code on NBA.com and the App, knew that PVI would be disclosed to Facebook, and financially benefited from it.”
He also alleged that the pixel “enabled NBA.com and the accompanying app to show targeted advertising to its digital subscribers based on the products those digital subscribers had previously viewed on the website or app, including Video Media consumption, for which Defendant received financial remuneration.” The PVI, according to the complaint, was not anonymized, and therefore Facebook could either add the data to information it already had for specific users or use the data to generate new user profiles.
Plaintiff’s Use of NBA.com
By doing so, the plaintiff alleged that his PVI was disclosed to Facebook and that he “never consented, agreed, authorized, or otherwise permitted Defendant to disclose his PVI to Facebook.” Furthermore, he claimed he was never provided written notice that his PVI would be disclosed, nor did he receive any written notice that he could opt out of such disclosure.
Salazar initiated this putative class action on September 16, 2022.
“The NBA filed a motion to dismiss and argued that Plaintiff failed to plead that he was a consumer of goods and services within the meaning of the VPPA because, although he alleged that he viewed audio-visual content on the NBA’s website, he did not allege that he viewed the materials to which he actually subscribed but rather, separate and free content that was offered elsewhere on the website,” wrote the Duane Morris attorneys. “Put differently, the content containing adtech was not the content that created his statutory standing to sue under the VPPA.”
The U.S. Court of Appeals for the Second Circuit, however, reversed, remanding the case to the district court. The NBA again moved to dismiss the claims, pursuant to Federal Rule of Civil Procedure 12(b)(6), for failure to state a claim.
Again, the judge dismissed the plaintiff’s proposed VPPA class action.
“In reaching its decision, the Court applied the Second Circuit’s ‘ordinary person’ standard, which requires plaintiffs to show that the ‘personally identifiable information’ includes information that would permit an ‘ordinary person’ to identify a user’s video-watching habits,” wrote the attorneys.
They continued: “Under this standard, the Court found that the personally identifiable information would not allow an ordinary person to identify Plaintiff’s video-watching habits, relying on other cases in which the Second Circuit rejected Pixel-based VPPA claims that ‘mirror’ the allegations at issue. See Soloman v. Flipps Media, Inc., 136 F.4th 41, 44 (2d Cir. 2025) (finding that the complaint did not ‘plausibly allege that an ordinary person could identify [the plaintiff]’ because an ordinary person would not be able to decipher the ‘c_user’ cookie and corresponding string of letters to be a person’s Facebook ID); see also Hughes v. National Football League, 24-2656, 2025 WL 1720295 (2d Cir. June 20, 2025) (rejecting the argument that a user’s Facebook ID could be identified based on lines of computer code because it was not plausible that an ordinary person would conclude that the phrase was a person’s Facebook ID). The Court aligned with other district court rulings in finding the plaintiff’s argument—that a person could use internet-based tools like ChatGPT to understand the code communication—unpersuasive, reasoning that the argument was ‘insufficient to demonstrate that an ordinary person would know what to do with the c_user information to pinpoint an individual’s identity.’” (citing Taino v. Bow Tie Cinemas, LLC, No. 23-CV-0537, 2025 WL 2652730, at *8 (S.D.N.Y. Sept. 16, 2025)).
The Duane Morris attorneys noted several implications for companies.
“This case is a success for defendants involved in other putative adtech class actions,” they wrote. “Indeed, Salazar is another example of a district court applying a narrow interpretation of ‘personally identifiable information’ under the Second Circuit’s ‘ordinary person’ standard and has broader implications outside of the VPPA for adtech class actions generally.
“As a result, if corporate counsel is faced with an adtech class action based on commonplace technology installed on his or her organization’s website, he or she should consider raising these arguments in a motion to dismiss or shortly thereafter, as Salazar and its progeny may prove to be a powerful tool to exit a putative class action early in the litigation.”
Salazar v. National Basketball Association, S.D.N.Y., No. 22 Civ. 07935, 2025 WL 2830939 (Oct. 6, 2025).
