Yershov v. Gannett Satellite Information Network, Inc., No. 1:2014cv13112 - Document 30 (D. Mass. 2015)

Court Description: Judge F. Dennis Saylor, IV: ORDER entered. MEMORANDUM AND ORDER granting 14 Motion to Dismiss for Failure to State a Claim. (FDS, law4)

Download PDF

Yershov v. Gannett Satellite Information Network, Inc. Doc. 30 UNITED STATES DISTRICT COURT DISTRICT OF MASSACHUSETTS ____________________________________ ) ALEXANDER YERSHOV, ) individually and on behalf of all ) others similarly situated, ) ) Plaintiff, ) ) v. ) ) GANNETT SATELLITE ) INFORMATION NETWORK, INC., ) dba USA TODAY, ) ) Defendant. ) ____________________________________) Civil Action No. 14-13112-FDS MEMORANDUM AND ORDER ON DEFENDANT’S MOTION TO DISMISS SAYLOR, J. This is a putative class action arising out of the Video Privacy Protection Act (“VPPA”), 18 U.S.C. § 2710. The VPPA, among other things, prohibits the disclosure of “personally identifiable information” of certain consumers of video services. Plaintiff Alexander Yershov has filed suit against defendant Gannett Satellite Information Network, Inc. Gannett publishes a print and on-line newspaper called USA Today. Gannett has also created a mobile app, called the “USA Today App,” that is designed to run on smartphones and other mobile devices, and that permits readers to view the on-line version of the newspaper. Viewers using the App can access video clips on various news, sports, and entertainment topics. Plaintiff alleges that defendant discloses “personally identifiable information” every time a person uses the USA Today App to watch video clips. Specifically, plaintiff alleges that every time a user of the App watches a video, the unique identification number of the user’s Dockets.Justia.com smartphone is provided to a third-party data-analytics company. Plaintiff contends that by doing so, Gannett violates the VPPA. On September 19, 2014, defendant filed a motion to dismiss pursuant to Fed. R. Civ. P. 12(b)(1) for lack of subject-matter jurisdiction and Fed. R. Civ. P. 12(b)(6) for failure to state a claim. For the following reasons, defendant’s motion will be granted. I. Background A. The USA Today App Gannett Satellite Information Network, Inc., is based in McLean, Virginia. (Compl. ¶ 6). Gannett is a media company that produces news and entertainment programming. (Id. ¶ 1). It distributes that content to consumers through a variety of media, including its flagship newspaper, USA Today. (Id.). In addition to the print edition of USA Today, Gannett offers content through websites and mobile software applications. (Id.). One of Gannett’s mobile applications is the USA Today App. (Id. ¶ 2). The USA Today App is a mobile software application that allows individuals to access news and entertainment media content. (Id. ¶ 9). It is available for installation on Android mobile devices, among others. (Id.). Android is a mobile device operating system developed by Google. (Id. ¶ 1 n.1). Smartphones made by a variety of companies, including HTC and Samsung, use the Android operating system. (Id.). Users can install the USA Today App on an Android device by visiting the Google Play Store, the on-line media platform operated by Google. (Id. ¶ 10). Once installed, the App allows users to view articles and video clips organized into sections, such as news and sports. (Id. ¶ 12). Prior to using it for the first time, 2 the App requests permission from users to “push” notifications on their device. (Id. ¶ 10).1 The App does not otherwise seek a user’s consent to disclose personal information to third parties for any purpose. (Id. ¶ 11). There is no charge to install the App or to view video clips after installation. (See Compl. ¶¶ 9-11 (citing USA Today, GOOGLE PLAY, https://play.google.com/store/apps/ details?id=com.usatoday.android.news&hl=en (last visited July 2, 2014))). There is no registration requirement (such as a requirement that the user provide a name and e-mail contact). (See id.). After responding to the request for permission to “push” notifications, the user is not required to provide any other information in order to use the App. (See id.). B. Alleged Transmittal of PII The complaint alleges that each time users view video clips on the App, it sends a record of the transaction to Adobe Systems, Inc., an unrelated company that, among other things, performs third-party data-analytics. (Id. ¶ 13).2 Along with the record of the transaction, the App sends a user’s GPS coordinates and the Android device’s unique identification number (the “Android ID”). (Id. ¶ 13). The Android ID is a “64-bit number (as a hex string) that is randomly generated when the user first sets up the device and should remain constant for the lifetime of the user’s device.” (Id. ¶ 13 n.3 (citing Settings.Secure, ANDROID DEVELOPERS, http://developer.android.com/reference/android/provider/Settings.Secure.html#Android_ID)). Android IDs are unique to specific devices and users. (Id. ¶ 16). It is not precisely clear what 1 “Push” notifications are alerts that inform app users of relevant activity related to the app even when the user is not actively using it. USA Today App users may decline to receive “push” notifications. (See id. ¶ 10). 2 The complaint characterizes Adobe as a data-analytics company that “provides insights into the behaviors and demographics for the App’s user base.” (Id. ¶ 19). 3 the “record of the transaction” includes, but it appears from the complaint that it includes an identification of the video watched by the user. (See id. ¶¶ 42, 54, 57). According to the complaint, Adobe “collects an enormous amount of detailed information about a given consumer’s online behavior (as well as unique identifiers associated with a user’s devices) from a variety of sources.” (Id. ¶ 20). “Once Adobe links a device’s Android ID with its owner, it can then connect new information retrieved from Android apps—including the USA Today App—with existing data in the person’s profile (which was previously collected by Adobe from other sources).” (Id. ¶ 22). Therefore, when Adobe receives an individual’s Android ID and the record of the video transaction from USA Today App, it is able to connect that information with information collected from other sources “to personally identify users and associate their video viewing selections with a personalized profile in its databases.” (Id. ¶ 29). According to the complaint, Alexander Yershov downloaded and began using the USA Today App on his Android device in late 2013. (Id. ¶ 39). He never consented to allowing USA Today to disclose his “personally identifiable information” to third parties. (Id. ¶ 40). The complaint alleges that “the combination of his device’s unique Android ID and the records of videos that [Yershov] viewed . . . constitutes ‘personally identifiable information’ . . . because it allows Adobe to identify users such as Yershov, and to attribute their video-viewing records to their Adobe-created profiles.” (Id. ¶ 57). C. Procedural Background Plaintiff filed the complaint in this action on July 24, 2014, alleging a violation of the Video Privacy Protection Act, 18 U.S.C. § 2710. (Compl.). The complaint is a putative class 4 action; the class is defined as “[a]ll persons in the United States who used the USA Today App to watch videos and had their PII transmitted to Adobe.” (Id. ¶ 43). The complaint alleges that all such class members “have had their statutorily defined right to privacy violated.” (Id. ¶ 62). Defendant has moved to dismiss for failure to state a claim upon which relief can be granted. II. Legal Standard On a motion to dismiss, the Court “must assume the truth of all well-plead[ed] facts and give . . . plaintiff the benefit of all reasonable inferences therefrom.” Ruiz v. Bally Total Fitness Holding Corp., 496 F.3d 1, 5 (1st Cir. 2007) (citing Rogan v. Menino, 175 F.3d 75, 77 (1st Cir. 1999)). To survive a motion to dismiss, the complaint must state a claim that is plausible on its face. Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). That is, “[f]actual allegations must be enough to raise a right to relief above the speculative level, . . . on the assumption that all the allegations in the complaint are true (even if doubtful in fact).” Id. at 555 (citations omitted). “The plausibility standard is not akin to a ‘probability requirement,’ but it asks for more than a sheer possibility that a defendant has acted unlawfully.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Twombly, 550 U.S. at 556). Dismissal is appropriate if the facts as alleged do not “possess enough heft to show that plaintiff is entitled to relief.” Ruiz Rivera v. Pfizer Pharm., LLC, 521 F.3d 76, 84 (1st Cir. 2008) (alterations omitted) (internal quotation marks omitted). III. Analysis The Video Privacy Protection Act (“VPPA”), 18 U.S.C. § 2710, was enacted in 1988. Congress passed the VPPA after a “newspaper in Washington published a profile of [Supreme 5 Court nominee and D.C. Circuit] Judge Robert H. Bork based on the titles of 146 films his family had rented from a video store.” S. Rep. 100-599, 2d Sess. at 5 (1988), reprinted in 1988 U.S.C.C.A.N. 4342. Among other things, the VPPA prohibits “video tape service providers” from “knowingly disclos[ing], to any person, personally identifiable information concerning any consumer of such provider” without the consumer’s informed, written consent. 18 U.S.C. § 2710(b). The statute has three relevant definitions: • the term “video tape service provider” means “any person, engaged in the business, in or affecting interstate or foreign commerce, of rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials . . . ,” 18 U.S.C. § 2710(a)(4); • the term “personally identifiable information” “includes information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider,” 18 U.S.C. § 2710(a)(3); and • the term “consumer” “means any renter, purchaser, or subscriber of goods or services from a video tape service provider.” 18 U.S.C. § 2710(a)(1). For present purposes, at least, defendant does not contest that it fits within the statutory definition of a “video tape service provider.”3 Defendant contends, however, that the complaint should be dismissed because (1) defendant did not disclose “personally identifiable information” within the meaning of the statute, (2) plaintiff is not a “consumer” within the meaning of the 3 Although defendant contends that plaintiff’s “VPPA claim will ultimately fail for the additional, independent, reason that Gannett is not a ‘video tape service provider’ under the VPPA,” it does not challenge “the sufficiency of [p]laintiff’s pleading” of this issue at this stage of litigation. (Defs.’ Mem. Support Mot. Dismiss 7 n.4). 6 statute, and (3) plaintiff lacks standing because he has not pleaded an injury in fact. A. Personally Identifiable Information As noted, the VPPA prohibits “video tape service providers” from disclosing “personally identifiable information” (“PII”) concerning a “consumer” to third parties. 18 U.S.C. § 2710(b). The complaint alleges that each time users view video clips on the USA Today App, defendant sends a record of the transaction along with the user’s GPS coordinates and the Android ID for the user’s device.4 The first issue is whether that information sent to Adobe qualifies as “personally identifiable information.” Any statutory analysis begins with the text of the statute. To some extent, of course, this exercise involves an attempt to place a square peg (modern electronic technology) into a round hole (a statute written in 1988 aimed principally at videotape rental services). Nonetheless, the statute says what it says, and the place to begin is with the words themselves. Again, the VPPA provides that “personally identifiable information” includes “information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider.” 18 U.S.C. § 2710(a)(3). Those words must be interpreted in “context and with a view to [their] place in the overall statutory scheme.” Davis v. Michigan Dept. of Treasury, 489 U.S. 803, 809 (1989). Here, the statute provides at least two clues as to the meaning of the term. First, the statute permits disclosure of PII under five specific circumstances. 18 U.S.C. § 4 The complaint alleges that “even ‘[w]hen a device has multiple users [] each user appears as a completely separate device, so the ANDROID_ID value is unique to each user.” (Compl. ¶ 17 (citing Settings.Secure, ANDROID DEVELOPERS, https://developer.android.com/reference/android/provider/Settings.Secure.html#ANDROID_ID (last visited July 15, 2014)). As a result, each device user has a unique Android ID. (See id.). It further alleges that Adobe is able to use the Android ID “to identify [plaintiff] and attribute his video viewing records to an individualized profile of [him] in its databases.” (Id. ¶ 42). 7 2710(b)(2). One of those circumstances is that disclosure may be made “to any person” if “the disclosure is solely of the names and addresses of consumers,” but only if the consumer has had an opportunity to prohibit that disclosure, and if the disclosure does not identify the “title, description, or subject matter of the video.”5 Id. § 2710(b)(2)(D). That suggests (1) that a consumer’s name and address are both PII, and (2) that the universe of PII is greater than the consumer’s name and address. Second, the list of statutory definitions uses the word “means” in three out of four instances (in other words, the definitions are formatted to provide that the term “x” means “y”). See 18 U.S.C. § 2710(a)(1), (2), (4). As to PII, however, the statute provides that “the term ‘personally identifiable information’ includes information which identifies a person . . . .” Id. § 2710(a)(3) (emphasis in original). This suggests that the statutory term may have a broader definition than what is provided in the text, which may be a mere example of a possible form of PII.6 With that framework in mind, the Court turns to the question whether the information sent to Adobe constitutes PII. When a user requests a video clip, Gannett discloses three kinds of information: (1) a record of the transaction (presumably, information concerning the precise video selected for viewing); (2) the user’s GPS coordinates (that is, the precise location of the user); and (3) the Android ID of the user’s smartphone or other device. There is no question that 5 The statute provides an exception, such that “the subject matter of such materials may be disclosed if the disclosure is for the exclusive use of marketing goods and services directly to the consumer.” 28 U.S.C. § 2710(b)(2)(D)(ii). 6 While the Court places very limited weight on legislative history, that history supports such a conclusion. According to the Senate Report, Congress’s purpose in enacting the VPPA was “[t]o preserve personal privacy with respect to the rental, purchase, or delivery of video tapes or similar audio visual materials.” S. Rep. 100-599, 2d Sess. at 5 (1988), reprinted in 1988 U.S.C.C.A.N. 4342. at *1. The Senate Report specifically notes that the definition of PII “uses the word ‘includes’ to establish a minimum, but not exclusive, definition . . . .” Id. at *11. 8 the information transmitted to Adobe identifies the “specific video materials or services” requested or obtained by the consumer. See 18 U.S.C. § 2710(a)(1)(3). The issue is whether that information also identifies a specific person. Without question, a person’s name, social security number, and date of birth are PII. See In re Pharmatrak, Inc., 329 F.3d 9 (1st Cir. 2003) (finding that the definition of “contents” in Electronic Communication Privacy Act encompasses “personally identifiable information such as a party’s name, date of birth, and medical condition”).7 Similarly, a person’s home address is PII, under the statutory construction noted above and as a matter of common sense.8 Similar types of information, such as a place of birth, a mother’s maiden name, an automobile license plate number, or a home telephone number, could also be PII under at least some circumstances; for example, celebrities and public officials often have unlisted telephone numbers and “blocked” license plate numbers in order to protect their privacy and security. It requires no great leap of logic to conclude that the unique identifier of a person’s smartphone or similar device—its “address,” so to speak—is also PII. A person’s smartphone 7 Several federal statutes contain provisions that specifically use the term “personally identifiable information” or similar terms. See, e.g., 20 U.S.C. § 1232g (Family Educational Rights and Privacy Act); 47 U.S.C. § 551(a)(2) (Cable Communications Policy Act); see also 15 U.S.C. § 6809(4)(A) (The Gramm-Leach Billey Financial Modernization Act) (referring to “nonpublic personal information”). 8 The Family Education and Records Privacy Act of 1974 (“FERPA”) prohibits educational entities from releasing or providing access to “any personally identifiable information in education records.” 20 U.S.C. § 1232g(b)(2). The statute does not provide a definition for PII. However, the regulation implementing the statute provides the following definition: The term includes, but is not limited to—(a) The student’s name; (b) The name of the student’s parent or other family members; (c) The address of the student or student’s family; (d) A personal identifier, such as the student’s social security number, student number, or biometric record; (e) Other indirect identifiers, such as the student’s date of birth, place of birth, and mother’s maiden name; (f) Other information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty . . . . 34 C.F.R. § 99.3. 9 “address” is an identifying piece of information, just like a residential address. Indeed, it is in many ways a more significant identifier. Smartphones typically contain “vast quantities of personal information.” Riley v. California, 134 S. Ct. 2473, 2485 (2014). “[A] cell phone collects in one place many distinct types of information—an address, a note, a prescription, a bank statement, a video—that reveal much more in combination than any isolated record.” Id. Therefore, the type of information that could be ascertained from a smartphone could potentially be devastating to an individual’s privacy interests. A person with access to a smartphone’s unique identifer could potentially learn a huge quantity of personal information about the user of that smartphone. Furthermore, a smartphone may be more directly connected to a specific individual that even a residential address; for example, people are much more likely to share their homes with other persons than their smartphones. Defendant makes two principal objections to that conclusion. First, it contends that the Android ID cannot be PII because it identifies an object, rather than a human being. But that contention cannot be correct. A home address describes an object, not a person, but there can be little doubt that it is PII. Indeed, and as noted, the VPPA expressly refers to the “addresses of consumers,” in a context clearly indicating that an address is PII. And that is true even though multiple persons may share a residence.9 The identity of an object—its unique “address,” whether in the physical world or in cyberspace—can therefore constitute PII, at least under some circumstances. Next, defendant contends that the Android ID cannot be PII because that information 9 Similarly, an automobile license plate number or a home telephone number may identify an object (a motor vehicle or a telephone) that several persons (for example, spouses or teenage children of the owner) may share. Nonetheless, that type of information could be a personal identifier under many circumstances, and thus fit within the definition of the statute. 10 cannot be linked to a specific person without access to certain additional information—specifically, the information that a particular phone is used by a particular person. But that is true of every identifier other than a person’s name. For example, a social security number is a string of nine numbers that only takes on meaning if it can be identified as the number of a specific person. Likewise, a date in a calendar is meaningless as an identifier, unless it is identified as a specific person’s date of birth. Even a person’s name may be of limited use as an identifier without further information; there may be hundreds, or thousands, of persons with the same or a similar name. At oral argument, defendant conceded that a home address qualifies as PII even though it requires an extra step to link it to a specific person. Defendant contended, however, that home addresses qualify as PII because there are public record databases that can link home addresses to individuals, but there is no such publicly accessible database that links an Android ID to a person. Defendant therefore contended that in isolation the Android ID is a meaningless number. But the same could also be said for social security numbers. There is no publicly accessible database that links those numbers to individuals, but a social security number is nonetheless unquestionably the type of information that fits within the definition of PII. It is also noteworthy that Gannett transmits the GPS coordinates of the user along with the Android ID. Presumably, that information would be sufficient to identify a very specific location (such as a building) from which the user viewed the video. It therefore appears possible to identify, with a relatively high degree of accuracy, the residential address of users at the same time as their Android ID. Indeed, in areas of relatively low-density housing, the GPS coordinates of the user are essentially identical to a residential address. 11 Finally, defendant notes that the substantial weight of authority points in the opposite direction. Of particular relevance is the Northern District of Georgia’s ruling in Ellis v. Cartoon Network, Inc., 2014 WL 5023535 (N.D. Ga. Oct. 8, 2014), because its facts are very similar to the facts of the present case. In Ellis, the court examined whether the Cartoon Network App’s transmission of a user’s video history along with the user’s Android ID to a third party constituted a violation of the VPPA. Id. at *2. For purposes of the motion to dismiss, the court accepted that the third party was able to reverse engineer the consumer’s identities from the Android ID, using information previously collected from other sources. Id. at *1. In its analysis, the court found that PII “is that which, in its own right, without more, ‘link[s] an actual person to actual video materials.’” Id. at *3 (quoting In re Nickelodeon, 2014 WL 3012873, *10 (D.N.J. July 2, 2014)). The court determined that the Android ID does not identify a specific person without the third party taking extra steps. Id. As a result, it concluded that “the disclosure of an Android ID alone . . . does not qualify as personally identifiable information under the VPPA.” Id. It relied on district court decisions in In re Hulu Privacy Litigation, 2014 WL 1724344 (N.D. Cal. Apr. 28, 2014), and In re Nickelodeon Consumer Privacy Litigation, 2014 WL 3012873 (D.N.J. July 2, 2014), to come to its conclusion.10 10 Two other decisions that defendant cites in support of its motion to dismiss also rely on the Hulu and the Nickelodeon decisions to conclude that information similar to the Android ID is not PII. See Locklear v. Dow Jones & Company, Inc., 1:14-cv-00744-MHC (N.D. Ga. Jan 23, 2015) (relying on the Hulu, Nickelodeon, and Ellis decisions to conclude that disclosure of Roku serial number and titles of videos does not violate the VPPA because the Roku serial number without more is not PII); Eichenberger v. ESPN, Inc., C14-463 TSZ (W.D. Wash. Nov. 24, 2014) (relying on the Hulu decision to conclude that disclosure of Roku serial number and viewing records does not violate the VPPA because the Roku serial number is not PII). After the court in Eichenberger dismissed the first amended complaint, the plaintiff in that case filed a second amended complaint. See Eichenberger v. ESPN, Inc., C14-463 TSZ (W.D. Wash. May 7, 2015). The second amended complaint alleged that the third party, Adobe, was able to “automatically correlate[] [the Roku device serial number] with existing user information possessed by Adobe, and therefore identif[y] Eichenberger as having watched specific video material . . . .” Id. at 3. In an 12 The Nickelodeon case involved a class of children under the age of thirteen who sued Viacom for violating the VPPA. The case involved plaintiffs who visited “certain Viacomowned websites and willingly provide[d] Viacom with their gender and age when they register[ed] as users of the sites.” Id. at *2. When the plaintiffs went to these websites, Viacom also placed a “cookie” on their computer without their consent or that of their parents.” Id. The “cookie” allowed Viacom to acquire certain information about each plaintiff, including their “‘IP address’; ‘browser settings’; ‘unique device identifier’; ‘operating system’; ‘screen resolution’; ‘browser version’; and certain ‘web communications,’ specifically ‘detailed URL . . . requests and video materials requested and obtained from Viacom children’s websites.” Id. at *1. Whenever registered users watched video on Viacom’s websites, Viacom made a record of that activity and shared it with Google. Id. at *1-2. The court refused to credit allegations in the complaint that Viacom and Google were able to link online activity and information with offline activity and information, and thereby “identify specific users.” Id. at *2 n.3. Against that backdrop, the court examined whether Viacom’s disclosures to Google of “anonymous usernames; IP address; browser setting; ‘unique device identifier’; operating system; screen resolution; browser version; and ‘detailed URL requests and video materials requested and obtained’ from the Viacom websites, requests which presumably contain” gender and age information and the title of a video, violated the VPPA. 2014 WL 3012873, at *10. The court cited the Hulu decision as holding that “PII is information that must link ‘a specific, identified opinion issued on May 7, 2015, the Eichenberger court engaged in a more thorough analysis of PII by looking to the statutory text, “its legislative history, and the growing line of cases that have considered this issue.” Id. at 6-12. The court cited the Nickelodeon, Hulu, Ellis, and Locklear decisions, and concluded that plaintiff’s complaint did not sufficiently plead that the defendant had disclosed PII. Id. at 10. The court found that the allegation that Adobe could combine the Roku device serial number with other information already in its possession “also fails to assert a plausible claim to relief under the VPPA.” Id. 13 person and his video habits’—what the Hulu [c]ourt characterizes as any information ‘akin’ to a name.” Id. at *10 (quoting Hulu, 2014 WL 1724344, at *12, 14). The Nickelodeon court concluded that “PII is information which must, without more itself link an actual person to actual video materials.” Id. The court found that “all Google knows from the disclosure of this information . . . is ‘a child’s username, sex, age, type of computer,’ and IP address.” Id. at *11. It is not enough that “information might one day serve as the basis of personal identification after some effort on the part of the recipient” because “the same could be said for nearly any type of personal information; this [c]ourt read the VPPA to require a more tangible, immediate link.” Id. Because this information in isolation did not identify a person, the court concluded that plaintiff’s VPPA claim against Viacom failed. Id. at *9.11 In Hulu, on a motion for summary judgment, the Northern District of California examined whether three types of disclosures by Hulu were PII. 2014 WL 1724344, at * 9. The first disclosure, to comScore, was a “watch page” URL web address that contained the video name and the Hulu user’s unique seven-digit Hulu User ID. Id. Using the user ID, comScore could access a user’s profile page, which listed the user’s first and last name. Id. The second disclosure, to comScore, was a “comScore ID” that was unique to each registered user, which “allowed comScore to link the identified user and the user’s video choices with information that 11 In response to the court’s decision, plaintiffs amended their complaint to “allege that Google could learn [p]laintiffs’ actual identities by using a ‘DoubleClick cookie identifier,’ and by combining the information Viacom provides it with data it already gathers from its other websites and services.” In re Nickelodeon Consumer Privacy Litigation, 2015 WL 248334, *2 (D.N.J. Jan. 20, 2015). In its unpublished opinion in the Nickelodeon case, the court found that plaintiffs did not allege “new facts which make it plausible that the information collected does indeed identify [p]laintiffs.” Id. at *3-*4. The court confirmed its previous holding that PII “is information which must, without more, itself link an actual person to actual video materials.” Id. at *3. Because the complaint alleged that Google independently gathered information to connect an actual person with actual video materials, the court concluded that the information disclosed by Viacom did not constitute PII. Id. In any event, the court found that the complaint included “no allegation that Google can identify the individual [p]laintiffs in this case, as opposed to identifying people generally, nor any allegation that Google has actually done so here.” Id. at *4. As a result, the court dismissed the amended complaint. Id. 14 comScore gathered from other websites that the same user visited.” Id. The third disclosure, to Facebook, included unique identifiers that sometimes consisted of the user’s IP address, the URL web address with the video name, and the user’s Facebook ID. Id. The court in Hulu found that “the statute, the legislative history, and the case law do not require a name, instead require the identification of a specific person tied to a specific transaction, and support the conclusion that a unique anonymized ID alone is not PII but context could render it not anonymous and the equivalent of the identification of a specific person.” Id. at *11. It therefore explained that “a unique anonymized ID could be PII if other evidence renders it the equivalent of identifying a specific person.” Id. However, it also noted that case law supported a “conclusion that anonymous identification data alone is not PII.” Id. In examining the three types of disclosures, the court looked at how the third party used the information. Id. at *12. The court concluded that the disclosure of the watch page URL containing the video name and a user’s unique sevendigit Hulu User ID was not PII because there was no evidence that suggested any linking of a specific, identified person and his video habits. Id.. Likewise, the court concluded that the disclosure to comScore of the comScore ID was not PII on the ground that although “[t]here may be substantial tracking that reveals a lot of information about a person . . . [,] there is a VPPA violation only if that tracking necessarily reveals an identified person and his video watching.” Id. Finally, the court concluded that the disclosure to Facebook of the watch page, the user’s IP address, and the Facebook user ID was PII because it constituted information that identified the Hulu user’s actual identity on Facebook. Id. at *13. “If the cookies contained a Facebook ID, they could show the Hulu user’s identity on Facebook.” Id. at *14. The Hulu decision does not necessarily support a finding that an Android ID is not PII. 15 The case was decided on a motion for summary judgment, and specifically noted that “a unique anonymized ID alone is not PII but context could render it not anonymous and the equivalent of the identification of a specific person.” It is unclear whether the court meant that context could render it PII if other information provided in the disclosure with the anonymized ID identified a specific person, or whether context could render it PII if the third party receiving the information had independent information that helped link the ID with a specific person. No matter what it holds, it is clear that the inquiry is context-dependent. Based on the logic of the Hulu decision, it would appear that the factual record would need to be developed before concluding that an Android ID is not PII. In any event, Nickelodeon’s conclusion that “PII is information which must, without more, itself link an actual person to actual video materials” is flawed. That conclusion would seemingly preclude a finding that a home address or social security number is PII. Surely, that cannot be correct. Therefore, because it relies on Nickelodeon and Hulu, the holding in Ellis that an Android ID is not PII is unpersuasive.12 12 Defendant also cites a variety of cases outside of the VPPA that involve PII to support its motion. For example, defendant cites the Cable Communication Privacy Act cases Pruitt v. Comcast Cable Holdings, LLC, 100 Fed. Appx. 713 (10th Cir. 2004) and Klimas v. Comcast Cable Comm’ns., Inc., 2003 WL 23472182 (E.D. Mich. July 1, 2003), aff’d on other grounds, 465 F.3d 271 (6th Cir. 2006). Courts have found that the VPPA is analogous to the Cable Act. See Parker v. Time Warner Entmt’ Co., 1999 WL 1132463, at *9 (E.D.N.Y. Nov. 8, 1999). In Pruitt, the Tenth Circuit examined whether Comcast information stored within Comcast’s converter boxes is PII. 100 Fed. Appx. at 716. The court explained that “[i]ndividual subscriber information is not contained within the converter box, but an identifying number known as a ‘unit address’ allows Comcast to match the subscriber’s purchases to its billing system.” Id. at 715. The court determined that “the converter box code—without more—provides nothing but a series of numbers.” Id. at 716. Because “without the billing information, even Comcast would be unable to identify which individual household was associated with the raw data in the converter box,” the court concluded that information contained in the boxes is not PII. Id. at 716-17. The Hulu court found that “Pruitt stands for the proposition that an anonymous, unique ID without more does not constitute PII. But it also suggests that if an anonymous, unique ID were disclosed to a person who could understand it, that might constitute PII.” Hulu, 2014 WL 1724344, at *11. Here, the complaint alleges that Adobe is able to use the Android ID to identify specific individuals. In Klimas, 2003 WL 23472182, the plaintiff brought a class action alleging that Comcast “secretly 16 The opinions cited above seem to take an unrealistic view of the nature of personal identifiers, and how readily different databases or pieces of information can be linked together. The courts appear to frame the issue in large part by referring to these identifiers as “anonymous identifiers,” which is unhelpful and possibly misleading. Again, a social security number or a date of birth, in isolation, is anonymous. However, it would be absurd to conclude that a social security number is not PII, simply because there is no publicly-available database linking those numbers with names. Likewise, it is unrealistic to refer to PII as “information which must, without more, itself link an actual person to actual video materials.” Again, that would appear to preclude a finding that home addresses, social security numbers, and dates of birth are PII. Moreover, drawing a link between the Android ID and a person’s name may not be difficult. If, as alleged, Adobe collects information from the USA Today App linking an Android ID and GPS information with a specific video, and collects information from another source (such as GPS information linked to residential addresses, and residential addresses linked to names)—it would be relatively easy for Adobe to link that information to identify a person. It is also possible, of course, that third parties such as Adobe have access to databases that link Android IDs to specific persons. In short, the information alleged disclosed to Adobe by Gannett, which consists of an Android ID and a GPS location, constitutes “personally identifiable information” within the meaning of the Video Privacy Protection Act. intercept[ed], cop[ied], stor[ed], and otherwise collect[ed] all the information sent to and from its subscribers over the Internet” in violation of the Cable Act. Comcast admitted storing IP and URL information. The issue the court considered was whether dynamic IP addresses constitute PII. Id. at *4. The court found that “a dynamic IP address cannot constitute PII [because] [u]nlike a subscriber’s name, address, social security number, etc., a dynamic IP address is constantly changing.” Id. at *5. It is undisputed that the Android ID is static. 17 B. Plaintiff Is Not a “Subscriber” The VPPA defines a “consumer” as any “renter, purchaser, or subscriber of goods or services from a video tape service provider.” 18 U.S.C. § 2710.(a)(1). Plaintiff contends that he is a “subscriber” for purposes of the VPPA because he “downloaded, installed, and watched videos” using the App. The term “subscriber” is not defined in the statute. Traditionally—and certainly as of 1988, when the statute was enacted—a “subscriber” would have been defined principally as a person who has signed up to receive a periodical or a commercial service, typically having agreed to make a regular payment. See, e.g., WEBSTER’S NINTH NEW COLLEGIATE DICTIONARY 1176 (Frederick C. Mish, et al., eds., 1991) (defining “subscribe” as “to enter one’s name for a publication or service; also: to receive a periodical or service regularly on order”); Subscriber Definition, THE OXFORD ENGLISH DICTIONARY (online ed.), http://oed.com/view/Entry/ 192954?redirectedFrom=Subscriber#eid (last visited Apr. 2, 2015) (defining “subscriber” as “a person who makes a regular payment in return for entitlement to receive a periodical, membership of a society, access to a commercially provided service, etc.”).13 The traditional subscription business model involves an individual making periodic payments in exchange for delivery of magazines, newspapers, or other content. See, e.g., Subscribe to Home Delivery, BOSTON GLOBE, http://services.bostonglobe.com/subscribers/homedelivery.aspx?id=5278 (last visited Apr. 14, 2015). In the modern electronic world, subscriptions entail a broader spectrum of activity. 13 Other definitions of “subscriber,” such a person who signs one’s name to a document, pledges a gift or contribution in writing, or agrees to purchase an offering of securities, are clearly not relevant here. See Subscribe Definition, MERRIAM-WEBSTER (online ed.), www.merriam-webster.com/dictionary/subscriber (last visited May 5, 2015). 18 Certain periodicals allow access (or complete access) to online content only with a subscription. See, e.g., WASHINGTON POST https://subscribe.washingtonpost.com/acquisition/ acquisitionapp.html#/offers/promo/digital01 (last visited Apr. 14, 2015); N.Y. TIMES, http://www.nytimes.com/subscriptions/Multiproduct/lp88U46.html?campaignId=4FWFJ&__KE YWORDS__=${keywordText}&__CAMP__=4FWFJ (last visited Apr. 14, 2015). In addition, individuals may subscribe to YouTube channels and podcasts. Subscribe to the Channels You Love, YOUTUBE, https://support.google.com/youtube/answer/4489286?hl=en (last visited Apr. 15, 2015); Discovering Podcasts, APPLE, https://www.apple.com/itunes/podcasts/discover/ (last visited Apr. 15, 2015).14 A “subscriber” has also been defined as “a person who adds his or her details to an electronic newsgroup mailing list, etc., in order to receive, or contribute to, its contents; a person who has signed up to receive messages or other information from a newsgroup, mailing list, etc.” Subscriber Definition, THE OXFORD ENGLISH DICTIONARY (online ed.), http://oed.com/view/Entry/192954?redirectedFrom=Subscriber#eid (last visited Apr. 2, 2015). A common thread can be distilled from these definitions and examples. Subscriptions involve some or all of the following: payment, registration, commitment, delivery, and/or access to restricted content. To download and use the USA Today App, an individual does not have to pay any money; does not have to register; and does not have to make any commitment of any 14 With a YouTube subscription, a person must register and then login to his or her account. Subscribe to the Channels You Love, https://support.google.com/youtube/answer/4489286?hl=en (last visited Apr. 15, 2015). The individual then clicks the “Subscribe” button for a specific channel. Id. Once an individual has subscribed to a YouTube channel, “the channel is added to [her] guide . . . . [W]henever [she] visits [her] homepage, new videos from [her] subscriptions will appear in the My Subscriptions feed.” Id. This means that an individual receives “updates whenever [a channel] upload[s] new videos.” Id. A podcast subscription is similar to a Youtube subscription. When an individual subscribes to a podcast, he or she will “automatically receive any future episodes.” Podcasts are automatically delivered to individuals as they are uploaded. Discovering Podcasts, APPLE, https://www.apple.com/itunes/podcasts/discover/ (last visited Apr. 15, 2015). 19 kind. The complaint does not allege that downloading the App causes individuals to be placed on an e-mail list or permits individuals to access otherwise restricted content. To watch videos on the USA Today App, users simply click on the app and click on the video. The App appears to merely be a more convenient form of visiting the USA Today website.15 Under the circumstances, an individual who downloads and uses the USA Today is not a “subscriber” within the meaning of the VPPA. In common parlance, an individual who watches video on the App is simply known as a “user.” That conclusion is bolstered by the fact that subscriptions do exist for other forms of apps. See, e.g., Subscriptions on Google Play, GOOGLE, https://support.google.com/googleplay/ answer/2476088?hl=en (last visited Apr. 15, 2015); Monetize Apps: Paid Apps vs. In-App Purchases vs. Freemium vs. Subscription, BUILDBLOG BY THINKAPPS, http://thinkapps.com/blog/ post-launch/monetize-apps-paid-apps-vs-app-purchases-vs-freemium-vs-subscription/ (last visited Apr. 15, 2015). According to Google, a “subscription is when you pay a recurring fee rather than a one-time price for content on Google Play. You’ll automatically be charged at the beginning of each subscription term.” Subscriptions on Google Play, supra. In its Buildblog, ThinkApps (which is an on-demand service for designing and building applications for web, mobile and wearables) explains that there are many different models for apps. Monetize Apps, supra. Among those models are paid apps, free apps, and subscription apps. Id. According to this blogpost, “[s]ubscription apps offer users access to a particular service or content for a weekly, monthly, or annual fee.” Id. Thus, because there is a recognized concept of a subscription within the app context—and because users of the USA Today App do not fit within 15 At oral argument, plaintiff appeared to concede that visiting the USA Today website alone would not make an individual a “subscriber” under the VPPA. (Mot. Hearing Tr. 29-30). 20 that concept—individuals who use the USA Today App are not “subscribers” within the VPPA’s definition of “consumer.” Again, however, the weight of authority seems to point in the opposite direction. In Ellis v. Cartoon Network, the court relied on a 2012 decision in the Hulu case to conclude that an app user qualifies as a “subscriber.” 2014 WL 5023535, at *2.16 The Ellis court did not look to the plain meaning of “subscriber,” and appeared to rely on the Hulu court’s analysis as conclusive. Id. In Hulu, the defendant contended that plaintiff could not be a “subscriber” on the ground that the ordinary meaning of the term implied the payment of money. 2012 WL 3282960, at *7-8. The court determined that the plaintiffs in the Hulu case pleaded “more than just visiting Hulu’s website.” Id. at *8. The court concluded that because the term “subscriber” does not necessarily imply the payment of money, the plaintiffs in that case could be considered “subscribers.”17 Again, this Court concludes that Hulu, and the cases that follow its reasoning, are not correctly decided. Here, at least, where there is no payment of money, no registration of information, no periodic delivery, and no privilege to view restricted content, none of the necessary elements of a subscription are present. Plaintiff is therefore not a “subscriber” within the meaning of the VPPA. Accordingly, the complaint fails to state a claim upon which relief can be granted.18 16 The court in Locklear v. Dow Jones & Co., 14-cv-00744-MHC (N.D. Ga. Jan. 23, 2015), relied on both Ellis and Hulu to conclude that an individual who downloaded the WSJ Channel and used it to watch video clips qualified as a “subscriber.” 17 It appears that Hulu involved registered users who received Hulu IDs, established Hulu profiles, and used Hulu’s video streaming services. 2012 WL 3282960 at *7. 18 The Court does not reach the question of whether the complaint alleges an injury in fact. 21 IV. Conclusion For the foregoing reasons, the motion to dismiss is GRANTED. So Ordered. /s/ F. Dennis Saylor F. Dennis Saylor IV United States District Judge Dated: May 15, 2015 22

Some case metadata and case summaries were written with the help of AI, which can produce inaccuracies. You should read the full case before relying on it for legal research purposes.

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.