Opinion
Civil Action 23-cv-10998-RGS
01-11-2024
MICHELE SAUNDERS and RICHARD HAYDEN, on behalf of themselves and all others similarly situated v. HEARST TELEVISION, INC.
MEMORANDUM AND ORDER ON DEFENDANT'S MOTION TO DISMISS THE AMENDED COMPLAINT FOR FAILURE TO STATE A CLAIM
RICHARD G. STEARNS UNITED STATES DISTRICT JUDGE
Hearst Television, Inc., is the owner of several mobile applications on which consumers can access various news stories. Michele Saunders and Richard Hayden filed this putative class action against Hearst, claiming that it disclosed to third parties their personally identifiable information -including a record of every video they viewed on Hearst's apps- in violation of the Video Privacy Protection Act, 18 U.S.C. § 2710 (VPPA). Plaintiffs seek declaratory and injunctive relief, damages, and attorneys' fees and costs. Hearst moves to dismiss plaintiffs' First Amended Complaint (FAC) (Dkt. # 22) for failure to state a claim.The court will deny the motion.
A software application, or “app,” is a “[s]oftware designed to carry out a specific task other than one relating to the operation of the computer itself.” Application Software, Oxford English Dictionary (Sept. 2023 ed.).
Hearst previously moved to dismiss plaintiffs' initial complaint. Because the FAC supersedes the original complaint, that motion is moot. See Kolling v. Am. Power Conversion Corp., 347 F.3d 11, 16 (1st Cir. 2003).
BACKGROUND
Hearst owns various apps on which users can read and watch local and national news, sports, weather, traffic, politics, and entertainment stories. Plaintiffs, who are residents of Massachusetts and New Hampshire, watched videos of weather updates on two local news apps owned by Hearst - the WCVB 5 and WMUR 9 apps - for several years. When Saunders downloaded the WCVB 5 app, she provided her email address and enabled geolocation services and push notifications. Hayden also enabled geolocation services and push notifications when he downloaded the WMUR 9 app, but he did not provide his email address.
Prior to filing this case, plaintiffs' counsel retained a private research company to analyze what, if any, personal data is transmitted by Hearst's apps when a user watches a video. The analysis determined that Hearst integrates two application programming interfaces (APIs) into its apps: the Braze API and the DoubleClick API.At a high level, Hearst shares data about its apps' users with Braze and Google (the owner of the DoubleClick API) through these APIs to improve its marketing and analytics. Specifically, the Braze API assigns users a user ID, a unique and random string of numbers, which allows Hearst to “[t]rack [its] users across devices and platforms, improving the quality of [its] behavioral and demographic data.” Setting User IDs, Braze, https://www.braze.com/docs/developer guide/platformintegrationguides/android/analytics/settinguserids/ (last visited Jan. 11, 2024). The DoubleClick API does not assign user IDs, but Hearst provides Google with a user's advertising ID (AAID), which is a unique and random string of numbers associated with an individual device. Users can reset AAIDs, but plaintiffs claim that “because virtually no one knows about AAIDs, . . . virtually no one resets that identifier.” FAC ¶ 48.
An API allows different apps to “talk” to each other, allowing companies to share application data with third parties. See What is an API?, IBM, https://www.ibm.com/topics/api (last visited Jan. 11, 2024).
Each time a user watches a video on one of Hearst's apps, Hearst discloses to Braze the user's email address and location at the time she watched the video, as well as a unique video ID associated with each video the user watched and data showing that the video was watched. Similarly, in addition to the user's AAID, Hearst discloses to Google a user's geolocation, the title and ID of each video she watched, and data showing that the video was watched. Although plaintiffs concede that they chose to share with Hearst geolocation information and, in Saunders's case, her email address, they allege that they never gave Hearst permission to disclose this information to third parties.
Hearst only discloses a user's email address and geolocation information to Braze and Google if the user has provided this information to Hearst.
DISCUSSION
“To survive a motion to dismiss, [plaintiffs'] complaint ‘must contain sufficient factual matter . . . to state a claim that is plausible on its face.” Saldivar v. Racine, 818 F.3d 14, 18 (1st Cir. 2016), quoting Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (second alteration in original). Under this familiar “make-or-break standard,” a claim has facial plausibility “when the plaintiff pleads sufficient factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Sepulveda-Villarini v. Dep't of Educ. of Puerto Rico, 628 F.3d 25, 29 (1st Cir. 2010). Although the standard is deferential to plaintiffs, “[i]f the facts articulated in the complaint are ‘too meager, vague, or conclusory to remove the possibility of relief from the realm of mere conjecture,' the complaint is vulnerable to a motion to dismiss.” In re Curran, 855 F.3d 19, 25 (1st Cir. 2017), quoting SEC v. Tambone, 597 F.3d 436, 442 (1st Cir. 2010).
The VPPA prohibits a “video tape service provider” from “knowingly disclos[ing], to any person, personally identifiable information concerning any consumer of such provider.” 18 U.S.C. § 2710(b)(1). A video tape service provider is “any person, engaged in the business, in or affecting interstate or foreign commerce, of rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials,” and a consumer is “any renter, purchaser, or subscriber of goods or services from a video tape service provider.” Id. § 2710(a). The statute defines personally identifiable information (PII) as that which “identifies a person as having requested or obtained specific video materials or services from a video tape service provider.” Id. The VPPA creates a private right of action for “[a]ny person aggrieved by an act of a person in violation of” the statute. Id. § 2710(c).
Hearst moves to dismiss on seven grounds. Five grounds are based on the pleadings, claiming that the FAC fails to adequately allege that: (1) Hearst is a “video tape service provider,” (2) plaintiffs are “consumers,” (3) the disclosed information is PII, (4) the transmission was knowing, and (5) plaintiffs suffered actual damages. Hearst also claims that (6) the information was disclosed in the “ordinary course of business” so satisfies an exception to liability under the VPPA, and (7) plaintiffs' reading of the VPPA violates the First Amendment. The court addresses the arguments in turn.
Plaintiffs Allege that Hearst Is a Video Tape Service Provider
Hearst claims that it is not a video tape service provider because the statutory definition of such a provider is limited to “distributors of prerecorded videocassettes or similar media available at that time” Congress pass the VPPA. Mot. to Dismiss the Am. Compl. for Failure to State a Claim (Mot. to Dismiss) (Dkt. # 26) at 9. This is too narrow a reading of the VPPA. Although originally passed in the era of rental video stores, Congress amended the VPPA in 2012 because VHS tapes are “now obsolete Today, so-called ‘on-demand' cable services and Internet streaming services allow consumers to watch movies or TV shows on televisions, laptop computers, and cell phones.” S. Rep. 112-258, at 2. The FAC's allegations that Hearst “host[s] and deliver[s] thousands of videos” to one of every five homes in the United States are sufficient. FAC ¶¶ 10, 14; Ambrose v. Boston Globe Media Partners, 2022 WL 4329373, at *2 (D. Mass. Sept. 19, 2022).
The FAC Plausibly Alleges that Plaintiffs Are Consumers
Plaintiffs allege that they are subscribers of Hearst's apps, which is sufficient to be a “consumer” under the VPPA. See 18 U.S.C. § 2710(a)(1). The First Circuit has adopted a “broader common definition of the term” subscriber in the VPPA under which an individual need not pay a fee to be a subscriber. See Yershov v. Gannett Satellite Info. Network, Inc., 820 F.3d 482, 487-488 (1st Cir. 2016). Instead, a person is a “subscriber” of an app if she provides some consideration to use the app. Id. at 489. In Yershov, the sufficient consideration was Yershov's “Android ID and his mobile device's GPS location at the time he viewed a video, each linked to his viewing selections.” Id.
Hearst repeatedly argues that Yershov “is not binding precedent,” ostensibly because Yershov voluntarily dismissed his case after discovery. See, e.g., Mot. to Dismiss at 19-20; Reply in Further Support of Mot. to Dismiss the Amended Compl. (Reply) (Dkt. # 28) at 1-2 & n.1. This is plainly incorrect. The First Circuit's decisions are of course binding on the court, and the ultimate disposition of Yershov does not alter this fact.
According to the FAC, any time a user views a video on one of Hearst's apps, the full name of the video and/or the video ID is provided to Braze and Google with the user's AAID or user Id. Id. ¶¶ 55-57, 60-64, 66-68. The FAC further alleges that Saunders provided her email address to the WCVB 5 app and that both Saunders and Hayden enabled geolocation services and push notifications. FAC ¶¶ 106, 112. Taken together, the FAC alleges that plaintiffs provided adequate consideration to use Hearst's apps to obtain subscriber status under the VPPA. See Yershov, 820 F.3d at 489.
The FAC Alleges that the Disclosed Information Is PII
The FAC alleges that the geolocation data, which was provided to third parties alongside video IDs and/or video titles, divulged the precise locations of plaintiffs when they viewed videos on Hearst's apps.This information alone “would enable most people to identify what are likely the home and work addresses of the viewer.” Id. at 486; see also In re Nickelodeon Consumer Priv. Litig., 827 F.3d 262, 289 (3d Cir. 2016) (“GPS coordinates contain . . . power to identify a specific person.”); Louth v. NFL Enters. LLC, 2022 WL 4130866 at *3 (D.R.I. Sept. 12, 2022) (a “short string of numbers that links to a particular video name” is sufficient to identify a specific video). The FAC further alleges that if an individual enters the geolocation data into a publicly available website, “the user's precise location is displayed in latitude, longitude, and on Google Maps.” FAC ¶ 39.
Hearst argues that the geolocation data pled in the FAC does not identify plaintiffs because the data “indicates the device(s) that sent GPS signals . . . may have been located in or around 1306 to 1314 Solano Avenue in Albany, California at some point in time,” but Saunders and Hayden reside in Massachusetts and New Hampshire. Mot. to Dismiss at 16 (citation omitted). This is true, but the geolocation data pled in the FAC was from a “tester,” not plaintiffs. See FAC ¶ 16.
Indeed, Hearst determined the likely address of the tester's workplace using the geolocation data pled in the FAC despite plaintiffs not disclosing the actual address. See Mot. to Dismiss at 16.
The allegations that Hearst disclosed plaintiffs' unique user IDs and AAIDs and, in some cases, their email addresses, strengthens their claims. See Lamb v. Forbes Media LLC, 2023 WL 6318033, at *10 (S.D.N.Y. Sept. 28, 2023) (“Courts have uniformly held Facebook IDs to constitute PII under the VPPA, particularly where-as here-the plaintiff alleges that her Facebook ID was disclosed alongside the viewed video's URL and name.”); In re Nickelodeon, 827 F.3d at 289 n.174 (“[E]ven a numeric identifier might qualify as [PII].”). The FAC thus limns a claim that the information disclosed was PII because it was reasonably and foreseeably likely that an ordinary person would be able to both identify the specific videos that plaintiffs watched and know that it was likely plaintiffs who watched them.
The FAC Adequately Pleads Knowledge
Hearst contends that the FAC does not adequately allege that it knowingly transmitted PII because it did not believe that the data it was conveying was PII. Mot. to Dismiss at 24-25. But the FAC is rife with allegations that Hearst knew that it was collecting data from users that identified personalized information about them because, in exchange for the data, Braze and Google provided Hearst with analytics allowing it to provide advertisements tailored to specific users. E.g., FAC ¶¶ 96-105. These allegations adequately plead knowledge. See Yershov, 820 F.3d at 486; Golden v. NBCUniversal Media, LLC, 2023 WL 5434378, at *8 (S.D.N.Y. Aug. 23, 2023); Louth, 2022 WL 4130866, at *3.
Plaintiffs Need Not Plead Actual Damages
The VPPA permits “[a]ny person aggrieved” by a violation of the statute to recover “actual damages but not less than liquidated damages in an amount of $2,500,” punitive damages, attorneys' fees and costs, and other equitable relief. 18 U.S.C. § 2710(c). Hearst reads this provision to require plaintiffs to plead pecuniary loss. Mot. to Dismiss at 26. The court disagrees.
The problem with Hearst's reading of the statute is that the text of the VPPA does not condition recovery on proof of actual damages. In Doe v. Chao, 540 U.S. 614 (2004), on which Hearst relies heavily, Doe argued that the Privacy Act of 1974, 5 U.S.C. § 552a, did not require proof of actual damages. The Privacy Act provides that if the United States violates a provision of the statute, it “shall be liable to the individual in an amount equal to the sum of actual damages sustained by the individual as a result of the [violation], but in no case shall a person entitled to recovery receive less than the sum of $1,000.” 5 U.S.C. § 552a(g)(4). The Court concluded that Doe needed to prove actual damages to prevail on a Privacy Act claim. Chao, 540 U.S. at 620. But in doing so, it noted that if Congress wished to allow recovery of liquidated damages for violations of the Privacy Act absent actual damages, it could have made the statute read “the Government would be liable to the individual for actual damages ‘but in no case . . . less than the sum of $1,000.'” Id. at 623 (alteration in original). That is nearly exactly how the VPPA is styled. See 18 U.S.C. § 2710(c)(2)(A) (“The court may award actual damages but not less than liquidated damages in an amount of $2,500.”).
Nor is the statute's reference to a “person aggrieved” by violation of the statute meant to cabin viable VPPA claims only to plaintiffs who have suffered actual damages. The cases that Hearst cites in support of this argument all interpret statutes other than the VPPA, and each statute contains materially different language than that of the VPPA. The court is comfortable that at this preliminary stage, and absent guidance from the First Circuit on the issue, plaintiffs may proceed without alleging any specific pecuniary loss.
The Ordinary Course of Business Exception Does Not Apply
The VPPA has a narrow exception for disclosures made “incident to the ordinary course of business.” 18 U.S.C. § 2710(b)(2)(E). “[O]rdinary course of business” means “only debt collection activities, order fulfillment, request processing, and the transfer of ownership.” Id. § 2710(a). The alleged uses of the information here - “marketing, advertising, and analytics” - do not fall within the exception's narrow list of permissible uses. FAC ¶ 29; see also Louth, 2022 WL 4130866, at *4 (disclosing PII to “measure analytics and increase advertising revenue” does not fall within ordinary course of business exception).
The Application of the VPPA Alleged in the FAC Is Consonant with the First Amendment
Hearst finally argues that plaintiffs' reading of the VPPA runs “headlong into the First Amendment” because the VPPA is a content- and speaker-based regulation that would not survive intermediate or strict scrutiny as applied to “any communications by publishers to facilitate advertising.” Mot. to Dismiss at 27-29. Plaintiffs counter that Hearst's speech is commercial speech, so the VPPA is subject to intermediate scrutiny.
Commercial speech is “expression related solely to the economic interests of the speaker and its audience.” Pharm. Care Mgmt. Ass'n v. Rowe, 429 F.3d 294, 309 (1st Cir. 2005), quoting El Dia, Inc. v. Puerto Rico Dep't of Consumer Affs., 413 F.3d 110, 115 (1st Cir. 2005). If the commercial speech concerns lawful activity and is not misleading, it may be regulated if the government: (1) “assert[s] a substantial interest in support of its regulation”; (2) “demonstrate[s] that the restriction on commercial speech directly and materially advances that interest”; and (3) the regulation is “narrowly drawn.” Florida Bar v. Went For It, Inc., 515 U.S. 618, 624 (1995), quoting Cent. Hudson Gas & Elec. Corp. v. Pub. Serv. Comm'n of New York, 447 U.S. 557, 564-565 (1980). At bottom, the VPPA must evince a “fit between the legislature's ends and the means chosen to accomplish those ends” that is “not necessarily perfect, but reasonable.” Bd. of Trs. of State Univ. of New York v. Fox, 492 U.S. 469, 481 (1989), quoting Posadas de Puerto Rico Assocs. v. Tourism Co. of Puerto Rico, 478 U.S. 328, 341 (1986).
As plead in the FAC, Hearst's disclosure of PII to third parties is commercial speech. See Sorrell v. IMS Health Inc., 564 U.S. 552, 563-565 (2011) (analyzing restrictions on the “sale, disclosure, and use of prescriber- identifying information” with commercial speech framework); see also Boelter v. Hearst Commc'ns, Inc., 192 F.Supp.3d 427, 445-446 (S.D.N.Y. 2016) (disclosing identities of individuals who purchase products covered by state analog of VPPA is commercial speech). The speech concerns lawful activity and is not misleading, and the court finds that the VPPA satisfies the intermediate scrutiny test.
Even if the disclosures do not strictly satisfy the definition of commercial speech, speech that is “solely in the individual interest of the speaker and its specific business audience” and does not implicate matters of public concern is subject to “many of the same concerns that argue in favor of reduced constitutional protection” for commercial speech. Dun & Bradstreet, Inc. v. Greenmoss Builders, Inc., 472 U.S. 749, 761-762 & n.8 (1985). And the speech here is “solely motivated by the desire for profit,” which “is a force less likely to be deterred than others,” further counseling in favor of the application of intermediate scrutiny. Id. at 762.
First, Congress's interest in enacting the VPPA was to “preserve personal privacy with respect to the rental, purchase or delivery of video tapes or similar audio visual materials.” S. Rep. 100-599 at 1. The Supreme Court has repeatedly recognized the sanctity of personal privacy. E.g., Florida Bar, 515 U.S. at 625; Frisby v. Schultz, 487 U.S. 474, 483-485 (1988). Second, restricting Hearst from disclosing to third parties the precise videos that plaintiffs viewed alongside plaintiffs' PII directly and materially advances that interest. Third, the court can conceive of no legitimate noncommercial First Amendment interest of Hearst that its exploitation of plaintiffs' PII serves. Finally, the VPPA is narrowly drawn because it applies only to a narrow group of business entities and specific group of consumers. The court is satisfied that the “fit” between Congress's goal of protecting privacy in this realm and its means to do so is at least reasonable. See Bd. of Trs. of State Univ. of New York, 492 U.S. at 481.
This conclusion is bolstered by the fact that the court is aware of no cases in any circuit - and Hearst cites none - holding that the VPPA violates the First Amendment. Hearst's reliance on Stark v. Patreon, Inc., 656 F.Supp.3d 1018 (N.D. Cal. 2023), to argue otherwise is unavailing. In Stark, the Northern District of California concluded that the VPPA might regulate both commercial and non-commercial speech and thus was subject to facial overbreadth review. Id. at 1034-1036. But it declined to engage in such review at the motion-to-dismiss stage because overbreadth analysis “depends not only on statutory text but also on ‘actual fact.'” Id. at 1037, quoting New York State Club Ass'n v. City of New York, 487 U.S. 1, 14 (1988). The court declines to raise a sua sponte facial challenge to the statute at this stage.
ORDER
For the foregoing reasons, Hearst's motion to dismiss the FAC is DENIED.
SO ORDERED.