Summary
noting that courts have found that "consumers alleging that a video tape service provider knowingly disclosed their [personally identifiable information] to a third party without their consent have satisfied the concreteness requirement for Article III standing," as the VPPA "elevated an otherwise non-actionable invasion of privacy into a concrete, legally cognizable injury"
Summary of this case from Adams v. Am's Test Kitchen, L.P.Opinion
Civil Action No. 14-13112-FDS
09-02-2016
Alexander YERSHOV, individually and on behalf of all others similarly situated, Plaintiff, v. GANNET SATELLITE INFORMATION NETWORK, INC., dba USA Today, Defendant.
J. Aaron Lawson, Benjamin H. Richman, J. Dominick Larry, Edelson PC, Chicago, IL, Erica C. Mirabella, Boston, MA, for Plaintiff. Heather B. Repicky, Nutter, McClennen & Fish, LLP, Boston, MA, Jacob A. Sommer, Zwillinger Genetski LLP, Jeffrey G. Landis, Marc J. Zwillinger, Zwillgen PLLC, Washington, DC, for Defendant.
J. Aaron Lawson, Benjamin H. Richman, J. Dominick Larry, Edelson PC, Chicago, IL, Erica C. Mirabella, Boston, MA, for Plaintiff.
Heather B. Repicky, Nutter, McClennen & Fish, LLP, Boston, MA, Jacob A. Sommer, Zwillinger Genetski LLP, Jeffrey G. Landis, Marc J. Zwillinger, Zwillgen PLLC, Washington, DC, for Defendant.
MEMORANDUM AND ORDER ON DEFENDANT'S MOTION TO DISMISS
Saylor, District Judge
This is a putative class action arising under the Video Privacy Protection Act ("VPPA"), 18 U.S.C. § 2710. The VPPA, among other things, prohibits "video tape service providers" from knowingly disclosing, to any person, the "personally identifiable information" of certain consumers of video services.
Plaintiff Alexander Yershov has filed suit against defendant Gannett Satellite Information Network, Inc. Gannett publishes a print and online newspaper called USA Today. Gannett has also created a mobile app, called the "USA Today App," that is designed to run on smartphones and other mobile devices, and that permits App users to view the online version of the newspaper. The App also allows users access to short videos on various news, sports, and entertainment topics. The complaint alleges that Gannett discloses a user's "personally identifiable information" ("PII") every time he uses the App to watch video clips. Specifically, the complaint alleges that every time Yershov watches a video through the App, Gannett provides, among other things, the unique identification number of his smartphone to Adobe Systems, Inc., a third-party data-analytics company. It alleges that by doing so, Gannett violates Yershov's "statutorily defined rights to privacy" under the VPPA. (Compl. ¶ 62).
Gannett has moved to dismiss the complaint for lack of subject-matter jurisdiction pursuant to Fed. R. Civ. P. 12(b)(1). It contends that the complaint alleges a "bare procedural violation" of the VPPA, which is insufficient to establish Article III standing to bring suit. See Spokeo, Inc. v. Robins, ––– U.S. ––––, 136 S.Ct. 1540, 1549, 194 L.Ed.2d 635 (2016). In essence, Gannett contends that the complaint does not allege a concrete injury in fact.
Accepting the complaint's allegations as true and drawing all reasonable inferences on behalf of Yershov, it appears that he has suffered a concrete, albeit "intangible," injury in fact that is sufficient to establish standing. See id. Accordingly, and for the reasons set forth below, Gannett's motion to dismiss will be denied.
I. Background
A. Factual Background
The following facts relevant to standing are stated as alleged in the complaint. The factual background is more completely set forth in the previous orders of the First Circuit and this Court. See Yershov v. Gannett Satellite Info. Network, Inc. , 104 F.Supp.3d 135, 137–38 (D.Mass.2015), rev 'd 820 F.3d 482, 484–85 (1st Cir.2016).
1. The USA Today App
Gannett is a media company that produces news and entertainment content. (Compl. ¶ 1). It distributes that content to consumers through a variety of media, including its flagship newspaper, USA Today. (Id.). In addition to the print edition of USA Today , Gannett offers content through websites and mobile-software applications. (Id. ). One of Gannett's mobile applications is the USA Today App. (Id. ¶ 2).
The USA Today App is a mobile-software application that allows individuals to access news and entertainment media content. (Id. ¶ 9). It is available for installation on Android mobile devices, among others, through the Google Play Store, the online-media platform operated by Google. (Id. ¶¶ 9-10). Before a user can use the App for the first time, it requests the user's permission to "push" (that is, display) notifications to his device. (Id. ¶ 10). The App does not otherwise seek a user's consent to disclose personal information to third parties for any purpose. (Id. ¶ 11). Once installed, the App allows users to view articles and video clips that are organized into sections, such as news and sports. (Id. ¶ 12).
The App is free; there is no charge to install it or to view video clips after installation. (See Compl. ¶¶ 9-11 (citing USA Today , GOOGLE PLAY , https://play.google.com/store/apps/details?id=com.usatoday.android.news&=en (last visited September 1, 2016))). Nor is there a registration requirement (such as a requirement that the user provide a name and e-mail contact). (See id.). After responding to the App's request for permission to "push" notifications, the user is not required to provide any other information in order to use the App. (See id.).
2. Alleged Transmittal of PII from Gannett to Adobe
The complaint alleges that each time users view video clips on the App, Gannett sends a record of the transaction to Adobe, an unrelated company. (Id. ¶ 13). Along with the transaction record, the App sends to Adobe a user's GPS coordinates and the Android device's unique identification number (the "Android ID"). (Id.). The Android ID is a "64-bit number (as a hex string) that is randomly generated when the user first sets up the device and should remain constant for the lifetime of the user's device." (Id. ¶ 13 n.3). Android IDs are unique to specific devices and users. (Id. ¶ 16). It is not precisely clear what the "record of the transaction" includes, but it appears from the complaint that it includes an identification of the video watched by the user. (See id. ¶¶ 42, 54, 57).
Adobe performs data analytics, which it sells to its own customers. (Id. ¶ 13). According to the complaint, Adobe "collects an enormous amount of detailed information about a given consumer's online behavior (as well as unique identifiers associated with a user's devices) from a variety of sources." (Id. ¶ 20). "Once Adobe links a device's Android ID with its owner, it can then connect new information retrieved from Android apps—including the USA Today App—with existing data in the person's profile (which was previously collected by Adobe from other sources)." (Id. ¶ 22). Therefore, when Adobe receives an individual's Android ID and the record of the video transaction from USA Today App, it is able to connect that information with information collected from other sources "to personally identify users and associate their video viewing selections with a personalized profile in its databases." (Id. ¶ 29).
According to the complaint, plaintiff Alexander Yershov downloaded and began using the USA Today App on his Android device in late 2013. (Id. ¶ 39). He never consented to allowing USA Today to disclose his PII to third parties. (Id. ¶¶ 40, 60). However, it alleges that "each time Yershov viewed a video clip using the [App], USA Today disclosed his PII—in the form of the title of the videos he had watched, his unique Android ID, and his GPS coordinates—to third-party analytics company Adobe." (Id. ¶ 42). "Using this information, Adobe was able to identify Yershov and attribute his video records to an individualized profile of [him] in its databases." (Id.).
The complaint alleges that "the combination of his device's unique Android ID and the records of videos that [Yershov] viewed... constitutes ‘personally identifiable information’ ... because it allows Adobe to identify users such as Yershov, and to attribute their video-viewing records to their Adobe-created profiles." (Id. ¶ 57).
The complaint alleges that "[a]s a result of defendant's unlawful disclosures, plaintiff and the class have had their statutorily defined rights to privacy violated." (Id. ¶ 62). Yershov "seeks an injunction to prohibit USA Today from releasing his and the class's PII in the future, as well as the maximum statutory and punitive damages available under the VPPA [in] 18 U.S.C § 2710(c)." (Id).
B. Statutory Background
The VPPA, in relevant part, provides as follows: "A video tape service provider who knowingly discloses, to any person, personally identifiable information concerning any consumer of such provider shall be liable to the aggrieved person for the relief provided in [subsection (c) ]." 18 U.S.C. § 2710(b)(1). Subsection (c) of the statute, in relevant part, reads as follows:
The VPPA defines "consumer" as "any renter, purchaser, or subscriber of goods or services from a video tape service provider." Id. § 2710(a)(1). It defines "personally identifiable information" to "include [ ] information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider." Id. § 2710(a)(3).
(1) Any person aggrieved by any act of a person in violation of this section may bring a civil action in a United States district court.
(2) The court may award—
(A) actual damages but not less than liquidated damages in an amount of $2,500;
(B) punitive damages;
(C) reasonable attorneys' fees and other litigation costs reasonably incurred; and
(D) such other preliminary and equitable relief as the court determines to be appropriate.
The statute, however, provides several exceptions to the disclosure prohibition, including when the consumer has provided written consent, when the party seeking disclosure has obtained a warrant or court order, or when the disclosure is incident to the video tape service provider's ordinary course of business. Id. § 2710(b)(2).
Congress enacted the VPPA "in response to a profile of then-Supreme Court nominee Judge Robert H. Bork that was published by a Washington D.C., newspaper during his confirmation hearings." Yershov , 820 F.3d at 485 (citing S. Rep. No. 100-599, at 5 (1988), reprinted in 1988 U.S.C.C.A.N. 4342-1). The profile contained a list of all films that Judge Bork and his family had rented from a video store. Id. Members of Congress "denounced the disclosure as repugnant to the right of privacy," id. and passed the VPPA "[t]o preserve personal privacy with respect to the rental, purchase[,] or delivery of video tapes or similar audio visual materials." S. Rep. No. 100-599, at 1.
C. Procedural Background
Yershov filed a single-count complaint on July 24, 2014, alleging a violation of the VPPA, 18 U.S.C. § 2710. The complaint is a putative class action; the class is defined as "[a]ll persons in the United States who used the USA Today App to watch videos and had their PII transmitted to Adobe." (Compl. ¶ 43).
On September 19, 2014, Gannett moved to dismiss the complaint for failure to state a claim upon which relief can be granted pursuant to Fed. R. Civ. P. 12(b)(6), and for lack of subject-matter jurisdiction pursuant to Fed. R. Civ. P. 12(b)(1). The Court granted Gannett's motion to dismiss for failure to state a claim. The Court concluded that the information Gannett allegedly disclosed to Adobe was PII under the VPPA. Yershov , 104 F.Supp.3d at 142. However, the Court held that Yershov's download and use of the free App were insufficient to make him a "subscriber" under the VPPA. Id. at 147–48. The Court granted Gannett's motion without addressing the Rule 12(b)(1) issue. See id. at 148 n. 18.
On appeal, the First Circuit agreed that the complaint sufficiently alleged that Gannett had disclosed Yershov's PII, as defined by the VPPA. Yershov , 820 F.3d at 486. However, the panel reversed this Court's decision, concluding that Yershov was a "subscriber" under the VPPA. Id. at 487–90. In its decision, the panel did not address whether Yershov had Article III standing, and it remanded to this Court for further proceedings.
On remand, Gannett has again moved to dismiss the complaint for lack of subject-matter jurisdiction. It contends that the complaint fails to allege that Yershov has suffered a concrete injury in fact necessary to establish standing.
II. Legal Standard
On a motion to dismiss, the Court "must assume the truth of all well-plead[ed] facts and give ... plaintiff the benefit of all reasonable inferences therefrom." Ruiz v. Bally Total Fitness Holding Corp. , 496 F.3d 1, 5 (1st Cir.2007) (citing Rogan v. Menino , 175 F.3d 75, 77 (1st Cir.1999) ). To survive a motion to dismiss, the complaint must state a claim that is plausible on its face. Bell At l antic Corp. v. Twombly , 550 U.S. 544, 570, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007). That is, "[f]actual allegations must be enough to raise a right to relief above the speculative level,... on the assumption that all the allegations in the complaint are true (even if doubtful in fact)." Id. at 555, 127 S.Ct. 1955 (citations omitted). "The plausibility standard is not akin to a ‘probability requirement,’ but it asks for more than a sheer possibility that a defendant has acted unlawfully." Ashcroft v. Iqbal , 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009) (quoting Twombly , 550 U.S. at 556, 127 S.Ct. 1955 ). Dismissal is appropriate if the complaint fails to set forth "factual allegations, either direct or inferential, respecting each material element necessary to sustain recovery under some actionable legal theory." Gagliardi v. Sullivan , 513 F.3d 301, 305 (1st Cir.2008) (quoting Centro Medico del Turabo, Inc. v. Feliciano de Melecio , 406 F.3d 1, 6 (1st Cir.2005) ).
"Although review of a Rule 12(b)(6) [motion] for failure to state a claim and review to ensure the existence of standing are conceptually distinct, the same basic principles apply in both situations." Hochendoner v. Genzyme Corp. , 823 F.3d 724, 730 (1st Cir.2016). A court "must take the complaint's well-pleaded facts as true and indulge all reasonable inferences in the pleader's favor." Id. Moreover, "[j]ust as the plaintiff bears the burden of plausibly alleging a viable cause of action, so too the plaintiff bears the burden of pleading facts necessary to demonstrate standing." Id. (citations omitted). The plausibility standard that is applied to motions to dismiss under Rule 12(b)(6) also applies to motions to dismiss for lack of standing under Rule 12(b)(1). See id. at 731 ("[A]t the pleading stage, the plaintiff bears the burden of establishing sufficient factual matter to plausibly demonstrate his standing to bring the action ... [and] [n]either conclusory assertions nor unfounded speculation can supply the necessary heft.").
III. Analysis
The Constitution "endows the federal courts with ‘the judicial Power of the United States.’ " Spokeo , 136 S.Ct. at 1547 (quoting U.S. Const. art. III, § 1 ). That power extends only to "Cases" and "Controversies," U.S. Const. art. III, § 2, and "[n]o principle is more fundamental to the judiciary's proper role in our system of government than the constitutional limitation of federal-court jurisdiction to actual cases or controversies." Raines v. Byrd , 521 U.S. 811, 818, 117 S.Ct. 2312, 138 L.Ed.2d 849 (1997). "Standing to sue is a doctrine rooted in the traditional understanding of a case or controversy." Spokeo , 136 S.Ct. at 1547. The standing doctrine "serves to prevent the judicial process from being used to usurp the powers of the political branches." Clapper v. Amnesty Int'l USA, 568 U.S. ––––, 133 S.Ct. 1138, 1146, 185 L.Ed.2d 264 (2013). "If a party lacks standing to bring a matter before the court [at any time during the litigation], the court lacks jurisdiction to decide the merits," and the case must be dismissed. United States v. AVX Corp. , 962 F.2d 108, 113 (1st Cir.1992).
To satisfy the "irreducible constitutional minimum" of Article III standing, Lujan v. Defenders of Wildlife , 504 U.S. 555, 560, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992), Yershov as the plaintiff bears the burden of establishing that he has "(1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision." Spokeo , 136 S.Ct. at 1547. The injury-in-fact requirement is the only one of the three standing elements contested by Gannett.
The injury-in-fact element of standing is constitutional in nature, and "[i]t is settled that Congress cannot erase Article III's standing requirements by statutorily granting the right to sue to a plaintiff who would not otherwise have standing." Raines , 521 U.S. at 820 n. 3, 117 S.Ct. 2312 ; accord Spokeo , 136 S.Ct. at 1547–48. "To establish injury in fact, a plaintiff must show that he or she suffered ‘an invasion of a legally protected interest’ that is ‘concrete and particularized’ and ‘actual or imminent, not conjectural or hypothetical.’ " Spokeo , 136 S.Ct. at 1548 (quoting Lujan , 504 U.S. at 560, 112 S.Ct. 2130 ).
Gannett raises two principal arguments in its motion to dismiss. First, it contends that the complaint fails to allege a "concrete" injury in fact because it relies on a bare procedural violation of the VPPA. Furthermore, it contends that even if the complaint alleges an injury that is concrete, Yershov's standing depends on the implausible assumption that Adobe has a "profile" on him.
A. Concrete Injury in Fact
Gannett contends that the complaint fails to allege a concrete injury in fact. According to Gannett, the complaint alleges a bare procedural violation of the VPPA, and it fails to connect such a violation to a concrete injury actually suffered by Yershov.
In Spokeo , the plaintiff alleged that Spokeo.com , a "people search engine," had violated the Fair Credit Reporting Act ("FCRA") by disseminating inaccurate information about his financial and educational status, among other personal details. Id. at 1545–46. The District Court dismissed the complaint for lack of standing. Id. On appeal, the Ninth Circuit reversed, holding that the plaintiffs alleged violations of his statutory rights were sufficiently particularized to satisfy the injury-in-fact requirement of Article III. Id. The Supreme Court then vacated that decision, holding that the Ninth Circuit's analysis "overlooked" the requirement that an injury must be both concrete and particularized. Id. at 1545.
The Spokeo Court began by emphasizing that an injury in fact must be both concrete and particularized, and that the two inquiries are distinct. Id. at 1548 ("We have made it clear time and time again that an injury in fact must be both concrete and particularized."). "For an injury to be ‘particularized,’ it ‘must affect the plaintiff in a personal and individual way.’ " Id. (quoting Lujan , 504 U.S. at 560 n. 1, 112 S.Ct. 2130 ). However, while particularization is necessary to establish an injury in fact, it is not sufficient; an injury must also be concrete. Id. To be concrete, an injury "must be ‘de facto’; that is, it must actually exist." Id. (citations omitted). In other words, a concrete injury is one that is " ‘real’ and not ‘abstract.’ " Id. " ‘Concrete’ is not, however, necessarily synonymous with ‘tangible.’ " Id. at 1549. The Court explained that, "[a]lthough tangible injuries are perhaps easier to recognize, we have confirmed in many of our previous cases that intangible injuries can nevertheless be concrete." Id. (citing cases involving free speech and free exercise challenges under the First Amendment).
The Spokeo Court provided lower courts with two important considerations when evaluating whether an intangible harm constitutes a concrete injury in fact: "history and the judgment of Congress." Id. Concerning the "history" consideration, the Court explained:
Because the doctrine of standing derives from the case-or-controversy requirement, and because that requirement in turn is grounded in historical practice, it is instructive to consider whether an alleged intangible harm has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts.
Id. As to the "judgment of Congress" consideration, the Court explained:
In addition, because Congress is well positioned to identify intangible harms that meet minimum Article III requirements, its judgment is also instructive
and important. Thus, we said in Lujan that Congress may "elevat[e] to the status of legally cognizable injuries concrete, de facto injuries that were previously inadequate in law." 504 U.S. at 578, 112 S.Ct. 2130. Similarly, Justice Kennedy's concurrence in that case explained that "Congress has the power to define injuries and articulate chains of causation that will give rise to a case or controversy where none existed before." Id. at 580, 112 S.Ct. 2130 (opinion concurring in part and concurring in judgment).
Id.
Although the Court noted that the judgment of Congress was important, it nevertheless cautioned that "Congress's role in identifying and elevating intangible harms does not mean that a plaintiff automatically satisfies the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right." Id. It explained that "Article III standing requires a concrete injury even in the context of a statutory violation," and "[f]or that reason, [plaintiff] could not, for example, allege a bare procedural violation , divorced from any concrete harm, and satisfy the injury-in-fact requirement of Article III." Id. (emphasis added); accord Summers v. Earth Island Inst. , 555 U.S. 488, 496, 129 S.Ct. 1142, 173 L.Ed.2d 1 (2009) ("[D]eprivation of a procedural right without some concrete interest that is affected by the deprivation ... is insufficient to create Article III standing"). However, the Court provided somewhat of a caveat to that "bare procedural violation" rule:
This does not mean, however, that the risk of real harm cannot satisfy the requirement of concreteness. See, e.g., Clapper v. Amnesty Int'l USA , 133 S.Ct. 1138, 185 L.Ed.2d 264 (2013). For example, the law has long permitted recovery by certain tort victims even if their harms may be difficult to prove or measure. See, e.g. , Restatement (First) of Torts §§ 569 (libel), 570 (slander per se ) (1938). Just as the common law permitted suit in such instances, the violation of a procedural right granted by statute can be sufficient in some circumstances to constitute injury in fact. In other words, a plaintiff in such a case need not allege any additional harm beyond the one Congress has identified. See Federal Election Comm'n v. Akins , 524 U.S. 11, 20–25, 118 S.Ct. 1777, 141 L.Ed.2d 10 (1998) (confirming that a group of voters' "inability to obtain information" that Congress had decided to make public is a sufficient injury in fact to satisfy Article III); Public Citizen v. Department of Justice , 491 U.S. 440, 449, 109 S.Ct. 2558, 105 L.Ed.2d 377 (1989) (holding that two advocacy organizations' failure to obtain information subject to disclosure under the Federal Advisory Committee Act "constitutes a sufficiently distinct injury to provide standing to sue").
Spokeo , 136 S.Ct. at 1549–50.
Applying those rules to the plaintiffs FCRA claim in Spokeo , the Court observed that "[o]n the one hand, Congress plainly sought to curb the dissemination of false information by adopting procedures designed to decrease that risk," but "[o]n the other hand, [plaintiff] cannot satisfy the demands of Article III by alleging a bare procedural violation." Id. at 1550. Before remanding to the Ninth Circuit, the Court provided two examples where "[a] violation of one of the FCRA's procedural requirements may result in no harm." Id. First, where "even if a consumer reporting agency fails to provide the required notice to a user of the agency's consumer information, that information regardless may be entirely accurate." Id. Second, it noted that "not all inaccuracies cause harm or present any material risk of harm.... [For example,] [i]t is difficult to imagine how the dissemination of an incorrect zip code, without more, could work any concrete harm." Id.
Here, Gannett contends that the complaint must be dismissed because it fails to allege anything more than a "bare procedural violation" of the VPPA. As an initial matter, however, the only two circuit courts that have addressed the issue of standing under the VPPA—as well as every district court—have reached the opposite conclusion. In each case, consumers alleging that a video tape service provider knowingly disclosed their PII to a third party without their consent have satisfied the concreteness requirement for Article III standing. See In re Nickelodeon Consumer Privacy Litig., 827 F.3d 262, 272–75, 2016 WL 3513782, at *6–8 (3d Cir.2016) (discussing Spokeo in context of VPPA claims by class of children against website that disclosed their video-viewing history to Google, and concluding "[w]hile perhaps ‘intangible,’ the harm is also concrete in the sense that it involves a clear de facto injury, i.e. , the unlawful disclosure of legally protected information"); Sterk v. Redbox Automated Retail, LLC , 770 F.3d 618, 624 (7th Cir.2014) (stating that "there is no doubt that plaintiffs have alleged a [concrete] invasion of a legally protected interest" because self-service video-rental kiosk disclosed PII to an outside customer-service company) (internal quotation marks omitted); Austin – Spearman v. AMC Network Entm't LLC , 98 F.Supp.3d 662, 666 (S.D.N.Y.2015) ("Notably, every court to have addressed this question has reached the same conclusion, affirming that the VPPA establishes a privacy right sufficient to confer standing through its deprivation.").
See also In re Hulu Privacy litig., 2013 WL 6773794, at *5 (N.D.Cal. Dec. 20, 2013) (holding that "the VPPA requires only injury in the form of a wrongful disclosure" because " [t]he consumer ... is ‘aggrieved’ based solely on the disclosure of [PII] to third parties," which "demonstrates an injury-in-fact for Article III standing purposes"); Ellis v. Cartoon Network, Inc., 2014 WL 5023535, at *2 (N.D.Ga. Oct. 8, 2014).
The Court agrees with the analysis of those courts, and therefore concludes that Yershov has alleged a concrete injury in fact. Even before Spokeo , it was clear "that Congress cannot erase Article III's standing requirements by statutorily granting the right to sue to a plaintiff who would not otherwise have standing." Raines , 521 U.S. at 820 n. 3, 117 S.Ct. 2312 ; accord Spokeo , 136 S.Ct. at 1547–48. Nonetheless, that does not contradict the well-established principle that "the injury required by Art[icle] III may exist solely by virtue of statutes creating legal rights, the invasion of which creates standing." Lujan , 504 U.S. at 578, 112 S.Ct. 2130 (internal quotation marks and alterations omitted); accord Spokeo , 136 S.Ct. at 1549 ("Thus, we said in Lujan that Congress may ‘elevat[e] to the status of legally cognizable injuries concrete, de facto injuries that were previously inadequate in law.’ " (quoting Lujan , 504 U.S. at 578, 112 S.Ct. 2130 )).
Here, the complaint alleges an intangible harm: the invasion of Yershov's privacy interest in his video-viewing history. To determine whether that alleged intangible harm "constitutes [a concrete] injury in fact, both history and the judgment of Congress play important roles." Spokeo , 136 S.Ct. at 1549.
Beginning with the latter, Congress, by enacting the VPPA, elevated an otherwise non-actionable invasion of privacy into a concrete, legally cognizable injury. See id. ; Lujan , 504 U.S. at 578, 112 S.Ct. 2130. In Congress's "judgment," the VPPA was necessary " ‘to preserve personal privacy with respect to the rental, purchase[,] or delivery of video tapes or similar audio visual materials.’ " Yershov , 820 F.3d at 485 (quoting S. Rep. No. 100-599, at 1) ; see also In re Nickelodeon , 827 F.3d at 274, 2016 WL 3513782, at *7 ("Congress has long provided plaintiffs with the right to seek redress for unauthorized disclosures of information that, in Congress's judgment , ought to remain private.") (emphasis added); Sterk , 770 F.3d at 623 (noting that Congress may not "lower the threshold for standing below" the constitutional minimum, but that it "does have the power to enact statutes creating legal rights, the invasion of which creates standing, even though no injury would exist without the statute") (internal quotation marks omitted). In other words, and as several courts have concluded, Congress enacted the VPPA to "create[ ] a right to the privacy of one's video-watching history, the deprivation of which—through wrongful disclosure ... constitutes an injury sufficient to confer Article III standing." See, e.g., Austin – Spearman , 98 F.Supp.3d at 666.
Furthermore, an individual's right to privacy, both as to certain personal information and private locations, has long "been regarded as providing a basis for a lawsuit in English or American courts." Spokeo , 136 S.Ct. at 1549. "Both the common law and the literal understandings of privacy encompass the individual's control of information concerning his or her person." United States Dep't of Justice v. Reporters Comm. for Freedom of Press , 489 U.S. 749, 763, 109 S.Ct. 1468, 103 L.Ed.2d 774 (1989) ; see Thomas v. FTS USA, LLC , 2016 WL 3653878, at *10 (E.D.Va. June 30, 2016) (concluding that in the wake of Spokeo , plaintiff alleging a FCRA violation had demonstrated concrete injury in fact because statutorily authorized right to privacy in personal information had close ties with privacy rights at common law). Moreover, "the right to privacy in compilations of personal information is particularly powerful because the ‘power of compilations to affect personal privacy ... outstrips the combined power of the bits of information contained within.’ " Thomas , 2016 WL 3653878, at *10 (quoting Reporters Comm. , 489 U.S. at 765, 109 S.Ct. 1468 ). Thus, "it is well-settled that Congress may create a statutory right to privacy in certain information that strengthens or replaces the common law, and citizens whose statutory right to informational privacy has been invaded [have standing to] bring suit under the statute to vindicate that right." Id. (citing as examples the Electronic Communications Privacy Act, the Right to Financial Privacy Act, and the VPPA).
In sum, the VPPA "plainly" provides plaintiffs like Yershov, who allege wrongful disclosure of their PII, with standing and a right to relief. See, e.g., Austin – Spearman , 98 F.Supp.3d at 666 ; See also In re Nickelodeon , 827 F.3d at 274, 2016 WL 3513782, at *7 ("None of the[ ] pronouncements [in Spokeo ] call[ ] into question whether [plaintiffs alleging wrongful disclosure under the VPPA] have Article III standing."). The intangible harm allegedly suffered by Yershov from Gannett's alleged disclosure of his PII is a concrete injury in fact. B. Plausibility of Adobe's "Profile" on Yershov
Gannett raises two principal counterarguments, neither of which is persuasive. First, it contends that Yershov has alleged a "bare procedural violation" of the VPPA that is insufficient to confer standing under Spokeo. That argument has been raised by defendants in other VPPA cases and consistently rejected by courts. As the Seventh Circuit explained in Sterk:
[Defendant] characterizes plaintiffs' claim as an allegation that [defendant] committed a "mere technical violation" of the statute, which [defendant] argues is insufficient to establish standing. But "technical" violations of the [VPPA] (i.e., impermissible disclosures of one's sensitive, personal information) are precisely what Congress sought to illegalize by enacting the VPPA.
770 F.3d at 623 (emphasis added); accord Austin – Spearman, 98 F.Supp.3d at 667 ; see also Thomas, 2016 WL 3653878, at *11 (explaining that the informational privacy "rights created by [FCRA] are substantive rights, and the breach of the statute is not a ‘bare procedural violation’ of a technical requirement"). Gannett's alleged disclosure of information to Adobe is not a mere procedural violation akin to the "dissemination of an incorrect zip code" under FCRA. See Spokeo, 136 S.Ct. at 1550. Rather, accepting the complaint's allegations as true, it is the precise type of disclosure for which the VPPA created a substantive right to prevent and remedy.
Second, Gannett contends that the complaint does not allege any "material risk of harm." (Def. Mem. 14-16) (quoting Spokeo, 136 S.Ct. at 1550 ). That argument, however, appears to misconstrue the complaint's allegations. The complaint does not allege that Yershov faces only a future risk of harm, such as exposure of his information to hackers. Rather, it alleges that Yershov has already suffered an injury defined by the VPPA—the non-consensual disclosure of his PII to Adobe.
--------
Furthermore, even if Yershov's alleged injury is concrete, Gannett contends that he does not have standing because the complaint does not plausibly allege that Adobe has a "profile" on him. It explains,
Yershov lacks standing for the independent reason that he does not allege facts supporting the notion that Adobe had a "profile" on him such that it could use that profile to identify him as having watched specific videos on the [App].... [E]ven if [Yershov did allege a concrete injury], based on his complaint, any such injury (or risk of future injury) would necessarily depend on Adobe having a detailed profile on him.... [T]he notion that Adobe had a profile on [Yershov] is based on pure speculation of the kind not entitled to any weight.
(Def Mem. 16) (emphasis added). There are two significant problems with that argument, each of which has been previously addressed in the earlier orders of the First Circuit and this Court.
First, even if Gannett is correct that Yershov's standing depends on Adobe's having a profile on him, the First Circuit has already concluded that it was plausible that Adobe had sufficient information about Yershov—whether it was in a profile or otherwise—from which it could identify which videos he viewed.
According to the complaint, when Gannett makes such a disclosure to Adobe, it knows that Adobe has the "game program," so to speak, allowing it to link the GPS address and device identifier information to a certain person by name, address, phone number, and more. While there is certainly a point at which the linkage of information to identify becomes too uncertain, or too dependent on too much yet-to-be-done, or unforeseeable detective work, here the linkage, as plausibly alleged , is both firm and readily foreseeable to Gannett. The complaint therefore adequately alleges that Gannett disclosed information reasonably and foreseeably likely to reveal which USA Today videos Yershov has obtained.
Yershov , 820 F.3d at 486 (emphasis added).
The more fundamental flaw in Gannett's argument is its unsupported assumption that Yershov's standing "necessarily depend[s] on Adobe having a detailed profile on [him]." To state a claim under the VPPA, a consumer needs to allege only that a video tape service provider disclosed his personally identifiable information to a third party without his consent. 18 U.S.C. § 2710(b)(1). " ‘Personally identifiable information’ includes information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider." Id. § 2710(a)(3). Accordingly, to establish standing, Yershov does not need to plausibly allege that Adobe has a "profile" on him; that word does not even appear in the statute. Rather, he must plausibly allege that Gannett disclosed information to Adobe "which identifies [Yershov] as having requested or obtained specific video materials ...." Id. Both this Court and the First Circuit have explained that it is at least a plausible allegation that Adobe could identify Yershov by using only the information disclosed by Gannett (Android ID, GPS coordinates, video history), perhaps in combination with other easily obtainable, publicly available information. No proprietary "profile" or "game program" is necessary.
As explained by this Court in concluding that the complaint plausibly alleged that Gannett disclosed Yershov's PII:
[I]t is unrealistic to refer to PII as "information which must, without more, itself link an actual person to actual video materials." [That] would appear to preclude a finding that home addresses, social security numbers, and dates of birth are PII. Moreover, drawing a link between the Android ID and a person's name may not be difficult. If, as alleged, Adobe collects information from the USA Today App linking an Android ID and GPS information with a specific video, and collects information from another source (such as GPS information linked to residential addresses, and residential addresses linked to names)—it would be relatively easy for Adobe to link that information to identify a person. It is also possible, of course, that third parties such as Adobe have access to databases that link Android IDs to specific persons.
Yershov , 104 F.Supp.3d at 146. Furthermore, as the First Circuit explained:
Here, the complaint and its reasonable inferences describe what for very many people is a similar type of identification, effectively revealing the name of the video viewer. To use a specific example, imagine Gannett had disclosed that a person viewed 146 videos on a single device at 2 sets of specified GPS coordinates. Given how easy it is to locate a GPS coordinate on a street map, this disclosure would enable most people to identify what are likely the home and work addresses of the viewer (e.g. , Judge Bork's home and the federal courthouse).
Yershov , 820 F.3d at 486.
Yershov has plausibly alleged that Gannett disclosed information "which identifies [him] has having requested or obtained specific video materials ..." 18 U.S.C. § 2710(a)(3). If, as alleged, Gannett disclosed Yershov's videos, GPS coordinates at the times he viewed videos, and Android ID, it is certainly plausible that any person with those three pieces of information, a search engine, and some spare time could identify Yershov. In any event, the First Circuit has already concluded that the "linkage" between Yershov and the information that Gannett disclosed to Adobe "as plausibly alleged, is both firm and readily foreseeable." Yershov , 820 F.3d at 486.
IV. Conclusion
For the foregoing reasons, Gannett's motion to dismiss for lack of subject-matter jurisdiction is DENIED.