Robinson v. Disney Online

• Court: U.S. District Court — Southern District of New York
• Writing for the Court: RONNIE ABRAMS, District Judge
• Citation: Robinson v. Disney Online, 152 F. Supp. 3d 176 (S.D. N.Y. 2015)
• Decision Date: 20 October 2015
• Docket Number: No. 14–CV–4146 (RA).,14–CV–4146 (RA).
• Parties: James ROBINSON, individually and on behalf of others similarly situated, Plaintiff. v. DISNEY ONLINE d/b/a Disney Interactive, Defendant.

152 F.Supp.3d 176

James ROBINSON, individually and on behalf of others similarly situated, Plaintiff.

v.DISNEY ONLINE d/b/a Disney Interactive, Defendant.

No. 14–CV–4146 (RA).

United States District Court, S.D. New York.

Signed Oct. 20, 2015.

Order Denying Reconsideration April 14, 2016.

Fred David Weinstein, Kurzman Eisenberg Corbin Lever & Goodman, LLP, White Plains, NY, Rafey S. Balabanian, Benjamin H. Richman, James Dominick Larry, Edelson McGuire, LLC, Chicago, IL, for Plaintiff.

Bryan Harte Heckenlively, Jonathan H. Blavin, Rose Ring, Munger, Tolles & Olson LLP, San Francisco, CA, Glenn D. Pomerantz, Munger, Tolles & Olson, Los Angeles, CA, for Defendant.

OPINION & ORDER

RONNIE ABRAMS, District Judge:

Plaintiff James Robinson brings this class action against Defendant Disney Online (“Disney”), alleging violations of the Video Privacy Protection Act (the “VPPA”), 18 U.S.C. § 2710. He claims that Disney unlawfully disclosed personally identifiable information (“PII”)—the encrypted serial number of the digital device he used to access Disney video content, as well as his viewing history—to Adobe, a third-party data analytics company. Adobe purportedly combined these disclosures with additional information gathered from other sources, and used this composite data to identify Robinson and attribute his viewing history to him. Before the Court is Disney's motion to dismiss Robinson's Amended Complaint pursuant to Fed.R.Civ.P. 12(b)(6). For the reasons that follow, Disney's motion is granted.

BACKGROUND

Robinson's Amended Complaint concerns videos he purportedly viewed using a Roku, a “digital media-streaming device that delivers videos, news, games, and other content to consumers' televisions via the Internet.” Am. Compl. (Dkt. 20) ¶ 1 n. 1. Through the Roku Channel Store—an “online digital media platform”—Robinson downloaded the Disney Channel application, which, once installed on his Roku, allowed him to view Disney's proprietary video content. Id. ¶¶ 9–10.

“Unbeknownst to its users,” Robinson claims, “each time they use the Disney Channel to watch videos or television shows, Disney discloses their personally identifiable information—including a record of every video clip viewed by the user ... to unrelated third parties.” Id. ¶ 2; see also id. ¶ 13. He further claims that this record is “sent each time that a user views a video clip,” and is accompanied by the “hashed serial number associated with the user's Roku device.” Id. ¶ 13. This hashed—or anonymized—serial number is “unique to a ... device and remain[s] constant for the lifetime of that device.” Id. ¶ 18.

Disney, according to Robinson, programmed its Roku channel to send this information to Adobe, a third-party data analytics company. See id. ¶¶ 3, 13. Adobe, and companies like it, purportedly maintain “massive digital dossiers on consumers” by aggregating consumer data collected from an array of sources, including applications like the Disney Channel. See id. ¶¶ 22–29. Robinson claims that “Adobe has the capability to use” this aggregated data to “personally identify ... users and associate their video viewing selections with a personalized profile in its databases.” Id. ¶ 29.

Robinson “downloaded and began using the Disney Channel on his Roku” device beginning in December 2013. Id. ¶ 39. He claims that Disney disclosed the hashed serial number of his device and his viewing history to Adobe without his consent, id. ¶ 40, and that this information constitutes PII “in this context because it allows Adobe to identify users ... and to attribute their video viewing records to their existing profiles,” id. ¶ 56. He further alleges that Adobe actually identified him and “attribute[d] his viewing choices to his profile” using the information disclosed by Disney. Id. ¶ 57.¹ Robinson argues that these disclosures amounted to violations of the VPPA. Id. ¶ 59. Disney argues otherwise, and seeks dismissal of Robinson's Amended Complaint in its entirety. See Dkt. 30. The Court heard oral argument from the parties on October 5, 2015.

LEGAL STANDARD

To survive a motion to dismiss under Fed.R.Civ.P. 12(b)(6), a pleading must contain “a short and plain statement of the claim showing that the pleader is entitled to relief,” Fed.R.Civ.P. 8(a)(2), and be “plausible on its face,” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007). “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009).

DISCUSSION

The VPPA prohibits a “video tape service provider” from “knowingly disclos [ing], to any person, personally identifiable information concerning any consumer of such provider.” 18 U.S.C. § 2710(b)(1). Its impetus was the publication in “a weekly newspaper in Washington” of a “profile of Judge Robert H. Bork based on the titles of 146 films his family had rented from a video store.” Sen. Rep. 100–599, at 5 (1988).

As defined in the VPPA, a “video tape service provider” is “any person, engaged in the business, in or affecting interstate or foreign commerce, of rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials,” 18 U.S.C. § 2710(a)(4) ; a “consumer” is “any renter, purchaser, or subscriber of goods or services from a video tape service provider,” 18 U.S.C. § 2710(a)(1) ; and “personally identifiable information” (“PII”) “includes information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider,” 18 U.S.C. § 2710(a)(3). Disney contends that Robinson's VPPA claim is statutorily precluded, both because he was not a consumer and because the information Disney transmitted to Adobe was not PII. See Mem. (Dkt. 31) 7–10, 16–17. The Court declines to address the former argument, as it concludes that the information Disney disclosed did not amount to PII.

The precise scope of PII under the VPPA is difficult to discern from the face of the statute—whether read in isolation or in its broader statutory context. As defined in Section 2710(a)(3), PII “includes information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider.”

This language suggests that the information disclosed by a video tape service provider must, at the very least, identify a particular person—not just an anonymous individual—and connect this particular person with his or her viewing history. See In re Hulu Privacy Litig., 2014 WL 1724344, at *7 (N.D.Cal. Apr. 28, 2014) (defining PII as, in part, “information that identifies a specific person and ties that person to particular videos that the person watched”). This construction is consistent with the ordinary meaning of “a person,” as well as the plain meaning of the definition's final element, the requirement that the disclosed information identify “a person as having requested or obtained specific video materials.” 18 U.S.C. § 2710(a)(3). It is also consistent with the VPPA's legislative history. As explained in the Senate Report issued in advance of the statute's enactment, “personally identifiable information is intended to be transaction-oriented. It is information that identifies a particular person as having engaged in a specific transaction with a video tape service provider.” Sen. Rep. 100–599, at 12 (emphasis added). The use of “includes” in the statutory definition is not to the contrary. See id. (“[PII] is information ....”) (emphasis added).

Less clear is the scope of information encompassed by PII, and how, precisely, this information must identify a person. Importantly, Robinson does not argue that the information disclosed by Disney—a “record of [his viewing] activities ... along with the hashed serial number associated with [his] Roku device,” Am. Compl. ¶¶ 13, 42—constitutes PII in its own right. Instead, he argues that the information constitutes PII because Adobe, the recipient of Disney's disclosures, can identify him by “link[ing]” these disclosures with “existing personal information” obtained elsewhere. See Am. Compl. 27, 29; Opp. 8–10. Indeed, the Court assumes, for the purposes of this motion, that Adobe has actually identified him in this manner. See infra note 1. Disney responds that the VPPA is not targeted at what non-defendant third parties might do with disclosures by video tape service providers, as PII is solely limited to information which, in and of itself, identifies a person. See Mem. 7–10. Because the anonymized disclosures here do not themselves identify a specific person, Disney contends, they are not prohibited. See id.

Robinson's theory of liability is not without support in the existing case law. Indeed, Yershov v. Gannett Satellite Info. Network, Inc., 104 F.Supp.3d 135 (D.Mass.2015), expressly rejects the view of PII urged by Disney. There, the District of Massachusetts concluded that the disclosures at issue—the transmission of viewing records of the USA Today application on an Android device, in addition to the “user's GPS coordinates and the ... device's unique identification number”—constituted PII despite requiring additional information before Plaintiff was linked to his video history. Id. at 137–38, 142–43, 145–46. The majority of courts to address this issue, however, have adopted a narrower definition of PII. See In re Nickelodeon Consumer Privacy Litig., 2014 WL 3012873, at *10 (D.N.J. July 2, 2014) (“[PII is] information which must, without more, itself link an actual person to actual video materials.”); Ellis v. Cartoon Network, Inc., 2014 WL 5023535, at *3 (N.D.Ga. Oct. 8, 2014), aff'd on other grounds, 803 F.3d 1251 (11th Cir.2015), (PII not disclosed where the third party to whom an Android ID and viewing history were provided had to “collect information from other sources” to identify the...