Feldman v. Star Tribune Media Co.

Full title: Kyle Feldman, on behalf of himself and all others similarly situated…

Court: United States District Court, District of Minnesota

Date published: Mar 7, 2023

659 F. Supp. 3d 1006 (D. Minn. 2023)

Opinion

File No. 22-cv-1731 (ECT/TNL)

2023-03-07

Kyle FELDMAN, on behalf of himself and all others similarly situated, Plaintiff, v. STAR TRIBUNE MEDIA COMPANY LLC, Defendant.

Steven Liddle, Nicholas Alexander Coulson, and Lance T. Spitzig, Liddle Sheets Coulson P.C., Detroit, MI; and Nathaniel James Weimar, Tewksbury & Kerfeld, P.A., Minneapolis, MN, for Plaintiff Kyle Feldman. Jeffrey P. Justman and Anderson Tuggle, Faegre Drinker Biddle & Reath LLP, Minneapolis, MN, for Defendant Star Tribune Media Company LLC.

Eric C. Tostrud, United States District Judge

Steven Liddle, Nicholas Alexander Coulson, and Lance T. Spitzig, Liddle Sheets Coulson P.C., Detroit, MI; and Nathaniel James Weimar, Tewksbury & Kerfeld, P.A., Minneapolis, MN, for Plaintiff Kyle Feldman. Jeffrey P. Justman and Anderson Tuggle, Faegre Drinker Biddle & Reath LLP, Minneapolis, MN, for Defendant Star Tribune Media Company LLC.

OPINION AND ORDER

Eric C. Tostrud, United States District Judge

Plaintiff Kyle Feldman is a startribune.com subscriber, and he occasionally watches videos on that website. In this case, Mr. Feldman alleges that Defendant Star Tribune Media Company, the website's owner, violated the federal Video Privacy Protection Act (or "VPPA"), 18 U.S.C. § 2710, by sharing his video-viewing history with Facebook using a code analytics tool called Facebook Pixel. He hopes to represent a class of similarly situated startribune.com subscribers.

The Star Tribune seeks dismissal of the case on jurisdictional and merits grounds. It argues that Mr. Feldman lacks Article III standing. Alternatively, it argues that Mr. Feldman's claim fails on the merits. The Star Tribune's motion will be denied. The better answer is that Mr. Feldman suffered a concrete injury in fact traceable to the Star Tribune, meaning there is subject-matter jurisdiction over this case. And the Complaint includes factual allegations plausibly showing each of the VPPA's essential elements.

I

Under the VPPA, "[a] video tape service provider who knowingly discloses, to any person, personally identifiable information concerning any consumer of such provider shall be liable to the aggrieved person." 18 U.S.C. § 2710(b)(1). A "video tape service provider" is "any person, engaged in the business . . . of rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials." Id. § 2710(a)(4). " '[P]ersonally identifiable information' includes information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider." Id. § 2710(a)(3). "[T]he term 'consumer' means any renter, purchaser, or subscriber of goods or services from a video tape service provider." Id. § 2710(a)(1). "Any person aggrieved by any act of a person in violation of this section may bring a civil action in a United States district court." 18 U.S.C. § 2710(c)(1). A VPPA plaintiff may recover "actual damages but not less than liquidated damages in an amount of $2,500," "punitive damages," "reasonable attorneys' fees and other litigation costs reasonably incurred," and "such other preliminary and equitable relief as the court determines to be appropriate." 18 U.S.C. § 2710(c)(2).¹

1 The statute contains a scrivener's error. Subsection 2710(b)(1) says that a video tape service provider who violates the statute "shall be liable to the aggrieved person for the relief provided in subsection (d)." (emphasis added). The problem is that subsection (d) doesn't really describe remedial "relief." It says only that personally identifiable information obtained in violation of the statute "shall not be received in evidence in any trial, hearing, arbitration, or other proceeding." 18 U.S.C. § 2710(d). As noted above, available remedies are listed in subsection (c)(2). As a result, courts understand subsection (b)(1)'s reference to "subsection (d)" to mean "subsection (c)." See In re Nickelodeon Consumer Priv. Litig., 827 F.3d 262, 280 n.107 (3d Cir. 2016) (citing Sterk v. Redbox Automated Retail, LLC, 672 F.3d 535, 537 (7th Cir. 2012)).

Regarding Congress's reasons for enacting the VPPA, the First Circuit has explained:

Congress enacted the VPPA in response to a profile of then-Supreme Court nominee Judge Robert H. Bork that was published by a Washington, D.C., newspaper during his confirmation hearings. S. Rep. No. 100-599, at 5 (1988), reprinted in 1988 U.S.C.C.A.N. 4342-1. The profile contained a list of 146 films that Judge Bork and his family had rented from a video store. Id. Members of Congress denounced the disclosure as repugnant to the right of privacy. Id. at 5-8. Congress then passed the VPPA "[t]o preserve personal privacy with respect to the rental, purchase or delivery of video tapes or similar audio visual materials." Id. at 1.

Yershov v. Gannett Satellite Info. Network, Inc., 820 F.3d 482, 485 (1st Cir. 2016).

II

The Complaint's basic factual allegations are few and seemingly straightforward. The Star Tribune developed, owns, and operates a website, startribune.com. Compl ¶¶ 2, 7, 12. This website offers an array of video content. Id. ¶ 2. The Star Tribune monetizes its website, in part, by collecting and disclosing subscriber information to Facebook. Id. ¶ 20. The website uses a code analytics tool called "Facebook Pixel," which tracks the actions of subscribers, such as the pages or videos they view. Id. ¶¶ 21-22. When a Facebook account is created, a corresponding Facebook ID number is also created. Id. ¶¶ 17-18. A user's Facebook profile can be identified and viewed by appending the user's Facebook ID number to the end of "Facebook.com." Id. ¶ 29.

If an individual watches a video on the Star Tribune website while logged in to Facebook on the same web browser and device, the individual's Facebook ID and a URL of the video the individual watched "are simultaneously sent to Facebook via Facebook Pixel." Id. ¶¶ 23, 48. The viewer's Facebook ID is sent to Facebook via a "cookie." Id. ¶ 25. At the same time, something called the "PageView" component of Facebook Pixel discloses to Facebook the URL a viewer accessed. Id. ¶ 26. The Complaint illustrates this process using the partially redacted Facebook ID of an unidentified user. See id. ¶ 25. If Facebook, the Star Tribune, or perhaps someone else were to enter the video URL and the appended-Facebook-ID into a web browser, the Complaint alleges, it would be possible to identify which Star Tribune video a particular user had viewed. Id. ¶¶ 27, 29-30.

Mr. Feldman subscribes to startribune.com. Id. ¶ 2. Mr. Feldman also has a Facebook account, "which he is perpetually logged into." Id. ¶ 44. His Facebook profile contains his name. Id. ¶ 47. Since becoming a startribune.com subscriber in 2011, Mr. Feldman regularly has watched videos on startribune.com while logged into his Facebook account on the same web browser and device. Id. ¶ 48. Each time Mr. Feldman has watched a video on startribune.com, the Star Tribune disclosed his Facebook ID and the URL of the video that he viewed to Facebook via Facebook Pixel. Id. ¶¶ 26, 49. Mr. Feldman alleges that the Star Tribune violated the VPPA each time it knowingly disclosed his Facebook ID and viewed-video-URLs (and those of would-be class members) to Facebook via Facebook Pixel. Id. ¶¶ 4, 64-71. The proposed class would include: "All persons in the United States who have a Facebook account, subscribed to startribune.com, and watched one or more videos on that Website." Id. ¶ 54.

III

"As the party invoking federal jurisdiction, the plaintiff[ ] bear[s] the burden of demonstrating that [he has] standing." TransUnion LLC v. Ramirez, — U.S. —, 141 S. Ct. 2190, 2207, 210 L.Ed.2d 568 (2021) (citing Lujan v. Defenders of Wildlife, 504 U.S. 555, 561, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992)). To establish Article III standing at the motion-to-dismiss stage, a plaintiff must allege facts plausibly showing that he has "(1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision." Spokeo, Inc. v. Robins, 578 U.S. 330, 338, 136 S.Ct. 1540, 194 L.Ed.2d 635 (2016); see also Thole v. U.S. Bank N.A., — U.S. —, 140 S. Ct. 1615, 1621, 207 L.Ed.2d 85 (2020) (noting that these elements must be "plausibly and clearly allege[d]"); Lujan, 504 U.S. at 561, 112 S.Ct. 2130.² "Jurisdictional issues, whether they involve questions of law or of fact, are for the court to decide." Osborn v. United States, 918 F.2d 724, 729 (8th Cir. 1990) (citation omitted). "In assessing a plaintiff's Article III standing, we must 'assume that on the merits the plaintiffs would be successful in their claims.' " Am. Farm Bureau Fed'n v. United States Env't Prot. Agency, 836 F.3d 963, 968 (8th Cir. 2016) (quoting Muir v. Navy Fed. Credit Union, 529 F.3d 1100, 1106 (D.C. Cir. 2008)).

2 To be precise, I do not understand the Supreme Court's statements that a plaintiff must "clearly" allege facts demonstrating each standing element—appearing, for example, in Thole, 140 S. Ct. at 1621, and Warth v. Seldin, 422 U.S. 490, 518, 95 S.Ct. 2197, 45 L.Ed.2d 343 (1975)—to mean there is some heightened, more-than-plausibility pleading burden with respect to standing.

"A court deciding a motion under Rule 12(b)(1) must distinguish between a 'facial attack' and a 'factual attack.' " Osborn, 918 F.2d at 729 n.6 (citations omitted). "In a facial attack, the court merely needs to look and see if plaintiff has sufficiently alleged a basis of subject matter jurisdiction." Branson Label, Inc. v. City of Branson, Mo., 793 F.3d 910, 914 (8th Cir. 2015) (cleaned up). "Conversely, in a factual attack, the existence of subject matter jurisdiction is challenged in fact, irrespective of the pleadings, and matters outside the pleadings . . . are considered." Id. at 914-15 (cleaned up). Here, "[t]he Star Tribune facially attacks Plaintiff's allegations of 'concrete' injury, and factually attacks the 'traceability' of any such injury to the Star Tribune." Mem. in Supp. [ECF No. 19] at 12.

A

Begin with the Star Tribune's facial challenge to Mr. Feldman's Article III injury allegations. The Supreme Court has explained in some detail what makes an injury "concrete" for Article III's purposes. See, e.g., Ramirez, 141 S. Ct. at 2204-07. A "concrete" injury is "real, and not abstract." Spokeo, 578 U.S. at 340, 136 S.Ct. 1540 (cleaned up). Complaints that allege "economic or physical harms" are almost always no-doubters. Hein v. Freedom from Religion Found., Inc., 551 U.S. 587, 642, 127 S.Ct. 2553, 168 L.Ed.2d 424 (2007) (Souter, J., dissenting). This is true even if the alleged harm is "only a few pennies." Wallace v. ConAgra Foods, Inc., 747 F.3d 1025, 1029 (8th Cir. 2014). "Various intangible harms can also be concrete," though they also may present more difficult and closer calls. Ramirez, 141 S. Ct. at 2204. As the Court explained in Spokeo in the context of federal statutory claims:

In determining whether an intangible harm constitutes injury in fact, both history and the judgment of Congress play important roles. Because the doctrine of standing derives from the case-or-controversy requirement, and because that requirement in turn is grounded in historical practice, it is instructive to consider whether an alleged intangible harm has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts. In addition, because Congress is well positioned to identify intangible harms that meet minimum Article III requirements, its judgment is also instructive and important. Thus, we said in Lujan that Congress may "elevat[e] to the status of legally cognizable injuries concrete, de facto injuries that were previously inadequate in law." Similarly, Justice Kennedy's concurrence in that case explained that "Congress has the power to define injuries and articulate chains of causation that will give rise to a case or controversy where none existed before."

578 U.S. at 340-41, 136 S.Ct. 1540 (citations omitted). Examples of "harms traditionally recognized as providing a basis for lawsuits in American courts . . . include, for example, reputational harms, disclosure of private information, and intrusion upon seclusion." Ramirez, 141 S. Ct. at 2204. "And those traditional harms may also include harms specified by the Constitution itself." Id.

The presence of even an acknowledged federal statutory violation does not necessarily mean a plaintiff has suffered a concrete injury. Spokeo, 578 U.S. at 341, 136 S.Ct. 1540. As the Court explained in Ramirez:

For standing purposes . . . an important difference exists between (i) a plaintiff's statutory cause of action to sue a defendant over the defendant's violation of federal law, and (ii) a plaintiff's suffering concrete harm because of the defendant's violation of federal law. Congress may enact legal prohibitions and obligations. And Congress may create causes of action for plaintiffs to sue defendants who violate those legal prohibitions or obligations. But under Article III, an injury in law is not an injury in fact. Only those plaintiffs who have been concretely harmed by a defendant's statutory violation may sue that private defendant over that violation in federal court. As then-Judge Barrett succinctly summarized, "Article III grants federal courts the power to redress harms that defendants cause plaintiffs, not a freewheeling power to hold defendants accountable for legal infractions." Casillas [v. Madison Ave. Assocs., Inc.], 926 F.3d [329,] 332 [ (7th Cir. 2019) ].

Ramirez, 141 S. Ct. at 2205. When a defendant acknowledges a federal statutory violation (or, as here, doesn't dispute the violation's presence for purposes of its jurisdictional argument), but argues that the plaintiff has nonetheless failed to show a concrete injury, the task, as I understand it, is to examine the plaintiff's injury allegations and determine whether they have a "close relationship" to a harm traditionally recognized as the basis for a case under the common law. Spokeo, 578 U.S. at 341, 136 S.Ct. 1540; see also Braitberg v. Charter Commc'ns, Inc., 836 F.3d 925, 930-31 (8th Cir. 2016).

Applying this framework, I conclude that Mr. Feldman has plausibly alleged a concrete injury as required by Article III. Mr. Feldman does not allege physical or economic injury. See generally Compl. He alleges intangible harm associated with the nonconsensual sharing of his private information—that is, the videos he watched on startribune.com—with a third party. Id. ¶¶ 3, 32-33, 66-69. He alleges that the disclosure of his video-viewing history "is an outrageous invasion of privacy and would be offensive to a reasonable person." Id. ¶ 36. And he alleges that Congress enacted the VPPA "[i]n recognition of the outrageous nature of such invasions." Id. ¶ 37. As the Eighth Circuit observed in Braitberg, "there is a common law tradition of lawsuits for invasion of privacy." 836 F.3d at 930. As support for this assertion, the Braitberg court cited the Restatement (Second) of Torts § 652A (Am. Law Inst. 1977) ("Restatement"). Id. Section 652A states the general rule that "[o]ne who invades the right of privacy of another is subject to liability for the resulting harm to the interests of the other." Restatement § 652A(1). Section 652 goes on to describe particular circumstances that would constitute invasion of privacy, including intrusion upon seclusion. Id. § 652B. To show intrusion upon seclusion under the common law tradition the Restatement describes, a plaintiff must allege that a defendant "intentionally intrude[d], physically or otherwise, upon the solitude or seclusion of [the plaintiff] or his private affairs or concerns," and the intrusion must "be highly offensive to a reasonable person." Id. Intrusion upon seclusion "does not depend upon any publicity given to the person whose interest is invaded or to his affairs." Id. cmt. a. The claim "consists solely of an intentional interference with his interest in solitude or seclusion, either as to his person or as to his private affairs or concerns, of a kind that would be highly offensive to a reasonable man." Id. The invasion may occur by many means, including for example "by opening [a plaintiff's] private and personal mail." Id. cmt. b. So described, this common law tradition bears a close relationship to Mr. Feldman's injury allegations: Mr. Feldman alleges that his video viewing history was his private concern, that the Star Tribune intruded by sharing this history with Facebook, and that this sharing would be offensive to a reasonable person. That seems enough at the motion-to-dismiss stage.

The conclusion that a plaintiff like Mr. Feldman has suffered a concrete injury for purposes of Article III standing to assert a VPPA claim is supported by every federal circuit court that has considered the issue. See In re: Nickelodeon Consumer Priv. Litig., 827 F.3d 262, 274 (3d Cir. 2016) ("While perhaps 'intangible,' the harm is also concrete in the sense that it involves a clear de facto injury, i.e., the unlawful disclosure of legally protected information."); Sterk v. Redbox Automated Retail, LLC, 770 F.3d 618, 623 (7th Cir. 2014) (finding that disclosure of video viewing history was a concrete injury for Article III's purposes); Eichenberger v. ESPN, Inc., 876 F.3d 979, 982-84 (9th Cir. 2017) (determining that the VPPA "protects concrete interests" in privacy that are injured by disclosure and confirming this understanding by reviewing the historical practice and common law tradition regarding privacy-related torts); Perry v. Cable News Network, Inc., 854 F.3d 1336, 1339-41 (11th Cir. 2017) (concluding that the plaintiff "established his standing to file this action because his alleged injury is sufficiently concrete," and that "the VPPA's creation of a cause of action for this type of invasion of privacy 'has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts' " (quoting Spokeo, 578 U.S. at 341, 136 S.Ct. 1540)).

The Star Tribune advances several sensible-but-unconvincing arguments to show that Mr. Feldman has not alleged a concrete injury. (1) It argues that Mr. Feldman "does not allege any physical, financial, reputational, or emotional injury . . . [or] any public disclosure of any information," and that these failures mean Feldman's VPPA claim bears no close relationship to a historical analog. Mem. in Supp. at 14. Mr. Feldman alleges intangible harm associated with the invasion of his privacy, and Spokeo makes clear that allegations of intangible harm count. Spokeo, 578 U.S. at 340, 136 S.Ct. 1540. And under the common law tradition associated with invasion-of-privacy and intrusion-upon-seclusion claims, "publication" of a private matter is not an essential element. Restatement § 652B. (2) The Star Tribune argues that Mr. Feldman alleges no invasion or intrusion because he "does not allege that his Facebook ID and video URLs were seen by anybody at Facebook." Mem. in Supp. at 16. True, but I understand the common law tradition to care about the offensive intrusion, not whether the intrusion was accompanied by review or perhaps use by a third party. No authority has been cited or identified suggesting that this understanding is incorrect. (3) The Star Tribune disputes Mr. Feldman's showing that his "privacy" was invaded in a way that was "highly offensive," arguing "there is nothing inherently sensitive, outrageous, or embarrassing about a third party learning that one watches videos on the website of a mainstream local news outlet." Id. at 16. Mr. Feldman's claim is not based on the allegation that the Star Tribune violated a right to privacy associated with the mere fact that he viewed videos on startribune.com. He alleges a privacy invasion associated with the identity of the videos he watched. It is true that Mr. Feldman might have alleged more. He has not, for example, tethered his allegation that this was private activity to, say, a promise or promises made by the Star Tribune. See Nickelodeon Consumer Priv. Litig., 827 F.3d at 291 (noting that plaintiffs rested their claim of privacy on a promise by Nickelodeon that it would not collect or share children's personal information). But especially in view of the reasons Congress provided for the VPPA's enactment, Mr. Feldman's allegation that he had a privacy interest in his video viewing history, the intrusion of which would be highly offensive to a reasonable person, seems plausible. (4) The Star Tribune characterizes the circuit decisions finding Article III standing in the context of VPPA claims as "pre-TransUnion outliers" that should not be followed. Mem. in Supp. at 19. I disagree. Ramirez did not overrule or abrogate any part of Spokeo. After Ramirez, there may be room for argument around precisely how the inferior federal courts are to determine whether a federal statutory claim bears "a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts." Spokeo, 578 U.S. at 341, 136 S.Ct. 1540. (For one example of this debate, see Hunstein v. Preferred Collection and Mgmt. Servs., Inc., 48 F.4th 1236 (11th Cir. 2022) (en banc)). But this case does not implicate such arguments. Considering the Eighth Circuit's recognition of the "common law tradition of lawsuits for invasion of privacy," Braitberg, 836 F.3d at 930, and the evidently close relationship between Feldman's VPPA claim in this case and the intrusion-upon-seclusion tort as it has been traditionally understood, Mr. Feldman has done enough. The uniformity with which the circuits have decided this issue just reinforces this conclusion.

B

Next consider the Star Tribune's factual challenge to Mr. Feldman's ability to show that his injury is "fairly traceable" to the Star Tribune. This "requires the plaintiff to show a sufficiently direct causal connection between the challenged action and the identified harm" that "cannot be overly attenuated." AGRED Found. v. United States Army Corps of Eng'rs, 3 F.4th 1069, 1073 (8th Cir. 2021). "A plaintiff who causes its own injury does not satisfy the traceability prong." ABF Freight Sys., Inc. v. Int'l Bhd. of Teamsters, 645 F.3d 954, 961 (8th Cir. 2011); see also Garland v. Orlans, PC, 999 F.3d 432, 440-41 (6th Cir. 2021) (holding that FDCPA plaintiff's anxiety injury failed Article III's traceability requirement because the plaintiff conceded owing the debt that was the subject of assertedly FDCPA-non-compliant collection letters, meaning his anxiety and fear of foreclosure was "rooted in the fact of default, not the [collection] letters received"); Cameron Cnty. Hous. Auth. v. City of Port Isabel, 997 F.3d 619, 623-24 (5th Cir. 2021) (finding no traceability because "the summary judgment record makes clear that Plaintiff's December 1 loss of federal funding was the combined result of third-party actions and self-inflicted harm.").³

3 In Federal Election Commission v. Cruz, the Supreme Court observed that it has "never recognized" "an exception to traceability for injuries that a party purposely incurs." 596 U.S. 289, 142 S. Ct. 1638, 1647, 212 L.Ed.2d 654 (2022). This statement is best understood as referring only to those cases in which a plaintiff asserts "an injury resulting from the application or threatened application of an assertedly unlawful enactment." Id.; see Alexis Bailly Vineyard, Inc. v. Harrington, 931 F.3d 774, 779-80 (8th Cir. 2019) (recognizing that the plaintiff's voluntary decision to operate under the challenged statutory regime, though other statutory options were available, did not make the plaintiff responsible for its own injuries). So understood, Cruz's refusal to recognize a self-inflicted injury exception to the traceability requirement has no bearing here because this case does not involve a challenge to a statute, regulation, or other enactment.

Factually, the Star Tribune says that any injury Mr. Feldman suffered was self-inflicted because "the Star Tribune's use of Facebook Pixel is not what caused Plaintiff's data to be disclosed to Facebook. To the contrary, information is sent to Facebook only because of any one of several actions (or non-actions) taken by the user." Mem. in Supp. at 21. To support these assertions, the Star Tribune has filed a declaration of its Senior Vice President for Digital, Jim Bernard. ECF No. 20. In his declaration, Mr. Bernard testifies that there are "numerous simple steps that any Star Tribune website user can take to prevent Facebook Pixel from sending cookies about their startribune.com activities to Facebook." Id. ¶ 4. Mr. Bernard identifies three such options. First, he testifies, "a user can modify their browser settings to stop their browser from sharing cookies with Facebook." Id. ¶ 5. Mr. Bernard testifies that the Star Tribune's privacy policy includes "specific instructions to use browser settings to manage this kind of information." Id. The specific instructions Mr. Bernard identifies say only that "the best way to avoid third-party tracking of your online behaviors may be through your browser settings and deletion of cookies." Id. Second, Mr. Bernard testifies that "a user can prevent cookies from being shared with Facebook by using a different browser to access startribune.com than the browser used to access Facebook." Id. ¶ 6. Third, Mr. Bernard testifies that "a user can prevent cookies from being shared with Facebook by logging out of Facebook before watching any videos on startribune.com." Id. ¶ 7.

Legally, the Star Tribune argues that these facts make this case like St. Louis Heart Center, Inc. v. Nomax, Inc., in which the Eighth Circuit affirmed the dismissal of a would-be class action brought under the Telephone Consumer Protection Act ("TCPA"), 47 U.S.C. § 227, because the plaintiff failed to show that its asserted injuries were fairly traceable to the defendant's actions. 899 F.3d 500, 503-05 (8th Cir. 2018). The St. Louis Heart Center alleged that Nomax, the manufacturer of a potassium tablet called "Effer-K," "transmitted twelve advertisements to the Heart Center by facsimile without including a proper opt-out notice on each advertisement." Id. at 502. As a result, the Heart Center alleged, it had suffered injuries including "the loss of toner and paper, wasted time, and invasions of privacy." Id. at 504. Through the deposition testimony of its president, Dr. Ronald Weiss, the Heart Center conceded that the lawsuit "was not based on a lack of consent," and that the proposed class "would include those individuals who did consent to receive the challenged faxes." Id. at 502-03. This posture, the Eighth Circuit concluded, meant that the Heart Center had failed to show traceability. The court explained:

The district court found that the Heart Center "both invited and did not rebuke" the challenged faxes. This finding is not clearly erroneous. Dr. Weiss admitted that he requested samples of Nomax's Effer-K product on at least four occasions. While Dr. Weiss first testified that he did not consent to receive Nomax's faxes, he eventually acknowledged that the lawsuit "is not based upon the fact that consent was not given." Counsel similarly represented that "the issue of consent or not will not be an issue" in the case. In other words, the plaintiff conceded for purposes of the lawsuit that the facsimiles were not transmitted without consent.

In that posture, the Heart Center cannot show that its alleged injury is traceable to Nomax's alleged failure to provide a technically compliant opt-out notice. Whether or not the faxes contained a proper opt-out notice, their transmission would have used the Heart Center's paper and toner, occupied its phone lines, and invaded its privacy. Because there is no "causal connection between the injury and the conduct complained of," the Heart Center has not established traceability.

Id. at 504 (citation omitted). In other words, because the Heart Center invited receipt of the assertedly non-TCPA-compliant faxes, the injuries it claimed owing just to the faxes' receipt were not traceable to Nomax. The court continued on to separately find that "the Heart Center ha[d] not established that Nomax's alleged failure to display a proper opt-out notice compliant with the federal regulations created a risk of real harm." Id.

Neither the facts described in Mr. Bernard's declaration (accepting them as true) nor St. Louis Heart Center show that traceability is lacking here. Mr. Bernard describes steps Mr. Feldman might have taken to prevent his alleged injuries—that is, to prevent his video-viewing history from being shared with Facebook. The availability of these measures, however, does not show either that Mr. Feldman consented to the disclosure of this information or that his injuries were self-inflicted. The law doesn't ordinarily say that a plaintiff's failure to use available measures to avoid injury means the plaintiff consented to the injury. In tort law, a plaintiff's failure to take advantage of an opportunity to avoid injury ordinarily matters, if at all, with respect to causation, a merits question. Regardless, no case has been cited adopting or applying such a rule in the Article III context. Though it seems conceivable that a plaintiff's refusal to take advantage of plain chances to avoid injury might be so extreme as to justify the conclusion that a sued-for injury is self-inflicted, the facts alleged by Mr. Feldman and described by Mr. Bernard do not show that this is that kind of case. St. Louis Heart Center is materially different because the Heart Hospital there conceded it consented to the faxes it received, and thus invited the injuries it incurred in connection with its receipt of those faxes. Essentially the same is true of the Sixth Circuit's decision in Garland, which the Star Tribune also cites. As noted parenthetically above, the plaintiff in that FDCPA case "did not dispute his debts or allege the [allegedly FDCPA-non-compliant] letter contained inaccurate information." 999 F.3d at 441. For these reasons, the court found that plaintiff's anxiety injury resulted only from the plaintiff's delinquency and could not have resulted from the defendant's correspondence. Id. Mr. Feldman makes no concession here of the sort made in St. Louis Heart Center or Garland, either expressly or impliedly, and he has alleged a direct causal connection between the Star Tribune's conduct and his injury under the VPPA. Traceability is not absent.

IV

The Star Tribune advances three distinct challenges to the Complaint's merits under Rule 12(b)(6). In reviewing a motion to dismiss for failure to state a claim, a court must accept as true all of the factual allegations in the complaint and draw all reasonable inferences in the plaintiff's favor. Gorog v. Best Buy Co., 760 F.3d 787, 792 (8th Cir. 2014) (citation omitted). Although the factual allegations need not be detailed, they must be sufficient to "raise a right to relief above the speculative level." Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007) (citation omitted). The complaint must "state a claim to relief that is plausible on its face." Id. at 570, 127 S.Ct. 1955. "A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Ashcroft v. Iqbal, 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009).

A

First, the Star Tribune argues that the Complaint does not include allegations plausibly showing that the Star Tribune disclosed "personally identifiable information." As noted, the VPPA defines this term to "include[ ] information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider." 18 U.S.C. § 2710(a)(3). (For purposes of its motion, the Star Tribune does not dispute that it is a "video tape service provider." Mem. in Supp. at 24.)

Several courts have interpreted the VPPA's definition of "personally identifiable information." Some of the definition's aspects are straightforward and noncontroversial. "For there to be an actionable VPPA violation, the video provider must have knowingly disclosed: 1) a consumer's identity; 2) the identity of 'specific video materials'; and 3) the fact that the person identified 'requested or obtained' that material." In re: Hulu Priv. Litig., 86 F. Supp. 3d 1090, 1095 (N.D. Cal. 2015). "There are, in other words, three distinct elements here: the consumer's identity; the video material's identity; and the connection between them." Id.; see also Robinson v. Disney Online, 152 F. Supp. 3d 176, 179 (S.D.N.Y. 2015) ("This language suggests that the information disclosed by a video tape service provider must, at the very least, identify a particular person—not just an anonymous individual—and connect this particular person with his or her viewing history.").

The primary challenge courts encounter concerns § 2710(a)(3)'s requirement that disclosed information connect the consumer to the video material the consumer requested or obtained. Neither the Supreme Court nor the Eighth Circuit have addressed this question. The First, Third, and Ninth Circuits have.

In Yershov, the First Circuit (with retired Justice Souter sitting by designation) addressed a claim comparable to Mr. Feldman's. The plaintiff (Yershov) installed the "USA Today Mobile App" on his Android mobile device and used the app to "watch numerous video clips." 820 F.3d at 484-85. Each time Yershov watched a video on the app, the defendant, Gannett, disclosed to a third party, Adobe, "the title of the viewed video, Yershov's unique Android ID, and the GPS coordinates of Yershov's device at the time the video was viewed." Id. at 485. "Using this information, Adobe was able to identify Yershov and link the videos he had viewed to his individualized profile maintained by Adobe." Id. The court determined that Yershov's complaint alleged facts plausibly showing that Gannett had disclosed information connecting him to the viewed videos. Id. at 486. In reaching this conclusion, the court noted that "the complaint and its reasonable inferences describe what for very many people is a similar type of identification, effectively revealing the name of the video viewer," and suggested that GPS coordinates, "[g]iven how easy it is to locate a GPS coordinate on a street map," alone might be enough to identify a video viewer. Id. The court acknowledged that "there is certainly a point at which the linkage of information to identity becomes too uncertain, or too dependent on too much yet-to-be-done, or unforeseeable detective work," but determined that Yershov's allegations implicated none of these concerns.

The Third Circuit addressed the issue in In re: Nickelodeon Consumer Priv. Litig. There, the plaintiffs' core allegation was that Viacom, owner of the children's television station Nickelodeon, disclosed to Google several items of information regarding children who registered for and used a Nickelodeon website, Nick.com. 827 F.3d at 268-69. Relevant to the plaintiffs' VPPA claims, the disclosed information included a user's IP address, a user's browser and operating system settings, and a computing device's unique device identifier. Id. at 281-82. Based largely on its close review of the VPPA's legislative history, the court held that disclosed information provides the requisite connection between the consumer and the requested or obtained video material if the "information that would, with little or no extra effort, permit an ordinary recipient to identify a particular person's video-watching habits." Id. at 284; see also id. at 290 ("In our view, personally identifiable information under the [VPPA] means the kind of information that would readily permit an ordinary person to identify a specific individual's video-watching behavior."). The court was careful to note that it did not disagree with the First Circuit's decision in Yershov and remarked specifically that the First Circuit's "conclusion merely demonstrates that GPS coordinates contain more power to identify a specific person than, in our view, an IP address, a device identifier, or a browser fingerprint." Id. at 289. The court also clarified that "[s]ome disclosures predicated on new technology, such as the dissemination of precise GPS coordinates or customer ID numbers, may suffice." Id. at 290. Applying its "little or no extra effort/ordinary person" rule, the court affirmed the district court's dismissal of the plaintiffs' VPPA claim because "the Act does not extend to the kind of static digital identifiers allegedly disclosed by Viacom to Google." Id. at 295.

The Ninth Circuit addressed the question in Eichenberger. There, the plaintiff downloaded an application—the "Watch-ESPN Channel"—to a Roku device that allowed him "to view videos and other content on [his] television by means of Internet streaming." 876 F.3d at 981. Every time the plaintiff watched a video, ESPN "knowingly disclosed to a third party, Adobe Analytics[,] . . . [his] Roku device serial number and . . . the identity of the video that he watched." Id. The court framed the issue as a choice between the "reasonably and foreseeably likely to reveal" rule of Yershov versus the "ordinary person" standard of Nickelodeon. Id. at 985. The court determined that Nickelodeon's " 'ordinary person' test better informs video service providers of their obligations under the VPPA" and seems to have adopted it for that reason. Id. Applying the test, the court found the complaint deficient because the plaintiff conceded that the disclosed information—his Roku device serial number and the names of the videos he watched—"cannot identify an individual unless it is combined with other data in Adobe's possession—data that ESPN never disclosed and apparently never even possessed." Id. at 986. Notwithstanding its choice of the Nickelodeon "ordinary person" test, the court observed that its decision "[did] not necessarily conflict with Yershov" because the GPS data at issue there was information " 'most people' " could use to identify an individual. Id. (quoting Yershov, 820 F.3d at 486.) The court also noted, albeit in dicta, that other examples of disclosed information, including "[a] Facebook link or an email address may very well readily enable an 'ordinary person' to identify an individual." Id.

Judged against these authorities, the Complaint's allegations here plausibly show that the Star Tribune disclosed information connecting Mr. Feldman to video material he requested or obtained. The Complaint alleges that the Star Tribune chose to "implement[ ]" Facebook Pixel on its website. Compl. ¶ 21. Mr. Feldman "has had a Facebook account since 2009, which he is perpetually logged into." Id. ¶ 44. His "Facebook profile and his email address contain his name," making it feasible to identify Mr. Feldman by reference to this information. Id. ¶ 47. When he created his Facebook account, Mr. Feldman was assigned a Facebook ID that could "be used to identify and view [his] associated Facebook profile." Id. ¶ 18. Mr. Feldman also is a startribune.com subscriber who "has regularly watched" videos on the website "using the same device and/or browser in which he is logged into his Facebook account." Id. ¶¶ 6, 48. Under these circumstances, each time Mr. Feldman has watched video content on startribune.com, the Star Tribune "simultaneously disclosed [his Facebook ID] and the name of the video/content that he viewed to Facebook via Facebook Pixel." Id. ¶ 49; see also id. ¶ 23. As the Complaint describes things then, connecting a Facebook ID to a specific person, a URL to a particular video, and the specific person to the particular video is a reasonably straightforward exercise. I'll grant that the screen shot the Complaint provides as an example does not show disclosure of personally identifiable information as obviously as a profile or list that might have been produced by a video-rental store in 1987. But as the Complaint describes it, the information is both reasonably comprehensible and plausibly as usable as the GPS data addressed in Yershov.

As with the earlier conclusion regarding Mr. Feldman's Article III standing, the conclusion that the Complaint's allegations plausibly satisfy the VPPA's "connection" requirement—i.e., that disclosed information connect the consumer to the video material the consumer requested or obtained—finds support in many persuasive cases. There are Yershov, Nickelodeon, and Eichenberger. Each of these cases supports the basic idea that electronic disclosures of a person's video-viewing history, even if not explicit, can violate the VPPA. And most district courts that have addressed the use of Facebook Pixel specifically reached this same result in the context of Rule 12(b)(6) motions. See Belozerov v. Gannett Co., Inc., No. 22-cv-10838-NMG, 646 F. Supp. 3d 310, 313-15 (D. Mass. Dec. 20, 2022); Czarnionka v. The Epoch Times Ass'n, Inc., No. 22 Civ. 6348 (AKH), 2022 WL 17069810, at *3 (S.D.N.Y. Nov. 17, 2022); Lebakken v. WebMD, LLC, No. 1:22-CV-644-TWT, 640 F. Supp. 3d 1335, 1341-42 (N.D. Ga. Nov. 4, 2022); Stark v. Patreon, Inc., No. 22-cv-03131-JCS, 635 F. Supp. 3d 841, 852-54 (N.D. Cal. Oct. 13, 2022); Ambrose v. Boston Globe Media Partners LLC, No. 21-cv-10810-RGS, 2022 WL 4329373, at *2 (D. Mass. Sept. 19, 2022); contra Martin v. Meredith Corp., No. 22-cv-4776 (DLC), 657 F. Supp. 3d 277, 283-86 (S.D.N.Y. Feb. 17, 2023).

B

Second, the Star Tribune argues that the Complaint omits allegations essential to plausibly showing that the Star Tribune "knowingly" disclosed personally identifiable information to Facebook. 18 U.S.C. § 2710(b). The Star Tribune acknowledges that the Complaint accuses it of "knowingly collecting and disclosing its subscribers' [personally identifiable information] to Facebook" through its decision to "implement[ ]" Facebook Pixel on startribune.com. Compl. ¶¶ 20, 21, 31-32, 67. The Star Tribune says that's not enough. To state a plausible VPPA claim, the Star Tribune asserts, the Complaint must allege "that the Star Tribune knew that Facebook would actually connect the disclosed video URLs and Facebook IDs into something approximating the Judge Bork video list." Mem. in Supp. at 29. In the Star Tribune's understanding, "[m]ere knowledge that two pieces of data could hypothetically be combined to identify subscribers and the videos they watched is not enough to state a VPPA claim." Id. Mr. Feldman disagrees with this interpretation of the statute. He argues that, so long as a defendant disclosed "personally identifiable information" as the VPPA defines that term, "the only consideration in determining whether" that disclosure was done " 'knowingly' is whether [the defendant] did so consciously." Mem. in Opp'n [ECF No. 24] at 28.

The VPPA's text does not support the Star Tribune's argument. The connection between a VPPA plaintiff's identity and video-viewing history is established (or not) by determining whether the disclosed information is "personally identifiable information" under 18 U.S.C. § 2710(a)(3). The VPPA defines "personally identifiable information" by reference to whether the "information . . . identifies a person as having requested or obtained specific video materials or services." Id. (emphasis added). It is true that determining whether information connects a person with his or her video-viewing history depends on the information's capacity to be readily or reasonably understood as making that connection. Yershov, Nickelodeon, and Eichenberger addressed that issue. But if that question is answered affirmatively—as it was above in Part IV.A.—that's it. Textually, in other words, the VPPA doesn't care either about whether a person to whom the information is disclosed connects the identity of the viewing-person with his or her video-viewing history, or about what a person to whom information is disclosed does with the information (unless of course the recipient also happens to be a video tape service provider who turns around and discloses the information a second time). It follows that a VPPA plaintiff need not allege—to meet the VPPA's "knowingly" element—that the video tape service provider knew that the person to whom personally identifiable information was disclosed would "actually connect" the disclosed information. Mem. in Supp. at 29. Allegations plausibly showing that personally identifiable information was consciously disclosed suffice, and the Complaint here includes such allegations.

C

Third, the Star Tribune argues that "Plaintiff's claim should be dismissed because he consented to his information being disclosed to third parties via cookies, and so the VPPA's safe harbor bars his claim. See 18 U.S.C. § 2710(b)(2)(B))." Mem. in Supp. at 29. The provision on which this argument depends says that "[a] video tape service provider may disclose personally identifiable information concerning any consumer . . . to any person with the informed, written consent (including through an electronic means using the internet) of the consumer." To be effective, any consent must meet three requirements:

(i) the consent must be "in a form distinct and separate from any form setting forth other legal or financial obligations of the consumer;"

(ii) "at the election of the consumer—" the consent must be "given at the time the disclosure is sought" or be given "in advance for a set period of time, not to exceed 2 years or until consent is withdrawn by the consumer, whichever is sooner; and"

(iii) "the video tape service provider [must have] provided an opportunity, in a clear and conspicuous manner, for the consumer to withdraw on a case-by-case basis or to withdraw from ongoing disclosures, at the consumer's election."

18 U.S.C. § 2710(b)(2)(B). The Star Tribune argues that its Privacy Policy referenced in its Terms of Use binds Mr. Feldman and meets the VPPA's safe-harbor criteria. See Mem. in Supp. at 30-32.

The Star Tribune's motion will not be granted on this basis. Though no case has been cited addressing this specific question, whether Mr. Feldman consented to the disclosure of his personally identifiable information in a way that meets § 2710(b)(2)(B) seems like an affirmative defense that the Star Tribune bears the burden to plead and prove. Defense, Black's Law Dictionary (11th ed. 2019); cf. In re: EpiPen Direct Purchaser Litig., No. 20-cv-0827 (ECT/TNL), 2021 WL 147166, at *15 (D. Minn. Jan. 15, 2021). That is how the Star Tribune appears to understand the issue; it does not argue that Mr. Feldman's failure to allege his consent's absence bars his VPPA claim. For an affirmative defense to justify a Rule 12(b)(6) dismissal of a complaint, "the applicability of the defense has to be clearly indicated and must appear on the face of the pleading to be used as the basis for the motion." 5B Charles Alan Wright, Arthur R. Miller & Mary Kay Kane, Federal Practice and Procedure: Civil § 1357 (3d ed. & Apr. 2022 Update) (footnotes omitted). Assuming the Privacy Policy may be considered appropriately at this stage, it does not show that the VPPA's consent safe harbor bars Mr. Feldman's claim. Recall that the VPPA says that the consent must be "in a form distinct and separate from any form setting forth other legal or financial obligations of the consumer." 18 U.S.C. § 2710(b)(2)(B)(i). Legally, no particular authority has been cited interpreting or applying this provision, and the provision receives no specific attention in the parties' briefing. Factually, it is not obvious that the Star Tribune Privacy Policy addresses a consumer's consent to disclosure of his or her video-viewing history, and it appears to cover many legal obligations beyond consent to disclose personally identifiable information under the VPPA. Better to leave the consent/safe-harbor question to be addressed, if at all, on a sufficiently developed factual record and more thorough legal arguments.

ORDER

Based on the foregoing, and on all the files, records, and proceedings herein, IT IS ORDERED THAT Defendant Star Tribune Media Company LLC's Motion to Dismiss [ECF No. 17] is DENIED.