Opinion
23-1147
10-15-2024
MICHAEL SALAZAR, INDIVIDUALLY AND ON BEHALF OF ALL OTHERS SIMILARLY SITUATED, Plaintiff-Appellant, v. NATIONAL BASKETBALL ASSOCIATION, Defendant-Appellee.
JOSHUA I. HAMMACK (Michael L. Murphy, on the brief), Bailey & Glasser, LLP, Washington, D.C., for Plaintiff-Appellant. MATTHEW X. ETCHEMENDY, Vinson & Elkins LLP, Washington, D.C. (Hilary L. Preston, Marisa Antonelli, Vinson & Elkins LLP, New York, NY, on the brief), for Defendant-Appellee. Jordan L. Von Bokern, U.S. Chamber Litigation Center, Washington, D.C.; Adam G. Unikowsky, Jenner & Block LLP, Washington, D.C.; Allison N. Douglis, Jenner & Block LLP, New York, NY, for Amicus Curiae The Chamber of Commerce of the United States of America, in Support of Defendant-Appellee.
Argued: April 2, 2024
Plaintiff-Appellant Michael Salazar appeals from an August 8, 2023 judgment of the United States District Court for the Southern District of New York (Rochon, J.) dismissing his putative class action complaint against Defendant-Appellee the National Basketball Association (NBA) for alleged violations of the Video Privacy Protection Act (VPPA), 18 U.S.C. § 2710. The VPPA makes it unlawful for a "video tape service provider" to "knowingly disclose[], to any person, personally identifiable information concerning any consumer of such provider." 18 U.S.C. § 2710(b)(1). The statute defines "consumer" to mean "any renter, purchaser, or subscriber of goods or services from a video tape service provider." Id. § 2710(a)(1). It does not define the terms "goods or services" and "subscriber."
Salazar alleges that (1) he signed up for the NBA's free online newsletter, meaning he exchanged information including his email address in return for periodic emails from the NBA; (2) he visited the NBA's website, NBA.com, where he watched videos; and (3) the NBA violated the VPPA by knowingly disclosing, without Salazar's permission, certain information about Salazar and the videos he watched.
We must answer two questions on appeal. First, has Salazar pled that he suffered a sufficiently "concrete" injury to confer Article III standing under TransUnion LLC v. Ramirez, 594 U.S. 413 (2021)? Second, did the district court err in holding that Salazar is not a "subscriber of goods or services" based on its reasoning that the online newsletter is not an audiovisual "good or service," and that signing up for the newsletter did not make Salazar a VPPA "subscriber"?
We answer both questions in the affirmative. Salazar's alleged injuries are sufficiently concrete to confer Article III standing. And the district court erred by holding that Salazar is not a "subscriber of goods or services" from the NBA. Accordingly, we VACATE the district court's judgment and REMAND for further proceedings.
JOSHUA I. HAMMACK (Michael L. Murphy, on the brief), Bailey & Glasser, LLP, Washington, D.C., for Plaintiff-Appellant.
MATTHEW X. ETCHEMENDY, Vinson & Elkins LLP, Washington, D.C. (Hilary L. Preston, Marisa Antonelli, Vinson & Elkins LLP, New York, NY, on the brief), for Defendant-Appellee.
Jordan L. Von Bokern, U.S. Chamber Litigation Center, Washington, D.C.; Adam G. Unikowsky, Jenner & Block LLP, Washington, D.C.; Allison N.
Douglis, Jenner & Block LLP, New York, NY, for Amicus Curiae The Chamber of Commerce of the United States of America, in Support of Defendant-Appellee.
Before: RAGGI, LEE, and ROBINSON, Circuit Judges.
ROBINSON, CIRCUIT JUDGE
The Video Privacy Protection Act (VPPA) makes it unlawful for a "video tape service provider" to "knowingly disclose[], to any person, personally identifiable information concerning any consumer of such provider." 18 U.S.C. § 2710(b)(1). Enacted in 1988, the VPPA includes language like "video tape service provider" and "prerecorded video cassette tapes"-terms that invoke a bygone era of video technology. In this case, we must grapple with how the language of this statute applies in today's increasingly online world.
Plaintiff-Appellant Michael Salazar says he signed up for an online email newsletter offered by Defendant-Appellee the National Basketball Association (NBA). He further alleges he visited the NBA's website, NBA.com, where he watched videos. After he watched those videos, his video-watching history and "Facebook ID" (we describe both below) were disclosed to Meta Platforms, Inc. (Meta) without his permission. Those disclosures, Salazar contends, violated the VPPA.
The central question in this appeal is whether Salazar is a "consumer" under the VPPA so that the knowing disclosure by a video tape service provider of his video viewing history violates that statute. The VPPA defines "consumer" to mean "any renter, purchaser, or subscriber of goods or services from a video tape service provider." Id. § 2710(a)(1). But the Act doesn't define most of the words within that definition, including "goods or services" and "subscriber." We must construe both these terms for the first time in this Circuit.
Salazar contends that when he signed up for the NBA's online newsletter through NBA.com, he exchanged personal information in return for emailed NBA-related updates, thereby making him a "subscriber of goods or services," and, accordingly, a VPPA "consumer." And by offering videos on NBA.com, the NBA became a "video tape service provider" prohibited by the VPPA from disclosing the personally identifiable information of consumers like Salazar. So, Salazar submits, when he watched NBA.com videos, and when the NBA then disclosed his Facebook ID and video-watching history to Meta without his consent, the NBA violated the VPPA.
The NBA counters that Salazar is not a VPPA "consumer" because the online newsletter he signed up for is not an audiovisual "good or service," and signing up for the newsletter did not in any event make him a "subscriber" under the statute. It also asserts that Salazar has not pled a sufficiently "concrete" injury to confer Article III standing under the standards set forth by the Supreme Court in TransUnion LLC v. Ramirez, 594 U.S. 413 (2021).
The United States District Court for the Southern District of New York (Rochon, J.) dismissed Salazar's suit in an August 8, 2023 judgment. Although it concluded that Salazar had standing to sue, it ruled for the NBA on the merits, holding that Salazar had not plausibly pled that he is a "consumer" under the VPPA. The court held that the phrase "goods or services" within the VPPA's definition of "consumer" is limited to audiovisual "goods or services"-which the online newsletter is not-and that signing up for an online newsletter did not make Salazar a VPPA "subscriber." See generally Salazar v. National Basketball Association, 685 F.Supp.3d 232 (S.D.N.Y. 2023).
As a threshold matter, we hold that Salazar has pled an injury that confers Article III standing. His core alleged harm-that his personal information was disclosed to a third party, without his consent, in violation of the VPPA-"has a 'close relationship' to a harm traditionally recognized as providing a basis for a lawsuit in American courts": public disclosure of private facts. TransUnion, 594 U.S. at 417. Salazar's injury therefore satisfies Article III standing's concreteness requirement.
On the merits, we hold that the district court erred in determining that Salazar failed to plausibly plead that he is a "consumer" under the VPPA because we conclude that he satisfactorily alleged he was a "subscriber of goods or services" from the NBA. The VPPA's text, structure, and purpose compel the conclusion that that phrase is not limited to audiovisual "goods or services," and the NBA's online newsletter falls within the plain meaning of that phrase. And by trading personal information like his email and IP addresses in return for receiving the online newsletter, Salazar became a "subscriber of" that newsletter. Accordingly, we VACATE the district court's judgment and REMAND for further proceedings.
Unless otherwise indicated, we draw this account from the allegations in Salazar's Class Action Complaint. Since we are evaluating the NBA's motion to dismiss for failure to state a claim, we presume these allegations to be true. See Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009).
I. The NBA, NBA.com, the "Facebook Pixel," and the NBA's Online Newsletter
The NBA is a professional sports league headquartered in New York. It owns the website NBA.com, on which people can watch "a broad selection of video content." Jt. App'x at 10. The NBA says these videos are free.
Salazar also alleges that people can watch these videos through a smartphone application (app). The district court concluded that Salazar "does not allege he downloaded any such application, or even specify what application he is referring to," so "no such claim [based on use of the app] has been adequately pleaded." Salazar v. National Basketball Association, 685 F.Supp.3d 232, 246 n.4 (S.D.N.Y. 2023). Beyond cursorily noting that the NBA delivers video content "[t]hrough NBA.com and an app," Salazar doesn't challenge that conclusion on appeal. Appellant's Br. at 5. He therefore has abandoned any challenges based on the allegations concerning a smartphone application as opposed to a website. See United States v. Quiroz, 22 F.3d 489, 490 (2d Cir. 1994) ("It is well established that an argument not raised on appeal is deemed abandoned[.]" (internal quotation marks omitted)).
Salazar doesn't allege that he had to pay any money to watch the videos. But he does plead that the NBA, using certain bits of code, extracts information from NBA.com video-watchers like him.
The code most relevant to this case is a "tracking pixel"-a piece of code embedded on a website someone visits. As its name suggests, a tracking pixel tracks users as they navigate the website, reporting back to the pixel's owner. The information tracked depends on the tracking pixel's configuration.
Here, Salazar alleges that Meta owns a tracking pixel, which we call the "Facebook Pixel." The NBA has installed the Facebook Pixel on NBA.com. Meta coded that pixel to collect and send to it (1) the title of the NBA.com video a user watched, (2) that video's URL, and (3) the user's "Facebook ID" (FID)-a number unique to each individual Facebook account. Id. at 15. We call this disclosed information "personal viewing information."
By possessing the video title and URL of watched videos associated with a given FID, Meta can link a given Facebook profile to those watched videos. And with that information, Meta can send a user targeted advertisements. The NBA receives financial renumeration from this arrangement.
The NBA also allows people to sign up for an "online newsletter." Id. at 12. Here too, Salazar doesn't contend that he had to pay any money to sign up for the newsletter. Instead, he alleges that he gave the NBA certain personal information, and in return, the NBA sent him "emails and other communications." Id. at 12, 19.
II. Salazar's Allegations
Salazar's VPPA claim rests on three primary allegations: (1) he has a Facebook account; (2) he signed up for the NBA's online newsletter; and (3) he watched NBA.com videos while logged into his Facebook account.
First, since 2010, Salazar "has had a Facebook account." Id. at 10, 20. He therefore has an FID associated with that account.
Second, starting in 2022, Salazar "signed up for a digital subscription to NBA.com." Salazar, 685 F.Supp.3d at 237; see also Jt. App'x at 10, 19-20. In doing so, he gave NBA.com information including his email address, IP address, "and any cookies associated with his device" in return for "emails and other communications" from the NBA. Jt. App'x at 19.
An IP address is "the numeric address of a computer on the Internet" that typically consists of "four parts separated by dots and containing up to three digits in each part." IP Address, Merriam-Webster's Unabridged Dictionary, https://unabridged.merriam-webster.com/unabridged/ip%20address [https://perma.cc/8DK2-U6F9] (last visited Sept. 4, 2024). Salazar alleges that his IP address "informs Defendant as to the city and zip code he resides in as well as his physical location." Jt. App'x at 19.
A "cookie" is "a small file or part of a file that is stored on the computer of a World Wide Web user, that is created and subsequently read by a website server, and that contains personal user information (such as a user identification code, customized preferences, or a record of pages visited)." Cookie, Merriam-Webster's Unabridged Dictionary, https://unabridged.merriam- webster.com/unabridged/cookie [https://perma.cc/GFE3-ALB9] (last visited Sept. 4, 2024). There are presently no allegations in Salazar's complaint that he watched or accessed NBA.com videos through the online newsletter. He has, however, submitted that he could amend his complaint to plausibly allege that "the NBA's online newsletter gave subscribers 'exclusive content or enhanced access' to video content." Appellant's Br. at 34-35 (quoting Jt. App'x at 210).
Third, also starting in 2022, Salazar has watched NBA.com videos through NBA.com "while logged into his Facebook account." Jt. App'x at 10. Watching videos while logged into his Facebook account caused his personal viewing information to be transmitted to Meta. See id. Salazar alleges that the NBA didn't give him notice that it was disclosing his personal viewing information; nor did it ask for his consent.
Salazar's complaint specifies that when he watched NBA.com videos "while logged into his Facebook account," his personal viewing information was disclosed to Meta due to the website's use of the Facebook Pixel. Jt. App'x at 10, 15-16. For purposes of this appeal, we need not delve into the technical mechanics of that disclosure. It is enough to presume that what Salazar alleges is true-when he (1) was logged into his Facebook account and (2) watched a video on NBA.com, his personal viewing information was transmitted to Meta because the NBA had installed the Facebook Pixel on its website.
Putting the pieces together, Salazar alleges that signing up for the online newsletter made him a "subscriber of goods or services," and, therefore, a "consumer" under the VPPA. And watching videos on NBA.com caused his "personally identifiable information"-his personal viewing information-to be disclosed to Meta without his consent. So, Salazar says, the NBA violated the VPPA.
III. District Court Proceedings
Salazar filed his putative class action complaint in September 2022, purporting to represent "[a]ll persons in the United States with a digital subscription to an online website owned and/or operated by [the NBA] that had their Personal Viewing Information disclosed to [Meta] by [the NBA]." Id. at 20. He raised a single cause of action: violation of the VPPA.
The NBA moved to dismiss pursuant to Federal Rules of Civil Procedure 12(b)(1) and 12(b)(6). It sought dismissal under Rule 12(b)(1) for lack of subject matter jurisdiction because Salazar did not allege a sufficiently concrete injury to confer Article III standing, and alternatively under Rule 12(b)(6) because Salazar failed to state a claim upon which relief can be granted.
On the merits, the NBA primarily argued that Salazar was not a "consumer" under the VPPA since he was not a "renter, purchaser, or subscriber of goods or services from a video tape service provider." Id. at 49 (quoting 18 U.S.C. § 2710(a)(1)). It stressed that the online newsletter was not an audiovisual good or service, and thus did not qualify as "goods or services" under the VPPA. And it argued that, in any event, signing up for the newsletter did not make him a VPPA "subscriber." The NBA also argued in the alternative that it did not "knowingly disclose" any personally identifiable information to Meta.
We express no view on whether the NBA's disclosure, as alleged by Salazar, constitutes a "knowing[]" disclosure by the NBA. 18 U.S.C. § 2710(b)(1). The NBA also argued in the alternative to the district court that Salazar had consented to disclosure of his personally identifiable information by assenting to the NBA's privacy policy. Salazar concedes that NBA.com's privacy policy states that it collects certain "Personal Information" from site visitors. But he contends that this policy doesn't say that the NBA "will share digital subscribers' private and protected Personal Viewing Information with third parties, including [Meta]." Jt. App'x at 14-15. As a result, he alleges, the NBA failed to satisfy the VPPA's consent requirements. The NBA does not raise this argument on appeal and concedes the argument should be left for the district court to address in the first instance given that its resolution will require "detailed examination of the NBA's Privacy Policy and Mr. Salazar's factual allegations showing his acceptance of that policy." Appellee's Br. at 52 n.16. We agree. The NBA also argued before the district court that it should dismiss Salazar's class allegations because the NBA's Terms of Use provision, to which it says Salazar agreed, includes an enforceable class action waiver. The NBA concedes here that this "argument is not an alternative basis for affirming the" court's dismissal "of the entire complaint," so "it is not properly resolved on this appeal." Id. Accordingly, this argument is not before us in this appeal.
In an August 2023 opinion, the district court denied the NBA's motion to dismiss for lack of standing but granted its motion to dismiss for failure to state a claim. See Salazar, 685 F.Supp.3d at 247.
With respect to Article III standing, the court explained that Salazar's alleged harm-deprivation of privacy rights based on the NBA's non-consensual disclosure of his personal viewing information-was closely related to two traditionally recognized common-law analogs: disclosure of private facts and intrusion upon seclusion. See id. at 239-42. Accordingly, the court held that Salazar pled a concrete Article III injury under TransUnion. Id. at 242.
On the merits, the court concluded that Salazar failed to plead a VPPA claim because he had not plausibly alleged that he was a VPPA "consumer." Id. at 246. It rejected Salazar's argument that his signing up for the online newsletter made him a "subscriber" under the VPPA, reasoning that "the VPPA only applies to consumers (including subscribers) of audio video services." Id. at 244. The court also rejected Salazar's argument that the newsletter's links to videos available on NBA.com affect the calculus. It reasoned that the newsletter's inclusion of links to content otherwise "generally accessible on the NBA.com website" did not constitute a sufficient exchange of value to create a subscriber relationship "given the lack of allegations regarding exclusive content or enhanced access" to audiovisual services through the newsletter. Id. at 245-46.
Because the court concluded that Salazar had not plausibly alleged that he was a VPPA "consumer," it did not address the NBA's remaining arguments. Id. at 246. It further denied Salazar's "blanket request for leave to amend his Complaint 'to address any issues the Court raises in its Order'" since Salazar had the opportunity to view the NBA's arguments for dismissal and didn't describe the substance of a proposed amendment. Id. at 246-47. The court therefore entered judgment dismissing the case, which Salazar timely appealed.
DISCUSSION
The NBA argues that the district court erred by concluding that Salazar has Article III standing to sue. Salazar contends that the court erred on the merits by holding that he is not a "consumer" as defined in the VPPA.
We hold that Salazar sufficiently pled that he has Article III standing and that he is a "subscriber of goods or services from a video tape service provider" and therefore a "consumer" under the VPPA. 28 U.S.C. § 2710(a)(1). We elaborate below.
I. Standing
We start by evaluating whether Salazar has adequately pled injury as necessary to demonstrate Article III standing to sue for a violation of the VPPA. He has. Salazar's alleged injury stems from the unauthorized disclosure of his personal viewing information, which is closely related to at least one common-law analog traditionally recognized as providing a basis for a lawsuit in American courts: public disclosure of private facts.
Since "standing is challenged on the basis of the pleadings, we accept as true all material allegations of the complaint," which we construe "in favor of the complaining party." Bohnak v. Marsh & McLennan Companies, Inc., 79 F.4th 276, 283 (2d Cir. 2023) (internal quotation marks omitted). We do so in this context without deferring to the district court. Id.
A federal court lacks subject matter jurisdiction-and therefore cannot consider a lawsuit's merits-unless three constitutional standing requirements are met. First, the plaintiff must have suffered an "injury in fact that is concrete, particularized, and actual or imminent." TransUnion, 594 U.S. at 423. Second, that injury must be traceable to the defendant's challenged conduct-it must have been "likely caused by the defendant." Id. And third, it must be likely that the injury would "be redressed by judicial relief." Id. As "[t]he party invoking federal jurisdiction," Salazar bears the burden of establishing Article III standing. Lujan v. Defenders of Wildlife, 504 U.S. 555, 561 (1992).
The NBA argues that Salazar has not alleged that he has suffered a "concrete" injury in fact. We disagree.
Article III standing requires that "[o]nly those plaintiffs who have been concretely harmed by a defendant's statutory violation may sue that private defendant over that violation in federal court." TransUnion, 594 U.S. at 427; see also Bohnak, 79 F.4th at 283 (explaining that "TransUnion is the touchstone for" assessing the concreteness requirement). To allege a concrete harm, a plaintiff must point to "a close historical or common-law analogue for their asserted injury." TransUnion, 594 U.S. at 424. But they need not present an "exact duplicate." Id. at 433. Rather, "what matters is 'whether the alleged injury to the plaintiff has a 'close relationship' to a harm 'traditionally' recognized as providing a basis for a lawsuit in American courts.'" Packer on behalf of 1-800-Flowers.Com, Inc. v. Raging Capital Management, LLC, 105 F.4th 46, 52 (2d Cir. 2024) (quoting TransUnion, 594 U.S. at 424).
Both tangible and intangible harms can satisfy the concreteness requirement. "[T]raditional tangible harms" like physical and monetary harms "readily qualify as concrete." TransUnion, 594 U.S. at 425. So do "[v]arious intangible harms" closely related to a traditionally recognized harm. Id.
One intangible harm that readily qualifies as concrete is the public disclosure of private facts. Id. This "well-established common-law analog," Bohnak, 79 F.4th at 285, is triggered when one "gives publicity to a matter concerning the private life of another, . . . if the matter publicized is of a kind that (a) would be highly offensive to a reasonable person, and (b) is not of legitimate concern to the public," id. (quoting Restatement (Second) Torts § 652D).
Because we hold that Salazar's alleged harm is closely related to the public disclosure of private facts analog, we need not examine whether it is closely related to the other analog the district court identifies: the "intrusion upon seclusion" tort. Cf. Eichenberger v. ESPN, Inc., 876 F.3d 979, 983-84 (9th Cir. 2017) (holding, preTransUnion, that an alleged VPPA violation was related to the intrusion upon seclusion tort); Perry v. Cable News Network, Inc., 854 F.3d 1336, 1340-41 (11th Cir. 2017) (same).
Our conclusion that Salazar has pled that he suffered an injury closely related to the public disclosure of private facts analog is guided by our recent decision in Bohnak. There, Bohnak had sued her former employer for failing to adequately protect and warn her about the vulnerability of personal information including her social security number, driver's license, and passport information. That information was stolen when her employer was targeted in a data breach. Id. at 280-82.
We had "no trouble" concluding that "Bohnak's alleged harm [wa]s sufficiently concrete to support her claims for damages" because her core alleged injury-exposure of her personally identifiable information to unauthorized third parties-"bears some relationship to a well-established common-law analog: public disclosure of private facts." Id. at 285. In reaching this conclusion, we stressed that "[i]n TransUnion itself, the Supreme Court specifically recognized that 'disclosure of private information' was an intangible harm 'traditionally recognized as providing a basis for lawsuits in American courts.'" Id. at 286 (quoting TransUnion, 594 U.S. at 425). And because Bohnak's alleged harm was closely related to a common-law analog, it did not matter whether she had "assert[ed] a common law claim for public disclosure of private facts" against her employer or whether the relevant "common law recognize[d] a tort relating to publication of private facts." Id. at 286.
For these reasons, we similarly have "no trouble" holding here that Salazar's alleged harm is sufficiently concrete to withstand dismissal. Id. at 285. Like Bohnak, Salazar's core allegation is that his personally identifiable information was exposed to an unauthorized third party. Jt. App'x at 24. And Salazar doesn't just allege that his data was exposed to a third party; rather, he asserts that it was disclosed as a result of an arrangement between the NBA and Meta pursuant to which the NBA deliberately uses the Facebook Pixel. This alleged harm is closely related to the public disclosure of private facts analog.
The NBA's arguments to the contrary are unpersuasive. To the NBA, the disclosure in Bohnak-to hackers through a data breach-is quite different from "limited disclosures to a single legitimate business" like Meta because hackers have a "known penchant for trading illegally acquired [personally identifiable information] 'through the dark web,'" thereby making the disclosure in Bohnak more analogous to a public disclosure of private facts than the disclosure of Salazar's information to Meta. Appellee's Br. at 24 n.7 (quoting Bohnak, 79 F.4th at 281).
Based on this asserted lack of publicity, the NBA insists that Salazar's allegations of injury are more like those held insufficient in cases from other circuits involving mail vendor corporations and a different statute: the Fair Debt Collection Practices Act (FDCPA). In those cases, plaintiffs sued debt collection agencies for violating the FDCPA by giving their personal information to mail vendors, which then used the disclosed information to send the plaintiffs prewritten letters notifying them about their outstanding debts. See Appellee's Br. at 21-25 (citing Hunstein v. Preferred Collection & Management Services, Inc., 48 F.4th 1236, 1240 (11th Cir. 2022) (en banc); Shields v. Professional Bureau of Collections of Maryland, Inc., 55 F.4th 823, 827 (10th Cir. 2022); Nabozny v. Optio Solutions LLC, 84 F.4th 731, 733 (7th Cir. 2023). These courts concluded that any harm from such limited disclosures-to mail vendors who then sent the information back to its owner-was not closely related to harm from the public disclosure of private facts analog. See Hunstein, 48 F.4th at 1245-49; Shields, 55 F.4th at 828-29; Nabozny, 84 F.4th at 735-38.
The NBA also cites some of these cases to suggest that an alleged harm isn't closely related to a common-law analog if the plaintiff doesn't plead a required element of that analog. See, e.g., Hunstein v. Preferred Collection and Management Services, Inc., 48 F.4th 1236, 1242 (11th Cir. 2022) (en banc) (holding that Hunstein's alleged harm wasn't closely related to the public disclosure of private facts tort because his allegations were "missing an element essential to liability": "disclosure to the public") (internal quotation marks omitted). Not every circuit has adopted that approach. See, e.g., Shields v. Professional Bureau of Collections of Maryland, Inc., 55 F.4th 823, 829 (10th Cir. 2022) ("Shields did not have to plead and prove the tort's elements to prevail. But to proceed, she had to at least allege a similar harm."); Barclift v. Keystone Credit Services, LLC, 93 F.4th 136, 145 (3d Cir. 2024) ("We believe that if the Court wanted us to compare elements, it would have simply said so. So when asking whether a plaintiff's intangible injury is 'concrete,' we will examine the kind of harm at issue."), petition for cert. filed, No. 23-1327 (June 20, 2024). Nor have we. This Court has applied TransUnion in at least four published opinions to determine whether an alleged harm satisfies Article III standing's concreteness requirement. We did not, in any of those cases, hold that TransUnion demands that a plaintiff adequately plead every element of a common-law analog to satisfy the concreteness requirement. See Maddox v. Bank of New York Mellon Trust Company, N.A., 19 F.4th 58, 62-66 (2d Cir. 2021); Bohnak v. Marsh &McLennan Companies, Inc., 79 F.4th 276, 283-87 (2d Cir. 2023); Saba Capital Cef Opportunities 1, Ltd. v. Nuveen Floating Rate Income Fund, 88 F.4th 103, 114-17 (2d Cir. 2023); Packer on behalf of 1-800 Flowers.Com, Inc. v. Raging Capital Management, LLC, 105 F.4th 46, 51-56 (2d Cir. 2024); see also Stafford v. International Business Machines Corporation, 78 F.4th 62, 67-69 (2d Cir. 2023) (applying TransUnion to the mootness doctrine, which "is standing set in a time frame") (internal quotation marks omitted). Instead, we followed the Supreme Court's directive in TransUnion that the concrete injury requirement for standing does not demand that a plaintiff alleging intangible harm identify and establish an "exact duplicate" in common law, but asks "whether a plaintiff's asserted harm has a 'close relationship' to a harm traditionally recognized as providing a basis for a lawsuit in American courts." TransUnion LLC v. Ramirez, 594 U.S. 413, 433-34 (2021) (stating that "publication is essential to liability" in explaining why "mere presence of an inaccuracy in an internal credit file" that was not disclosed to third-party was not analogous to harm from defamatory statement, without suggesting that plaintiff must satisfy all elements of defamation to show "close relationship" to defamation analog (internal quotation marks omitted)); see id. at 433 (holding dissemination of misleading credit reports is analogous to harm from defamation even though defendant asserted reports were "only misleading and not literally false," because harm from misleading statement of "being labeled a 'potential terrorist' . . . bears a sufficiently close relationship to the harm from a false and defamatory statement").
Glossing over the numerous factual and legal distinctions between the mail vendor cases and Salazar's allegations, the NBA submits that the mail vendor "cases are on all fours" with this one because they all involve "limited disclosures to a single legitimate business." Appellee's Br. at 23, 24 n.7. The analogy is inapt. Meta isn't a "ministerial intermediary" like a mail vendor, Nabozny, 84 F.4th at 736-it's one of the world's largest companies, employing more than 67,000 people, with 2024 revenues exceeding $142 billion, see Forbes, Profile, Meta Platforms, https://www.forbes.com/companies/meta-platforms/?list=global2000 [https://perma.cc/8S94-9M7A] (last visited Sept. 4, 2024).
More to the point, Meta's use of the disclosed data is very different from that of the mail vendor. Unlike in the mail vendor cases, Salazar doesn't allege that his personal viewing information was disclosed to an intermediary so that it could be bounced back to him on behalf of the entity that properly possessed the information. One of Salazar's allegations is that the NBA discloses users' personal viewing information to Meta, which then harnesses that information "to show the user targeted ads"-ads that Meta chooses for its own commercial purposes, not the NBA's or the user's purposes. Jt. App'x at 15 (emphasis added). Moreover, nothing in the complaint suggests that Meta can't sell, disclose, or otherwise use Salazar's data for additional purposes. In addition, Salazar alleges that Meta "cross-referenc[es]" "this highly sought-after information" "to the data it already has in [its] own detailed profiles." Id. at 16-17. And the information is being used for digital advertising, id. at 15-16, an industry that "underlies many of the Internet's most widely used services," Brief of the Chamber of Commerce of the United States of America as Amicus Curiae in Support of Defendant-Appellee at 15.
Given the nature of the companies involved, intended and potential uses of the disclosed information, and resulting enhanced disclosure risks, we see little daylight between the nature of the harm Salazar alleges and the harm flowing from the public disclosure of private facts common-law analog. Therefore, Salazar has satisfactorily pled a concrete injury sufficient to confer Article III standing and to withstand dismissal under Rule 12(b)(1).
The NBA does not argue that Salazar has otherwise failed to plead that his alleged injury satisfies Article III standing requirements at the motion to dismiss stage. That makes sense. His alleged injury in fact is particularized and actual- his personal viewing information was disclosed without his consent to a third party. That alleged harm is traceable to the NBA's installation of the Facebook Pixel on NBA.com. And Salazar's requested relief-declaratory, injunctive, and monetary relief for violating the VPPA-would likely redress his injury. Accordingly, Salazar has alleged a sufficient harm to confer Article III standing, and the district court correctly denied the NBA's motion to dismiss for lack of subject matter jurisdiction.
II. Merits
To survive Rule 12(b)(6) dismissal, a complaint's factual allegations must "state a claim to relief that is plausible on its face." Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 570 (2007). On appeal, we review the complaint without deference to the district court's assessment, accepting as true all its factual allegations and drawing all inferences in the plaintiff's favor. See Nicosia v. Amazon.com, Inc., 834 F.3d 220, 230 (2d Cir. 2016); Peretti v. Authentic Brands Group LLC, 33 F.4th 131, 137 (2d Cir. 2022). That means the plaintiff's allegations must enable the court to reasonably infer that the defendant is liable for the alleged misconduct. Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009).
Applying these standards, we must determine whether Salazar plausibly pled that he was a "subscriber of goods or services" as understood in the VPPA. For the reasons set forth below, we conclude that he did. The phrase "goods or services" in the VPPA is not cabined to audiovisual goods or services, but also reaches the NBA's online newsletter. By alleging that he exchanged personal information in return for periodically receiving the online newsletter, Salazar plausibly pled that he is a "subscriber of" that newsletter.
A. The VPPA
In 1987, a newspaper published an article called The Bork Tapes, see Michael Doland, The Bork Tapes, Washington City Paper (Sept. 25, 1987), which identified 146 films that Judge Robert Bork and his family had rented from a video store. At the time of publication, the Senate Judiciary Committee was holding hearings on Judge Bork's nomination to the Supreme Court. See S. Rep. No. 100-599, at 5 (1988); Ellis v. Cartoon Network, Inc., 803 F.3d 1251, 1252-53 (11th Cir. 2015); Yershov v. Gannett Satellite Information Network, Inc., 820 F.3d 482, 485 (1st Cir. 2016).
Senators quickly decried the publication. As Senator Patrick Leahy commented during the nomination hearings:
It is nobody's business what Oliver North or Robert Bork or Griffin Bell or Pat Leahy watch on television or read or think about when they are home.... In an era of interactive television cables, the growth of computer checking and check-out counters, of security systems and telephones, all lodged together in computers, it would be relatively easy at some point to give a profile of a person and tell what they buy in a store, what kind of food they like, what sort of television programs they watch, who are some of the people they telephone.... I think that is wrong. I think that really is Big Brother, and I think it is something that we have to guard against....
Privacy is not a conservative or a liberal or moderate issue. It is an issue that goes to the deepest yearnings of all Americans that we are free and we
cherish our freedom and we want our freedom. We want to be left alone.
S. Rep. No. 100-599, at 5-6 (quoting Hearings on Nomination of Robert H. Bork to be Associate Justice of the Supreme Court of the United States Before the Senate Committee on the Judiciary, 100th Cong. 1374 (1987)) (alterations adopted).
The Bork Tapes was the catalyst for the VPPA. See id. at 5; S. Rep. No. 112258, at 2 (2012); Ellis, 803 F.3d at 1252-53. A bipartisan group of Senators, including Senator Leahy, introduced legislation in May 1988 "to preserve personal privacy with respect to the rental, purchase, or delivery of video tapes or similar audio visual materials." S. 2361, 100th Cong. (1988); see also S. Rep. No. 100-599, at 1 (same). That bill became the VPPA. See Video Privacy Protection Act of 1988, Pub. L. No. 100-618, 102 Stat. 3195.
The VPPA prohibits a "video tape service provider" from "knowingly disclos[ing], to any person, personally identifiable information concerning any consumer of such provider," subject to certain enumerated exceptions, such as in cases where the provider has obtained a consumer's "informed, written consent." 18 U.S.C. § 2710(b). The Act thereby "reflects the central principle of the Privacy Act of 1974: that information collected for one purpose may not be used for a different purpose without the individual's consent." S. Rep. No. 100-599, at 8.
By 2012, Congress recognized that "the Internet ha[d] revolutionized the way that American consumers rent and watch movies and television programs," such that the way "Americans used to watch videos in 1998-the VHS cassette tape-[wa]s now obsolete." S. Rep. 112-258, at 2. These new technologies had created a problem: Americans couldn't "share information about their video preferences on social media sites on an ongoing basis" without violating the 1988 VPPA, which required obtaining consent from the consumer for each disclosure of viewing information. Id. at 2-3. The solution? Amend the statute "to clarify that a video tape service provider may obtain a consumer's informed, written consent on an ongoing basis and that consent may be obtained through the Internet." Video Privacy Protection Act Amendments Act of 2012, Pub. L. 112-258, 126 Stat. 2414; see 18 U.S.C. § 2710(b)(2)(B) (authorizing a video tape service provider to disclose consumers' personally identifiable information "to any person with the informed, written consent (including through an electronic means using the Internet) of the consumer" provided either "at the time the disclosure is sought" or "in advance for a set period of time, not to exceed 2 years or until consent is withdrawn by the consumer, whichever is sooner").
Otherwise, much of the 1988 VPPA's text remains unchanged. Like the original version, the current VPPA holds liable "[a] video tape service provider who knowingly discloses, to any person, personally identifiable information concerning any consumer of such provider." 18 U.S.C. § 2710(b)(1). And the Act provides consumers with a private right of action for violations of the statute. Id. § 2710(c) (authorizing award of "actual damages but not less than liquidated damages in an amount of $2,500," punitive damages, reasonable attorneys' fees and litigation costs, and appropriate "preliminary and equitable relief").
Central to this case is the VPPA's "Definitions" section. See id. § 2710(a). The VPPA defines the term "consumer" to mean "any renter, purchaser, or subscriber of goods or services from a video tape service provider." Id. § 2710(a)(1). But the phrase "subscriber of goods or services" is not explicitly defined in the statute. Our task here is to construe that phrase. The parties have focused their arguments on two questions: Is the digital newsletter a "good or service"? And is Salazar a subscriber? We consider each in turn.
B. "Goods or Services"
The parties contest whether the online newsletter Salazar signed up for qualifies as "goods or services" as that phrase is used in the VPPA. The NBA doesn't contend that the newsletter is not a good or service generally; rather, it insists that statutory context compels the conclusion that a consumer under the VPPA must specifically rent, purchase, or subscribe to audiovisual "goods or services." The NBA reasons that because the VPPA defines a "consumer" as one who rents, purchases, or subscribes to services "from a video tape service provider," id. at § 2710(a)(1) (emphasis added), those services must, by definition, be audiovisual services. Salazar disagrees and argues that nothing in the statute limits the definition of "consumer" to those who rent, purchase, or subscribe to a particular class of services-namely, audiovisual content.
Considering the text, structure, and purpose of the VPAA, we agree with Salazar. And we conclude that the NBA's policy based counterarguments are unpersuasive.
i. Text, Structure and Purpose
When interpreting a statutory provision, we start with the text. See Wisconsin Central Limited v. United States, 585 U.S. 274, 277 (2018). Because the VPPA does not define the phrase "goods or services," we presume that its plain meaning applies. See Perrin v. United States, 444 U.S. 37, 42 (1979) ("A fundamental canon of statutory construction is that, unless otherwise defined, words will be interpreted as taking their ordinary, contemporary, common meaning."). In assessing the words' plain meaning, we consider "the language itself, the specific context in which that language is used, and the broader context of the statute as a whole." Robinson v. Shell Oil Co., 519 U.S. 337, 341 (1997). Applying this guidance, we conclude that the plain language of the "consumer" definition, the VPAA's terminology in other sections, and the structure of the statute as a whole support Salazar's view. And his read is entirely consistent with the statute's purpose.
Congress defined "consumer" as "any renter, purchaser, or subscriber of goods or services from a video tape service provider." 18 U.S.C. § 2710(a)(1) (emphasis added). "[R]ead naturally, the word 'any' has an expansive meaning." Ali v. Federal Bureau of Prisons, 552 U.S. 214, 219 (2008) (internal quotation marks omitted). And a statute's use of the word "'or' is 'almost always disjunctive.'" Encino Motorcars, LLC v. Navarro, 584 U.S. 79, 87 (2018) (quoting United States v. Woods, 571 U.S. 31, 45 (2013)). So by using expansive words like "any" and "or," Congress codified a "consumer" definition that "bespeaks breadth." Id.
Comparing this language to other definitions in the statute reinforces this conclusion. Congress deployed similarly broad language in the "video tape service provider" definition. That definition classifies "any person, engaged in the business, in or affecting interstate or foreign commerce, of rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials" as a "video tape service provider." 18 U.S.C. § 2710(a)(4) (emphasis added). But while the "consumer" and "video tape service provider" definitions share similarly expansive language, there is also a critical distinction between the two provisions:
Unlike the "consumer" definition, which makes no mention of audiovisual materials, the "video tape service provider" definition requires the provider to deal in "audio visual materials." Id. This meaningful variation shows that Congress knew to include an audiovisual limitation in the VPPA when it wanted one to apply. In fact, Congress twice deploys the term "audio visual material" (or materials) in the VPAA-first in the "video tape service provider" definition, and next in a provision establishing when a video tape service provider may lawfully disclose personally identifiable information. See id. § 2710(a)(4), (b)(2)(D)(ii). As the Supreme Court has instructed, we should not "lightly assume that Congress has omitted from its adopted text requirements that it nonetheless intends to apply," especially when it "has shown elsewhere in the same statute that it knows how to make such a requirement manifest." Jama v. Immigration and Customs Enforcement, 543 U.S. 335, 341 (2005); see also Yale New Haven Hospital v. Becerra, 56 F.4th 9, 21 (2d Cir. 2022) (explaining principle of meaningful variation, i.e., "where a statutory scheme has used one term in one place, and a materially different term in another, the presumption is that the different term denotes a different idea" (quoting Southwest Airlines Co. v. Saxon, 596 U.S. 450, 458 (2022)) (alterations adopted)).
In the "video tape service provider" definition, the relevant text is plural: "audio visual materials." 18 U.S.C. § 2710(a)(4). In the provision enumerating when a video tape service provider may lawfully disclose personally identifiable information, the language is singular: "audio visual material." Id. § 2710(b)(2)(D)(ii).
This textual divergence highlights the flaw in the NBA's argument that the "consumer" and "video tape service provider" definitions share "a suggestively parallel structure" that supports reading an audiovisual limitation into the definition of "goods or services." Appellee's Br. at 31. To the NBA, the phrase "renter, purchaser, or subscriber" in the "consumer" definition is parallel to the "rental, sale, or delivery" language in the "video tape service provider" definition. That means, the NBA says, the term "goods or services" must be parallel to "prerecorded video cassette tapes or similar audio visual materials," with a similarly cabined scope. Compare 18 U.S.C. § 2710(a)(1), with id. § 2710(a)(4).
We need not decide whether the phrase "renter, purchaser, or subscriber" in the definition of "consumer" is intended to mirror the phrase "rental, sale or delivery" in the definition of "video tape service provider." Even if that were correct, it would not support the NBA's conclusion that the term "goods or services" in the definition of "consumer" mirrors the term "prerecorded video cassette tapes or similar audio visual materials" in the "video tape service provider" definition. Tellingly, Congress chose to deviate from any parallelism by using the terms "goods or services" in the "consumer" definition and "prerecorded video cassette tapes or similar audio-visual materials" in the "video tape service provider" definition. Again, Congress's decision to use different words in different definitions strongly signals its intent to convey different meanings. See Jama, 543 U.S. at 341.
Salazar actually relies on the same parallelism to make a different argument-one we also need not reach. He argues that "renter" in the definition of "consumer" mirrors "rental" in the definition of "video tape service provider," and "purchaser" mirrors "sale," so "subscriber" must mirror "delivery." Following this logic, a "subscriber" is someone who receives goods or services. Under that interpretation, someone who simply watches online videos could be considered a VPPA "consumer."
In addition, the NBA's interpretation is hard to harmonize with other language in the statute. The definition of "personally identifiable information" includes "information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider." Id. § 2710(a)(4) (emphasis added). But if "goods or services" are, by definition, audiovisual materials, then Congress's express restriction in the definition of "personally identifiable information" to information about "video materials or services" would be superfluous. See generally Corley v. United States, 556 U.S. 303, 314 (2009) (holding that a "statute should be construed . . . so that no part will be inoperative or superfluous" (internal quotation marks omitted)).
We are likewise unpersuaded by the NBA's reliance on the title of the VPAA's liability provision: "Video Tape Rental and Sale Records." 18 U.S.C. § 2710(b). The NBA argues that by explicitly tying "video" to "rental and sale records" in that title, Congress showed that the relationship between consumers and providers is restricted to those who rent, purchase, or subscribe to videos.
There are at least two problems with this argument. First, headings and titles in statutes "cannot limit the plain meaning of the text." Rajah v. Mukasey, 544 F.3d 427, 436 (2d Cir. 2008) (internal quotation marks omitted). Second, the title of the liability provision tells us little about the meaning of "consumer" in the VPPA. The parties agree that sharing information that is not about video materials or services is beyond the scope of the statute. But as explained further below, it's the definition of "personally identifiable information" that limits what can be shared, not the definition of "consumer."
Nor are we persuaded by the NBA's argument that the phrase "from a video tape service provider" somehow cabins "goods or services" to audiovisual goods or services." The definition of "video tape service provider" is broad, encompassing "any person[] engaged in the business . . . of rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials." 18 U.S.C. § 2710(a)(4) (emphasis added). That definition is not limited to entities that deal exclusively in audiovisual content; rather, audiovisual content need only be part of the provider's book of business. 18 U.S.C. § 2710(a)(4). Thus, by its plain terms, the statute applies equally to a business dealing primarily in audiovisual materials (think Blockbuster) and one dealing in primarily non-audiovisual materials (think a general store that rents out a few movies). Congress cast a wide net in defining "video tape service provider," to ensure that businesses dealing in audiovisual goods or services satisfy the definition even if they also deal in non-audiovisual goods or services.
We express no view on whether the VPPA applies only to businesses dealing in "prerecorded" audiovisual goods or services as opposed to "live" video services, an issue not presented in this appeal.
Given that "video tape service provider" is defined broadly to include even those businesses that dabble in video rentals, it makes sense that "consumer" should be understood to encompass a renter, purchaser, or subscriber of any of the provider's "goods or services"-audiovisual or not. Under the VPPA's expansive language, such a business may not disclose "personally identifiable information" pertaining to its consumers regardless of the particular goods or services rented, purchased, or subscribed to.
This is not to say the VPPA's reach is boundless. As noted above, the statute only prohibits video tape service providers from "knowingly disclos[ing] personally identifiable information." 18 U.S.C. § 2710(b)(1) (emphasis added). And the "personally identifiable information" definition "includes information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider." Id. § 2710(a)(3) (emphasis added). That means the general store owner who also rented out a few movies wouldn't be liable under the VPPA for disclosing particular customers' bread-buying habits; that information, which does not relate to video materials or services, is not "personally identifiable information" under the VPAA.
True, the "personally identifiable information" definition uses the word "include." Some of the legislative history suggests that Congress intentionally used that word to help keep the "personally identifiable information" term broad, too. See S. Rep. No. 100-599, at 12 (1988) ("[P]aragraph (a)(3) uses the word 'includes' to establish a minimum, but not exclusive, definition of personally identifiable information.") But that Senate report also stresses that the VPPA's definition of "personally identifiable information" contains the word "video" to make clear that only audiovisual information is protected. See id. ("[T]he definition of personally identifiable information includes the term 'video' to make clear that simply because a business is engaged in the sale or rental of video materials or services does not mean that all of its products or services are within the scope of the bill. For example, a department store that sells video tapes would be required to extend privacy protection to only those transactions involving the purchase of video tapes and not other products."). So while there may be breathing room in the statute to explore what exactly is "personally identifiable information"-we need not and do not explore that argument in this appeal-the VPPA's text, structure and purpose make clear that the disclosed information must still be related to audiovisual materials or services.
Our read of the statute not only reflects the language and structure of the VPAA; it's also "consistent with Congress's intended purpose." Bustamante v. Napolitano, 582 F.3d 403, 410 (2d Cir. 2009). As we explained above, Senate
Judiciary Committee members understood the VPPA to "prohibit[] video service providers from disclosing personally identifiable information except in certain, limited circumstances." S. Rep. No. 100-599, at 5; see also S. Rep. No. 112-258, at 2 (same). Grafting unstated limitations on the broad definition of "consumer," and by extension, "goods or services," would be inconsistent with Congress's purpose here.
ii. NBA's Policy Arguments
Given the clear meaning of the VPPA evidenced by its statutory text and context, we are unpersuaded by the NBA's policy arguments for a different construction. The NBA insists that failing to cabin "goods or services" to audiovisual goods or services would produce anomalous results. It contends that under a broad construction of the term, someone who just watches a video on a website "with no other relationship to the company would not receive VPPA privacy protections vis-a-vis their viewing of these videos, because they have no 'renter,' 'purchaser,' or 'subscriber' relationship to the company," but someone who "previously and unrelatedly bought a hammer at one of the company's brick-and-mortar stores, and then watched a free video on the website" would be a VPPA consumer. Appellee's Br. at 40. To the NBA, it makes no sense that the VPPA can be triggered by a consumer interaction unrelated to videos.
Even presuming that merely watching a free video-and giving up personal information in the process-does not make someone a VPPA "consumer," the purportedly anomalous results identified by the NBA do not justify artificially cabining the statute's scope in a way that is inconsistent with its plain meaning and purpose.
Salazar does not contend that, independent of his registering for the newsletter, simply watching videos on NBA.com-thereby intentionally or unintentionally providing his personal viewing information to the NBA-makes him a "renter, purchaser, or subscriber of goods or services from a video tape service provider." We therefore express no view on this question.
For starters, the statute's express terms control. See Bostock v. Clayton County, Georgia, 590 U.S. 644, 653 (2020) ("When the express terms of a statute give us one answer and extratextual considerations suggest another, it's no contest. Only the written word is the law, and all persons are entitled to its benefit."); Pennsylvania Department of Corrections v. Yeskey, 524 U.S. 206, 212 (1998) ("[T]he fact that a statute can be applied in situations not expressly anticipated by Congress does not demonstrate ambiguity. It demonstrates breadth." (internal quotation marks omitted)).
We're also unconvinced that broadly defining "goods or services" produces anomalous results. Take the NBA's hypothetical: a consumer buys a hammer, then watches free videos on the vendor's website. The NBA suggests that it is anomalous that this consumer is subject to privacy protections under the VPPA. But considering the privacy protective goals of the VPPA with respect to individuals' video viewing information, this scenario does not strike us as anomalous. Especially given the broad definition of consumer in the VPPA, allowing disclosure of the consumer's video viewing information would be out of sync with the statute's goals.
To summarize: The phrase "goods or services" in the VPPA's definition of "consumer" is not cabined to only audiovisual "goods or services." The NBA's online newsletter therefore is a qualifying good or service.
C. "Subscriber"
Even if the NBA digital newsletter is a "good or service," we still must decide whether Salazar is a subscriber of that good or service such that he is a "consumer" within the VPPA. Salazar alleges that he "became a digital subscriber of NBA.com by providing, among other information, email address and IP address, . . . and any cookies associated with his device." Jt. App'x at 19. The NBA contends these actions do not signify a sufficient relationship between Salazar and the NBA, and therefore don't make Salazar a "subscriber" under the VPPA.
Salazar insists that "everyone agrees Mr. Salazar subscribes to the NBA's newsletter." Reply Br. at 3; see also Appellant's Br. at 17 n.3 (arguing that "this appeal does not concern the meaning" of the "subscriber" term). We disagree. The NBA concedes only that Salazar himself alleges "he signed up for a free NBA email newsletter." Appellee's Br. at 3. It also argued before the district court that Salazar's allegations "at most" supported an argument that he subscribed to the online newsletter, which the NBA contended was not an audiovisual good or service. See id. at 11 (quoting Jt. App'x at 50). We don't read the NBA's alternative argument as a concession that signing up for that newsletter made Salazar a "subscriber" of that newsletter as understood under the VPPA.
Two other circuits have tackled this question. In Ellis, the Eleventh Circuit confronted a case in which a plaintiff downloaded an Android application to watch video clips. 803 F.3d at 1254. Although the plaintiff didn't pay any money, the application recorded and shared his device-unique "Android ID" and videoviewing information with a third-party data analytics company. Id. The Eleventh Circuit held that "payment is not a necessary element of subscription," but "'subscription' involves some type of commitment, relationship, or association (financial or otherwise) between a person and an entity," which "involve[s] either payment, registration, commitment, delivery, . . . or access to restricted content." Id. at 1256 (internal quotation marks omitted). That plaintiff, however, had not made any payments, an account, or a profile; "provide[d] any personal information"; "sign[ed] up for any periodic services or transmissions"; or otherwise "ma[d]e any commitment or establish[ed] any relationship that would allow him to have access to exclusive or restricted content." Id. at 1257. All he did was download a free app and use it to view content. So, the court concluded, he was not a VPPA "subscriber." Id. at 1258.
The First Circuit faced a similar set of facts in Yershov. There, someone also downloaded an app in order to, among other things, watch videos. 820 F.3d at 484. Each time the plaintiff used the app to watch videos, the video's title, his device's GPS coordinates, and his device's unique Android ID were sent to a third-party data analytics company, which used the information for, among other things, targeted advertising. Id. at 484-85. The First Circuit agreed with the Eleventh Circuit that someone does not have to pay money to be a VPPA subscriber. Id. at 487-88. But unlike the Eleventh Circuit, the First Circuit held that the Yershov plaintiff was a VPPA subscriber. Id. at 487. It explained:
To use the App, Yershov did indeed have to provide Gannett with personal information, such as his Android ID and his mobile device's GPS location at the time he viewed a video, each linked to his viewing selections. While he paid no money, access was not free of a commitment to provide consideration in the form of that information, which was of value to Gannett. And by installing the App on his phone, thereby establishing seamless access to an electronic version of USA Today, Yershov established a relationship with Gannett that is materially different from what would have been the case had USA Today simply remained one of millions of sites
on the web that Yershov might have accessed through a web browser.Id. at 489.
We agree with both the Eleventh and First Circuits that someone doesn't have to spend money to be a VPPA "subscriber." Otherwise, the term "subscriber" would be rendered superfluous by the terms "purchaser" and "renter" in the definition of "consumer." Someone in 1988 (or 2012, for that matter) who paid money for permanent access to audiovisual material would be a "purchaser," and someone who exchanged money for temporary access would be a "renter." If the payment of money was an essential condition of being a "subscriber," then anyone who was a "subscriber" would also be either a "renter" or "purchaser." See id. at 487-88.
Although some dictionary definitions in circulation around the time the VPPA was enacted, and later amended, suggest that a someone must pay money to be a subscriber, other definitions don't. See, e.g., Yershov, 820 F.3d at 487 (comparing dictionary definitions).
It's also easy to imagine subscriptions that don't require monetary payment. Someone can, for example, subscribe to a YouTube channel by signing into a YouTube account (which requires no monetary payment) and clicking the "subscribe" icon on a content creator's channel. YouTube Help, Subscribe to YouTube channels, https://support.google.com/youtube/answer/4489286 [https://perma.cc/RM2E-FMX8] (last visited Sept. 4, 2024). Subscribing causes YouTube to "automatically send . . . notifications about the highlights from that channel." Id.
These types of subscriptions aren't only a feature of the modern internet. As the First Circuit explained, they existed in the 1980s through "the reasonably common retailing practice of introductory enticements":
Suppose a customer in 1988 obtained several videos from a new commercial supplier at no charge, or with money back. We can discern no reason why Congress would have wanted different disclosure rules to apply to those transactions than to ones where a monetary payment is made. And because we think that Congress cast such a broadly inclusive net in the brick-and-mortar world, we see no reason to construe its words as casting a less inclusive net in the electronic world when the language does not compel that we do so. See Barr v. United States, 324 U.S. 83, 90 (1945) ("[I]f Congress has made a choice of language which fairly brings a given situation within a statute, it is unimportant that the particular application may not have been contemplated by the legislators.").Yershov, 820 F.3d. at 488.
Here, although Salazar does not allege that he paid the NBA money, he does allege that he provided the NBA with his personal information when he signed up for the newsletter. In return for receiving periodic NBA-related updates, Salazar exchanged, at a minimum, (1) his email address, (2) his IP address, and (3) cookies associated with his device. He further alleges that through his IP address, the NBA can identify "the city and zip code he resides in as well as his physical location." Jt. App'x at 19.
That information is not insignificant. By receiving it, the NBA learned how to directly reach out to Salazar. It discovered where his device was. It gained access to additional information stored in any cookies on his device. These tools increased the NBA's potential to urge Salazar to visit NBA.com and watch videos on it, making the NBA's relationship with him distinct from its relationship with casual NBA.com video-watchers who had not signed up for the newsletter. Accepting these allegations as true and drawing all reasonable inferences in Salazar's favor, as we must at the pleadings stage, Salazar plausibly alleged that he gave the NBA valuable personal information in exchange for access to the online newsletter. Cf. Yershov, 820 F.3d at 489 (reasoning that the plaintiff provided "consideration in the form of" "personal information" including his Android ID and device's GPS location). This is sufficient at the pleadings stage to satisfy the requirement that Salazar allege that he became a "subscriber of" the NBA's online newsletter.
That is not to say that a NBA.com video-watcher who does not sign up for the online newsletter is not also a VPPA "subscriber." Salazar does not argue that he was a subscriber merely by virtue of any information acquired by the NBA based solely on his viewing the videos on NBA.com. We therefore leave that question for another day.
CONCLUSION
Our ruling is narrow: We hold on the merits only that Salazar has plausibly pled that he is a "subscriber of goods or services" and that the district court therefore erred in dismissing his complaint pursuant to Fed.R.Civ.P. 12(b)(6). We leave the district court to address the NBA's alternative arguments in the first instance. And, of course, our conclusions are conditioned on the necessary pleading-stage presumption that Salazar's allegations are true. Further factual developments may ultimately paint a different picture.
The VPPA is no dinosaur statute. Congress deployed broad language in defining the term "consumer," showing it did not intend for the VPPA to gather dust next to our VHS tapes. Our modern means of consuming content may be different, but the VPPA's privacy protections remain as robust today as they were in 1988.
The district court's judgment is VACATED, and the case is REMANDED for further proceedings consistent with this opinion.