Perry v. Cable News Network, Inc. et al

RESPONSE in Opposition re MOTION TO DISMISS FOR FAILURE TO STATE A CLAIM Plaintiff's First Amended Class Action Complaint

N.D. Ga.December 13, 2014

IN THE UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF GEORGIA ATLANTA DIVISION RYAN PERRY, individually and on behalf of all others similarly situated, Plaintiff, v. CABLE NEWS NETWORK, INC., a Delaware corporation, and CNN INTERACTIVE GROUP, INC., a Delaware corporation, Defendants. Case No. 1:14-cv-2926-ELR PLAINTIFF’S RESPONSE IN OPPOSITION TO DEFENDANTS’ MOTION TO DISMISS PURSUANT TO FEDERAL RULES 12(b)(1) and 12(b)(6) Case 1:14-cv-02926-ELR Document 52 Filed 12/13/14 Page 1 of 35 i TABLE OF CONTENTS INTRODUCTION ................................................................................................... 1 FACTUAL AND PROCEDURAL BACKGROUND .......................................... 2 ARGUMENT ........................................................................................................... 4 I. Perry Alleges that CNN Disclosed His PII By Transmitting Data to Bango that Identified Him as Viewing Specific Video Materials ................................................. 5 A. The VPPA’s definition of PII is broad, and the case-by-case analysis it requires shows that Perry’s MAC Address and video records are PII .................................................................. 5 1. Common usage of the term “identify” confirms that any information that distinguishes a specific consumer as having watched a particular video is “personally identifying information” ........................... 6 2. CNN takes too narrow a view of PII, ignores modern data analytics and identification practices, and reads additional requirements into the VPPA without any textual basis ............................................. 10 a. Hulu supports a finding that Perry’s MAC Address was personally identifying because it identified him to Bango. ........................................ 11 b. CNN’s other authorities define “identify” too narrowly, misapply the Hulu analysis, and ignore official government, as well as common usage ..................................................................... 13 B. Perry alleges sufficient facts to show that the MAC Address and video viewing history disclosed by CNN is PII in this case ........................................................................................... 17 Case 1:14-cv-02926-ELR Document 52 Filed 12/13/14 Page 2 of 35 ii II. Perry is a “Consumer” Entitled to the VPPA’s Protections Because He Downloaded, Installed, and Used the App to View Video Content ................................................................................... 19 A. Perry is a “Subscriber” Under the VPPA Because He Downloaded, Installed, and Used the App to View Regularly Updated Video Content ........................................... 19 B. Perry “Rented from CNN” Because He Provided a Benefit in Exchange for a Temporary License to Use CNN’s Video Materials ................................................................................... 20 III. CNN’s Violation of Perry’s Video Privacy Rights Constituted an Injury-in-Fact, Conferring Upon Him Standing to Sue .......... 22 CONCLUSION ..................................................................................................... 26 Case 1:14-cv-02926-ELR Document 52 Filed 12/13/14 Page 3 of 35 iii TABLE OF AUTHORITIES United States Supreme Court Cases: Bell Atlantic Corp. v. Twombly, 550 U.S. 554 (2007) .............................................. 4 Erickson v. Pardus, 551 U.S. 89 (2007) ................................................................... 4 Havens Realty Corp. v. Coleman, 455 U.S. 363 (1982) ................................. 22 – 23 Linda R.S. v. Richard D., 410 U.S. 614 (1973) ...................................................... 22 Warth v. Seldin, 422 U.S. 490 (1975) ............................................................. 22 – 24 United States Circuit Court of Appeals Cases: David v. Alphin, 704 F.3d 327 (4th Cir. 2013) ....................................................... 24 Ellis v. The Cartoon Network, Inc., No. 14-15046 (11th Cir.) ......................... 13 n.9 Garcia v. Copenhaver, Bell & Assocs., M.D.’s, P.A., 104 F.3d 1256 (11th Cir. 1997) ...................................................................... 4 Grossman v., N.A., 225 F.3d 1228 (11th Cir. 2000) ................................................. 4 Kendall v. Employees Ret. Plan of Avon Prods., 561 F.3d 112 (2d Cir. 2009) ................................................................. 24 – 25 Kyles v. J.K. Guardian Sec. Servs., Inc., 222 F.3d 289 (7th Cir. 2000) ................. 22 Pruitt v. Comcast Cable Holdings, 100 F. App’x 713 (10th Cir. 2004), ................ 15 Sterk v. Redbox Automated Retail, LLC, 770 F.3d 618 (7th Cir. 2014) ................. 23 United States v. Frank, 599 F.3d 1221 (11th Cir. 2010) .................................... 6, 19 United States v. Lopez, 590 F.3d 1238 (11th Cir. 2009) ........................................... 6 Case 1:14-cv-02926-ELR Document 52 Filed 12/13/14 Page 4 of 35 iv United States v. Porter, 591 F.2d 1048 (5th Cir. 1979) ............................................ 7 United States v. Weiss, 467 F.3d 1300 (11th Cir. 2006) ......................................... 22 United States District Court Cases: Campbell v. Tartt, No. 110-CV-854-TWT, 2010 WL 4007568 (N.D. Ga. Oct. 8, 2010) ............ 4 Eichenberger v. ESPN, Inc., No. 14-cv-463-TSZ (W. Dist. Wa. Nov. 24, 2014) ...................................... 16 Ellis v. The Cartoon Network, Inc., No. 14-cv-484, 2014 WL 5023535 (N.D. Ga. Oct. 8, 2014) ................. passim In re Hulu Privacy Litig., No. 3:11-cv-03764 (N.D. Cal. June, 11, 2012) ............. 24 In re Hulu Privacy Litig., No. 11-cv-03764, 2012 WL 3282960 (N.D. Cal. Aug. 10, 2012) ........ 19 – 20 In re Hulu Privacy Litig., No. 11-cv-3764, 2014 WL 1724344 (N.D. Cal. Apr. 28, 2014) ........... passim In re Nickelodeon Consumer Privacy Litig., MDL No. 2443, 2014 WL 3012873 (D. N.J. July 2, 2014) .................. 13 – 15 Klimas v. Comcast Cable Comm’ns., Inc., No. 02-cv-72054, 2003 WL 23472182 (E.D. Mich. July 1, 2003) ............... 16 Lane v. Wells Fargo Bank, N.A., 2010 WL 2724084 (N.D. Ga. July 7, 2010) ......................... 4, 13 n.7, 15 n.10 Low v. LinkedIn Corp., 900 F. Supp. 2d 1010 (N.D. Cal. 2012) .................... 18 n.11 Viacom Int’l v. YouTube Inc., 253 F.R.D. 256 (S.D.N.Y. 2008) ............................ 15 Case 1:14-cv-02926-ELR Document 52 Filed 12/13/14 Page 5 of 35 v Statutes and Federal Rules: Fed. R. Civ. P. 12 ............................................................................................. passim 16 C.F.R. § 312.2 ...................................................................................................... 8 34 C.F.R. § 99.3 .................................................................................................. 8, 10 45 C.F.R. § 164.514 ............................................................................................ 8, 10 15 U.S.C. § 6501 ....................................................................................................... 7 18 U.S.C. § 2710 .............................................................................................. passim 20 U.S.C. § 1232 ....................................................................................................... 8 29 U.S.C. § 1109 ..................................................................................................... 25 42 U.S.C. § 1320 ....................................................................................................... 8 Miscellaneous Authorities: Black’s Law Dictionary (3d Pocket Ed. 2006) ....................................................... 21 Dictionary.com, http://dictionary.reference.com/browse/identify ...................... 7 n.3 Encyclopedia.com, http://www.encyclopedia.com/topic/subscribe.aspx ....... 19 n.12 Handbook for Safeguarding Sensitive Personally Identifiable Information, Dep’t of Homeland Sec. (Mar. 2012), http://www.dhs.gov/sites/default/files/ publications/privacy/Guidance/handbookforsafeguardingsensitivePII_ march_2012_webversion.pdf. .................................................................. 9 n.4 Merriam-Webster Online Dictionary, http://www.merriamwebster.com/ dictionary/identity ..................................................................................... 6 n.2 Oxford Dictionaries, http://www.oxforddictionaries.com/us/definition/ american_english/identify ........................................................................ 6 n.1 Case 1:14-cv-02926-ELR Document 52 Filed 12/13/14 Page 6 of 35 vi Oxford Dictionaries, http://www.oxforddictionaries.com/us/definition/ american_english/rent?q=rent .............................................................. 20 n.13 Oxford Dictionaries, http://www.oxforddictionaries.com/definition/ english/subscribe ................................................................................. 19 n.12 Privacy and Technology Focus Group: Final Report and Recommendations, Global Justice Information Sharing Institute – U.S. Dep’t of Justice (Sept. 19, 2006), http://www.it.ojp.gov/documents/privacy_technology _focus_group_full_report.pdf ................................................................... 9 n.6 Rules and Regulations – Protecting PII – the Privacy Act, GSA.gov, http://www.gsa.gov/portal/content/104256 .............................................. 9 n.5 S. Rep. No. 100-599 (1988) ............................................................................ 21 n.14 Case 1:14-cv-02926-ELR Document 52 Filed 12/13/14 Page 7 of 35 1 INTRODUCTION Defendants Cable News Network, Inc. and CNN Interactive Group, Inc., (collectively “CNN”) distribute a mobile software application that allows users to read news articles and watch videos of CNN’s coverage on their iPhones (the “App”). Each time a user watches a video through the App, however, CNN discloses (without consent) the user’s iPhone media access control address (“MAC Address”)—a persistent, unique, numeric identifier of Internet-enabled devices such as the iPhone—and video viewing history to third-party data analytics firm Bango PLC (“Bango”). Because Bango can and does identify specific consumers using device-supplied identifiers like MAC Addresses, each of CNN’s disclosures specifically and personally identified its users and their viewing choices in violation of the Video Privacy Protection Act (“VPPA”), 18 U.S.C. § 2710, which prohibits disclosures of this sort of personally identifiable information (“PII”) without consent. CNN now offers three arguments for dismissal of Plaintiff Ryan Perry’s claims. First, it argues that the MAC Addresses that it admittedly disclosed to Bango did not identify specific individuals and therefore Perry has failed to allege any disclosure of PII. Second, it argues that Perry is neither a “renter” nor “subscriber” of the App and therefore is not a “consumer” protected by the VPPA. Case 1:14-cv-02926-ELR Document 52 Filed 12/13/14 Page 8 of 35 2 And finally, it argues that Perry lacks the injury-in-fact sufficient to confer Article III standing to sue. As described more fully below, each of CNN’s arguments fail. The breadth of relevant case law, agency regulations, and the plain meaning of the term “identify” all support the conclusion that MAC Addresses disclosed with video viewing records are “PII” as contemplated by the VPPA. Further, Perry subscribed to the App and rented videos from it, thus making him a “consumer” as defined by the VPPA. And finally, consistent with Supreme Court precedent on the issue, CNN’s alleged violations of Perry’s privacy rights created by the VPPA is an injury-in-fact sufficient to confer standing under Article III. Accordingly, CNN’s motion should be denied in its entirety, and Perry should be allowed to prove his claims through discovery. FACTUAL AND PROCEDURAL BACKGROUND The App allows consumers to “[g]et breaking news alerts and follow stories as they develop,” “[w]atch video clips and coverage of live events as they unfold,” and more. (Compl. ¶ 10.) The App never seeks or obtains consumers’ consent to share or otherwise disclose their personally identifiable information. (Id. ¶ 12.) Each time a user closed the App, however, CNN sent a record of any videos viewed (and their titles), along with the user’s MAC address, to Bango, whose Case 1:14-cv-02926-ELR Document 52 Filed 12/13/14 Page 9 of 35 3 business model focuses on “tracking individual user behaviors across the Internet and mobile applications.” (Id. ¶¶ 12, 14 n.2.) To do so, Bango relies on “[o]perator and device manufacturer supplied identit[ies],” including MAC Addresses, which identify specific device users. (Id. ¶¶ 15–19.) Indeed, as part of its central business, Bango tracks users’ activities through MAC Addresses (including video viewing activities), and even attributes a “name[], address[], and billing information[] to” each user and MAC Address. (Id. ¶¶ 15–29, 25.) For his part, Perry downloaded and began using the App to watch videos in early 2013. (Id. ¶ 34.) At no point did he grant CNN permission to disclose his PII to any third party. (Id. ¶ 35.) Nonetheless, CNN disclosed Perry’s video viewing history and his MAC Address to Bango each and every time he closed the App. (Id. ¶¶ 14, 37.) On February 18, 2014, Perry filed his complaint, alleging that CNN’s disclosure of his PII without consent violated the VPPA. CNN responded by moving to transfer the case to this Court, or, in the alternative, to dismiss. (Dkt. 18.) Following that motion, Perry amended his Complaint, (Dkt. 25), and the case was transferred from the Northern District of Illinois to this Court. (Dkt. 32.) CNN has now moved to dismiss under Federal Rules 12(b)(1) and 12(b)(6). (Dkt. 49.) Case 1:14-cv-02926-ELR Document 52 Filed 12/13/14 Page 10 of 35 4 ARGUMENT On a Rule 12(b)(6) motion, the “court is required to accept as true ‘all facts set forth in the plaintiff’s complaint,’” and it “must draw all reasonable inferences in the light most favorable to the plaintiff.” Lane v. Wells Fargo Bank, N.A., No. 10-cv-1411, 2010 WL 2724084, at *1 (N.D. Ga. July 7, 2010) (quoting Grossman v. Nationsbank, N.A., 225 F.3d 1228, 1231 (11th Cir. 2000)). To survive such a motion, a complaint need not plead “[s]pecific facts,” but instead, must only contain a statement of the claim that “give[s] the defendant fair notice of what the . . . claim is and the grounds upon which it rests.” Erickson v. Pardus, 551 U.S. 89, 93 (2007) (quoting Bell Atlantic Corp. v. Twombly, 550 U.S. 554, 555 (2007)). Under Rule 12(b)(1), “it is extremely difficult to dismiss a claim for lack of subject matter jurisdiction.” Garcia v. Copenhaver, Bell & Assocs., M.D.’s, P.A., 104 F.3d 1256, 1260 (11th Cir. 1997). “Facial attacks[,]” like CNN’s here, “require[ ] the court merely to look and see if [the] plaintiff has sufficiently alleged a basis of subject matter jurisdiction, and the allegations in his complaint are taken as true for the purposes of the motion.” Campbell v. Tartt, No. 110-CV-854-TWT, 2010 WL 4007568, at *1 (N.D. Ga. Oct. 8, 2010) (citations omitted). Here, CNN makes three arguments in favor of dismissal. First, that the information it disclosed was not PII. Second, that Perry is neither a “subscriber” to, Case 1:14-cv-02926-ELR Document 52 Filed 12/13/14 Page 11 of 35 5 nor a “renter” of its services and therefore is not a “consumer” protected by the VPPA. And third, that Perry fails to allege any injury and therefore lacks standing to sue. As explained below, each argument fails: CNN’s disclosures identified Perry to Bango as having viewed specific video materials, satisfying the VPPA’s definition of PII; Perry was a “consumer” of CNN’s services because he both subscribed to the App and rented video material from CNN; and Perry was aggrieved by CNN’s invasion of his privacy rights and therefore—consistent with decades of Supreme Court and appellate precedent—he has standing to sue. I. Perry Alleges that CNN Disclosed His PII by Transmitting Data to Bango that Identified Him as Viewing Specific Video Materials. A. The VPPA’s definition of PII is broad, and the case-by-case analysis it requires shows that Perry’s MAC Address and video records are PII. CNN first argues that unique identifiers—like Perry’s MAC Address—are not “PII” under the VPPA, claiming instead that the Act only prohibits the disclosure of information like an individual’s actual name or physical address. That takes far too narrow a view. The VPPA defines “personally identifiable information” as “includ[ing] information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider.” 18 U.S.C. § 2710(a)(3) (emphasis added). It does not, however, define “identifies,” and thus the Court must interpret the term as it is “commonly Case 1:14-cv-02926-ELR Document 52 Filed 12/13/14 Page 12 of 35 6 understood” and by using its “ordinary and plain meaning.” United States v. Frank, 599 F.3d 1221, 1234 (11th Cir. 2010). Given its ordinary usage, “identify” “plainly encompasses other means of identifying a person,” beyond names or actual physical addresses. In re Hulu Privacy Litig., No. 11-cv-3764, 2014 WL 1724344, at **7, 11 (N.D. Cal. Apr. 28, 2014) (“Hulu”). 1. Common usage of the term “identify” confirms that any information that distinguishes a specific consumer as having watched a particular video is “personally identifying information.” When analyzing a statute’s text, “courts often turn to dictionary definitions for guidance.” United States v. Lopez, 590 F.3d 1238, 1248 (11th Cir. 2009). Oxford Dictionaries defines “identify” as to “[e]stablish or indicate who or what (someone or something) is.”1 Webster’s defines “identity” not only as “the name of a person,” but also “who someone is,” “the qualities . . . that make a particular person . . . different from others,” and “the distinguishing character [] of an individual.”2 Likewise, a leading online dictionary defines “identify” as “to recognize or establish as being a particular person or thing,” or “to verify the 1 Identify, Oxford Dictionaries, http://www.oxforddictionaries.com/us/ definition/american_english/identify (last accessed Dec. 3, 2014). 2 Identity, Merriam-Webster Online Dictionary, http://www.merriamwebster.com/dictionary/identity (last accessed Dec. 3, 2014). Case 1:14-cv-02926-ELR Document 52 Filed 12/13/14 Page 13 of 35 7 identity of.”3 As these definitions make clear, “identifying” refers to any information used to distinguish an individual from many others, not merely their actual name. Other federal privacy laws, and the regulations implementing them, take a similar approach to the meaning of “identify.” See United States v. Porter, 591 F.2d 1048, 1053 (5th Cir. 1979) (courts “look to similar statutes, the common law, and common sense to aid [] interpretation.”). For instance, the regulations implementing the Children’s Online Privacy Protection Act, 15 U.S.C. §§ 6501– 06, confirm the widespread view that identifiers like MAC Addresses do identify particular individuals. New regulations effective July 1, 2013 define “personal information” under that Act as: individually identifiable information about an individual collected online, including: (1) A first and last name; (2) A home or other physical address including street name and name of a city or town; (3) Online contact information as defined in this section; (4) A screen or user name where it functions in the same manner as online contact information, as defined in this section; (5) A telephone number; (6) A Social Security number; (7) A persistent identifier that can be used to recognize a user over time and across different Web sites or online services. Such persistent identifier includes, but is not limited to, a customer number held in a cookie, an Internet Protocol (IP) address, a processor or device serial number, or unique 3 Identify, Dictionary.com, http://dictionary.reference.com/browse/identify (last accessed Dec. 3, 2014). Case 1:14-cv-02926-ELR Document 52 Filed 12/13/14 Page 14 of 35 8 device identifier . . . . 16 C.F.R. § 312.2 (2013) (emphasis added). Likewise, the regulations implementing the Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g, recognize that “identifying” includes “[a] personal identifier, such as the student’s social security number, student number, or biometric record[,]” as well as any “[o]ther information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty.” 34 C.F.R. § 99.3 (2012) (emphasis added). Similarly, the regulations implementing the Health Insurance Portability and Accountability Act, 42 U.S.C. § 1320d, recognize 18 types of “direct identifiers,” including: names, dates (i.e., birth, death, etc.) with limited exceptions, telephone and fax numbers, email addresses, social security numbers, medical record numbers, health plan beneficiary numbers, account numbers, certificate/license numbers, vehicle identifiers (including license plate numbers), device identifiers and serial numbers, URLs, and IP addresses. 45 C.F.R. § 164.514(e)(2) (2013). Not surprisingly, numerous other government agencies are in accord. For example, the Department of Homeland Security defines “personally identifiable Case 1:14-cv-02926-ELR Document 52 Filed 12/13/14 Page 15 of 35 9 information” as “any information that permits the identity of an individual to be directly or indirectly inferred, including any information that is linked or linkable to that individual . . . .”4 The General Services Administration takes a similarly broad view. It has recognized that the “definition of PII is not anchored to any single category of information or technology,” and instead, defines PII as “information that can be used to distinguish or trace an individual’s identity, either alone or in combination with other information that is linked or linkable to a specific individual.”5 The Department of Justice also agrees that PII simply refers to information that distinguishes one individual from another (whether it be name, number, or some other characteristic), defining it as “one or more pieces of information that when considered together or when considered in the context of how it is presented or how it is gathered sufficient to specify a unique individual.”6 According to the 4 Handbook for Safeguarding Sensitive Personally Identifiable Information at 5, Dep’t of Homeland Sec. (Mar. 2012), available at http://www.dhs.gov/sites/ default/files/publications/privacy/Guidance/handbookforsafeguardingsensitivePII_ march_2012_webversion.pdf. 5 See Rules and Regulations – Protecting PII – the Privacy Act, GSA.gov, http://www.gsa.gov/portal/content/104256 (last accessed Dec. 3, 2014). 6 Privacy and Technology Focus Group: Final Report and Recommendations at 58, Global Justice Information Sharing Institute – U.S. Dep’t of Justice (Sept. 19, 2006), available at http://www.it.ojp.gov/documents/privacy_technology _focus_group_full_report.pdf (last accessed Dec. 3, 2014). Case 1:14-cv-02926-ELR Document 52 Filed 12/13/14 Page 16 of 35 10 DOJ, this information can include “personal characteristics,” any “unique set of numbers or characters assigned to a specific individual, including name; address; phone number; social security number; e-mail address; driver’s license number,” and more. Id. Common usage of the word “identifying,” then, shows that PII includes not only names and addresses, but also any data that differentiates a single person from a group at large. More specifically, those same authorities recognize that unique identifiers (such as the MAC Addresses at issue here) are, in fact, uniquely identifying and therefore—when combined with a video viewing record—are PII under the VPPA. See 34 C.F.R. § 99.3; 45 C.F.R. § 164.514(e)(2). 2. CNN takes too narrow a view of PII, ignores modern data analytics and identification practices, and reads additional requirements into the VPPA without any textual basis. The authorities CNN relies upon in arguing that MAC Addresses cannot “identif[y] a person” are also unavailing. Indeed, the In re Hulu Privacy Litig., No. 11-cv-3764, 2014 WL 1724344 (N.D. Cal. Apr. 28, 2014) (“Hulu”) decision— which provides the analytical framework for CNN’s other authorities—actually supports Perry’s claims here. And, CNN’s remaining authorities, including the recent Cartoon Network opinion, read the word “identify” too narrowly and ignore both the common usage of that term (as discussed above) and the capabilities and Case 1:14-cv-02926-ELR Document 52 Filed 12/13/14 Page 17 of 35 11 practices of data analytics companies like Bango. a. Hulu supports a finding that Perry’s MAC Address was personally identifying because it identified him to Bango. CNN argues that Hulu stands for the proposition that the disclosure of unique identifiers cannot be “personally identifying” under the VPPA. (See Memorandum in support of CNN’s Motion to Dismiss, Dkt. 49-1 (“MTD”) at 13.) CNN misreads that opinion. In Hulu, the Court actually held that unique identifiers, when disclosed to recipients who can understand them, are personally identifying under the VPPA. Hulu, 2014 WL 1724344 at *14. There, the plaintiffs alleged that online video provider Hulu had disclosed their Facebook user IDs to Facebook, and their Hulu user IDs to data analytics company comScore, Inc. Id. On summary judgment, the Hulu court recognized that a person can “be identified in many ways: by a picture, by pointing, by an employee number, by the station or office or cubicle where one works, [or] by telling someone what ‘that person’ rented.” Id. at *11. The court further explained that “the statute, the legislative history, and the case law do not require a name, [but] instead[,] require the identification of a specific person tied to a specific transaction, and support the conclusion that a unique anonymized ID alone is not PII but context could render it not anonymous and the equivalent of the identification of a specific person.” Id. (emphasis added). Case 1:14-cv-02926-ELR Document 52 Filed 12/13/14 Page 18 of 35 12 Further, in addressing the very argument raised by CNN—that a MAC Address is no more than a random string of numbers—the Hulu court held that the Facebook IDs in question being “a string of numbers and letters does not alter the conclusion. [Computer] [c]ode is a language, and languages contain names, and the string is the Facebook user name.” Id. at *14. Accordingly, the court denied the defendant’s motion for summary judgment on that issue. The Hulu court’s order expressly recognizes that context matters—the disclosures of the Facebook IDs to Facebook were identifying because (1) that’s how Facebook actually identifies its users, and (2) the information disclosed was tied to unique profiles on the Facebook social network. Id. Likewise, the MAC Addresses here are (1) how Bango identifies specific App users, and (2) are tied to those individuals’ unique profiles in Bango’s databases. (Compl. ¶¶ 14–26, 52, 53.) And, as with the Facebook IDs in Hulu, because Bango has extensive consumer tracking databases, App users are “automatically identifie[d]” in Bango’s records. (Id. ¶ 23.) Accordingly, the MAC Address “is more than a unique, anonymous identifier. It personally identifies [an App] user. That it is a string of numbers and letters does not alter the conclusion.” See Hulu, 2014 WL 1724344, at *14.7 7 CNN’s reliance on the Hulu court’s entry of summary judgment against the plaintiffs with respect to the disclosure of Hulu user IDs to comScore is inapposite, Case 1:14-cv-02926-ELR Document 52 Filed 12/13/14 Page 19 of 35 13 b. CNN’s other authorities define “identify” too narrowly, misapply the Hulu analysis, and ignore official government, as well as common, usage. CNN further relies on In re Nickelodeon Consumer Privacy Litig., MDL No. 2443, 2014 WL 3012873, at *10 (D. N.J. July 2, 2014) (“Nickelodeon”), and Ellis v. The Cartoon Network, Inc., No. 14-cv-484, 2014 WL 5023535 (N.D. Ga. Oct. 8, 2014).8 While both of those courts began their analysis by recognizing that “‘a person’ can be identified by more than just their name and address[,]” (see Nickelodeon, 2014 WL 3012873, at *19 (citing Hulu); Ellis, 2014 WL 5023535, at *9) contrary to the Hulu court’s reasoning, they ultimately held that disclosure of a unique identifier could only violate the VPPA if it was somehow tied to an individual’s actual name. See Nickelodeon, 2014 WL 3012873 at *19 (concluding that in order to be PII under the VPPA, “information . . . must, without more, itself as the court only held that the plaintiffs failed to present evidence that comScore had actually linked video histories to their profiles. See id. at *12 (“There is no evidence that comScore did this. The issue is only that it could.”) Here, by contrast, Perry alleges that Bango did actually identify him as viewing specific videos by his MAC Address, and those allegations are entitled to a presumption of truth. (Compl. ¶¶ 15–26); see also Lane, 2010 WL 2724084, at *1 (“[A] federal court is to accept as true all facts set forth in the plaintiff's complaint.”). 8 Ellis is currently on appeal to the Eleventh Circuit, with the appellant’s opening brief due on December 16, 2014. See Ellis v. The Cartoon Network, Inc., Case No. 14-15046 (11th Cir.). Case 1:14-cv-02926-ELR Document 52 Filed 12/13/14 Page 20 of 35 14 link an actual person with actual video materials.”);9 see also Ellis 2014 WL 5023535, at *3 (“[An] Android ID, without more, is not personally identifiable information” because “the disclosure by the Defendant [t]here required [the third party recipient of the IDs] to collect information from other sources” to make it identifiable). Those conclusions, however, ignore the Hulu court’s contextual analysis (which both courts claimed to endorse), common usage of the word “identify,” governmental agencies’ definitions of PII, and the capabilities and practices of analytics companies like Bango. Ellis and Nickelodeon also ignore the Hulu court’s acknowledgement that, “[o]ne can be identified in many ways: by a picture, by pointing, by an employee number, by the station or office or cubicle where one works . . . .” Hulu, 2014 WL 1724344, at *11 (emphasis added). These examples demonstrate the importance of context, and of the recipient’s possession of information that may render the disclosure in question “identifying.” For instance, were CNN to provide an employer with a list of its employees’ video viewing records listed by employee number, such a disclosure would clearly be identifying at the time it was made. 9 Despite holding that data must link an “actual person” to video materials to be PII, the Nickelodeon court never explained what it meant by “actual person,” or why the Facebook IDs in Hulu identified “actual persons,” while the usernames, device identifiers, and other information at issue in Nickelodeon did not. Case 1:14-cv-02926-ELR Document 52 Filed 12/13/14 Page 21 of 35 15 That is, the records would identify specific individuals to the employer based on the employee numbers, even though the numbers would likely be meaningless to anyone else who receives them. Likewise, a video store’s disclosure of video records associated with Georgia drivers license numbers to the Georgia DDS would be personally identifying at the time it was made, because the drivers license numbers would identify specific individuals to the DDS, even though they would be meaningless to many other persons, such as a local restaurant.10 Equally misplaced—in light of the Hulu framework, and the Ellis and Nickelodeon courts’ endorsement of the same—is CNN’s reliance on cases involving the Cable Act, and disclosure of IP addresses. As the Hulu court noted, both Pruitt v. Comcast Cable Holdings, LLC, 100 Fed. Appx. 713 (10th Cir. 2004) and Viacom Int’l Inc. v. YouTube, Inc., 253 F.R.D. 256 (S.D.N.Y. 2008), relied on by CNN (MTD at 14), support the proposition that “if an anonymous, unique ID were disclosed to a person who could understand it, that might constitute PII.” 10 Extending the analogy, Perry alleges that the MAC Addresses were identifying when disclosed to Bango because that is how Bango identifies App users. Thus, while a MAC Address would be nothing more than a long string of characters when in the hands of the Court or counsel, it is identifying to Bango, whose business consists of identifying and analyzing specific individuals and their behaviors through, inter alia, unique device identifiers. (See Compl. ¶¶ 14–26.) And, in any event, Perry’s allegations that Bango did identify specific individuals using their MAC Addresses must be taken as true at this stage of the proceedings. Lane, 2010 WL 2724084, at *1. Case 1:14-cv-02926-ELR Document 52 Filed 12/13/14 Page 22 of 35 16 Hulu, 2014 WL 1724344, at *11 (emphasis in original); see also Hulu at *9–10. Likewise, CNN’s other cited authorities involving disclosure of IP addresses (MTD at 15), recognize that anonymous and dynamic (i.e., regularly changed) identifiers such as IP addresses, if “correlated to some other information, such as [a database]” could identify an individual. Klimas v. Comcast Cable Comm’ns., Inc., No. 02-cv-72054, 2003 WL 23472182, at *5 (E.D. Mich. July 1, 2003). Here, Perry alleges that CNN disclosed his MAC Address—a persistent identifier (Compl. ¶¶ 14, 37), as opposed to a regularly cycled one such as an IP address—to a recipient who already possessed information sufficient to identify individuals by their MAC Address, thus the Cable Act and IP address cases offer CNN no support and, in fact, support Perry’s position. Accordingly, the relevant case law also supports the notion that where, as here, a video service provider (like CNN) discloses a unique identifier (like a MAC Address) and video viewing history to a third party (like Bango) that actually uses the information to identify specific individuals and the videos they viewed, the information disclosed is PII. Hulu at *11 (“One could not skirt liability under the VPPA, for example, by disclosing a unique identifier and a correlated look-up table.”). Case 1:14-cv-02926-ELR Document 52 Filed 12/13/14 Page 23 of 35 17 B. Perry alleges sufficient facts to show that the MAC Address and video viewing history disclosed by CNN is PII in this case. Turning to the disclosures in this case, CNN argues that the contextual allegations in Perry’s Complaint—which establish how and why the information disclosed by CNN is identifying to Bango—are irrelevant and inadequately pled. (MTD at 16.) But CNN misreads the allegations in the Complaint, misconstrues governing law, and ignores the presumption of truth attached to Perry’s allegations at the pleading stage. Though it hasn’t done so already, on reply CNN will surely rely on the recent order in Eichenberger v. ESPN, Inc., No. 14-cv-463-TSZ, Dkt. 38 (W. Dist. Wa. Nov. 24, 2014). There, the plaintiff alleged that ESPN had disclosed serial numbers of Roku streaming video devices, in conjunction with video viewing histories, to a third party. The Eichenberger court recognized that the disclosure of information to a party with a “correlated look-up table”—like Bango—would result in a violation of the VPPA. Id. at 2 (quoting Hulu, 2014 WL 1724344, at *11). However, the court found that the plaintiff had not alleged sufficient facts to demonstrate that the defendant already possessed such a “look-up table.” Id. Here, Perry has repeatedly alleged Bango’s possession and use of the proverbial “look-up table.” (Compl. ¶¶ 21–26.) In fact, Bango boasts that “[n]o matter what connection or device a user is on, with [its] unique identification Case 1:14-cv-02926-ELR Document 52 Filed 12/13/14 Page 24 of 35 18 methods [it] is able to identify users visiting [its client’s] mobile pages.” (Compl. ¶ 25.) And, Bango’s database is “constantly updated and enriched by new information.”(Compl. ¶ 23.) Accordingly, Perry alleges that it was Bango’s possession and use of that information that allowed it to “automatically identif[y]” him upon CNN’s disclosure. (Id. (emphasis added).)11 Just as the disclosures of Facebook IDs in Hulu “identifie[d] the Hulu user’s actual identity on Facebook,” Hulu, 2014 WL 1724344, at *13, CNN’s disclosure’s “actually identif[ied]” Perry within Bango’s databases, and allowed Bango to “attribute their private viewing habits to their digital dossiers” within Bango’s records. (Compl. ¶ 26.) In sum, CNN “disclose[d] a unique identifier” (a MAC Address) to a third party (Bango) that already possessed a “correlated look-up table.” Hulu, 2014 WL 1724344, at *11. Thus, the MAC Addresses disclosed were “not anonymous and [were] the equivalent of the identification of a specific person.” Id. As such, CNN’s disclosures identified Perry as having viewed specific videos, and contained PII under the VPPA. 11 CNN’s reliance on Low v. LinkedIn Corp., 900 F. Supp. 2d 1010 (N.D. Cal. 2012) in this regard is misplaced. In Low, the Court dismissed the plaintiffs’ data disclosure claims for failure to allege that anyone had actually identified them through the disclosures. Id. at 1025. Because Perry has alleged that Bango did identify him by MAC Address (and how), (see Compl. ¶¶ 14–26), Low does “not alter the conclusion” that the information CNN disclosed was personally identifying. Hulu, 2014 WL 172344, at *11. Case 1:14-cv-02926-ELR Document 52 Filed 12/13/14 Page 25 of 35 19 II. Perry is a “Consumer” Entitled to the VPPA’s Protections Because He Downloaded, Installed, and Used the App to View Video Content. CNN next argues that Perry does not meet the VPPA’s definition of “consumer,” which is “any renter, purchaser, or subscriber of goods or services from a video service provider[.]” 18 U.S.C. § 2710(a)(1). (See MTD at 22–23.) Once again, the VPPA does not provide the definitions of those terms and thus, the Court must interpret them as they are “commonly understood” and by using their “ordinary and plain meaning.” United States v. Frank, 599 F.3d 1221, 1234 (11th Cir. 2010). A. Perry is a “Subscriber” Under the VPPA Because He Downloaded, Installed, and Used the App to View Regularly Updated Video Content. With regard to online services like the App, “subscribe” means “[a]n arrangement by which access is granted to an online service.”12 In re Hulu Privacy Litig., No. 11-03764, 2012 WL 3282960, at *8 (N.D. Cal. Aug. 10, 2012) (finding plaintiffs subscribers where they alleged that they were “subscribers” and that “[t]hey visited hulu.com and viewed video content,” “regardless of whether they were registered and logged in.”); Ellis, 2014 WL 5023535, at *2 (“[Plaintiff] 12 See, e.g., subscribe (1.1), Oxford Dictionaries, http://www.oxforddictionaries.com/definition/english/subscribe (last accessed Dec. 10, 2014); subscribe, Encyclopedia.com, http://www.encyclopedia.com/topic/subscribe.aspx (last accessed Dec. 10, 2014). Case 1:14-cv-02926-ELR Document 52 Filed 12/13/14 Page 26 of 35 20 downloaded the CN App and used it to watch video clips. His Android ID and viewing history were transmitted to Bango. These facts suffice to qualify the Plaintiff as a ‘subscriber,’ and as such, a ‘consumer.’”). Here, Perry’s allegations make him a “subscriber” in the online and mobile context. As in Hulu and Ellis, Perry alleges that he downloaded the App (thus entering into an agreement with CNN to provide him streaming video content through the App) and requested and received videos from CNN through the App. (Compl. ¶¶ 34, 48, 49.) Thus, Perry is a subscriber under the plain meaning of the term. See In re Hulu Privacy Litig., 2012 WL 3282960, at *8; Ellis, 2014 WL 5023535, at *2. B. Perry “Rented from CNN” Because He Provided a Benefit in Exchange for a Temporary License to Use CNN’s Video Materials. CNN also argues that Perry is not a “renter” (and therefore, not a “consumer”) of its video content because “‘renter’ necessarily implies payment of money.” (MTD at 23.) This argument also misses its mark. “Rent” commonly refers to the act of being “let or hired out at a specified rate[.]”13 In other words, a “renter” relationship is based upon the exchange of 13 Rent (1.2), http://www.oxforddictionaries.com/us/definition/american _english/rent?q=rent; see also rent (1.1), id., (defining “rent” as an act ([o]f an owner) let[ting] someone use (something) in return for payment). Case 1:14-cv-02926-ELR Document 52 Filed 12/13/14 Page 27 of 35 21 “consideration” for the temporary use of property. Black’s Law Dictionary (3rd Pocket Ed. 2006) (defining “Rent”). In line with this definition, “valuable consideration” is defined as “consideration that [] confers a pecuniarily measurable benefit on one party[.]” Black’s Law Dictionary (3rd Pocket Ed. 2006). As such, to be a “renter” does not require the exchange of money, as CNN argues, but rather the exchange of a benefit between the parties. Perry’s allegations demonstrate that he is a “renter” under the common usage of the term. In particular, he alleges that he was granted a license to view specific videos on the App in exchange for exposure to additional advertisements, and limited access to Perry’s data. (Compl. ¶ 48.) Thus, Perry also rented videos from CNN by generating additional advertising revenues for it in exchange.14 14 CNN argues that its relationship with Perry is more akin to that of a viewer to a free broadcast television station than a renter and lender. (MTD at 24.) But, unlike a television viewer (who can control the channel selected, but not the programming on that channel), Perry selected specific video content at will in exchange for being exposed to advertising. (Compl. ¶ 48.) Additionally, unlike broadcast television advertising (which is based on samples of viewing habits), CNN receives increased advertising revenue for each additional video watched on the App, including those watched by Perry. (Id. ¶ 21.) Finally, unlike broadcast television, Perry’s viewing of videos on the App created (and ultimately led to the disclosure of) the very video viewing records the Act was meant to protect. See S. Rep. 100-599 at *2. Case 1:14-cv-02926-ELR Document 52 Filed 12/13/14 Page 28 of 35 22 III. CNN’s Violation of Perry’s Video Privacy Rights Constituted an Injury- in-Fact, Conferring Upon Him Standing to Sue. CNN next contends that Perry lacks standing to sue because he does not allege that he suffered any “injury in fact” independent of the violation of his statutory rights, which CNN “believes” is required by Article III. (MTD at 24.) As an initial matter, it is hornbook law that the violation of a substantive right created by statute, even without more, can be the injury-in-fact sufficient to confer Article III standing. The Supreme Court has consistently held that “Congress can enact statutes creating legal rights, the invasion of which creates standing, even though no injury would exist without the statute.” Linda R.S. v. Richard D., 410 U.S. 614, 617 n.3 (1973); see also Warth v. Seldin, 422 U.S. 490, 500 (1975); Havens Realty Corp. v. Coleman, 455 U.S. 363, 373–74 (1982). “Essentially, the standing question in such cases is whether the constitutional or statutory provision on which the claim rests properly can be understood as granting persons in the plaintiff’s position a right to judicial relief.” Warth, 422 U.S. at 500. Second, despite CNN’s belief that “[t]his Circuit has not squarely addressed the question of whether a statutory violation alone confers Article III standing,” (MTD at 25), the 11th Circuit has decreed that “Congress may enact statutes creating legal rights, the invasion of which creates standing, even though no injury would exist without the statute.” United States v. Weiss, 467 F.3d 1300, 1311 (11th Case 1:14-cv-02926-ELR Document 52 Filed 12/13/14 Page 29 of 35 23 Cir. 2006) (citing Warth, 422 U.S. at 500). As such, 11th Circuit authority supports finding the violation of Perry’s statutory rights sufficient to establish standing. Here, the VPPA confers a right to privacy in the viewing of videos, and an enforcement right on any “person aggrieved by any act of a person in violation of” its provisions. 18 U.S.C. § 2710(c). Because the Act confers a substantive right and provides that a “person aggrieved” by its violation may sue, any such person has “suffer[ed] an injury ‘in precisely the form the statute was intended to guard against.’” Kyles v. J.K. Guardian Sec. Servs., Inc., 222 F.3d 289, 298 (7th Cir. 2000) (quoting Havens Realty Corp., 455 U.S. at 373). The Seventh Circuit, in the only appellate case to date addressing Article III standing to assert a VPPA claim, recently confirmed that no additional injury is necessary beyond disclosure. See Sterk v. Redbox Automated Retail, LLC, 770 F.3d 618, 623 (7th Cir. 2014). After reciting the three-pronged standing test, the Seventh Circuit noted, “‘technical’ violations of the statute (i.e., impermissible disclosures of one’s sensitive, personal information) are precisely what Congress sought to illegalize by enacting the VPPA.” Id. From that, the court held that because “Congress does have the power to ‘enact statutes creating legal rights, the invasion of which creates standing, even though no injury would exist without the statute,’” (id. (quoting Kyles, 222 F.3d at 294)), the plaintiffs’ assertion that their Case 1:14-cv-02926-ELR Document 52 Filed 12/13/14 Page 30 of 35 24 information had been disclosed in violation of the VPPA demonstrated the injury- in-fact required. Id. Even the Ellis court, which CNN cites favorably, agreed. Ellis, 2014 WL 5023535, at *2 (concluding that “because the Plaintiff is alleging a violation of the VPPA, he alleges an injury.”); see also In re Hulu, Case No. 3:11- cv-03764, Dkt. 64 at 10 (N.D. Cal. June, 11, 2012) (“Plaintiffs establish an injury (and standing) by alleging a violation of [the VPPA].”) In response, CNN argues that two out-of-circuit ERISA cases establish that statutory rights are irrelevant to the standing analysis. (MTD at 24.) In David v. Alphin, 704 F.3d 327, 338–39 (4th Cir. 2013), the Fourth Circuit found that ERISA plaintiffs who suffered no financial harm could not satisfy Article III’s standing requirement by asserting their statutory rights “to ensure that the Pension Plan is operated in accordance with law, the fiduciaries discharge their duties with care, skill, prudence, loyalty, and diligence, and that fiduciaries do not engage in self- dealing.” Id. at 339. CNN argues that holding was echoed by the Second Circuit in Kendall v. Employees Ret. Plan of Avon Prods., 561 F.3d 112, 121 (2d Cir. 2009). Those two cases, however, are fundamentally off-point, because they involved ERISA claims, which are brought by plan members who sue “on behalf of the Pension Plan,” and “are not permitted to recover individually.” David, 704 F.3d at 332. In those cases, the plaintiffs could only point to ERISA’s creation of Case 1:14-cv-02926-ELR Document 52 Filed 12/13/14 Page 31 of 35 25 an enforcement mechanism (i.e., a private right of action), and not to any substantive “legal right[], the invasion of which creates standing.” Warth, 422 U.S. 490, 500 (1975). That is, when someone violates ERISA’s fiduciary requirements, that person is liable to the plan itself, not to the plan’s individual members. 29 U.S.C. § 1109. In contrast, the VPPA creates both a cause of action and an individual right of enforcement—when a video tape service provider violates the VPPA with regard to a particular person, they are then liable to that person “in an amount of $2,500.” 18 U.S.C. § 2710(c). Thus, rather than addressing whether an individual has standing when he brings a suit on his own behalf alleging that an illegal action has caused him a personal injury (i.e., the invasion of his rights), CNN’s authorities address the unrelated issue of whether a person who is not entitled to any direct relief can have standing to sue. Id. In fact, the Kendall court itself recognized as much, and reiterated that where, as here, a statute gives a person “in the plaintiff’s position a right to judicial relief,” the “invasion of [a right created by statute] creates standing.” Kendall, 561 F.3d at 118 (quoting Warth, 422 U.S. at 500). Accordingly, because CNN violated Perry’s right to privacy in his viewing records, he has Article III standing to sue. Case 1:14-cv-02926-ELR Document 52 Filed 12/13/14 Page 32 of 35 26 CONCLUSION For the reasons stated above, Plaintiff Ryan Perry respectfully requests that the Court deny CNN’s Motion to Dismiss and award such other and further relief as it deems reasonable and just. Respectfully submitted, RYAN PERRY, individually and on behalf of all others similarly situated, Dated: December 13, 2014 By: /s/ Benjamin H. Richman One of Plaintiff’s Attorneys Jay Edelson (pro hac vice) jedelson@edelson.com Rafey S. Balabanian (pro hac vice) rbalabanian@edelson.com Benjamin H. Richman (pro hac vice) brichman@edelson.com J. Dominick Larry (pro hac vice) nlarry@edelson.com EDELSON PC 350 North LaSalle Street, Suite 1300 Chicago, Illinois 60654 Tel: 312.589.6370 Fax: 312.589.6378 Jennifer Auer Jordan Georgia Bar No. 027857 jennifer@thejordanfirm.com THE JORDAN FIRM, LLC 1447 Peachtree Street, N.E., Suite 880 Atlanta, Georgia 30309 Tel: 404.445.8400 Fax: 404.445.8477 Case 1:14-cv-02926-ELR Document 52 Filed 12/13/14 Page 33 of 35 27 CERTIFICATE OF COMPLIANCE Pursuant to Local Rule 7.1(D), the undersigned counsel for Plaintiff certifies that the pleading has been prepared in Times New Roman, 14-point type, which is of the font selections approved by the Court in Local Rule 5.1(B). /s/ Benjamin H. Richman Case 1:14-cv-02926-ELR Document 52 Filed 12/13/14 Page 34 of 35 28 CERTIFICATE OF SERVICE I hereby certify that on December 13, 2014, I electronically filed the above and foregoing with the Clerk of Court using the CM/ECF system, which will send a notice of electronic filing to all counsel of record. /s/ Benjamin H. Richman Case 1:14-cv-02926-ELR Document 52 Filed 12/13/14 Page 35 of 35