Robinson v. Disney Online d/b/a Disney Interactive

RESPONSE in Opposition to Motion re: 30 MOTION to Dismiss First Amended Complaint. . Document

S.D.N.Y.October 3, 2014

UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK JAMES ROBINSON, individually and on behalf of all others similarly situated, Plaintiff, No. 14-cv-04146-RA (DCF) v. The Honorable Ronnie Abrams DISNEY ONLINE d/b/a DISNEY INTERACTIVE, a California Corporation, Defendant. _______________________________________ PLAINTIFF’S RESPONSE IN OPPOSITION TO DEFENDANT’S MOTION TO DISMISS Case 1:14-cv-04146-RA Document 33 Filed 10/03/14 Page 1 of 29 i TABLE OF CONTENTS INTRODUCTION .............................................................................................................1 BACKGROUND ................................................................................................................3 ARGUMENT ......................................................................................................................4 I. Robinson Adequately Alleges that Disney’s Disclosure of His PII to Adobe Identified Him as Having Viewed Specific Video Materials ..............................4 A. The VPPA’s definition of PII is broad, and the context-based, case-by-case analysis it requires supports the conclusion that the information Disney disclosed to Adobe is PII .........................................5 B. The context of Disney’s disclosures: Robinson alleges sufficient facts to show that the information Disney disclosed is PII within the VPPA’s meaning ..................................................................................9 C. Disney’s cited authorities do not require a finding that its disclosures were not PII ...........................................................................14 II. Robinson Falls Within the VPPA’s Definition of a “Consumer” Because He Downloaded and Installed the Disney Channel on His Roku Device, and Used it to Watch Video Content ..................................................................18 A. As a Disney Channel subscriber, Robinson’s privacy is protected by the VPPA .............................................................................................19 B. Because Disney provided Robinson a temporary license to access and view videos in exchange for being exposed to advertisements, he is also a “renter” of those videos ........................................................20 CONCLUSION ................................................................................................................22 Case 1:14-cv-04146-RA Document 33 Filed 10/03/14 Page 2 of 29 ii TABLE OF AUTHORITIES UNITED STATES SUPREME COURT CASES: Asgrow Seed Co. v. Winterboer, 513 U.S. 179 (1995) ......................................................19 Bell Atl. Corp. v. Twombly, 550 U.S. 554 (2007) ................................................................4 Erickson v. Pardus, 551 U.S. 89 (2007) ..............................................................................4 UNITED STATES CIRCUIT COURT OF APPEALS CASES: In re Facebook Privacy Litig., 572 Fed. Appx. 494 (9th Cir. 2014) ...........................21, 22 Kaluczky v. City of White Plains, 57 F.3d 202 (2d Cir. 1995) ...................................4, 9, 17 Pruitt v. Comcast Cable Holdings, LLC, 100 Fed. Appx. 713 (10th Cir. 2004) .........10, 17 York v. Assoc. of Bar of City of New York, 286 F.3d 122 (2d. Cir. 2002) .............12, 13, 15 UNITED STATES DISTRICT COURT CASES: Awbrey v. Great Atl. & Pac. Tea Co., 505 F. Supp. 604 (N.D. Ga. 1980) ..........................9 In re Hulu Privacy Litig., No. 11-cv-3764, 2012 WL 3282960 (N.D. Cal. Aug. 10, 2012) ...............................................19, 20 In re Hulu Privacy Litig., No. 11-cv-3764, 2014 WL 1724344 (N.D. Cal. Apr. 28, 2014) ............................................... passim In re Nickelodeon Consumer Privacy Litig., MDL No. 2443, 2014 WL 3012873 (D. N.J. July 2, 2014) ..............................................................13 Joao v. Cenuco, Inc., 376 F. Supp. 2d 380 (S.D.N.Y. 2005) .............................................21 Johnson v. Microsoft Corp., No. 06-cv-900, 2009 WL 1794400 (W.D. Wash. June 23, 2009) ...................................................18 Low v. LinkedIn Corp., 900 F. Supp. 2d 1010 (N.D. Cal. 2012) .......................................18 Sneed v. SEI/Aaron’s, Inc., No. 13-cv-982, 2013 WL 6669276 (ND. Ga. Dec. 18, 2013) ...........................................................9 Steinberg v. CVS Caremark Corp., 899 F. Supp. 2d 331 (E.D. Pa. 2012) ........................18 Case 1:14-cv-04146-RA Document 33 Filed 10/03/14 Page 3 of 29 iii U.S. Engine Prod., Inc. v. AGCS Marine Ins. Co., 769 F. Supp. 2d 626 (S.D.N.Y. 2011) ...................................................................21 Viacom Int’l Inc. v. YouTube, Inc., 253 F.R.D. 256 (S.D.N.Y.) ..................................17, 18 RULES AND STATUTES: 18 U.S.C. § 2710 ..........................................................................................................1, 5, 6 Fed. R. Civ. P. 12(b)(6)..................................................................................................4, 12 MISCELLANEOUS: Arvind Narayanan & Vitaly Shmatikov, Myths and Fallacies of “Personally Identifiable Information,” 53 Comms. of the ACM 24 (2010) ...............................8 Arvind Narayanan & Vitaly Shmatikov, Robust De-Anonymization of Large Sparse Datasets, 29 Proces. of the 2008 IEEE Sym. on Security and Privacy 111 (2008) ...................................................................................................8 Black’s Law Dictionary (3d. Pocket ed. 2006) ..................................................................20 Data Brokers: A Call for Transparency and Accountability, Federal Trade Commission (May 2014), available at http://www.ftc.gov/reports/data-brokers-call- transparency-accountability-report-federal-trade-commission-may-2014 ..............8 Guide to Protecting the Confidentiality of Personally Identifiable Information (PII), NIST Special Publication 800-122, at ES-1 (Apr. 2010) .....................................7, 8 Paul Ohm, Broken Promises of Privacy: Responding to the Surprising Failure of Anonymization, 57 U.C.L.A. L. Rev. 1701 (Aug. 2010) ...........................11, 13, 18 Rent (1.1, 1.2), Oxford Dictionaries, http://www.oxforddictionaries.com/us/definition/american_english/rent?q=rent (last accessed Sept. 30, 2014) ................................................................................20 subscribe, Encyclopedia.com, http://www.encyclopedia.com/topic/subscribe.aspx (last accessed Sept. 30, 2014) ................................................................................19 subscribe (1.1), Oxford Dictionaries, http://www.oxforddictionaries.com/definition/english/subscribe (last accessed Sept. 30, 2014) ................................................................................19 subscribing (2), FindMe Words, http://www.findmewords.com/definition-of- subscribing.html (last accessed Sept. 30, 2014) ....................................................19 Case 1:14-cv-04146-RA Document 33 Filed 10/03/14 Page 4 of 29 iv S. Rep. No. 100-500 (1988) ...........................................................................................6, 20 Case 1:14-cv-04146-RA Document 33 Filed 10/03/14 Page 5 of 29 1 INTRODUCTION Defendant Disney Online d/b/a Disney Interactive (“Disney”) is a well-known multimedia and entertainment company. In addition to delivering its feature films and other video content through traditional avenues (like movie theaters and video sales), Disney now offers its products through various Internet-enabled consumer devices. The focus of this lawsuit is the so-called “Disney Channel,” which is delivered to consumers’ televisions over the Internet via a set-top streaming device known as the Roku. Unbeknownst to Disney Channel users, each time they watched videos on the Channel, Disney disclosed their personally identifiable information (“PII”) in the form of the hashed version of their Roku device serial numbers, and video viewing histories, to data analytics giant Adobe Systems, Inc. (“Adobe”). When disclosed to Adobe—a company that specializes in gathering information and analyzing consumer habits for targeted advertising and marketing purposes—this information identifies specific individuals as having viewed specific videos. Plaintiff James Robinson is one such consumer who subscribed to the Channel and whose unique Roku serial number and video viewing history Disney disclosed to Adobe without authorization. In response, he filed this case, and later, his First Amended Class Action Complaint and Demand for Jury Trial (“Complaint”) (Dkt. 20), on behalf of himself and all other Disney Channel subscribers, alleging that Disney violated the Video Privacy Protection Act, 18 U.S.C. § 2710 (“VPPA”), which expressly prohibits such disclosures of PII. Disney now seeks dismissal of the case for two reasons. First, it argues that Robinson fails to state a claim because the Roku serial numbers it admittedly disclosed to Case 1:14-cv-04146-RA Document 33 Filed 10/03/14 Page 6 of 29 2 Adobe do not alone identify specific individuals and therefore, do not constitute PII. Failing that, it argues that even if the serial numbers could be considered PII in the appropriate context, Robinson has not alleged facts sufficient to suggest that such a context exists here. Disney is mistaken on a number of levels. Congress and the courts have been clear that the term “personally identifiable information” should be broadly construed to encompass more than just actual names and physical addresses, and that the analysis of what constitutes PII requires case-by-case consideration of the context in which the disclosure is made (e.g., whether the information disclosed is combined with other data to identify an individual). Thus, the question here is not whether the hashed Roku serial number alone identifies a specific individual, but whether it does so in the context of the specific disclosures Disney made to Adobe. Moreover, Congress, the courts, government agencies, and leading privacy researchers all agree that unique identifiers, like the hashed Roku serial numbers disclosed by Disney here, can and often are used to identify specific individuals. Because Robinson details in his Complaint how, as part of its business, Adobe links the hashed serial numbers and viewing histories with existing consumer information in its databases to identify and track consumers across multiple devices and platforms, he has alleged more than enough to state a claim for Disney’s violations of the VPPA. That is especially true given that at this stage of the proceedings, those allegations must be accepted as true and all reasonable inferences drawn in Robinson’s favor. Second, Disney argues that Robinson is neither a “subscriber” to the Disney Channel nor a “renter” of its content, and therefore is not a “consumer” protected by the Case 1:14-cv-04146-RA Document 33 Filed 10/03/14 Page 7 of 29 3 VPPA. These arguments fail as well. Under the relevant legal authority and common usage of those terms, Robinson sufficiently alleges that he subscribed to the Disney Channel because he downloaded, installed, and used it to watch videos through his Roku. Further, he has sufficiently alleged that he was a “renter” inasmuch as he provided valuable consideration to Disney—in the form of his exposure to advertisements that resulted in Disney receiving additional revenue—in exchange for a temporary license to watch videos through the Channel. For these reasons, and as explained further below, the Court should deny Robinson’s motion in its entirety and allow his claim to proceed. BACKGROUND Disney is one of the world’s most prominent multimedia and entertainment companies. (See First Amended Class Action Complaint and Demand for Jury Trial, Compl. ¶ 1.) In addition to its movies, theme parks, and cable television channel, Disney distributes its content through a proprietary software application (the Disney Channel) developed for use with a digital-media-streaming device known as the Roku. (Id.) Relevant here, viewers of the Disney Channel are not required to (and do not) consent to the disclosure of their PII. (Id. ¶ 11.) Nevertheless, each time a consumer watched a video on the Disney Channel, Disney disclosed information to Adobe that identified what each consumer had watched on the Channel. (Id. ¶ 15.) Adobe is a “third-party data analytics company.” (Id. ¶ 3.) “The business models of such ‘big data’ analytics companies center on the collection of disparate pieces of uniquely identifying information and online behavioral data about individual consumers, which they then compile to form comprehensive profiles about a person’s entire digital Case 1:14-cv-04146-RA Document 33 Filed 10/03/14 Page 8 of 29 4 life. These profiles can then be used for targeted advertising, sold as a commodity to other data brokers, or both.” (Id.) The records Disney disclosed to Adobe included the first 15 characters of the titles of each video the users watched, as well as a hashed version of each user’s Roku device’s serial number. (Compl. ¶ 42.) Robinson alleges that based on the massive stores of information Adobe possesses about individual consumers, the Roku serial numbers received by Adobe allowed it to identify specific users and associate them with specific video viewing histories. (Id. ¶¶ 42, 56 – 59.) For his part, Robinson downloaded and used the Disney Channel to “view numerous video clips.” (Id. ¶ 39.) He never granted Disney permission to disclose his PII to anyone. (Id. ¶ 40, 42, 60.) But, each time he viewed content on the Disney Channel, Disney disclosed his PII (in the form of his viewing history and hashed Roku serial number) to Adobe. (Id. ¶¶ 42, 56 – 59.) ARGUMENT “In reviewing a complaint under [Rule 12(b)(6), courts] accept as true the material facts alleged in the complaint and draw all reasonable inferences in plaintiff’s favor.” Kaluczky v. City of White Plains, 57 F.3d 202, 206 (2d Cir. 1995). To survive such a motion, a complaint need not plead “[s]pecific facts,” but instead, must contain a statement of the claim that “give[s] the defendant fair notice of what the . . . claim is and the grounds upon which it rests.” Erickson v. Pardus, 551 U.S. 89, 93 (2007) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 554, 555 (2007)). I. Robinson Adequately Alleges that Disney’s Disclosure of His PII to Adobe Identified Him as Having Viewed Specific Video Materials. Disney raises two challenges to Robinson’s assertion that the information it Case 1:14-cv-04146-RA Document 33 Filed 10/03/14 Page 9 of 29 5 disclosed is PII within the VPPA’s meaning. First, it argues that disclosures of unique device identifiers—used by companies like Adobe to track users’ activities across a variety of media—categorically cannot be personally identifying. Second, it argues that Robinson’s allegations providing the context supporting his assertions that Roku device identifiers, when disclosed to companies like Adobe, are personally identifying, are irrelevant and inadequately pled. As an initial matter, Congress, the courts, and government agencies such as the Federal Trade Commission (“FTC”) have been clear that “personally identifiable information” includes much more than consumers’ actual names and physical addresses. Instead, it can be any type of information that, within a given context, serves to actually identify a specific individual as having requested specific video materials. (See Section I.A, infra.) Second, Robinson adequately alleges the contextual facts necessary to show that the information disclosed by Disney identified Robinson when it was disclosed to Adobe. (See Section I.B, infra.) And third, none of the authorities relied on by Disney change the result. (See Section I.C, infra.) Accordingly, Disney’s motion should be denied and Robinson should be allowed to proceed with his claim. A. The VPPA’s definition of PII is broad, and the context-based, case-by- case analysis it requires supports the conclusion that the information Disney disclosed to Adobe is PII. Disney would have the Court believe that the only way it could violate the VPPA is by disclosing a customer’s name, address, and video rental history to a third party in plain-text format. The VPPA’s definition of PII, however, while it would certainly encompass such a disclosure, is not so narrowly limited. The VPPA defines “personally identifiable information” as “includ[ing] information which identifies a person as having requested or obtained specific video Case 1:14-cv-04146-RA Document 33 Filed 10/03/14 Page 10 of 29 6 materials or services from a video tape service provider.” 18 U.S.C. § 2710(a)(3) (emphasis added). That definition does not limit PII to traditional methods of identification like names and addresses, but instead, “plainly encompasses other means of identifying a person.” In re Hulu Privacy Litig., No. 11-cv-3764, 2014 WL 1724344, at **7, 11 (N.D. Cal. Apr. 28, 2014) (“Hulu”). Nonetheless, and despite the fact that analytics companies like Adobe use device identifiers (whether in plain-text or hashed format), Disney asserts that the Roku serial numbers and video viewing histories it disclosed are not PII and thus, do not fall within the VPPA’s purview. (See Memorandum of Law in Support of Defendant’s Motion to Dismiss First Amended Complaint, Dkt. 31 (“Def. Br.”) at 7.) Disney is mistaken. The Northern District of California recently issued an opinion that comprehensively analyzed the meaning of “personally identifiable information” under the VPPA and found that the statutory language, legislative history, and case law confirm that a video viewing history tied to a unique identifier—like a hashed Roku serial number—could certainly constitute PII. See Hulu, 2014 WL 1724344, at *13. The Hulu court began by recognizing that the VPPA does not expressly address whether unique user IDs constitute PII. See id. at *7. Thus, it turned to the legislative history to determine Congress’s intent in enacting the VPPA, which, simply put, was “[t]o preserve personal privacy with respect to the rental, purchase or delivery of video tapes or similar audio visual materials.” Id. at *8 (citing S. Rep. No. 100-500, at 2 (1988)). As Senator Patrick Leahy explained, It is nobody’s business what Oliver North or Robert Bork or Griffin Bell or Pat Leahy watch on television or read . . . In an era of interactive television cables, the growth of computer checking and check-out counters, of security systems and telephones, all lodged together in Case 1:14-cv-04146-RA Document 33 Filed 10/03/14 Page 11 of 29 7 computers, it would be relatively easy at some point to give a profile of a person and tell what they buy in a store, what kind of food they like, what sort of television programs they watch . . . . I think that is wrong . . . and I think it is something that we have to guard against. S. Rep. No. 100-599, at 5 – 6. The Hulu court also noted that the Senate Report includes a section-by-section analysis of the VPPA, explaining that, “[u]nlike the other definitions in this subsection, [the definition of the term ‘personally identifiable information’] uses the word ‘includes’ to establish a minimum, but not exclusive, definition of personally identifiable information.” Hulu, 2014 WL 1724344, at *11. In that light, the court concluded that the VPPA does not limit identification of individuals merely to traditional methods like “a name necessarily.” Id. (“One can be identified in many ways: by a picture, by pointing, by an employee number, by the station or office or cubicle where one works, by telling someone what ‘that person’ rented.”). Instead, “the statute, the legislative history, and the case law . . . require the identification of a specific person tied to a specific transaction, and support the conclusion that [although] a unique anonymized ID alone is not PII . . . context could render it not anonymous and the equivalent of the identification of a specific person.” Id. (emphasis added). The Hulu court’s analysis is consistent with findings by several government agencies and leading academics. By way of example, according to the National Institute of Standards and Technology (“NIST”), “PII is any information about an individual maintained by an agency, including (1) any information that can be used to distinguish or trace an individual’s identity . . . and (2) any other information that is linked or linkable to an individual[.]” Guide to Protecting the Confidentiality of Personally Identifiable Information (PII), NIST Special Publication 800-122, at ES-1 (Apr. 2010). In reaching Case 1:14-cv-04146-RA Document 33 Filed 10/03/14 Page 12 of 29 8 that conclusion, NIST identified two particularly relevant examples of PII: “Asset information, such as Internet Protocol (IP) addresses . . . or other host-specific persistent static identifier that consistently links to a particular person or small, well-defined group of people[,]” id. at 2-2, like the hashed Roku serial numbers Disney disclosed to Adobe here.1 Perhaps of equal importance is the FTC’s guidance on the issue. In a recent study responding to data brokers’ claims that they don’t maintain “profiles” on consumers, the FTC concluded that it makes no difference whether the steward of the data (like Adobe here) breaks up PII and stores it in separate repositories, or keeps it together in a centralized database. See Data Brokers: A Call for Transparency and Accountability at 22, Federal Trade Commission (May 2014), available at http://www.ftc.gov/reports/data- brokers-call-transparency-accountability-report-federal-trade-commission-may-2014. The agency’s investigation revealed that rather than storing the data in one location, the brokers organized information by “events,” and performed queries to generate on-the-fly profiles of consumers. Id. Others substituted real names for unique identifiers. Id. at n.56. In either case, the data is PII. This is the reality of modern computing and data analytics. Accordingly, where, as here, a video service provider (like Disney) discloses a unique identifier (like a Roku serial number) and video viewing history to a third party 1 The Hulu court’s analysis is also consistent with that of noted privacy scholars Arvind Narayanan and Vitaly Shmatikov, who have concluded that “[w]hile some attributes may be uniquely identifying on their own, any attribute can be identifying in combination with them.” See Arvind Narayanan & Vitaly Shmatikov, Myths and Fallacies of “Personally Identifiable Information,” 53 Comms. of the ACM 24, 26 (2010). Notably, the researchers have reduced their theories to practice demonstrating how seemingly unassigned personal attributes in a dataset may be combined with other sources to identify a specific person. See Arvind Narayanan & Vitaly Shmatikov, Robust De-Anonymization of Large Sparse Datasets, 29 Procs. of the 2008 IEEE Sym. on Security & Privacy 111 (2008). Case 1:14-cv-04146-RA Document 33 Filed 10/03/14 Page 13 of 29 9 (like Adobe) which actually uses that information to identify specific individuals and the video materials they viewed, the information disclosed is PII. Hulu at *11 (“One could not skirt liability under the VPPA, for example, by disclosing a unique identifier and a correlated look-up table.”).2 B. The context of Disney’s disclosures: Robinson alleges sufficient facts to show that the information Disney disclosed is PII within the VPPA’s meaning. Turning to the context of the disclosures in this case, Disney argues that the information allegedly disclosed by Disney “do[es] not ‘identify a person’ and, therefore, do[es] not constitute a prohibited disclosure of PII under the VPPA.” (Def. Br. at 7.) Disney also argues that the contextual allegations in Plaintiff’s Complaint—which establish how and why the information disclosed by Disney is identifying when shared with Adobe—are irrelevant and improper. Disney’s arguments, however, misread the allegations in the Complaint and misconstrue the governing law. To start, Robinson alleges that the information disclosed by Disney (i.e., a hashed 2 Importantly, the Hulu decision was on summary judgment, where the plaintiffs were no longer entitled to the presumption that their allegations were correct and instead were required to produce evidence that the disclosures at issue identified them specifically. It was for this reason—a lack of evidence that a unique identifier had actually been tied to them specifically—that the Hulu Court ultimately granted summary judgment as to two types of disclosures made. See Hulu, 2014 WL 1724344, at ** 12 – 13. Here, by contrast, Robinson’s allegations that Adobe actually identified him and the other Class members, (Compl. ¶ 57), must be taken as true, and can also be plausibly inferred from the nature of Adobe’s business (i.e., identifying specific consumers using persistent identifiers such as Roku serial numbers (Compl. ¶¶ 16 – 29); see Kaluczky, 57 F.3d at 206; Sneed v. SEI/Aaron’s, Inc., No. 13-cv-982, 2013 WL 6669276, at *2 (ND. Ga. Dec. 18, 2013) (finding allegation that “the Plaintiff believe[d] the Defendant ha[d] accessed specific aspects of her private information using a specific software program the Defendant installed on her computer” sufficient even where she could not be certain of as much sufficient to state a claim, as “it is unclear how the Plaintiff could know at this time beyond information and belief whether the Defendant actually accessed the Plaintiff’s computer.”) (citing Awbrey v. Great Atl. & Pac. Tea Co., 505 F. Supp. 604, 607 (N.D. Ga. 1980)). Case 1:14-cv-04146-RA Document 33 Filed 10/03/14 Page 14 of 29 10 version of his unique Roku serial number) identified him to Adobe as having viewed specific video materials. (Compl. ¶¶ 16 – 21, 42, 54 – 57.) From there, Robinson details how—given Adobe’s existing wealth of data about him and the other Class members— the disclosures identified him as having viewed specific video materials, and “allowed Adobe to . . . attribute his viewing choices to his profile.” (Id. ¶ 56.) He also details how that information is personally identifying when disclosed to Adobe. (Compl. ¶¶ 22 – 29, 55 – 57). What Disney is alleged to essentially have done, then, is “disclose a unique identifier” (his Roku serial number) to a third party (Adobe) that already possessed a “correlated look-up table.” Hulu, 2014 WL 1724344, at *11. Given the context of the disclosures at issue—that they were made to Adobe, which possesses troves of information on individual consumers, including information obtained from Roku devices—the Roku serial numbers disclosed were “not anonymous and [were] the equivalent of the identification of a specific person.” Id. (explaining that Pruitt v. Comcast Cable Holdings, LLC, 100 Fed. Appx. 713 (10th Cir. 2004) “suggests that if an anonymous, unique ID were disclosed to a person who could understand it, that might constitute PII.”). As such, Disney’s disclosures identified Robinson as having watched specific video materials, and constituted disclosures of PII under the VPPA. Disney asserts that these contextual allegations are inadequately pled. (Def. Br. at 12.) To start, Disney begins its attack with a false premise: that in order for the information disclosed to Adobe to be personally identifying, Adobe must both “(1) obtain[] Roku device serial numbers and personal information for DI Channel users from Roku ‘and/or’ other unidentified third parties; and (2) associat[e] those Roku device Case 1:14-cv-04146-RA Document 33 Filed 10/03/14 Page 15 of 29 11 serial numbers and personal information in its databases.” Disney errs from the start. Adobe wouldn’t need to receive information tying the Roku serial numbers to other identifying information. Rather, Adobe would only have to associate the serial numbers with other information that is associated other information that is itself identifying (that is, the serial number need not be directly associated with other identifying information, as long as an unbroken chain of association exists). See Paul Ohm, Broken Promises of Privacy: Responding to the Surprising Failure of Anonymization, 57 U.C.L.A. L. Rev. 1701, 1716 – 26 (Aug. 2010). That information could come from other Roku channels, other data analytics or data mining companies, or even from the consumer himself in other transactions with Adobe. Thus, Disney’s argument here falls flat. Disney then offers several attacks on Robinson’s factual bases for asserting that its disclosures identified him. First, it cherry picks from the Complaint and latches on to Robinson’s reference to the Roku privacy policy, asserting that nothing therein shows that Roku shared personal information with Adobe. (Def. Br. at 13.) This misunderstands the Complaint. Robinson cites the privacy policy not to establish that Roku itself did disclose serial numbers and additional information to Adobe, but rather to establish that Roku itself considers serial numbers to be personally identifying, (Compl. ¶ 19), which is not surprising, given that (as explained above) government agencies, academics, and the data analytics industry all agree that such data can be used to identify specific individuals. (See Section I.A, supra.) Second, Disney argues that Robinson’s Complaint misinterprets a figure from Adobe’s marketing materials related to the “depth of information captured by Adobe’s data analytics services.” (Compl. ¶ 30; see also Def. Br. at 13 – 14.) As Disney points Case 1:14-cv-04146-RA Document 33 Filed 10/03/14 Page 16 of 29 12 out, the figure cited in the Complaint comes from a white paper promoting Adobe’s “Adobe Campaign” advertising service through which it helps companies “access data that already exists internally” by “aggregating customer data from different systems and mak[ing] it centrally available.” (Dkt. 51-4 at 2.) However, it does not follow (as Disney contends) that Disney would have to be an Adobe Campaign customer for Adobe to leverage the data described in the white paper and identify specific consumers using, inter alia, their hashed Roku serial numbers. Instead, the key takeaway from the white paper (and consistent with Robinson’s allegations) is that Adobe has access to that information, gathered from dozens of its clients3—whether Disney is one such client or not—and its public representations suggest that it uses such information to identify specific consumers. But again, to the extent the white paper is open to interpretation, all reasonable inferences must be drawn in Robinson’s favor at this point. See York v. Assoc. of Bar of City of New York, 286 F.3d 122, 125 (2d. Cir. 2002). Third, Disney challenges Robinson’s interpretation of the Adobe Analytics Privacy Policy. (Def. Br. at 15.) In that regard, Robinson alleges that the Privacy Policy shows that Adobe does receive identifying information (including email addresses, account information, or Facebook profile information) from its clients, supporting the inference that Adobe’s customer profiles do identify individuals. (Compl. ¶¶ 22 – 29); see also York, 286 F.3d at 215 (On a Rule 12(b)(6) motion, a court must “construe the complaint in the light most favorable to the plaintiff, accepting the complaint’s allegations as true.”) Disney points out that the Privacy Policy states that “Adobe does 3 See Partner Finder, Adobe, http://solutionpartners.adobe.com/home/partnerFinder.html (last accessed Sept. 30, 2014). Case 1:14-cv-04146-RA Document 33 Filed 10/03/14 Page 17 of 29 13 not use the information we collect for a company except as may be allowed in a contract with that company,’ which ‘is usually limited to providing [] services to the company,’” and that the only information shared between companies is “‘anonymous and does not identify individuals.’” (Def. Br. at 15.) From this, Disney surmises, it is impossible that Adobe could have combined client data and itself identified consumers. (Id.) Disney’s challenge ignores the word “usually” in the Privacy Policy, as well as the fact that even if Adobe only shared anonymous information among companies, it would still have access to that combined information in identifying form, before attempting to de-identify it. See generally Paul Ohm, Broken Promises of Privacy, supra (discussing the shortcomings of efforts to “anonymize” or “de-identify”). As such, a factual dispute exists regarding the implications of the Adobe Privacy Policy, and Disney’s argument only serves to illustrate why dismissal on the pleadings, without discovery, would be inappropriate. See York, 286 F.3d at 215. Fifth and finally, Disney asserts that its disclosures were not identifying because they involved hashed, rather than plain-text, Roku serial numbers. (Def. Br. at 15.) According to Disney, Plaintiff fails to establish that Adobe linked the hashed Roku serial device numbers to the actual plain-text serial numbers, and then again to associated personal information. (Id.) Disney misses the point. Robinson’s Complaint explains why, for purposes of identifying an individual, a hashed serial number works just as well as a plain-text one, and is in fact used by analytics companies to do so. (See Compl. ¶ 18 (“Device serial numbers operate as persistent identifiers even hashed, because each unique serial number has a corresponding unique hashed value.”); id. at ¶ 21, n.8 Case 1:14-cv-04146-RA Document 33 Filed 10/03/14 Page 18 of 29 14 (“Because hashed serial numbers (like their plain-text counterparts) are unique, they are as useful as plain-text serial numbers in acting as unique identifiers.”). Thus, the mere fact that the identifiers here are hashed serial numbers, rather than plain-text ones, is irrelevant, as Robinson alleges that they were just as effective in identifying him. At this stage, Robinson has alleged facts sufficient to show that Adobe received, by Disney’s disclosures, information that “personally identified” him as having viewed specific video materials. C. Disney’s cited authorities do not require a finding that its disclosures were not PII. None of Disney’s cited authorities require a different result, nor are they sufficient to overcome the Rule 12(b)(6) standards, which require Robinson’s allegations to be accepted as true and all reasonable inferences to be drawn in his favor. Not surprisingly, Disney relies heavily on the recent decision in In re Nickelodeon Consumer Privacy Litig., MDL No. 2443, 2014 WL 3012873, *10 (D. N.J. July 2, 2014) (“Nickelodeon”). Disney reads Nickelodeon as dictating that PII be strictly limited to actual names or close surrogates. (Def. Br. at 8 – 9.) That’s not a fair reading of the case. In Nickelodeon, the plaintiffs brought VPPA claims alleging that the defendant had disclosed their online usernames, IP addresses, and device identifiers to a third party. Nickelodeon, 2014 WL 3012873. In its discussion, the Nickelodeon Court began by examining the statute’s language, as well as the Hulu decision, and acknowledged that “‘a person’ can be identified by more than just their name and address,” id. at *19, including “by a picture, by pointing, by an employee number, by the station or office or cubicle where one works . . . .” Id. (quoting Hulu, 2014 WL 1724344, at *11). Relying on the Hulu decision, the Nickelodeon court concluded that in order to constitute PII under Case 1:14-cv-04146-RA Document 33 Filed 10/03/14 Page 19 of 29 15 the statute, “information . . . must, without more, itself link an actual person with actual video materials.” Id. While the Nickelodeon Court recognized that electronic identifiers could, with context, serve to identify specific individuals in a manner “akin to” a name, it nevertheless found that the plaintiffs in that case had failed to plead any contextual facts sufficient to support such a conclusion. Id. at **20 – 22. Ultimately, the Nickelodeon Court applied the Hulu analysis, and found that due to the plaintiffs’ failure to plead the context in which the information was disclosed, the plaintiffs had only alleged disclosure of the “type of information that might one day serve as the basis of personal identification after some effort on the part of the recipient,” and therefore failed to state a claim. Id. at *22 (emphasis added). Here, by contrast, Robinson does not allege that Adobe “might one day” use the information disclosed to identify him; rather, he alleges that because of Adobe’s existing stores of data, the information Disney disclosed did identify him to Adobe at the time it was disclosed. (Compl. ¶¶ 42, 54 – 57.) At this stage, those allegations must be taken as true, and Disney’s assertions to the contrary—that, in actual practice, the information disclosed does not identify users—are inappropriate for resolution without discovery. See York, 286 at 125 (On a Rule 12(b)(6) motion, a court must “construe the complaint in the light most favorable to the plaintiff, accepting the complaint’s allegations as true.”). Additionally, given the nature of Adobe’s business and the way it operates, the disclosures alleged by Robinson are largely similar to the Facebook disclosures recognized in Hulu and cited favorably in Nickelodeon—just as Facebook’s core business involves and depends on associating randomized Facebook IDs with specific individuals Case 1:14-cv-04146-RA Document 33 Filed 10/03/14 Page 20 of 29 16 in a manner “akin to” a name, Robinson alleges that Adobe’s business involves and depends on associating device identifiers with specific individuals in a manner “akin to” a name. (Compl. ¶¶ 22 – 29, 54 – 57.) Ultimately, Disney’s “only names count” theory of PII ignores the Hulu court’s context-dependent analysis, and practical realities as well. As the Hulu court noted, “[o]ne can be identified in many ways: by a picture, by pointing, by an employee number, by the station or office or cubicle where one works . . . .” Hulu, 2014 WL 1724344, at *11 (emphasis added). These examples demonstrate the importance of context, and of the recipient’s access to and knowledge of information that may render the disclosure identifying. For instance, were a video tape service provider to give an employer a list of its employees’ video rental histories listed by employee number—even with no other information whatsoever—such a disclosure would clearly be personally identifying. The same disclosure to a passerby on the street would be meaningless. Likewise for a video tape service provider’s disclosure of rental histories associated with specific New York drivers’ licenses. If disclosed to the New York State DMV, such a disclosure would be personally identifying. If disclosed to a local restaurant, it likely would not. Here then, the scope of Adobe’s existing databases is vitally important. And Robinson alleges that Adobe possesses and stores the information and profiles of individual consumers in sufficient detail such that Disney’s disclosures were personally identifying. (Compl. ¶¶ 22 – 29.) At this stage, he need not allege anything more. For the same reason, Disney’s characterization of the Hulu case is misplaced. There, the Court held that a plaintiff’s assertion that “[a]nonymous disclosures . . . hypothetically could have been linked to video watching” was insufficient to establish Case 1:14-cv-04146-RA Document 33 Filed 10/03/14 Page 21 of 29 17 disclosure of PII. Hulu, 2014 WL 1724344, at *1. While the plaintiffs in Hulu showed (on summary judgment) only that the third-party recipient had the “key” to allow identification of otherwise anonymous viewing histories—and expressly did not show that such a “key” was used. See id. at *12 (“There is no evidence that comScore did this. The issue is only that it could.”) Robinson here has alleged that Adobe does actually identify specific individuals as having watched specific video materials through the Disney Channel, and those allegations are entitled to a presumption of validity. (Compl. ¶¶ 22 – 29.) See also Kaluczky, 57 F.3d at 206. Equally misplaced is Disney’s reliance on Pruitt, 100 Fed. Appx. 713 and Viacom Int’l Inc. v. YouTube, Inc., 253 F.R.D. 256 (S.D.N.Y. 2008) for the proposition that unique identifiers can never be personally identifying. (See Def. Br. at 9 – 10.) In Pruitt, the court held that because the information at issue—unique anonymous identifiers stored in Comcast cable boxes—had not been combined with the identifying information from Comcast’s own databases, it was not “personally identifying.” Pruitt, 100 Fed. Appx. at 716. Thus, while “Pruitt stands for the proposition that an anonymous, unique ID without more does not constitute PII . . . it also suggests that if an anonymous, unique ID were disclosed to a person who could understand it, that might constitute PII.” Hulu, 2014 WL 1724344, at *11 (emphasis in original) (citing Pruitt, 100 Fed. Appx. at 716). Thus, because the recipient of the information in this case (Adobe), can and does identify specific individuals using the identifiers disclosed (hashed Roku serial numbers), (Compl. ¶¶ 22 – 29.), Pruitt is inapposite. Likewise for Viacom. As the Hulu court explained: What was at issue [in Viacom], however, was not the users’ identities. Instead, because the case was a copyright case against YouTube, what Case 1:14-cv-04146-RA Document 33 Filed 10/03/14 Page 22 of 29 18 mattered was the number of times the users viewed particular videos. [Viacom, 253 F.R.D. at 262.] YouTube “did not refute that the login ID is an anonymous pseudonym that users create for themselves when they sign up with YouTube which without more cannot identify specific individuals” Id. at 262. (emphasis added). The Court dismissed YouTube’s privacy concerns as speculative and ordered discovery. Id. That result makes sense: the case was about discovery to establish copyright damages, not consumers’ identities. The consumer identities were not relevant. Indeed, Viacom issued a press release that the parties would anonymize the data before disclosure to address YouTube users’ privacy concerns. [Citation omitted.] Also, the decision does not provide enough of a factual context to determine whether the user IDs in Viacom identified a person or were anonymized. The case’s holding is relevant only to the extent that it recognizes that unique anonymous IDs do not necessarily identify people. Hulu, 2014 WL 1724344, at **9 – 10.4 * * * For these reasons, the hashed Roku serial numbers disclosed by Disney allowed Adobe to identify individuals, including Robinson, as having viewed specific video materials, and are therefore PII. II. Robinson Falls Within the VPPA’s Definition of a “Consumer” Because He Downloaded and Installed the Disney Channel on His Roku Device, and Used it to Watch Video Content. Disney next argues that Robinson is not a “consumer” under the VPPA because 4 In a footnote, Disney also relies on Johnson v. Microsoft Corp., No. 06-cv-900, 2009 WL 1794400 (W.D. Wash. June 23, 2009); Low v. LinkedIn Corp., 900 F. Supp. 2d 1010 (N.D. Cal. 2012); and Steinberg v. CVS Caremark Corp., 899 F. Supp. 2d 331 (E.D. Pa. 2012) to argue that the mere possibility of identification is insufficient to make information personally identifying. As described above, however, Robinson does not allege the mere possibility of identification, but rather that he has already been identified by Adobe as having viewed specific video materials. (Compl. ¶¶ 56 – 57.) Further, those cases took a view of PII that is simply incompatible with modern technology and consumer analytics practices. In Johnson, for instance, the Court held that IP addresses are not personally identifying. 2009 WL 1794400. Given modern data practices and identification principles, however, that is simply not the case. See also Ohm, Broken Promises of Privacy, at 1772 – 74 (explaining the personally identifying nature of IP addresses). Case 1:14-cv-04146-RA Document 33 Filed 10/03/14 Page 23 of 29 19 he is neither a “subscriber” to nor a “renter” of “goods or services” as those terms are defined in the statute. (Def. Br. at 16); see also 18 U.S.C. § 2710(a)(1) (defining “consumer” as “any renter, purchaser, or subscriber of goods or services from a video tape service provider.”). Disney is wrong. Robinson is both a “subscriber” and “renter” under the VPPA. A. As a Disney Channel subscriber, Robinson’s privacy is protected by the VPPA. Disney first contends that Robinson is not a subscriber because he supposedly fails to allege “that he provided his name or any other personal information to Disney Interactive or that he viewed content regularly on the DI Channel.” (Def. Br. at 17.) This again misses the point: 1) those allegations are not required, 2) even if they were, Robinson does in fact allege as much. The VPPA does not define “subscriber.” See 18 U.S.C. § 2710(a). Thus, the Court must “give [the term its] ordinary meaning.” Asgrow Seed Co. v. Winterboer, 513 U.S. 179, 187 (1995). In the context of Internet-based services like the Disney Channel, “subscribe” refers to “[a]n arrangement by which access is granted to an online service.”5 The Hulu court confirmed as much, finding that an online video subscriber relationship existed where plaintiffs alleged that “[t]hey visited hulu.com and viewed video content,” “regardless of whether they were registered and logged in.” In re Hulu Privacy Litig., No. 11-cv-3764, 2012 WL 3282960, at *8 (N.D. Cal. Aug. 10, 2012). This usage of 5 See, e.g., subscribe (1.1), Oxford Dictionaries, http://www.oxforddictionaries.com/definition/english/subscribe (last accessed Sept. 30, 2014); subscribe, Encyclopedia.com, http://www.encyclopedia.com/topic/subscribe.aspx (last accessed Sept. 30, 2014); subscribing (2), FindMe Words, http://www.findmewords.com/definition-of-subscribing.html (last accessed Sept. 30, 2014). Case 1:14-cv-04146-RA Document 33 Filed 10/03/14 Page 24 of 29 20 “subscribe” also fulfills the VPPA’s purpose of “preserv[ing] personal privacy with respect to the . . . delivery of . . . audiovisual materials” by ensuring that video viewers will continue to have their privacy protected as technology evolves and advances. See S. Rep. No. 100-599 (1988). Like the plaintiffs in Hulu, then, Robinson used a video streaming service— provided by Disney—to view video content. (Id.) Thus, he is a “subscriber” within that word’s plain meaning because he downloaded, installed, and used the Disney Channel to receive and watch video content. (Compl. ¶ 53.) See In re Hulu Privacy Litig., 2012 WL 3282960, at *8. B. Because Disney provided Robinson a temporary license to access and view videos in exchange for being exposed to advertisements, he is also a “renter” of those videos. Disney argues further that Robinson is not a “renter” (and therefore, not a “consumer”) of its video content because he does not allege that he “paid any money to Disney Interactive to use the DI Channel.” (Def. Br. at 17.) As with its “subscriber” argument, Disney misunderstands the ordinary use of “renter,” especially within the digital media context. “Rent” commonly refers to the fact of being “let or hired out at a specified rate[.]”6 In other words, a “renter” relationship is based upon the exchange of “consideration” for the temporary use of property. Black’s Law Dictionary (3d. Pocket ed. 2006). In line with this definition, “valuable consideration” is defined as “consideration that [] confers a pecuniarily measurable benefit on one party[.]” Id. As 6 Rent (1.2), Oxford Dictionaries http://www.oxforddictionaries.com/us/definition/american_english/rent?q=rent (last accessed Sept. 30, 2014); see also rent (1.1), id. (defining “rent” as an act ([o]f an owner) let[ting] someone use (something) in return for payment). Case 1:14-cv-04146-RA Document 33 Filed 10/03/14 Page 25 of 29 21 such, renting does not “necessarily imply payment of money,” (Def. Br. at 17), but rather, contemplates any exchange where one party lets property in exchange for something of value from another. Cf. U.S. Engine Prod., Inc. v. AGCS Marine Ins. Co., 769 F. Supp. 2d 626, 628 (S.D.N.Y. 2011) (“Consideration consists of ‘some right, interest, profit or benefit accruing to one party, or some forbearance, detriment, loss, or responsibility given, suffered, or undertaken by the other.’”) (quoting Joao v. Cenuco, Inc., 376 F. Supp. 2d 380, 384 n.4 (S.D.N.Y. 2005). Further, while Disney relies on the Hulu decision in this regard, the issue of renting was not even before the Court. Indeed, the Plaintiffs there did not even contend that they had rented (instead, limiting themselves to the argument that they were subscribers), much less put forth any argument regarding non- monetary consideration. See In re Hulu Privacy Litig., No. 11-cv-3764, Dkt. No. 58 at 18 (N.D. Cal. May 11, 2012). Robinson’s allegations demonstrate that he is a “renter” under the common usage of that term. In particular, he alleges that when he requested to “view specific videos” on the Disney Channel, he was “exposed to Defendant’s advertisements.” (Compl. ¶ 53.) Thus, he conferred a benefit on Disney by generating advertising revenues for it each time he requested video content and providing it with his valuable personal information, and, in exchange for that benefit, Disney “grant[ed] him a temporary license to access and view specific videos . . . .” (Id.) Cf. In re Facebook Privacy Litig., 572 Fed. Appx. 494, 494 (9th Cir. 2014) (“Plaintiffs allege that the information disclosed by Facebook can be used to obtain personal information, and that they were harmed both by the dissemination of their personal information and by losing the sales value of that information. In the absence of any applicable contravening state law, these allegations are Case 1:14-cv-04146-RA Document 33 Filed 10/03/14 Page 26 of 29 22 sufficient to show the element of damages for their breach of contract and fraud claims.”). And that benefit to Disney is “pecuniarily measurable”—Disney can calculate the increased revenue it obtains for each video watched on the Roku. Thus, Robinson can appropriately be considered a “renter” as well as a “subscriber” under the VPPA, and Disney’s arguments to the contrary should be disregarded. CONCLUSION For the reasons stated above, Plaintiff James Robinson, individually and on behalf of all others similarly situated, respectfully requests that this Honorable Court deny Disney’s Motion to Dismiss in its entirety and award such other relief as it deems necessary, reasonable, and just. Dated: October 3, 2014 Respectfully Submitted, JAMES ROBINSON, individually and on behalf of all others similarly situated s/ J. Dominick Larry Plaintiff’s Counsel Rafey S. Balabanian (Admitted pro hac vice) rbalabanian@edelson.com Benjamin H. Richman (Admitted pro hac vice) brichman@edelson.com J. Dominick Larry (Admitted pro hac vice) nlarry@edelson.com EDELSON PC 350 N. LaSalle St., Suite 1300 Chicago, Illinois 60654 Tel: 312.572.7212 Fax: 312.589.6378 Fred D. Weinstein fweinstein@kelaw.com KURZMAN EISENBERG CORBIN LEVER & GOODMAN, LLP Case 1:14-cv-04146-RA Document 33 Filed 10/03/14 Page 27 of 29 23 One North Broadway White Plains, New York 10601 Tel: 914.285.9800 Fax: 914.285.9855 Counsel for Plaintiff and the Putative Class Case 1:14-cv-04146-RA Document 33 Filed 10/03/14 Page 28 of 29 24 CERTIFICATE OF SERVICE I hereby certify that on October 3, 2014, I electronically filed the above and foregoing with the Clerk of Court using the CM/ECF system, which will send a notice of electronic filing to all counsel of record. s/ J. Dominick Larry Case 1:14-cv-04146-RA Document 33 Filed 10/03/14 Page 29 of 29