Afriyie v. NBCUniversal Media, LLC

• Court: District Court, S.D. New York
• Decided: March 31, 2025
• Docket: 1:23-cv-09433
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK

AMMA AFRIYIE and ROY CAMPBELL, individually and on behalf of all others similarly situated, Plaintiffs, 1:23-CV-09433-LTS v. NBCUNIVERSAL MEDIA, LLC and PEACOCK TV, LLC, Defendants.

OPINION AND ORDER LOWEY DANNENBERG, P.C. ZWILLGEN PLLC By: Christian Levis By: Jeffrey Landis Nicole A. Veno 1900 M Street NW, Suite 250 Amanda Fiorilla Washington, DC 20036 Claire Noelle Forde 44 South Broadway, Suite 1100 ZWILLGEN PLLC White Plains, NY 10601 By: Benjamin S. Thomassen One North LaSalle Street, Suite 4600 -and- Chicago, IL 60602

LABATON KELLER SUCHAROW LLP Attorneys for Defendants NBCUniversal By: Michael P. Canty Media, LLC and Peacock TV LLC Carol C. Villegas Danielle Izzo 140 Broadway, 34th Floor New York, NY 10005

Attorneys for Amma Afriyie and Roy Campbell, individually and on behalf of all others similarly situated LAURA TAYLOR SWAIN, Chief United States District Judge

In this action, Plaintiffs Amma Afriyie and Roy Campbell (collectively, “Plaintiffs”) bring a four-count putative class action against NBCUniversal Media, LLC (“NBCUniversal”) and Peacock TV, LLC (“Peacock” and, collectively, “Defendants”), alleging violations of the Video Privacy Protection Act, 18 U.S.C. § 2710 et seq. (“VPPA”); the New York Video Consumer Protection Act, N.Y. GEN. BUS. LAW §§ 670-75 (“VCPA”); the New York Uniform Deceptive Trade Practice Act, N.Y. GEN. BUS. LAW (“GBL”) § 349; and unjust enrichment. (Docket entry no. 24 (“FAC”) ¶¶ 123-64.) The Court has subject matter jurisdiction of this action under 28 U.S.C. sections 1331, 1332(d)(2)(A), and 1367(a).

This Opinion and Order addresses the Defendants’ motion to dismiss the First Amended Complaint. (Docket entry no. 30.) The Court has considered carefully the parties’ submissions (docket entry no. 31 (“Defs. Mem.”); docket entry no. 37 (“Pls. Mem.”); docket entry no. 39 (“Defs. Reply”); docket entry no. 47 (“Pls. Ltr.”); docket entry no. 48 (“Defs. Ltr.”)1) and, for the reasons set forth below, Defendants’ motion to dismiss is granted in full, and the First Amended Complaint is dismissed in its entirety, without prejudice to Plaintiffs’ filing of a motion for leave to file an amended complaint within three weeks of the date of this Opinion and Order.

BACKGROUND The following summary is drawn from the First Amended Complaint (docket entry no. 24 (the “FAC” or the “complaint”)), the well-pleaded factual allegations of which are taken as true for the purposes of this motion to dismiss practice.

1 Docket entry pincites are to ECF-designated pages. The NBC Apps Defendants own and operate several mobile applications—the Peacock TV App, the CNBC: Business & Stock News App (“the CNBC News App”), the NBC News App, and the NBC Sports App (collectively, the “NBC Apps”)—that offer a wide array of prerecorded video content, including TV shows, movies, trailers, and clips concerning news, politics, financial and

market segments, and sports. (FAC ¶ 2.) The NBC Apps incorporate third-party software development kits (“SDKs”), which are software tools that allow app developers to integrate pre-built functionality into their software products. (Id. ¶ 3.) The NBCApps Disclose Information to Third Parties Defendants use the Adobe Experience SDK and the mParticle SDK to collect analytics about how consumers use the NBC Apps. (Id. ¶¶ 3, 45 n.13.) To subscribe to the NBC Apps, users must provide certain information to the apps. (Id. ¶¶ 29, 33, 37, 41.) Through SDKs, the NBC Apps transmit some of the information provided by users, as well as certain user activity data, to non-defendant third parties Adobe and mParticle. (Id. ¶¶ 48, 69.) • CNBC News App o The CNBC News App on iOS devices transmits to Adobe: Video Titles, Identifier for Advertisers (IDFA), Identifier for Vendors (IDFV), New Relic ID, and Adobe ID (also known as Experience Cloud ID or ECID). (Id. ¶ 51.) o The CNBC News App on Android devices transmits to mParticle: Video Titles, Video IDs, New Relic ID, and Android ID. (Id. ¶ 72.) • NBC News App o Plaintiffs do not explicitly allege what kinds of information the NBC News App on iOS devices transmit to third parties. (See id. ¶ 71.) o The NBC News App on Android devices transmits to mParticle: Video Titles, Video IDs, Adobe ID, Android Advertising ID (AAID), and GPS location. (Id. ¶ 71.) • NBC Sports App o The NBC Sports App on iOS devices transmits to mParticle: Video Titles, Video IDs, Email, mParticle ID, and Identifier for Vendors. (Id. ¶ 70.) o The NBC Sports App on Android devices transmits to mParticle: Video Titles, Video IDs, Android Advertising ID, User ID, and Email. (Id.) • Peacock App o The Peacock App on iOS devices transmits to Adobe: Video Titles, Video IDs, Adobe ID, Identifier for Advertisers, New Relic ID, and User ID. (Id. ¶¶ 50, 6.) The Peacock App on Android devices transmits to Adobe: Video Titles, Video IDs, Adobe ID, Android Advertising ID. (Id. ¶ 6.)

The following bullets summarize the complaint’s allegations as to the nature of each piece of user information transmitted by the NBC Apps: • Adobe ID (also known as Experience Cloud ID or ECID): Identifier for individualized user profiles on the Adobe Experience Cloud platform. (Id. ¶¶ 62, 5.a n.3.) • Android Advertising ID (AAID): Not explained. (See id. ¶ 5.d.) • Android ID: Not explained. (See id. ¶¶ 33, 41, 72.) • Email: Self-explanatory. • GPS location: Self-explanatory. • Identifier for Advertisers (IDFA): “IDFA is a device identifier assigned by Apple to a user’s iOS device.” (Id. ¶ 5.b n.4.) • Identifier for Vendors (IDFV): “IDFV is an identifier assigned by Apple to all apps on a single user’s iOS device from the same vendor.” (Id. ¶ 5.c n.5.) • mParticle ID: Identifier for individualized user profiles on the mParticle IDSync platform. (Id. ¶ 78.) • New Relic ID: Not explained. (See id. ¶ 5.e.) • User ID: Not explained. (See id. ¶¶ 50, 70.) • Video Titles: Self-explanatory. • Video IDs: “[I]dentifiers that allow someone to uniquely identify a specific video, i.e., a numeric identifier, a full URL, or other identifier.” (Id. ¶ 5 n.2.)

The Android ID, Android Advertising ID, Identifier for Advertisers, Identifier for Vendors, New Relic ID, and User ID, each appear to correspond to a unique device.2 As

2 The Court assumes that Android ID, Android Advertising ID, New Relic ID, and User ID are device identifiers, as Plaintiffs do not explain what those identifiers are. (FAC ¶¶ 5.e, 70, 72, 5.d); see Ellis v. Cartoon Network, Inc., No. 14-CV-484-TWT, 2014 WL 5023535, at *3 (N.D. Ga. Oct. 8, 2014) (“The Android ID is a randomly generated number that is unique to each user and device.”), aff’d on other grounds, 803 F.3d 1251 (11th Cir. 2015); In re Nickelodeon Consumer Priv. Litig., 827 F.3d 262, 282 n.124 (3d Cir. 2016) (presuming “unique device identifier” to refer to Android ID where plaintiff failed to explain the term). described below, the Adobe ID and mParticle ID correspond to a unique user profile on, respectively, the Adobe Experience Cloud platform and the mParticle IDSync platform. How Adobe and mParticle Use the Disclosed Information Adobe maintains the Adobe Experience Cloud Platform, which contains “individualized profile[s]” about people. (Id. ¶¶ 53-54, 68.) The Adobe Experience Cloud

Platform combines information from multiple sources to create “unified person profiles.” (Id. ¶ 57.) According to Adobe’s website, these profiles “featur[e] ‘linked identities, along with all [the NBC Apps’] customer’s real-time consumer, professional, or combined attributes or behavioral data across channels and all lines of business.’” (Id.) The profiles “start[] by integrating data from all customer touchpoints, combining personally identifiable data from sources such as CRM [customer relationship management] and loyalty programs, with unknown user data—like web searches, ad clicks, and device IDs.” (Id. ¶ 56.) Individuals are “assign[ed]” Adobe IDs (also referred to as Adobe Experience Cloud IDs), which are “unique persistent identifiers that Adobe assigns to app users and/or website visitors [that] allow[] Adobe to track users across devices.” (Id. ¶ 62.) The Adobe ID allows Adobe to connect an individual

to her “identity graph[].” (Id. ¶¶ 60, 62.) Adobe is able to use the information transmitted by the NBC Apps to “link” a user of the NBC Apps, along with her video viewing history, to her unique Adobe Experience Cloud Platform profile. (Id. ¶¶ 52-53, 59, 68.) Similarly, through its IDSync platform, mParticle is able to identify individual users of the NBC Apps by using the information transmitted by those apps. (Id. ¶¶ 73-74.) As mParticle’s website explains, IDSync creates “individualized profile[s]” of people, which compile “the most up-to-date real-time user identities, device identities, user attributes, and audience memberships,” and which “can be queried to find a specific individual user using identifiers such as an email address, phone number, or device ID.” (Id. ¶¶ 75, 79.) mParticle assigns an mParticle ID to each user profile on the IDSync platform. (Id. ¶ 78.) Upon receiving the information transmitted by the NBC Apps, mParticle is able to “match[]” a user of the NBC Apps, along with her video viewing history, to her unique IDSync profile. (Id. ¶¶ 74, 78-79.) Plaintiffs Use the NBC Apps

In 2021, Plaintiff Amma Afriyie downloaded the Peacock App and the CNBC News App to her iPhone. (Id. ¶ 13-14.) She currently pays for a subscription on the Peacock App, and she paid for a subscription on the CNBC News App (together, the “Purchased NBC Apps”). (Id.) In 2022, Plaintiff Roy Campbell downloaded the Peacock App to his iPhone, and he currently pays for a subscription. (Id. ¶ 18.) Neither Afriyie nor Campbell downloaded or used the NBC News App or the NBC Sports App (the “Unpurchased NBC Apps”.) (See Pls. Mem. at 22.) Nor did either download or use the Android version of the Peacock App or the NBC News App. (See id. ¶¶ 13-14, 18.) At the time they purchased the apps, neither Plaintiff knew about or consented to the Purchased NBC Apps’ transmission of the above-described information to third parties Adobe and mParticle. (Id. ¶¶ 16, 19.)

DISCUSSION Defendants bring their motion under Federal Rule of Civil Procedure 12(b)(6). To survive a Rule 12(b)(6) motion to dismiss, a complaint must plead “enough facts to state a claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). A proper complaint cannot simply recite legal conclusions or bare elements of a cause of

action; there must be factual content pleaded that “allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). The Court accepts as true the nonconclusory factual allegations in the Complaint and draws all reasonable inferences in the Plaintiff’s favor. Roth v. Jennings, 489 F.3d 499, 501 (2d Cir. 2007). The first issue that the Court must address, however, is subject matter jurisdiction of the individual and putative class claims. The parties dispute whether Plaintiffs have class standing to raise claims concerning the two apps that they did not use—the NBC News App and

the NBC Sports App (the Unpurchased NBC Apps). As explained below, class standing is lacking with regard to the Unpurchased Apps because the data sharing practices of these two apps are too different from those of the two apps that Plaintiffs used—the Peacock App and the CNBC News App (the Purchased NBC Apps)—to implicate the same factual issues that will be material to resolution of Plaintiffs’ claims regarding the Purchased NBC Apps, and because Plaintiffs lack the proper incentives to develop arguments unique to the Unpurchased NBC Apps. Accordingly, Plaintiffs’ claims regarding the Unpurchased NBC Apps must be dismissed for lack of subject matter jurisdiction. Plaintiffs’ allegations are only sufficient to support individual and class standing with respect to their claims regarding the Purchased NBC Apps.

Class Standing As a threshold issue, Plaintiffs lack individual Article III standing to raise claims with respect to the NBC News App and the NBC Sports App because they did not use or purchase those apps. See NECA-IBEW Health & Welfare Fund v. Goldman Sachs & Co., 693 F.3d 145, 158 (2d Cir. 2012) (“[Plaintiff] clearly lacks standing to assert such claims on its behalf because it did not purchase those [products].”). Plaintiffs do, however, have standing with respect to the Peacock App and the CNBC News App because they used and purchased those apps. Thus, because standing is established as to each named defendant and each Purchased NBC App claim,3 the inquiry shifts to whether the named Plaintiffs have class standing to represent users of the Unpurchased NBC Apps. Cent. States Se. & Sw. Areas Health & Welfare Fund v. Merck-Medco Managed Care, L.L.C., 504 F.3d 229, 241 (2d Cir. 2007); In re LIBOR- Based Fin. Instruments Antitrust Litig., 299 F. Supp. 3d 430, 459 (S.D.N.Y. 2018). Under Article III of the Constitution, the federal judicial power may only be

invoked to resolve “Cases” and “Controversies.” “For there to be a case or controversy under Article III, the plaintiff must have a ‘personal stake’ in the case—in other words, standing.” TransUnion LLC v. Ramirez, 594 U.S. 413, 423 (2021) (quoting Raines v. Byrd, 521 U.S. 811, 819 (1997)). Consequently, a “plaintiff generally must assert his own legal rights and interests, and cannot rest his claim to relief on the legal rights or interests of third parties.” Warth v. Seldin, 422 U.S. 490, 499, (1975). These principles of constitutional standing, however, are in “tension” with Federal Rule of Civil Procedure 23, which allows one named plaintiff, or several named plaintiffs, to represent the interests of a class of plaintiffs—many of whom may have suffered injuries different from those suffered by the named plaintiff(s). See Gratz v. Bollinger,

539 U.S. 244, 263 & n.15 (2003) (describing the “tension”). In the Second Circuit, this tension is addressed by the doctrine of class standing. NECA-IBEW, 693 F.3d at 162. To establish class standing under the NECA-IBEW test, a named plaintiff must show “(1) that he ‘personally has suffered some actual . . . injury as a result of the putatively illegal conduct of the defendant’” (i.e., that he has standing in his own right), and “(2) that such conduct implicates ‘the same set of concerns’ as the conduct alleged to have caused injury to other members of the putative class by

3 Plaintiffs allege that “NBC [defined as NBC Universal Media, LLC and Peacock TV, LLC] owns and operates” the Purchased NBC Apps. (FAC ¶ 2.) the same defendants” (i.e., that he has standing to represent the class). Id. (quoting Blum v. Yaretsky, 457 U.S. 991, 999 (1982); Gratz, 539 U.S. at 267). Whether to Address Class Standing at the Motion to Dismiss Stage Before turning to the two prongs of the NECA-IBEW class standing test, as a threshold issue, Plaintiffs object to Defendants’ focus on class standing at the motion to dismiss

stage and argue that this issue is better resolved at the class certification stage. Plaintiffs have accurately identified the “tension” within the case law, and courts in this Circuit—and across the country—have split on whether to address class standing as a constitutional standing issue at the motion to dismiss stage or as a commonality, typicality, or adequacy issue at the class certification stage. See 1 NEWBERG AND RUBENSTEIN ON CLASS ACTIONS § 2:6 (6th ed. Supp. Nov. 2024) (discussing the split); compare In re Bibox Grp. Holdings Ltd. Sec. Litig., 534 F. Supp. 3d 326, 334-37 (S.D.N.Y. 2021) (addressing class standing at motion to dismiss stage); Hart v. BHH, LLC, No. 15-CV-04804-WHP, 2016 WL 2642228, at *3 (S.D.N.Y. May 5, 2016) (same); Curtis v. Aetna, 648 F. Supp. 3d 358, 371-73 (D. Conn. 2023) (same); and Holve v. McCormick & Co., Inc., 334 F. Supp. 3d 535, 550 (W.D.N.Y. 2018) (same) with Kacocha v.

Nestle Purina Petcare Co., No. 15-CV-05489-KMK, 2016 WL 4367991, at *10-11 (S.D.N.Y. Aug. 12, 2016) (addressing class standing at class certification stage); Ault v. J.M. Smucker Co., No. 13-CV-03409-PAC, 2014 WL 1998235, at *7 (S.D.N.Y. May 15, 2014) (same); Moses v. Apple Hosp. REIT Inc., No. 14-CV-03131-DLI-SMG, 2016 WL 8711089, at *4 (E.D.N.Y. Sept. 30, 2016) (same); and Jovel v. i-Health, Inc., No. 12-CV-05614-JG, 2013 WL 5437065, at *10 (E.D.N.Y. Sept. 27, 2013) (same). After reviewing these decisions, the Court finds it appropriate to address class standing now, at the motion to dismiss stage, particularly because it is apparent from the face of the complaint that the claims for which the Plaintiffs do not have individual standing (i.e., those regarding the Unpurchased NBC Apps) raise different factual issues than the claims arising from their purchase and use of the Purchased NBC Apps. “The class standing test ‘derives from constitutional standing principles’ and the Second Circuit has ‘rejected the . . . argument that standing law has nothing to say about [a] plaintiff’s ability to assert absent class members’

claims.’” Holve, 334 F. Supp. 3d at 551 & n.7 (quoting Ret. Bd. of the Policemen’s Annuity v. Bank of New York Mellon, 775 F.3d 154, 160-61 (2d Cir. 2014)). Furthermore, “[o]ne purpose of the class standing test . . . is to ensure that the named plaintiff has ‘the right incentives’ to develop the ‘proof contemplated for all of the claims.’” Curtis, 648 F. Supp. 3d at 373 (quoting Ret. Bd., 775 F.3d at 161). Where the named plaintiffs lack the “right incentives,” it would be inappropriate to allow named plaintiffs to litigate further as class representatives. See id. Finally, the Court must be mindful of “the Court’s and the parties’ obligation to ‘secure the just, speedy, and inexpensive determination of [the] action,’ as unleashing discovery on claims the plaintiff lacks standing to litigate would waste time and resources.” Id. (quoting FED. R. CIV.

P. 1 (emphasis omitted)). All these considerations counsel in favor of addressing class standing now, at the motion to dismiss stage. Further fact discovery would be unnecessary and wasteful, because the issue of class standing can be resolved through analysis of the allegations in the First Amended Complaint. Moreover, named Plaintiffs’ claims turn on factual allegations that are different from those that are relevant only to the absent class members’ claims. Notably, the Purchased NBC Apps are alleged to transmit different types of information than the Unpurchased NBC Apps— the latter are alleged to transmit email and GPS location data, in addition to device and user profile identifiers. (FAC ¶¶ 6, 50-51, 70-72.) Whether Named Plaintiffs Have Class Standing Turning now to the two prongs of the NECA-IBEW class standing test, Plaintiffs plainly satisfy the first prong; they clearly have standing to sue over the allegedly unlawful data sharing practices of the Purchased NBC Apps because they used and purchased those apps. See NECA-IBEW, 693 F.3d at 162. Plaintiffs, however, fail to meet the second prong because the

types of information disclosed by the Purchased NBC Apps are not contiguous with the types of information disclosed by the Unpurchased NBC Apps, thus indicating that the claims Plaintiffs assert as to latter apps “could turn on very different proof” from that involving the claims regarding former apps. See id. at 163. The Purchased NBC Apps are only alleged to disclose device identifiers (Android ID, Android Advertising ID, Identifier for Advertisers, Identifier for Vendors, New Relic ID, and User ID) and user profile identifiers (Adobe ID and mParticle ID). (FAC ¶¶ 6, 50-51, 72.) The Unpurchased NBC Apps are alleged to disclose, in addition to device and user profile identifiers, email and GPS location data. (Id. ¶¶ 70-71.) The typology of the information allegedly disclosed by Defendants goes to the very core of Plaintiffs’ VPPA and VCPA claims. Thus, the two pairs of apps raise a “fundamentally different set of concerns.”4 See NECA-IBEW, 693 F.3d at 164 (quoting Gratz, 539 U.S. at 264). Furthermore, Plaintiffs lack the “right incentives” to develop arguments unique to the Unpurchased NBC Apps— arguments relating to email and GPS location data. See Ret. Bd. v. Bank of N.Y. Mellon, 775 F.3d 154, 161 (2d Cir. 2014). Indeed, this is reflected by Plaintiffs’ failure to allege or argue that

email and GPS location data are “personally identifiable information.”5 (See generally FAC; Pls. Mem.) This case is similar to NECA-IBEW. There, the court held that the named plaintiffs had class standing to raise Securities Act claims with respect to mortgage-backed securities they did not purchase but which were backed by loans originated by the same

4 As discussed below, Plaintiffs’ allegations concerning device identifiers and user profile identifiers are insufficient to plead plausibly that those types of information are “personally identifiable information” (“PII”) within the meaning of the VPPA or the VCPA. See infra pp. 14-30. The Court does not consider at this stage whether email and GPS location data are PII, but notes that courts appear to have treated such information differently in analyzing VPPA questions. See, e.g., Aldana v. GameStop, Inc., No. 22- CV-07063-LTS, 2024 WL 708589, at *7 n.5 (S.D.N.Y. Feb. 21, 2024) (“While at least one court has indicated that email addresses do not necessarily constitute personal information, Dancel v. Groupon, Inc., 949 F.3d 999, 1008-09 (7th Cir. 2019), the Court finds persuasive other decisions holding that email addresses are personally identifying, see, e.g., United States v. Hastie, 854 F.3d 1298, 1303 (11th Cir. 2017); Eichenberger v. ESPN, Inc., 876 F.3d 979, 986 (9th Cir. 2017).”); Yershov v. Gannett Satellite Info. Network, Inc., 820 F.3d 482, 486 (1st Cir. 2016) (noting that “[g]iven how easy it is to locate a GPS coordinate on a street map, this disclosure would enable most people to identify what are likely the home and work addresses of the viewer”); In re Nickelodeon Consumer Priv. Litig., 827 F.3d 262, 289 (3d Cir. 2016) (“GPS coordinates contain more power to identify a specific person than, in our view, an IP address, a device identifier, or a browser fingerprint.”). 5 Because of the discrepancy in the types of information disclosed, even if named Plaintiffs have class standing to represent users of the Unpurchased NBC Apps, they would only have class standing insofar as they bring a claim predicated solely on device and user identifiers. As explained below, those claims have not been pleaded sufficiently to survive the instant Rule 12(b)(6) motion. Infra pp. 14-30. originators that had originated the loans backing the securities that the plaintiffs had purchased. 693 F.3d at 162-64. The court reasoned that the two types of claims were “sufficiently similar” because they both rested on the allegation that the defendant had falsely represented that the particular originators had complied with their underwriting guidelines. See id. at 162 (describing it as a “nearly identical misrepresentation[] . . . common to every [security’s] registration

statement”). The court, however, held that the named plaintiffs did not have class standing to represent those who purchased securities backed by loans from different lenders because those other claims “could turn on very different proof.” Id. at 163 (“That proof would center on whether the particular originators of the loans . . . had in fact abandoned its underwriting guidelines.”). Similarly, Retirement Board v. Bank of New York Mellon held that the named plaintiffs lacked class standing to bring breach of contract claims on behalf of investors in trusts in which the named plaintiffs had not invested. 775 F.3d at 159-63. According to the court, proving defendant’s unlawful conduct required “examining [defendant’s] conduct with respect to

each trust” and there was “no way in which answering . . . questions for the trusts in which Plaintiffs invested w[ould] answer the same questions for the numerous trusts in which they did not invest.” Id. at 162. Furthermore, DiMuro v. Clinique Lab’ys, LLC held that named plaintiffs could not bring consumer fraud claims on behalf of consumers of certain products when the named plaintiffs had not purchased those products. 572 F. App’x 27, 29 (2d Cir. 2014). The court explained that each of the products had “different ingredients” and that defendant “made different advertising claims for each product.” Id. “Entirely unique evidence” was required to prove the different claims. Id. “As a result, we [the court] cannot say that claims brought by a purchaser of one product would raise a set of concerns nearly identical to that of a purchaser of another [ ] product.” Id. (internal quotations omitted). Ultimately, Plaintiffs do not have “free reign to bring lawsuits regarding products they never purchased.” Hart v. BHH, LLC, No. 15-CV-4804-WHP, 2016 WL 2642228, at *4 (S.D.N.Y. May 5, 2016) (finding class standing lacking where named plaintiffs did not purchase

the products). Plaintiffs lack class standing to represent users of the Unpurchased NBC Apps. Merits Arguments Defendants raise various arguments going to the merits of Plaintiffs’ VPPA and VCPA claims regarding the Purchased NBC Apps. Of their many arguments, Defendants contend that the Purchased NBC Apps do not disclose “personally identifiable information” within the meaning of the VPPA and VCPA. This argument carries the day for the reasons explained below, and Plaintiffs’ VPPA and VCPA claims must be dismissed. Finally, Plaintiffs’ GBL section 349 and unjust enrichment claims must be dismissed because they are derivative of, and allege no underlying conduct beyond, Plaintiffs’ VPPA and VCPA claims. “Personally Identifiable Information” (or “PII”) Defendants contend, persuasively, that Plaintiffs fail to allege that the Purchased

NBC Apps disclose any “personally identifiable information” (or “PII”) as that term is defined in the VPPA and VCPA. Under the VPPA, the “term ‘personally identifiable information’ includes information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider.” 18 U.S.C.A. § 2710(a)(3) (Westlaw through P.L. 119-4). The VCPA defines the term in substantially the same way. N.Y. GEN. BUS. LAW § 672(3) (Westlaw through 2025 N.Y. Sess. Laws Chs. 1-49, 61-107) (“The term ‘personally identifiable information’ means any information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider or video tape seller.”). To date, no court appears to have interpreted the VCPA’s definition of “personally identifiable information,” and the parties do not contend that the VCPA’s definition is substantively different from the VPPA’s definition. Thus, the Court treats the two as turning on

the same considerations. Two different interpretations of the term “personally identifiable information,” as used in the VPPA, have emerged from the Circuit courts. See Collins v. Pearson Educ., Inc., 721 F. Supp. 3d 274, 287 (S.D.N.Y. 2024) (discussing the split); Lee v. Springer Nature Am., Inc., No. 24-CV-04493-LJL, __ F. Supp. 3d __, 2025 WL 692152, at *13 (S.D.N.Y. Mar. 4, 2025) (same). Under the broader test, adopted by the First Circuit, PII is “information reasonably and foreseeably likely to reveal which [ ] videos [a person] has obtained” to the third party to whom the information is disclosed. Yershov v. Gannett Satellite Info. Network, Inc., 820 F.3d 482, 486 (1st Cir. 2016). Thus, in Yershov, a device’s GPS coordinates and device identifiers, such as

Android ID, were held to be PII where the recipient of the information—which was Adobe, the same recipient alleged here—had software that could “link” that information to a specific person’s name, phone number, and address. Id. at 486. The Yershov court cautioned, however, that, at some point, “the linkage of information to identity [can] become[] too uncertain, . . . too dependent on too much yet-to-be-done, or unforeseeable detective work” to frame a plausible VPPA claim. Id. This broader test has been described as “recipient-dependent” because the scope of PII can depend on the recipient’s capabilities. See Wilson v. Triller, Inc., 598 F. Supp. 3d 82, 91-92 (S.D.N.Y. 2022); Eichenberger v. ESPN, Inc., 876 F.3d 979, 985 (9th Cir. 2017). Under the narrower approach, adopted by the Third and Ninth Circuits, “personally identifiable information” for purposes of the VPPA is “the kind of information that would readily permit an ordinary person to identify a specific individual’s video-watching behavior.” In re Nickelodeon Consumer Priv. Litig., 827 F.3d 262, 290 (3d Cir. 2016); accord Eichenberger v. ESPN, Inc., 876 F.3d 979, 985 (9th Cir. 2017). This “ordinary person” test

“looks to what information a video service provider discloses, not to what the recipient of that information decides to do with it.” Eichenberger, 876 F.3d at 985. Thus in Nickelodeon, a device’s IP address, browser and operating system settings (which comprise a so-called “browser fingerprint”), and “unique device identifier,” such as Android ID,6 were held not to be PII, even though the recipient of the information was “Google, a company whose entire business model is purportedly driven by the aggregation of information about Internet users” and Google was alleged to “assemble otherwise anonymous pieces of data to unmask the identity of individual[s].” 827 F.3d at 289-90. Similarly, Eichenberger held that a device serial number was not PII even where the recipient of the information, Adobe—one of the recipients here—,

could allegedly identify an individual by combining the device serial number with other information available to it from sources other than the defendant. 876 F.3d at 986. While the Second Circuit has not yet taken a position,7 to date no Court in this District has adopted the broader test. E.g., Collins v. Pearson Educ., Inc., 721 F. Supp. 3d 274,

6 Nickelodeon noted that the “unique device identifier” in question was not defined by the plaintiffs’ complaint, but equated it to an Android ID. 827 F.3d at 282 n.124. 7 Recently, the Second Circuit noted that “while there may be breathing room in the statute to explore what exactly is ‘personally identifiable information’ . . . we need not and do not explore that argument in this appeal.” Salazar v. Nat’l Basketball Ass’n, 118 F.4th 533, 549 n.10 (2d Cir. 2024). 287 (S.D.N.Y. 2024) (“Courts in this District have followed the narrower approach, keyed to an ordinary person’s expectations and understanding.”); Wilson v. Triller, Inc., 598 F. Supp. 3d 82, 90-93 (S.D.N.Y. 2022); Robinson v. Disney Online, 152 F. Supp. 3d 176, 180 (S.D.N.Y. 2015); Czarnionka v. Epoch Times Ass’n, Inc., No. 22-CV-6348-AKH, 2022 WL 17069810, at *2 (S.D.N.Y. Nov. 17, 2022).8 Wilson is especially instructive in explaining the appeal of the

narrower test. 598 F. Supp. 3d at 91-92. There, the court determined that that the VPPA cannot be “recipient-dependent” because “the VPPA sets out requirements regarding the handling of PII

8 These cases can be broken down into two categories, instances where the Circuit split was dispositive and instances where the split was not. The only case in the former group is Robinson, which rejected the argument that a device serial number was PII because the recipient, Adobe, could combine this data with other information at its disposal to personally identify the plaintiff. 152 F. Supp. 3d at 180; see infra pp. 20-21 (discussing Robinson). Of the latter group, with the exception of Wilson, all of these cases concerned the Facebook (or Meta) Pixel, which tracks a user’s actions on websites other than Facebook and reports that information, along with that user’s Facebook ID, to Facebook. E.g., Collins, 721 F. Supp. 3d at 280. In each of the Facebook Pixel cases, the court considered whether Facebook IDs were PII. The Circuit split was not dispositive of this issue because Facebook IDs have been held to be PII even under the narrower test. E.g., id. at 287 (“Even applying the narrower, more demanding approach, however, courts in this District have uniformly held that disclosure of a ‘Facebook ID [ ] would readily permit an ordinary person to identify a specific individual’s video-watching behavior.’” (citing Golden v. NBCUniversal Media, LLC, 688 F. Supp. 3d 150 (S.D.N.Y. 2023); Lamb v. Forbes Media LLC, No. 22-CV-06319-ALC, 2023 WL 6318033, at *10 (S.D.N.Y. Sept. 28, 2023); and Czarnionka)). For its part, Wilson reasoned that the “narrower definition is the correct one” based on principles of statutory interpretation. 598 F. Supp. 3d at 92; see supra p. 17 & infra p. 18 (discussing Wilson). Wilson, however, did not find the Circuit split dispositive because, even under the broader test, the court held that “unique user identification number[s]” were not PII where the identifier merely pointed to a “profile page, which may or may not contain various personal information about the user” and where there were “no allegations as to what information was actually included on [plaintiff’s] profile nor how that information could be used by a third party to identify [plaintiff].” 598 F. Supp. 3d at 92. that do not implicate the disclosure of such information to a recipient, including 18 U.S.C. § 2710(e), which imposes an obligation on any ‘person subject to [the Act]’ to ‘destroy [PII] as soon as practicable.’” Id. at 91. “This command would be impossible to follow if the definition of PII depended on the recipient of a disclosure.” Lee, 2025 WL 692152, at *12 (citing Wilson, 598 F. Supp. 3d at 91). Given the weight of authority in this District, the Court is not persuaded

by Plaintiffs’ urging to adopt the broader test used by the First Circuit. A recent decision in this District introduces a novel standard that departs from— and reframes—both the narrower test and the broader test. Lee v. Springer, No. 24-CV-04493- LJL, __ F. Supp. 3d __, 2025 WL 692152, at *10-16 (S.D.N.Y. Mar. 4, 2025). First, Lee rejects the “ordinary person” test used by the Third and Ninth Circuits, as well as other courts. According to Lee, “[t]he characterization of a specific type of information as PII cannot turn on whether it would ‘readily permit an ordinary person to identify a specific individual’s video-watching behavior,’ or would be of assistance ‘[t]o an average person.’” Id. at *15 (quoting Nickelodeon, 827 F.3d at 282-83, 290). “Digital identifiers cannot be excluded from

the definition of PII simply because a hypothetical ‘ordinary person’ does not understand how to use them.” Id. Instead, Lee posits that the identification of PII is based on evaluation of its utility from the viewpoint of an “enterprising investigator” with the “time, motivation [and] skill to link” the information to an individual. Id. Second, Lee introduces a novel approach to examining whether disclosed information, in combination with other non-disclosed information, can produce PII. According to Lee, the answer depends on “the nature of the information needed to connect the identifier to an individual and whether such information is publicly or widely available.” Id. This test supplants the “ordinary person” test, as well as the broader “recipient-dependent” test. Id. (explaining that this novel test “may be what the ‘ordinary person’ standard is really addressing”). While Lee rejects the “ordinary person” test, Lee does not completely reject the reasoning of Eichenberger and Nickelodeon. Rather, it appears that the Lee court would find that the plaintiffs’ downfall in Eichenberger and Nickelodeon was the product of a failure to

plead that the additional, undisclosed information required to link the disclosed information to an individual was publicly or widely available. See Eichenberger, 876 F.3d at 981 (the “additional information” included “email addresses, account information, or Facebook profile information, including photos and usernames,” none of which were alleged to be publicly or widely available); Nickelodeon, 827 F.3d at 290 (“The allegation that Google will assemble otherwise anonymous pieces of data to unmask the identity of individual children is, at least with respect to the kind of identifiers at issue here, simply too hypothetical to support liability under the Video Privacy Protection Act.”). Furthermore, Lee’s rejection of the “ordinary person” test is not indicative of the

court’s embrace of the reasoning in Yershov. Indeed, Yershov’s facts do not fit Lee’s construct. In Yershov, the plaintiff alleged that “Adobe takes [the information shared by defendant] and other information culled from a variety of sources to create user profiles comprised of a given user’s personal information, online behavioral data, and device identifiers.” 820 F.3d 482 at 484. There were no allegations, however, that any of the “other information” that allowed Adobe to identify individuals was publicly or widely available. Id. at 484-86. Thus, Lee does not signal an adoption of the broader test. Rather, Lee merely reframes the narrower test that was already widely adopted in this District. 2025 WL 692152, at *15. Lee does, however, purport to reject the reasoning of an earlier decision from this District, Robinson v. Disney Online, 152 F. Supp. 3d 176 (S.D.N.Y. 2015). In Robinson, the plaintiff alleged that a device serial number was PII because the recipient, Adobe, could combine that data with other information at its disposal to personally identify the plaintiff. 152 F. Supp. 3d at 180. The Robinson court rejected the plaintiff’s theory, reasoning that the disclosed

information “must itself do the identifying that is relevant for purposes of the VPPA (literally, ‘information which identifies’)—not information disclosed by a provider, plus other pieces of information collected elsewhere by non-defendant third parties.” Id. at 182. By itself, the device serial number, on which the Robinson plaintiff’s claims turned, “identifies a specific device, and nothing more.” Id. at 184. Robinson held that “[defendant’s] liability turns only on whether the information it disclosed itself identified a specific person. It did not. Thus, Adobe’s ability to identify [plaintiff] by linking this disclosure with other information is of little significance.” Id. According to Lee, Robinson “does not accord with the natural reading of PII as information that ‘can be used’ to identify an individual[.]” Lee, 2025 WL 692152, at *10 (citing

Eichenberger, 876 F.3d at 984); Eichenberger, 876 F.3d at 984 (Because “the suffix ‘able’ means ‘capable of[,]’” “the term ‘personally identifiable information’ covers some information that is ‘capable of’ identifying a person, as well as information that, standing alone, identifies a person.”). To explain, Lee presents the cases of names and physical addresses, both of which are commonly acknowledged to be PII.9 Lee, 2025 WL 692152, at *12; Robinson, 152 F. Supp. 3d

9 Under 18 U.S.C. section 2710(b)(2)(D), a video tape service provider “may disclose personally identifiable information concerning any consumer,” including “names and addresses of consumers,” if certain conditions are met. This provision implies that names and addresses are “personally identifiable information,” but that they are not the only potential types of information that are “personally identifiable.” Lee, 2025 WL 692152, at *12; Robinson, 152 F. Supp. 3d at 182. at 182. By itself, a name may not identify a specific person, because several different people may share the same name. Lee, 2025 WL 692152, at *11. Other information, such as a telephone directory or an Internet search, may be required to specify an individual. An even better example is an address, which may fail to identify a specific person because several people may live at the same location. Id. Other steps, such as a visit to the address, may be required to

specify an individual. Thus, PII does not need to “ipso facto reveal the identity of a specific individual.” Id. at *14. The VPPA countenances at least some liability based on the potential for connecting disclosed data with data from other sources to identify an individual. Id. at *10 (“PII must be read to include not only information that directly identifies the renter of a video, but also at least some information ‘that can be used to identify an individual’ when combined with other information.” (citations omitted)). Under Lee, the dividing line is whether “the [additional] information needed to connect the identifier to an individual . . . is publicly or widely available.” Id. at *15. A Workable Test Having surveyed the foregoing landscape of VPPA jurisprudence, the Court

distills the above principles to craft a workable test for “personally identifiable information.” As a threshold issue, “personally identifiable information,” whether by itself (the “sole PII” theory) or in combination with other information (the “linkage” theory), must be capable of identifying a “particular individual as having watched certain videos.”10 Eichenberger, 876 F.3d at 985 (quoting Nickelodeon, 827 F.3d at 290) (emphasis added); see Lee, 2025 WL 692152, at *12 (PII includes “information with analogous ability [as names and addresses] to identify an individual who has requested or obtained specific video materials” (internal quotations omitted)); Collins, 721 F. Supp. 3d at 287 (PII must “identify a specific

individual’s video-watching behavior” (citation omitted)); see also Lee, 2025 WL 692152, at *10 (“The term ‘personally identifiable information’ means information that can be used to identify the person, as ‘the suffix “able” means “capable of.”’” (quoting Eichenberger, 876 F.3d at 985)). Next, plaintiffs may allege plausibly that a disclosure reveals “personally identifiable information” in two ways. First, plaintiffs may allege that the disclosed information, by itself, is “personally identifiable” in that it generally points directly to a significant identifier

10 Pointing to 18 U.S.C. section 2710(a)(2)(D), Lee posits that there is an open issue of whether “a disclosure must connect an individual to video information to be prohibited by the VPPA.” 2025 WL 692152, at *12 n.9. The Court need not consider this issue because Plaintiffs allege that their video viewing history is connected to their device identifiers and their individualized profiles. Nonetheless, the Court believes the answer to the question would be yes. Otherwise, the VPPA would be expanded beyond its original intention, which was to protect the video viewing history of individuals. See Nickelodeon, 827 F.3d at 284 (citing Congress’s “quite narrow” purpose in enacting the VPPA—preventing disclosures that would permit the recipient to identify “a particular person’s video-watching habits”); Salazar, 118 F.4th at 549 (“[T]he general store owner who also rented out a few movies wouldn’t be liable under the VPPA for disclosing particular customers’ bread-buying habits” because “that information, which does not relate to video materials or services, is not ‘personally identifiable information’ under the VPAA.”). Moreover, all section 2710(a)(2)(D) does is to allow disclosure of PII if the “disclosure is solely of the names and addresses of consumers” and certain other conditions are satisfied. That exception does not mean that PII need not connect an individual to her video viewing history. of a particular individual human (the sole PII theory).11 Examples of this sort of information include names, addresses, and Facebook IDs. See, e.g., Lee, 2025 WL 692152, at *12 (names and addresses); Collins v. Pearson Educ., Inc., 721 F. Supp. 3d 274, 287 (S.D.N.Y. 2024) (Facebook IDs). Second, plaintiffs may proceed under a linkage theory and allege that the

disclosed information, in combination with additional information possessed or acquired by the recipient of the disclosed information,12 is “personally identifiable.” Under the linkage theory, the dispositive question is whether the necessary connection between the available information and information revealing the identity of a specific person is too remote. This question involves analyzing (1) the nature of the available information (consisting of the disclosed information and additional information possessed or acquired by the recipient of the disclosed information) and (2) the effort required to make the connection between the available information and information revealing the identity of a specific individual.13 First, Lee posits that the additional information

11 Arguably, the linkage approach subsumes the sole PII theory because linkage data is almost always necessary. See Lee, 2025 WL 692152, at *12, *14-15 (discussing how names and addresses do not “ispo facto reveal the identity of a specific individual” and how additional linkage effort is required). 12 This additional information is not disclosed by the defendant. 13 Prior to Lee, the answer to this question was addressed by either the broader, “recipient-dependent” test or the narrower, “ordinary person” test. For the reasons explained in Lee, the Court finds Lee’s focus on “the nature of the information needed to connect the identifier to an individual,” as evaluated by an “enterprising investigator,” 2025 WL 692152, at *15, more useful and discerning than Yershov’s, Eichenberger’s, and Nickelodeon’s focus (or lack thereof) on the capabilities of the recipient, Yershov, 820 F.3d at 486; Eichenberger, 876 F.3d at 985; Nickelodeon, 827 F.3d at 267. Indeed, the Lee test incorporates the principles animating Yershov, Eichenberger, and Nickelodeon: if the undisclosed linkage information is not publicly or widely available, then an ordinary person could not perform the linkage. properly taken into account in the analysis must be “publicly or widely available.” 2025 WL 692152, at *15. If the necessary, additional linking data is publicly or widely available, then the disclosed information may qualify as PII. Otherwise, the disclosed information is not PII. As to the second question, Lee’s “enterprising investigator” standard provides a workable template for the outer limit of analytical sophistication that can be taken into account in creating a link that

renders disclosed information PII. This standard assumes the viewpoint of an “enterprising investigator” with the “time, motivation [and] skill to link” the information to an individual.14 Lee, 2025 WL 692152, at *15. As helpful benchmarks in assessing whether an “enterprising investigator” can make the requisite connection, the Court looks to names, addresses, and Facebook IDs as examples. Id. at *12, *14-15 (discussing how names and addresses do not “ispo facto reveal the identity of a specific individual” and how additional linkage effort is required); Collins, 721 F. Supp. 3d at 280 (“Anyone who knows a user’s Facebook ID can type ‘facebook.com/’ followed by the Facebook ID into a web browser to view that user’s Facebook profile page.”).

Finally, “personally identifiable information” is assessed at a category-based level.15 Lee, 2025 WL 692152, at *16 (“[T]he test is categorical.”). That is, for each type of information, the question is whether the information, considered in categorical terms, is generally sufficiently informative to constitute PII. In other words, if a sufficient proportion of

14 The effort analysis is also pertinent to the sole PII theory, as there, the Court must also evaluate the effort needed to connect the available information (which solely consists of the disclosed information) to a particular individual. 15 If multiple categories of data are disclosed, the categories may be considered collectively as a single category. This could be important in situations where one category is not PII when disclosed by itself, but is PII when simultaneously disclosed with another category. the information in a category is “personally identifiable,” disclosure of any data in that category of information will constitute disclosure of PII. Because names, addresses, and Facebook IDs cross this threshold, they are PII as a whole category, notwithstanding the possibility of instances in which the datapoint is not, alone, sufficiently identifying. See id. (“A name is protected even if it is shared with numerous others and it would be challenging to link that name to a specific

individual.”). These three examples of categories are useful benchmarks for evaluating the likelihood that a type of information is PII. Whether “Personally Identifiable Information” Is Alleged Sufficiently Here The Court now turns to the question of whether Plaintiffs have adequately pleaded that the Purchased NBC Apps disclose their “personally identifiable information.” Applying the tests outlined above, the Court finds that Plaintiffs have failed to do so for several reasons. The Court first considers the “sole PII” analysis, under which the facts proffered in the First Amended Complaint are insufficient to state a claim. Plaintiffs have not pleaded that the Purchased NBC Apps disclose information that, standing alone, is capable of identifying them as individual human beings associated with viewing activity on the apps. Plaintiffs allege the disclosure of various device identifiers (Android ID, Android Advertising ID, Identifier for Advertisers, Identifier for Vendors, New Relic ID, and User ID), but those identifiers only identify devices, not particular individuals. It may be true that only one person uses an identified device. But without more information, such as a name or an address, no one can identify the

particular individual using a particular device. For all intents and purposes, the device remains anonymous—a nameless and faceless device among a million others. Plaintiffs assert, conclusorily, that the Adobe ID and mParticle ID are user profile identifiers that “specifically identify individuals linked [to] that user profile” on the Adobe Experience Cloud platform and IDSync platform, respectively. (Pls. Mem. at 14-15.) Their complaint does not, however, allege that these individualized user profiles contain any information that reveals the identity of a particular individual, as opposed to a composite of information relating to an anonymous individual’s patterns of behavior. See Wilson, 598 F. Supp. 3d at 92 (finding that identifier pointing to a user profile was not PII where the complaint

“contains no allegation as to what information was actually included on [plaintiff’s] profile nor how that information could be used by a third party to identify [plaintiff]”). Plaintiffs plead, for example, that Adobe IDs point to unique user profiles on the Adobe Experience Platform. Plaintiffs allege that these profiles contain information about “Analytics,” Digital Advertising,” “Email,” “Customer Data Management,” “Social Media,” “Call Centers,” and “Commerce,” (FAC ¶ 58 (quoting Adobe’s website)), but Plaintiffs do not explain the contents of any of this information or whether any of it can be used to specifically identify them. Plaintiffs also allege that Adobe’s user profile can “connect[] IDs across all data sets,” including “Ad ID,” “CRM ID,” “Support ID,” “Email ID,” “Phone,” “3rdParty ID,”

“In-App ID,” “Anonymous ID,” “Web logged-in ID,” and “Device ID.” (Id. ¶ 67 (quoting Adobe’s website).) But again, Plaintiffs do not explain the nature of any of this information or whether any of it can be used to specifically identify them in association with their video viewing information. Plaintiffs similarly contend that mParticle IDs point to unique user profiles on the IDSync Platform. This allegation is likewise insufficient. Plaintiffs allege that “[e]very piece of data collected is attributed to a user [profile]” and that user profiles “compile ‘the most up-to- date real-time user identities, device identities, user attributes, and audience memberships.’” (FAC ¶¶ 75, 77 (quoting mParticle’s website).) Plaintiffs also claim that these user profiles “decisively link data generated from your apps with data from other sources, like CRM feeds.” (Id. ¶ 74 (quoting mParticle’s website).) Again, however, Plaintiffs fail to explain the precise contents of an individualized user profile and how these contents can specifically identify them. Plaintiffs do allege that “these user profiles can be queried to find a specific individual user using identifiers such as an email address, phone number, or device ID,” (id.), but Plaintiffs do not

allege that these profiles actually contain email addresses or phone numbers or that such information is used to relate their personal identities to their video viewing histories. The First Amended Complaint is too vague for the Court to reasonably infer that any—let alone a significant proportion—of the user profiles on the mParticle IDSync platform contain email addresses, phone numbers, or other potential identifiers of particular people.16 Plaintiffs’ argument that the user identifiers (Adobe ID and mParticle ID) are PII also fails because this argument must proceed under the linkage theory17—and Plaintiffs fail to plead that the requisite additional information is publicly or widely available. The Purchased NBC Apps transmit only certain types of information to Adobe and mParticle. To create

individualized user profiles, Adobe and mParticle must collect and agglomerate various data not disclosed by the Purchased NBC Apps, in addition to the data disclosed by the apps. As explained above, the additional information includes, in the case of Adobe, information about

16 The First Amended Complaint alleges that “[w]eb and app developers configure the data disclosed to mParticle” and may configure the process to disclose an email address to mParticle. (FAC ¶ 76.) Plaintiffs, however, do not allege that the Purchased NBC Apps actually configured the process to disclose email addresses to third parties. (Id. ¶¶ 6, 50-51, 72.) 17 Plaintiffs’ proposition that disclosure of the combination of device identifiers and user profile identifiers is PII also must be considered under the linkage theory for the same reasons. “Analytics,” “Digital Advertising,” etc., (FAC ¶ 58), and in the case of mParticle, “real-time user identities, device identities, user attributes, and audience memberships,” (id. ¶ 77). Adobe collects this additional data “from all customer touchpoints, combining personally identifiable data from sources such as CRM and loyalty programs, with unknown user data—like web searches, ad clicks, and device IDs.” (Id. ¶ 56 (quoting Adobe’s website).) Adobe “link[s]

together multiple records” to create “‘unified person profiles’ featuring ‘linked identities, along with all [the NBC Apps’] customer’s real-time consumer, professional, or combined attributes or behavioral data across channels and all lines of business.’” (Id. ¶ 57 (quoting Adobe’s website).) Similarly, user profiles on the mParticle IDSync platform compile “the most up-to-date real-time user identities, device identities, user attributes, and audience memberships” and “decisively link data generated from [the Purchased NBC Apps] with data from other sources, like CRM feeds.” (Id. ¶ 75 (quoting mParticle’s website).) Plaintiffs’ allegations of prohibited PII disclosure fail, when considered under the linkage approach, because Plaintiffs do not allege that that the additional information that the platforms would have to use to match the disclosed information to

an individual person is publicly or widely available. Indeed, Plaintiffs do not even clearly describe the additional information. Plaintiffs’ primary argument in opposition is to analogize the information disclosed by the Purchased NBC Apps to Facebook IDs, which courts have held to constitute PII. This argument is unavailing because, in most instances, Facebook IDs correspond to individual identifiable humans, who can be identified merely by querying publicly available information. See, e.g., Czarnionka, 2022 WL 17069810, at *3 (“Facebook need not link the disclosed FID [Facebook ID] to personal information obtained elsewhere. The FID itself represents a particular individual.”); Collins, 721 F. Supp. 3d at 280 (“Anyone who knows a user’s Facebook ID can type ‘facebook.com/’ followed by the Facebook ID into a web browser to view that user’s Facebook profile page.”); Robinson, 152 F. Supp. 3d at 184 (describing a Facebook ID as “equivalent to a name—it stands in for a specific person”). Plaintiffs only allege that the disclosed information here is used to identify an “individualized profile.” On the face of the First Amended Complaint, there are no allegations that these profiles contain any further

identifying information, such as names or addresses. That is, at most, Plaintiffs allege that the profiles are themselves anonymous. Accordingly, Plaintiffs fail to allege a “‘firm and readily foreseeable’ connection between [these profiles] and [Plaintiffs’] identi[es].” Wilson, 598 F. Supp. 3d at 92 (quoting Yershov, 820 F.3d at 486). Supra pp. 25-27 (discussing the same in detail). Plaintiffs have thus failed to allege facts sufficient to support an inference that the information disclosed by the Purchased NBC Apps is “personally identifiable information” within the meaning of the VPPA or the VCPA. This conclusion is consonant with those of other courts that have dismissed VPPA claims premised on similar identifiers. See Wilson, 598 F.

Supp. 3d at 92 (holding “unique user identification number” was not PII where the identifier merely pointed to a “profile page, which may or may not contain various personal information about the user” and where there were “no allegations as to what information was actually included on [plaintiff’s] profile nor how that information could be used by a third party to identify [plaintiff]”); Robinson, 152 F. Supp. 3d at 178 (holding device serial number was not PII where recipient could use “aggregated data to ‘personally identify . . . users and associate their video viewing selections with a personalized profile in its databases’” (citation omitted)); Eichenberger, 876 F.3d at 984-86 (holding device serial number not PII where a “‘Visitor Stitching technique’ [may be used] to link an individual’s Roku device number with other identifying information derived from ‘an enormous amount of information’ collected ‘from a variety of sources’” (citation omitted)); Locklear v. Dow Jones & Co., 101 F. Supp. 3d 1312, 1318 (N.D. Ga. 2015) (holding device serial number was not PII where the “third party [recipient] had to take further steps, i.e., turn to sources other than [defendant], to match the Roku number to Plaintiff”), abrogated on other grounds by Ellis v. Cartoon Network, Inc., 803

F.3d 1251 (11th Cir. 2015); Ellis v. Cartoon Network, Inc. No. 14-CV-484-TWT, 2014 WL 5023535, at *3 (N.D. Ga. Oct. 8, 2014) (holding Android device ID was not PII where “to connect Android IDs with names, [recipient] had to use information ‘collected from a variety of other sources’”), aff’d on other grounds, 803 F.3d 1251 (11th Cir. 2015). State Law Claims Next, the Court turns to Plaintiffs’ state law claims. Notwithstanding the dismissal of Plaintiffs’ federal claims, the Court has subject matter jurisdiction of the state claims under 18 U.S.C. section 1332(d)(2)(A) because plaintiffs plead a putative class action and minimal diversity exists. See Blockbuster, Inc. v. Galeno, 472 F.3d 53, 59 (2d Cir. 2006). On the merits, however, Plaintiffs fail to plausibly plead either a GBL section 349 claim or an unjust

enrichment claim. GBL Section 349 Claim GBL section 349 “makes it unlawful to engage in ‘[d]eceptive acts or practices in the conduct of any business, trade or commerce or in furnishing of any service’ in New York.” Morales v. Apple, Inc., No. 22-CV-10872-JSR, 2023 WL 5579929, at *2 (S.D.N.Y. Aug. 29, 2023) (quoting N.Y. GEN. BUS. LAW § 349). To state a claim, a plaintiff “must allege that a defendant has engaged in (1) consumer-oriented conduct that is (2) materially misleading and that (3) plaintiff suffered injury as a result of the allegedly deceptive act or practice.” Orlander v. Staples, Inc., 802 F.3d 289, 300 (2d Cir. 2015) (quoting Koch v. Acker, Merrall & Condit Co., 18 N.Y.3d 940, 941 (2012)). Plaintiffs’ GBL section 349 claim rests on two alleged omissions: (1) “omissions of disclosures required under the VPPA [ ] and VCPA [ ] for the sharing of PII and video viewing history,” and (2) Defendants’ “failure to disclose [their] practice of sharing Plaintiffs’

and Class members’ PII and video viewing histories to third parties” and their failure to disclose that their data sharing practices “reveal[ed to those third parties] the identity of individuals who watched specific videos.” (FAC ¶ 149.) The first claim fails because Plaintiffs do not allege facts indicating the disclosure of “personally identifiable information” under the VPPA or the VCPA. Because they have not alleged disclosure in potential violation of either statute, their allegation of violations of related disclosure obligations fails to state a section 349 claim. Plaintiffs’ second claim also fails. Arguably, a plaintiff could possibly be able to plead an actionable claim under GBL section 349 for failure to disclose data sharing practices

even if the data being shared is not PII under the VPPA or VCPA. For example, a plaintiff might argue that a defendant lied about what categories of data it shared with third parties, regardless of whether such data was PII and whether such data enabled third parties to identify particular individuals who watched specific videos. But Plaintiffs’ complaint does not advance such a theory—Plaintiffs’ section 349 claim as pleaded in the First Amended Complaint is indistinguishable from their VPPA and VCPA claims. (See FAC ¶¶ 154-55.) Accordingly, Plaintiffs’ section 349 claims must be dismissed because they are duplicative of their VPPA and VCPA claims. See Martin v. Meredith Corp., 657 F. Supp. 3d 277, 287 (S.D.N.Y. 2023) (dismissing section 349 claim where VPPA claim was dismissed); see also Diaz v. Paragon Motors of Woodside, Inc., 424 F. Supp. 2d 519, 543 (E.D.N.Y. 2006) (“[W]here a [defendant] has not violated the underlying [statutory] claim, [it] has not committed a deceptive sales practice because such practice is not materially misleading.”); Myers v. Wakefern Food Corp., No. 20-CV-08470-NSR, 2022 WL 603000, at *5 (S.D.N.Y. Mar. 1, 2022) (“Nor does New York’s [GBL] fill the gap by creating a state law claim solely as a result of a

violation of federal [ ] regulations.”). Unjust Enrichment “The basic elements of an unjust enrichment claim in New York require proof that (1) [the] defendant was enriched, (2) at [the] plaintiff’s expense, and (3) equity and good conscience militate against permitting defendant to retain what [the] plaintiff is seeking to recover.” Briarpatch Ltd., L.P. v. Phoenix Pictures, Inc., 373 F.3d 296, 306 (2d Cir. 2004) (citing Clark v. Daby, 751 N.Y.S.2d 622, 623 (App. Div., 3d Dep’t 2002)). Plaintiffs’ unjust enrichment claim rests on the same allegedly tortious conduct— Defendants’ purported collection and disclosure of personally identifiable information and video viewing history—that Plaintiffs say violates the VPPA and VCPA. (FAC ¶¶ 157-64.)

Accordingly, Plaintiffs’ unjust enrichment claim is dismissed for the same reasons Plaintiffs’ VPPA and VCPA claims are dismissed. See Golden v. NBCUniversal Media, LLC, 688 F. Supp. 3d 150, 168 (S.D.N.Y. 2023) (“[T]o the extent that the VPPA claim ‘succeed[s], the unjust enrichment claim is duplicative’ and if the VPPA claim is ‘defective, an unjust enrichment claim cannot remedy the defects.’” (quoting Corsello v. Verizon New York, Inc., 18 N.Y.3d 777, 790 (2012))); accord Gardener v. MeTV, No. 22-CV-05963-LCJ, 2023 WL 4365901, at *5 (N.D. Ill. July 6, 2023) (“Plaintiffs’ unjust enrichment claim is dependent on its VPPA claim, so the Court similarly dismisses it . . . .” (applying Illinois law)). CONCLUSION For the reasons explained above, Defendants’ motion to dismiss is granted in full, and the First Amended Complaint is dismissed in its entirety. Plaintiffs are, however, granted permission to file a motion for leave to file an amended complaint, within 21 days of the date of this Opinion and Order. Any such motion must comply with all applicable federal, local and

individual rules of procedure (including Local Civil Rule 15.1). Failure to make a timely motion for leave to amend, or to demonstrate in such a motion that amendment would not be futile, will result in dismissal of this action with prejudice. This Opinion and Order resolves docket entry no. 30.

SO ORDERED.

Dated: New York, New York March 31, 2025

/s/ Laura Taylor Swain LAURA TAYLOR SWAIN Chief United States District Judge