UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK -------------------------------------------------------x ALEJANDRO ALDANA and SCOTT GALLIE, individually and on behalf of all others similarly situated, Plaintiffs, -v- No. 22-CV-7063-LTS GAMESTOP, INC., Defendant. -------------------------------------------------------x MEMORANDUM OPINION AND ORDER Plaintiffs Alejandro Aldana (“Mr. Aldana”) and Scott Gallie (“Mr. Gallie,” and together, “Plaintiffs”), individually and on behalf of all others similarly situated, bring this putative class action against GameStop, Inc. (“GameStop” or “Defendant”), under the Video Protection Privacy Act (“VPPA”), 18 U.S.C. section 2710. The Court has jurisdiction of this action pursuant to 28 U.S.C. section 1331. This case is before the Court on GameStop’s motion to dismiss the First Amended Complaint. (Docket entry no. 13 (the “Motion to Dismiss”).) The Court has carefully considered the parties’ submissions in connection with the instant motion. For the following reasons, the Motion to Dismiss is denied. BACKGROUND The following summary is drawn from the First Amended Complaint (docket
entry no. 10 (the “First Amended Complaint” or “FAC”)), the well-pleaded factual allegations of which are taken as true for the purposes of this motion practice. GameStop and Its Use of Facebook Advertising GameStop is “the world’s biggest game retailer” and sells video games through its website, gamestop.com. (FAC ¶ 2.) Video games have been produced on different kinds of laser discs, including CD-I and CD-ROM, since the early 1980s. (Id. ¶¶ 8-11.) Today, video games
are “typically manufactured using 100GB Blu-ray discs, the same audio-visual material used for movies.” (Id. ¶ 13.) Facebook is the world’s largest social media site, with 2.9 billion monthly active users. (FAC ¶ 14.) Facebook users are allowed only one account and must share “the name they go by in everyday life”—including their first and last name—their birthday, and their gender when creating an account. (Id.) Facebook generates revenue by selling advertising space on its website. (Id. ¶ 15.) Specifically, Facebook “sells advertising space by highlighting its ability to target users” by tracking “user activity both on and off its site” and compiling information to build “Core Audiences,” “which advertisers use to apply highly specific filters and parameters for their targeted advertisements.” (Id. ¶ 16.) Advertisers can also build “Custom Audiences” to
target specific users on Facebook in two ways: (1) by manually uploading contact information for customers or (2) by utilizing Facebook’s “Business Tools,” which collect and transmit the data automatically. (Id. ¶ 17.) GameStop uses both methods. First, GameStop uploads customer lists to Facebook that contain subscribers’ email addresses and information about what video games they purchased. (FAC ¶ 46.) GameStop “uploads these lists so Facebook can match subscribers to their Facebook profiles.” (Id.) To support this allegation, the First Amended Complaint includes a screenshot of a Facebook webpage that provides instructions to advertisers about how to provide Facebook with “recent offline event information” about the advertisers’ customers, including “customer” and “event details.” (Id. at Fig. 20 (citing Facebook, Upload Offline Event Data, https://perma.cc/3Z4D-YMH5).) Second, GameStop uses one of Facebook’s Business Tools called the “Facebook Tracking Pixel,” a piece of code that advertisers can integrate into their websites. (FAC ¶¶ 17-
18.) The Facebook Tracking Pixel captures specific actions on the advertiser’s website (each, an “event”) and sends a record of the event to Facebook; Facebook then “processes [that record], analyzes it, and assimilates it into datasets like the Core Audiences and Custom Audiences.” (Id. ¶ 18.) Advertisers control what events the Facebook Tracking Pixel collects and how it identifies users. (Id. ¶¶ 19-20.) GameStop hosts the Facebook Tracking Pixel on gamestop.com. (FAC ¶ 22.) There, the Facebook Tracking Pixel records and discloses a number of events, including when a user searches for a video game, clicks on the searched game, adds a game to their cart, checks out, and places an order. (Id. ¶¶ 23-29.) Plaintiffs allege that these disclosures “permit[] an ordinary person to identify a purchased video game.” (Id. ¶ 30.)
Upon the purchase of a video game from gamestop.com, the Facebook Tracking Pixel discloses three cookies—the c-user, fr, and _fbp cookies—to Facebook “to link to Facebook IDs and corresponding Facebook profiles.” (FAC ¶ 39.) That is, when a customer purchases a video game from gamestop.com while logged into Facebook, GameStop “compels a visitor’s browser to transmit to Facebook the c_user cookie, which contains that visitor’s unencrypted Facebook ID.” (Id. ¶ 31.) When a customer has recently logged out of Facebook, GameStop will “compel the browser” to send “the fr cookie,” which contains “at least, an encrypted Facebook ID and browser identifier,” an “_fbp cookie” that contains “at least, an unencrypted value that uniquely identifies a browser.” (Id. ¶¶ 32-33.) Facebook uses these two cookies, fr and _fbp, to identify users. (Id. ¶ 33.) Plaintiffs allege that (1) “[b]y compelling a visitor’s browser to disclose the c_user cookie alongside event data for video games, Gamestop knowingly discloses information sufficiently permitting an ordinary person to identify what video games a specific individual has purchased[,]” and (2) “[b]y compelling a visitor’s browser
to disclose the fr and _fbp cookies alongside event data for video games, Gamestop knowingly discloses information sufficiently permitting an ordinary person to identify what video games a specific individual has purchased.” (Id. ¶¶ 42-43; see also id. ¶ 45.) Plaintiffs’ Purchases on gamestop.com Both Plaintiffs created Facebook accounts and purchased video games from gamestop.com by checking out as guests. (FAC ¶¶ 50-52; 55-57.) The First Amended Complaint includes screenshots of “cut scenes”1 from two video games that Plaintiffs purchased: Mr. Aldana purchased Lost Judgment, and Mr. Gallie purchased The Quarry. (FAC ¶¶ 51, 56, Fig. 22 & 23.) Unbeknownst to Mr. Aldana, each time he purchased a video game from gamestop.com, GameStop used a customer list to upload his personally identifiable information
(“PII”), which specifically identified him and what games he purchased, to Facebook. (FAC ¶ 53.) Unbeknownst to Mr. Gallie, each time he purchased a video game from gamestop.com, GameStop used the Facebook Tracking Pixel to upload his PII, which specifically identified him and what games he purchased, to Facebook. (Id. ¶ 58.) Both Plaintiffs discovered GameStop’s disclosure of their PII in July 2022. (Id. ¶¶ 54, 59.)
1 “Cut scenes” are “video clips within a video game” that move the narrative of the game forward. (Docket entry no. 17 (“Pl. Mem.”) at 9.) DISCUSSION To survive a motion to dismiss a complaint pursuant to Federal Rule of Civil Procedure 12(b)(6), a complaint must plead “enough facts to state a claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). A proper
complaint cannot simply recite legal conclusions or bare elements of a cause of action; there must be factual content pleaded that “allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). The Court accepts as true the nonconclusory factual allegations in the First Amended Complaint and draws all reasonable inferences in the nonmoving party’s favor. Roth v. Jennings, 489 F.3d 499, 501 (2d Cir. 2007). In determining a Rule 12(b)(6) motion to dismiss, the Court may consider “the complaint, any exhibit attached to the complaint, materials incorporated in the complaint by reference, and documents that, ‘although not incorporated by reference, are “integral” to the complaint.’” Jasper & Black, LLC v. Carolina Pad Co., No. 10-CV-3562-LTS, 2012 WL 413869, at *4 (S.D.N.Y. Feb. 9, 2012) (quoting Schwartzbaum v. Emigrant Mortg.
Co., No. 09-CV-3848-SCR, 2010 WL 2484116, at *3 (S.D.N.Y. June 16, 2010)). Plaintiffs here bring one cause of action against GameStop under the VPPA, alleging that GameStop has violated a provision of the VPPA that prohibits a “video tape service provider” from “knowingly disclos[ing], to any person, personally identifiable information concerning any consumer of such provider.” 18 U.S.C. § 2710(b)(1). The VPPA’s “impetus was the publication in a weekly newspaper in Washington of a profile of Judge Robert H. Bork based on the titles of 146 films his family had rented from a video store.” Robinson v. Disney Online, 152 F. Supp. 3d 176, 179 (S.D.N.Y. 2015) (citation and internal quotation marks omitted).2 In its Motion to Dismiss, GameStop argues that Plaintiffs fail to state a claim under the VPPA because they have failed to allege facts indicating that (1) that GameStop is “video tape service provider” and (2) that GameStop knowingly disclosed the PII of any
consumer. (Docket entry no. 14 (“Def. Mem.”) at 2-3.) For the following reasons, neither argument has merit. Plaintiffs Plausibly Allege that GameStop is a “Video Tape Service Provider” Under the VPPA The VPPA defines a “video tape service provider” as “any person, engaged in the business, in or affecting interstate or foreign commerce, of rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials.” 18 U.S.C.A. § 2710(a)(4) (Westlaw through P.L. 118-39). In its motion, GameStop contends that it is not a “video tape service provider” because it sells video games, which it asserts “are neither pre-recorded video tapes nor audio visual materials ‘similar’ to pre-recorded video tapes.” (Def. Mem. at 6.) In opposition, Plaintiffs argue that they have plausibly alleged that the video games that GameStop sells are
covered by the plain language of the VPPA. (Pl. Mem. at 3.) Because the goods at issue are not “prerecorded video cassette tapes,” this Court’s evaluation of the pleading hinges on a determination of what “audio visual materials” are “similar” to “prerecorded video cassette tapes” under the VPPA. While other courts have addressed the meaning of “similar audio visual materials” under the VPPA, see, e.g., In re Hulu Priv. Litig., No. 11-CV-3764-LB, 2012 WL 3282960, at *5 (N.D. Cal. Aug. 10, 2012); In re Vizio, Inc. Consumer Priv. Litig., 238 F. Supp. 3d 1204, 1222
2 The VPPA was amended in 2013 to clarify how a video tape service provider could obtain consent to disclose a consumer’s PII to a third party. See Pub.L. 112-258, § 2, Jan. 10, 2013, 126 Stat. 2414. The amended provision is not at issue in this case. (C.D. Cal. 2017), none has considered whether the statutory language covers video games. However, at least two courts have held that the word “prerecorded” modifies both “video cassette tapes” and “similar audio visual materials.” Louth v. NFL Enters. LLC, No. 21-CV- 00405-MSM-PAS, 2022 WL 4130866, at *5 (D.R.I. Sept. 12, 2022); Stark v. Patreon, Inc., 2022
WL 7652166, at *6 (N.D. Cal. Oct. 13, 2022). Neither party to this case disagrees with that conclusion. Therefore, this Court must determine whether Plaintiffs have plausibly pled that GameStop is in the business of selling “similar audio visual materials” that are “prerecorded.” The Court considers a non-exclusive set of factors—including the text of the statute, the legislative history, and the content of the video games that Plaintiffs purchased from GameStop—to answer this question. Text of the VPPA “As always, we begin with the text.” Southwest Airlines Co. v. Saxon, 596 U.S. 450, 457 (2022). “If the meaning is plain, the inquiry ends there.” United States v. Rowland, 826 F.3d 100, 108 (2d Cir. 2016). “The plainness or ambiguity of statutory language is
determined by reference to the language itself, the specific context in which that language is used, and the broader context of the statute as a whole.” Robinson v. Shell Oil Co., 519 U.S. 337, 341 (1997). The Court must also “give effect, if possible, to every clause and word of a statute” and, in turn, “avoid statutory interpretations that render provisions superfluous.” United States v. Kozeny, 541 F.3d 166, 174 (2d Cir. 2008) (citations omitted). As an initial matter, Plaintiffs have plausibly pled that GameStop sells video games that are “audio visual materials” that were “prerecorded.” First, “audio visual” merely refers to work “consisting of related images that are presented in a series, usu[ally] with the aid of a machine, and accompanied by sound.” Audiovisual Work, Black’s Law Dictionary (11th ed. 2019). In light of this definition, it is not surprising that the Second Circuit and other courts have held that video games, which rose to popularity in the 1980s, are audio visual works (albeit in the context of copyright cases). See, e.g., Stern Elecs., Inc. v. Kaufman, 669 F.2d 852, 856 (2d Cir. 1982). Because Plaintiffs allege that the video games that GameStop sells have audio visual
elements (see FAC ¶¶ 51, 56), they have plausibly pled that these games are “audio visual materials.” Second, “prerecorded” refers to something “recorded in advance,” Prerecorded, The Merriam-Webster Dictionary (Rev. ed. 2022), and “recorded” means “to cause (sound, visual images, data, etc.) to be registered on something (such as a disc or magnetic tape) in reproducible form[,]” Recorded, The Merriam-Webster Dictionary (Rev. ed. 2022). Here, Plaintiffs allege that GameStop sells video games that “are typically manufactured using 100GB Blu-ray discs.” (FAC ¶ 13.) This is sufficient to plausibly plead that the games are captured on the disks and thus their audio visual content is “prerecorded” within the plain meaning of that term. The proper interpretation of the term “similar” as used in the VPPA is, however, a more challenging question. The dictionary definition of “similar”—“[n]early corresponding;
resembling in many respects; somewhat like; having a general likeness”—is insufficient by itself to elucidate the meaning of the word as used in the context of the statute. See Similar, Black’s Law Dictionary (6th ed. 1990). “[A]udio visual materials” may resemble or correspond to “prerecorded video cassette tapes” in a number of ways. The parties’ arguments focus on the attributes of audio visual content, the technical aspects of the media—found in video games and on prerecorded video cassette tapes—, and the available legislative history of the VPPA. According to GameStop, the statutory term “similar audio visual materials” refers to “new technologies but [only] for the purpose of delivering the same film, television, or video clip materials found in prerecorded video tapes.” (Def. Mem. at 8.) GameStop’s proposed definition relies on a distinction between passive and interactive engagement with the audio visual material, as well as the length and type of content embodied in the prerecorded material. (Id. at 9 (contrasting “[sitting] back for . . . ninety minutes” to watch a movie with “engag[ing] in an interactive, multi-part game”).) Plaintiffs, by contrast, insist that, “by selling video games on
physical discs, Defendant sells audio visual materials that are similar to pre-recorded video cassette tapes.” (Pl. Mem. at 6). Put somewhat differently, Plaintiffs argue that, because prerecorded physical discs—like the 100GB Blu-ray discs used for both video games and movies —are physical media “similar” to prerecorded video cassette tapes, video games are covered by the statutory language. (Id.) The parties’ disagreement about the meaning of “similar” indicates that the statutory language of the VPPA is ambiguous in this context. Legislative History of the VPPA Where, as here, “statutory language is ambiguous, [courts] may consider legislative history, but in doing so, [courts] must construct an interpretation that comports with the statute’s primary purpose and does not lead to anomalous or unreasonable results.” Carlin v.
Davidson Fink LLP, 852 F.3d 207, 214 (2d Cir. 2017) (internal quotation marks and original brackets omitted). “[A] committee report is the most useful document in the legislative history.” United States v. Gayle, 342 F.3d 89, 94 (2d Cir. 2003) (internal quotation marks and citations omitted). Here, both parties argue that the Senate Judiciary Committee Report that was submitted with the proposed VPPA in 1988 (S. Rep. 100-599 (1988) (the “Senate Report”)) supports their respective readings of the statutory language. Plaintiffs highlight the Senate Report’s description of “similar audio visual materials” as encompassing “laser discs, open-reel movies, or CDI technology.” (Pl. Mem. at 7.) Yet Plaintiff’s conclusion—that “the VPPA applies to new technologies that transmit audio visual materials that are pre-recorded, full stop” (id. at 8)—does not necessarily follow from the list of new technologies included in the Senate Report when that list is considered in the full context of the report. GameStop, on the other hand, emphasizes the Senate Report’s repeated reference to “protect[ing] an individual’s choice
of films or television to watch,” and argues, inter alia, that similarity is lacking here because interactivity makes games different from movies. (Def. Mem. at 11.) GameStop’s argument as to the importance of the reason for statutory protection is more consistent with the Court’s reading of the Senate Report, although consideration of the purpose leads the Court to a path divergent from GameStop’s desired outcome. Critically, the Senate Report places the VPPA in a “long line of statutes passed by the Congress to extend privacy protection to records that contain information about individuals.” Senate Report at *2. According to the Report, Congress had passed at least eleven statutes in the 1970s and 80s to “expand[] and give[] meaning to the right of privacy.” Id. These statutes—including the Fair Credit Reporting Act, 15 U.S.C. section 1681 et seq., the Family Education Rights and Privacy
Act, 20 U.S.C. section 1232(g) et seq., and the Right to Financial Privacy Act, 12 U.S.C. section 3401 et seq.—indicate that Congress in each instance extended privacy protections to information gathered in specific contexts and did not create a broad right to privacy. See Senate Report at *2-4. Indeed, when the bill was introduced, Senator Grassley emphasized that, while “[p]rivacy is something we all value,” it is not “a generalized undefined right. . . . And it is the role of the legislature to define, expand, and give meaning to the concept of privacy.” Id. at *6. In the VPPA, Congress specifically sought to “prohibit[] video service providers from disclosing personally identifiable information except in certain, limited circumstances.” Senate Report at *5. There is a wealth of evidence indicating that Congress intended to regulate purveyors of films due to the important “relationship between the right of privacy and intellectual freedom.” Id. at *4. For example, the Senate Report emphasized that: Acknowledging the relationship between the right of privacy and intellectual freedom is a central part of the [F]irst [A]mendment. . . . Protecting an individual’s choice of books and films is a second pillar of intellectual freedom under the [F]irst [A]mendment. In Stanley v. Georgia, 394 U.S. 557, 565 (1969), the Court declared, “If the First Amendment means anything, it means that a State has no business telling a man, sitting alone in his house, what books he may read or what films he may watch.” Id. at *4. The Senate Report also notes that Senator Leahy reflected on this connection— between privacy and an individual’s choice of the media they consume—in his remarks in a Senate committee hearing regarding Judge Bork’s nomination to the Supreme Court. Id. at *5 (“It is nobody’s business what Oliver North or Robert Bork or Griffin Bell or Pat Leahy watch on television or read or think about when they are home.”). While Congress explicitly recognized that th ese privacy values extend past films—by repeatedly referencing books—Congress ultimately chose not to extend these protections to other materials. Indeed, the Senate Report explains that, in the original draft bill “the bill’s sponsors . . . included a similar protection for library borrower records, recognizing that there is a close tie between what one views and what one reads.” Id. at *8. “However,” that provision was not ultimately included in the final bill because “the committee was unable to resolve questions regarding the application of such a provision for law enforcement.” Id. The Senate Report thus indicates that “similar audio visual material” refers more narrowly to pre- recorded videos that are films or have similar content rather than the generic world of “audio visual materials that are pre-recorded, full stop” (Pl. Mem. at 8).3
3 This conclusion is consistent with GameStop’s argument that video games cannot be “similar audio visual materials” under the VPPA because, “[w]here Congress has sought to regulate video games, it has done so loudly and clearly, by simply referring to video games by name.” (Def. Mem. at 10.) Indeed, GameStop highlights one example in Application of the VPPA to the Content of the Video Games that GameStop Sells The Court’s inquiry, however, does not end there. After all, while a video game is not just like a video, Plaintiffs allege that video games—including the ones they purchased— include “cut scenes.” (FAC ¶¶ 51, 56.) “Cut scenes” are “video clips within a video game” that
move the narrative of the game forward. (Pl. Mem. at 9.) Courts across the country have agreed that short, pre-recorded videos constitute “similar audio visual material” under the VPPA. See Golden v. NBCUniversal Media, LLC, No. 22-CV-9858-PAE, 2023 WL 5434378, at *4 (S.D.N.Y. Aug. 23, 2023) (collecting cases); see also Ambrose v. Boston Globe Media Partners LLC, No. 21-CV-10810-RGS, 2022 WL 4329373, at *1-2 (D. Mass. Sept. 19, 2022) (concluding that plaintiff’s allegation that defendant was “engaged in the business of delivering various types of video content” including “video clips” was sufficient to state a claim under the VPPA). Indeed, the material sold by a covered vendor does not have to consist exclusively of prerecorded video cassette tapes; courts have found that businesses “that provide video content as well as other media content” that is not covered by the VPPA (e.g., because the content was not pre-
recorded) “are video service providers under the VPPA.” Golden, 2023 WL 5434378, at *4 (quoting Sellers v. Bleacher Rep., Inc., No. 23-CV-00368-SI, 2023 WL 4850180, at *6 (N.D. Cal. July 28, 2023)). So too here: “cut scenes” are prerecorded videos that the user can view in the context of playing an interactive game. This experience is analogous to prerecorded content that is made available to users of informational and entertainment websites that provide other content or programming that is not covered by the VPPA. In other words, the “cut scenes” in
which “Congress required [the] Department of Justice to report to it infringement cases involving different categories of works and specifically listed ‘video games’ as a separate category from ‘audio visual (videos and films),’ the very subject matter covered by the VPPA.” (Id. (quoting 18 U.S.C.A. § 2320(h)(2)(a)(i) (West 2016)).) video games are clearly “video content” covered by the VPPA, even if they are accompanied by the active game elements of the video games that GameStop sells. To avoid an inference of video tape service provider status on the basis of the cut scene content of its merchandise, GameStop argues that the cut scenes are merely incidental,
stating that “of course [it] may sell video games that happen to contain cut scenes, but that happenstance is far from enough to give rise to a VPPA claim.” (Def. Mem. at 13.) Specifically, GameStop cites In re Visio, Inc., Consumer Priv. Litig., 238 F. Supp. 3d 1204 (C.D. Cal. 2017)—a case positing that a letter carrier who, hypothetically, delivered video content when dropping off a package that contained a video tape was not “engaged in the business” of delivering audio visual content—to support the proposition that GameStop is not “engaged in the business of selling or delivering cut scenes” because being “peripherally or passively involved in video content delivery” is not enough for liability to attach under the VPPA. (Def. Mem. at 13 (quoting 238 F. Supp. 3d at 1221).) The In re Visio, Inc. decision, which relied upon a hypothetical to emphasize that a letter carrier “could not be characterized as ‘engaged in the
business’ of delivering video content because her job responsibilities are in no way tailored to delivering packages that contain videotapes as opposed to any other package[,]” 238 F. Supp. 3d. at 122, is inapposite. Here, the First Amended Complaint adequately alleges that GameStop is engaged in the business of selling video games, and that those video games include cut scenes. (FAC ¶¶ 51, 56.) Read in the light most favorable to the Plaintiffs, these factual allegations are sufficient to support an inference that video games are “substantially involved in the conveyance” of video clips in the form of cut scenes. In re Visio, 238 F. Supp. at 1221. Because GameStop is in the business of selling video games—products that include video content that is covered by the VPPA—it can be covered by the VPPA at least to the extent of those products. See Lebakken v. WebMD, LLC, 640 F. Supp. 3d 1335, 1340 n.2 (N.D. Ga. 2022) (“WebMD is a video tape service provider because [plaintiff] alleges that WebMD is engaged in the business of delivering prerecorded audio-visual materials to consumers via its e-newsletter and its website.”); Belozerov v. Gannett Co., Inc., 646 F. Supp. 3d 310, 314 (D. Mass. 2022) (finding
that USA Today is a video tape service provider “because it is engaged in the business of delivering computer files containing video content”). In sum, the Court concludes that Plaintiffs have plausibly pled that GameStop is a “video tape service provider” under the VPPA by alleging GameStop sold video games that include cut scenes. Because businesses that “that provide [VPPA-covered] video content as well as other media content” that is not covered by the VPPA “are video service providers under the VPPA[,]” Golden, 2023 WL 5434378, at *4, those allegations are sufficient as to the issue of video tape service provider status. Plaintiffs Plausibly Allege Knowing Disclosure of their Personal Identifying Information The VPPA prohibits “knowing[] disclos[ure], to any person, [of] personally
identifiable information concerning any consumer of such provider.” 18 U.S.C. § 2710(b)(1). To plead a disclosure of PII, Plaintiffs must allege that GameStop conveyed information “identif[ying]” both the “specific video materials or services” requested or obtained, and the person who “requested or obtained” those materials. 18 U.S.C. § 2710(a)(3). A viable VPPA claim thus requires “three distinct elements”: “the consumer’s identity; the video material’s identity; and the connection between them.” In re Hulu Priv. Litig., 86 F. Supp. 3d 1090, 1095 (N.D. Cal. 2015). The Court considers each Plaintiff’s disclosure-related allegations in turn.4
4 GameStop argues that, to the extent that the VPPA covers cut scenes in a video game, Plaintiffs fail to allege that GameStop disclosed “the video material’s identity” because “[d]isclosing the video game title is not the same as sharing what video clips a person Mr. Aldana’s Allegations The First Amended Complaint alleges that, unbeknownst to Mr. Aldana, each time he purchased a video game from gamestop.com, GameStop used a customer list to upload his PII—which specifically identified him and the games he purchased—to Facebook. (FAC
¶ 53). Specifically, the First Amended Complaint alleges that the customer lists that GameStop uploads to Facebook contain customers’ (1) email addresses5 and (2) information about what video games they purchased. (Id. ¶ 46.) This allegation is bolstered by a Facebook webpage, attached to the First Amended Complaint, that provides instructions to advertisers about how to provide Facebook with “recent offline event information” about the advertisers’ customers, including “customer” and “event details.” (Id. at Fig. 20 (citing Facebook, Upload Offline Event
requested, watched, or purchased: video games do not necessarily contain cut scenes and many video games in fact do not contain any cut scenes.” (Def. Mem. at 16.) But GameStop also concedes that video game purchasers “simply receive whatever cut scenes the game developer happened to include in the video game.” (Id.) In other words, there is no question that disclosing the name of the video game purchased also discloses the cut scenes that are included in that particular video game. The fact that a player may choose to “skip” or not watch a given cut scene (id. at 17) does not alter this reality. Further still, the plain language of the VPPA regulates the disclosure of the “title, description, or subject matter of any video tapes or other audio visual material.” See 18 U.S.C. §2710(b)(1)(D) (emphasis added). At a minimum, disclosing the name of the video game is sufficient to disclose the subject matter of the cut scenes embedded in the game. Therefore, Plaintiffs’ allegations that GameStop disclosed the names of the video games they purchased to Facebook is a sufficient allegation of disclosure of the identity of the video material. (See FAC ¶¶ 25, 30, 41, 44, 46, 53, 58.) 5 While at least one court has indicated that email addresses do not necessarily constitute personal information, Dancel v. Groupon, Inc., 949 F.3d 999, 1008-09 (7th Cir. 2019), the Court finds persuasive other decisions holding that email addresses are personally identifying, see, e.g., United States v. Hastie, 854 F.3d 1298, 1303 (11th Cir. 2017); Eichenberger v. ESPN, Inc., 876 F.3d 979, 986 (9th Cir. 2017). In any event, GameStop does not directly dispute that email addresses constitute PII. (See Def. Mem. at 24 n. 6 (noting that Mr. “Aldana alleges nothing to suggest that the email address he used in patronizing GameStop identified anything other than an email account”).) Data, https://perma.cc/3Z4D-YMH5).) GameStop seeks to contradict the factual allegations in the First Amended Complaint and argues that “GameStop could not have disclosed to Facebook a customer list containing video game purchase information, because such data is not within ‘the information
types that Meta accepts.’” (Def. Mem. at 24 (quoting Facebook, How to Format Customer Lists, https://perma.cc/4MVV-F9J7).) 6 GameStop insists that Facebook’s instructions to advertisers “make clear that a business must fastidiously ‘[p]repare’ and ‘format[]’ the customer list to include only the select set of fields permitted by Facebook,” and there is no field for video game or other purchase information in the customer list. (Id. at 23-24.) This argument is unavailing because it ignores entirely the Facebook instructions—regarding how to upload offline event data—that Plaintiffs included in the First Amended Complaint. (Pl. Mem. at 18.) Those instructions indicate that advertisers, like GameStop, could provide Facebook with specific information regarding customers’ purchases. (Id. at 18-19.) Therefore, Plaintiffs’ allegations— that GameStop provided Facebook with Mr. Aldana’s PII, including his email address, and
information about his video game purchases—are plausible. For this reason, GameStop’s Motion to Dismiss is denied as to Mr. Aldana. Mr. Gallie’s Allegations The First Amended Complaint alleges that, unbeknownst to Mr. Gallie, each time he purchased a video game from gamestop.com, GameStop used the Facebook Tracking Pixel to
6 The Court entertains this argument at the motion to dismiss stage because the First Amended Complaint references the Facebook instructions for creating customer lists, and the Court may consider “the complaint, any exhibit attached to the complaint, materials incorporated in the complaint by reference, and documents that, ‘although not incorporated by reference, are “integral” to the complaint.’” Jasper & Black, 2012 WL 413869, at *4 (quoting Schwartzbaum, 2010 WL 2484116, at *3). upload his PII—which specifically identified him and the games he purchased—to Facebook. (FAC ¶ 58.) GameStop makes a number of arguments about why these allegations are insufficient to survive its motion to dismiss, but none is persuasive. First, GameStop argues that Plaintiffs fail to state a claim under the VPPA
because “the purchase data allegedly shared by GameStop does not contain any identifiers.” (Def. Mem. at 18.) GameStop characterizes the First Amended Complaint as asserting only “that GameStop discloses purchase data to Facebook,” not that GameStop discloses personally identifiable information. (Id. at 19.) This argument is unavailing because it ignores allegations in the First Amended Complaint that, upon the purchase of a video game from gamestop.com, the Facebook Tracking Pixel also discloses three cookies—the c-user, fr, and _fbp cookies—to Facebook “to link to Facebook IDs and corresponding Facebook profiles” to the video game purchase. (FAC ¶ 39.) Indeed, the First Amended Complaint alleges that one of the disclosed cookies, the c_user cookie, contains that visitor’s unencrypted Facebook ID (id. ¶ 31); GameStop does not dispute that unencrypted Facebook IDs are PII under the VPPA (see Def. Mem. at 20).
Second, GameStop insists that “Facebook’s cookies are not personally identifiable information . . . because cookies are not ‘the kind of information that would readily permit an ordinary person to identify a specific individual’s video-watching behavior.’” (Def. Mem. at 19 (quoting Wilson v. Triller, Inc., 598 F. Supp. 3d 82, 91 (S.D.N.Y. 2022).)7 GameStop argues
7 To support this argument, GameStop points to one decision in this District that denied a plaintiff’s preliminary injunction motion and noted that Facebook’s “fr” cookie was not clearly PII under the VPPA. See Bernardino v. Barnes & Noble Booksellers, Inc., No. 17-CV-04570-LAK-KHP, 2017 WL 3727230, at *9 (S.D.N.Y. Aug. 11, 2017) (“[T]here is case law to support Barnes & Noble’s position that the alleged disclosure [of Facebook’s ‘fr’ cookie] may not constitute PII . . . .”), report and recommendation adopted, No.17-CV-4570-LAK, 2017 WL 3726050 (S.D.N.Y. Aug. 28, 2017). However, that decision is of limited relevance here because it made clear “[the] task on the present motion is not to decide the issue of whether the information conveyed is PII.” Id. at *9. that “[t]he fact that Facebook alone may be able to read the c_user cookie to identify a user is not enough to render the cookie PII.” (Id. at 20-21.) This argument seeks to obscure the significance of Plaintiffs’ allegations that Facebook is the third-party that received customer information from gamestop.com, and Facebook is able to decipher the cookies generated by the
Facebook Tracking Pixel. Courts across the country—including in this district—have indicated that providing a third party with PII that is legible to that specific third party is sufficient to state a claim under the VPPA. See, e.g., Robinson, 152 F. Supp. 3d at 182-83 (“[Defendant] could not disclose the information at issue here, along with a code that enabled [the relevant third party] to decrypt the hashed serial number and other information necessary to determine the specific device’s user, and still evade liability.”); In re Hulu, 86 F. Supp. 3d at 1097 (“No one would deny that I would violate the VPPA by passing someone an encrypted list of Judge Bork’s video rentals—if my recipient and I both understood that we would use a mutually intelligible code.”). For this reason, Plaintiffs have sufficiently alleged that the cookies disclosed to Facebook constitute PII.
Third, GameStop contends that Plaintiffs failed to allege that it disclosed PII because GameStop “does not disclose the cookie—the user’s browser does.” (Def. Mem. at 22.) To support its contention, GameStop points to Facebook documentation attached to the First Amended Complaint that explains how “cookies are placed by Facebook on a user’s web browser” and are not created or stored by GameStop. (Id. at 22-23.) This argument fails to acknowledge that, “[b]y installing the [Facebook Tracking] Pixel, Defendant opened a digital door and invited Facebook to enter that door and extract information from within.” Czarnionka v.Epoch Times Assoc., Inc., No. 22-CV-6348-AKH, 2022 WL 17069810, at *3 (S.D.N.Y. Nov. 17, 2022); see also Belozerov, 2022 WL 17832185, at *4 (concluding that it was “plausible [the defendant] disclosed PII under the VPPA” where the plaintiff “alleges throughout the complaint that defendant inserted the code into [its] website to transmit users’ information to Facebook”). Like other courts that have considered whether installing the Facebook Tracking Pixel constitutes disclosure of PII under the VPPA, the Court concludes that Plaintiffs’ allegations are
sufficient to survive the motion to dismiss. Fourth, GameStop argues that “Plaintiffs do not allege a knowing disclosure of PII.” (Def. Mem. at 24.) In other words, GameStop characterizes Plaintiffs’ allegation that “Defendant knowingly disclosed [PII] because it used that data to build audiences on Facebook and retarget them for its advertising campaigns” as “conclusory” and “mix[ing] two things: GameStop’s advertising to its own customers via Facebook, and Facebook’s independent attempts to purportedly match video game purchases with other sources of data, such [as] through Facebook’s cookies.” (Id. at 25.) Plaintiffs only need to plausibly allege knowing disclosure to a third party of “the consumer’s identity; the video material’s identity; and the connection between them.” In re Hulu, 86 F. Supp. 3d at 1095. Here, Plaintiffs allege knowing
disclosure of (1) the consumer’s identity (i.e., the unencrypted Facebook ID) (FAC ¶¶ 31-33, 39), (2) the video material’s identity (i.e., the name of the purchased video game) (id. ¶¶ 23-30), and (3) the connection between them (i.e., that GameStop compelled the disclosure of the cookies, “which contains that visitor’s unencrypted Facebook ID” and other identifying information, “alongside event data for video games”) (id. ¶¶ 31, 42-43; see also id. ¶ 45). “Knowledge of what Facebook might do with the disclosed information to yield PII is therefore unnecessary” to state a claim under the VPPA. Czarnionka, 2022 WL 17069810, at *4. Instead, Plaintiffs’ allegation that GameStop “integrated or installed the Facebook Tracking Pixel into its website . . . is sufficient to allege that [it] acted ‘knowingly’” under the VPPA because GameStop knew that the Pixel would automatically transmit users’ information to Facebook (see FAC ¶¶ 41-45). Lamb v. Forbes Media LLC, No. 22-CV-06319-ALC, 2023 WL 6318033, at *11 (S.D.N.Y. Sept. 28, 2023). Therefore, GameStop’s Motion to Dismiss is also denied as to Mr. Gallie.
CONCLUSION For the foregoing reasons, the Motion to Dismiss is denied. This case remains referred to Magistrate Judge Figueredo for general pretrial management. This Memorandum Order resolves docket entry no. 13. SO ORDERED. Dated: February 21, 2024 New York, New York /s/ Laura Taylor Swain LAURA TAYLOR SWAIN Chief United States District Judge