Cain v. Redbox Automated Retail, LLC

136 F. Supp. 3d 824, 2015 U.S. Dist. LEXIS 131949, 2015 WL 5728834

• Court: District Court, E.D. Michigan
• Decided: September 30, 2015
• Docket: No. 12-CV-15014
• Status: Published

Opinion

OPINION AND ORDER REGARDING THE PARTIES’ CROSS MOTIONS FOR SUMMARY JUDGMENT .

Gerald E. Rosen, Chief Judge, United States District Court

I. INTRODUCTION

Plaintiffs Michelle Cain and Radha Sam-pat brought a putative class action against Defendant Redbox, a video rental company, based on Defendant’s alleged unlawful disclosure to third parties of certain personal information obtained during Defendant’s rental process. Plaintiffs assert three causes of action: (i) a violation of Michigan’s Video Rental Privacy Act (“VRPA”), M.C.L. § 445.1711 et seq.; (2) breach of contract; and (3) unjust enrichment. The parties have now each moved separately for summary judgment pursuant to Rule 56 of the Federal Rules of Civil Procedure. The parties have fully briefed both motions and have also filed supplemental material with this Court; Having reviewed and considered the parties’, briefs, supplemental authorities, supporting documents and the entire record of this matter, the Court has determined that the. pertinent allegations and legal arguments are sufficiently addressed in these materials and that oral argument would not assist in the resolution of this motion. Accordingly, the Court will decide the motions “on the briefs.” See Local Rule 7.1(e)(2), U.S. District "Court, Eastern District of Michigan. This Opinion and Order sets forth the Court’s ruling. '

II. PERTINENT FACTS

Since 2002, Defendant¹ has operated a movie rental business that allows customers ■ to rent physical copies of DVD and Blu-ray discs through- a nationwide network of self-service kiosks. Michael Woko-sin Deck, Dkt. # 46, ¶¶'3-4. These kiosks are located in or just outside various cooperating establishments, such as grocery stores, retailers, drug stores, and convenience stores. Id. ¶ 4. When renting a video at a kiosk, customers select one or more movies by title, pay by swiping a credit card or other payment card, and then take their disc or discs, which is dispensed automatically from the kiosk’s inventory through a slot. During the transaction, customers are provided the option of entering their email address in order to receive a transactional receipt and other notifications, but there is no requirement that théy do so. Id.

. When a Redbox customer makes a rental, she is required to click through several screens in order to select the disc or discs that she wants to rent and provide for payment. See id.; see also Sterk v. Redbox Automated Retail, LLC, No. 11 C 1729, 2013 WL 4451223, at *1 (N.D.Ill. Aug. 16, 2013). After the customer has done this, she must “check out” before receiving her disc or discs. Wokosin Deck, ¶¶ 15-16. Depending on the date on which the disc was rented, the “check out” screen would provide the customer with a prompt, requiring her to click a. box to finalize the transaction. Id. From, June 2010 until roughly June 2011, the kiosk would display, “By clicking on ‘Check Out’ you agree to the following terms and conditions.” Id. ¶ 15; June 2010 Kiosk Screen Shot, Dkt. # 48-7. The “Terms of Use,” described in more detail below, would then be displayed directly below that language. Id. No rental transaction could be completed without the customer affirmatively pressing the “Check Out” button and agreeing to be bound to the Terms of Use. Id. Beginning around June 2011, depending on the particular kiosk location, the “check out” process was slightly modified due to new software installed on the kiosks — each‘kiosk would display, “By pressing ‘pay’ or ‘use credits’ you agree to the Terms.” Wokosin Deck, ¶¶ 16-17, June 2011 Kiosk Screen Shot, Dkt. # 48-8. Below that language was a button labeled “Terms & Privacy” that allowed a customer to go to the Terms of Use and Privacy Policy to review them before completing the transaction. Id.. As discussed in more detail below, there were two different versions of the Terms of Use and Privacy Policy in place during the period in which the transactions at issue in this case took place: one effective from roughly June 2010 to June 2011, and one effective from roughly June 2011 to July 2013. Both sets of agreements, though containing different language, have the same import as relevant here.

The Terms of Use, discussed in more detail in the analysis section below, contain detailed contractual language, including required charges, return timing, limitations on use, and procedures for disputes. The Terms also contain an Illinois choice of law clause, which the parties do not dispute. Importantly, the Terms refer on several occasions to the applicable Privacy Policy, which describes the ways in which the customer authorizes Redbox to use certain “personal information” and other data collected by Redbox during the transaction. As explained below, these agreements form the crux of the debate in this case.

Redbox also contracts with various vendors to aid it in various business functions, “such as providing customer call center services, génerating rental receipts that are emailed to customers at their request, sending marketing information to Redbox consumers, and using anonymized customer rental information for internal purposes.” Wokosin Deck ¶ 32. In order to do this, Redbox shares with those vendors various bits of information associated with customer transactions. At issue here is information that Redbox shared with four vendors: ExactTarget, Experian Marketing Solutions (“Experian”), Adobe Insight (“Adobe”), and Stream Global Services (“Stream”).

First, Redbox employs ExactTarget to “genera,te[] rental and transactional receipts. . .when a movie is rented from a kiosk.” Id. ¶ 40. “Given the nature of the email transaction receipt, ExactTarget, by definition, has movie transactional information (because it is sending the transactional receipt for that movie), and it also receives the specific email address that the customer provided for that transaction. Redbox does not provide the name or any other information about that customer.” Id. ¶ 42. More specifically, as Plaintiff alleges, ExactTarget receives each “customer’s email address, video title rented (or returned), kiosk location, and last four digits of the customer’s credit card...in order to enable ExactTarget to send emails and ads to that customer.” Pk’s Resp. to Def.’s Mot. for Summ. J., Dkt. # 61, at 3; see also Sarah Hatch Deck, Dkt. #53-2, ¶¶ 8, 10, 12, 14.

Second, Redbox. employs Experian to provide “marketing email services,” which includes promotional emails sent to customers regarding new Redbox releases, and to “track promotion code redemptions.” Wokosin Deck ¶¶ 36-37. According to Redbox, it does not share any personal rental history with Experian; instead it shares “limited customer information,” including a customer’s email address and name. Id. Plaintiffs contend,, however, that in order to perform its marketing email functions, Experian is provided with each customer’s “birthdate, email address, credit card , zip code, date of first rental, preferred genre, date of most recent rental, location of the kiosk last rented from, total number of rentals last made, total number of lifetime rentals, and the dates of any interactions with customer service.” Pl.’s Resp. to Def.’s Mot. for Summ.- J., Dkt. # 61, at 4; see also Redbox-Experian Data Stream, Dkt. 55-15.²

Third, Redbox employed Adobe to provide “analytics services” that “allow Red-box to query customer behavior;” Wokosin Deck ¶ 35. Redbox stopped using Adobe’s services in November, 2012. Id. Redbox asserts that “customer rental information sent to Adobe Insight [was] anonymized such that it is impossible to determine what movie any particular individual rented.” Accordingly, Redbox asserts that it did not provide Adobe with any customer names, email addresses, credit card numbers, addresses, or any other information that might identify a person. Id. Plaintiff, however, maintains that Plaintiffs’ personal and rental information — including email address, credit card zip code, date of most recent rental, location of most recent rental, total rentals made, and total lifetime rentals — were also transmitted to Adobe to perform analytics, though the deposition excepts that Plaintiffs cite for this proposition do not seem to support it. Pl.’s Resp. to Def.’s Mot. for Summ. J., at 5; Wokosin Dep., Dkt. # 55-9, at 86; Hoersten Dep., Dkt. # 55-4, at 177.

Finally, Redbox employs Stream “to perform.. .customer service related functions, including providing call center support for customers. Redbox began using Stream in February 2010 so that it could more effectively handle incoming requests from customers as Redbox grew in size.” Id. ¶ 44. Stream provides Redbox with “customer service agents” who answer customer service calls on behalf of Redbox. Id. ¶ 45. According to Redbox, these agents “have the ability to access a customer’s personal rental history from Red-box’s servers upon the request of that customer in order to process and respond to that consumer’s service related request or inquiry. Stream does not possess a copy of Redbox’s customer dataset, but instead only has access to it through credentials that Redbox administers and controls.” Id. ¶ 46. As Plaintiffs characterize this, however, Redbox provides Stream “searchable access to... customer data — including name, email, last four digits of credit card, state, zip code, and movie rented — which pulls up a list of customers matching that criteria and their rental histories.” PL’s Resp. to Def.’s Mot. for Summ. J., Dkt # 61, at 5-6. Plaintiffs also provide some indication that Stream employees use Red-box customer information for training purposes, though it is not clear that any such training uses non-anonymous data. Id. at 6.

Plaintiffs here are both citizens of Michigan who have used the services of Redbox in the past, with Plaintiff Sampat renting a total of 31 times from November 2010 to January 2013, and Plaintiff Cain renting over 100 times from July 2010 to July 2013. Id. ¶¶ 9-10.³ On November 11, 2012,⁴ Plaintiffs filed a complaint in this Court, predicating jurisdiction on the Class Action Fairness Act of 2005, 28 U.S.C. § 1332(d),⁵ and alleging claims based on Redbox’s practices on behalf of themselves and a putative class defined as

[a]ll Michigan residents who had their Personal Viewing Information disclosed by Redbox to a third party “service support” vendor or any other third party without written consent.

Pl.’s Compl., Dkt. # 1-1, ¶ 43. Plaintiffs claim that Redbox’s conduct in disclosing information to ExactTarget, Experian, Adobe, and Steam violates Michigan’s Video Rental Privacy Act (“VRPA”), M.C.L. § 445.1711 et seq., which provides various limitations on sellers or renters of media from disclosing information relating to those sales or rentals. Id. ¶¶ 51-64. Plaintiffs also allege breach of contract and unjust enrichment under Michigan law. Id. ¶¶ 65-85.

Prior to the filing of the instant motions, Defendant filed a Motion to Dismiss, asserting that Plaintiffs lacked standing to bring the suit under the VRPA because they failed to plead any damages; that the vendors that Defendant dealt with are Defendant’s agents and that disclosure to them was not a violation of the VRPA; that all disclosures occurred in- the “ordinary course of business,” which Defendant asserted was excepted under the VRPA; that Plaintiffs consented to disclosure of their personal information; and that Plaintiffs’ claims were barred by a one-year- limitation period. See Def.’s Mot. to Dismiss, Dkt. # 10. The Court rejected Defendant’s standing argument, and held that the remaining arguments required factual development and were best left for a Rule 56 motion. See Opinion and Order Denying Def.’s Mot. to Dismiss, Dkt. # 27.

The parties have how filed cross motions for summary judgment. Defendant re-raises all-of the claims that it raised in its Motion to Dismiss, now armed with a factual record. See Defi’s Mot. for Summ. J., Dkt. # 46. Plaintiffs reject each of those arguments in their own Motion for Partial Summary Judgment, and assert that the Court should rule in their favor on the issue of liability.

III. DISCUSSION

A. Rule 56 Standard

Through their present motions, both parties seek summary judgment in their favor pursuant to Rule 56 of the Federal Rules of Civil Procedure. Under Rule 56, summary judgment is proper if the moving party “shows that there is no genuine dispute as to any material fact and the movant is entitled to judgment as a matter of law.” Fed. R. Civ. P. 56(a). As the Supreme Court has explained, “the plain language of Rule 56[ ] mandates the entry of summary judgment, after adequate time for discovery and upon motion, against a party who fails to make a, showing sufficient to establish the existence of an element essential to that party’s case, and on whicli that party will bear the burden of proof at trial.” Celotex Corp. v. Catrett, 477 U.S. 317, 322, 106 S.Ct. 2548, 91 L.Ed.2d 265 (1986). In addition, where a moving party seeks an award of summary judgment in its favor on a claim or issue as to which it bears the burden of proof at trial, that party’s “showing must be sufficient for the court to hold that no reasonable trier of fact could find other than for the moving party.” Calderone v. United States, 799 F.2d 254, 259 (6th Cir.1986) (emphasis and citation omitted).

In deciding a motion brought under Rule 56, the Court must view the evidence in a light’most favorable to the non-moving party. Pack v. Damon Corp., 434 F.3d 810, 813 (6th Cir.2006). Yet, the nonmoving party may not rely on mere allegations or denials, but must “cit[e] to particular parts of materials in the record” as establishing that one or more material facts are “genuinely disputed.” Fed. R. Civ. P. 56(c)(1). Further, “the mere existence of a scintilla of evidence that supports the nonmoving party’s claims is insufficient to defeat summary judgment.” Pack, 434 F.3d at 814 (alteration, internal quotation marks, and citation omitted).

B. Analysis

This case involves relatively straightforward allegations, of violations of the VRPA, which, as the court previously noted, “is a state statute that lacks any significant litigation history.” Halaburda v. Bauer Pub. Co., LP, 2013 WL 4012827, at *2 (E.D.Mich. Aug. 6, 2013). The VRPA is a short act, containing only five sections. The first section defines “Customer,” “Employee,” and “Employer” for the purposes of the Act (none of these definitions are at issue here). The second provides the VRPA’s primary protections, broadly limiting the extent to which persons selling, renting, or lending various media items may disclose details regarding those transactions:

Except as provided in section 3 or as otherwise provided by -law, a person, or an employee or agent .of the person, engaged in the business 'of selling at retail, renting, or lending books or other written materials; sound recordings, Or video recordings shall not disclose to any person, other than the customer, a record or information concerning -the purchase, lease, rental, or borrowing of those materials by a customer that indicates the identity of the customer.

M.C.L. § 445.1712. The third section then provides various exceptions to section 2, including that “a record or information described in section 2 may be disclosed ... [w]ith the written permission of the customer.” M.C.L. § 445.1713. Last, section 4 classifies any violation as a criminal misdemeanor, and section 5 provides for a civil cause of action for violation of the statute, allowing for “[a]ctual damages, including damages for emotional distress, or $5,000.00, whichever is greater,” as well as litigation and attorney fees. M.C.L. §§ 445.1714-1715.

In their Motions, the parties raise five distinct issues regarding Defendant’s alleged-violations. First, Defendant contends that no disclosure of the kind prohibited by the VRPA took place to any vendor except Stream; Plaintiff disagrees, asserting that disclosures made to ExactTarget, Experian, and Adobe also qualify as violations under the VRPA. Second, Defendant contends that Plaintiffs, and by extension all Redbox customers, consented to any disclosure through of the Terms of Use that customers must agree to before renting a movie. Third, Defendant contends that disclosures were made in the “ordinary course of business,” which Defendant asserts is an implied exception to the VRPA that is incorporated from the federal Video Privacy Protection Act of 1988 (“VPPA”), 18 U.S.C. § 2710(b). Fourth, Defendant argues that the, claims are time-barred by the one-year limitation period provided, for in the Terms of Use. Fifth, Defendant reasserts that Plaintiffs lack standing because they have not sufferéd an injury in fact.⁶ Defendant’s success on any one of these grounds functions to bar Plaintiffs’ recovery, and accordingly, as discussed below, the Court need not reach all of the issues.

1. Plaintiffs Provided Consent for Defendant to Disclose Information to Ex-actTarget, Experian, Adobe, and Stream

Defendant asserts that, regardless of any information allegedly disclosed to companies that it collaborates with, Plaintiffs provided “written permission” within the meaning of the VRPA by agreeing to the Terms and Conditions that all usérs of Redbox kiosks must agree to when renting discs. See Defi’s Mot. for Summ. J., at 16-19. Plaintiffs admit that they followed the required process regarding Redbox’s terms and conditions when using the kiosks, but they challenge that this did not constitute “written permission” within the meaning of the VRPA for three reasons:

First, under Michigan law, Plaintiffs are not bound by Redbox’s Terms of Use, an electronic document they were unable to print or store during their kiosk transactions. Second, even if Plaintiffs were bound by the Terms of Use, it- does not.. .incorporate the Privacy Policy. Third, even if the Terms of Use did incorporate the Privacy Policy, Redbox fails to establish that Plaintiffs provided written permission to disclose their protected information as required by the VRPA.

Pl.’s Resp. to Def.’s Mot. fof Summ. J., Dkt.; # 61, at 16-17. The Court addresses each point in turn.

A. Plaintiffs Are Bound by the Terms of Use

First, Plaintiffs assert that the Terms of Use provided in all Redbox transactions are not enforceable against Plaintiffs because “[u]nder the Uniform Electronic Transactions Act, which has been enacted into Michigan law, an electronic document cannot be enforced against a party who is unable to store or print that record.” PL’s Resp. to Def.’s Mot. for Summ. J., at 17. The Uniform Electronic Transactions Act (“UETA”), M.C.L. § 450.831 et seq., which has been adopted by nearly every state, is a model law developed by the Uniform Law Commissioners that “represents] the first national effort at providing some uniform rules to govern transactions in electronic commerce that should serve in every state.” Michigan House Fiscal Agency Legislative Analysis, House Bill 5537 (Nov. 6, 2000). The Commissioners described the bill as “a procedural statute” with the fundamental purposes of “establishpng] the legal equivalence of electronic records and signatures with paper writings and manually-signed signatures” and “removing perceived barriers to electronic commerce.” Id. The act itself states that it should be construed to “[b]e consistent with reasonable practices concerning electronic transactions and with the continued expansion of those practices,” M.C.L. § 450.836(b).

Plaintiffs assert two related theories under the UETA. First,' they argue that because Redbox customers cannot “print or otherwise store a copy of the Terms of Use,” those Terms violate the UETA and accordingly the Terms are not binding. Second, they assert that they have not supplied “written permission” within the meaning of the VRPA because the UETA requires that such information must be provided in a form capable of retention by the recipient. Specifically, they point to sections 8(í) and (3) of the UETA, which state:

(1) If parties have agreed to conduct a transaction by electronic means and a law requires a person to provide, send, or deliver information in writing to another person, the requirement is satisfied if the information is provided, sent, or delivered in an electronic record capable of retention by the recipient at the time of receipt. An electronic record is not capable of retention by the recipient if the sender or its information processing system inhibits the ability of the recipient to print or store the electronic record.

H? i'fi *

(3) If a sender inhibits the ability of a recipient to store or print an electronic record, the electronic record is not enforceable against the recipient.

M.C.L. § 450.838(1), (3). Plaintiffs contend that subsection (1) requires Redbox to show that each time a rental is consummated, “an electronic record capable of retention” is created and.sent to Redbox from the kiosk used. And they further contend that subsection (3) means that the Terms of Use are not enforceable against them because, at each kiosk used, the Terms of Use are in a form that is neither able to be stored nor printed.

There are several problems with Plaintiffs’ theory. First, and perhaps most importantly, is the fact that Plaintiffs expressly agreed, in the Terms of Agreement, to an Illinois choice of law clause. See June 2010 Terms of Use, Dkt. # 48-5, at C00007 (“These Terms of Use, your access and use of the Kiosks, and the relationship between you and us are governed by the laws of the state, of Illinois.”); June 2011 Terms of use, Dkt. # 48-9, at C00027 (“These terms and the interpretation of these terms will be governed and construed under the laws of the State of Illinois.”). Critically, Illinois is one ’of the few states that has not adopted the UETA, and Plaintiffs point to no indication that the UETA should govern this transaction, especially as to Plaintiffs’ theory that the Michigan UETA renders the Terms of Use not binding against them.⁷

But even if the Michigan UETA were binding in this transaction, there is no reason to believe that Defendant’s conduct violates it. The relevant provisions of the law here require that where a particular “law requires a person to... deliver information in writing to another person,” then that information must be “capable of retention by the recipient at the time of receipt.” M.C.L. § 450.838(l).⁸Plaintiff initially attempts to argue that the inability of Redbox customers to retain a copy of the Terms of Use at the kiosk itself violates this provision of the UETA. PL’s Resp. to Def.’s Mot. for Summ. J., at 17 (“Redbox can point to nothing in the record suggesting that customers can print or otherwise store a copy of the Terms of Use to which Redbox purports to bind them.”). Plaintiff is confused on this point — there is no law asserted that requires Redbox to deliver any information to Plaintiff in writing. Accordingly, the UETA places no obligation on Redbox to allow Plaintiffs to retain the Terms of Use — Redbox is the recipient of the information that must be “delivered in writing.”

Plaintiff eventually realizes this, and makes the better argument in their brief-stating that “Redbox fails to establish that pressing a button on a kiosk creates ‘an electronic record capable of retention’ by Redbox, i.e., a record of Plaintiffs’ permission that can be printed or stored.” Id. at 17. The problem for Plaintiff is that this is simply not factually true, at least as based on the record here — indeed, information regarding the transaction is in fact retained by Defendant at the close of every transaction — such retention led to this very lawsuit. Plaintiff seems to imply that every transaction with every customer entered into by Defendant would have to result in separate and unique storage of the exact same agreement, i.e., a separate copy of the Terms of Use and Privacy Policy for each individual transaction. Not only would this be incredibly wasteful— resulting in millions of copies of the exact same Terms of Use and Privacy Policy document — it does not fit with the actual language of the statute, which requires only that the information sent be “capable of retention.” The information sent here, via the customer’s pressing of either the “pay” or “use credits” button on the kiosk, is unquestionably capable of being retained by Redbox, and is in fact actually retained in the various bits of information at issue here. Plaintiffs fail to understand that these provisions of the UETA serve essentially as a protector of the statute of frauds in electronic documents, ensuring that written assent is capable of being retained where such written assent is required by law. Even if the UETA were applicable here, Defendant’s procedures surely would have satisfied it.

Finally, independent of the UETA, Plaintiffs claim that they never provided assent, to the Terms of Use when making their rentals. This argument is similarly unavailing. The parties agree that, before a rental can be completed on one of Red-box’s kiosks, the customer is confronted with a screen that states “By pressing ‘pay’ or ‘use credits’ you agree to the Terms.” E.g., June 2011 Kiosk Screen Shot, Dkt. # 48-8. The parties disagree, however, on whether a customer would understand that “Terms” means the Terms of Use. Plaintiffs note that the final screen also includes the following terms, which they argue could confuse customers as to which terms apply to a sale:

Daily rental charges don’t include applicable tax. Discs kept after 9 p.m. the next day, and each day after, are subject to additional daily rental charges. If you keep a disc for the .maximum rental period, it’s yours to keep, and no further charges apply. See complete Terms for the rules for renting from Redbox. Maximum rental period: DVD (25 days), Bluray® (23 days), Games (30 days).

June 2011 Kiosk Screen Shot,* Dkt. # 48.-8. The Court is not persuaded by Plaintiffs’ argument, as even a cursory glance at the text would alert a customer to the fact that there are other terms incorporated into the contract. The screen explicitly tells customers to “[s]ee complete Terms,” which quite obviously signals that more complete terms exist elsewhere. Further, this screen clearly capitalizes “Terms,” demarcating the word as a proper noun and making clear that the “complete Terms” are the Terms of Use. Accordingly, the Court finds that Plaintiffs clearly assented to the Terms of Use when making , then-rentals a Redbox kiosks.

B. Redbox’s Privacy Policy is Partially Incorporated in the Terms of Use

Next, Plaintiffs argue that, even if they assented to the Terms of Use and those Terms of Use were binding against them, Redbox’s Privacy Policy, which contains the language that potentially allows it to disclose the information at-issue here, was not contained within those -Terms. Pl.’s Resp. to Def.’s Mot. for Summ. J., at 19-20. Defendant concedes that the Terms of Use language itself is silent on the subject of information disclosure, but notes that the Terms of Use references the Privacy Policy on multiple occasions, and accordingly, argues that the Privacy Policy is incorporated by reference into the Terms of Use.

’ As noted above, Illinois .law governs the contract.⁹ Under Illinois law, “[i]n order for a contract to incorporate all or part of another document by reference, the reference must show an intention to incorporate the document and make it part of the contract.” Bd. of Managers of Chestnut Hills Condo. Ass’n v. Pasquinelli, Inc., 354 Ill.App.3d 749, 755, 290 Ill.Dec. 730, 822 N.E.2d 12, 17 (2004). However, “[t]o be construed as incorporating an entire second document, a contract must display an intention to completely adopt that document, not merely require compliance with specified portions.” Hayes v. M & T Mortg. Corp., 389 Ill.App.3d 388, 329 Ill.Dec. 440, 906 N.E.2d 638, 641 (2009) (emphasis added) (citation omitted).

Here, the Terms of Use mentions the Privacy Policy four times: (1) on the first kiosk screen, stating “[p]lease also read the Redbox Privacy Policy below...;” (2) on the fifth kiosk screen, stating “[p]lease also review Redbox’s privacy policy below;” (3) on the eighth kiosk screen, in the “User Comments and Postings” section, stating “[e]xcept as otherwise described in the Redbox Privacy Policy, any User Content will be treated as non-confidential and non-proprietary and we will not be liable for any use or disclosure of User Content;” and (4) on the sixteenth kiosk screen, in the “Indemnification” section, stating that customers, “agree to... hold [Defendant] harmless from and against any and all claims.. .that directly or indirectly arise from or are otherwise directly or indirectly related to::. . (g) [Defendant’s] use of [customer] information as permitted under these Terms, the Privacy Policy, or . any other, written agree-ment____” June 2011 Terms of Use, Dkt. # 48-9, at C01648, C01652,' C01655, C01663.¹⁰ Reviewing the language, the Court finds that the Terms of Use do not display a clear intention to “completely adopt” the Privacy Policy in its entirety. Compare Hayes v. M & T Mortgage Corp., 389 Ill.App.3d 388, 329 Ill.Dec. 440, 906 N.E.2d 638, 641 (2009), with Gillespie Cmty. Unit Sch. Dist. No. 7, Macoupin Cnty. v. Wight & Co., 2012 WL.7037447, at *7 (Ill.App.Ct. Sep. 11, 2012) (finding completely incorporated second document where the first document explicitly states that the two will “together constitute the ‘Agreement’ ”). Instead, it merely requires compliance “only with specified portions” of the Privacy Policy, namely in the fourth reference. McWhorter v. Realty World Star, Inc., 171 Ill.App.3d 588, 121 Ill.Dec. 898, 525 N.E.2d 1205, 1208 (1988). The first two references simply ask customers to read the Privacy Policy — they do not state that it will be binding in any way'. The third relates to User Content¹¹ and only describes the Privacy Policy as an exception to the rule stated in the Terms of Use. The fourth reference, however, 'explicitly indicates that Defendant cannot be held hable for use of customers’ information in accordance with the Privacy Policy. The language - of that clause is explicit, and accordingly, Plaintiffs have consented to any “use of [customer] information as permitted under, .'.the Privacy Policy.” June 2011 Terms of Use, Dkt. # 48-9, at C01663. In that sense,-"even though, even though there is not clear language adopting or merging the Privacy Policy with the Terms of Use, any activity that is consented to under the Privacy Policy will also be consented to by accepting- the Terms of Use.

C. By Accepting the Terms of Use, Plaintiffs Provided Written Permission to Allow Defendant to Disclose Information for the Purposes Outlined in the Privacy Policy

Last, Plaintiffs argue that “even if [they] assented to and could be bound by the Terms of Use, and even if the Terms of Use incorporated the Privacy Policy, none of that establishes that Plaintiffs provided their “written permission” to disclose their protected information.” Pl.’s Resp. to Def.’s Mot. for Summ. J., at 20-21.¹² Assessment of this argument requires examination of the relevant provisions of the Privacy Policy. The Policy states:

Our Use of Information Collected Through the Platforms Redbox may use information collected through the Redbox Platforms, including your Personal Information, to: (1) allow you to participate in features we offer or to provide related customer service, including, without limitation, to respond to your questions, complaints or comments; (2) tailor content recommendations and offers we display to you; (3) process a rental or other transaction you initiate; (4) provide you with information, products or services that you have requested- or that we think may interest you; (5) process your registration, including verifying your e-mail address is active and valid; (6) improve the Redbox Platforms or our services and for internal business purposes;____

June 2011 Privacy Policy, Dkt. # 48-12, at C01666 (emphasis added).¹³ At the outset, Plaintiffs note that “Personal Information” is defined within the privacy policy as “information that identifies you as a specific individual, such as yoúr name, phone number, e-mail address or payment information.” Id. at C01667. Plaintiffs then assert that “[n]owhere does the Privacy Policy state that it will disclose the other kinds of protected information that were disclosed here, such as movie titles, kiosk locations, and dates of rentals. Thus, even if the Privacy Policy applied, it in no way establishes that customers like Plaintiffs consented to the disclosure of information protected by the YRPA but not listed in the Privacy Policy’s definition of Personal Information.” PL’s Resp. to Defi’s Mot. for Summ. J., at 19. What Plaintiffs fail to recognize, however, is that the Policy allows for use of “information collected through the Redbox Platforms, including your Personal Information.” In the Policy, “Personal Information” is a subset of the “information collected through the Redbox Platforms,” and therefore any permission to disclose information would concern the broader term. See, e.g., BLACK’s LAW DICTIONARY (10th ed. 2014) (defining “include” to mean “[t]he participle including typically indicates a partial list.. .But some drafters use phrases such as including without limitation and including but not limited to — which mean the same thing.”).

Thus, the critical task is determining what is the “information collected through the Redbox Platforms.” “Redbox Platforms” is defined in the first sentence of the Privacy Policy, a sentence . that is somewhat difficult to parse for a definition. The relevant language is as follows:

This Privacy Policy applies to the Red-box web sites that post this policy (including, without limitation, Redbox;com) (each a “Site”), and to information collected through Redbox kiosks and Red-box mobile applications, including any available interactive features, downloads, applications, widgets or other outlets made available through a Redbox web site or that interact with a Redbox web site, and that post or include a link to this Privacy Policy, regardless of whether accessed via computer, mobile device pr otherwise (collectively, the “Redbox Platforms”).

June 2011 Privacy Policy, Dkt. # 48-12, at C01666 (emphasis added). Although the above language is somewhat confusing, the definition of “Redbox Platforms” only makes sense if it includes the following three items: Redbox web sites, Redbox kiosks, and Redbox mobile applications. Given this definition, the relevant Privacy Policy section can be read as allowing Defendant to use information collected through the kiosks to be used to “provide related customer service,” “tailor content recommendations and offers,” “process ... rental[s] or other transaction^] [the customers] initiate,” “provide [customers] with information, products or services that [Redbox] think[s] may interest [customers],” “process [customers’] registration,” or “improve the Redbox Platforms or [Redbox’s] services and for internal business purposes.” Id.

Armed with that definition, we can now examine whether Plaintiffs consented to all of the disclosures that they alleged in their Complaint and supported with evidence in the record. Plaintiffs have alleged, and provided some evidence, that Defendant discloses to ExactTarget information including a customer’s email address and movie title, for the purpose of sending emails to confirm certain customer actions, and also to show ads for snacks, Redbox promotions, and social media. Sending emails to customers to confirm actions falls squarely within “provid[ing] related customer service,” just as ads for offerings and social media fall within “providing] [customers] with information, products or services that [Redbox] think[s] may interest [customers],” both of which are functions that Plaintiffs agreed to by accepting the Terms of Use.

As to Experian and Adobe,' Plaintiffs allege that Defendant discloses information containing- a customer’s name, email address, date of first rental, preferred genre, date of most recent rental, and total number of lifetime rentals, all for the purposes of marketing- emails, tracking, and data analytics. Certainly, the marketing emails fall under “provid[ing] [customers] with information, products or services that [Redbox] think[s] may interest [customers].” The tracking and data analytics are less clear, but they appear to fall under either “improv[ing] the Redbox Platforms or [Redbox’s] services and for internal business purposes” or “tailoring] content recommendations and offers.” For example, the data analytics performed by third party vendor Adobe are specifically used, as Plaintiffs assert, for the purpose of determining “what e-mails have gone out [to customers] and the corresponding data associated with those e-mails” regarding how users react to the emails with rental habits. Pl.’s Mot. for Summ. J., Dkt. # 53, at 12. This fits within the category of “improving] the Redbox Platforms or [Redbox’s] services and for internal business purposes,” or “tailoring] content recommendations and offers.”

Finally, third party vendor Stream allegedly has access to a database containing customer names and rental history. Plaintiffs’ own filings admit that this database is for the purpose of providing customer service. Pl’s Resp. to Def.’s Mot. for Summ. J., at 5-6. Plaintiffs’ further assertion that Stream employees have free access to customer data does nothing to take that access outside of customer service.. And Plaintiffs’ assertion that Stream trainees use customers’ data for training purposes further falls under “improvfing] the Red-box Platforms or [Redbox’s] services and for internal business purposes.”

In whole, while Redbox undoubtedly engaged in internal sharing of Plaintiffs’ personal and 'rental information, Plaintiffs clearly gave consent for all of the sharing that occurred. The palpable message of the Privacy Policy is that it allows virtually all sharing of information within Redbox’s organization and partner organizations for the limited internal purpose of benefiting Redbox’s services to customers and overall business. The Policy further makes clear that any disclosure of customer information for an external purpose is not consented — the type of disclosure that the VRPA is clearly most concerned with. Redbox clearly could not, for example, give or sell any customer data to a third party for a use unrelated to Redbox’s own business. But Plaintiffs have provided no evidence that there was any such disclosure; instead, all of their evidence relates to Redbox’s sharing of information within its own regulated system.

Accordingly, Plaintiffs’ claims that Defendant disclosed information to third parties in violation of the VRPA must fail. Defendant has shown that its Terms of Use and portions of its Privacy Policy apply to every rental transaction, and that these documents provide the written permission required by the VRPA. Because Plaintiffs’ claims of breach of contract and unjust enrichment are contingent on the success of its VRPA claims, those must fail as well.¹⁴

IV. CONCLUSION

For all the foregoing reasons,

IT IS HEREBY ORDERED that Defendant’s Motion for Summary Judgment (Dkt. #46) is GRANTED.

IT IS FURTHER ORDERED that and Plaintiffs’ .Motion for Partial Summary Judgment (Dkt. # 52) is DENIED. .

' IT IS FURTHER ORDERED' that Plaintiffs’ Complaint is " DISMISSED WITH PREJUDICE.

IT IS SO ORDERED.

1 . Defendant is a Delaware Limited Liability Company with its principal place of business in Illinois. Pl.’s Compl., Dkt # 1-1, ¶ 7.

2 . Though both parties seem to agree that Ex-perian receives each renter’s name, no name appears to be present; in the data stream provided by Plaintiffs.

3 . Plaintiff’s complaint focuses on only a subset of these rentals. See Pl.'s Compl., Dkt. # 1-1, ¶¶ 27, 35.

4 . As these dates make clear, and at Defendant repeatedly notes in its briefs, Plaintiffs continued to rent from Redbox even after the filing of this lawsuit.

6 . The Court previously addressed, and rejected, this argument, in its Opinion and Order Denying Defendant’s Motion to Dismiss, Dkt. #26. Defendant re-raises the issue merely to preserve it for any future apppal. Def.’s Mot. for Summ. J., Dkt. # 46, at 23-24. Accordingly, the Court does not address the issue again here.

7 . Illinois does have its own similar Act, called the Electronic Commerce Security Act. 5 ILCS 175/1-101; see also Princeton Indus., Products, Inc. v. Precision Metals Corp., No.13 C 7160, 120 F.Supp.3d 812, 818-19,. 2015 WL 4880843, at *5 (N.D.Ill, Aug. 17, 2015) (describing Electronic Commerce Security Act). That Act contains’ some provisions like the UETA, but does not contain provisions with effective language like that which Plaintiff attempts to rely on here. Even if it did, ' Plaintiff has waived any such argument by failing to raise it in its briefing.

8 . Much like the VRPA, there is relatively little caselaw regarding the UETA, and no Michigan court, at least as far as the Court could find, has interpreted the statute.

9 . On this issue, the parties agree that Illinois law controls. See Pl.’s Resp. to Def.'s Mot. for Summ. J., at 20 n.11.

10 . An earlier version of the Terms of Use, effective from approximately June 2010 to June 2011, more directly referenced the Privacy Policy, stating, “Our personal information practic'es are governed by our Privacy Policy, the terms' of which are incorporated herein. Please review our Privacy Policy on our Website at www.redbox.com to understand our practices.” June 2010 Terms of Use, Dkt. # 48-5, at C00006.

11 .' “User Content”' is content that is -created •in “user comment areas, message boards or Other Interactive areas on the Rejibox .Platforms” which are provided “to give users of the Redbox Platforms a forum to express their opinions and share their ideas, information, materials, and other user-generated content.” June 2011 Terms of Use, at C00023. '

12 . Plaintiffs make no argument, other than their UETA argument described above, that acceptance of the Terms of Use by clicking is not "written” within the meaning of the VER-PA, ' ‘

13 . As with the Terms of Use, there was an earlier version of the Privacy Policy that was effective from approximately June -2010 to June 2011. That version contained substantially similar language to the version effective in June 2011:

Companies may from time to time be engaged by Redbox to perform a variety of functions, such as fulfilling orders, assisting with promotions, providing technical services for our web site, etc. These companies may have access to personal information if needed to perform such functions. However, these companies may only use such personal information for the purpose of' performing that function and may not use it for any other purpose.

Redbox does not sell, transfer or disclose personal information to third parties. However, we may on occasion send márketing information on behalf of one of our business partners about products or. services they provide, that may be of interest to you. Redbox will not share your personal information with such partners but rather will send a mailing or email on behalf of those partners. - >

June 2010 Privacy Policy, Dkt. # 48-6, at C00008. Though the June 2011 Privacy Policy applied for the majority of the transactions at 'issue here, the'June 2010 Privacy Policy did apply for a few of the early' transactions. For the purposes of this analysis, the Court finds the language similar enough to warrant the same conclusion:

14 . Because Plaintiffs' consent to the Terms of Use precludes their recovery in full, the Court need not resolve the parties’ remaining arguments, though they raise interesting issues regarding the scope of the VRPA, especially as it relates to disclosure to potential agents (rather than public disclosure) and'to disclosure that occurs in the "ordinary-"course of business,” a recognized exception under the related VPPA. These important issues will remain for another day.