Cantu v. Tapestry, Inc.

District Court, S.D. California·Decided July 10, 2023·No. 3:22-cv-01974·Unknown

Opinion

JESSE CANTU, Case No. 22-cv-1974-BAS-DDL

Plaintiff, ORDER GRANTING IN PART AND v. DENYING IN PART DEFENDANT’S MOTION TO DISMISS

Defendant. (ECF No. 10)

Plaintiff Jesse Cantu (“Plaintiff”) is a self-described consumer and data privacy advocate who commenced this class-action suit on December 13, 2022, against Defendant Tapestry Inc. (“Defendant”), which does business as Coach.com (“Coach”). Plaintiff claims that Defendant’s actions—disclosing, without consent, the identities of customers and the titles of videos they view on Coach’s website to Facebook—violate the Video Privacy Protection Act (“VPPA”), 18 U.S.C. § 2710. Now before the Court is Defendant’s Motion to Dismiss Plaintiff’s First Amended Complaint (“FAC”). (Mot., ECF No. 10.) Defendant argues that Plaintiff’s Complaint must be dismissed for lack of subject matter jurisdiction under Federal Rule of Civil Procedure (“Rule”) 12(b)(1). In the alternative, Defendant argues that Plaintiff has failed to state a claim upon which relief can be granted. Plaintiff opposes (Opp’n, ECF No. 13) and Defendant replies (Reply, ECF No. 14).1 The Court finds the resolution of Defendant’s Rule 12(b)(1) and Rule 12(b)(6) motion is suitable without the need for oral argument. See Fed. R. Civ. P. 78(b); Civ. L. R. 7.1 (d)(1). For the reasons set forth below, the Court GRANTS IN PART and DENIES IN PART Defendant’s Motion to Dismiss. In 1988, the Washington City Paper published a list of then-Supreme Court nominee Robert Bork’s video rental history after a D.C.-area store provided the information to a reporter. In response to the disclosure, Congress passed the VPPA, recognizing that such an invasion of privacy, especially in an era of rapidly developing technology, is “an issue that goes to the deepest yearnings of all Americans.” S. Rep. No. 100–599, at *6 (1988). The VPPA prohibits any “video tape service provider” from “knowingly disclos[ing], to any person, personally identifiable information concerning any consumer of such provider.” 18 U.S.C. § 2710(b)(1). The Act provides for liquidated damages in the amount of $2,500, as well as punitive damages and other equitable relief for violations of its provisions. Id. § 2710(2)(A)–(D). In the instant case, Plaintiff alleges that Defendant leverages an elaborate system of cookies and other data capturing processes to better tailor its marketing and advertising campaigns to its customers. (FAC ¶¶ 9, 53.) To do this, Defendant enlists a Facebook- curated software, known as the Facebook Tracking Pixel (“Facebook Pixel”). (FAC ¶ 10.) The Facebook Pixel is a string of programming code that advertisers integrate into their websites. (See id.) Once installed, the Facebook Pixel allows Defendant to collect information about how users interact with its site. (FAC ¶¶ 11, 13.) 1 Defendant also filed a “Notice of Recent Authority” (ECF No. 15), which drew a corresponding response from Plaintiff (ECF No. 16). The Court will disregard both the Notice of Recent Authority and Plaintiff’s response, as Defendant failed to seek leave of court to file such a notice, pursuant to section 4F Most notably, Plaintiff alleges that when a user visits Coach.com, Defendant has programmed the Facebook Pixel to record the Website’s URL and the title of any video watched on the website. (FAC ¶¶ 19–21.) Facebook Pixel then sends such information to Facebook. (Id.) It also links a user’s video viewing information to a specific Facebook ID, should that user have a Facebook account. (FAC ¶ 56.) Facebook Pixel does so using three different cookies. (FAC ¶¶ 23–28.) When a visitor watches a video on Coach.com while logged into Facebook, the Facebook Pixel compels a visitor’s browser to transmit a “c_user cookie,” which contains a visitor’s unencrypted Facebook ID. (FAC ¶ 23.) A Facebook ID is a lengthy string of numbers, which by itself, contains no personally identifiable information. (FAC Fig. 6.) But Plaintiff alleges that anyone can connect a Facebook ID to one’s Facebook profile, simply by appending the string of numbers to the end of Facebook.com. (FAC ¶ 29.) This leads one to the Facebook account associated with the Facebook ID. (Id.) When a visitor’s browser has recently logged out of Facebook, a smaller set of cookies is sent through the Facebook Pixel. (FAC ¶ 24.) The “fr cookie” contains an encrypted Facebook ID and browser identifier. (FAC ¶ 25.) Another cookie, called the “datr cookie,” supplies browser information, and the “_fbp cookie contains, at least, an unencrypted value that uniquely identifies a browser.” (FAC ¶¶ 26–27.) Plaintiff does not explain how the encryption status of a Facebook ID affects one’s ability to identify a particular Facebook user. And he does not allege whether, by themselves, these smaller sets of cookies disclose information sufficient to identify a specific Facebook profile. However, he claims that “alongside event data for videos,” the “fr cookie” and “_fbp cookie” allow Facebook to identify a particular Facebook user. (FAC ¶¶ 25–26.) Facebook then “matches activity on Coach.com with a user’s profile.” (FAC ¶ 34.) To recap, Plaintiff claims that the code employed by Defendant generally can record and disclose the titles of videos watched on Coach.com. Cookies, which contain the Facebook IDs of those users watching such videos, are transmitted to Facebook, perhaps regardless of whether a user is actively logged into Facebook. And Facebook IDs are easily linked to corresponding Facebook users, as anyone can append the numerical ID to the end of Facebook.com. Together, this information—Facebook IDs and the viewing history of customers—constitutes what Plaintiff alleges is “personally identifiable information” (“PII”) protected by the VPPA. See 18 U.S.C. § 2710(a)(3). The PII is disclosed to Facebook to “build audiences” and “retarget . . . Facebook’s advertising campaigns.” (FAC ¶ 58.) And this is all done without consent. (FAC ¶ 59.) Plaintiff claims that during the “Class Period,” Defendant’s website hosted and delivered video content, such as the “Dream It Real” video. (FAC ¶ 15.) Plaintiff watched this video around October 31, 2022. (Id.) When he did so, Defendant disclosed to Facebook Plaintiff’s PII, like his Facebook ID and the title of the video he viewed, through the process just described above. Plaintiff brings suit on behalf of himself and a class of other users similarly situated who have watched videos on Coach.com. (FAC ¶¶ 46–51.) He seeks statutory and punitive damages, along with injunctive relief. (FAC at 16:2–14.) A. Standing Under Rule 12(b)(1), a party may move to dismiss a claim for lack of subject matter jurisdiction, including the absence of standing. Chandler v. State Farm Mut. Auto. Ins. Co., 598 F.3d 1115, 1123 (9th Cir. 2010). Article III, Section 2, of the Constitution limits federal courts to hearing “actual cases or controversies.” Spokeo, Inc. v. Robins, 578 U.S. 330, 337 (2016). This means that a plaintiff must have standing to bring suit in federal court. Id. at 338. A plaintiff must show three distinct elements to satisfy the irreducible constitutional minimum for standing. He must demonstrate (1) an injury-in-fact via “an invasion of a legally protected interest which is (a) concrete and particularized, and (b) actual or imminent, not conjectural or hypothetical”; (2) causation—the injury must be “fairly . . . trace[able

Free access — add to your briefcase to read the full text and ask questions with AI

Cantu v. Tapestry, Inc., (S.D. Cal. 2023).

Cantu v. Tapestry, Inc. (Cantu v. Tapestry, Inc.) — published by Counsel Stack Legal Research, free access to 12M+ legal documents.

Related

Chandler v. State Farm Mutual Automobile Insurance
598 F.3d 1115 (Ninth Circuit, 2010)
Warth v. Seldin
422 U.S. 490 (Supreme Court, 1975)
Havens Realty Corp. v. Coleman
455 U.S. 363 (Supreme Court, 1982)
Lujan v. Defenders of Wildlife
504 U.S. 555 (Supreme Court, 1992)
Bell Atlantic Corp. v. Twombly
550 U.S. 544 (Supreme Court, 2007)
Chapman v. Pier 1 Imports (U.S.) Inc.
631 F.3d 939 (Ninth Circuit, 2011)
Maya v. Centex Corp.
658 F.3d 1060 (Ninth Circuit, 2011)
United States v. Dennis Veal
23 F.3d 985 (Sixth Circuit, 1994)
Douglas Leite v. Crane Company
749 F.3d 1117 (Ninth Circuit, 2014)
Meghan Mollett v. Netflix, Inc.
795 F.3d 1062 (Ninth Circuit, 2015)
Bradley Van Patten v. Vertical Fitness Group
847 F.3d 1037 (Ninth Circuit, 2017)
Chad Eichenberger v. Espn, Inc.
876 F.3d 979 (Ninth Circuit, 2017)
Steckman v. Hart Brewing, Inc.
143 F.3d 1293 (Ninth Circuit, 1998)
Lee v. City of Los Angeles
250 F.3d 668 (Ninth Circuit, 2001)