Czarnionka v. The Epoch Times Association, Inc.

• Court: District Court, S.D. New York
• Decided: November 17, 2022
• Docket: 1:22-cv-06348
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK

penne ee eeee OX LAWRENCE CZARNIONKA, individually and: on behalf of all others similarly situated, : ORDER AND OPINION : DENYING MOTION TO Plaintiff, : DISMISS -against- : : 22 Civ. 6348 (AKH) THE EPOCH TIMES ASSOCIATION, INC., : Defendants. :

eeeneeeeeee OX ALVIN K. HELLERSTEIN, U.S.D.J.: Plaintiff Lawrence Czarnionka, individually and on behalf of all other similarly situated persons (“Plaintiff”) brings this putative consumer privacy class action against The Epoch Times Association, Inc. (“Epoch Times” or “Defendant”) alleging violation of the federal Video Privacy Protection Act, 18 U.S.C. § 2710 (“VPPA”). (Complaint (“Compl.”), ECF No. 1.) Defendants move to dismiss for failure to state a claim upon which relief may be granted (R. 12(b)(6)). (ECF No. 17). For the reasons discussed below, Defendants’ motion to dismiss for failure to state a claim is denied. BACKGROUND The following facts are taken from the Complaint, which I must “accept{] as true” for the purpose of this motion. Ashcroft v. Igbal, 556 U.S. 662, 678 (2009). Defendant is an international newspaper and media company headquartered in New York, New York. Compl. 10. Defendant operates the website theepochtimes.com, where subscribers may view Defendant’s video content. /d. J§ 18, 20. As part of the subscription process, users provide Defendant with their name, email address, and billing information. /d. { 20.

]

Defendant has installed a Facebook Pixel on its website. Jd. § 19. The Pixel is a string of code that allows Defendant to collect information about how users interact with their site, such as whether users initiate purchases, what content users view, and other details. /d. □ 4, 22-23. When a subscriber views a video on Defendant’s website, the Pixel sends Facebook information about the subscriber, including the title and URL of the video and the subscriber’s Facebook ID (“FID”), which is a unique string of numbers linked to the subscriber’s Facebook profile. 7d. 5,27. The FID, when entered into a web browser in a specific format (“facebook.com/[FID]”), can be used to navigate to the Facebook profile of the particular person associated with that FID. /d 4 5. Plaintiff Lawrence Czarnionka was a paid Epoch Times subscriber and watched video content through his subscription. /d. § 38-40. He also was a Facebook user during that time. /d. 441. Plaintiff alleges that Defendant disclosed to Facebook his FID and details about the videos he watched. Jd. On July 27, 2022, Plaintiff brought the present action, on behalf of himself and a putative class of similarly situated subscribers, seeking injunctive relief and liquidated damages for alleged violation of the VPPA. /d. Defendant moves to dismiss the claims pursuant to Federal Rule of Civil Procedure 12(b)(6) for failure to state a claim. (ECF No. 17.) Having reviewed the parties’ submissions, I find that Plaintiff has plausibly asserted a claim under the VPPA. Accordingly, Defendants’ motion to dismiss for failure to state a claim is denied. DISCUSSION Legal Standard To survive a Rule 12(b)(6) motion to dismiss, Plaintiffs must allege “sufficient factual matter, accepted as true, to state a claim to relief that is plausible on its face.” Igbal, 556

U.S. at 678. A claim is facially plausible when it pleads “factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Jd. “Where a complaint pleads facts that are merely consistent with a defendant's liability, it stops short of the line between possibility and plausibility of entitlement to relief.” Jd. When considering a motion to dismiss a complaint under Rule 12, the Court must “accept[] all of the complaint's factual allegations as true and draw{] all reasonable inferences in the plaintiff's favor.” See In re Gen. Elec. Sec. Litig., 844 F. App'x 385, 387 (2d Cir. 2021). However, the Court is not “bound to accept conclusory allegations or legal conclusions masquerading as factual conclusions.” Faber v. Metro. Life Ins. Co., 648 F.3d 98, 104 (2d Cir. 2011), The Court is limited to a “narrow universe of materials.” Goel v. Bunge, Lid., 820 F.3d 554, 559 (2d Cir. 2016). “Generally, [courts] do not look beyond ‘facts stated on the face of the complaint, .. . documents appended to the complaint or incorporated in the complaint by reference, and... matters of which judicial notice may be taken.’" /d. (quoting Concord Assocs., L.P. v, Entm't Props. Tr., 817 F.3d 46, 51 n. 2 (2d Cir. 2016)) (alterations in original). Il. Analysis Under the VPPA, “[a] video tape service provider who knowingly discloses, to any person, personally identifiable information concerning any consumer of such provider shall be liable to the aggrieved person for [] relief].]” 18 U.S.C. § 2710(b)(1). Defendant moves to dismiss, arguing: (1) Plaintiff fails to plausibly allege that Defendant’s disclosures to Facebook included personally identifiable information (“PII”); (2) Plaintiff fails to plausibly allege that Defendant “disclosed” his PII; (3) Plaintiff fails to plausibly allege that Defendant “knowingly” disclosed his PII; and (4) Plaintiff's allegation lack the specificity necessary to determine if the

VPPA applies to the “video content” he consumed. (Mem. in Support at 4, ECF No. 1.) The Court addresses each argument in turn. A. Personally Identifiable Information The VPPA prohibits video tape service providers from knowingly disclosing “personally identifiable information concerning any consumer of such provider].]” 18 U.S.C. § 2710(b)(1). The statute provides that PII “includes information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider.” 18 U.S.C. § 2710(a)(3). The First Circuit has adopted a broad approach to PII; in Yershov v. Gannett Satellite Info. Network, Inc., the District Court held that the transmission of viewing records along with GPS coordinates and a device’s unique identification number constituted PII despite requiring additional information in order to link Plaintiff to his video history. 104 F.Supp.3d 135 (D.Mass.2015), at 137-38. However, a majority of courts have adopted a narrower view, requiring the disclosure itself, without any additional information, to identify a particular person. See Robinson v. Disney Online, 152 F. Supp. 3d 176, 180 (S.D.N.Y. 2015) (collecting cases). The Southern District of New York considered the issue in Robinson, where Disney provided plaintiff's viewing history to a third party along with a device serial number. Td. at 178. Plaintiff argued that the disclosure constituted PI because the third party could identify plaintiff by “linking these disclosures with existing personal information obtained elsewhere.” /d. at 180. The District Court rejected this argument, holding that the disclosure “must itself do the identifying that is relevant for purposes of the VPPA (literally, ‘information which identifies’ }—not information disclosed by a provider, plus other pieces of information collected elsewhere by non-defendant third parties.” Jd. at 182. The court held that “the

information disclosed by a video tape service provider must, at the very least, identify a particular person—not just an anonymous individual—and connect this particular person with his or her viewing history.” /d. at 179 (emphasis in original). Defendant relies on Robinson to argue that Defendant’s disclosure to Facebook fails to specifically identify Plaintiff and thus does not constitute PII, because the FID is not labeled as such in the disclosure and because a Facebook profile is not always associated with a specific person. Mem. in Support at 4-6. I find this argument unconvincing. Unlike the anonymized device serial numbers disclosed in Robinson, Facebook need not link the disclosed FID to personal information obtained elsewhere. The FID itself represents a particular individual. Indeed, Defendant fails to acknowledge that Robinson itself distinguished FIDs from the sort of device serial number disclosed by Disney in Robinson: “Nor is the information disclosed by Disney equivalent to a Facebook ID. ... A Facebook ID .. . is thus equivalent to a name—it stands in for a specific person, unlike a device identifier.” Robinson, 152 F. Supp. 3d, at 184. This view is consistent with courts in other district that have considered the very same question. See Inre Hulu Priv. Litig., No. C 11-03764 LB, 2014 WL 1724344, at *14 (N.D. Cal. Apr. 28, 2014) (“The Facebook User ID is more than a unique, anonymous identifier. It personally identifies a Facebook user. That it is a string of numbers and letters does not alter the conclusion. Code is a language, and languages contain names, and the string is the Facebook user name.”); Lebakken v. WebMD LLC, No. 1:22-cv-00644-TWT, ECF No. 40 (“the Court finds that [Plaintiff] adequately alleged that [Defendant] disclosed her Facebook ID and email address in connection with her video viewing information to Facebook and that the disclosure of such information constituted a disclosure of PII’). Accordingly, I find that Plaintiff has plausibly alleged that Defendant’s disclosure constituted PII.

B. Disclosure of PII Defendant argues that they did not actually “disclose” any PII to Facebook because the Pixel is placed into a user’s web browser by Facebook and sends information from the user’s web browser directly to Facebook, independent of any action by Defendant itself. Defendant notes that the GET request in the Complaint indicates that the request is hosted by Facebook. See Compl. 31. Defendant further argues that that the MARKUP article cited by Plaintiff in the Complaint states that Facebook, not Defendant, places a “c_user” cookie on a user’s web browser, and that when users with this cookie browse sites containing the Pixel, “the tracker communicates with Meta’s servers.” See Compl. § 25; Mem. in Support, at 8. At the motion to dismiss stage, the Court must “accept[] all of the complaint’s factual allegations as true and draw|] all reasonable inferences in the plaintiff's favor.” See In re Gen. Elec. Sec. Litig., 844 F. App'x 385, 387 (2d Cir. 2021). Additionally, courts generally “do not look beyond ‘facts stated on the face of the complaint, . .. documents appended to the complaint or incorporated in the complaint by reference, and . . . matters of which judicial notice may be taken.’” Goel v. Bunge, Ltd., 820 F.3d 554, 559 (2d Cir. 2016) (citation omitted). Here, Plaintiff alleges throughout the Complaint that Defendant itself discloses subscriber information by installing and maintaining the Pixel on its website. See Compl. {§ 4, 19, 22, 26-27, 29. Moreover, assuming that the MARKUP article has been fully incorporated by reference into the Complaint, the contents of that article do not contradict Plaintiff's claims. The relevant portion of the article states that the “tracker”—which is to say, the Pixel— communicates with Meta’s servers and transmits information about the user. See Mem. in Support, at 8. As alleged in the Complaint, the Pixel was installed by Defendant on Defendant’s website. It is therefore inaccurate for Defendant to claim that the transmission of information

occurs “independent of any action by Epoch.” Mem in Support, at 9. By installing the Pixel, Defendant opened a digital door and invited Facebook to enter that door and extract information from within. See In re Hulu, 2014 WL 1724344, at *14 (“Throwing Judge Bork’s video watch list in the recycle bin is not a disclosure. Throwing it in the bin knowing that the Washington Post searches your bin every evening for intelligence about local luminaries might be.”). Taking the factual assertions raised in the Complaint as true, and drawing all reasonable inferences in Plaintiff's favor, Defendant’s installation of the Pixel exposed its subscribers’ information to Facebook. This is sufficient to constitute “disclosure” under the VPPA. I therefore conclude that disclosure has been plausible alleged. C. “Knowing” Disclosure of PII Defendant argues that Plaintiff has not plausibly alleged that “Epoch even knew the Facebook ID existed much less that Epoch considered the Facebook ID to be PII or knew it was transmitted[.]’” Mem. in Support, at 10. However, Defendant’s assertions are contradicted by the contents of the Complaint. The Complaint plainly alleges that Defendant’s “disclosures were made knowingly, as [Defendant] programmed the Facebook Pixel into its website code, knowing that Facebook would receive video titles and the subscriber’s FID when a subscriber watched a video.” Compl. § 59. The Complaint also states that “Defendant knew that the Facebook Pixel disclosed PII to Facebook.” § 30. Defendant additionally argues that Plaintiff has not alleged that Epoch knew Facebook “might combine a Facebook user’s identity (contained in the c_user cookie) with the watch page address [i.e., the URL] to yield ‘personally identifiable information’ under the VPPA.” Mem. in Support, at 10 (citing Jn re Hulu Privacy Litig., 86 F. Supp 3d 1090, 1095 (N.D. Cal. 2015). However, as discussed supra, Plaintiff has plausibly alleged that the FID itself

constituted PII. Knowledge of what Facebook might do with the disclosed information to yield PII is therefore unnecessary. Accordingly, I find that Plaintiff has plausible alleged “knowing” disclosure. D. Applicability of VPPA to Content Consumed The VPPA defines a “video tape service provider” in relevant part as “any person, engaged in the business . . . of rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials.” 18 U.S.C. § 2710(a)(4). Defendant argues that Plaintiff has not plausibly alleged that the VPPA applies to Epoch Times because the Complaint does not allege whether the videos Plaintiff watched were prerecorded. Indeed, at least two courts have held that live broadcasts do not fall under the VPPA’s definition of regulated content. See Louth v. NFL Enterprises LLC No. 1:21-cv-00405-MSM-PAS, 2022 WL 4130866, at *4 (D.R.L Sept. 12, 2022) (holding that, because “‘prerecorded’ modifies both ‘video cassette tapes’ and ‘similar audio visual materials[,]’” the VPPA does not apply to live broadcasts); Order Regarding Motion to Dismiss at 10-11, Stark v. Patreon, Inc., No. 3:22-cv-03131 (N.D. Cal. Oct. 13, 2022), ECF No. 40 (same). Here, the Complaint alleges that Defendant is “engaged in the business .. . of rental, sale, or delivery of prerecorded video cassette tapes or similar audiovisual materials,” including “news programs, television shows, documentaries, movies, and other audiovisual content.” Compl. § 2. “[D]rawing all reasonable inferences in the plaintiff's favor,” it is reasonable to infer that Plaintiff consumed prerecorded content of the variety specifically identified in the Complaint. See In re Gen. Elec. Sec. Litig., 844 F. App'x 385, 387 (2d Cir. 2021). Moreover, Defendant does not even allege that it offers live broadcast content on its site.

Accordingly, I find that Plaintiff has plausibly alleged that the VPPA applies to the video content he consumed. CONCLUSION For the reasons discussed, the motion to dismiss is denied. The Initial Case Management Conference shall be held December 16, 2022, 10:00 am. The Clerk of the Court shall terminate Motion to Dismiss (ECF No. 17).

SO ORDERED. Dated: November 17, 2022 GL. OWA New York, New York ALVIN K. HELLERSTEIN United States District Judge