Dye v. Meta Platforms, Inc.

• Court: District Court, E.D. North Carolina
• Decided: May 10, 2024
• Docket: 5:23-cv-00509
• Status: Unknown

Opinion

IN THE UNITED STATES DISTRICT COURT FOR THE EASTERN DISTRICT OF NORTH CAROLINA WESTERN DIVISION No. 5:23-CV-509-BO-BM

DAWN DYE, on behalf of herself and all) others similarly situated, ) Plaintiff, ¥ ) ORDER META PLATFORMS, INC., Defendant.

This cause comes before the Court on defendant's motion to dismiss plaintiff's complaint. Plaintiff has responded, defendant has replied, and a hearing on the matter was held before the undersigned on March 21, 2024, at Raleigh, North Carolina. In this posture, the motion is ripe for ruling. For the reasons that follow, the motion to dismiss is granted. BACKGROUND Plaintiff initiated this action by filing a complaint on behalf of herself and all others . similarly situated on September 15, 2023. [DE 1]. Plaintiff alleges that defendant has violated the Drivers’ Privacy Protection Act (DPPA), 18 U.S.C. §§ 2721, ef seq. by surreptitiously tracking the activities of North Carolinians who use the North Carolina Department of Motor Vehicles (DMV) online payment portal (myNCDMV) to obtain disability placard renewals, new car registrations, identification card renewals, and engage in other activities. Plaintiff alleges that when users visit Facebook.com, defendant installs a tracking code, the Meta Tracking Pixel (Pixel), onto their browsers which tracks many of the websites that they visit, including myNCDMV. Plaintiff specifically alleges that the Pixel “is a piece of code that advertisers can integrate intotheir website.

Once activated, the [] Pixel tracks the people and type of actions they take. When the {] Pixel captures an action, it sends a record to Facebook. Once this record is received, Meta processes it, analyzes it, and assimilates it into datasets .. ..” Compl. { 17. The DMV hosts the Pixel to allow defendant to track what visitors to the my NCDMV site do. This tracking permits defendant to deliver targeted advertisements to its users. Plaintiff alleges that the myNCDMV website transmits three events to defendant via the Pixel: “Page View,” “Microdata,” and “Button Click.” Compl. § 20. Plaintiff's complaint alleges these events are present on nearly all of the myNCDMV webpages and “covey a trove of information about a driver’s personal business with the DMV” including “highly restricted personal information”. Compl. 9§ 25-36. Plaintiff alleges that when a web user is navigating the myNCDMV website while logged into Facebook, “the myNCDMV website compels a visitor’s browser to transmit an identifying ‘computer cookie’ to Meta, called ‘c_user,” for every single event sent through the [] Pixel.” Compl. § 27. Plaintiff alleges that the c_user cookie constitutes personally identifiable information because it contains the web user’s unencrypted Facebook ID, which anyone may use to identify a particular Facebook user through their Facebook page. Compl. § 28. Plaintiff also brings allegations regarding the Pixel’s fr cookie, which contains an encrypted Facebook ID and browser identifier, and the usida cookie which defendant uses to target advertisements. Compl. J 30-35. Plaintiff alleges that “[b]y compelling a visitor's browser to disclose the c_user and fr cookies alongside event data, the myNCDMV website knowingly discloses personal information and highly restricted personal information to Meta. By partnering with the myNCDMV website to host the [] Pixel, Meta also knowingly obtains this same personal information and highly restricted personal information.” Compl. § 38. Plaintiff further alleges that

defendant is collecting a drivers’ Facebook ID from the myNCDMV website by collecting c_user and fr cookies as first-party cookies. Compl. § 39. Plaintiff's specific experience is described in the complaint as follows. Plaintiff used the myNCDMV website to conduct private business with the DMV in August 2023. When doing so, plaintiff accessed the myNCDMV website using the same browser she uses to access her Facebook account. Plaintiff alleges that when she was navigating through the myNCDMV website, defendant obtained and used her personal information to help in its advertising efforts. Compl. □□□ 43-47, Defendant has moved to dismiss plaintiff's complaint for failure to state a claim upon which relief can be granted. Fed. R. Civ. P. 12(b)(6). Defendant argues that plaintiff has failed to allege that defendant received any information from a motor vehicle record; that she failed to allege that defendant obtained any data for an improper purpose; and that she has failed to allege that defendant knowingly obtained or used protected information for an improper purpose. DISCUSSION A Rule 12(b)(6) motion tests the legal sufficiency of the complaint. Papasan v. Allain, 478 U.S. 265, 283 (1986). A complaint must allege enough facts to state a claim for relief that is facially plausible. Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 570 (2007). In other words, the facts alleged must allow a court, drawing on judicial experience and common sense, to infer more than the mere possibility of misconduct. Nemet Chevrolet, Ltd. v. Consumeraffairs.com, Inc., 591 F.3d 250, 256 (4th Cir. 2009). The court “need not accept the plaintiffs legal conclusions drawn from the facts, nor need it accept as true unwarranted inferences, unreasonable conclusions, or arguments.” Philips v. Pitt County Mem. Hosp., 572 F.3d 176, 180 (4th Cir. 2009) (internal alteration and citation omitted).

A. The DPPA To obtain a driver’s license or register a vehicle, state DMVs, as a general rule, require an individual to disclose detailed personal information, including name, home address, telephone number, Social Security number, and medical information. See Reno v. Condon, 528 U.S. 141, 143, 120 S.Ct. 666, 145 L.Ed.2d 587 (2000). The enactment of the DPPA responded to at least two concerns over the personal information contained in state motor vehicle records. The first was a growing threat from stalkers and criminals who could acquire personal information from state DMVs. The second concern related to the States’ common practice of selling personal information to businesses engaged in direct marketing and solicitation. To address these concerns, the DPPA “establishes a regulatory scheme that restricts the States’ ability to disclose a driver’s personal information without the driver’s consent.” /d., at 144, 120 S.Ct. 666. Maracich v. Spears, 570 U.S. 48, 57 (2013). To that end, the DPPA provides that “A person who knowingly obtains, discloses or uses personal information, from a motor vehicle record, for a purpose not permitted under this chapter shall be liable to the individual to whom the information pertains, who may bring a civil action in a United States district court.” 18 U.S.C. § 2724(a). Thus, to state a claim for violation of the DPPA, a plaintiff must ultimately prove that the defendant (1) “knowingly obtained his personal information (2) from a motor vehicle record (3) for a nonpermissible use.” Andrews v. Sirius XM Radio Inc., 932 F.3d 1253, 1259 (9th Cir. 2019). B. Plaintiff's complaint Plaintiff alleges that Facebook ID numbers are personal information under the DPPA and that webpages on the myNCDMV online payment portal are a type of motor vehicle record under the DPPA. Plaintiff alleges that, in violation of the DPPA, defendant obtained highly restricted personal information from a motor vehicle record and that it knowingly used this personal information to deliver targeted advertisements, without the express consent of plaintiff or the putative class members having been granted to either defendant or the DMV. Compl. 4 57-63.

Personal information is defined by the DPPA as “information that identifies an individual, including an individual’s photograph, social security number, driver identification number, name, address (but not the 5-digit zip code), telephone number, and medical or disability information . . .” 18 U.S.C. § 2725(3). The Court assumes, without deciding, that plaintiff has plausibly alleged that a Facebook ID is personal information under the DPPA. See Keogh v. Meta Platforms, Inc., 680 F. Supp. 3d 601, 609 (D.S.C. 2023). Plaintiff has failed, however, to plausibly allege that the cookies defendant allegedly received containing her Facebook ID were obtained from a motor vehicle record. A “motor vehicle record” is defined by the DPPA as “any record that pertains to a motor vehicle operator’s permit, motor vehicle title, motor vehicle registration, or identification card issued by a department of motor vehicles”. 18 U.S.C. § 2725(1). The term “record” is defined by the Privacy Act of 1974, which the DPPA is intended to reflect, as “information about an individual that is maintained by an agency.” 5 U.S.C. § 552a(a)(4); Andrews, 932 F.3d at 1260. The myNCDMV website is a public-facing website accessible by anyone using the internet. A user of the myNCDMV website can access information about vehicle registration renewal, license and ID cards, and disability placard renewal, as well as paying administrative hearing fees and submitting a voter registration application. See www.payments.ncdot.gov (last visited May 6, 2024). The complaint fails to allege any information about an individual that is maintained on the myNCDMV website by the DMV such that the website itself could be considered a “record” for purposes of the DPPA. Nor is the myNCDIMV website a “motor vehicle record.” A court recently considering a substantially similar case brought against defendant arising from a user’s interaction with the South Carolina Department of Motor Vehicles (SCDMV) website concluded that “even if the SCDMV

website was a ‘record,’ it is not a ‘motor vehicle’ record under the statutory definition, which is limited to records pertaining to ‘a motor vehicle operator’s permit, motor vehicle title, motor vehicle registration, or identification card.” Keogh, 680 F. Supp. 3d at 610 (quoting 18 U.S.C. § 2725(1)). There, as here, plaintiffs argued that almost every webpage on SCDMV has a “connection with driving.” /d.; [DE 17 p. 5]. But the South Carolina court rejected that argument, noting both that the SCDMV website had information unrelated to driving and that, in any event, the argument did not help the plaintiff because whether a record or information is “connected” to driving does not satisfy the DPPA’s definition of a “motor vehicle record” — the statute narrowly defines a motor vehicle record as only records which pertain to the “four specific types of records” identified. Keogh, 680 F. Supp. 3d at 610. The same is true for plaintiff here. The my NCDMV website contains information related to voting registration, which plainly does not pertain to a “motor vehicle operator’s permit, motor vehicle title, motor vehicle registration, or identification card.” 18 U.S.C. § 2725(1). And, as defendant has argued, it would stretch the DPPA too far for there to be a violation of the statute anytime a Facebook user accesses myNCDMV to register to vote. Moreover, “disclosure of the fact that a person simply visited a website page where motor vehicle records might or might not be accessed does not violate the DPPA [because] the DPPA does not create a right to privacy with respect to every interaction that a citizen may have with the DMV website.” Keogh, 680 F. Supp. 3d at 610. Additionally, even assuming that the myNCDMV website uses the information it collects to create other records about motor vehicle registrations or disability placards, that does not cause the myNCDMV website itse/fto be a motor vehicle record as that term is defined by the DPPA.

Finally, even if it is determined that the myNCDMV website is a motor vehicle record, plaintiff has not plausibly alleged that the information defendant obtained comes from a motor vehicle record. The complaint alleges that the c_user and fr cookies at issue are placed on plaintiff's and other users’ web browsers. Compl. JJ 27; 38, 45, 59. Specifically, plaintiff alleges that “the myNCDMV website compels a visitor’s browser to transmit an identifying “computer cookie’ to Meta [which] contains that visitor’s unencrypted Facebook ID.” Compl. § 27. In other words, the information contained in the cookie comes, not from the myNCDMV website or any DMV database, but from the webpage visitor’s browser. But the “DPPA imposes civil liability only on a defendant who obtains personal information from a motor vehicle record, but not on a defendant who merely obtains personal information that can be linked back to (i.e., derived from) such a record.” Garey v. James S. Farrin, P.C., 35 F.4th 917, 927 (4th Cir. 2022). Plaintiff has not plausibly alleged that the personal information transmitted via cookie from her own web browser is information from a motor vehicle record. See also Andrews, 932 F.3d at 1260 (“where, as here, the initial source of personal information is a record in the possession of an individual, rather than a state DMV, then use or disclosure of that information does not violate the DPPA.”). In opposition to the motion to dismiss, plaintiff relies heavily on the holding in Gershzon v. Meta Platforms, Inc., No. 23-CV-00083-SI, 2023 WL 5420234 (N.D. Cal. Aug. 22, 2023). There, however, unlike here, plaintiff alleged that he had opened an online DMV account and that in doing so provided his full name, email address, and telephone number. Jd. at *3. He further specifically alleged that he visited the website twice per year, at least in part to apply fora disability placard.. Addi:ional ly, “Gershizon alleges that Metz obtained his personal informatior from the DMV website and that the DMV maintained this information after Gershzon provided it to the DMV through his “MyDMV” online account.” Gershzon, 2023 WL 5420234, at *8. Plaintiff

makes no similar allegations in her complaint. She alleges only that in August 2023 she visited the myNCDMV website to conduct private business, that she also has a Facebook account, and that defendant obtained and used her personal information. Compl. § 43-46. Gershzon is therefore factually distinguishable, and plaintiff's allegations are insufficient to state a claim. In sum, plaintiff has failed to plausibly allege that defendant knowingly obtained any personal information from a motor vehicle record. This Court is persuaded by the holding in Keogh, which is premised on similar facts, and determines that plaintiff's complaint is appropriately dismissed. ! CONCLUSION Accordingly, for the foregoing reasons, defendant’s motion to dismiss [DE is GRANTED. Plaintiff's complaint is hereby DISMISSED. The clerk is DIRECTED to close this case.

SO ORDERED, this SO bay of May 2024.

Uy. UNITED STATES DISTRICT JUDGE

' Because the Court determines that plaintiff has failed to allege the existence of a motor vehicle record, the Court need not address defendant’s remaining arguments.