Jancik v. WebMD LLC

• Court: District Court, N.D. Georgia
• Decided: November 4, 2022
• Docket: 1:22-cv-00644
• Status: Unknown

Opinion

IN THE UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF GEORGIA ATLANTA DIVISION

DEBRA LEBAKKEN,

,

Plaintiff,

v. CIVIL ACTION FILE NO. 1:22-CV-644-TWT WEBMD, LLC,

Defendant.

OPINION AND ORDER This is a putative class action case brought under the Video Privacy Protection Act (“VPPA”). It is before the Court on the Defendant WebMD, LLC’s (“WebMD”) Motion to Dismiss [Doc. 29]. For the reasons set forth below, WebMD’s Motion to Dismiss is DENIED. I. Background1 This case arises under the VPPA from allegations that WebMD improperly disclosed personally identifiable information (“PII”) of the Plaintiff Debra Lebakken, and others similarly situated, to Facebook through an online tool called the Facebook Tracking Pixel. (First Am. Compl. ¶¶ 3, 20, 85.) WebMD owns and operates the popular website, WebMD.com, which provides

1 The Court accepts the facts as alleged in the First Amended Complaint as true for purposes of the present Motion to Dismiss. , 941 F.3d 1116, 1122 (11th Cir. 2019). online health information and medical news to individuals and generates revenue through advertising on its website. ( ¶¶ 2, 10.) WebMD delivers some of that health and medical information to individuals through videos, and

it allegedly refines content for specific viewers based on prior videos they have watched on the website. ( ¶¶ 13–14.) Such content refining is made possible through data aggregators like Facebook, which harvest activity data of online users to create custom audiences and other similar tools for targeted advertising. ( ¶¶ 15, 18–19.) On its website, WebMD hosts one of Facebook’s data aggregation tools, the Facebook Tracking Pixel, to analyze the online

activity of WebMD users. ( ¶¶ 20–24.) Lebakken alleges in detail how WebMD’s Facebook Tracking Pixel records user activity, transmits that data to Facebook, and employs the aggregated data to improve the targeting of its online content to WebMD users. ( ¶¶ 24–57.) Lebakken created a Facebook account in 2007 and a WebMD account in 2017, the latter requiring her to submit her email address and birthday to create the account. ( ¶¶ 62–63.) She also provided her email address to

WebMD to receive an e-newsletter, which frequently contained video content. ( ¶¶ 56, 62.) Lebakken alleges that when she watched videos on WebMD.com, WebMD disclosed her Facebook ID, her email address, and the video detail, along with other information, to Facebook. ( ¶¶ 65–66.) On February 15, 2022, Lebakken brought the present action, on behalf of herself and the putative class, seeking damages for the alleged violations of the VPPA. 2 ( ¶ 87.) WebMD now moves to dismiss the claims in Lebakken’s First Amended Complaint pursuant to Federal Rule of Civil Procedure 12(b)(6) for failure to state a claim. (Br. in Supp. of Def.’s Mot. to Dismiss, at 4.)

II. Legal Standard A complaint should be dismissed under Rule 12(b)(6) only where it appears that the facts alleged fail to state a “plausible” claim for relief. , 556 U.S. 662, 678 (2009); Fed. R. Civ. P. 12(b)(6). A complaint may survive a motion to dismiss for failure to state a claim, however, even if it is “improbable” that a plaintiff would be able to prove those facts; even if the

possibility of recovery is extremely “remote and unlikely.” , 550 U.S. 544, 556 (2007). In ruling on a motion to dismiss, the court must accept the facts pleaded in the complaint as true and construe them in the light most favorable to the plaintiff. , 711 F.2d 989, 994-95 (11th Cir. 1983); , 40 F.3d 247, 251 (7th Cir. 1994) (noting that at the pleading stage, the plaintiff

“receives the benefit of imagination”). Generally, notice pleading is all that is required for a valid complaint. , 753 F.2d 974, 975 (11th Cir. 1985). Under notice pleading, the plaintiff need only give the defendant fair notice of the plaintiff’s claim and the grounds upon which it rests. , 551 U.S. 89, 93 (2007) (citing , 550 U.S. at 555). 3 III. Discussion WebMD moves to dismiss the First Amended Complaint, arguing that Lebakken has failed to state a claim under the VPPA for several reasons. (Br.

in Supp. of Def.’s Mot. to Dismiss, at 5.) Under the VPPA, “[a] video tape service provider who knowingly discloses, to any person, personally identifiable information concerning any consumer of such provider shall be liable to the aggrieved person for the relief” specified in the statute. 18 U.S.C. § 2710(b)(1). In support of its motion to dismiss, WebMD first argues that Lebakken is not a consumer of any video service, then argues that any disclosure of Lebakken’s

information did not constitute PII, and finally argues that WebMD did not disclose any PII knowingly. (Br. in Supp. of Def.’s Mot. to Dismiss, at 5–6.) The Court addresses each of these arguments and Lebakken’s responses in turn. A. Consumer Under the VPPA WebMD first argues that Lebakken cannot state a claim under the VPPA because she failed to adequately allege that she is a consumer of any video service. ( at 10.) Lebakken responds that WebMD’s e-newsletter

constitutes a good or service under the VPPA and that Lebakken was a subscriber of that e-newsletter. (Pl.’s Resp. Br. in Opp’n to Def.’s Mot. to Dismiss, at 3.) Under the VPPA, a “consumer” is “any renter, purchaser, or subscriber of goods or services from a video tape service provider,” and a “video tape service provider” is “any person, engaged in the business . . . of rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual 4 materials.” 18 U.S.C. § 2710(a)(1), (a)(4). The parties dispute (1) whether Lebakken sufficiently alleged she was a subscriber of WebMD’s e-newsletter and (2) whether that e-newsletter constitutes a good or service under the

VPPA. (Br. in Supp. of Def.’s Mot. to Dismiss, at 10–16; Pl.’s Resp. Br. in Opp’n to Def.’s Mot. to Dismiss, at 3–13.) 1. Was Lebakken a Subscriber under the VPPA? The Eleventh Circuit Court of Appeals has established a multi-factor test in determining whether an individual is a “subscriber” under the VPPA. , 803 F.3d 1251, 1255–58 (11th Cir. 2015)

(“Subscriptions involve some or [most] of the following [factors]: payment, registration, commitment, delivery, [expressed association,] and/or access to restricted content.” (alterations in original) (citation omitted)). Generally, subscribing “involves some type of commitment, relationship, or association (financial or otherwise) between a person and an entity” but does not necessarily require payment. at 1256. Indeed, “there are numerous periodicals, newsletters, blogs, videos, and other services that a user can sign

up for (i.e., subscribe to) and receive for free.” Merely downloading a free smartphone application and watching videos at no cost does not constitute subscription. at 1258 (“[T]he free downloading of a mobile app on an Android device to watch free content, without more, does not a ‘subscriber’ make.”); , 854 F.3d 1336, 1344 (11th Cir. 2017) (finding “the ephemeral investment and commitment associated with 5 [the plaintiff]’s downloading of the CNN App on his mobile device, even with the fact that he ha[d] a separate cable television subscription that include[d] CNN content, [was] simply not enough to consider him a ‘subscriber’”).

Here, unlike in and , Lebakken alleges more than just the free downloading of a mobile application onto her smartphone; she alleges that she exchanged her email address to receive the WebMD e-newsletter and that she also created her own WebMD account. (Pl.’s Resp. Br. in Opp’n to Def.’s Mot. to Dismiss, at 12–13; First Am. Compl. ¶¶ 46, 62.) Because the Eleventh Circuit in expressly contemplated “newsletters . . . that a user can sign

up for (i.e., subscribe to) and receive for free,” the Court finds that Lebakken has adequately pleaded that she was a subscriber under the VPPA. , 803 F.3d at 1256. 2. Was WebMD’s E-Newsletter a Good or Service Under the VPPA? WebMD next argues that Lebakken was not a subscriber of any video service, as required to state a claim under the VPPA. (Br. in Supp. of Def.’s Mot. to Dismiss, at 12.) Lebakken argues, in response, that WebMD interprets

the phrase “goods or services” too narrowly when it argues that its e-newsletter did not constitute a video service under the VPPA. (Pl.’s Resp. Br. in Opp’n to Def.’s Mot. to Dismiss, at 3.) The Court agrees with Lebakken on this point. To constitute a “consumer” under the VPPA, the plaintiff must subscribe to “goods or services from a video tape service provider,” not a video service as WebMD attempts to frame the issue. Thus, the question here is whether WebMD’s 6 e-newsletter constitutes a good or service of a video tape service provider.2 The Court concludes that Lebakken has plausibly pleaded that WebMD’s e-newsletter constitutes a good or service under the VPPA.

Specifically, Lebakken alleges that the e-newsletter provides subscribers with doctor-approved health tips, which WebMD monetizes by selling advertising space alongside those tips to generate revenue. (Pl.’s Resp. Br. in Opp’n to Def.’s Mot. to Dismiss, at 5–6 (citing First Am. Compl. ¶¶ 14, 46).) Such allegations are sufficient to state a claim that the e-newsletter is a good or service, considering that the phrase “goods or services” is generally construed

broadly to encompass “all parts of the economic output of society.” ( at 5 (quoting D.C. Code Ann. § 28-3904(7)).)

2 WebMD provides the statutory definition of video tape service provider in both of its briefs but does not specifically argue in either brief that it is not a video tape service provider. (Br. in Supp. of Def.’s Mot. to Dismiss, at 9–10; Reply. Br. in Supp. of Def.’s Mot. to Dismiss, at 3.) Lebakken, in response, treats this omission as an admission that WebMD is a video tape service provider. (Pl.’s Resp. Br. in Opp’n to Def.’s Mot. to Dismiss, at 3.) WebMD’s arguments regarding legislative history, however, suggest that it believes it is not a video tape service provider, as contemplated by the VPPA. ( Br. in Supp. of Def.’s Mot. to Dismiss, at 15 (citing , 827 F.3d 262, 284 (3d Cir. 2016), and , No. 8:04CV99, 2004 WL 2359722, at *2 (D. Neb. Oct. 19, 2004)); Reply. Br. in Supp. of Def.’s Mot. to Dismiss, at 3.) The Court concludes that Lebakken has adequately alleged that WebMD is a video tape service provider because she alleges that WebMD is engaged in the business of delivering prerecorded audio-visual materials to consumers via its e-newsletter and its website. (First Am. Compl. ¶¶ 56, 82.) Such allegations are sufficient to survive WebMD’s Motion to Dismiss. ( Pl.’s Notice of Suppl. Authority, Doc. 36, at 9–10.) 7 WebMD relies on , 98 F. Supp. 3d 662, 669 (S.D.N.Y. 2015), in support of its position on this issue, arguing that a plaintiff cannot state a claim under the VPPA when he

“subscribes only to a portion of the provider’s services that are distinct and set apart from its provision of videos.” (Br. in Supp. of Def.’s Mot. to Dismiss, at 12 (quoting , 98 F. Supp. 3d at 671).) In response, Lebakken argues that WebMD’s reliance on is misplaced because the discussion it references is both irrelevant and dicta, considering that Lebakken alleges that WebMD’s e-newsletter “features videos that link back to [its]

website.” (Pl.’s Resp. Br. in Opp’n to Def.’s Mot. to Dismiss, at 9–10.) WebMD essentially argues that Lebakken providing her email address to WebMD to subscribe to the e-newsletter in 2017 is too attenuated from her viewing of any WebMD videos to state claim under the VPPA. (Br. in Supp. of Def.’s Mot. to Dismiss, at 14.) Specifically, WebMD argues that although the First Amended Complaint alleges that WebMD “frequently features its video content through its email newsletter,” Lebakken never actually alleges that

she ever accessed any of the videos featured in the e-newsletter. ( at 14–15 (quoting First Am. Compl. ¶ 56).) The question here, however, is not whether Lebakken alleges that she viewed the videos embedded within the e-newsletter but rather whether the e-newsletter constitutes a good or service to which

8 Lebakken subscribed.3 Having resolved the answer to the former question in the affirmative and construing the facts as alleged in the First Amended Complaint in the light most favorable to Lebakken, the Court concludes that

Lebakken states a claim as a consumer under the VPPA. B. Disclosure of PII WebMD next argues that Lebakken has failed to allege facts demonstrating that WebMD improperly disclosed her PII. (Pl.’s Resp. Br. in Opp’n to Def.’s Mot. to Dismiss, at 16.) The VPPA defines PII as including “information which identifies a person as having requested or obtained specific

video materials or services from a video tape service provider.” 18 U.S.C. § 2710(a)(3). Lebakken argues that her allegation of WebMD’s disclosure of her Facebook ID, email address, and the webpages she viewed are sufficient identifiers to constitute PII under the VPPA. (Pl.’s Resp. Br. in Opp’n to Def.’s Mot. to Dismiss, at 15 (citing , No. C 11-03764, 2014 WL 1724344, at *14 (N.D. Cal. Apr. 28, 2014), and First Am. Compl. ¶¶ 65–66).) In reply, WebMD argues that Lebakken fails to allege that any disclosure of her

Facebook ID or email address was connected to her video viewing information. (Reply. Br. in Supp. of Def.’s Mot. to Dismiss, at 6–7 (citing , 152 F. Supp. 3d 176, 179 (S.D.N.Y. 2015)).)

3 For example, the disclosure by a streaming service of a person’s movie rental history would be enough to state a claim for violation of the VPPA; the person need not have actually watched any of the movies for the act of disclosure to nonetheless constitute a violation of the statute. 9 The Third Circuit Court of Appeals thoroughly discussed the issue of determining what constitutes PII under the VPPA in , 827 F.3d at 281–90. Though it declined to create

a bright-line rule, the Third Circuit established generally that PII “means the kind of information that would readily permit an ordinary person to identify a specific individual’s video-watching behavior.” at 290. Citing a related First Circuit case, the court noted that “‘there is certainly a point at which the linkage of information to identity becomes too uncertain, or too dependent on too much yet-to-be-done, or unforeseeable detective work’ to trigger liability

under” the VPPA. at 289 (quoting , 820 F.3d 482, 486 (1st Cir. 2016) (holding that the defendant’s alleged disclosure of the GPS coordinates of the plaintiff’s phone at the time of viewing, in addition to the video information itself, supported a plausible claim under the VPPA)). Under its articulated standard, however, the Third Circuit determined that disclosing “an IP address, a device identifier, or a browser fingerprint” did not constitute PII for purposes of VPPA liability.

Here, the Court finds that Lebakken adequately alleged that WebMD disclosed her Facebook ID and email address in connection with her video viewing information to Facebook and that the disclosure of such information constituted a disclosure of PII, supporting a plausible claim under the VPPA. ( First Am. Compl. ¶¶ 65–66.) Whether Lebakken had recently logged into her Facebook account, such that transmission of her Facebook ID upon viewing 10 WebMD videos would be possible, is a question of fact appropriate for resolution at a later stage in this litigation. (Pl.’s Resp. Br. in Opp’n to Def.’s Mot. to Dismiss, at 17; Reply. Br. in Supp. of Def.’s Mot. to Dismiss, at 6–7.)

For now, the Court finds sufficient that Lebakken has alleged the disclosure itself. Accordingly, WebMD is not entitled to dismissal of the First Amended Complaint on this ground. C. Knowledge of Disclosure Finally, WebMD argues that Lebakken has failed to adequately plead that any disclosure of her PII by WebMD was made knowingly. (Br. in Supp.

of Def.’s Mot. to Dismiss, at 19.) In response, Lebakken contends that the First Amended Complaint unmistakably demonstrates that WebMD disclosed Lebakken’s PII knowingly. (Pl.’s Resp. Br. in Opp’n to Def.’s Mot. to Dismiss, at 20.) In support of its position on the issue, WebMD relies on , 86 F. Supp. 3d 1090 (N.D. Cal. 2015). (Br. in Supp. of Def.’s Mot. to Dismiss, at 19.) In , the plaintiffs claimed that Hulu violated the VPPA when

it disclosed their video viewing information to Facebook through the Facebook “Like” button that Hulu added to its videos. , 86 F. Supp. 3d at 1091. Providing the legal standard, the United States District Court for the Northern District of California reiterated that the knowing disclosure of PII under the VPPA requires the conscious transmission of private information. at 1095. Under that standard and the facts of the case, the court concluded that the 11 plaintiff’s VPPA claim could not survive summary judgment, reasoning that there was “no evidence that Hulu knew that Facebook might combine a Facebook user’s identity (contained in the c_user cookie) with the watch-page

address to yield [PII] under the VPPA.” at 1097. Consequently, there was “no proof that Hulu knowingly disclosed any user ‘as having requested or obtained specific video materials or services.’” (quoting 18 U.S.C. § 2710(a)(3)). WebMD contends that the court’s holding in applies to the present case because Lebakken has not alleged facts showing that WebMD

knew its consumers’ video viewing information and identify information would be combined and shared with Facebook. (Br. in Supp. of Def.’s Mot. to Dismiss, at 20.) Lebakken argues, in response, that the allegations of the First Amended Complaint support that WebMD knowingly transmitted Lebakken’s PII and video viewing information to Facebook and that is distinguishable because it was a summary judgment disposition involving the Facebook “Like” button, not a 12(b)(6) motion involving the Facebook Tracking Pixel. (Pl.’s

Resp. Br. in Opp’n to Def.’s Mot. to Dismiss, at 21.) The Court agrees with Lebakken that the present case is distinguishable from . Here, the Court is not faced with evaluating evidence that WebMD knew Facebook would combine the video viewing and identity information of its consumers; rather, the question is whether the allegations of the First Amended Complaint plausibly state a claim under the VPPA upon 12 which relief may be granted. The Court finds that Lebakken does plausibly allege WebMD’s conscious transmission of its consumers’ private information, and thus, WebMD is not entitled to dismissal of the First Amended Complaint on that ground. IV. Conclusion For the foregoing reasons, WebMD’s Motion to Dismiss [Doc. 29] is DENIED. SO ORDERED, this 4th day of November, 2022.

THOMAS W. THRASH, JR. United States District Judge