Louth v. NFL Enterprises LLC

• Court: District Court, D. Rhode Island
• Decided: September 12, 2022
• Docket: 1:21-cv-00405
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT FOR THE DISTRICT OF RHODE ISLAND

) DANIEL LOUTH, individually and on ) behalf of all others similarly situated, ) Plaintiff, ) ) v. ) C.A. No. 1:21-cv-00405-MSM-PAS ) NFL ENTERPRISES LLC., ) Defendant. ) )

MEMORANDUM AND ORDER Mary S. McElroy, United States District Judge. This is a putative class action arising under the Video Privacy Protection Act (“VPPA”), 18 U.S.C. § 2710, and Rhode Island’s Video Rental Privacy Act (“RIVRPA”), R.I.G.L. § 11-18-32. The VPPA prohibits video service providers from knowingly disclosing the “personally identifiable information” of its consumers to any person, with limited exceptions. 18 U.S.C. § 2710(b). Similarly, the RIVRPA prohibits anyone from “reveal[ing], transmit[ing], publish[ing], or disseminate[ing] in any manner, any records which would identify the names and addresses of individuals, with the titles or nature of video films, records, cassettes, or the like, which they purchased, leased, rented, or borrowed. . .” R.I.G.L. § 11-18-32. The defendant, NFL Enterprises LLC, now moves to dismiss the plaintiff’s complaint pursuant to Fed. R. Civ. P. 12(b)(6). For the reasons that follow, the Court GRANTS IN PART and DENIES IN PART the defendant’s Motion. (ECF No. 17.) I. BACKGROUND As alleged in the plaintiff’s First Amended Complaint, NFL Enterprises LLC owns and operates a mobile application (“NFL App”) which disseminates “live local

and primetime games, exciting videos and highlights, and replays of every game.” (ECF No. 14 ¶ 2.) Consumers can download the NFL App through the Google Play Store on Android devices or the Apple App Store on iOS devices. ¶ 13. Once downloaded, the NFL App requests permission from the user to access their location through the mobile device’s GPS. At no point does NFL Enterprises receive permission from users to share their location information, personally identifiable

information, or video viewing information with third parties. ¶ 14. The plaintiff’s counsel retained a private research company to conduct a dynamic analysis of the NFL App. ¶ 16. The researchers’ analysis revealed that NFL Enterprises transmits information sufficient to identify class members and the videos they watch to an unrelated third party. Further, the analysis established that the defendant incorporates multiple “application programming interfaces” (“APIs”) into the NFL App. ¶ 17. APIs “enable[] companies to open up their

applications’ data and functionality to external third-party developers, business partners, and internal departments within their companies.” ¶ 18. NFL Enterprises integrates the Anvato API, which is owned by Google, into the NFL App. ¶ 20. When a user enables location services, NFL Enterprises transmits to Google, through the Anvato API, a user’s geolocation, a user’s advertising ID, and a unique video identifier of the video(s) the user viewed. ¶ 21. The purpose of these disclosures, the plaintiff alleges upon description and analysis of the Anvato platform, is for NFL Enterprises to maximize its advertising revenue. ¶ 59.

The plaintiff, Daniel Louth, used the NFL App from 2018 to 2021 in Rhode Island. ¶¶ 78-79. He never consented, agreed, or otherwise permitted the defendant to disclose his geolocation, advertising ID, and watch history to third parties. ¶ 80. He alleges, on behalf of himself and a putative class, that in violation of the VPPA and RIVRPA, NFL Enterprises, without consent, “knowingly and intentionally discloses its users’ personally identifiable information—including a

record of every video viewed by the user—to unrelated third parties.” ¶¶ 3, 82. II. MOTION TO DISMISS STANDARD On a motion to dismiss, the Court “must assume the truth of all well-plead[ed] facts and give plaintiff the benefit of all reasonable inferences therefrom.” , 496 F.3d 1, 5 (1st Cir. 2007). To survive a motion to dismiss, the complaint must state a claim plausible on its face. , 550 U.S. 544, 570 (2007). The Court assesses the sufficiency of the

plaintiff’s factual allegations in a two-step process. , 640 F.3d 1, 7, 11-13 (1st Cir. 2011). “Step one: isolate and ignore statements in the complaint that simply offer legal labels and conclusions or merely rehash cause-of-action elements.” , 699 F.3d 50, 55 (1st Cir. 2012). “Step two: take the complaint’s well-pled ( non-conclusory, non-speculative) facts as true, drawing all reasonable inferences in the pleader’s favor, and see if they plausibly narrate a claim for relief.” “The relevant question … in assessing plausibility is not whether the complaint makes any particular factual allegations but, rather, whether ‘the complaint warrant[s] dismissal because it failed

to render plaintiffs’ entitlement to relief plausible.” , 711 F.3d 49, 55 (1st Cir. 2013) (quoting , 550 U.S. 544, 569 n.14 (2007)). III. DISCUSSION A. The Video Privacy Protection Act, 18 U.S.C. § 2710 To state a claim under the VPPA, the plaintiff must establish that NFL

Enterprises acted as a video tape service provider that knowingly disclosed personally identifiable information to a third party in a manner that falls outside of one of the VPPA’s express statutory exceptions. 18 U.S.C. § 2710. 1. Disclosure of “Personally Identifiable Information” The VPPA covers the disclosure of personally identifiable information (“PII”), defined in the statute to “includ[e] information which identifies a person as having requested or obtained specific video materials or services from a video tape service

provider[.]” 18 U.S.C. § 2710(a)(3). The First Circuit has held that the statutory language, though “awkward and unclear,” “reasonably conveys the point that PII is not limited to information that explicitly names a person” and that it sets forth “a minimum, but not exclusive, definition of [PII].” , 820 F.3d 482, 486 (1st Cir. 2016). Disclosure of data is actionable where it is “reasonably and foreseeably likely to reveal which … videos” a consumer has watched. Nevertheless, “there is certainly a point at which the linkage of information to identity becomes too uncertain, or too dependent on too much yet-to- be done, or unforeseeable detective work,” to plausibly set forth a VPPA claim.

The initial question is whether the plaintiff’s allegations support a claim that NFL Enterprises disclosed PII and the specific videos that he obtained. What is required at this stage is whether the plaintiff has alleged sufficient facts that the defendant’s disclosure of data to a third-party (here, Google), reasonably and foreseeably can identify consumers and which videos they watched. The plaintiff alleges that NFL Enterprises discloses to Google via the Anvato

API a user’s PII through geolocation, a user’s unique advertising ID (“AAID”), and the unique video identifier of the videos viewed by the user. (ECF No. 14 ¶¶ 20, 67, 72-73.) As to a consumer’s geolocation, NFL Enterprises collects and transmits to Google this data at the time the consumer views videos. ¶¶ 30-37. The NFL App discloses a user’s geolocation “with more than three decimal places of accuracy (i.e., within less than forty feet of the user).” ¶ 22. “In other words, this type of

geolocation can be considered precise, as it provides street level accuracy.” The geolocation data disclosed, therefore, is “reasonably and foreseeably likely” to identify a user who watched videos on the NFL App. , 820 F.3d at 486 (“Given how easy it is to locate a GPS coordinate on a map, this disclosure would enable most people to identify what are likely the home and work addresses of the viewer.”). Secondly, the plaintiff makes allegations concerning NFL Enterprises’ disclosure of AAID to Google. (ECF No. 14 ¶ 38.) An AAID is a “unique string of numbers that attaches to a device (such as a mobile phone).” ¶ 39. “An AAID is

sent to advertisers and other third parties so they can track user activity across multiple applications.” The data collected can allow companies to create inferences about the user’s identity. ¶¶ 41-42. While AAID are “resettable” by users, the plaintiff plausibly alleges that “AAID is a persistent identifier because virtually no one knows about AAIDs and, correspondingly, virtually no one resets their AAID.” ¶ 40. The plaintiff sufficiently alleges that AAID is PII because it is

“unique both to a specific device and user” and allows Google “to identify and track specific users across multiple electronic devices, applications, and services that a consumer may use.” , 820 F.3d at 484, 484 n.1. The plaintiff further buttresses his assertion that geolocation and AAID are PII with the argument that the combination of the two allows Google to identify specific users each time they watch a video because NFL Enterprises transmits both data groups allowing Google to “create synergetic inferences about user activity.”

¶¶ 47-48. In addition, the plaintiff alleges that when NFL Enterprises transmits a user’s geolocation and AAID, it also transmits a user’s video ID which identifies the video that is being watched. ¶ 49. This “MCP ID” is a “short string of numbers that links to a particular video name.” ¶ 24. Anvato’s platform confirms that it matches the MCP ID to the video title and content. ¶ 55. Thus, Google (via Anvato) can identify which users watch which videos using an MCP ID. Assuming the truth of these alleged facts, the disclosure of precise geolocation

data, AAID, and video MCP IDs constitutes PII because it is “reasonably and foreseeably likely to reveal which [NFL] videos [the plaintiff] has obtained.” , 820 F.3d at 486. 2. “Knowing” Disclosure of “Personally Identifiable Information” The VPPA prohibits only “knowing” disclosures of PII. 18 U.S.C. § 2710(b)(1). A video tape service provider violates the VPPA when it “actually knew that it was

disclosing: 1) a user’s identity; 2) the identity of the video material; and 3) the connection between the two— , that the given user had ‘requested or obtained’ the given video material.” , 86 F. Supp. 3d 1090, 1095 (N.D. Cal. 2015). NFL Enterprises argues that while the plaintiff alleges facts regarding the analytics and ad targeting services that Google’s Anvato offers—which would require the PII disclosure—it does not set forth facts from which the Court could reasonably

infer that NFL Enterprises actually used such services. But the Amended Complaint sets forth that Google markets Anvato as providing “100% workflow automation” with nine distinct services in one product, including “monetization” and “analytics” for mobile applications. (ECF No. 14 ¶¶ 26- 27.) Specifically, the Anvato platform offers “a fully managed, end-to-end video processing and management platform for signal acquisition, live and video-on- demand editing, hybrid encoding, social and premium syndication, dynamic ad insertion, authenticated playback, video analytics and player SDKs across all connected devices.” ¶ 29. “[D]ynamic ad insertion” and “video analytics” rely upon

a user’s geolocation and AAID. As alleged, the Avanto dashboard transparently shows what information Google is collecting, analyzing, and aggregating. ¶ 75. This includes what users are watching and where they are watching. By using these dashboards, the plaintiff asserts, NFL Enterprises knows that it is disclosing a user’s geolocation, AAID, and watch history to Google.

Given the facts alleged, it can reasonably be inferred that NFL Enterprises knowingly transmits PII for the purpose of targeted advertising. Furthermore, it cannot be said that upon discovery such a linkage is “too dependent on too much yet- to-be done, or unforeseeable detective work.” , 820 F.3d at 486. 3. The “Ordinary Course of Business” Exception The VPPA provides that a video tape service provider’s knowing disclosure of PII is permitted if “incident to the ordinary course of business.” 18 U.S.C. §

2710(b)(2)(E). The statute defines the “ordinary course of business” as “only debt collection activities, order fulfillment, request processing, and the transfer of ownership.” § 2710(a)(2). Viewing the alleged facts in the light most favorable to the plaintiff, as the Court must upon a motion to dismiss, NFL Enterprises discloses PII to Google to measure analytics and increase advertising revenue. Such purposes do not fall into the narrow categories statutorily defined as the “ordinary course of business.” ; , 2012 WL 3282960, at *7 (N.D. Cal. Aug. 10, 2012) (holding that the purposes of “[m]arket research and web analytics,” were “not in the

ordinary course of [the defendant’s] business of delivering video content to consumers”). It may be determined upon discovery that NFL Enterprises uses Anvato only for “end-to-end video processing and management” functions, but, at this early pleading stage, the plaintiff sets forth a plausible case that it uses those services in violation of the VPPA.

4. “Video Tape Service Provider” The plaintiff’s claim is premised upon the disclosure of PII when watching live game content and video clips, the latter including prerecorded game highlights and other videos. (ECF No. 14 ¶¶ 2, 79.) NFL Enterprises argues that, under the plain language of the VPPA, it cannot be a “video tape service provider” with respect to “live” game content. A “video tape service provider” is “any person, engaged in the business, in or affecting interstate or foreign commerce, of rental, sale, or delivery of

video cassette tapes or similar audio visual materials ….” 18 U.S.C. § 2170(a)(4) (emphasis added). The plaintiff asserts that live content should be included as a “similar audio visual materia[l]” but the Court finds this interpretation goes too far. The adjective “prerecorded” modifies both “video cassette tapes” “similar audio visual materials.” This is confirmed in a Sente Report recommending passage of the VPPA, specifically identifying “laser discs, open-reel movies, and CDI technologies,” as the types of technologies that provide “similar audio visual materials,” beyond video cassette tapes. S. Rep. No. 100-599, at 5 (1988), q988 U.S.C.C.A.N.

4342. This Report “suggests Congress’ intent to cover new technologies for pre- recorded video content.” , 2012 WL 328960, at * 6. As such, NFL Enterprises’ Motion to Dismiss the plaintiff’s VPPA claims is granted to the extent they rely upon the consumption of live content but denied as to pre-recorded content. B. The Rhode Island Video Protection Act, R.I.G.L. §11-18-32

The plaintiff also brings a claim under the Rhode Island Video Protection Act, R.I.G.L. §11-18-32 (“RIVPRA”), which provides in relevant part that. It shall be unlawful for any person with the titles or nature of video films, records, cassettes, or the like, which they purchased, leased, rented, or borrowed, from libraries, book stores, video stores, or record and cassette shops or any retailer or distributor of those products, whether or not the identities and listings are kept in a remote computing service or electronic storage or the disclosure is made through or by a remote computing service… (emphasis added).

Unlike the VPPA, under which “PII is not limited to information that explicitly names a person” and sets forth “a minimum, but not exclusive, definition of [PII],” , 820 F.3d at 486, the RIVPRA specifically prohibits disclosure of “names and addresses.” R.I.G.L. §11-18-32(a). Here, the plaintiff does not allege that NFL Enterprises specifically disclosed his name and address and therefore his RIVPRA claims are dismissed. IV. CONCLUSION For the foregoing reasons, NFL Enterprises’ Motion to Dismiss (ECF No. 17) is GRANTED on the plaintiff’s RIVPRA claim in its entirety (Count II) and any aspect

of the VPPA claim (Count I) that is premised upon the consumption of live content. The Motion is DENIED as to the plaintiff’s VPPA claim concerning pre-recorded content.

IT IS SO ORDERED.

_________________________________ Mary S. McElroy United States District Judge

September 12, 2022