Nixon v. Pond5, Inc.

• Court: District Court, S.D. New York
• Decided: July 21, 2025
• Docket: 1:24-cv-05823
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK MATTHEW NIXON and PETER FLEMING, on behalf of themselves and all others similarly situated, Plaintiffs, Case No. 1:24-cv-05823 (JLR) -against- OPINION AND ORDER POND5, INC., Defendant. JENNIFER L. ROCHON, United States District Judge: Matthew Nixon and Peter Fleming (together, “Plaintiffs”) bring claims on behalf of a putative class against Defendant Pond5, Inc. (“Pond5”), a stock-video seller, under the Video Privacy Protection Act (VPPA), 18 U.S.C. § 2710. Dkt. 1 (“Compl.”). Pond5 moves to dismiss the Complaint pursuant to Federal Rule of Civil Procedure (“Rule”) 12(b)(1) and Rule 12(b)(6). Dkt. 16. For the reasons that follow, the Court GRANTS the motion to dismiss. BACKGROUND1 I. Factual Allegations Pond5 is a stock-video seller and operates a service by which its users can purchase and download prerecorded videos. Compl. ¶¶ 3, 16. On Pond5’s website, www.pond5.com, customers can choose from over 42 million prerecorded videos to watch, purchase (either individually or through a subscription), and download. Compl. ¶¶ 17-18. The price for

1 Unless otherwise noted, the following facts are drawn from the Complaint, which the Court “constru[es] . . . liberally, accepting all factual allegations in the complaint as true, and drawing all reasonable inferences in the plaintiff’s favor.” Herrera v. Comme des Garcons, Ltd., 84 F.4th 110, 113 (2d Cir. 2023) (quoting Miller v. Metro Life Ins. Co., 979 F.3d 118, 121 (2d Cir. 2020)). individual prerecorded videos begins at $25, but Pond5 also offers a monthly subscription for $199 per month or an annual subscription for $999 per year. Compl. ¶ 17. Meta, the company that operates Facebook and Instagram, offers advertisers the option to use certain business tools to gather information about Facebook users to better target advertising. Compl. ¶¶ 24-25, 27-28. One such tool is the Meta Tracking Pixel (the “Pixel”), “a piece of code that advertisers . . . can integrate into their website[s].” Compl. ¶¶ 28-29.

Once activated, the Pixel tracks users and the types of actions they take, including what content a visitor views or purchases. Compl. ¶¶ 29-30. When the Pixel captures an action, it sends a record to Facebook, which processes, analyzes, and assimilates the information into datasets for use in targeted advertising. Compl. ¶ 29. Pond5 implemented the Pixel in or about February 2018, and continues to use it. Compl. ¶¶ 21, 33. Plaintiffs allege that Pond5 tracks, collects, and discloses its customers’ and subscribers’ information through the Pixel without their knowledge or consent. Compl. ¶¶ 4-5. Plaintiffs allege that when they visited Pond5’s website, the Pixel “automatically caused” their personal identifiers, including “c_user,” “fr,” and “datr” cookies, to be sent to Meta, along with the fact that Plaintiffs visited the website and the titles of the videos they

viewed. Compl. ¶ 34. The “c_user” cookie contains a visitor’s unencrypted Facebook ID (“FID”), which can be used to find their Facebook accounts. Compl. ¶¶ 41-42. A “fr” cookie contains a visitor’s encrypted FID and a browser identifier. Compl. ¶ 45. The “datr” cookie also contains a browser identifier. Compl. ¶ 45. The Pixel transmits information associated with two distinct events, the “PageView” and “Purchase” events, to Facebook. Compl. ¶ 36. The PageView event occurs when a subscriber views a prerecorded video, while the Purchase event occurs when a subscriber or customer purchases and downloads a prerecorded video. Compl. ¶¶ 37-39. In both events, the Pixel transmits the URL and title of the video to Facebook. Compl. ¶¶ 37-40. If a visitor to Pond5’s website has not logged out of Facebook when they visit Pond5’s website, the Pixel transmits the “c_user,” “fr,” and “datr” cookies to Facebook. Compl. ¶¶ 41-42, 41 fig. 4. When a visitor has recently logged out of Facebook, the Pixel transmits the “datr” and “fr” cookies, but not the “c_user” cookie. Compl. ¶¶ 44-45, 44 fig. 5. In or about September 2021, Plaintiff Matthew Nixon purchased two stock videos

from Pond5. Compl. ¶ 7. In or about October 2020, Plaintiff Peter Fleming purchased stock videos from Pond5. Compl. ¶ 8. Throughout the time that Fleming and Nixon viewed and downloaded videos on Pond5’s website, they had Facebook and/or Instagram accounts and used one of those accounts during that period. Compl. ¶¶ 7-8. Nixon did not discover that Pond5 had collected and transmitted his FID and browser identifiers, along with the videos and titles of videos he viewed, to Meta until July 8, 2024. Compl. ¶¶ 52-53. Similarly, Fleming did not discover that Pond5 had collected and transmitted his FID and browser identifiers, along with the videos and titles of videos he viewed, until July 10, 2024. Compl. ¶¶ 52-53, 58-59.

II. Procedural History Plaintiffs filed this suit on July 31, 2024. See generally Compl. Pond5 moved to dismiss on September 20, 2024. Dkt. 16; Dkt. 17 (“Br.”); Dkt. 18 (“McPherson Decl.”); Dkts. 18-1 to 18-16. Plaintiffs filed their opposition on November 1, 2024, Dkt. 20 (“Opp.”), and Pond5 filed its reply on November 22, 2024, Dkt. 21 (“Reply”). Pond5 filed notices of supplemental authority on May 5, 2025 and June 24, 2025. Dkts. 22, 23. The motion is thus fully briefed.2

2 Pond5 requested oral argument via notation on its motion. The Court declines this request because the parties’ briefing was sufficient and oral argument would not materially assist the LEGAL STANDARDS To survive a Rule 12(b)(1) motion to dismiss, “‘the plaintiff must clearly allege facts [in his complaint] demonstrating each element’ of standing,” Lugo v. City of Troy, 114 F.4th 80, 87 (2d Cir. 2024) (alteration in original) (quoting Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016)), and “the complaint’s factual allegations of standing must be ‘plausible’ and ‘nonconclusory,’” id. (quoting Ashcroft v. Iqbal, 556 U.S. 662, 678, 680 (2009)). “In assessing whether there is subject matter jurisdiction, the Court must accept as true all

material facts alleged in the complaint, but ‘the court may resolve [any] disputed jurisdictional fact issues by referring to evidence outside of the pleadings.’” Lowell v. Lyft, Inc., 352 F. Supp. 3d 248, 254 (S.D.N.Y. 2018) (alteration in original) (citation omitted) (quoting Zappia Middle E. Constr. Co. v. Emirate of Abu Dhabi, 215 F.3d 247, 253 (2d Cir. 2000)). Under Rule 12(b)(6), a complaint must contain “sufficient factual matter, accepted as true, to state a claim to relief that is plausible on its face.” Francis v. Kings Park Manor, Inc., 992 F.3d 67, 72 (2d Cir. 2021) (en banc) (quoting Iqbal, 556 U.S. at 678). The court draws all reasonable inferences in the plaintiff’s favor and accepts as true all nonconclusory allegations of fact. Id. However, a complaint must allege “more than a sheer possibility that a defendant

has acted unlawfully” and more than “facts that are ‘merely consistent with’ a defendant’s liability.” Iqbal, 556 U.S. at 678 (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 556, 557 (2007)). Determining whether a complaint states a plausible claim is “a context-specific task that requires the reviewing court to draw on its judicial experience and common sense.” Id. at 679.

Court. See Dotson v. Griesa, 398 F.3d 156, 159 (2d Cir. 2005) (“[A] district court acts well within its discretion in deciding dispositive motions on the parties’ written submissions without oral argument.”). DISCUSSION Pond5 moves to dismiss for lack of standing under Rule 12(b)(1) and for failure to state a claim under the VPPA, pursuant to Rule 12(b)(6). Br. at 7, 10. The Court begins with Pond5’s Rule 12(b)(1) motion. See Daly v. Citigroup Inc., 939 F.3d 415, 426 (2d Cir. 2019) (where defendants move to dismiss under Rules 12(b)(1) and 12(b)(6), the court “consider[s] the Rule 12(b)(1) challenge first since ‘if [the court] must dismiss the complaint for lack of subject matter jurisdiction, the [defendants’] defenses and objections become moot and do not

need to be determined’” (quoting Rhulen Agency, Inc. v. Ala. Ins. Guar. Ass’n, 896 F.2d 674, 678 (2d Cir. 1990))); Narcisse v. Progressive Cas. Ins. Co., --- F. Supp. 3d ---, 2025 WL 1114855, at *4 (S.D.N.Y. Apr. 15, 2025) (resolving Rule 12(b)(1) motion to dismiss for lack of standing before Rule 12(b)(6) motion to dismiss for failure to state a claim). I. Standing Pond5 moves to dismiss Plaintiffs’ claim for lack of subject matter jurisdiction, arguing that Plaintiffs lack standing because they have not suffered a concrete injury. Br. at 7-10. To demonstrate standing, “a plaintiff must show (i) that he suffered an injury in fact that is concrete, particularized, and actual or imminent; (ii) that the injury was likely caused

by the defendant; and (iii) that the injury would likely be redressed by judicial relief.” TransUnion LLC v. Ramirez, 141 S. Ct. 2190, 2203 (2021) (citing Lujan v. Defenders of Wildlife, 504 U.S. 555, 560-61 (1992)). In cases involving statutory violations, Article III’s injury-in-fact requirement means that “[o]nly those plaintiffs who have been concretely harmed by a defendant’s statutory violation may sue that private defendant over that violation in federal court.’” Id. at 2205. “To allege a concrete harm, a plaintiff must point to ‘a close historical or common-law analogue for their asserted injury,’” but “need not present an ‘exact duplicate.’” Salazar v. Nat’l Basketball Ass’n, 118 F.4th 533, 541 (2d Cir. 2024) (quoting TransUnion, 141 S. Ct. at 2204, 2209). Instead, “what matters is ‘whether the alleged injury to the plaintiff has a “close relationship” to a harm “traditionally” recognized as providing a basis for a lawsuit in American courts.’” Packer ex rel. 1-800-Flowers.Com, Inc. v. Raging Cap. Mgmt., LLC, 105 F.4th 46, 52 (2d Cir. 2024) (quoting TransUnion, 141 S. Ct. at 2204). Pond5 argues that the Complaint fails to allege an injury in fact because Plaintiffs’

injury does not bear a close relationship to “a harm traditionally recognized as providing a basis for a lawsuit in American courts,” TransUnion, 141 S. Ct. at 2200. See Br. at 8-9. The Court is not persuaded. In Salazar, the Second Circuit held that the plaintiff, who alleged “that his personally identifiable information was exposed to an unauthorized third party” in violation of the VPPA “as a result of an arrangement between the [defendant] and Meta pursuant to which the [defendant] deliberately use[d] the Facebook Pixel,” was “sufficiently concrete” since the alleged harm was closely related to the traditional common-law claim for public disclosure of private facts. 118 F.4th at 542. Plaintiffs here have similarly alleged that Pond5 disclosed their private viewing information (the titles of the Pond5 videos they downloaded and

watched) to a third party, Meta, without their consent. Compl. ¶¶ 81-84. Pond5 argues that the facts of this case differ from those in Salazar because Pond5’s stock videos are designed to be redisplayed to the public and so any disclosure of the videos viewed do not involve private information. Reply at 1-4. But the fact that Pond5 sells stock videos and offers commercial licenses for those videos does not make Plaintiffs’ viewing history public, particularly given that the claims are not based on allegations that Plaintiffs displayed the downloaded videos to the public; rather, the claims concern the downloading of those videos by Plaintiffs. As in Salazar, the fact that Meta could leverage Plaintiffs’ personal viewing or downloading information for “its own commercial purposes” (showing the user targeted ads) renders the harm alleged sufficiently similar to “the public disclosure of private facts common-law analog.” 118 F.4th at 543-44. That harm still exists even if Plaintiffs may one day use Pond5’s videos publicly. Since Pond5 has not offered any persuasive reason why this case meaningfully differs from the facts at issue in Salazar, the Court finds that Plaintiffs have adequately pleaded a concrete injury sufficient to withstand dismissal under Rule 12(b)(1).3

Pond5 does not otherwise argue that Plaintiffs have failed to plead facts that satisfy Article III’s other standing requirements. The Court is satisfied that the alleged injury, the disclosure of Plaintiffs’ personal viewing information to a third party without their consent, is particularized and actual, that the injury is traceable to Pond5’s installation of the Pixel on its website, and that Plaintiffs’ requested injunctive and monetary relief would redress their injuries. See Salazar, 118 F.4th at 544 (similar). Since Plaintiffs have alleged facts that satisfy Article III standing, the Court denies Pond5’s motion to dismiss under Rule 12(b)(1). II. The VPPA Claim Plaintiffs allege that Pond5 disclosed their personally identifiable information to Meta

and other unauthorized third parties through the Meta Tracking Pixel in violation of the

3 Pond5’s attempt to analogize Plaintiffs’ viewing to the facts of Osheske v. Silver Cinemas Acquisition Co., 700 F. Supp. 3d 921 (C.D. Cal. 2023), aff’d, 132 F.4th 1110 (9th Cir. 2025), is unpersuasive, since that case did not address standing and instead held that a movie theater defendant was not covered by the VPPA because it was not a “video tape service provider.” Id. at 927-28. Pond5 has now withdrawn its argument that it is not a videotape service provider in light of Salazar. Reply at 6. Similarly, the Court is unmoved by Pond5’s citation to a series of cases, all involving Fourth Amendment claims (or its state-constitution equivalent) in the criminal context, holding that individuals lack a privacy interest in information they post on public websites, see Br. at 9-10, given the differing factual and statutory context here. VPPA. Compl. ¶¶ 77-86. Pond5 moves to dismiss this claim, arguing that Plaintiffs have failed to state a claim under the VPPA. The VPPA provides that “[a] video tape service provider who knowingly discloses, to any person, personally identifiable information concerning any consumer of such provider shall be liable to the aggrieved person.” 18 U.S.C. § 2710(b)(1). “To state a claim under the VPPA, a plaintiff must plausibly allege that (1) a video tape service provider (2) knowingly

disclosed to any person (3) personally identifiable information concerning her use of the service.” Solomon v. Flipps Media, Inc., 136 F.4th 41, 44 (2d Cir. 2025). Pond5 argues that Plaintiffs’ claims should be dismissed because (1) they are time- barred, Br. at 11-15, (2) Plaintiffs do not allege disclosure of personally identifiable information, id. at 18-20 and (3) Plaintiffs consented to Pond5’s use of the Meta Tracking Pixel and its alleged disclosure of personally identifiable information, id. at 20-22.4 The Court need only address Pond5’s second argument, that Plaintiffs have failed to state a claim because they have not alleged the disclosure of personally identifiable information. The VPPA defines “personally identifiable information” as “includ[ing] information which identifies a person as having requested or obtained specific video materials or services

from a video tape service provider.” 18 U.S.C. § 2710(a)(3). The Courts of Appeals have diverged in their interpretation of this term. The First Circuit has adopted a “reasonable foreseeability” standard, holding that “personally identifiable information is ‘not limited to information that explicitly names a person,’ but also includes information disclosed to a third

4 Pond5 also initially argued that the Complaint should be dismissed because Pond5 is not a video tape service provider within the meaning of the VPPA, Br. at 15-18, but has withdrawn this argument in light of the Second Circuit’s contrary holding in Salazar, Reply at 6; Salazar, 118 F.4th at 549. The Court thus does not address this argument. party that is ‘reasonably and foreseeably likely to reveal which . . . videos [the plaintiff] has obtained.’” Solomon, 136 F.4th at 49 (alteration in original) (quoting Yershov v. Gannett Satellite Info. Network, Inc., 820 F.3d 482, 486 (1st Cir. 2016)). Meanwhile, the Third and Ninth Circuits have adopted the “ordinary person” standard, holding that personally identifiable information is limited to “the kind of information that would readily permit an ordinary person to identify a specific individual’s video-watching behavior.” In re

Nickelodeon Consumer Privacy Litig., 827 F.3d 262, 267 (3d Cir. 2016); Eichenberger v. ESPN, Inc., 876 F.3d 979, 985 (9th Cir. 2017) (adopting ordinary person standard) Recently, in Solomon v. Flipps Media, Inc., 136 F.4th 41, the Second Circuit adopted the “ordinary person” standard and held that “‘personally identifiable information’ encompasses information that would allow an ordinary person to identify a consumer’s video- watching habits, but not information that only a sophisticated technology company could use to do so.” Solomon, 136 F.4th at 52. Thus, to survive a motion to dismiss, plaintiffs must “plausibly allege[] that [the defendant’s] disclosure of [information] ‘would, with little or no extra effort, permit an ordinary recipient to identify [the plaintiff’s] video-watching habits.’” Id. at 54 (quoting In re Nickelodeon, 827 F.3d at 284).

After adopting the ordinary person standard, the Second Circuit rejected Pixel-based VPPA claims on the ground that such claims do not plausibly allege the disclosure of personally identifiable information. See Solomon, 136 F.4th at 54-55. In Solomon, as here, the plaintiff brought a VPPA claim against a defendant that had installed the Pixel on its website. See id. at 54. Among other things, the Second Circuit found that the complaint did not “plausibly allege that an ordinary person could identify [the plaintiff] through her FID,” since an ordinary person would not see the “c_user” cookie and the corresponding string of letters “and conclude that the phrase was a person’s FID.” Id.; see also In re Nickelodeon, 827 F.3d at 283 (“To an average person, an IP address or a digital code in a cookie file would likely be of little help in trying to identify an actual person.”). Shortly thereafter, in Hughes v. National Football League, No. 24-2656, 2025 WL 1720295, (2d Cir. June 20, 2025) (summary order), the Second Circuit affirmed the dismissal of another VPPA action on this basis, even though the district court had not addressed it. /d. at *2. The Second Circuit declared that “Solomon effectively shut the door for Pixel-based VPPA claims.” Hughes, 2025 WL 1720295, at *2; see id. at *3 (rejecting the argument that “a viewer’s FID can be identified based on the string of numerals following the ‘c_user’ field” since it was “not plausible that an ordinary person, without [] annotation ..., would see the ‘c_user’ phrase on [this communication] and conclude that the phrase was a person’s FID” (alterations and omission in original) (quoting So/omon, 136 F.4th at 54)). Plaintiffs’ allegations mirror those found insufficient in Salazar and Hughes. Here too, Plaintiff alleges that “the Meta Pixel automatically caused the Plaintiffs’ . . . personal identifiers, including the c_user, fr, and datr cookies, to be transmitted to Meta, attached to the fact that the Plaintiffs . . . had viewed the website and the titles of the videos the Plaintiffs ... viewed.” Compl. § 34. Like the plaintiffs in Hughes and Solomon, Plaintiffs include screenshots depicting the information sent to Meta from a visitor’s browser by the Meta Tracking Pixel when a visitor watches or downloads a video on PondS’s website: 5 = c_user 10000” <— datr saFWZXu696kRJfnBDt3cUDkn dpr fr 1paMCZGP2m6rSPhH2.AWXupRLWPhICWMU2bbdLyN8V17A.B... Compl. § 41 fig. 4 (arrow identifying redacted FID); see also id. J 44 fig. 5; Hughes, 2025 WL 1720295, at *2; Solomon, 136 F.4th at 46. While Plaintiffs assert that their FIDs can be identified from the c_user cookie and can thus be used to identify their individual video-

watching habits, Opp. at 16, the Second Circuit has now twice rejected this theory, finding it implausible “that an ordinary person, without [] annotation . . . , would see the ‘c_user’ phrase on [this transmission] and conclude that the phrase was a person’s FID” or “use an FID to identify [plaintiff].” Solomon, 136 F.4th at 54; see also Hughes, 2025 WL 1720295, at *3 (same). Since an ordinary person would not plausibly be able to identify Plaintiffs’ video- watching habits as a result of the Pixel transmissions, Plaintiffs have not plausibly alleged that

Pond5 disclosed “personally identifiable information” in violation of the VPPA. The Court thus grants the motion to dismiss. III. Leave to Amend Plaintiffs briefly request leave to amend should the Court grant the motion to dismiss. Opp. at 20-21. Rule 15 provides that courts “should freely give leave [to amend] when justice so requires.” Fed. R. Civ. P. 15(a)(2); accord Rejuvenating Fertility Ctr., PLLC v. TD Bank, N.A., No. 23-cv-05973 (JLR), 2025 WL 588570, at *7 (S.D.N.Y. Feb. 24, 2025) (same). “Nonetheless, ‘it is within the sound discretion of the district court to grant or deny leave to amend,’ and ‘a district court may properly deny leave when amendment would be futile.’” Veras v. N.Y.C. Dep’t of Educ., No. 22-cv-00056 (JLR) (SN), 2024 WL 3446498, at *8

(S.D.N.Y. July 17, 2024) (first quoting Kim v. Kimm, 884 F.3d 98, 105 (2d Cir. 2018); and then quoting Jones v. N.Y. State Div. of Mil. & Naval Affs., 166 F.3d 45, 50 (2d Cir. 1999)). “[T]he standard for denying leave to amend based on futility is the same as the standard for granting a motion to dismiss.” Carroll v. Trump, 590 F. Supp. 3d 575, 579 (S.D.N.Y. 2022) (quoting IBEW Loc. Union No. 58 Pension Tr. Fund & Annuity Fund v. Royal Bank of Scot. Grp., PLC, 783 F.3d 383, 389 (2d Cir. 2015)). The Court denies leave to amend in light of Hughes. In Hughes, the Second Circuit rejected the plaintiff’s request to vacate and remand so that he could amend his complaint to include greater detail about his Pixel-based VPPA claims, namely that “(1) Facebook receives communications from the Pixel ‘in a way that is automatically translated into a readable format and is displayed (or is displayable) on a user interface as plain text’; (2) an ordinary person could plug the code into ‘ubiquitous internet-based tools like ChatGPT’ to ‘translate the code to reveal the Facebook ID and video title in plain English’; and (3) 75% of Americans have a Facebook account.” 2025 WL 1720295, at *3 (citation omitted). The

Second Circuit found that “amendment would likely be futile” in light of Solomon, since none of the plaintiff’s proposed allegations made it plausible that “an ordinary person would be able to understand the actual underlying code communication itself.” Id. Here, Plaintiffs do not offer any insight into how they would amend their Complaint if given the opportunity, see Opp. at 20-21, nor have they provided any such details following the Second Circuit’s decisions in Solomon and Hughes. Thus, the Court concludes that leave to amend would be futile. See Gregory v. ProNAi Therapeutics Inc., 757 F. App’x 35, 39 (2d Cir. 2018) (summary order) (affirming denial of leave to amend where plaintiffs sought leave to amend only briefly at the end of their opposition to defendants’ motion to dismiss and “included no proposed amendments”); Hughes, 2025 WL 1720295, at *3 (despite plaintiff’s

requests to add greater detail about his Pixel-based claims, explaining that there was “no basis for remanding because amendment would likely be futile”). Plaintiffs’ request for leave to amend is DENIED. CONCLUSION For the foregoing reasons, the Court DENIES Pond5’s motion to dismiss pursuant to Rule 12(b)(1), but GRANTS its motion to dismiss pursuant to Rule 12(b)(6). Plaintiffs’ request for leave to amend is DENIED. The Complaint is dismissed with prejudice. The Clerk of Court is respectfully directed to terminate the motion at Dkt. 16 and close the case. Dated: July 21, 2025 New York, New York SO ORDERED.

; NIFEW L. ROCHON nited States District Judge