Rancourt v. Meredith Corporation

• Court: District Court, D. Massachusetts
• Decided: February 1, 2024
• Docket: 1:22-cv-10696
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT DISTRICT OF MASSACHUSETTS

* ROBERT RANCOURT, individually and on * behalf of all others similarly situated, * * Plaintiff, * v. * * Civil Action No. 22-cv-10696-ADB MEREDITH CORPORATION, * * Defendant. * * * *

MEMORANDUM AND ORDER

BURROUGHS, D.J. Allrecipes.com (“Allrecipes”), owned by Defendant Meredith Corporation (“Meredith”), has a mobile application, Dinner Spinner (the “App”), that contains “recipe videos . . . with step- by-step cooking instructions.” [ECF No. 50-1 (“Am. Compl.”) ¶ 2]. Plaintiff Robert Rancourt (“Mr. Rancourt”), a user of the App, alleges that Meredith disclosed his personally identifiable information (“PII”), including a record of every video he viewed within the App, to third parties, in violation of the federal Video Privacy Protection Act (“VPPA”) and an analogous state law, Mass. Gen. Laws ch. 93, § 106 (“MVPA”). [Id. ¶¶ 3–6]. Currently pending before the Court is Meredith’s motion to dismiss under Federal Rule of Civil Procedure 12(b)(2) for lack of personal jurisdiction and Rule 12(b)(6) for failure to state a claim. [ECF No. 61]. For the reasons set forth below, both motions to dismiss are DENIED as to the VPPA claim in Count I, but Meredith’s motion to dismiss under Rule 12(b)(6) for the MVPA claim in Count II, which is seemingly unopposed, is GRANTED. I. BACKGROUND A. Factual Background1 Meredith, an Iowa corporation with a principal place of business in Des Moines, Iowa, [Am. Compl. ¶ 76], owns and operates the App, [id. ¶ 12; ECF No. 64 ¶¶ 5–7]. The App is

available for download from the Google Play Store and the Apple App Store and can be downloaded and accessed across the United States. [Am. Compl. ¶¶ 13, 76]. The App contains cooking recipes, many of which “include a text recipe accompanied by a video showing the recipe’s preparation.” [Id. ¶ 45]. Mr. Rancourt, a resident of Fall River, Massachusetts, downloaded the App on his Android phone in May 2017, [Am. Compl. ¶¶ 70, 75], and used it for nearly five years, until approximately April 2022, [id. ¶ 71]. When downloaded, the App requests permission from users to access their location through the GPS on their mobile device and to send push notifications to the device. [Am. Compl. ¶ 13]. Although users may decline or grant permission for location tracking and push

notifications, the App does not request permission from users to share location and other user information gathered from within the App. [Id. ¶ 14]. Accordingly, Mr. Rancourt enabled location services when he created his account, but he never agreed to the App disclosing PII to third parties. [Id. ¶ 72]. Nonetheless, as alleged by Mr. Rancourt, when a user watches an instructional cooking video embedded in the App, Meredith discloses the user’s PII to a third-

1 For Meredith’s Rule 12(b)(6) motion, facts are taken from the Amended Complaint and assumed to be true. Ruivo v. Wells Fargo Bank, N.A., 766 F.3d 87, 90 (1st Cir. 2014). As to Meredith’s Rule 12(b)(2) motion, facts are also drawn from additional materials that the Court may properly consider in the context, “giving credence to the plaintiff’s version of genuinely contested facts.” Baskin-Robbins Franchising LLC v. Alpenrose Dairy, Inc., 825 F.3d 28, 34 (1st Cir. 2016) (noting that in ruling on personal jurisdiction motions, courts may consider “whatever supplemental filings (such as affidavits) are contained in the record”). party partner—Twilio, Inc. (“Twilio”)—as part of an effort to target marketing campaigns and advertisements at the App user and thus maximize ad revenue, as well as to conduct user analytics. [Id. ¶¶ 20, 29, 62]. Through an analysis conducted by “a private research company,” at the behest of Mr.

Rancourt’s counsel, Mr. Rancourt discovered that Meredith incorporates multiple application programming interfaces (“APIs”) into the App. [Am. Compl. ¶¶ 16–17]. These APIs “enable companies to open up their applications’ data and functionality to external third-party developers, business partners, and internal departments within their companies.” [Id. ¶ 18 (internal citations omitted)]. One of the APIs integrated into the App was the Segment API, owned and operated by Twilio. [Id. ¶ 19]. Through the Segment API, Meredith disclosed to Twilio information about Mr. Rancourt, including his (1) geolocation, (2) account or member ID, (3) advertising ID, and (4) “a unique video identifier of the video(s) viewed by the user.” [Id. ¶ 20]. An App user’s geolocation is established by “generating a set of geographic coordinates

such as latitude and longitude through [the phone’s] GPS and using the coordinates to determine a meaningful location [of the user].” [Am. Compl. ¶ 24].2 A user’s Advertising ID (“AAID”) is a unique string of numbers associated with a particular device that can be used to track the device user’s activities across multiple applications. [Am. Compl. ¶ 33]. This allows a third-party with access to the AAID to “track, cross-correlate, and aggregate” a user’s activity on multiple applications on a single device. [Id.]. The resulting “record of user activity” allows for inferences about the user “like a person’s

2 As explained by Mr. Rancourt, geolocation is considered “‘the Holy Grail of advertising’ because it creates ‘the complete picture that connects all of our interests and online activity with our real-world actions.’” [Am. Compl. ¶ 30 (internal citations omitted)]. political or religious affiliations, sexuality, or general reading and viewing preferences.” [Id. ¶ 36]. The Segment API also discloses a member ID, which is “a unique string of numbers corresponding to an [] App user’s account.” [Am. Compl. ¶¶ 40–41].3

Finally, Mr. Rancourt alleges that Meredith discloses to Twilio a video ID (also referred to as “recipe ID”) in addition to the other user information. [Am. Compl. ¶ 44]. This video ID is a separate number that correlates to the specific recipe video the user watched on the App. [Id. ¶ 49]. According to Mr. Rancourt, a Google search querying the video ID number alongside “Allrecipes” reveals which video corresponds to a particular video ID number. [Id.]. “Twilio combines [all this information] to identify a specific individual’s video viewing behavior.” [Am. Compl. ¶ 52]. “This, in turn, allows Twilio to enhance Defendant’s advertising and marketing efforts.” [Id.]. Twilio does this by merging this information with users’ information from other “devices and channels” to build “complete user- or account-level profiles.” [Id. ¶ 53]. Twilio calls these “Persona” profiles. [Id. ¶ 54]. Twilio uses these

“Persona” profiles to group together “cohorts of users or accounts based on their event behavior and traits.” [Id. ¶ 57]. Twilio calls these “Audiences.” [Id.]. Meredith then relies on this “Audience” information to better target its marketing campaigns at “Persona profiles that fit specific parameters.” [Id.]. Twilio also compiles and transmits users’ personal information to other third parties, like Facebook, Google, and Salesforce, “that Defendant utilizes for targeted advertising.” [Id. ¶ 58]. “In this role, Twilio acts as a facilitator,” providing the information to allow these other third parties to “personalize messages across channels, optimize ad spend, and

3 The Segment API matches the user’s “display name” with its corresponding member ID in transmitting this information to Twilio. [Am. Compl. ¶ 41]. improve targeting.” [Id.]. This personalization and targeting of advertising, in turn, allows Meredith to maximize its advertising revenue. [Id. ¶¶ 58, 62]. Finally, Twilio’s analysis of users’ personal information also allows Meredith to “better measure and analyze the App’s performance.” [Am. Compl. ¶ 59]. Users’ information can

include “e-mails received” and “videos viewed.” [Id. ¶ 60]. Meredith uses this information to target specific users to increase their engagement with the App. [Id.]. In the two years before Mr. Rancourt filed his complaint, see [ECF No. 1], from May 2020 to May 2022, which is seemingly the relevant time period given the VPPA’s two year statute of limitations, 18 U.S.C. § 2710(c)(3), “the only revenue [Meredith] generated from [the App] . . . was from online advertisements run on the app,” [ECF No. 47-1 ¶ 3]. Meredith manages ad inventory for the App through “an advertising exchange platform,” Google Ad Manager, which “allows [Meredith] to facilitate the buying and selling of advertisements on its applications [including the App], and to track revenue generated from these advertisements.” [Id. ¶ 4]. From May 2020 to May 2022, roughly 66,000,000, or 2.02%, of the roughly

3,000,000,000 advertisements that were run on the App in the United States were run on devices located in Massachusetts and these advertisements generated $66,677.96 in revenue, accounting for 2.02% of the total revenue Meredith generated from the App in the United States. [Id. ¶¶ 8, 10]. As of July 2022, 54,302, or 3% of the App’s users in the United States, were located in Massachusetts. [ECF No. 64 ¶ 16]. Meredith was registered to do business in Massachusetts from July 1987 to July 2022. [ECF No. 84 at 6]. B. Procedural History Mr. Rancourt filed his original complaint in May 2022, raising claims for violations of the VPPA (Count I) and the MVPA (Count II). [ECF No. 1]. On November 14, 2022, after Meredith filed a motion to dismiss pursuant to Rules 12(b)(2) and 12(b)(6), [ECF No. 23], Mr.

Rancourt filed an amended complaint (the operative complaint)—individually and on behalf of a class of similarly situated individuals4—raising the same claims. [Am. Compl.]. Also following Meredith’s first motion to dismiss, at the request of Mr. Rancourt, the Court allowed jurisdictional discovery to develop a better understanding of the revenue Meredith derives from App users in Massachusetts. See [ECF No. 45]. On December 22, 2022, Meredith moved to dismiss both counts under Rule 12(b)(2) for lack of personal jurisdiction and Rule 12(b)(6) for failure to state a claim. [ECF No. 61]. Mr. Rancourt opposed the motion on January 19, 2023. [ECF No. 66-2].5 II. Rule 12(b)(2) A. Legal Standard

To establish personal jurisdiction based on a defendant’s contacts with the state, “a plaintiff must satisfy both the forum state’s long-arm statute and the Due Process Clause of the Fourteenth Amendment.” C.W. Downer & Co. v. Bioriginal Food & Sci. Corp., 771 F.3d 59, 65

4 Mr. Rancourt seeks to represent a class of similarly situated individuals defined as “all persons in the United States who used the Allrecipes App with location services enabled to watch videos and had their PII transmitted to a third party,” and a subclass of similarly situated individuals defined as “all Massachusetts residents who used the Allrecipes App with location services enabled to watch videos and had their PII transmitted to a third party.” [Am. Compl. ¶¶ 86–87]. 5 After the motion was briefed, the case was transferred to another session of the Court and the parties filed supplemental briefing. See [ECF Nos. 77, 83, 84]. (1st Cir. 2014) (citing Ticketmaster-N.Y., Inc. v. Alioto, 26 F.3d 201, 204 (1st Cir. 1994)).6 Under this analysis, “the touchstone of due process is that the defendant must ‘have certain minimum contacts with [the forum] such that the maintenance of the suit does not offend ‘traditional notions of fair play and substantial justice.’” Motus, LLC v. CarData Consultants,

Inc., 23 F.4th 115, 122 (1st Cir. 2022) (quoting Int’l Shoe Co. v. Washington, 326 U.S. 310, 316 (1945)). The Massachusetts long-arm statute also limits when courts may exercise personal jurisdiction over nonresidents. See Mass. Gen. Laws ch. 223A, § 3.7 Plaintiffs bear the burden of establishing that the Court has jurisdiction over Defendants. A Corp. v. All Am. Plumbing, Inc., 812 F.3d 54, 58 (1st Cir. 2016) (citing Phillips v. Prairie Eye Ctr., 530 F.3d 22, 26 (1st Cir. 2008)). “When a district court rules on a motion to dismiss for lack of personal jurisdiction without holding an evidentiary hearing . . . the ‘prima facie’ standard governs its determination.” United States v. Swiss Am. Bank, Ltd., 274 F.3d 610, 618

6 As relevant to Plaintiffs’ VPPA claim: when a party asserts a federal question claim, a federal court can “exercise personal jurisdiction over a defendant . . . if that defendant has sufficient contacts with the United States as a whole.” Lorelei Corp. v. Cnty. of Guadalupe, 940 F.2d 717, 719 (1st Cir. 1991) (quoting Whistler Corp. v. Solar Elecs., Inc., 684 F. Supp. 1126, 1128 (D. Mass. 1988)). That said, where a federal statute, here the VPPA, “does not provide for nationwide service,” id. at 720; see 18 U.S.C. § 2710, the “Court must conduct the same personal jurisdiction inquiry as in a diversity case, focusing on the defendant’s contacts with Massachusetts rather than with the United States as a whole,” Jorge v. Adler, No. 22-cv-30075, 2023 WL 1421595, at *3 (D. Mass. Jan. 31, 2023) (quoting Motus, LLC v. CarData Consultants Inc., 520 F. Supp. 3d 87, 91 (D. Mass. 2021)). 7 Additionally, parties may consent to personal jurisdiction. Mallory v. Norfolk S. Ry. Co., 600 U.S. 122, 138 (2023) (“‘[E]xpress or implied consent’ can . . . ground personal jurisdiction.”); id. at 147 (Jackson, J., concurring) (“Because the personal-jurisdiction right belongs to the defendant, . . . a defendant can choose to ‘subject [itself] to powers from which [it] may otherwise be protected.’ When that happens, a State can exercise jurisdiction over the defendant consistent with the Due Process Clause, even if our personal-jurisdiction cases would normally preclude the State from subjecting a defendant to its authority under the circumstances presented.” (quoting Ins. Corp. of Ireland v. Compagnie des Bauxites de Guinee, 456 U.S. 694, 703 n.10 (1982)). (1st Cir. 2001).8 Under this standard, the Court takes as true whatever properly documented facts a plaintiff proffers, construes those facts in the light most favorable to the plaintiff, and considers facts put forward by the defendant only to the extent they are uncontradicted. See Phillips, 530 F.3d at 26; Platten v. HG Berm. Exempted Ltd., 437 F.3d 118, 134 (1st Cir. 2006).

The prima facie approach does not require that [the Court] “credit conclusory allegations or draw farfetched inferences.” Instead, “[t]he prima facie showing of personal jurisdiction must be based on evidence of specific facts set forth in the record.” “Although the burden of proof is light, [the plaintiff] may not rely on the mere allegations of its complaint, but must point to specific facts in the record that support those allegations.” [Plaintiffs] “must go beyond the pleadings and make affirmative proof.” Vapotherm, Inc. v. Santiago, 38 F.4th 252, 257 (1st Cir. 2022) (first quoting Ticketmaster-N.Y., 26 F.3d at 203; then quoting Boit v. Gar-Tec Prods., Inc., 967 F.2d 671, 675 (1st Cir. 1992); then quoting Jet Wine & Spirits, Inc. v. Bacardi & Co., 298 F.3d 1, 8 (1st Cir. 2002); and then quoting Boit, 967 F.2d at 675). B. Discussion 1. Long-Arm Statute Because “‘the Massachusetts long-arm statute imposes specific constraints on the exercise of personal jurisdiction that are not coextensive with the parameters of due process,’ . . . Massachusetts courts . . . begin with ‘a determination under the long-arm statute’ before ‘considering the constitutional question.’” Mojtabai v. Mojtabai, 4 F.4th 77, 85 (1st Cir. 2021) (internal alterations omitted) (quoting SCVNGR, Inc. v. Punchh, Inc., 85 N.E.3d 50, 52 (Mass. 2017)). The Massachusetts long-arm statute provides that “[a] court may exercise personal

8 Although the parties engaged in jurisdictional discovery, the parties did not request an evidentiary hearing, and the Court did not hold one. The Court therefore applies the prima facie standard. jurisdiction over a person, who acts directly or by an agent, as to a cause of action in law or equity arising from” certain enumerated categories of conduct, including: (a) transacting any business in this commonwealth; . . . (c) causing tortious injury by an act or omission in this commonwealth; [or] (d) causing tortious injury in this commonwealth by an act or omission outside this commonwealth if he regularly does or solicits business, or engages in any other persistent course of conduct, or derives substantial revenue from goods used or consumed or services rendered, in this commonwealth[.] Mass. Gen. Laws ch. 223A, § 3(a), (c)–(d). In its motion, Meredith notes that Mr. Rancourt has alleged that the Court has jurisdiction over Meredith under subsection (c), “causing tortious injury by an act or omission in this commonwealth.” [ECF No. 62 at 12–13 n.5 (quoting Am. Compl. ¶ 84)]. Meredith describes this as “a tenuous assertion given the locations of Allrecipes, Meredith, and Twilio,” but does not otherwise contest the applicability of this subsection. [Id.]. Instead, it asserts that whether a tort “was committed in Massachusetts within the meaning of section 3(c) of the long-arm statute” does not relieve a plaintiff’s burden to satisfy constitutional due process; indeed, courts grant Rule 12(b)(2) motions to dismiss for lack of specific jurisdiction even where an alleged Massachusetts-based tort may satisfy the long-arm statute. [Id. (citing Ching-Yi Lin v. TipRanks, Ltd., No. 19-cv-11517, 2019 WL 6211246, at *3 (D. Mass. Nov. 21, 2019))]. In his opposition, Mr. Rancourt asserts that the Court has jurisdiction over Meredith not just under subsection (c), but all three of the above provisions, namely (a), (c) and (d). [ECF No. 66-2 at 9 n.1]. The Court finds that it may exercise jurisdiction pursuant to § 3(d).9 Section 3(d) is the Massachusetts long-arm statute’s general personal jurisdiction provision and applicable only if the defendant is subject to general personal jurisdiction in Massachusetts. See Pettengill v.

9 Having found the exercise of jurisdiction appropriate under § 3(d), the Court does not address the other provisions of the long-arm statute. Curtis, 584 F. Supp. 2d 348, 357 (D. Mass. 2008) (“§ 3(d) would only apply if general jurisdiction existed over the . . . [d]efendants.”); Krua v. Sirleaf, No. 18-cv-10574, 2019 WL 1936733, at *4 (D. Mass. May 1, 2019) (“[Plaintiffs] have also not alleged sufficient facts to establish general jurisdiction . . . which is necessary for jurisdiction under § 3(d).” (citing

Pettengill, 584 F. Supp. 2d at 357)); see also Wright v. Ruberto, Israel & Weiner, P.C., No. ESCV2018001434A, 2019 WL 2895580, *5 (Mass. Super. Ct. May 28, 2019) (noting that § 3(d) is a general jurisdiction provision designed to subject “defendants . . . who conduct substantial business within the Commonwealth” to Massachusetts’ courts’ jurisdiction for any and all claims). “Section 3(d) is to be construed ‘extremely broadly.’” Fiske v. Sandvik Mining, 540 F. Supp. 2d 250, 255 (D. Mass. 2008) (quoting Noonan v. Winston Co., 135 F.3d 85, 92 (1st Cir. 1998)). “Literal satisfaction” of the clause’s “disjunctive requirement that the defendant ‘derives substantial revenue from goods used [or consumed or services rendered] . . . in this commonwealth’ . . . is sufficient to support the assertion of jurisdiction provided that the statute’s

implicit due process limitations are not offended.” Heins v. Wilhelm Loh Wetzlar Optical Mach. GmbH & Co. KG., 522 N.E.2d 989, 993 (Mass. App. Ct. 1988) (citing Good Hope Indus., Inc. v. Ryder Scott Co., 389 N.E.2d 76, 80 (Mass. 1979); and then citing Carlson Corp. v. Univ. of Vt., 402 N.E.2d 483, 485 (Mass. 1980)). Further, the First Circuit has held that the test for determining whether revenue is “substantial,” within the meaning of the long-arm statute, is lenient, does not require that a certain absolute sales threshold or percentage of sales be met, and that “[t]he sale of 6000 pairs of shoes for $15,000 easily meets this requirement.” Keds Corp. v. Renee Int’l Trading Corp., 888 F.2d 215, 219 (1st Cir. 1989); see also Heins, 522 N.E.2d at 993 (finding requirement met based on evidence of sale of $56,000 machine and presence of other similar machines in Massachusetts); Healey v. Hydraforce, Inc., Nos. 991863, 992118, 00384, 2005 WL 1009514, at *1 (Mass. Super. Mar. 18, 2005) (“Cases construing § 3(d) demonstrate that the [several hundred thousand dollars in] . . . revenue which [defendant] derived, directly and indirectly, from sales of goods in the Commonwealth substantially surpass any minimum

requirement[.]” (citing Mark Obear & Sons, Inc., 313 F. Supp. 373 (D. Mass. 1970) (“substantial revenue found in sale of $5,000 in goods”); and then citing Merced v. JLG Indus., Inc., 170 F. Supp. 2d 65 (D. Mass. 2001) (“sales of $5,902 [sufficient to satisfy § 3(d)]”) (other citation omitted)). The Court finds that Meredith’s nearly $70,000 in ad revenue from devices located in Massachusetts over two years meets this requirement, and therefore that it may exercise jurisdiction pursuant to § 3(d) of the long-arm statute, assuming doing so does not offend due process.10 2. Minimum Contacts With regards to the due process analysis, the First Circuit has recognized that a court

may, consistent with due process, exercise two types of jurisdiction: general or specific. See United Elec., Radio & Mach. Workers of Am. v. 163 Pleasant St. Corp., 960 F.2d 1080, 1088–89 (1st Cir. 1992) (distinguishing the two types of personal jurisdiction). Under “general [personal] jurisdiction, in which the cause of action may be unrelated to the defendant’s contacts, the defendant must have continuous and systematic contacts with the state.” Harlow v. Child.’s Hosp., 432 F.3d 50, 57 (1st Cir. 2005). To establish specific personal jurisdiction, the Plaintiff

10 The fact that Meredith is registered to do business and thus has named a registered agent for service of process in Massachusetts provides additional support for exercising jurisdiction under § 3(d). See Fiske, 540 F. Supp. 2d at 256 (noting that these activities “add some modest weight to the jurisdictional analysis” (citing Sandstrom v. ChemLawn Corp., 904 F.2d 83, 89 (1st Cir. 1990)). bears the burden of establishing a “demonstrable nexus” between his claims and the defendant’s forum-state contacts. Swiss Am. Bank, 274 F.3d at 618 (quoting Mass. Sch. of L. at Andover, Inc. v. Am. Bar Ass’n, 142 F.3d 26, 34 (1st Cir. 1998)). Meredith contends that the Court has neither general nor specific personal jurisdiction over it. [ECF No. 62 at 12–18]. In response,

Mr. Rancourt argues only that the Court has specific personal jurisdiction. [ECF No. 66-2 at 9– 16]. The Court thus focuses its analysis on specific personal jurisdiction.11 Specific personal jurisdiction exists when (1) the plaintiff’s claim arises out of, or relates to, the defendant’s activities in the forum, (2) the defendant’s forum-state contacts represent a purposeful availment of the privilege of conducting activities in that state, and (3) the exercise of specific jurisdiction is reasonable. Kuan Chen v. U.S. Sports Acad., 956 F.3d 45, 59 (1st Cir. 2020) (citing Scottsdale Cap. Advisors Corp. v. The Deal, LLC, 887 F.3d 17, 20 (1st Cir. 2018)). i. Purposeful Availment The Parties’ briefing focuses on the purposeful availment prong. [ECF No. 62 at 13–18; ECF No. 66-2 at 9–16].

The purposeful availment requirement ensures that the exercise of jurisdiction is essentially voluntary and foreseeable, and is not premised on a defendant’s “random, fortuitous, or attenuated contacts[.]” “[T]he Supreme Court has explained that ‘the foreseeability that is critical to due process analysis . . . is that the defendant’s conduct and connection with the forum State are such that he should reasonably anticipate being haled into court there.’”

Knox v. MetalForming, Inc., 914 F.3d 685, 691 (1st Cir. 2019) (citing C.W. Downer, 771 F.3d at 66; then quoting Carreras v. PMG Collins, LLC, 660 F.3d 549, 555 (1st Cir. 2011); and then

11 In supplemental briefing, Mr. Rancourt additionally argues that the Court has general jurisdiction over Meredith, because, by registering to do business in Massachusetts and appointing an agent for service of process, Meredith consented to jurisdiction in Massachusetts. See [ECF No. 84 at 6]. As discussed below, having found personal jurisdiction based on Meredith’s contacts with Massachusetts, the Court does not address Mr. Rancourt’s consent argument. quoting PREP Tours, Inc. v. Am. Youth Soccer Org., 913 F.3d 11, 20 (1st Cir. 2019)). Meredith argues that as a nationally available online application, “something more” than its mere accessibility in the state is required to demonstrate purposeful availment for purposes of jurisdiction. [ECF No. 62 at 14 (citing Motus, 520 F. Supp. 3d at 92)]. For current purposes,

Meredith asserts that the Court should view this case under the rubric of internet cases that focus on whether a defendant—through its website—”purposely and voluntarily directs his activities toward the forum.” [Id. at 14 (citing Crowe v. Harvey Klinger, Inc., 277 F. Supp. 3d 182, 191 (D. Mass. 2017))]. The First Circuit recently “explore[d] the frontiers of personal jurisdiction in the internet age” in Kuan Chen v. United States Sports Academy, 956 F.3d 45, 51 (1st Cir. 2020). Chen involved a student of an online doctoral program who participated in the program from multiple states across the country and over a period of several years, ending up in Massachusetts. Id. at 52-54. Mr. Chen sued the program on state law claims in Massachusetts state court, and the defendant removed the case to federal court and then moved to dismiss for lack of personal

jurisdiction. Id. On appeal, the First Circuit determined that the defendant could not “be subjected to specific jurisdiction in Massachusetts based on its maintenance of an online learning platform accessible in (and allegedly accessed by Chen from) the Commonwealth.” Id. at 60. Although the defendant “perhaps could have anticipated that Massachusetts residents (like residents of any other state) might enroll in its Distance Learning Program and access its online learning platform from the Commonwealth,” the First Circuit determined that “this broad and generic degree of foreseeability is insufficient, standing alone, to rise to the level of purposeful availment. . . .” Id. Further, although “two Massachusetts-based students were enrolled in a single online course through [defendant] as of January 2019,” the First Circuit concluded that “[t]he record . . . [wa]s utterly devoid of evidence sufficient to ground either a finding that [defendant] used its online presence to target these two students while they were in Massachusetts or a finding that

[defendant] derived substantial revenue from them.” Chen, 956 F.3d at 61. As such, the defendant’s awareness of these two students’ enrollment was “insufficient to show that [defendant] purposefully availed itself of the benefit of doing business in Massachusetts such that it reasonably could have expected to face suit there by Chen.” Id. This reasoning aligns with other cases involving transactions conducted over the internet in which courts have recognized that internet commerce has required a shift in the personal jurisdiction paradigm. See, e.g., Motus, 23 F.4th at 125; Cossaboon v. Me. Med. Ctr., 600 F.3d 25, 35 (1st Cir. 2010); Gather, Inc. v. Gatheroo, LLC, 443 F. Supp. 2d 108, 116 (D. Mass. 2006) (implementing “sliding scale” analysis in which exercise of personal jurisdiction is dependent on the degree of interactivity of website). Where companies now have the ability to operate

websites that can be accessed by anyone with an internet connection, something beyond the availability of a website in a state is needed to establish personal jurisdiction over an out-of-state corporate defendant. Chen, 956 F.3d at 60 (citing A Corp., 812 F.3d at 61). In Chen, the First Circuit held that to demonstrate purpose availment, a plaintiff must put forward evidence “show[ing] that the website either [1] specifically targets the forum or [2] has resulted in the defendant’s knowing receipt of substantial revenue from forum residents.” 956 F.3d at 60; id. at 59 (“evidence of ‘specific targeting of a forum’ is not ‘the only means of showing that the purposeful availment test has been met.’ Under appropriate circumstances, a defendant corporation’s ‘regular course of sale[s] in the [forum]’ could make the exercise of jurisdiction foreseeable to the defendant[.]’” (first quoting Plixer Int’l, Inc. v. Scrutinizer GmbH, 905 F.3d 1, 9 (1st Cir. 2018); and then quoting Knox, 914 F.3d at 691)). From this starting point, Meredith argues that it did not specifically target Massachusetts or receive substantial revenue from Massachusetts residents. [ECF No. 62 at 15–17]. Meredith

asserts that (1) the App only advertises itself through national campaigns; (2) the process for running third-party ads on the App is the same throughout the country; and (3) the App’s collection practices were the same for all users who enabled location tracking, regardless of where they were located. [Id. at 13–17]. This, according to Meredith, “is the opposite of targeting users because they live in a particular state.” [Id. at 17 (citing Chen, 956 F.3d at 60) (emphasis in original)]. Further, Meredith argues that it does not receive substantial revenue from Massachusetts residents, given that, in the relevant two-year timeframe, only 2.02% of its total U.S. revenue was generated from devices located in Massachusetts, which is lower than Massachusetts’ total percentage of the U.S. population. [Id. at 15]. Mr. Rancourt disagrees with Meredith’s framing of the issue in several ways. [ECF No.

66-2 at 9]. First, he argues that Keeton v. Hustler Magazine, 465 U.S. 770 (1984) is controlling. [ECF No. 66-2 at 10]. In Keeton, the Supreme Court found that although a nationally circulated magazine delivered only a small portion of its product to New Hampshire, such contacts were sufficient to establish personal jurisdiction because the magazine “ha[d] continuously and deliberately exploited the New Hampshire market,” and “must [have] reasonably anticipate[d] being haled into court there in a libel action based on the contents of its magazine.” Keeton, 465 U.S. at 771, 775. Mr. Rancourt asserts that as in Keeton, Meredith (1) knew it was transmitting content to and contracting with consumers in Massachusetts and (2) knowingly delivered content to a “substantial number” of Massachusetts residents (over 54,000). [Id. at 10–12]. Thus, in Mr. Rancourt’s view, as in Keeton, Meredith has sufficient contacts with Massachusetts to warrant the exercise of personal jurisdiction. [Id. at 11–12]. Second, Mr. Rancourt asserts that even assuming more were needed, he has also adequately shown that Meredith purposely directed its activities at Massachusetts, where (1) Meredith “knows that the target of its allegedly wrongful

conduct is located in Massachusetts,” [id. at 12 (quoting Morphotrust USA, LLC v. Identrix, LLC, No. 16-cv-10074, 2016 WL 3512131, at *7 (D. Mass. June 21, 2016))], and (2) Meredith’s “conduct ‘results in [Meredith’s] knowing receipt of substantial revenue from forum residents,’” [id. (quoting Motus, 520 F. Supp. 3d at 92)]. The Court finds that Chen offers a helpful framework for identifying purposeful availment in the context of a widely available internet application. Like Chen, the App is equally available inside and outside of Massachusetts and available to anyone in the United States who wishes to download it. See Chen, 956 F.3d at 52; [ECF No. 62 at 8]. Unlike Chen, where there was evidence of only two Massachusetts students, here, as of July 2022, the App had nearly 55,000 Massachusetts users. See Chen, 956 F.3d at 61; [ECF No. 64 ¶ 16]. Likewise, over two

years (May 2020 to May 2022), Meredith earned over $66,000 or 2% of the App’s total U.S. ad revenue from Massachusetts devices. [ECF No. 47-1 ¶¶ 8, 10]. Courts have held business of a similar magnitude to be sufficiently substantial for personal jurisdiction. See Plixer, 905 F.3d at 10 (holding that $200,000 in business over three-and-a-half years was not “insubstantial income from [the] market”); id. at 11 (citing approvingly Willemsen v. Invacare Corp., 282 P.3d 867 (Or. 2012) (en banc), in which the Oregon Supreme Court found that 1,000 in-state sales yielding $30,000 in revenue over a two-year period constituted a “pattern of sales” that “made the exercise of personal jurisdiction over the defendant constitutional”); Knox, 914 F.3d at 692 (citing approvingly Ainsworth v. Moffett Eng’g, Ltd., 716 F.3d 174, 178 & n.14 (5th Cir. 2013), in which the Fifth Circuit “uph[e]ld[] the exercise of jurisdiction based on substantial in-forum sales, even though the defendant’s forum sales represented only 1.55% of its nationwide sales during the relevant period”). Further, ad revenue is not tangential or incidental to the App’s business; in fact, it is Meredith’s only revenue stream from the App. [ECF No. 47-1 ¶ 3].

This is also unlike “stream-of-commerce case[s] [that] . . . usually involve entities who cannot necessarily predict or control where downstream their products will land,” and where courts have found no purposeful availment. Plixer, 905 F.3d at 8. Here, Meredith can track where the App is being accessed, based on the geolocation information it collects, and therefore can easily predict where its App is being used and where they might be reasonably haled into court as a result of significant usage. Further, Meredith is not merely aware of its many Massachusetts users and the resulting ad revenue, but it also uses the information it collects to tailor advertisements and content to increase user engagement; thus, taking a “voluntary act[]” to foster the “‘regular flow or regular course of sales,’ . . . in the Commonwealth.” Knox, 914 F.3d at 692. As the First Circuit did in

Knox, the Court rejects Meredith’s arguments that the Court “should discount its Massachusetts sales [or ad revenue] because those sales were part of a nationwide sales effort. . . . [T]he question is not whether a defendant sells its product across the U.S.; it is instead whether a defendant’s forum connection is such ‘that the exercise of jurisdiction is essentially voluntary and foreseeable.’” Id. In UMG Recordings, Inc. v. Kurbanov, 963 F.3d 344, 353 (4th Cir. 2020), where, like here, “[defendant’s websites] . . . collect[ed], among other information, [website visitors’] IP addresses and country of origin,” the Fourth Circuit similarly found that “[f]ar from being indifferent to geography, any advertising displayed on the Websites is directed towards specific jurisdictions like Virginia[, and] [Defendant] ultimately profits from visitors by selling directed advertising space and data collected to third-party brokers, thus purposefully availing himself of the privilege of conducting business within Virginia.” Id. In reaching this conclusion, the Fourth Circuit likewise rejected the defendant’s argument that his lack of control over these

advertisements meant he had not purposely availed himself of the forum, explaining: “at a minimum, [defendant] facilitates targeted advertising by collecting and selling visitors’ data . . . [and] [w]hile he has outsourced the role of finding advertisers for the Websites to brokers, the fact remains that he earns revenues precisely because the advertising is targeted to visitors in Virginia.” UMG Recordings, 963 F.3d at 354.12 Other courts have reached similar conclusions. See Doffing v. Meta Platforms, Inc., No. 22-cv-00100, 2022 WL 3357698, at *4 (D. Or. July 20, 2022) (finding, as relevant to purposeful availment, that “Snap tracks Oregon residents by their location and monitors how they use the product so that it can recommend new connections, products, or activities in order to increase user engagement[;] . . . relies heavily on its ability to collect and disclose to its advertisers the personal data and metrics collected from Oregon

residents[;] [and] . . . stores and utilizes incredible amounts of personal information from every Oregon user in a manner and to a degree that jurisdictional jurisprudence could not have imagined as little as ten years ago.”); Alston v. www.calculator.com, 476 F. Supp. 3d 1295, 1315 (S.D. Fla. 2020) (“Regarding Stands4’s purposefully directed activities in Florida, . . . Stands4 lacks a physical presence in Florida, but operates the website often used by Florida residents that

12 Quoting from a Ninth Circuit case, Mavrix Photo, Inc. v. Brand Techs., Inc., 647 F.3d 1218 (9th Cir. 2011), the Fourth Circuit further explained, “‘it is immaterial whether the third-party advertisers or [the defendant] targeted . . . [state] residents,’ . . . [;] [t]he fact that the advertisements targeted . . . [state] residents indicates that [the defendant] knows—either actually or constructively—about its . . . user base [in a given state], and that it exploits that base for commercial gain by selling space on its website for advertisements.” UMG Recordings, 963 F.3d at 354 (quoting Mavrix Photo, 647 F.3d at 1230). generates income solely from advertisement revenue. Moreover, this ad revenue comes in part from advertisements that specifically target Florida users through location-specific ads.”); see also Chien v. Bumble Inc., 641 F. Supp. 3d 913, 928–29 (S.D. Cal. 2022) (finding as relevant to Bumble Trading’s purposeful availment of the California market that it “has collected personal

and location information for the purpose of sending targeted ‘marketing information,’ promotions, and advertisements.”). For the foregoing reasons, the Court concludes that Mr. Rancourt has made a prima facie showing of Meredith’s “knowing receipt of substantial revenue from forum residents,” and thus that Meredith has purposefully availed itself of the Massachusetts market. See Chen, 956 F.3d at 60. ii. Relatedness “To satisfy the relatedness prong, [a plaintiff] must show a nexus between his claim and the defendants’ forum-based activities. That means that ‘[t]he plaintiff’s claims . . . “must arise out of or relate to the defendant’s contacts” with the forum.’” Rodríguez-Rivera v. Allscripts

Healthcare Sols., Inc., 43 F.4th 150, 160–61 (1st Cir. 2022) (first citing A Corp., 812 F.3d at 59; and then quoting Ford Motor Co. v. Mont. Eighth Jud. Dist. Ct., 141 S. Ct. 1017, 1025 (2021)). “To determine relatedness for tort claims under the requirements of the Due Process Clause, [the Court] ‘must probe the causal nexus between the defendant’s contacts and the plaintiff’s cause of action.’” Vapotherm, Inc. v. Santiago, 38 F.4th 252, 260 (1st Cir. 2022) (quoting Phillips Exeter Acad. v. Howard Phillips Fund, 196 F.3d 284, 289 (1st Cir. 1999)). As Meredith pointed out in a notice of supplemental authority, [ECF No. 81], another session of this court recently held that a defendant’s website’s use of so-called “Session Replay” technology, which “causes ‘event data’—meaning the data pertaining to the user’s use of the website, including their mouse movements, clicks, and keystrokes—to be transmitted to a ‘designated third-party server,’” was not sufficiently related to plaintiffs’ privacy-related claims. See Alves v. Goodyear Tire & Rubber Co., No. 22-cv-11820, 2023 WL 4706585, at *2, *4 (D. Mass. July 24, 2023). The court concluded that “the only intentional contact between

[defendant] and Massachusetts that ‘relates to’ the claims at issue is the accessibility of www.goodyear.com from Massachusetts.” Id. at *6 (emphasis in original). To the extent that the interactivity of the website could be relevant to personal jurisdiction (which that court held could be foreclosed by current caselaw), “[t]he interactive features . . . which allow Goodyear to solicit sales from Massachusetts residents and offer Massachusetts residents the ability to schedule services—are unrelated to Goodyear’s use of Session Replay technology and this dispute.” Id. (cleaned up). “In fact, [the court noted] [plaintiff] is not alleged to have purchased tires or scheduled service with a Goodyear store at all.” Id.; see also Rosenthal v. Bloomingdale’s, Inc., No. 22-cv-11944, 2023 WL 5179506, at *3 (D. Mass. Aug. 11, 2023) (finding court lacked jurisdiction over Bloomingdales.com as to plaintiffs’ privacy claims related

to the use of session-replay data on the website, “[b]ecause the complaint[‘s ‘threadbare allegation[s]’] . . . fail[] to identify a ‘demonstrable nexus’ between the plaintiff’s claims and Bloomingdale’s contacts with Massachusetts”). Here, unlike in Alves, Mr. Rancourt has proffered evidence showing that Meredith’s use of advertising and content curation that targets individual Massachusetts residents (as it does residents of other states) increases user engagement with the App, thus allowing Meredith to collect and disclose more of users’ information. The Court finds that this is sufficient for a prima facie showing of relatedness between Meredith’s contacts with Massachusetts and Mr. Rancourt’s claims based on the disclosure of his information. iii. Reasonableness Turning to the last prong of the analysis, the First Circuit has identified the following “Gestalt factors” to guide the reasonableness inquiry: (1) the defendant’s burden of appearing, (2) the forum state’s interest in adjudicating the dispute, (3) the plaintiff’s interest in obtaining convenient and effective relief, (4) the judicial system’s interest in obtaining the most effective resolution of the controversy, and (5) the common interests of all sovereigns in promoting substantive social policies. Pritzker v. Yari, 42 F.3d 53, 63–64 (1st Cir. 1994) (citation omitted). Applying these factors, the Court finds that personal jurisdiction over Meredith is reasonable under the circumstances. The interests of the parties, the judicial system, and all the possible forums where this suit could have been filed ultimately weigh in favor of adjudicating this dispute in Massachusetts. Although the App is nationally available and the VPPA claim might plausibly be filed against Meredith in any U.S. state, Meredith’s appearance as a defendant would be equally burdensome in any other state. In the end, Meredith has not presented any argument demonstrating that the exercise of jurisdiction would be unreasonable in the present circumstances and, absent such argument, see Plixer, 905 F.3d at 12, the exercise of specific personal jurisdiction over Meredith in Massachusetts is reasonable. In sum, Mr. Rancourt has made a prima facie showing that (1) his claims arise out of Meredith’s activity in Massachusetts; (2) Meredith purposefully availed itself of Massachusetts and as such (3) requiring Meredith to appear in Massachusetts is reasonable. This is sufficient for the Court to exercise specific jurisdiction over Meredith. In a footnote, Meredith argues that in light of Bristol-Myers Squibb Co. v. Superior Court of California, 582 U.S. 255 (2017) (“BMS”), “[e]ven if this Court had personal jurisdiction over the ‘subclass’ of Massachusetts residents, it would not have personal jurisdiction over the entire class of U.S.-based users.” [ECF No. 62 at 18 n.10]. The Court joins the circuit courts, see Lyngaas v. Ag., 992 F.3d 412, 435 (6th Cir. 2021); Mussat v. IQVIA, Inc., 953 F.3d 441, 447 (7th Cir. 2020); Fischer v. Fed. Express Corp., 42 F.4th 366, 375 (3d Cir. 2022), as well as “the majority of district courts to have considered the issue,” Waters v. Day & Zimmermann NPS, Inc., 464 F. Supp. 3d 455, 459 (D. Mass. 2020) (collecting cases), and declines to extend BMS,

which involved mass tort actions brought in state court, to this federal class action. Meredith’s motion to dismiss under Rule 12(b)(2) is therefore DENIED.13 III. Rule 12(b)(6) A. Legal Standard Under Rule 12(b)(6), a complaint “must provide ‘a short and plain statement of the claim showing that the pleader is entitled to relief.’” Cardigan Mountain Sch. v. N.H. Ins. Co., 787 F.3d 82, 84 (1st Cir. 2015) (quoting Fed. R. Civ. P. 8(a)(2)). This pleading standard requires “more than labels and conclusions,” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007), and “[t]hreadbare recitals of the elements of a cause of action, supported by mere conclusory statements, do not suffice,” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). Rather, a complaint

“must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’” Id. (quoting Twombly, 550 U.S. at 570). B. Discussion The VPPA provides that “[a] video tape service provider who knowingly discloses, to any person, personally identifiable information concerning any consumer of such provider shall be liable to the aggrieved person . . . .” 18 U.S.C. § 2710(b)(1). Thus, “[t]o allege a violation of

13 In supplemental briefing, Mr. Rancourt also argues that in light of Mallory, 143 S. Ct. and regardless of Meredith’s contacts in Massachusetts, by registering to do business and agreeing to accept service in Massachusetts, Meredith has consented to general jurisdiction. See [ECF No. 84]. Having found prima facie support for the Court’s exercise of personal jurisdiction based on Meredith’s contacts with Massachusetts, the Court does not address this issue. the VPPA, a plaintiff must plead sufficient facts suggesting that a ‘video tape service provider knowingly disclosed, to any person, personally identifiable information concerning any consumer of such provider.’” Adams v. Am.’s Test Kitchen, LP, No. 22-cv-11309, 2023 WL 4304675, at *7 (D. Mass. June 30, 2023) (quoting Ambrose v. Bos. Globe Media Partners, No.

21-cv-10810, 2022 WL 4329373, at *2 (D. Mass. Sept. 19, 2022)). Meredith asserts that Mr. Rancourt is not a “consumer” and that Allrecipes is not a “video tape service provider” under the statute. [ECF No. 62 at 19–25]. Meredith further contends that any alleged user information disclosed to Twilio by Allrecipes was not PII because Meredith did not know that it could be collated to identify a particular app user. [Id. at 26–29]. Finally, Meredith alternatively argues that even if Mr. Rancourt has made each of these showings, Meredith’s disclosure of user information was permissible pursuant to the VPPA’s exception for information disclosed as part of the App’s “ordinary course of business.” [Id. at 29–31]. The Court finds that the sole controlling case shaping the contours of the VPPA in the First Circuit is Yershov v. Gannett Satellite Information (Yershov II), 820 F.3d 482 (1st Cir.

2016); see also Yershov v. Gannett Satellite Info. Network, Inc. (Yershov I), 104 F. Supp.3d 135, 139 (D. Mass. 2015) (Saylor J.). Much like the present case, Yershov involved allegations of the disclosure of personal information of a user of the “USA Today Mobile App” when the user watched a video embedded within the app. Yershov II, 820 F.3d at 484–85. Similar to the Allrecipes App, the USA Today Mobile App in Yershov was a free mobile application that, whenever a video was viewed within the app, sent to a third party (1) the title of the video, (2) the GPS coordinates of the device at the time the video was played, (3) and other user identifiers such as its AAID. Yershov II, 830 F.3d at 484. Mr. Yershov sued alleging violations of the VPPA. Id. Although his claims were initially dismissed because the district court determined that Mr. Yershov was not a “subscriber” under the statute, Yershov I, 104 F. Supp. 3d at 149, the First Circuit reversed, concluding that Mr. Yershov “plausibly pleads a case that the VPPA’s prohibition on disclosure applies,” Yershov II, 820 F.3d at 489. While the First Circuit in Yershov II left several parts of the VPPA unaddressed, the Court nonetheless relies on its

reasoning and conclusion throughout its analysis. 1. Whether Mr. Rancourt is a “Consumer” “Consumer” is defined as “any renter, purchaser, or subscriber of goods or services from a video tape service provider.” 18 U.S.C. § 2710(a)(1). The parties agree that Mr. Rancourt is neither a renter nor a purchaser of the free cooking videos embedded within the App and, instead, focus their arguments on whether he and other App users are “subscribers” under the statute. [ECF No. 62 at 19–21; ECF No. 66-2 at 17–18]. The meaning of “subscriber” under the VPPA was one of the issues that was directly addressed in Yershov II. 820 F.3d at 487–90. The Yershov II court found that Mr. Yershov, a user of the USA Today Mobile App, was a “subscriber” and thus a “consumer” under the statute.

820 F.3d at 487–89. While the First Circuit did not articulate a legal test to help identify the scope of “subscriber,” in reaching its conclusion it (1) examined the statutory text to determine that “subscriber” did not require a monetary payment from the user; (2) focused on the relationship between Mr. Yershov and the USA Today Mobile App, concluding that “Yershov’s decision to download the App seems a fair enough indication that he intended more than a one- shot visit”; and (3) considered the revenue model of the USA Today Mobile App in which users’ data was the payment required to use the app. Id. The Yershov II court also considered, and was seemingly influenced by, an Eleventh Circuit holding that found “subscriber” “involves some type of commitment, relationship, or association (financial or otherwise) between a person and an entity.” Ellis v. Cartoon Network, Inc., 803 F.3d 1251, 1256 (11th Cir. 2015). Referentially citing Yershov I, the Eleventh Circuit determined that “[s]ubscriptions involve some or most of the following factors: payment, registration, commitment, delivery, expressed association, and/or access to restricted content.”

Id. (cleaned up) (citing Yershov I, 104 F. Supp.3d at 147). With this framework in mind, the Court concludes that Mr. Rancourt was a “subscriber” under the VPPA. Mr. Rancourt was required to register for the App and to create an Allrecipes account. His decision to download the App, as opposed to using an internet browser to access Allrecipes content, evidences an intent to have an ongoing relationship or association with the App. The Court is guided by the Yershov II court’s observation that “[w]hile [Mr. Yershov] paid no money, access was not free of a commitment to provide consideration in the form of [personal user] information, which was of value to [the app].” 820 F.3d at 489. Accordingly, the Court is unpersuaded by Meredith’s assertion that subscribing requires a monetary payment by the user, or the distinction Meredith attempts to draw between the Allrecipes App and the USA Today

Mobile App concerning whether the apps required the user to enable location tracking on their phone. [ECF No. 62 at 12–14]. Here, regardless of whether or not Mr. Rancourt was required to enable GPS tracking on his phone to use the App, he nevertheless did so, and Meredith then allegedly profited from the use of Mr. Rancourt’s user data. Pursuant to the factors considered in Yershov II, this is sufficient to establish that Mr. Rancourt was a subscriber under the VPPA. 2. Whether Meredith is a “Video Tape Service Provider” “[T]he term ‘video tape service provider’ means any person, engaged in the business, in or affecting interstate or foreign commerce, of rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials . . . .” 18 U.S.C. § 2710(a)(4) (emphasis added). Meredith argues that the App is not a video tape service provider under the VPPA, because: (1) Allrecipes is not “engaged in the business” of providing video materials because the videos contained on the App are only ancillary to the App’s written cooking instructions, [ECF No. 62 at 22–24], and (2) the video clips embedded in the App are not “prerecorded video cassette tapes

or similar audio visual materials,” [id. at 24–25]. The Court does not find either of these arguments persuasive. i. “Engaged in the Business” of Providing Video Content The plain text of the VPPA evinces an intent by Congress for the phrase “video tape service provider” to encompass more than just local video stores renting feature length films, as Meredith proposes. Congress’ decision to include (1) rental, (2) sale, or (3) delivery is indicative of its intent that the VPPA apply in a broader set of circumstances and, importantly, remain applicable in the digital age when brick and mortar video rental stores are no longer common. See, e.g., In re Hulu Priv. Litig., 86 F. Supp. 3d 1090, 1096–97 (N.D. Cal. 2012). The Court declines to adopt Meredith’s proposed rule requiring the examination of the centrality of the video business as part of the determination of whether a defendant is “engaged

in the business” of video delivery. [ECF No. 62 at 23]. As a practical matter, a centrality test could be difficult to apply and not in keeping with the plain language or the intended scope of the statute. Further, even under the standard articulated in Meredith’s model case, In re Vizio—that is, “the defendant’s product must not only be substantially involved in the conveyance of video content to consumer but also significantly tailored to serve that purpose—it appears that Mr. Rancourt’s complaint would survive a motion to dismiss. 238 F. Supp. 3d 1204, 1221 (C.D. Cal 2017). The App was built in a way that allows users to watch videos within the App. This was not an accidental feature of the App and likely required considerable effort by designers and developers to enable. Even if the Court were to implement Meredith’s proposed rule as articulated in In re Vizio, it would likely find that the App is substantially involved in and significantly tailored to serve video content to its users. Thus, the Court finds that Meredith was “engaged in the business” of providing video content under the VPPA. 18 U.S.C. § 2710(a)(4). ii. Prerecorded Video Cassette Tapes or Similar Audio Visual Materials Similarly, Congress’ inclusion of “prerecorded video cassette tapes or similar audio visual materials” evinces an intent to expand, rather than to limit, the bounds of the statute. 18 U.S.C. § 2710(a)(4) (emphasis added). With no further guidance from the First Circuit on what type of content might be encompassed by “similar audio visual materials,” the Court relies on the reasoning of Yershov II to find that “similar audio visual materials” includes the recipe videos

embedded within the App. Mr. Rancourt and Meredith appear to agree that the VPPA can account for technological advances in how video materials might be delivered and that any medium or format, digital or physical, is covered by the statute. [ECF No. 62 at 25; ECF No. 66-2 at 21–22]. The question, as presented then, is whether the VPPA is nevertheless limited in the content of the videos to which it applies—that is, whether, as Meredith argues, “the only ‘audio visual materials’ covered by the VPPA are those ‘similar’ to the ‘prerecorded video cassette tapes’ available in 1988: feature-length films.” [ECF No. 62 at 24]. The Court finds that such a content-specific limitation would not only be impractical in application, but has no basis in the text, and was not a factor in Yershov I or Yershov II which involved “video clips on various news, sports, and

entertainment topics.” Yershov I, 104 F. Supp. 3d 135. Taking all of Mr. Rancourt’s allegations about the App as true, the Court concludes that he has adequately alleged that Meredith is a “video tape service provider” under the VPPA and that the recipe videos found in the App were “similar audio visual materials.” 3. Whether Meredith Disclosed “Specific Video Materials” Personally identifiable information under the VPPA, “includes information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider.” 18 U.S.C. § 2710(a)(3) (emphasis added). Meredith maintains that

merely disclosing the video ID, a seemingly random number that corresponds to a particular Allrecipes video, does not constitute “specific video materials” because that video ID number, in isolation, does not reveal the substance of the video. [ECF No. 62 at 28]. Mr. Rancourt responds in three parts. First, he asserts that the legislative history of the VPPA indicates that the statute does not require that a specific video be disclosed, but, instead, simply disclosing the subject matter is sufficient for a violation. [ECF No. 66-2 at 24]. Second, Mr. Rancourt contends that it is “reasonably and foreseeably likely” given the close partnership between Meredith and Twilio that Twilio would have been given the ability to interpret the video ID and determine which video it corresponds to. [Id. at 24–25]. Finally, Mr. Rancourt observes that by conducting a Google search querying the video ID along with “Allrecipes,” the substance

of the video becomes immediately evident. [Am. Compl. ¶ 49; ECF No. 66-2 at 25 n.5]. Meredith, again borrowing a standard from another circuit, contends that Mr. Rancourt must allege the disclosure of titles of particular videos or video information that “would, with little or no extra effort, permit an ordinary recipient to identify a particular person’s video- watching habits.” [ECF No. 62 at 26 (quoting In re Nickelodeon Consumer Priv. Litig., 827 F.3d 262, 284–85 (3d Cir. 2016))]. The Court finds that, even under this standard, Mr. Rancourt has sufficiently alleged non-conclusory and non-speculative facts that, if true, mean that the disclosure of the video ID constitutes specific video materials under the statute. Assuming that, as Mr. Rancourt alleges, the title and content of a video on the App can be obtained simply by conducting a Google search of the video ID, Mr. Rancourt has plausibly alleged disclosure of “specific video materials.” 18 U.S.C. § 2710(a)(3). While the video ID itself, as a set of random numbers, is meaningless to an ordinary person, performing a Google search to identify the video constitutes “little or no extra effort” and the Court will not dismiss Mr. Rancourt’s claims

because the content of the video was not disclosed when a Google search is sufficient to determine the identity of the video.14 4. Whether the User Information was PII Courts in and out of this circuit, presented with only slightly dissimilar facts, have resolved the question of whether the user data Meredith disclosed to Twilio is, in fact, PII under the statute quite differently. With the benefit of the First Circuit’s guidance in Yershov II, however, this Court concludes that the user data allegedly disclosed to Twilio is PII under the VPPA. Again, Yershov II is the sole First Circuit case that speaks directly on this question. 820 F.3d 482. As alleged in that case, when a user of the USA Today Mobile App watched a video

embedded in the app, “[a]long with the record of the transaction, the App sen[t] [to a third party] a user’s GPS coordinates and the Android device’s unique identification number (the [AAID]).” Yershov I, 104 F. Supp.3d at 138. Mr. Rancourt alleges Meredith disclosed the same information to Twilio. The Yershov II court recognized that “[m]any types of information other than a name can easily identify a person,” and that “the complaint and its reasonable inferences describe what for

14 The Court makes no finding as to whether, as Mr. Rancourt contends, the VPPA merely requires the subject matter of the video to be disclosed in order for a violation to occur. Additionally, whether or not a back-end program exists that reveals the content or the title of the corresponding cooking video is not central to the Court’s reasoning. very many people is a similar type of identification, effectively revealing the name of the video viewer.” 820 F.3d at 486. The Yershov II court imagined a scenario similar to what Mr. Rancourt now alleges in his complaint and reasoned that, “[g]iven how easy it is to locate a GPS coordinate on a street map[,]” the disclosure “that a person viewed 146 videos on a single device

at 2 sets of specified GPS coordinates . . . would enable most people to identify what are likely the home and work addresses of the viewer (e.g., Judge Bork’s home and the federal courthouse).” Id. (concluding that, “[w]hile there is certainly a point at which the linkage of information to identity becomes too uncertain, or too dependent on too much yet-to-be-done, or unforeseeable detective work, here the linkage, as plausibly alleged, is both firm and readily foreseeable . . .”). The Court recognizes that the First Circuit’s approach in Yershov II might be uniquely permissive in comparison to other circuits. Compare Yershov II with, for example, the Third Circuit’s holding in In re Nickelodeon, where the Third Circuit imagined a spectrum to gauge “what kinds of information are sufficiently ‘personally identifying’ for their disclosure to trigger

liability under the [VPPA].” In re Nickelodeon, 827 F.3d at 282. While “[a]t one of end of the spectrum, of course, is a person’s actual name[,] . . . [f]urther down the spectrum are pieces of information, like social security numbers, which are associated with individual persons but might not be easily matched to such persons . . . .” Id. at 282–83. The user information disclosed in In re Nickelodeon was (1) the user’s IP address, (2) the user’s browser and operating system setting (the “browser fingerprint”), and (3) the computing device’s “unique device identifier.” Id. at 279. The Third Circuit termed these user data “static digital identifiers” and found that they fell “even further down the spectrum” and, by themselves, did not constitute personally identifiable information under the statute. Id. at 283.15 Nevertheless, the Yershov II court found “that the transaction described in the complaint—whereby Yershov used the mobile device application that [the defendant] provided

to him, which gave [defendant] the [1] GPS location of Yershov’s mobile device at the time he viewed a video, [2] his device identifier, and [3] the titles of the videos he viewed in return for access to [defendant’s] video content—plausibly pleads a case that the VPPA’s prohibition on disclosure applies.” 820 F.3d at 489. With the understanding that the App disclosed the same information, if not more, to Twilio, First Circuit precedent requires the Court to conclude that Mr. Rancourt plausibly, for purposes of a motion to dismiss, pleads a case in which the VPPA’s prohibition on disclosure applies. 5. Whether the “Ordinary Course of Business” Exception Applies Finally, the Court addresses whether Meredith’s disclosure of user data was “incident to the ordinary course of business of the video tape service provider,” thereby falling into one of the

VPPA’s exceptions that permits the disclosure of PII. 18 U.S.C. § 2710(b)(2)(E). Meredith asserts that its disclosure of user information to Twilio was part of its order fulfillment or request processing operation. [ECF No. 62 at 29–30]. Mr. Rancourt, on the other hand, claims that the ordinary course of business exception only applies when a video service provider discloses PII

15 See also Ellis v. Cartoon Network, Inc., No. 14-cv-00484, 2014 WL 5023535, at *3 (N.D. Ga 2014) (holding that while, “[t]he Android ID is a randomly generated number that is unique to each user and device[,] [i]t is not, however, akin to a name. Without more, an Android ID does not identify a specific person . . . [and] is not personally identifiable information.”), aff’d on other grounds, 803 F.3d 1251 (11th Cir. 2015); Robinson v. Disney Online, 152 F. Supp. 3d 176, 182–83 (S.D.N.Y 2015) (disclosure of device ID to third party not violation under VPPA); Eichenberger v. ESPN, Inc., No 14-cv-00463, 2015 WL 7252985 at *4–5 (W.D. Wash. 2015) (disclosure of unique Roku device serial number not PII under VPPA). for non-pecuniary ends. [ECF No. 66-2 at 30]. Because Meredith discloses user PII in furtherance of its efforts to “analyze user data, launch marketing campaigns, and target specific users or specific groups or users of advertisements,” Mr. Rancourt argues this disclosure falls outside of the ordinary course of business under the statute. [Id. at 30–31].

The First Circuit has not directly addressed the scope of the ordinary course of business exception. Based on persuasive out-of-circuit caselaw, which comports with caselaw from other district courts in this Circuit, the Court finds that Mr. Rancourt has plausibly alleged activity by Meredith that falls outside of the exception. Nevertheless, the Court remains receptive to arguments by Meredith, on a summary judgment motion after the completion of discovery, that the ordinary course of business exception is applicable. The Court begins with the statutory text, which makes clear that the ordinary course of business “means only debt collection activities, order fulfillment, request processing, and the transfer of ownership.” 18 U.S.C. § 2710(a)(2) (emphasis added). The Court interprets this restrictive language to reflect an intent to limit the scope of the exception to ensure that it does

not become so expansive and flexible that it swallows the general prohibition. In general, the Court concurs with the standard set by the Seventh Circuit, and subsequently adopted by the Ninth Circuit, that intra-corporate disclosures of customer information intended to support the management and operation of the company fall within the ordinary course of business. See Sterk v. Redbox Automated Retail, LLC, 770 F.3d 618, 625 (7th Cir. 2014) (Redbox’s outsourcing of customer service operation and disclosure of customer information to third-party in support of that operation fell into ordinary course of business exception); Rodriguez v. Sony Comput. Ent. Am., LLC, 801 F.3d 1045, 1054–55 (9th Cir 2015) (“intra-corporate disclosures of consumers’ personal information between Sony entities to sustain the operations of the PlayStation Network” was incident to the ordinary course of business). With the Sterk standard in mind, the Court finds that if the disclosure of PII is in furtherance of business management and operations that are intra-corporate or inner facing,

designed to ensure the smooth operation of the business, such as customer support, internal data analytics, or cyber security, it falls under the exception. However, to the extent the PII disclosure is in furtherance of an objective beyond the general upkeep of the operation, the ordinary course of business exception cannot apply. Mr. Rancourt alleges that Meredith “discloses users’ PII to Twilio, through the Segment API, so it can better measure and analyze the App’s performance.” [Am. Compl. ¶ 59]. This disclosure may fall within the ordinary business exception. That said, Mr. Rancourt also alleges that once user information is disclosed to Twilio through the Segment API, “Twilio compiles and transmits that information to other third parties that [Meredith] utilizes for targeted advertising. These third parties include Facebook, Google, and Salesforce.” [Id. ¶ 58]. Meredith’s model of deriving revenue from

targeted advertising goes beyond the management and operations of the business to, as Mr. Rancourt contends, a purely pecuniary end. Cf. Saunders v. Hearst Television, Inc., No. 23-cv- 10998, 2024 WL 126186, at *4 (D. Mass. Jan. 11, 2024) (“The alleged uses of the information here—‘marketing, advertising, and analytics’—do not fall within the exception’s narrow list of permissible uses.” (citing Louth v. NFL Enters. LLC, No. 21-cv-00405, 2022 WL 4130866, at *4 (D.R.I. Sept. 12, 2022) (“disclosing PII to ‘measure analytics and increase advertising revenue’ does not fall within ordinary course of business exception”))). Mr. Rancourt has alleged sufficient facts to support his contention that Meredith, at least in part, discloses the App user data as part of its targeted advertising campaign which is intended to drive revenue. Disclosing this data to companies such as Google, Facebook, and Salesforce in order to better target ads does not constitute an intra-corporate disclosure or a disclosure in support of management operations. The Court declines to find that this disclosure of user data falls within the ordinary business exception.

Mr. Rancourt has thus adequately alleged a VPPA claim. IV. The MVPA Mr. Rancourt’s Amended Complaint alleges that Meredith also violated the MVPA, Mass. Gen. Laws ch. 93, § 106(2). The MVPA prohibits a business “engaged in . . . leasing or renting videos” from “mak[ing] available to a third party records that would indicate the name of the borrower or the title or category of any video leased or rented by a borrower[.]” Mass. Gen. Laws ch. 93, § 106(2). Meredith moves to dismiss under Rule 12(b)(6), asserting that the MVPA is narrower than the VPPA in that it only applies to businesses engaged in “leasing” or “renting” the videos. [ECF No. 62 at 31–32]. Mr. Rancourt did not respond to Meredith’s motion to dismiss Count II of his Amended

Complaint and the Court agrees with Meredith’s contention that the App was not engaged in leasing or renting videos, both of which would require a monetary payment.16 The MVPA is not a heavily litigated statute and the present issue has not yet been addressed. Nevertheless, the Court finds, based on the text of the statute, that the App was not engaged in the business of leasing or renting videos. Meredith’s motion to dismiss Count II of Mr. Rancourt’s Amended Complaint is therefore GRANTED.

16 “Leasing” means “to grant the temporary possession or use of (lands, tenements, etc.) to another, usually for compensation at a fixed rate.” Leasing, Dictionary.com, https://www.dictionary.com/browse/lease (last visited Jan. 26, 2024). To “rent” means “to take and hold (property, machinery, etc.) in return for the payment of rent to the landlord or owner.” Rent, Dictionary.com, https://www.dictionary.com/browse/rent (last visited Jan. 26, 2024). V. CONCLUSION For the foregoing reasons, Meredith’s motion is GRANTED in part and DENIED in part. Meredith’s motion to dismiss Count II is GRANTED and its motion to dismiss Count I is DENIED.

SO ORDERED.

February 1, 2024 /s/ Allison D. Burroughs ALLISON D. BURROUGHS U.S. DISTRICT JUDGE