Salazar v. NBA
This text of 118 F.4th 533 (Salazar v. NBA) is published on Counsel Stack Legal Research, covering Court of Appeals for the Second Circuit primary law. Counsel Stack provides free access to over 12 million legal documents including statutes, case law, regulations, and constitutions.
Opinion
23-1147 Salazar v. NBA
In the United States Court of Appeals For the Second Circuit
August Term, 2023
(Argued: April 2, 2024 Decided: October 15, 2024)
Docket No. 23-1147
MICHAEL SALAZAR, INDIVIDUALLY AND ON BEHALF OF ALL OTHERS SIMILARLY SITUATED,
Plaintiff-Appellant,
–v.–
NATIONAL BASKETBALL ASSOCIATION,
Defendant-Appellee.
Before: RAGGI, LEE, and ROBINSON, Circuit Judges.
Plaintiff-Appellant Michael Salazar appeals from an August 8, 2023 judgment of the United States District Court for the Southern District of New York (Rochon, J.) dismissing his putative class action complaint against Defendant-Appellee the National Basketball Association (NBA) for alleged violations of the Video Privacy Protection Act (VPPA), 18 U.S.C. § 2710. The VPPA makes it unlawful for a “video tape service provider” to “knowingly disclose[], to any person, personally identifiable information concerning any consumer of such provider.” 18 U.S.C. § 2710(b)(1). The statute defines “consumer” to mean “any renter, purchaser, or subscriber of goods or services from a video tape service provider.” Id. § 2710(a)(1). It does not define the terms “goods or services” and “subscriber.”
Salazar alleges that (1) he signed up for the NBA’s free online newsletter, meaning he exchanged information including his email address in return for periodic emails from the NBA; (2) he visited the NBA’s website, NBA.com, where he watched videos; and (3) the NBA violated the VPPA by knowingly disclosing, without Salazar’s permission, certain information about Salazar and the videos he watched.
We must answer two questions on appeal. First, has Salazar pled that he suffered a sufficiently “concrete” injury to confer Article III standing under TransUnion LLC v. Ramirez, 594 U.S. 413 (2021)? Second, did the district court err in holding that Salazar is not a “subscriber of goods or services” based on its reasoning that the online newsletter is not an audiovisual “good or service,” and that signing up for the newsletter did not make Salazar a VPPA “subscriber”?
We answer both questions in the affirmative. Salazar’s alleged injuries are sufficiently concrete to confer Article III standing. And the district court erred by holding that Salazar is not a “subscriber of goods or services” from the NBA. Accordingly, we VACATE the district court’s judgment and REMAND for further proceedings.
JOSHUA I. HAMMACK (Michael L. Murphy, on the brief), Bailey & Glasser, LLP, Washington, D.C., for Plaintiff-Appellant.
MATTHEW X. ETCHEMENDY, Vinson & Elkins LLP, Washington, D.C. (Hilary L. Preston, Marisa Antonelli, Vinson & Elkins LLP, New York, NY, on the brief), for Defendant-Appellee.
Jordan L. Von Bokern, U.S. Chamber Litigation Center, Washington, D.C.; Adam G. Unikowsky, Jenner & Block LLP, Washington, D.C.; Allison N. 2 Douglis, Jenner & Block LLP, New York, NY, for Amicus Curiae The Chamber of Commerce of the United States of America, in Support of Defendant- Appellee.
ROBINSON, Circuit Judge:
The Video Privacy Protection Act (VPPA) makes it unlawful for a “video
tape service provider” to “knowingly disclose[], to any person, personally
identifiable information concerning any consumer of such provider.” 18 U.S.C.
§ 2710(b)(1). Enacted in 1988, the VPPA includes language like “video tape service
provider” and “prerecorded video cassette tapes”—terms that invoke a bygone
era of video technology. In this case, we must grapple with how the language of
this statute applies in today’s increasingly online world.
Plaintiff-Appellant Michael Salazar says he signed up for an online email
newsletter offered by Defendant-Appellee the National Basketball Association
(NBA). He further alleges he visited the NBA’s website, NBA.com, where he
watched videos. After he watched those videos, his video-watching history and
“Facebook ID” (we describe both below) were disclosed to Meta Platforms, Inc.
(Meta) without his permission. Those disclosures, Salazar contends, violated the
VPPA.
3 The central question in this appeal is whether Salazar is a “consumer” under
the VPPA so that the knowing disclosure by a video tape service provider of his
video viewing history violates that statute. The VPPA defines “consumer” to
mean “any renter, purchaser, or subscriber of goods or services from a video tape
service provider.” Id. § 2710(a)(1). But the Act doesn’t define most of the words
within that definition, including “goods or services” and “subscriber.” We must
construe both these terms for the first time in this Circuit.
Salazar contends that when he signed up for the NBA’s online newsletter
through NBA.com, he exchanged personal information in return for emailed NBA-
related updates, thereby making him a “subscriber of goods or services,” and,
accordingly, a VPPA “consumer.” And by offering videos on NBA.com, the NBA
became a “video tape service provider” prohibited by the VPPA from disclosing
the personally identifiable information of consumers like Salazar. So, Salazar
submits, when he watched NBA.com videos, and when the NBA then disclosed
his Facebook ID and video-watching history to Meta without his consent, the NBA
violated the VPPA.
The NBA counters that Salazar is not a VPPA “consumer” because the
online newsletter he signed up for is not an audiovisual “good or service,” and
signing up for the newsletter did not in any event make him a “subscriber” under
4 the statute. It also asserts that Salazar has not pled a sufficiently “concrete” injury
to confer Article III standing under the standards set forth by the Supreme Court
in TransUnion LLC v. Ramirez, 594 U.S. 413 (2021).
The United States District Court for the Southern District of New York
(Rochon, J.) dismissed Salazar’s suit in an August 8, 2023 judgment. Although it
concluded that Salazar had standing to sue, it ruled for the NBA on the merits,
holding that Salazar had not plausibly pled that he is a “consumer” under the
VPPA. The court held that the phrase “goods or services” within the VPPA’s
definition of “consumer” is limited to audiovisual “goods or services”—which the
online newsletter is not—and that signing up for an online newsletter did not
make Salazar a VPPA “subscriber.” See generally Salazar v. National Basketball
Association, 685 F. Supp. 3d 232 (S.D.N.Y. 2023).
As a threshold matter, we hold that Salazar has pled an injury that confers
Article III standing. His core alleged harm—that his personal information was
disclosed to a third party, without his consent, in violation of the VPPA—“has a
‘close relationship’ to a harm traditionally recognized as providing a basis for a
lawsuit in American courts”: public disclosure of private facts. TransUnion, 594
U.S. at 417. Salazar’s injury therefore satisfies Article III standing’s concreteness
requirement.
5 On the merits, we hold that the district court erred in determining that
Salazar failed to plausibly plead that he is a “consumer” under the VPPA because
we conclude that he satisfactorily alleged he was a “subscriber of goods or
services” from the NBA. The VPPA’s text, structure, and purpose compel the
conclusion that that phrase is not limited to audiovisual “goods or services,” and
the NBA’s online newsletter falls within the plain meaning of that phrase. And by
Free access — add to your briefcase to read the full text and ask questions with AI
23-1147 Salazar v. NBA
In the United States Court of Appeals For the Second Circuit
August Term, 2023
(Argued: April 2, 2024 Decided: October 15, 2024)
Docket No. 23-1147
MICHAEL SALAZAR, INDIVIDUALLY AND ON BEHALF OF ALL OTHERS SIMILARLY SITUATED,
Plaintiff-Appellant,
–v.–
NATIONAL BASKETBALL ASSOCIATION,
Defendant-Appellee.
Before: RAGGI, LEE, and ROBINSON, Circuit Judges.
Plaintiff-Appellant Michael Salazar appeals from an August 8, 2023 judgment of the United States District Court for the Southern District of New York (Rochon, J.) dismissing his putative class action complaint against Defendant-Appellee the National Basketball Association (NBA) for alleged violations of the Video Privacy Protection Act (VPPA), 18 U.S.C. § 2710. The VPPA makes it unlawful for a “video tape service provider” to “knowingly disclose[], to any person, personally identifiable information concerning any consumer of such provider.” 18 U.S.C. § 2710(b)(1). The statute defines “consumer” to mean “any renter, purchaser, or subscriber of goods or services from a video tape service provider.” Id. § 2710(a)(1). It does not define the terms “goods or services” and “subscriber.”
Salazar alleges that (1) he signed up for the NBA’s free online newsletter, meaning he exchanged information including his email address in return for periodic emails from the NBA; (2) he visited the NBA’s website, NBA.com, where he watched videos; and (3) the NBA violated the VPPA by knowingly disclosing, without Salazar’s permission, certain information about Salazar and the videos he watched.
We must answer two questions on appeal. First, has Salazar pled that he suffered a sufficiently “concrete” injury to confer Article III standing under TransUnion LLC v. Ramirez, 594 U.S. 413 (2021)? Second, did the district court err in holding that Salazar is not a “subscriber of goods or services” based on its reasoning that the online newsletter is not an audiovisual “good or service,” and that signing up for the newsletter did not make Salazar a VPPA “subscriber”?
We answer both questions in the affirmative. Salazar’s alleged injuries are sufficiently concrete to confer Article III standing. And the district court erred by holding that Salazar is not a “subscriber of goods or services” from the NBA. Accordingly, we VACATE the district court’s judgment and REMAND for further proceedings.
JOSHUA I. HAMMACK (Michael L. Murphy, on the brief), Bailey & Glasser, LLP, Washington, D.C., for Plaintiff-Appellant.
MATTHEW X. ETCHEMENDY, Vinson & Elkins LLP, Washington, D.C. (Hilary L. Preston, Marisa Antonelli, Vinson & Elkins LLP, New York, NY, on the brief), for Defendant-Appellee.
Jordan L. Von Bokern, U.S. Chamber Litigation Center, Washington, D.C.; Adam G. Unikowsky, Jenner & Block LLP, Washington, D.C.; Allison N. 2 Douglis, Jenner & Block LLP, New York, NY, for Amicus Curiae The Chamber of Commerce of the United States of America, in Support of Defendant- Appellee.
ROBINSON, Circuit Judge:
The Video Privacy Protection Act (VPPA) makes it unlawful for a “video
tape service provider” to “knowingly disclose[], to any person, personally
identifiable information concerning any consumer of such provider.” 18 U.S.C.
§ 2710(b)(1). Enacted in 1988, the VPPA includes language like “video tape service
provider” and “prerecorded video cassette tapes”—terms that invoke a bygone
era of video technology. In this case, we must grapple with how the language of
this statute applies in today’s increasingly online world.
Plaintiff-Appellant Michael Salazar says he signed up for an online email
newsletter offered by Defendant-Appellee the National Basketball Association
(NBA). He further alleges he visited the NBA’s website, NBA.com, where he
watched videos. After he watched those videos, his video-watching history and
“Facebook ID” (we describe both below) were disclosed to Meta Platforms, Inc.
(Meta) without his permission. Those disclosures, Salazar contends, violated the
VPPA.
3 The central question in this appeal is whether Salazar is a “consumer” under
the VPPA so that the knowing disclosure by a video tape service provider of his
video viewing history violates that statute. The VPPA defines “consumer” to
mean “any renter, purchaser, or subscriber of goods or services from a video tape
service provider.” Id. § 2710(a)(1). But the Act doesn’t define most of the words
within that definition, including “goods or services” and “subscriber.” We must
construe both these terms for the first time in this Circuit.
Salazar contends that when he signed up for the NBA’s online newsletter
through NBA.com, he exchanged personal information in return for emailed NBA-
related updates, thereby making him a “subscriber of goods or services,” and,
accordingly, a VPPA “consumer.” And by offering videos on NBA.com, the NBA
became a “video tape service provider” prohibited by the VPPA from disclosing
the personally identifiable information of consumers like Salazar. So, Salazar
submits, when he watched NBA.com videos, and when the NBA then disclosed
his Facebook ID and video-watching history to Meta without his consent, the NBA
violated the VPPA.
The NBA counters that Salazar is not a VPPA “consumer” because the
online newsletter he signed up for is not an audiovisual “good or service,” and
signing up for the newsletter did not in any event make him a “subscriber” under
4 the statute. It also asserts that Salazar has not pled a sufficiently “concrete” injury
to confer Article III standing under the standards set forth by the Supreme Court
in TransUnion LLC v. Ramirez, 594 U.S. 413 (2021).
The United States District Court for the Southern District of New York
(Rochon, J.) dismissed Salazar’s suit in an August 8, 2023 judgment. Although it
concluded that Salazar had standing to sue, it ruled for the NBA on the merits,
holding that Salazar had not plausibly pled that he is a “consumer” under the
VPPA. The court held that the phrase “goods or services” within the VPPA’s
definition of “consumer” is limited to audiovisual “goods or services”—which the
online newsletter is not—and that signing up for an online newsletter did not
make Salazar a VPPA “subscriber.” See generally Salazar v. National Basketball
Association, 685 F. Supp. 3d 232 (S.D.N.Y. 2023).
As a threshold matter, we hold that Salazar has pled an injury that confers
Article III standing. His core alleged harm—that his personal information was
disclosed to a third party, without his consent, in violation of the VPPA—“has a
‘close relationship’ to a harm traditionally recognized as providing a basis for a
lawsuit in American courts”: public disclosure of private facts. TransUnion, 594
U.S. at 417. Salazar’s injury therefore satisfies Article III standing’s concreteness
requirement.
5 On the merits, we hold that the district court erred in determining that
Salazar failed to plausibly plead that he is a “consumer” under the VPPA because
we conclude that he satisfactorily alleged he was a “subscriber of goods or
services” from the NBA. The VPPA’s text, structure, and purpose compel the
conclusion that that phrase is not limited to audiovisual “goods or services,” and
the NBA’s online newsletter falls within the plain meaning of that phrase. And by
trading personal information like his email and IP addresses in return for receiving
the online newsletter, Salazar became a “subscriber of” that newsletter.
Accordingly, we VACATE the district court’s judgment and REMAND for further
proceedings.
6 BACKGROUND 1
I. The NBA, NBA.com, the “Facebook Pixel,” and the NBA’s Online Newsletter
The NBA is a professional sports league headquartered in New York. It
owns the website NBA.com, on which people can watch “a broad selection of
video content.” Jt. App’x at 10. 2 The NBA says these videos are free.
Salazar doesn’t allege that he had to pay any money to watch the videos. But
he does plead that the NBA, using certain bits of code, extracts information from
NBA.com video-watchers like him.
The code most relevant to this case is a “tracking pixel”—a piece of code
embedded on a website someone visits. As its name suggests, a tracking pixel
tracks users as they navigate the website, reporting back to the pixel’s owner. The
information tracked depends on the tracking pixel’s configuration.
1Unless otherwise indicated, we draw this account from the allegations in Salazar’s Class Action Complaint. Since we are evaluating the NBA’s motion to dismiss for failure to state a claim, we presume these allegations to be true. See Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009).
2 Salazar also alleges that people can watch these videos through a smartphone application (app). The district court concluded that Salazar “does not allege he downloaded any such application, or even specify what application he is referring to,” so “no such claim [based on use of the app] has been adequately pleaded.” Salazar v. National Basketball Association, 685 F. Supp. 3d 232, 246 n.4 (S.D.N.Y. 2023). Beyond cursorily noting that the NBA delivers video content “[t]hrough NBA.com and an app,” Salazar doesn’t challenge that conclusion on appeal. Appellant’s Br. at 5. He therefore has abandoned any challenges based on the allegations concerning a smartphone application as opposed to a website. See United States v. Quiroz, 22 F.3d 489, 490 (2d Cir. 1994) (“It is well established that an argument not raised on appeal is deemed abandoned[.]” (internal quotation marks omitted)).
7 Here, Salazar alleges that Meta owns a tracking pixel, which we call the
“Facebook Pixel.” The NBA has installed the Facebook Pixel on NBA.com. Meta
coded that pixel to collect and send to it (1) the title of the NBA.com video a user
watched, (2) that video’s URL, and (3) the user’s “Facebook ID” (FID)—a number
unique to each individual Facebook account. Id. at 15. We call this disclosed
information “personal viewing information.”
By possessing the video title and URL of watched videos associated with a
given FID, Meta can link a given Facebook profile to those watched videos. And
with that information, Meta can send a user targeted advertisements. The NBA
receives financial renumeration from this arrangement.
The NBA also allows people to sign up for an “online newsletter.” Id. at 12.
Here too, Salazar doesn’t contend that he had to pay any money to sign up for the
newsletter. Instead, he alleges that he gave the NBA certain personal information,
and in return, the NBA sent him “emails and other communications.” Id. at 12, 19.
II. Salazar’s Allegations
Salazar’s VPPA claim rests on three primary allegations: (1) he has a
Facebook account; (2) he signed up for the NBA’s online newsletter; and (3) he
watched NBA.com videos while logged into his Facebook account.
8 First, since 2010, Salazar “has had a Facebook account.” Id. at 10, 20. He
therefore has an FID associated with that account.
Second, starting in 2022, Salazar “signed up for a digital subscription to
NBA.com.” Salazar, 685 F. Supp. 3d at 237; see also Jt. App’x at 10, 19–20. In doing
so, he gave NBA.com information including his email address, IP address, “and
any cookies associated with his device” in return for “emails and other
communications” from the NBA. Jt. App’x at 19.
An IP address is “the numeric address of a computer on the Internet” that
typically consists of “four parts separated by dots and containing up to three digits
in each part.” IP Address, Merriam-Webster’s Unabridged Dictionary,
https://unabridged.merriam-webster.com/unabridged/ip%20address
[https://perma.cc/8DK2-U6F9] (last visited Sept. 4, 2024). Salazar alleges that his
IP address “informs Defendant as to the city and zip code he resides in as well as
his physical location.” Jt. App’x at 19.
A “cookie” is “a small file or part of a file that is stored on the computer of
a World Wide Web user, that is created and subsequently read by a website server,
and that contains personal user information (such as a user identification code,
customized preferences, or a record of pages visited).” Cookie, Merriam-Webster’s
Unabridged Dictionary, https://unabridged.merriam-
9 webster.com/unabridged/cookie [https://perma.cc/GFE3-ALB9] (last visited Sept.
4, 2024).
There are presently no allegations in Salazar’s complaint that he watched or
accessed NBA.com videos through the online newsletter. He has, however,
submitted that he could amend his complaint to plausibly allege that “the NBA’s
online newsletter gave subscribers ‘exclusive content or enhanced access’ to video
content.” Appellant’s Br. at 34–35 (quoting Jt. App’x at 210).
Third, also starting in 2022, Salazar has watched NBA.com videos through
NBA.com “while logged into his Facebook account.” Jt. App’x at 10. Watching
videos while logged into his Facebook account caused his personal viewing
information to be transmitted to Meta. 3 See id. Salazar alleges that the NBA didn’t
give him notice that it was disclosing his personal viewing information; nor did it
ask for his consent.
Putting the pieces together, Salazar alleges that signing up for the online
newsletter made him a “subscriber of goods or services,” and, therefore, a
3 Salazar’s complaint specifies that when he watched NBA.com videos “while logged into his Facebook account,” his personal viewing information was disclosed to Meta due to the website’s use of the Facebook Pixel. Jt. App’x at 10, 15–16. For purposes of this appeal, we need not delve into the technical mechanics of that disclosure. It is enough to presume that what Salazar alleges is true—when he (1) was logged into his Facebook account and (2) watched a video on NBA.com, his personal viewing information was transmitted to Meta because the NBA had installed the Facebook Pixel on its website.
10 “consumer” under the VPPA. And watching videos on NBA.com caused his
“personally identifiable information”—his personal viewing information—to be
disclosed to Meta without his consent. So, Salazar says, the NBA violated the
III. District Court Proceedings
Salazar filed his putative class action complaint in September 2022,
purporting to represent “[a]ll persons in the United States with a digital
subscription to an online website owned and/or operated by [the NBA] that had
their Personal Viewing Information disclosed to [Meta] by [the NBA].” Id. at 20.
He raised a single cause of action: violation of the VPPA.
The NBA moved to dismiss pursuant to Federal Rules of Civil Procedure
12(b)(1) and 12(b)(6). It sought dismissal under Rule 12(b)(1) for lack of subject
matter jurisdiction because Salazar did not allege a sufficiently concrete injury to
confer Article III standing, and alternatively under Rule 12(b)(6) because Salazar
failed to state a claim upon which relief can be granted.
On the merits, the NBA primarily argued that Salazar was not a “consumer”
under the VPPA since he was not a “renter, purchaser, or subscriber of goods or
services from a video tape service provider.” Id. at 49 (quoting 18 U.S.C.
§ 2710(a)(1)). It stressed that the online newsletter was not an audiovisual good or
11 service, and thus did not qualify as “goods or services” under the VPPA. And it
argued that, in any event, signing up for the newsletter did not make him a VPPA
“subscriber.” The NBA also argued in the alternative that it did not “knowingly
disclose” any personally identifiable information to Meta. 4
In an August 2023 opinion, the district court denied the NBA’s motion to
dismiss for lack of standing but granted its motion to dismiss for failure to state a
claim. See Salazar, 685 F. Supp. 3d at 247.
With respect to Article III standing, the court explained that Salazar’s
alleged harm—deprivation of privacy rights based on the NBA’s non-consensual
disclosure of his personal viewing information—was closely related to two
4We express no view on whether the NBA’s disclosure, as alleged by Salazar, constitutes a “knowing[]” disclosure by the NBA. 18 U.S.C. § 2710(b)(1).
The NBA also argued in the alternative to the district court that Salazar had consented to disclosure of his personally identifiable information by assenting to the NBA’s privacy policy. Salazar concedes that NBA.com’s privacy policy states that it collects certain “Personal Information” from site visitors. But he contends that this policy doesn’t say that the NBA “will share digital subscribers’ private and protected Personal Viewing Information with third parties, including [Meta].” Jt. App’x at 14–15. As a result, he alleges, the NBA failed to satisfy the VPPA’s consent requirements. The NBA does not raise this argument on appeal and concedes the argument should be left for the district court to address in the first instance given that its resolution will require “detailed examination of the NBA’s Privacy Policy and Mr. Salazar’s factual allegations showing his acceptance of that policy.” Appellee’s Br. at 52 n.16. We agree.
The NBA also argued before the district court that it should dismiss Salazar’s class allegations because the NBA’s Terms of Use provision, to which it says Salazar agreed, includes an enforceable class action waiver. The NBA concedes here that this “argument is not an alternative basis for affirming the” court’s dismissal “of the entire complaint,” so “it is not properly resolved on this appeal.” Id. Accordingly, this argument is not before us in this appeal.
12 traditionally recognized common-law analogs: disclosure of private facts and
intrusion upon seclusion. See id. at 239–42. Accordingly, the court held that
Salazar pled a concrete Article III injury under TransUnion. Id. at 242.
On the merits, the court concluded that Salazar failed to plead a VPPA claim
because he had not plausibly alleged that he was a VPPA “consumer.” Id. at 246.
It rejected Salazar’s argument that his signing up for the online newsletter made
him a “subscriber” under the VPPA, reasoning that “the VPPA only applies to
consumers (including subscribers) of audio video services.” Id. at 244. The court
also rejected Salazar’s argument that the newsletter’s links to videos available on
NBA.com affect the calculus. It reasoned that the newsletter’s inclusion of links to
content otherwise “generally accessible on the NBA.com website” did not
constitute a sufficient exchange of value to create a subscriber relationship “given
the lack of allegations regarding exclusive content or enhanced access” to
audiovisual services through the newsletter. Id. at 245–46.
Because the court concluded that Salazar had not plausibly alleged that he
was a VPPA “consumer,” it did not address the NBA’s remaining arguments. Id.
at 246. It further denied Salazar’s “blanket request for leave to amend his
Complaint ‘to address any issues the Court raises in its Order’” since Salazar had
the opportunity to view the NBA’s arguments for dismissal and didn’t describe
13 the substance of a proposed amendment. Id. at 246–47. The court therefore
entered judgment dismissing the case, which Salazar timely appealed.
DISCUSSION
The NBA argues that the district court erred by concluding that Salazar has
Article III standing to sue. Salazar contends that the court erred on the merits by
holding that he is not a “consumer” as defined in the VPPA.
We hold that Salazar sufficiently pled that he has Article III standing and
that he is a “subscriber of goods or services from a video tape service provider”
and therefore a “consumer” under the VPPA. 28 U.S.C. § 2710(a)(1). We elaborate
below.
I. Standing
We start by evaluating whether Salazar has adequately pled injury as
necessary to demonstrate Article III standing to sue for a violation of the VPPA.
He has. Salazar’s alleged injury stems from the unauthorized disclosure of his
personal viewing information, which is closely related to at least one common-law
analog traditionally recognized as providing a basis for a lawsuit in American
courts: public disclosure of private facts.
Since “standing is challenged on the basis of the pleadings, we accept as true
all material allegations of the complaint,” which we construe “in favor of the
14 complaining party.” Bohnak v. Marsh & McLennan Companies, Inc., 79 F.4th 276, 283
(2d Cir. 2023) (internal quotation marks omitted). We do so in this context without
deferring to the district court. Id.
A federal court lacks subject matter jurisdiction—and therefore cannot
consider a lawsuit’s merits—unless three constitutional standing requirements are
met. First, the plaintiff must have suffered an “injury in fact that is concrete,
particularized, and actual or imminent.” TransUnion, 594 U.S. at 423. Second, that
injury must be traceable to the defendant’s challenged conduct—it must have been
“likely caused by the defendant.” Id. And third, it must be likely that the injury
would “be redressed by judicial relief.” Id. As “[t]he party invoking federal
jurisdiction,” Salazar bears the burden of establishing Article III standing. Lujan
v. Defenders of Wildlife, 504 U.S. 555, 561 (1992).
The NBA argues that Salazar has not alleged that he has suffered a
“concrete” injury in fact. We disagree.
Article III standing requires that “[o]nly those plaintiffs who have been
concretely harmed by a defendant’s statutory violation may sue that private
defendant over that violation in federal court.” TransUnion, 594 U.S. at 427; see also
Bohnak, 79 F.4th at 283 (explaining that “TransUnion is the touchstone for”
assessing the concreteness requirement). To allege a concrete harm, a plaintiff
15 must point to “a close historical or common-law analogue for their asserted
injury.” TransUnion, 594 U.S. at 424. But they need not present an “exact
duplicate.” Id. at 433. Rather, “what matters is ‘whether the alleged injury to the
plaintiff has a ‘close relationship’ to a harm ‘traditionally’ recognized as providing
a basis for a lawsuit in American courts.’” Packer on behalf of 1-800-Flowers.Com,
Inc. v. Raging Capital Management, LLC, 105 F.4th 46, 52 (2d Cir. 2024) (quoting
TransUnion, 594 U.S. at 424).
Both tangible and intangible harms can satisfy the concreteness
requirement. “[T]raditional tangible harms” like physical and monetary harms
“readily qualify as concrete.” TransUnion, 594 U.S. at 425. So do “[v]arious
intangible harms” closely related to a traditionally recognized harm. Id.
One intangible harm that readily qualifies as concrete is the public
disclosure of private facts. Id. This “well-established common-law analog,”
Bohnak, 79 F.4th at 285, is triggered when one “gives publicity to a matter
concerning the private life of another, . . . if the matter publicized is of a kind that
16 (a) would be highly offensive to a reasonable person, and (b) is not of legitimate
concern to the public,” id. (quoting Restatement (Second) Torts § 652D). 5
Our conclusion that Salazar has pled that he suffered an injury closely
related to the public disclosure of private facts analog is guided by our recent
decision in Bohnak. There, Bohnak had sued her former employer for failing to
adequately protect and warn her about the vulnerability of personal information
including her social security number, driver’s license, and passport information.
That information was stolen when her employer was targeted in a data breach. Id.
at 280–82.
We had “no trouble” concluding that “Bohnak’s alleged harm [wa]s
sufficiently concrete to support her claims for damages” because her core alleged
injury—exposure of her personally identifiable information to unauthorized third
parties—“bears some relationship to a well-established common-law analog:
public disclosure of private facts.” Id. at 285. In reaching this conclusion, we
stressed that “[i]n TransUnion itself, the Supreme Court specifically recognized
5Because we hold that Salazar’s alleged harm is closely related to the public disclosure of private facts analog, we need not examine whether it is closely related to the other analog the district court identifies: the “intrusion upon seclusion” tort. Cf. Eichenberger v. ESPN, Inc., 876 F.3d 979, 983–84 (9th Cir. 2017) (holding, pre-TransUnion, that an alleged VPPA violation was related to the intrusion upon seclusion tort); Perry v. Cable News Network, Inc., 854 F.3d 1336, 1340–41 (11th Cir. 2017) (same).
17 that ‘disclosure of private information’ was an intangible harm ‘traditionally
recognized as providing a basis for lawsuits in American courts.’” Id. at 286
(quoting TransUnion, 594 U.S. at 425). And because Bohnak’s alleged harm was
closely related to a common-law analog, it did not matter whether she had
“assert[ed] a common law claim for public disclosure of private facts” against her
employer or whether the relevant “common law recognize[d] a tort relating to
publication of private facts.” Id. at 286.
For these reasons, we similarly have “no trouble” holding here that Salazar’s
alleged harm is sufficiently concrete to withstand dismissal. Id. at 285. Like
Bohnak, Salazar’s core allegation is that his personally identifiable information
was exposed to an unauthorized third party. Jt. App’x at 24. And Salazar doesn’t
just allege that his data was exposed to a third party; rather, he asserts that it was
disclosed as a result of an arrangement between the NBA and Meta pursuant to
which the NBA deliberately uses the Facebook Pixel. This alleged harm is closely
related to the public disclosure of private facts analog.
The NBA’s arguments to the contrary are unpersuasive. To the NBA, the
disclosure in Bohnak—to hackers through a data breach—is quite different from
“limited disclosures to a single legitimate business” like Meta because hackers
have a “known penchant for trading illegally acquired [personally identifiable
18 information] ‘through the dark web,’” thereby making the disclosure in Bohnak
more analogous to a public disclosure of private facts than the disclosure of
Salazar’s information to Meta. Appellee’s Br. at 24 n.7 (quoting Bohnak, 79 F.4th at
281).
Based on this asserted lack of publicity, the NBA insists that Salazar’s
allegations of injury are more like those held insufficient in cases from other
circuits involving mail vendor corporations and a different statute: the Fair Debt
Collection Practices Act (FDCPA). In those cases, plaintiffs sued debt collection
agencies for violating the FDCPA by giving their personal information to mail
vendors, which then used the disclosed information to send the plaintiffs
prewritten letters notifying them about their outstanding debts. See Appellee’s Br.
at 21–25 (citing Hunstein v. Preferred Collection & Management Services, Inc., 48 F.4th
1236, 1240 (11th Cir. 2022) (en banc); Shields v. Professional Bureau of Collections of
Maryland, Inc., 55 F.4th 823, 827 (10th Cir. 2022); Nabozny v. Optio Solutions LLC, 84
F.4th 731, 733 (7th Cir. 2023). 6 These courts concluded that any harm from such
6The NBA also cites some of these cases to suggest that an alleged harm isn’t closely related to a common-law analog if the plaintiff doesn’t plead a required element of that analog. See, e.g., Hunstein v. Preferred Collection and Management Services, Inc., 48 F.4th 1236, 1242 (11th Cir. 2022)
19 limited disclosures—to mail vendors who then sent the information back to its
owner—was not closely related to harm from the public disclosure of private facts
analog. See Hunstein, 48 F.4th at 1245–49; Shields, 55 F.4th at 828–29; Nabozny, 84
F.4th at 735–38.
(en banc) (holding that Hunstein’s alleged harm wasn’t closely related to the public disclosure of private facts tort because his allegations were “missing an element essential to liability”: “disclosure to the public”) (internal quotation marks omitted). Not every circuit has adopted that approach. See, e.g., Shields v. Professional Bureau of Collections of Maryland, Inc., 55 F.4th 823, 829 (10th Cir. 2022) (“Shields did not have to plead and prove the tort’s elements to prevail. But to proceed, she had to at least allege a similar harm.”); Barclift v. Keystone Credit Services, LLC, 93 F.4th 136, 145 (3d Cir. 2024) (“We believe that if the Court wanted us to compare elements, it would have simply said so. So when asking whether a plaintiff’s intangible injury is ‘concrete,’ we will examine the kind of harm at issue.”), petition for cert. filed, No. 23-1327 (June 20, 2024).
Nor have we. This Court has applied TransUnion in at least four published opinions to determine whether an alleged harm satisfies Article III standing’s concreteness requirement. We did not, in any of those cases, hold that TransUnion demands that a plaintiff adequately plead every element of a common-law analog to satisfy the concreteness requirement. See Maddox v. Bank of New York Mellon Trust Company, N.A., 19 F.4th 58, 62–66 (2d Cir. 2021); Bohnak v. Marsh & McLennan Companies, Inc., 79 F.4th 276, 283–87 (2d Cir. 2023); Saba Capital Cef Opportunities 1, Ltd. v. Nuveen Floating Rate Income Fund, 88 F.4th 103, 114–17 (2d Cir. 2023); Packer on behalf of 1-800 Flowers.Com, Inc. v. Raging Capital Management, LLC, 105 F.4th 46, 51–56 (2d Cir. 2024); see also Stafford v. International Business Machines Corporation, 78 F.4th 62, 67–69 (2d Cir. 2023) (applying TransUnion to the mootness doctrine, which “is standing set in a time frame”) (internal quotation marks omitted). Instead, we followed the Supreme Court’s directive in TransUnion that the concrete injury requirement for standing does not demand that a plaintiff alleging intangible harm identify and establish an “exact duplicate” in common law, but asks “whether a plaintiff’s asserted harm has a ‘close relationship’ to a harm traditionally recognized as providing a basis for a lawsuit in American courts.” TransUnion LLC v. Ramirez, 594 U.S. 413, 433–34 (2021) (stating that “publication is essential to liability” in explaining why “mere presence of an inaccuracy in an internal credit file” that was not disclosed to third-party was not analogous to harm from defamatory statement, without suggesting that plaintiff must satisfy all elements of defamation to show “close relationship” to defamation analog (internal quotation marks omitted)); see id. at 433 (holding dissemination of misleading credit reports is analogous to harm from defamation even though defendant asserted reports were “only misleading and not literally false,” because harm from misleading statement of “being labeled a ‘potential terrorist’ . . . bears a sufficiently close relationship to the harm from a false and defamatory statement”).
20 Glossing over the numerous factual and legal distinctions between the mail
vendor cases and Salazar’s allegations, the NBA submits that the mail vendor
“cases are on all fours” with this one because they all involve “limited disclosures
to a single legitimate business.” Appellee’s Br. at 23, 24 n.7. The analogy is inapt.
Meta isn’t a “ministerial intermediary” like a mail vendor, Nabozny, 84 F.4th at
736—it’s one of the world’s largest companies, employing more than 67,000
people, with 2024 revenues exceeding $142 billion, see Forbes, Profile, Meta
Platforms, https://www.forbes.com/companies/meta-platforms/?list=global2000
[https://perma.cc/8S94-9M7A] (last visited Sept. 4, 2024).
More to the point, Meta’s use of the disclosed data is very different from
that of the mail vendor. Unlike in the mail vendor cases, Salazar doesn’t allege
that his personal viewing information was disclosed to an intermediary so that it
could be bounced back to him on behalf of the entity that properly possessed the
information. One of Salazar’s allegations is that the NBA discloses users’ personal
viewing information to Meta, which then harnesses that information “to show the
user targeted ads”—ads that Meta chooses for its own commercial purposes, not
the NBA’s or the user’s purposes. Jt. App’x at 15 (emphasis added). Moreover,
nothing in the complaint suggests that Meta can’t sell, disclose, or otherwise use
Salazar’s data for additional purposes. In addition, Salazar alleges that Meta
21 “cross-referenc[es]” “this highly sought-after information” “to the data it already
has in [its] own detailed profiles.” Id. at 16–17. And the information is being used
for digital advertising, id. at 15–16, an industry that “underlies many of the
Internet’s most widely used services,” Brief of the Chamber of Commerce of the
United States of America as Amicus Curiae in Support of Defendant-Appellee at 15.
Given the nature of the companies involved, intended and potential uses of
the disclosed information, and resulting enhanced disclosure risks, we see little
daylight between the nature of the harm Salazar alleges and the harm flowing
from the public disclosure of private facts common-law analog. Therefore, Salazar
has satisfactorily pled a concrete injury sufficient to confer Article III standing and
to withstand dismissal under Rule 12(b)(1).
The NBA does not argue that Salazar has otherwise failed to plead that his
alleged injury satisfies Article III standing requirements at the motion to dismiss
stage. That makes sense. His alleged injury in fact is particularized and actual—
his personal viewing information was disclosed without his consent to a third
party. That alleged harm is traceable to the NBA’s installation of the Facebook
Pixel on NBA.com. And Salazar’s requested relief—declaratory, injunctive, and
monetary relief for violating the VPPA—would likely redress his injury.
Accordingly, Salazar has alleged a sufficient harm to confer Article III standing,
22 and the district court correctly denied the NBA’s motion to dismiss for lack of
subject matter jurisdiction.
II. Merits
To survive Rule 12(b)(6) dismissal, a complaint’s factual allegations must
“state a claim to relief that is plausible on its face.” Bell Atlantic Corp. v. Twombly,
550 U.S. 544, 570 (2007). On appeal, we review the complaint without deference
to the district court’s assessment, accepting as true all its factual allegations and
drawing all inferences in the plaintiff’s favor. See Nicosia v. Amazon.com, Inc., 834
F.3d 220, 230 (2d Cir. 2016); Peretti v. Authentic Brands Group LLC, 33 F.4th 131, 137
(2d Cir. 2022). That means the plaintiff’s allegations must enable the court to
reasonably infer that the defendant is liable for the alleged misconduct. Ashcroft
v. Iqbal, 556 U.S. 662, 678 (2009).
Applying these standards, we must determine whether Salazar plausibly
pled that he was a “subscriber of goods or services” as understood in the VPPA.
For the reasons set forth below, we conclude that he did. The phrase “goods or
services” in the VPPA is not cabined to audiovisual goods or services, but also
reaches the NBA’s online newsletter. By alleging that he exchanged personal
information in return for periodically receiving the online newsletter, Salazar
plausibly pled that he is a “subscriber of” that newsletter.
23 A. The VPPA
In 1987, a newspaper published an article called The Bork Tapes, see Michael
Doland, The Bork Tapes, Washington City Paper (Sept. 25, 1987), which identified
146 films that Judge Robert Bork and his family had rented from a video store. At
the time of publication, the Senate Judiciary Committee was holding hearings on
Judge Bork’s nomination to the Supreme Court. See S. Rep. No. 100-599, at 5 (1988);
Ellis v. Cartoon Network, Inc., 803 F.3d 1251, 1252–53 (11th Cir. 2015); Yershov v.
Gannett Satellite Information Network, Inc., 820 F.3d 482, 485 (1st Cir. 2016).
Senators quickly decried the publication. As Senator Patrick Leahy
commented during the nomination hearings:
It is nobody’s business what Oliver North or Robert Bork or Griffin Bell or Pat Leahy watch on television or read or think about when they are home. . . . In an era of interactive television cables, the growth of computer checking and check-out counters, of security systems and telephones, all lodged together in computers, it would be relatively easy at some point to give a profile of a person and tell what they buy in a store, what kind of food they like, what sort of television programs they watch, who are some of the people they telephone. . . . I think that is wrong. I think that really is Big Brother, and I think it is something that we have to guard against. . . .
Privacy is not a conservative or a liberal or moderate issue. It is an issue that goes to the deepest yearnings of all Americans that we are free and we
24 cherish our freedom and we want our freedom. We want to be left alone.
S. Rep. No. 100-599, at 5–6 (quoting Hearings on Nomination of Robert H. Bork to be
Associate Justice of the Supreme Court of the United States Before the Senate Committee
on the Judiciary, 100th Cong. 1374 (1987)) (alterations adopted).
The Bork Tapes was the catalyst for the VPPA. See id. at 5; S. Rep. No. 112-
258, at 2 (2012); Ellis, 803 F.3d at 1252–53. A bipartisan group of Senators, including
Senator Leahy, introduced legislation in May 1988 “to preserve personal privacy
with respect to the rental, purchase, or delivery of video tapes or similar audio
visual materials.” S. 2361, 100th Cong. (1988); see also S. Rep. No. 100-599, at 1
(same). That bill became the VPPA. See Video Privacy Protection Act of 1988, Pub.
L. No. 100-618, 102 Stat. 3195.
The VPPA prohibits a “video tape service provider” from “knowingly
disclos[ing], to any person, personally identifiable information concerning any
consumer of such provider,” subject to certain enumerated exceptions, such as in
cases where the provider has obtained a consumer’s “informed, written consent.”
18 U.S.C. § 2710(b). The Act thereby “reflects the central principle of the Privacy
Act of 1974: that information collected for one purpose may not be used for a
different purpose without the individual’s consent.” S. Rep. No. 100-599, at 8.
25 By 2012, Congress recognized that “the Internet ha[d] revolutionized the
way that American consumers rent and watch movies and television programs,”
such that the way “Americans used to watch videos in 1998—the VHS cassette
tape—[wa]s now obsolete.” S. Rep. 112-258, at 2. These new technologies had
created a problem: Americans couldn’t “share information about their video
preferences on social media sites on an ongoing basis” without violating the 1988
VPPA, which required obtaining consent from the consumer for each disclosure
of viewing information. Id. at 2–3. The solution? Amend the statute “to clarify
that a video tape service provider may obtain a consumer’s informed, written
consent on an ongoing basis and that consent may be obtained through the
Internet.” Video Privacy Protection Act Amendments Act of 2012, Pub. L. 112-258,
126 Stat. 2414; see 18 U.S.C. § 2710(b)(2)(B) (authorizing a video tape service
provider to disclose consumers’ personally identifiable information “to any
person with the informed, written consent (including through an electronic means
using the Internet) of the consumer” provided either “at the time the disclosure is
sought” or “in advance for a set period of time, not to exceed 2 years or until
consent is withdrawn by the consumer, whichever is sooner”).
Otherwise, much of the 1988 VPPA’s text remains unchanged. Like the
original version, the current VPPA holds liable “[a] video tape service provider
26 who knowingly discloses, to any person, personally identifiable information
concerning any consumer of such provider.” 18 U.S.C. § 2710(b)(1). And the Act
provides consumers with a private right of action for violations of the statute. Id.
§ 2710(c) (authorizing award of “actual damages but not less than liquidated
damages in an amount of $2,500,” punitive damages, reasonable attorneys’ fees
and litigation costs, and appropriate “preliminary and equitable relief”).
Central to this case is the VPPA’s “Definitions” section. See id. § 2710(a).
The VPPA defines the term “consumer” to mean “any renter, purchaser, or
subscriber of goods or services from a video tape service provider.” Id.
§ 2710(a)(1). But the phrase “subscriber of goods or services” is not explicitly
defined in the statute. Our task here is to construe that phrase. The parties have
focused their arguments on two questions: Is the digital newsletter a “good or
service”? And is Salazar a subscriber? We consider each in turn.
B. “Goods or Services”
The parties contest whether the online newsletter Salazar signed up for
qualifies as “goods or services” as that phrase is used in the VPPA. The NBA
doesn’t contend that the newsletter is not a good or service generally; rather, it
insists that statutory context compels the conclusion that a consumer under the
VPPA must specifically rent, purchase, or subscribe to audiovisual “goods or
27 services.” The NBA reasons that because the VPPA defines a “consumer” as one
who rents, purchases, or subscribes to services “from a video tape service provider,”
id. at § 2710(a)(1) (emphasis added), those services must, by definition, be
audiovisual services. Salazar disagrees and argues that nothing in the statute
limits the definition of “consumer” to those who rent, purchase, or subscribe to a
particular class of services—namely, audiovisual content.
Considering the text, structure, and purpose of the VPAA, we agree with
Salazar. And we conclude that the NBA’s policy based counterarguments are
unpersuasive.
i. Text, Structure and Purpose
When interpreting a statutory provision, we start with the text. See
Wisconsin Central Limited v. United States, 585 U.S. 274, 277 (2018). Because the
VPPA does not define the phrase “goods or services,” we presume that its plain
meaning applies. See Perrin v. United States, 444 U.S. 37, 42 (1979) (“A fundamental
canon of statutory construction is that, unless otherwise defined, words will be
interpreted as taking their ordinary, contemporary, common meaning.”). In
assessing the words’ plain meaning, we consider “the language itself, the specific
context in which that language is used, and the broader context of the statute as a
whole.” Robinson v. Shell Oil Co., 519 U.S. 337, 341 (1997). Applying this guidance,
28 we conclude that the plain language of the “consumer” definition, the VPAA’s
terminology in other sections, and the structure of the statute as a whole support
Salazar’s view. And his read is entirely consistent with the statute’s purpose.
Congress defined “consumer” as “any renter, purchaser, or subscriber of
goods or services from a video tape service provider.” 18 U.S.C. § 2710(a)(1)
(emphasis added). “[R]ead naturally, the word ‘any’ has an expansive meaning.”
Ali v. Federal Bureau of Prisons, 552 U.S. 214, 219 (2008) (internal quotation marks
omitted). And a statute’s use of the word “‘or’ is ‘almost always disjunctive.’”
Encino Motorcars, LLC v. Navarro, 584 U.S. 79, 87 (2018) (quoting United States v.
Woods, 571 U.S. 31, 45 (2013)). So by using expansive words like “any” and “or,”
Congress codified a “consumer” definition that “bespeaks breadth.” Id.
Comparing this language to other definitions in the statute reinforces this
conclusion. Congress deployed similarly broad language in the “video tape
service provider” definition. That definition classifies “any person, engaged in the
business, in or affecting interstate or foreign commerce, of rental, sale, or delivery
of prerecorded video cassette tapes or similar audio visual materials” as a “video
tape service provider.” 18 U.S.C. § 2710(a)(4) (emphasis added). But while the
“consumer” and “video tape service provider” definitions share similarly
expansive language, there is also a critical distinction between the two provisions:
29 Unlike the “consumer” definition, which makes no mention of audiovisual
materials, the “video tape service provider” definition requires the provider to
deal in “audio visual materials.” Id. This meaningful variation shows that
Congress knew to include an audiovisual limitation in the VPPA when it wanted
one to apply. In fact, Congress twice deploys the term “audio visual material” (or
materials) in the VPAA—first in the “video tape service provider” definition, and
next in a provision establishing when a video tape service provider may lawfully
disclose personally identifiable information. See id. § 2710(a)(4), (b)(2)(D)(ii). 7 As
the Supreme Court has instructed, we should not “lightly assume that Congress
has omitted from its adopted text requirements that it nonetheless intends to
apply,” especially when it “has shown elsewhere in the same statute that it knows
how to make such a requirement manifest.” Jama v. Immigration and Customs
Enforcement, 543 U.S. 335, 341 (2005); see also Yale New Haven Hospital v. Becerra, 56
F.4th 9, 21 (2d Cir. 2022) (explaining principle of meaningful variation, i.e., “where
a statutory scheme has used one term in one place, and a materially different term
in another, the presumption is that the different term denotes a different idea”
7 In the “video tape service provider” definition, the relevant text is plural: “audio visual materials.” 18 U.S.C. § 2710(a)(4). In the provision enumerating when a video tape service provider may lawfully disclose personally identifiable information, the language is singular: “audio visual material.” Id. § 2710(b)(2)(D)(ii).
30 (quoting Southwest Airlines Co. v. Saxon, 596 U.S. 450, 458 (2022)) (alterations
adopted)).
This textual divergence highlights the flaw in the NBA’s argument that the
“consumer” and “video tape service provider” definitions share “a suggestively
parallel structure” that supports reading an audiovisual limitation into the
definition of “goods or services.” Appellee’s Br. at 31. To the NBA, the phrase
“renter, purchaser, or subscriber” in the “consumer” definition is parallel to the
“rental, sale, or delivery” language in the “video tape service provider” definition.
That means, the NBA says, the term “goods or services” must be parallel to
“prerecorded video cassette tapes or similar audio visual materials,” with a
similarly cabined scope. Compare 18 U.S.C. § 2710(a)(1), with id. § 2710(a)(4).
We need not decide whether the phrase “renter, purchaser, or subscriber”
in the definition of “consumer” is intended to mirror the phrase “rental, sale or
delivery” in the definition of “video tape service provider.” 8 Even if that were
correct, it would not support the NBA’s conclusion that the term “goods or
8Salazar actually relies on the same parallelism to make a different argument—one we also need not reach. He argues that “renter” in the definition of “consumer” mirrors “rental” in the definition of “video tape service provider,” and “purchaser” mirrors “sale,” so “subscriber” must mirror “delivery.” Following this logic, a “subscriber” is someone who receives goods or services. Under that interpretation, someone who simply watches online videos could be considered a VPPA “consumer.”
31 services” in the definition of “consumer” mirrors the term “prerecorded video
cassette tapes or similar audio visual materials” in the “video tape service
provider” definition. Tellingly, Congress chose to deviate from any parallelism by
using the terms “goods or services” in the “consumer” definition and
“prerecorded video cassette tapes or similar audio-visual materials” in the “video
tape service provider” definition. Again, Congress’s decision to use different
words in different definitions strongly signals its intent to convey different
meanings. See Jama, 543 U.S. at 341.
In addition, the NBA’s interpretation is hard to harmonize with other
language in the statute. The definition of “personally identifiable information”
includes “information which identifies a person as having requested or obtained
specific video materials or services from a video tape service provider.” Id.
§ 2710(a)(4) (emphasis added). But if “goods or services” are, by definition,
audiovisual materials, then Congress’s express restriction in the definition of
“personally identifiable information” to information about “video materials or
services” would be superfluous. See generally Corley v. United States, 556 U.S. 303,
314 (2009) (holding that a “statute should be construed . . . so that no part will be
inoperative or superfluous” (internal quotation marks omitted)).
32 We are likewise unpersuaded by the NBA’s reliance on the title of the
VPAA’s liability provision: “Video Tape Rental and Sale Records.” 18 U.S.C.
§ 2710(b). The NBA argues that by explicitly tying “video” to “rental and sale
records” in that title, Congress showed that the relationship between consumers
and providers is restricted to those who rent, purchase, or subscribe to videos.
There are at least two problems with this argument. First, headings and
titles in statutes “cannot limit the plain meaning of the text.” Rajah v. Mukasey, 544
F.3d 427, 436 (2d Cir. 2008) (internal quotation marks omitted). Second, the title of
the liability provision tells us little about the meaning of “consumer” in the VPPA.
The parties agree that sharing information that is not about video materials or
services is beyond the scope of the statute. But as explained further below, it’s the
definition of “personally identifiable information” that limits what can be shared,
not the definition of “consumer.”
Nor are we persuaded by the NBA’s argument that the phrase “from a video
tape service provider” somehow cabins “goods or services” to audiovisual goods
or services.” The definition of “video tape service provider” is broad,
encompassing “any person[] engaged in the business . . . of rental, sale, or delivery of
prerecorded video cassette tapes or similar audio visual materials.” 18 U.S.C.
§ 2710(a)(4) (emphasis added). That definition is not limited to entities that deal
33 exclusively in audiovisual content; rather, audiovisual content need only be part of
the provider’s book of business. 18 U.S.C. § 2710(a)(4). Thus, by its plain terms,
the statute applies equally to a business dealing primarily in audiovisual materials
(think Blockbuster) and one dealing in primarily non-audiovisual materials (think
a general store that rents out a few movies). Congress cast a wide net in defining
“video tape service provider,” to ensure that businesses dealing in audiovisual
goods or services satisfy the definition even if they also deal in non-audiovisual
goods or services.9
Given that “video tape service provider” is defined broadly to include even
those businesses that dabble in video rentals, it makes sense that “consumer”
should be understood to encompass a renter, purchaser, or subscriber of any of the
provider’s “goods or services”—audiovisual or not. Under the VPPA’s expansive
language, such a business may not disclose “personally identifiable information”
pertaining to its consumers regardless of the particular goods or services rented,
purchased, or subscribed to.
This is not to say the VPPA’s reach is boundless. As noted above, the statute
only prohibits video tape service providers from “knowingly disclos[ing]
9We express no view on whether the VPPA applies only to businesses dealing in “prerecorded” audiovisual goods or services as opposed to “live” video services, an issue not presented in this appeal.
34 personally identifiable information.” 18 U.S.C. § 2710(b)(1) (emphasis added). And
the “personally identifiable information” definition “includes information which
identifies a person as having requested or obtained specific video materials or
services from a video tape service provider.” Id. § 2710(a)(3) (emphasis added).
That means the general store owner who also rented out a few movies wouldn’t
be liable under the VPPA for disclosing particular customers’ bread-buying habits;
that information, which does not relate to video materials or services, is not
“personally identifiable information” under the VPAA. 10
Our read of the statute not only reflects the language and structure of the
VPAA; it’s also “consistent with Congress’s intended purpose.” Bustamante v.
Napolitano, 582 F.3d 403, 410 (2d Cir. 2009). As we explained above, Senate
10True, the “personally identifiable information” definition uses the word “include.” Some of the legislative history suggests that Congress intentionally used that word to help keep the “personally identifiable information” term broad, too. See S. Rep. No. 100-599, at 12 (1988) (“[P]aragraph (a)(3) uses the word ‘includes’ to establish a minimum, but not exclusive, definition of personally identifiable information.”) But that Senate report also stresses that the VPPA’s definition of “personally identifiable information” contains the word “video” to make clear that only audiovisual information is protected. See id. (“[T]he definition of personally identifiable information includes the term ‘video’ to make clear that simply because a business is engaged in the sale or rental of video materials or services does not mean that all of its products or services are within the scope of the bill. For example, a department store that sells video tapes would be required to extend privacy protection to only those transactions involving the purchase of video tapes and not other products.”). So while there may be breathing room in the statute to explore what exactly is “personally identifiable information”—we need not and do not explore that argument in this appeal—the VPPA’s text, structure and purpose make clear that the disclosed information must still be related to audiovisual materials or services.
35 Judiciary Committee members understood the VPPA to “prohibit[] video service
providers from disclosing personally identifiable information except in certain,
limited circumstances.” S. Rep. No. 100-599, at 5; see also S. Rep. No. 112-258, at 2
(same). Grafting unstated limitations on the broad definition of “consumer,” and
by extension, “goods or services,” would be inconsistent with Congress’s purpose
here.
ii. NBA’s Policy Arguments
Given the clear meaning of the VPPA evidenced by its statutory text and
context, we are unpersuaded by the NBA’s policy arguments for a different
construction. The NBA insists that failing to cabin “goods or services” to
audiovisual goods or services would produce anomalous results. It contends that
under a broad construction of the term, someone who just watches a video on a
website “with no other relationship to the company would not receive VPPA
privacy protections vis-à-vis their viewing of these videos, because they have no
‘renter,’ ‘purchaser,’ or ‘subscriber’ relationship to the company,” but someone
who “previously and unrelatedly bought a hammer at one of the company’s brick-
and-mortar stores, and then watched a free video on the website” would be a VPPA
consumer. Appellee’s Br. at 40. To the NBA, it makes no sense that the VPPA can
be triggered by a consumer interaction unrelated to videos.
36 Even presuming that merely watching a free video—and giving up personal
information in the process—does not make someone a VPPA “consumer,” 11 the
purportedly anomalous results identified by the NBA do not justify artificially
cabining the statute’s scope in a way that is inconsistent with its plain meaning
and purpose.
For starters, the statute’s express terms control. See Bostock v. Clayton County,
Georgia, 590 U.S. 644, 653 (2020) (“When the express terms of a statute give us one
answer and extratextual considerations suggest another, it’s no contest. Only the
written word is the law, and all persons are entitled to its benefit.”); Pennsylvania
Department of Corrections v. Yeskey, 524 U.S. 206, 212 (1998) (“[T]he fact that a statute
can be applied in situations not expressly anticipated by Congress does not
demonstrate ambiguity. It demonstrates breadth.” (internal quotation marks
omitted)).
We’re also unconvinced that broadly defining “goods or services” produces
anomalous results. Take the NBA’s hypothetical: a consumer buys a hammer, then
watches free videos on the vendor’s website. The NBA suggests that it is
11Salazar does not contend that, independent of his registering for the newsletter, simply watching videos on NBA.com—thereby intentionally or unintentionally providing his personal viewing information to the NBA—makes him a “renter, purchaser, or subscriber of goods or services from a video tape service provider.” We therefore express no view on this question.
37 anomalous that this consumer is subject to privacy protections under the VPPA.
But considering the privacy protective goals of the VPPA with respect to
individuals’ video viewing information, this scenario does not strike us as
anomalous. Especially given the broad definition of consumer in the VPPA,
allowing disclosure of the consumer’s video viewing information would be out of
sync with the statute’s goals.
To summarize: The phrase “goods or services” in the VPPA’s definition of
“consumer” is not cabined to only audiovisual “goods or services.” The NBA’s
online newsletter therefore is a qualifying good or service.
C. “Subscriber”
Even if the NBA digital newsletter is a “good or service,” we still must
decide whether Salazar is a subscriber of that good or service such that he is a
“consumer” within the VPPA. Salazar alleges that he “became a digital subscriber
of NBA.com by providing, among other information, email address and IP
address, . . . and any cookies associated with his device.” Jt. App’x at 19. The NBA
38 contends these actions do not signify a sufficient relationship between Salazar and
the NBA, and therefore don’t make Salazar a “subscriber” under the VPPA. 12
Two other circuits have tackled this question. In Ellis, the Eleventh Circuit
confronted a case in which a plaintiff downloaded an Android application to
watch video clips. 803 F.3d at 1254. Although the plaintiff didn’t pay any money,
the application recorded and shared his device-unique “Android ID” and video-
viewing information with a third-party data analytics company. Id. The Eleventh
Circuit held that “payment is not a necessary element of subscription,” but
“‘subscription’ involves some type of commitment, relationship, or association
(financial or otherwise) between a person and an entity,” which “involve[s] either
payment, registration, commitment, delivery, . . . or access to restricted content.”
Id. at 1256 (internal quotation marks omitted). That plaintiff, however, had not
made any payments, an account, or a profile; “provide[d] any personal
information”; “sign[ed] up for any periodic services or transmissions”; or
12Salazar insists that “everyone agrees Mr. Salazar subscribes to the NBA’s newsletter.” Reply Br. at 3; see also Appellant’s Br. at 17 n.3 (arguing that “this appeal does not concern the meaning” of the “subscriber” term). We disagree. The NBA concedes only that Salazar himself alleges “he signed up for a free NBA email newsletter.” Appellee’s Br. at 3. It also argued before the district court that Salazar’s allegations “at most” supported an argument that he subscribed to the online newsletter, which the NBA contended was not an audiovisual good or service. See id. at 11 (quoting Jt. App’x at 50). We don’t read the NBA’s alternative argument as a concession that signing up for that newsletter made Salazar a “subscriber” of that newsletter as understood under the VPPA.
39 otherwise “ma[d]e any commitment or establish[ed] any relationship that would
allow him to have access to exclusive or restricted content.” Id. at 1257. All he did
was download a free app and use it to view content. So, the court concluded, he
was not a VPPA “subscriber.” Id. at 1258.
The First Circuit faced a similar set of facts in Yershov. There, someone also
downloaded an app in order to, among other things, watch videos. 820 F.3d at
484. Each time the plaintiff used the app to watch videos, the video’s title, his
device’s GPS coordinates, and his device’s unique Android ID were sent to a third-
party data analytics company, which used the information for, among other
things, targeted advertising. Id. at 484–85. The First Circuit agreed with the
Eleventh Circuit that someone does not have to pay money to be a VPPA
subscriber. Id. at 487–88. But unlike the Eleventh Circuit, the First Circuit held
that the Yershov plaintiff was a VPPA subscriber. Id. at 487. It explained:
To use the App, Yershov did indeed have to provide Gannett with personal information, such as his Android ID and his mobile device’s GPS location at the time he viewed a video, each linked to his viewing selections. While he paid no money, access was not free of a commitment to provide consideration in the form of that information, which was of value to Gannett. And by installing the App on his phone, thereby establishing seamless access to an electronic version of USA Today, Yershov established a relationship with Gannett that is materially different from what would have been the case had USA Today simply remained one of millions of sites 40 on the web that Yershov might have accessed through a web browser.
Id. at 489.
We agree with both the Eleventh and First Circuits that someone doesn’t
have to spend money to be a VPPA “subscriber.” Otherwise, the term “subscriber”
would be rendered superfluous by the terms “purchaser” and “renter” in the
definition of “consumer.” Someone in 1988 (or 2012, for that matter) who paid
money for permanent access to audiovisual material would be a “purchaser,” and
someone who exchanged money for temporary access would be a “renter.” If the
payment of money was an essential condition of being a “subscriber,” then anyone
who was a “subscriber” would also be either a “renter” or “purchaser.” See id. at
487–88. 13
It’s also easy to imagine subscriptions that don’t require monetary payment.
Someone can, for example, subscribe to a YouTube channel by signing into a
YouTube account (which requires no monetary payment) and clicking the
“subscribe” icon on a content creator’s channel. YouTube Help, Subscribe to
YouTube channels, https://support.google.com/youtube/answer/4489286
13Although some dictionary definitions in circulation around the time the VPPA was enacted, and later amended, suggest that a someone must pay money to be a subscriber, other definitions don’t. See, e.g., Yershov, 820 F.3d at 487 (comparing dictionary definitions).
41 [https://perma.cc/RM2E-FMX8] (last visited Sept. 4, 2024). Subscribing causes
YouTube to “automatically send . . . notifications about the highlights from that
channel.” Id.
These types of subscriptions aren’t only a feature of the modern internet. As
the First Circuit explained, they existed in the 1980s through “the reasonably
common retailing practice of introductory enticements”:
Suppose a customer in 1988 obtained several videos from a new commercial supplier at no charge, or with money back. We can discern no reason why Congress would have wanted different disclosure rules to apply to those transactions than to ones where a monetary payment is made. And because we think that Congress cast such a broadly inclusive net in the brick-and-mortar world, we see no reason to construe its words as casting a less inclusive net in the electronic world when the language does not compel that we do so. See Barr v. United States, 324 U.S. 83, 90 (1945) (“[I]f Congress has made a choice of language which fairly brings a given situation within a statute, it is unimportant that the particular application may not have been contemplated by the legislators.”).
Yershov, 820 F.3d. at 488.
Here, although Salazar does not allege that he paid the NBA money, he does
allege that he provided the NBA with his personal information when he signed up
for the newsletter. In return for receiving periodic NBA-related updates, Salazar
exchanged, at a minimum, (1) his email address, (2) his IP address, and (3) cookies
associated with his device. He further alleges that through his IP address, the NBA
42 can identify “the city and zip code he resides in as well as his physical location.”
Jt. App’x at 19.
That information is not insignificant. By receiving it, the NBA learned how
to directly reach out to Salazar. It discovered where his device was. It gained
access to additional information stored in any cookies on his device. These tools
increased the NBA’s potential to urge Salazar to visit NBA.com and watch videos
on it, making the NBA’s relationship with him distinct from its relationship with
casual NBA.com video-watchers who had not signed up for the newsletter. 14
Accepting these allegations as true and drawing all reasonable inferences in
Salazar’s favor, as we must at the pleadings stage, Salazar plausibly alleged that
he gave the NBA valuable personal information in exchange for access to the
online newsletter. Cf. Yershov, 820 F.3d at 489 (reasoning that the plaintiff provided
“consideration in the form of” “personal information” including his Android ID
and device’s GPS location). This is sufficient at the pleadings stage to satisfy the
requirement that Salazar allege that he became a “subscriber of” the NBA’s online
newsletter.
14That is not to say that a NBA.com video-watcher who does not sign up for the online newsletter is not also a VPPA “subscriber.” Salazar does not argue that he was a subscriber merely by virtue of any information acquired by the NBA based solely on his viewing the videos on NBA.com. We therefore leave that question for another day.
43 CONCLUSION
Our ruling is narrow: We hold on the merits only that Salazar has plausibly
pled that he is a “subscriber of goods or services” and that the district court
therefore erred in dismissing his complaint pursuant to Fed. R. Civ. P. 12(b)(6).
We leave the district court to address the NBA’s alternative arguments in the first
instance. And, of course, our conclusions are conditioned on the necessary
pleading-stage presumption that Salazar’s allegations are true. Further factual
developments may ultimately paint a different picture.
The VPPA is no dinosaur statute. Congress deployed broad language in
defining the term “consumer,” showing it did not intend for the VPPA to gather
dust next to our VHS tapes. Our modern means of consuming content may be
different, but the VPPA’s privacy protections remain as robust today as they were
in 1988.
The district court’s judgment is VACATED, and the case is REMANDED
for further proceedings consistent with this opinion.
Related
Cite This Page — Counsel Stack
118 F.4th 533, Counsel Stack Legal Research, https://law.counselstack.com/opinion/salazar-v-nba-ca2-2024.