UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION
SAM WELBEL; MICHAEL ARCHER; and DYLEN MACALUSO, individually and on behalf of all others similarly situated, No. 24 C 6426
Plaintiffs, Judge Thomas M. Durkin
v.
SHOUT! FACTORY, LLC,
Defendant.
MEMORANDUM OPINION AND ORDER Plaintiffs allege that Shout! Factory LLC (“Shout”) disclosed information to Facebook about the movies and TV shows they purchased from Shout’s website in violation of the Video Privacy Protection Act. Shout has moved to dismiss for lack of subject matter jurisdiction and failure to state a claim pursuant to Federal Rules of Civil Procedure 12(b)(1) and 12(b)(6). That motion is denied. Background Plaintiffs allege that Shout installed in its website a computer code known as the “Facebook Pixel.” When a consumer who has a Facebook account uses Shout’s website, the Facebook Pixel interacts with Facebook cookies in the consumer’s computer’s web browser and sends information to Facebook about the consumer’s purchases from Shout by linking that purchase information to the consumer’s Facebook identification number. Plaintiffs allege that Facebook uses that information to target advertisements to them. Analysis I. Injury-in-Fact Shout argues that Plaintiffs have failed to allege that they suffered an injury
in fact. According to the Supreme Court, a plaintiff must allege that they have suffered an injury that is “concrete . . . real, and not abstract,” and that has a “close historical or common-law analogue” that is “traditionally recognized as providing a basis for a lawsuit in American courts.” TransUnion LLC v. Ramirez, 594 U.S. 413, 424-25 (2021). Plaintiffs allege injury to their “privacy.” See R. 1 at 2 (¶ 7). Shout argues that
the “only possibly relevant” common law analogue is the tort of “public disclosure.” See R. 41 at 5. Shout argues further that Plaintiffs fail to allege the tort of public disclosure because they do not allege that Shout “publicized” the information about Plaintiffs’ video purchases, but merely that Shout shared it with “discrete companies . . . for business purposes.” Id. According to Shout, “there is nothing to suggest that anyone at Facebook . . . ever reviewed or appreciated the combination of Plaintiffs’ Facebook IDs and information about videos they purchased—and certainly no
allegations that information about Plaintiffs’ movie purchases was exposed to the public.” Id. Shout also contends that its argument is supported by the Seventh Circuit’s decision in Nabozny v. Optio Sols. LLC, 84 F.4th 731 (7th Cir. 2023). In Nabozny, the plaintiff claimed a violation of the Fair Debt Collection Practices Act based on allegations that a debt collector disclosed information about the plaintiff’s debt to a third party hired to assist the debt collector in preparing and sending letters to its debtors. The Seventh Circuit held that the closest common law privacy tort was “public disclosure of private facts.” Id. at 735. But the court also held that the plaintiff
failed to allege that the debt collector publicized the plaintiff’s information, “or even that [the third party] read or appreciated [the plaintiff’s] information.” Id. at 736. Ultimately, according to the Seventh Circuit, the “transmission of information to a single ministerial intermediatory does not remotely resemble the publicity element” necessary to the tort of public disclosure. See id. Shout’s reliance on Nabozny, however, ignores the Seventh Circuit’s emphasis
that the “distinction between public and private communication . . . is a qualitative inquiry, not a quantitative one.” Id. at 736. In other words, the “transmission of information to a single ministerial intermediary” did not constitute publication, not because it was made to a single entity, but because the entity was merely a ministerial intermediary. Here, it is not plausible to describe Facebook—one of the world’s largest social media corporations—as a ministerial entity. Far from it, Plaintiffs allege that
Facebook paid Shout to disclose Plaintiffs’ video purchases to Facebook so that Facebook could use that information to target advertisements at Plaintiffs. This is not a ministerial transaction unrelated to Plaintiffs’ privacy interests. First of all, unlike the third party in Nabozny that presumably was paid by the debt collector to provide a ministerial service that involved the plaintiff’s private information, here the third party Facebook paid Shout to disclose the private information. In other words, unlike the Nabozny debt collector who made a disclosure in the normal course of its business that was reasonably foreseeable by the plaintiff in that case, Shout made this disclosure apart from any expectation its customers would have had
regarding how Shout would use information about their video purchases. Shout is not merely disclosing the information in furtherance of its video selling business as the debt collector did in Nabozny. Rather, selling the information to Facebook is an entrepreneurial transformation of the use and value of the information from its original genesis and purpose. The transaction with Facebook is not at all “ministerial” or clerical.
Further, Facebook’s alleged use of the information to target advertisements to Plaintiffs is a public action. Targeting advertisements is a way of shaping Plaintiffs’ media environment, which is a significant invasion of personal privacy in our current era where a person’s media environment (primarily internet and television exposure) has grown to have an outsize share of how a person experiences the world. Other Circuits agree that disclosing information for this purpose is plausibly a public disclosure. See Salazar v. Nat’l Basketball Ass’n, 118 F.4th 533, 544 (2d Cir. 2024)
(“Given the nature of the companies involved, intended and potential uses of the disclosed information, and resulting enhanced disclosure risks, we see little daylight between the nature of the harm Salazar alleges and the harm flowing from the public disclosure of private facts common-law analog.”); Pileggi v. Washington Newspaper Publ’g Co., LLC, 146 F.4th 1219, 1230 (D.C. Cir. 2025) (“The complaint alleges, though, that Meta commonly provides or sells the data it collects to third parties, which may well amount to public release.”). Therefore, Plaintiffs have alleged an injury in fact and have standing to bring
their claims. II. Actual Damages In addition to punitive damages, attorneys’ fees, and equitable relief, the Video Privacy Protection Act (the “VPPA”) provides that the “court may award actual damages but not less than liquidated damages in an amount of $2,500.” 18 U.S.C. § 2710(c). Shout argues that this provision should be interpreted to require a plaintiff
to allege some actual damages in order to state a claim and be awarded the statutory liquidated damages amount, and that Plaintiffs’ claim should be dismissed because they do not allege actual damages. In support of this argument, Shout relies on the Supreme Court’s decision in Doe v. Chao, 540 U.S. 614 (2004). In Chao, the Supreme Court interpreted the following provision from a different federal statute, the federal Privacy Act: “the United States shall be liable to the individual in an amount equal to the sum of actual
damages sustained by the individual . . . but in no case shall a person entitled to recovery receive less than the sum of $1,000.” 5 U.S.C. § 552a(g)(4)(A). The Court held that this provision meant that under the Privacy Act actual damages are a prerequisite to recovering the statutory amount. See Chao, 540 U.S. at 627. The problem with Shout’s argument is that it ignores the fact that this provision of the Privacy Act expressly limits eligibility for the statutory damages floor of $1,000 to plaintiffs who are “entitled to recovery.” As the Supreme Court explained in Chao, under the Privacy Act’s express terms, the only plaintiffs “entitled to recovery” are those to whom “the United State shall be liable . . . in an amount equal
to the sum of actual damages sustained.” 5 U.S.C. § 552a(g)(4)(A) (emphasis added). There is no similar eligibility requirement in the VPPA. Instead, the statute simply provides that “actual damages” may “not” be “less than liquidated damages in the amount of $2,500.” 18 U.S.C. § 2710(c). There is nothing in this provision indicating that a plaintiff must allege some actual damages in order to be awarded liquidated damages.
Notably, the Supreme Court in Chao considered language almost identical to the language in the VPPA as a hypothetical counter-example to the language in the Privacy Act. The Supreme Court explained that “if Congress wished to allow recovery of liquidated damages for violations of the Privacy Act absent actual damages, it could have made the [Privacy Act] read ‘the Government would be liable to the individual for actual damages ‘but in no case . . . less than the sum of $1,000.’” Chao, 540 U.S. at 623. This hypothetical language is quite similar to the actual language in the VPPA:
“The court may award actual damages but not less than liquidated damages in an amount of $2,500.” In other words, the Supreme Court suggested that the sort phrasing used in the VPPA does not require an allegation of actual damages for a plaintiff to be eligible for the statutory liquidated damages amount. Other courts have noted that the Supreme Court’s hypothetical is “nearly exactly how the VPPA is styled.” Dawson v. The Univ. of Phoenix, 2026 WL 92248, at *9 (N.D. Ill. Jan. 13, 2026) (quoting Saunders v. Hearst Television, Inc., 711 F. Supp. 3d 24, 31-32 (D. Mass. 2024)). And those courts have held that the VPPA does not require an allegation of actual damages to be eligible for statutory liquidated damages. See id.;
see also Kehoe v. Fid. Fed. Bank & Tr., 421 F.3d 1209, 1214 (11th Cir. 2005) (“Had we any doubt that [the statutory language], as written, is unambiguous, this dicta by the Supreme Court would assuage those doubts.”); Pichler v. UNITE, 542 F.3d 380, 399 (3d Cir. 2008) (agreeing with Kehoe). The Seventh Circuit for its part has not directly analyzed this issue under the VPPA. But in addressing Chao with respect to a different statute and issue, the
Seventh Circuit has stated that it is “true” that the VPPA “allows $2,500 in ‘liquidated damages,’ without need to prove ‘actual damages.’” Sterk v. Redbox Automated Retail, LLC, 672 F.3d 535, 538 (7th Cir. 2012). Moreover, this interpretation of the VPPA is in accord with common law privacy actions which provide tort victims with a monetary award without proving actual damages. See Chao, 540 U.S. at 621 n. 3 (quoting 4 Restatement of Torts § 867 cmt. d (1939)); see also Pichler, 542 F.3d at 398-99; Parks v. Internal Revenue Serv.,
618 F.2d 677, 683 (10th Cir. 1980) (observing that the “common law tort of invasion” seeks to remedy “personal wrongs which result in injury to plaintiffs’ feelings and are actionable even though the plaintiff suffered no pecuniary loss nor physical harm”). “Courts permit recovery in privacy cases without proving actual damages because it is difficult to prove damages in such cases.” Pichler, 542 F.3d at 398-99. “Damages for a violation of an individual’s privacy are a quintessential example of damages that are uncertain and possibly unmeasurable.” Kehoe, 421 F.3d at 1213. And since statutory “liquidated damages are an appropriate substitute for the potentially uncertain and unmeasurable actual damages of a privacy violation, it follows that
proof of actual damages is not necessary for an award of liquidated damages.” Id. III. Personally Identifiable Information The VPPA prohibits “knowing” disclosure of “personally identifiable information,” which “includes information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider.” 18 U.S.C. § 2710(a)(3), (b)(1). The parties and other courts to have
addressed this issue are split on the proper interpretation of the definition of “personally identifiable information.” The dispute centers around what it means for “information” to “identify a person.” Shout argues this Court should follow courts that have interpreted the definition of “personally identifiable information” to include that which can “readily permit an ordinary person to identify a specific individual’s video- watching behavior.” R. 41 at 11 (quoting In re Nickelodeon Consumer Privacy Litig., 827 F.3d 262, 267 (3d Cir. 2016)) (emphasis added); see also Solomon v. Flipps Media,
Inc., 136 F.4th 41, 54 (2d Cir. 2025) (holding that it is “implausible that an ordinary person would look at the [complex Facebook Pixel code] and understand it to be a video title. . . . Nor [is it plausible] that an ordinary person could identify [the plaintiff] through her [Facebook ID, because it is] just one phrase embedded in many other lines of code”). By contrast, Plaintiffs argue that the Court should follow the First Circuit’s holding that information protected by the VPPA includes that which is “reasonably and foreseeably likely to reveal which” videos the customer acquired. See R. 54 at 2 (citing Yershov v. Gannett Satellite Info. Network, Inc., 820 F.3d 482, 486 (1st Cir. 2016)).
The Second Circuit in Solomon explained that the VPPA’s requirement that a protected disclosure be “knowing” shows that “the statute views disclosure from the perspective of the disclosing party.” Solomon, 136 F.4th at 52. In other words, the statute “looks to what information a video service provider discloses, not to what the recipient of that information decides to do with it.” Id. For that reason, the Second Circuit concluded that it “does not make sense that a video tape service provider’s
liability would turn on circumstances outside of its control and the level of sophistication of the third party.” Id. Hence, according to the Second Circuit, the “ordinary person standard is a more suitable framework to determine what constitutes personally identifiable information because it better informs video service providers of their obligations under the VPPA, while not impermissibly broadening its scope to include the disclosure of technological data to sophisticated third parties.” Id.
This reasoning would be relevant and necessary if Plaintiffs had merely alleged that Shout should have known that the Facebook Pixel would disclose their video purchases; i.e., that Shout’s knowledge of the disclosure was merely constructive. But Plaintiffs allege that Shout had actual knowledge of Facebook’s intent and abilities to use the disclosed information. See R. 1 at 14 (¶ 63) (“Defendant knew that Facebook would identify consumers who visited Defendant’s website, and Defendant transmitted the information regarding which video materials consumers purchased.”). Because Plaintiffs have alleged Shout’s actual knowledge of how Facebook could and would use the disclosed information, there is no need to resort to
a standard of constructive knowledge like the “ordinary person” standard to determine whether Shout should have been able to decipher the information transmitted in code to Facebook. Other district courts have similarly disagreed with Solomon’s reasoning and rejected the need to resort to a standard of constructive knowledge when actual knowledge is plausibly alleged. See Dawson v. The Univ. of Phoenix, Inc., 2026 WL 92248, at *7, *9 (N.D. Ill. Jan. 13, 2026) (“The Court finds it
unnecessary to choose either approach because the result is the same under both tests. . . . [Allegation of actual knowledge] is sufficient.”) (citing cases); see also Manza v. Pesi, Inc., 784 F. Supp. 3d 1110, 1122 (W.D. Wis. 2025) (“So if a video tape service provider is not aware . . . that the information it is disclosing can be used to identify an individual’s video purchases, the provider did not violate the VPPA. A ‘knowingly’ element excuses innocent or negligent mistakes.”). Presumably, the Second Circuit in Solomon sought to define protected
information solely with reference to the quality of the information itself (i.e., how clearly the information identifies a person’s video purchases) because the statutory definition does not expressly make a connection to the defendant’s knowledge. But as the Second Circuit noted, whether certain information can be used to identify a plaintiff’s video purchases can only be assessed in the context of the user’s more general knowledge. For instance, if the information is written in English, a non- English speaker could not immediately use that information to learn the plaintiff’s video purchases. The non-English speaker would of course need to have the information translated. But that begs the question: is the ability to translate a
characteristic of an “ordinary person”? The multiplicity of potential combinations of information quality and defendant knowledge makes the “ordinary person” a poor fit. Rather, as the VPPA provides in a later provision, separate from the definition of “personally identifiable information,” the relevant question is whether the information is of such a quality that the particular defendant in question “knew” at the time the disclosure was made that the third party would be able to “identify” the
plaintiff’s video purchases. The Second Circuit expressed concern that such a framework would mean that the defendant “video tape service provider’s liability would turn on circumstances outside of its control and the level of sophistication of the third party.” See Solomon, 136 F.4th at 52. But it is not clear why this would be the case when liability is limited to a defendant who makes a “knowing” disclosure. If the third party who receives the information uses it in such a way that the defendant knew about or reasonably could have foreseen, then liability for disclosure
in that circumstance is not unfair or unreasonable. And if the defendant did not know what the third party could or would do with the information, and the third party’s actions were not reasonably foreseeable, then the defendant will not be liable. The Second Circuit seemed to believe that the statute only imposes liability if the potential use of the information to identify a plaintiff’s video purchases is patently apparent on the face of the information, so to speak, so as not to resort to the specific knowledge of the particular defendant or the potential actions of the third party recipient. But information is inherently something that is communicated and so it does not exist apart from the knowledge of the people sending and receiving it. The
VPPA recognizes this fundamental truth by imposing liability on only “knowing” disclosure. So, whether information constitutes “personally identifiable information” should be assessed in the context of the defendant’s knowledge under the circumstances, not that of the hypothetical “ordinary person.” And here, Plaintiffs expressly allege that Shout knew that Facebook would use the information Shout disclosed in a manner that violates the VPPA.
Shout argues that Plaintiffs’ claim should be dismissed because “their own browser,” as opposed to Shout, disclosed the information. See R. 41 at 13. But Plaintiffs also allege that Shout knowingly installed the Facebook Pixel in its website code with knowledge that it would use cookies in Plaintiffs’ browsers to transmit information to Facebook. In other words, Plaintiffs browsers are only implicated here because Shout commandeered them. Furthermore, the Court also rejects the notion, put forward by Shout, that
Shout’s actions cannot be characterized as “knowing” because Shout did not have specific knowledge that these two Plaintiffs had Facebook accounts. Shout allegedly knew that the Facebook Pixel cast a web that would catch any and all of its customers who happened to have Facebook accounts. That constitutes a plausible allegation of “knowing” action. IV. First Amendment Lastly, Shout argues that Plaintiffs’ claims should be dismissed because the VPPA violates the First Amendment. Shout contends that that the VPPA is
impermissibly “speaker-based” because it “targets” only “video tape service providers.” R. 41 at 16. Additionally, Shout contends that the VPPA is impermissibly “content-based” because its “applicability depends entirely on the communicative content of the disclosures.” Id. Generally, content-based regulations receive strict scrutiny, meaning that the regulation must be “narrowly tailored to serve compelling state interests.” See Reed
v. Town of Gilbert, Ariz., 576 U.S. 155, 163 (2015) (emphasis added). However, speech that is commercial in nature is an exception to this general rule, and instead is subject to only intermediate scrutiny, meaning that the regulation must be “narrowly tailored to serve a significant governmental interest.” See Cent. Hudson Gas & Elec. Corp. v. Pub. Serv. Comm’n. of N.Y., 447 U.S. 557 (1980) (emphasis added). Shout does not directly argue that the speech at issue here—i.e., the disclosure of Plaintiff’s video purchases—is not commercial, but instead cites two recent
Supreme Court cases in which the Court applied strict scrutiny to speech that Shout contends was commercial in nature. See Reed, 576 U.S. 155, and Sorrell v. IMS Health Inc., 564 U.S. 552 (2011). In other words, Shout argues that the Supreme Court appears to have raised the level of scrutiny for some commercial speech. Whether that is true—and most courts believe it is not—the facts and holdings of Reed and Sorrell are distinguishable. Despite the fact that Reed concerned speech that might be described as “commercial,” the Supreme Court in Reed did not address whether the speech was commercial. See 576 U.S. 155. Similarly, Sorrell expressly held that the outcome of
the case was the same regardless of what level of scrutiny was applied. See 564 U.S. at 571. Moreover, although the statute in Sorrell prohibited disclosure of private information similar to the VPPA, it prohibited disclosure only to certain people or entities for “marketing” purposes, rather than the total prohibition imposed by the VPPA. See id. The discrimination based on speaker and content distinguishes Sorrell from this case.
Notably, no court has held that Sorrell or Reed or any other case has overruled the application of intermediate scrutiny to commercial speech. Rather, “numerous courts” have applied the intermediate scrutiny called for by “Central Hudson to commercial speech following Reed and Sorrel.” See Boelter v. Advance Mag. Publrs. Inc., 210 F. Supp. 3d 579, 598 n.15 (collecting cases); accord RCP Publ’s, Inc. v. City of Chiago, 204 F. Supp. 3d 1012, 1017 (N.D. Ill. 2016) (“This Court . . . does not see Reed as overturning the Supreme Court’s consistent jurisprudence subjecting
commercial speech regulations to a lesser degree of judicial scrutiny. The case says nothing of the kind, indeed, it does not even address the commercial-noncommercial distinction.”); Retail Digit. Network, LLC v. Prieto, 861 F.3d 839, 846, 849-50 (9th Cir. 2017) (explaining that “Sorrell did not mark a fundamental departure from Central Hudson’s four-factor test, and Central Hudson continues to apply,” and citing post- Sorrell commercial speech cases from the Second, Fourth, Sixth, and Eighth Circuits applying Central Hudson). And two district courts have applied Central Hudson to find that the VPPA constitutes commercial speech subject only to intermediate scrutiny. See Saunders v. Hearst Television, Inc., 711 F. Supp. 3d 24, 33 (D. Mass.
2024); Dawson v. The Univ. of Phoenix, Inc., 2026 WL 92248, at *11 (N.D. Ill. Jan. 13, 2026). Despite Shout’s arguments to the contrary, there is little doubt that the VPPA addresses a significant privacy interest in an appropriately tailored fashion. As the government recounts in the brief it filed after intervening in the case to address this issue, see R. 55, protecting privacy has long been recognized as a substantial
governmental interest. See Fla. Bar v. Went for It, 515 U.S. 618, 625 (1995). “[B]oth the common law and the literal understandings of privacy encompass the individual’s control of information concerning his or her person.” U.S. Dep’t of Just. v. Reps. Comm. for Freedom of Press, 489 U.S. 749, 763 (1989). And courts have specifically acknowledged the government’s substantial interest in protecting the privacy of consumer information. See, e.g., Saunders, 711 F. Supp. 3d at 33; see also Barr v. Am. Ass’n of Pol. Consultants, 591 U.S. 610, 650 (2020) (Gorsuch, J., concurring) (“No one
questions that protecting consumer privacy qualifies as a legitimate and ‘genuine’ interest for the government to pursue.”); Sosa v. Onfido, Inc., 600 F. Supp. 3d 859, 882 (N.D. Ill. 2022) (noting the government “has a substantial interest in protecting consumers”); Trans Union Corp. v. FTC, 245 F.3d 809, 818 (D.C. Cir. 2001) (finding that the government’s “interest [in] protecting the privacy of consumer credit information . . . is substantial”). Further, the government has a substantial and compelling interest in protecting the First Amendment rights held by consumers. That is, the First Amendment protects a person’s “right to receive information and ideas,” Bd. of Educ.
v. Pico, 457 U.S. 853, 866-67 (1982) (quotation omitted), and the VPPA advances that right by preventing the chilling of consumers’ freedom to view videos of their choosing. The VPPA also directly advances the privacy interest it identifies. The VPPA applies to individuals or entities who sell, rent, or deliver video recordings—the only individuals or entities, other than consumers themselves, likely to have access to the
information the statute seeks to protect. See Boelter v. Hearst Commc’ns, Inc., 192 F. Supp. 3d 427, 449 (S.D.N.Y. 2016). Restricting the ability of these individuals or entities to disclose consumers’ information thus directly advances the goal of keeping that information private. See id. (“Preventing the disclosure of consumer data to third parties by sellers—those most likely to possess and collect that information—reduces the likelihood of consumers’ private details becoming public.”). And the lawsuits that have credibly alleged VPPA violations over the years demonstrate that the
disclosures the statute prohibits are a legitimate concern. See, e.g., Yershov v. Gannett Satellite Info. Network, Inc., 820 F.3d 482, 484 (1st Cir. 2016) (finding that plaintiffs adequately stated a claim under the VPPA); In re Vizio, Inc., Consumer Priv. Litig., 238 F. Supp. 3d 1204, 1221-26 (C.D. Cal. 2017) (same); In re Hulu Priv. Litig., 2012 WL 3282960 (N.D. Cal. Aug. 10, 2012) (same); Czarnionka v. Epoch Times Ass’n, Inc., 2022 WL 17069810, at *4 (S.D.N.Y. Nov. 17, 2022) (same); Harris v. Pub. Broad. Serv., 662 F. Supp. 3d 1327, 1337 (N.D. Ga. 2023) (same). Shout’s argument that the VPPA is unconstitutionally underinclusive also fails. Shout argues that protecting only information about video purchases—as opposed to purchases of books or other media—makes no sense if the aim is to protect intellectual privacy. See R. 41 at 19. But the government “need not address all aspects of a problem in one fell swoop” and is permitted to focus on regulating a particular narrow issue, even though broader concerns may also exist. See Williams-Yulee v. Fla. Bar, 575 U.S. 483, 449 (2015). And merely because Congress could have regulated additional information and entities does not mean that its regulation of pre-recorded video materials and video tape service providers through the VPPA is ineffective at advancing the government’s interest. To the extent that Shout also argues that the VPPA is not sufficiently narrowly tailored, that argument is logically inconsistent with Shout’s primary argument that the statute is underinclusive. Conclusion Therefore, Shout’s motion to dismiss [40] is denied. ENTERED:
Honorable Thomas M. Durkin United States District Judge Dated: February 2, 2026