Saunders v. Hearst Television, Inc.

• Court: District Court, D. Massachusetts
• Decided: February 14, 2025
• Docket: 1:23-cv-10998
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT DISTRICT OF MASSACHUSETTS

CIVIL ACTION NO. 23-10998-RGS

CHARLES THERRIEN, Individually and on behalf of all others similarly situated

v.

HEARST TELEVISION, INC.

MEMORANDUM AND ORDER ON MOTION TO CERTIFY CLASS, MOTION TO STRIKE THE REPORT AND TESTIMONY OF NARSEO VALLINA-RODRIGUEZ, AND MOTION TO STRIKE THE REPORT OF JASON POLAKIS

February 14, 2025 STEARNS, D.J. In this putative class action, plaintiff Charles Therrien claims that defendant Hearst Television, Inc. (HTV or Hearst), unlawfully disclosed his personally identifiable information – including a record of every video he had viewed on Hearst’s Apps – to two third parties, Braze and Google, in violation of the Video Privacy Protection Act, 18 U.S.C. § 2710 (VPPA). Before the court are three motions: Therrien’s motion for class certification, Dkt. # 83, Hearst’s motion to strike the expert report and testimony of Dr. Vallina-Rodriguez, Dkt. # 95, and Hearst’s motion to strike the allegedly untimely expert report of Dr. Polakis, Dkt. # 100. For the following reasons, the court will deny Therrien’s motion for class certification and Hearst’s motion to strike the expert report and testimony of Dr. Vallina-Rodriguez. The court will allow Hearst’s motion to strike the expert report of Dr. Polakis.

BACKGROUND HTV broadcasts local news and weather programming in 28 local markets and offers station-specific mobile phone Apps for Android and iOS.1 These Apps provide live news, weather feeds, and articles that may contain

no video content, a single video, or multiple videos. When subscribers install the Apps, they are given the option to be placed on an email list for updates related to the Apps and access to permission location services. If users grant

HTV permission to use their location or email address, or share their AAIDs (Mobile Advertising IDs) for advertising,2 HTV is also permitted to gather their geolocation, email addresses, and AAIDs. To send push and email updates about breaking news and weather,

HTV uses a software-as-a-service provider called Braze. When an App is first

1 The Apps include KETV NewsWatch 7, KMBC 9 News, KCCI 8, WISN 12, WLKY, WLWT News 5, WXII 12, WTAE Pittsburgh’s Action News 4, WGAL News 8, MyNBC 5, WMUR News 9, WMTW News 8, WCVB NewsCenter 5, WBAL-TV 11, WYFF News 4, WJCL, WESH 2, WPBF 25, NBC2, WVTM 13 Birmingham News, WDSU 6, 16 WAPT, 40/29 News and Weather, KOCO 5, KOAT Action 7, KSBW Action News 8, KCRA 3, and ABC 7 News.

2 An App User’s AAID is a unique and random string of numbers associated with an individual device for purposes of targeted advertising. installed on a phone, a profile is created and assigned a Braze ID, which is composed of a string of letters and numbers. If a user permits HTV to use

geolocation data “always” or when using the App, the geolocation data is sent to Braze when the App is “foregrounded” – that is, when the App is open and in focus or actively being displayed on a phone’s screen. When a user opens an article, a unique content ID associated with the article is sent to Braze.

And when a user plays a video from an article, additional data indicating that a video was played and an updated “video counter” showing the total number of videos watched in a user’s profile are relayed to Braze. Each time an App

is foregrounded counts as a new session. The geolocation data, content ID, and video counter, if relevant, are associated with the user’s Braze ID, and where supplied, the user’s email address. Users may enable or disable sharing geolocation data or AAID at any time – HTV does not have a record

of when they do so. HTV uses Google Ad Manager (GAM) to push out advertisements based on App users’ AAIDs. When certain ads are shown, an App user’s AAID, geolocation data – if the user enabled geolocation services – and

article ID are allegedly sent to Google. I. Expert Report and Testimony

A. Motion to Strike the Report and Testimony of Dr. Vallina- Rodriguez

Before addressing the merits of Therrien’s motion for class certification, the court will first consider Hearst’s motion to strike the expert report and testimony of Dr. Narseo Vallina-Rodriguez for all purposes pursuant to Daubert v. Merrell Dow Pharmaceuticals, Inc., 509 U.S. 579 (1993). See Dkt. # 105 at 4. Hearst argues that Dr. Vallina-Rodriguez’s report and testimony should be stricken as it is based on an unreliable methodology. See Dkt. # 96 at 6. Two gateposts frame the exercise of a judge’s discretion to admit or exclude expert testimony. First, the proffered witness must be shown to be

sufficiently qualified by “knowledge, skill, experience, training, or education.” Fed. R. Evid. 702. Second, the Federal Rules of Evidence require that the judge “ensure that any and all scientific testimony or evidence

admitted is not only relevant, but [also] reliable” (and helpful to the finder of fact). Daubert, 509 U.S. at 589. “[T]he trial judge must determine at the outset, pursuant to Rule 104(a), whether the expert is proposing to testify to (1) scientific knowledge that (2) will assist the trier of fact to understand or

determine a fact in issue.” Id. at 592. “This entails a preliminary assessment of whether the reasoning or methodology underlying the testimony is scientifically valid and of whether that reasoning or methodology properly can be applied to the facts in issue.” Id. at 592-593. Some of the factors

relevant to determining whether a methodology is valid are: (1) whether a theory or technique can be (and has been) tested; (2) whether the theory or technique has been subjected to peer review and publication; (3) the known or potential rate of error; and (4) whether there is widespread acceptance of

the theory or technique in the relevant scientific community. See id. at 593- 594. Dr. Vallina-Rodriguez has considerable experience in the fields of

mobile platforms and application analysis, computer network analysis and measurement, and mobile privacy and security risks. See Dkt. # 97-10, ¶ 37. His 15-year career in these fields – which includes his work at the International Computer Science Institute at University of California,

Berkeley, analyzing mobile applications’ privacy and security practices, and his work at AppCensus Inc., analyzing Android users’ geolocation data and unique identifiers – along with his education – which includes a M.Sc. in Telecommunications Engineering from the University of Ovideo and a PhD

in Computer Science from the University of Cambridge – make him more than sufficiently qualified by experience and education. See id. ¶¶ 7-26. In forming his opinion that the disclosure of App users’ email addresses, geolocation, and AAIDs was reasonably and foreseeably likely to

reveal their identities to Braze and Google, Dr. Vallina-Rodriguez relied on a systematic literature survey of various peer-reviewed empirical studies that include data aggregations similar to those in this case, e.g., timestamped geolocation data points collected by GPS sensors on cell phones. See Vallina-

Rodriguez Expert Report (Dkt. # 97, Ex. J) ¶¶ 3, 46. The idea that individuals are likely to be identified and de-anonymized3 by cross-referencing external data sources against frequented locations is a conclusion accepted within the

data privacy research community.4 See id. ¶ 46; Dkt. # 105 at 17. Although,

3 “De-anonymize” in this context means “the ability to extract users’ first and last names from geolocation information by correlating/linking geolocation information with public and/or private information.” Vallina- Rodriguez Expert Report (Dkt. # 97, Ex. J) ¶ 44. This includes “information publicly [o]n the web, U.S. Census data, and online social networks along with data offered by brokers and online identity managers.” Id.

4 HTV contends that the peer-reviewed studies Dr. Vallina-Rodriguez relies on do not retrieve the names of the subjects, but rather show that disclosure of geolocation data only reveals people’s frequented locations. See Dkt. # 96 at 14. However, many of Dr. Vallina-Rodriguez’s cited sources report that they have the capacity to de-anonymize users based off geolocation, although they have not explicitly identified such users in their studies – the studies further recognize that the geolocation data may be joined with publicly available information, such as an individual’s home address, workplace address, or image, to identify the person by name. See Dkt. # 97, Ex. J at 2; Dkt. #97, Ex. M at 19 (Philippe Golle and Kurt Partridge, On the Anonymity of Home/Work Location Pairs 390-397 (2009)) (noting “[a]pproximate home and work locations may then be joined with as HTV points out, Dr. Vallina-Rodriguez has not conducted an empirical analysis involving Therrien personally, he was given access to only a single

datapoint, which was the last known geolocation coordinate of Therrien. Dkt. # 105 at 7. Moreover, Dr. Vallina-Rodriguez did not analyze the 78 points of geolocation data for former named plaintiff Michele Saunders because he was not attempting to identify her. See Mantha v.

QuoteWizard.com, LLC, 347 F.R.D. 376, 387 (D. Mass. 2024) (denying a motion to strike where the expert’s methodology did not identify the plaintiff because she was not assigned the expert task of identifying him). Hearst’s

challenges to Dr. Vallina-Rodriguez’s report and testimony, at best, go to the weight of the evidence as opposed to its admissibility. It is worth remembering that: Daubert does not require that a party who proffers expert testimony carry the burden of proving to the judge that the expert’s assessment of the situation is correct . . . . In short, Daubert neither requires nor empowers trial courts to determine which of several competing theories has the best provenance. It demands only that the proponent of the evidence show that the expert’s conclusion has been arrived at in a scientifically sound and methodologically reliable fashion.

employment directories, tax records or any other public or private dataset available to the adversary to map pairs of home and workplace locations to identities”). The fact that one can identify someone’s name based off their frequented locations may be too obvious or of “too limited interest to be published.” See Daubert, 509 U.S. at 593 (holding that “some propositions . . . are too particular, too new, or of too limited interest to be published”) Ruiz-Troche v. Pepsi Cola of Puerto Rico Bottling Co., 161 F.3d 77, 85 (1st Cir. 1998), citations omitted.

To the extent Dr. Vallina-Rodriguez’s opinions constitute legal conclusions or are based on insufficient anecdotal evidence, they may be subject to a proper motion in limine or appropriate objection at trial. See Palandjian v. Foster, 446 Mass. 100, 111, 842 N.E.2d 916 (2006); United

States v. Diaz, 300 F.3d 66, 74 (1st Cir. 2002); see also Daubert, 509 U.S. at 596 (“Vigorous cross-examination, presentation of contrary evidence, and careful instruction on the burden of proof are the traditional and appropriate

means of attacking shaky, but admissible evidence.”). On this record and at this stage of the case, the court denies the motion to strike the report and testimony of Dr. Vallina-Rodriguez. B. Expert Report of Dr. Polakis

Hearst also moves to strike the allegedly untimely expert report of Dr. Jason Polakis. See Dkt. # 100. Federal Rule of Civil Procedure 26(a)(2)(D) provides that expert disclosures are to be made “at the times and in the sequence that the court orders.” Fed. R. Civ. P. 26(a)(2)(D). Rule 37(c)(1)

excludes witnesses not disclosed pursuant to the court’s schedule “unless the failure was substantially justified or is harmless.” Fed. R. Civ. P. 37(c)(1). When considering whether to strike an untimely expert report, the court may consider various factors: (1) the history of the litigation; (2) the sanctioned party’s need for the precluded evidence; (3) the sanctioned party’s

justification (or lack of one) for its late disclosure; (4) the opponent-party’s ability to overcome the late disclosure’s adverse effects (e.g., the surprise and prejudice associated with the late disclosure); and (5) the late disclosure’s impact on the district court’s docket. See Macaulay v. Anas, 321 F.3d 45, 51

(1st Cir. 2003). On Friday, December 6, 2024 at 5:31 pm, plaintiffs’ counsel emailed Hearst’s counsel an expert report from Dr. Polakis, who had not previously

been identified by the plaintiff. Butler Decl. (Dkt. # 102) ¶ 9. The scheduling order entered by the court in this case makes clear, as recently as May 0f 2024, that plaintiff’s expert reports were due on October 18, 2024, and that all expert discovery was to be completed by December 6, 2024. See Dkt. #

43. Therrien failed to disclose Dr. Polakis or his expert report within this court’s discovery deadlines and offers no reason as to why he could not have identified him earlier and provided his report in a timely manner. The court does not accept Therrien’s lame characterization of the report as a “rebuttal”

and makes particular note of the fact that there was no effort on plaintiff’s part to seek an amendment extending the court’s discovery schedule and its deadlines. Of equal import is the fact that Rule 26 provides a schedule for a rebuttal report only in the absence of a scheduling order (which is not the case here). See Fed. R. Civ. P. 26(a)(2)(D); Local Rule 26.4(a). To permit

Therrien to ambush the defendant with a previously undisclosed expert report of a previously unidentified witness would “undermine[] the purpose of setting deadlines for expert disclosures; those deadlines must have some force if the courts are to be able to manage their dockets in any meaningful

way.” Crawford-Brunt v. Kruskall, 489 F. Supp. 3d 4, 9 (D. Mass. 2020); see also Santiago-Diaz v. Laboratorio Clinico Y De Referencia Del Este and Sara Lopez, M.D., 456 F.3d 272, 277 (1st Cir. 2006).

II. Class Certification Finally, Therrien seeks to certify a Rule 23(b)(3) class. The court may certify the class only if Therrien has established the four “threshold requirements” of Rule 23(a) – numerosity, commonality, typicality, and

adequacy of representation – and the two additional prerequisites of Rule 23(b)(3) – predominance and superiority. In re Nexium Antitrust Litig., 777 F.3d 9, 17 (1st Cir. 2015), quoting Comcast Corp. v. Behrend, 569 U.S. 27, 33 (2013). Predominance and superiority require the court to find that “the

questions of law or fact common to class members predominate over any questions affecting only individual members, and that a class action is superior to other available methods for fairly and efficiently adjudicating the controversy.” In re Nexium Antitrust Litig., 777 F.3d at 18.

Therrien also must satisfy the implicit Rule 23 requirement that he demonstrate, by a preponderance of the evidence, that the class is “currently and readily ascertainable based on objective criteria.” Id. at 19, citing Carrera v. Bayer Corp., 727 F.3d 300, 306 (3d Cir. 2013). At the class

certification stage, the court “must be satisfied that, prior to judgment, it will be possible to establish a mechanism for distinguishing the injured from the uninjured class members.” In re Nexium Antitrust Litig., 777 F.3d at 19.

Such a mechanism must be “administratively feasible” and “protective of defendants’ Seventh Amendment and due process rights.” Id. Therrien proposes a class defined as follows: All persons in the United States that (i) downloaded one of the Class Apps onto their mobile phone, (ii) enabled location permissions for the Class App for at least 250 sessions over a period of at least one month, and (iii) watched at least ten (10) videos between May 5, 2021, and April 16, 2024 (the “Class Period”).

Dkt. # 84 at 6; Dkt. # 104 at 25. The Class Apps refer to 28 mobile applications for Android and iOS that HTV owns and operates. See supra note 1. Therrien also proposes two subclasses. The Email Subclass is defined as follows: all Class Members who provided their email address to the Class Apps at the time of onboarding. Dkt. # 84 at 6. The AAID Subclass would include: all Class Members who (i) downloaded one of the Class Apps onto their Android mobile devices; and (ii) did not limit ad tracking during the

time they used the Class Apps during the Class Period. Dkt. # 84 at 6. Even assuming (which is doubtful on its face) that both proposed classes and subclasses satisfy the requirements of Rule 23(a), Therrien has failed to demonstrate that the members of the proposed classes are

“currently and readily ascertainable based on objective criteria.” In re Nexium Antitrust Litig., 777 F.3d at 19. Therrien relies on Dr. Vallina- Rodriguez’s proposed method of identifying proposed class members based

on geolocation data.5 This method consists of: analyzing geolocation data points over the class period to determine the users’ “top-2” most-frequented locations; sending that data (assuming those “top-2” locations are the residential and secondary addresses of users) to third-party brokers who will

5 HTV spreadsheets, which show every account whose geolocation and/or e-mail address was disclosed to Braze, along with the number of App “sessions” initiated by each account and number of videos that were watched by an App user, are insufficient for identifying proposed class members. Dkt. # 94 at 17. They do not show who had geolocation enabled for those sessions or whether the 10 or more videos were viewed during the class period (no time stamp is recorded with the “video view” counter). Id at 17, 21; Rosellini Decl. (Dkt. # 97, Ex. F) ¶¶ 18, 28. HTV also attests that it is “untrue and unsupported by any evidence sought in discovery or otherwise” that Braze and Google have this information. Dkt. # 94 at 21. Both parties agree that HTV, Braze, and Google do not have the names of potential class members. use additional data sources; and validating whether the resulting names are HTV App users through manual steps, including testimony from each

putative class member confirming that the information disclosed is theirs. See Expert Report of Vallina-Rodriguez (Dkt. # 97, Ex. J) ¶¶ 58, 104-107; Vallina-Rodriguez Dep. (Dkt. # 97, Ex. E) at 278:20-25, 281:2-4; Dkt. # 96 at 6-7. Such testimony from each putative class member necessary to

validate whether the geolocation data points identify residential and secondary addresses, and the names associated with those addresses would be “administratively infeasible” and potentially violative of HTV’s due

process rights. In re Asacol Anitrust Litig., 907 F.3d at 52; see In re Hulu Privacy Litig., 2014 WL 2758598, at *15 (N.D. Cal. June 17, 2014) (declining to certify the proposed class in a VPPA case because plaintiffs offered no way to identify individual class members other than broad notice and a self-

reporting, burdensome affidavit – cross-referencing email records would identify a large pool of users with only a subset of the pool suffering any injury). For example, according to plaintiff, 75 out of 78 geolocation points

from Braze reflected the home address of the original named plaintiff, Saunders. Dkt. # 84 at 19; Dkt. # 77 ¶¶ 4-5. However, the address is a multi- unit apartment building with hundreds of occupants and Vallina-Rodriguez admits he would not be able to identify Saunders’ apartment number from the geolocation data alone. Dkt. # 94 at 18; Vallina-Rodriguez Dep. (Dkt. #

97, Ex. E) at 351:16-352:17. Without the aid of Saunders’s deposition, it would be near impossible to distinguish Saunders based on the Braze data from other users like her in her apartment complex to provide her with notice of a pending class. See Kent v. SunAmerica Life Ins. Co., 190 F.R.D 271, 278

(D. Mass 2000) (to be ascertainable, the class definition must permit a court to decide who will receive notice of a pending class). Such a process would likely result in a “line of thousands of class members waiting their turn to

offer testimony and evidence on individual issues,” with such issues predominating over common ones.6 In re Asacol Antitrust Litig., 907 F.3d at 51. In addition, although unrebutted testimony contained in affidavits

may suffice as a mechanism for identifying who was injured and who was not injured, see in re Nexium Antitrust Litig. 777 F. 3d at 21, testimony that is “genuinely challenged,” such as an element of a party’s affirmative case, cannot be used to certify a class without providing the defendant an

opportunity to litigate its defenses, In re Asacol Antitrust Litig., 907 F.3d at

6 The geolocation data in the record associated with Therrien’s App usage identifies a church. 53. Here, the determination of whether the data shared with Braze and Google reasonably and foreseeably is likely to identify a HTV user is also an

element of the VPPA claim – the ascertainability inquiry overlaps with the merits. Moreover, written consent is a defense to the VPPA claim of each member of the putative class and HTV has stated its intention to challenge any affidavits. See Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338, 367 (2011)

(holding that a “class cannot be certified on the premise that [the defendant] will not be entitled to litigate its statutory defenses to individual claims”) For the above reasons, the court declines to certify the class.

ORDER For the foregoing reasons, Hearst’s motion to strike the expert report and testimony of Dr. Vallina-Rodriguez and Therrien’s motion for class certification are DENIED. Hearst’s motion to strike the expert report of Dr.

Polakis is ALLOWED. SO ORDERED. /s/ Richard G. Stearns UNITED STATES DISTRICT JUDGE