Saunders v. Hearst Television, Inc.

Opinion

UNITED STATES DISTRICT COURT DISTRICT OF MASSACHUSETTS

CIVIL ACTION NO. 23-10998-RGS

CHARLES THERRIEN, Individually and on behalf of all others similarly situated

v.

HEARST TELEVISION, INC.

MEMORANDUM AND ORDER ON MOTION FOR SUMMARY JUDGMENT

April 25, 2025 STEARNS, D.J. Plaintiff Charles Therrien claims that defendant Hearst Television, Inc. (HTV or Hearst), unlawfully disclosed his personally identifiable information to two third parties, Braze and Google, in violation of the Video Privacy Protection Act, 18 U.S.C. § 2710 (VPPA). Before the court is HTV’s motion for summary judgment. For the following reasons, the court will allow the motion. BACKGROUND The facts, viewed in the light most favorable to Therrien as the nonmoving party, are as follows. HTV broadcasts local news and weather programming in twenty-eight local markets and offers station-specific mobile phone Apps for Android and iOS.1 These Apps provide live news, weather feeds, and articles that may contain no video content, a single video,

or multiple videos. When subscribers install the Apps, they are given the option to be placed on an email list for updates related to the Apps and to grant permission for the App to use location services. Braze

HTV uses a third-party software, Braze, to provide a web-based user interface and analytics, which allow for sending push notifications and emails about breaking news and weather alerts to App users. Push

notifications can be personalized at a topical level. When an App is first installed on a phone, a profile is created and assigned a Braze ID, which is composed of a string of letters and numbers. Users who enter their email addresses at the time that they install the App also have their email address

passed to Braze. If a user permits HTV to use geolocation data “always,” or when using the App, their geolocation coordinates, including their latitude

1 The Apps include KETV NewsWatch 7, KMBC 9 News, KCCI 8, WISN 12, WLKY, WLWT News 5, WXII 12, WTAE Pittsburgh’s Action News 4, WGAL News 8, MyNBC 5, WMUR News 9, WMTW News 8, WCVB NewsCenter 5, WBAL-TV 11, WYFF News 4, WJCL, WESH 2, WPBF 25, NBC2, WVTM 13 Birmingham News, WDSU 6, 16 WAPT, 40/29 News and Weather, KOCO 5, KOAT Action 7, KSBW Action News 8, KCRA 3, and ABC 7 News. and longitude, are sent to Braze whenever the App is “foregrounded” – that is, when the App is open and in focus or actively being displayed on their

phone’s screen. Users may enable or disable sharing geolocation data at any time – HTV does not have a record of when they do so. Online content that is available on the Apps is sourced from HTV’s internal content management system. HTV assigns each article in its system

a Content ID (COID), or a unique numeric string. A COID, also known as an Article ID or artID, typically appears at the end of the URL when an article is published online.2 The App source code is programmed to publish articles

by referencing their COID. When a user opens an article on the App, the corresponding article COID is sent to Braze. The parties dispute whether once a user plays a video from an article, additional data indicating that a

2 HTV also creates and assigns each video in the content management system a UUID, which is a separate alpha-numeric string that is unique to each video. If one or more videos are chosen to be embedded on an article page, the video UUID is used by the App’s source code to find a video in HTV’s content management system and display it on an article page. When one or more videos are included in an article, each video has its own corresponding UUID. The same video may be included in multiple articles, in which case each article will have its own COID but the video UUID for the selected video will remain the same in each article where the video appears. An article with multiple videos will have a single COID, but each video in that article will have its own UUID. UUIDs are not included in the URL corresponding to the article hosting that video. Nor are they shared with Braze or GAM. video was played as well as an updated “video counter” showing the total number of videos watched in a user’s profile are relayed to Braze.

GAM HTV uses a third-party provider, Google Ad Manager (GAM), to push out advertisements. HTV integrates GAM’s computer code into its Apps. If users grant permission to do so, their AAID3 and geolocation are used to help

select the advertisement shown. Display ads, or “banner” ads, appear on the face of an article page on a user’s device. Pre-roll ads play before any video content begins. Each time an ad is shown, HTV’s App sends the user’s Article

ID (equivalent to a COID) assigned to the article that a video is embedded in, the article URL, and the AAIDs (if the user granted permission) to GAM. Each time a display ad is shown, HTV’s App also sends the user’s geolocation data (if the user has enabled geolocation services) to GAM.

Therrien’s use of the HTV App, WMUR News 9 The undisputed facts as to Therrien are as follows. In February of 2022, Therrien downloaded the WMUR News 9 (WMUR) App on his Android phone and used the App through August of 2024. When he installed

3 AAID is a unique and random string of numbers associated with an individual mobile device, used in connection with the display of advertisements on a mobile device. Users may reset or permanently delete an AAID, or “opt out” of having App developers use an AAID altogether. An AAID is not associated with a person’s name or address. the WMUR App, he asked to receive news and weather alerts on his phone and provided his business email address to receive emails from HTV. He

also enabled geolocation services and watched various pre-recorded videos on the App related to local news and weather. HTV produced Braze ID data relating to Therrien showing a first or last App session after May 8, 2021, and at least one “video count.” Of the

produced data, there is one geolocation data point associated with Therrien’s email address with a first session of February 20, 2022, and a last session of August 27, 2023. The geolocation data point locates a church that Therrien

attends. LEGAL STANDARD Summary judgment is appropriate when, based upon the pleadings, affidavits, and depositions, “there is no genuine dispute as to any material

fact and the movant is entitled to judgment as a matter of law.” Fed. R. Civ. P. 56(a). “To succeed, the moving party must show that there is an absence of evidence to support the nonmoving party’s position.” Rogers v. Fair, 902 F.2d 140, 143 (1st Cir. 1990). “‘[T]he mere existence of a scintilla of evidence’

is insufficient to defeat a properly supported motion for summary judgment.” Torres v. E.I. Dupont De Nemours & Co., 219 F.3d 13, 18 (1st Cir. 2000), quoting Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 252 (1986).

DISCUSSION In 1988, Congress passed the VPPA in response to the Washington City Paper’s publication of Supreme Court nominee Robert Bork’s video rental history. See Yershov v. Gannett Satellite Info. Network, Inc., 820 F.3d

482, 485 (1st Cir. 2016). Without Judge Bork’s knowledge or consent, the newspaper had “obtained a list of the 146 films that the Bork family had rented from a Washington, D.C.-area video store.” In re Nickelodeon

Consumer Privacy Litig., 827 F.3d 262, 278 (3d Cir. 2016). Congress subsequently enacted the VPAA “[t]o preserve personal privacy with respect to the rental, purchase or delivery of video tapes or similar audio visual materials.” S. Rep. No. 100-599, at 1 (1988), reprinted in 1988 U.S.C.C.A.N.

4342-1. The VPPA prohibits a “video tape service provider” from “knowingly disclos[ing], to any person, personally identifiable information concerning any consumer of such provider,” subject to certain enumerated exceptions,

such as when the provider has obtained a consumer’s “informed, written consent.” 18 U.S.C. § 2710(b). “Personally identifiable information,” or PII, is defined as “includ[ing] information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider.” 18 U.S.C. § 2710(a)(3). Under First Circuit law, PII

encompasses “information reasonably and foreseeably likely to reveal which . . . videos [a person] has obtained.” Yershov, 820 F.3d at 486. Although a consumer’s name and address are per se PII, the “universe of PII is greater than the consumer’s name and address.” Id. PII also may include “name,

address, phone number, and more.” Id. For example, an iPhone user’s GPS coordinates, device identifier, and the titles of the videos he views qualifies as PII. Id. at 489.

PII In addition to the Braze ID, HTV shares three fields with Braze: (1) geolocation (latitude and longitude, but only if a user has allowed sharing); (2) COID when an article is opened; and (3) email address (if a user has

chosen to receive email notifications).4 See Dkt. # 126 at 7; Reardon Dep. (Dkt. # 120-4) at 21:15-23:5. HTV shares four fields with GAM: (1) geolocation (if a user has enabled sharing and only if a display (i.e., non- video) ad is shown); (2) article URL; (3) artID (which is similar to a COID);

and (4) AAID. See Reardon Dep. (Dkt. # 120-4) at 21:15-23:5. Therrien

4 The parties dispute whether a COID is also transmitted to Braze when a video is opened. See Reardon Dep. (Dkt. # 120-4) at 273:10-16. argues that his geolocation data, AAID, and email address are all PII. See Dkt. # 126 at 11, 19.

1. Geolocation data disclosed to Braze and GAM Here, the record shows only one geolocation data point for Therrien. See Rosellini Decl. (Dkt. # 120-1) ¶ 51; Dkt. # 120-10. The datapoint reveals the location of a church, which Therrien testified he attends with at least 75

other congregants. Therrien Dep. (Dkt. # 120-3) at 136:19-138:1, 140:8-19. If someone learned that a WMUR App user watched a video on the App at this 75-member church, that simple shard of information would not “enable

most persons to identify” the user’s home and work address and ultimately identify Therrien.5 See Yershov, 820 F.3d at 486. Thus, the court finds on this record that there is an insufficient amount of evidence for a reasonable juror to find that Therrien could “reasonably and foreseeably” be identified

from the geolocation data alone. See id. 2. AAIDs disclosed to GAM

5 Therrien contends that HTV’s data reveals that it disclosed 856 points of his geolocation to Braze between February 2022 and August 2023 and that “the remaining 855 geolocation points provide their own windows into Plaintiff’s life that will ‘identify Therrien in particular from the 75-100 congregants he testified attend the same church.’” Dkt. # 136 at 9. However, this is pure speculation as the record does not provide any indication of what those geolocation points would show. The parties agree that HTV only retained one data point. The cellphone Therrien produced in this litigation has four AAIDs.6 See Vint Decl. (Dkt. # 120-8) ¶ 22. However, Therrien claims only one of the

AAIDs was in use while he owned the phone and that he never reset his AAIDs. See Kopel Class Cert Decl. ¶ 4. On this record, there is no evidence to suggest which of the AAIDs was active from February of 2022 to August of 2024 or that GAM connected any of the four AAIDs to Therrien personally.

See Vint Decl. (Dkt. # 120-8) ¶ 23. While AAIDs can uniquely distinguish a device at a point in time, they do not provide data that identifies any individual person. Id. ¶ 19. Without more, such as a name, home, or work

address, one cannot identify Therrien based simply from his phone’s AAID. See AMMA AFRIYIE and ROY CAMPBELL, 2025 WL 962033 (S.D.N.Y. March 31, 2025) (holding that AAID on its own does not identify a particular person).7 Lastly, there is insufficient evidence in the record that the AAIDs,

even if they were combined with the one geolocation data point in the record

6 The parties agree that only GAM receives AAIDs.

7 Therrien argues that a “consumer’s AAID is the identifier that permits third parties to advertise to consumers based on their video-viewing preferences” and relies on a District of Rhode Island case, Louth v. NFL Enters. LLC, 2022 WL 4130866, at *3 (D.R.I. Sept. 12, 2022) – which was decided at the motion to dismiss stage – for the proposition that AAIDs are PII. Dkt. # 126 at 21. Although AAIDs allow for targeted advertisements, as the court previously noted, they do not reveal the identity of the user – they identify a specific device. See Vint Decl. (Dkt. # 120-8) ¶ 9. – which pointed to Therrien’s church – would be “reasonably and foreseeably likely to” reveal Therrien’s identity. See Yershov, 820 F.3d at 486.

3. Email address disclosed to Braze Therrien contends that an email address is per se identifying under the VPPA. See Dkt. # 126 at 19. Here, Therrien disclosed his email address to Braze only. While Therrien relies on a screenshot of a Google search of his

email address to reveal his full name, address, age, and phone number, there is insufficient evidence in the record that Braze could have used Therrien’s email address to identify him specifically or would have had any incentive to

do so.8 See Dkt. # 127-4. Unlike in Yershov, Therrien has not provided any evidence that Braze has a “game program” that allows it “to link the [email address] to a certain person by name, address, phone number, and more.” See Yershov, 820 F.3d at 487.

Moreover, the VPPA has a narrow exception for disclosures made “incident to the ordinary course of business of the video tape service provider.” 18 U.S.C. § 2710(b)(2)(E). “[O]rdinary course of business” means “debt collection activities, order fulfillment, request processing, and the

transfer of ownership.” Id. § 2710(a)(2). Video tape service providers may

8 Therrien has not provided any information as to who conducted this Google search, what time such a search occurred, or whether those same results would have appeared at the time he provided his email to Braze. use third parties in their business operations without giving rise to liability under the VPPA. Sterk v. Redbox Automated Retail, LLC, 770 F.3d 618, 623

(7th Cir. 2014) (holding that the ordinary course of business exception applies to a defendant outsourcing its customer service support to a third party because customer service is a function of business operations normally performed by a company itself); S. Rep. No. 100-599, at 14 (1988), reprinted

in 1988 U.S.C.C.A.N 4342. Even if the court were to assume that Therrien’s email address is PII, the fully developed record shows that HTV’s disclosure of the email address

to Braze was incident to order fulfillment or request processing.9 Braze acts as HTV’s vendor to assist HTV in sending push alerts to Therrien’s phone, along with newsletters and updates to Therrien’s email address. Rosellini Decl. (Dkt. # 120-1) ¶ 13. HTV’s disclosures to Braze were not “part of [a]

targeted advertising campaign which is intended to drive revenue.” Rancourt v. Meredith Corp., 2024 WL 381344, at *17 (D. Mass. Feb. 1, 2024).10 Therrien purposefully disclosed his email address and signed up to

9 As HTV disclosed Therrien’s email addresses to Braze only, the court does not consider whether the ordinary course of business exception applies to GAM.

10 In Braze’s contract with HTV, Therrien points to Braze’s Statement of Work, which includes providing an “analytics tracking recommendation worksheet,” “deep linking recommendations,” and “dynamic personalization receive such newsletters and updates – he was not required to provide his email address (or grant geolocation services) to HTV to install or use the App,

and was free to unsubscribe from emails (and opt out of location sharing) at any time. Rosellini Decl. (Dkt. # 120-1) ¶¶ 9, 10. Thus, the court finds that even if Therrien’s email address was PII, its disclosure to Braze falls within the ordinary course of business exception.

ORDER For the foregoing reasons, HTV’s motion for summary judgment is ALLOWED. The clerk will enter judgment for HTV and close the case.

SO ORDERED. /s/ Richard G. Stearns UNITED STATES DISTRICT JUDGE

for campaigns.” He argues that the disclosures were “made for the purpose of analytics” and, therefore, should not fall under the ordinary course of business exception. See Dkt. # 126 at 31; Kopel Decl. (Dkt. # 85-6). First, the timing of the Statement of Work predates HTV’s use of Braze for email services. See Rosellini Dep. (Dkt. # 120-2) at 97:16-25. Second, HTV, as previously discussed, acknowledges that its HTV editorial team now uses the analytics provided via the Braze interface to send push notifications and email communications requested by App users. See Rosellini Decl. (Dkt. # 120-10) ¶ 42; Rosellini Dep. (Dkt. # 120-2) at 96:18-25, 167:3-168:18.