The Southern District of New York dismissed a putative class action brought by a digital subscriber to NBA.com, who alleged that the National Basketball Association (NBA) violated the Video Privacy Protection Act (VPPA) by disclosing his video-viewing information to Meta (Facebook’s parent company) via the Meta Pixel tracking tool. Plaintiff claimed that the NBA transmitted data such as video titles, URLs, and Facebook ID (FID) to Meta, which could purportedly be used to identify individual users’ video-watching habits.
After an initial dismissal and subsequent appeal, the Second Circuit remanded the case, finding plaintiff had plausibly alleged consumer status under the VPPA. The NBA again moved to dismiss, arguing that the plaintiff failed to allege the disclosure of “personally identifiable information” as required by the statute.
The VPPA prohibits video tape service providers from knowingly disclosing “personally identifiable information” (PII) about consumers. The central issue was whether the information allegedly shared—specifically, the Facebook ID and video-viewing data—constituted PII under the VPPA.
The Second Circuit recently clarified the standard for PII in Solomon v. Flipps Media, Inc., holding that PII encompasses only information that would allow an ordinary person, without specialized knowledge or tools, to identify a consumer’s video-watching habits. Information that only a sophisticated technology company could use to make such an identification does not meet the statutory definition.
Applying the “ordinary person” standard, the court found that the plaintiff’s allegations mirrored those previously rejected in both Solomon and Hughes v. National Football League.
The VPPA defines “personally identifiable information” as “information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider.” 18 U.S.C. § 2710(a)(3). The Courts of Appeals have diverged in their interpretation of this term. See Nixon v. Pond5, Inc., No. 24-cv-05823 (JLR), 2025 WL 2030303, at *4 (S.D.N.Y. July 21, 2025) (summarizing “reasonable foreseeability” standard used in the First Circuit and “ordinary person” standard used in the Third and Ninth Circuits). The Second Circuit recently adopted the “ordinary person” standard and held that “ ‘personally identifiable information’ encompasses information that would allow an ordinary person to identify a consumer’s video-watching habits, but not information that only a sophisticated technology company could use to do so.” Solomon, 136 F.4th at 52. Thus, to survive a motion to dismiss, plaintiffs must “plausibly allege[ ] that [the defendant]’s disclosure of [information] ‘would, with little or no extra effort, permit an ordinary recipient to identify [the plaintiff]’s video-watching habits.’ ” Id. at 54 (quoting In re Nickelodeon Consumer Priv. Litig., 827 F.3d 262, 284 (3d Cir. 2016)); see Nixon, 2025 WL 2030303, at *5 (applying standard articulated in Solomon).
The court emphasized that:
- An ordinary person would not recognize a Facebook ID embedded in a “c_user” cookie or be able to connect it to a specific individual’s video-watching activity.
- The ability of a technology company or someone with specialized knowledge to use such data to identify a user is insufficient under the VPPA.
- Arguments that tools like ChatGPT or simple online searches could bridge the gap were also rejected, as the standard focuses on what an ordinary person could do with the information, not what is theoretically possible with advanced tools.
MICHAEL SALAZAR, v. NATIONAL BASKETBALL ASSOCIATION, No. 1:22-CV-07935 (JLR), 2025 WL 2830939 (S.D.N.Y. Oct. 6, 2025).
