Judge Nathanial M. Cousins, in the U.S. District Court for the Northern District of California, denied a motion to dismiss a class action lawsuit alleging violations of the Video Privacy Protection Act (VPPA) by a web-based educational platform operator. Plaintiffs claim that the defendant disclosed users’ personally identifiable information (PII) and video viewing history to third parties, including Meta and Intercom, through cookies and tracking scripts on its website, without proper consent.
Plaintiffs, registered users of the defendant’s video-based learning platform, allege that each time they watched a video, the website transmitted their full name, email address, and the title of the video viewed to third parties. Specifically, the complaint asserts that:
- The platform used the Meta Pixel and Intercom cookies/scripts to transmit this information to Meta and Intercom, respectively.
- These disclosures occurred without the users’ informed, written consent as required by the VPPA.
Defendant sought dismissal on two primary grounds:
- Consent Defense: Defendant argued that users consented to the disclosures by agreeing to the platform’s Privacy Policy and Cookie Notice during registration. To support this, the defendant requested judicial notice of various policy documents and website screenshots.
- The court rejected this argument, finding that the consent issue is fact-intensive and not suitable for resolution at the motion to dismiss stage. The court also declined to take judicial notice of the defendant’s exhibits, noting factual disputes over whether the plaintiffs actually saw or agreed to the specific policies and whether those policies provided adequate notice.
“The court may judicially notice a fact that is not subject to reasonable dispute” if it is “generally known” or “can be accurately and readily determined from sources whose accuracy cannot reasonably be questioned.” Fed. R. Evid. 201(b). The exhibits provided by Defendant are inappropriate for judicial notice, particularly at the motion to dismiss stage. Defendant not only proffers the exhibits to establish their defense that Plaintiffs encountered and agreed to these webpages and policies, but Plaintiffs also dispute the accuracy of the exhibits and the purported functionality of the webpages. See Opp’n 6–7; Jackson v. Fandom, No. 22-cv-04423-JST, 2023 WL 4670285, at *2 (N.D. Cal. July 20, 2023) (denying similar request in a VPPA case where it was “unclear whether the webpages, Terms of Use, and Privacy Policy submitted by Fandom are the same versions that may have been available to Jackson when she registered as a user”); Balestrieri v. SportsEdTV, No. 25-cv-04046-SK, 2025 WL 2776356, at *2 (N.D. Cal. Sep. 16, 2025) (denying judicial notice in a VPPA case because “Defendant essentially requests the Court accept as facts that the webpages submitted are the ones Plaintiff viewed and that Defendant did not transmit the video titles viewed by users. Not only are those facts disputed, but they form the crux of the dispute underlying this case”). The request for judicial notice is denied.
*3 “[A] defendant may seek to incorporate a document into the complaint ‘if the plaintiff refers extensively to the document or the document forms the basis of the plaintiff’s claim.’ ” Khoja v. Orexigen Therapeutics, Inc., 899 F.3d 988, 1002 (9th Cir. 2018). “[T]he mere mention of the existence of a document is insufficient to incorporate the contents of a document.” Id. (citation omitted). Plaintiff’s first amended complaint nowhere invokes Defendant’s Cookie Notice, nor the webpages and their functionalities. And merely referencing the need to register for Osmosis to view videos is insufficient for the registration webpages to form the basis of the VPPA claim. See FAC ¶ 12. The Cookie Notice and webpages, then, are “only relevant to Defendant’s consent defense.” Balestrieri, 2025 WL 2776356, at *3; Khoja, 899 F.3d at 1002 (“[I]f the document merely creates a defense to the well-pled allegations in the complaint, then that document did not necessarily form the basis of the complaint.”).
Plaintiffs concede that they quote part of Defendant’s Privacy Policy in their first amended complaint. Opp’n 7; see FAC ¶ 19. Even if, as a result, Plaintiffs incorporate by reference the Privacy Policy (which the Court does not decide), Defendant is asking the Court to use the Privacy Policy to accept as true their proffer that all subscribers, including Plaintiffs, had to agree to the Privacy Policy to register for Osmosis—a fact that is not apparent from the Privacy Policy—and affirmatively decide their consent defense. “This is not permissible at the pleading stage and is not an appropriate application of the doctrine” of incorporation by reference. Thornton v. Mindvalley, Inc., No. 24-cv-00593-EKL, 2025 WL 877714, at *3 (N.D. Cal. Feb. 14, 2025). The Court is especially disinclined to treat the Privacy Policy as incorporated by reference, and its contents as true, because Plaintiffs dispute the implications of the Privacy Policy on their VPPA claim and Defendant’s consent defense. See Opp’n 11–13. In fact, “it is improper to assume the truth of an incorporated document if such assumptions only serve to dispute facts stated in a well-pleaded complaint. This admonition is, of course, consistent with the prohibition against resolving factual disputes at the pleading stage.” Khoja, 899 F.3d at 1003.
- Sufficiency of PII Disclosure Allegations: The defendant contended that the plaintiffs failed to plausibly allege the transmission of PII, particularly arguing that the information sent via Meta Pixel did not include a Facebook ID or other data that would link users to their video viewing activity.
- The court found the plaintiffs’ allegations sufficient, noting that the transmission of a user’s name, email address, and video title can constitute PII under the VPPA. The court emphasized that the form in which the information was transmitted (e.g., as code or plain text) is a factual question not appropriate for resolution at this stage.
In the Ninth Circuit, PII “means only that information that would ‘readily permit an ordinary person to identify a specific individual’s video-watching behavior.’ ” Eichenberger v. ESPN, Inc., 876 F.3d 979, 985 (9th Cir. 2017); see 18 U.S.C. § 2710(a)(3). “Personally identifiable information includes information that ‘standing alone, identifies a person’ as well as information that is ‘capable of’ identifying a person.’ ” Lee v. Plex, Inc., 773 F. Supp. 3d 755, 772 (N.D. Cal. 2025) (quoting Eichenberger, 876 F.3d at 984).
KIMSA NGUYEN, et al., v. ELSEVIER INC., No. 25-CV-00825-NC, 2025 WL 2901059 (N.D. Cal. Oct. 7, 2025).
