Case 1:22-cv-00644-TWT Document 29 Filed 07/15/22 Page 1 of 23
`
`IN THE UNITED STATES DISTRICT COURT
`FOR THE NORTHERN DISTRICT OF GEORGIA
`ATLANTA DIVISION
`
`Plaintiff,
`
`DEBRA LEBAKKEN, individually and
`on behalf of all others similarly situated,
`
`
`
`v.
`
`WEBMD, LLC,
`
`
`
`Defendants.
`
`
`
`MOTION TO DISMISS THE FIRST
`AMENDED COMPLAINT
`
`
`
`
`CIVIL ACTION
`FILE NO.: 1:22-cv-0644-TWT
`
`
`
`
`
`
`
`
`
`
`
`
`

`

`Case 1:22-cv-00644-TWT Document 29 Filed 07/15/22 Page 2 of 23
`
`TABLE OF CONTENTS
`
`
`Page
`
`
`I.
`
`INTRODUCTION .......................................................................................... 4
`
`II.
`
`FACTUAL BACKGROUND......................................................................... 6
`
`A.
`
`Lebakken’s Newsletter Subscription .................................................... 6
`
`B. WebMD’s Alleged use of the Facebook Pixel ..................................... 7
`
`C.
`
`Plaintiff’s Video Views ........................................................................ 8
`
`III. LEGAL STANDARD .................................................................................... 9
`
`IV. ARGUMENT .................................................................................................. 9
`
`A.
`
`Plaintiff is not a Consumer under the VPPA Because She Did
`Not Rent, Purchase, or Subscribe to Any Video Service from
`WebMD .............................................................................................. 10
`
`1.
`
`2.
`
`Plaintiff is not a “subscriber” under the VPPA. ...................... 10
`
`Plaintiff is not a subscriber of a video service ......................... 12
`
`B.
`
`Plaintiff Failed to Allege Facts Sufficient to Suggest that
`WebMD Shared Her Personally Identifiable Information in
`Connection with Video Views. .......................................................... 16
`
`1.
`
`2.
`
`Plaintiff fails to allege that her e-mail or Facebook ID
`was transmitted to Facebook. ................................................... 16
`
`Plaintiff fails to allege that WebMD disclosed any
`Facebook IDs. .......................................................................... 17
`
`3.
`
`Browser information is not PII ................................................ 18
`
`C.
`
`Plaintiff Fails to Adequately Plead Any Alleged Disclosure
`Was Made Knowingly. ....................................................................... 19
`
`V.
`
`CONCLUSION ............................................................................................. 21
`
`
`
`i
`
`

`

`Case 1:22-cv-00644-TWT Document 29 Filed 07/15/22 Page 3 of 23
`
`
`
`Cases
`
`TABLE OF AUTHORITIES
`
`Page(s)
`
`Ashcroft v. Iqbal,
`556 U.S. 662 (2009) .............................................................................................. 6
`
`Austin-Spearman v. AMC Network Entertainment LLC,
`98 F. Supp.3d 662 (S.D.N.Y. 2015) ........................................................... 7, 9, 10
`
`Bell Atl. Corp. v. Twombly,
`550 U.S. 544 (2007) .............................................................................................. 6
`
`Costanzo v. City of Omaha,
`No. 8:04CV99, 2004 WL 2359722 (D. Neb. Oct. 19, 2004) ............................. 12
`
`Ellis v. Cartoon Network,
`803 F.3d 1251 (11th Cir. 2015) .................................................................. 7, 8, 10
`
`In re Hulu Priv. Litig.,
`No. C 11-03764 LB, 2014 WL 1724344 (N.D. Cal. Apr. 28, 2014) ............ 15, 16
`
`In re Hulu Privacy Litigation,
`86 F.Supp.3d 1090 (N.D. Cal. 2015) ............................................................ 16, 17
`
`Mollett v. Netflix, Inc.,
`Case No. 5:11–CV–01629–EJD, 2012 WL 3731542 (N.D. Cal.
`Aug.17, 2012) ..................................................................................................... 16
`
`In re Nickelodeon Consumer Privacy Litigation,
`827 F.3d 262 (3d Cir. 2016) ......................................................................... 12, 15
`
`Papasan v. Allain,
`478 U.S. 265 (1986) .............................................................................................. 6
`
`Perry v. Cable News Network, Inc.,
`854 F.3d 1336 (11th Cir. 2017) ................................................................ 8, 10, 11
`
`Robinson v. Disney Online,
`152 F. Supp. 3d 176 (S.D.N.Y. 2015) ................................................................ 13
`
`Yershov v. Gannett Satellite Information Network, Inc.,
`104 F. Supp. 3d 135 (D. Mass. 2015) ................................................................... 8
`
`ii
`
`

`

`Case 1:22-cv-00644-TWT Document 29 Filed 07/15/22 Page 4 of 23
`
`
`
`STATUTES, RULES & REGULATIONS
`
`18 U.S.C. § 2710(a)(1) ............................................................................................... 7
`
`18 U.S.C. § 2710(a)(3) ....................................................................................... 13, 16
`
`18 U.S.C. § 2710(a)(4) ............................................................................................... 7
`
`18 U.S.C. § 2710(b)(1)............................................................................................... 6
`
`18 U.S.C. § 2710(b)(2)(B) ....................................................................................... 16
`
`Fed. R. Civ. P. 12(b)(6) .......................................................................................... 1, 3
`
`
`
`
`iii
`
`

`

`Case 1:22-cv-00644-TWT Document 29 Filed 07/15/22 Page 5 of 23
`
`
`
`Defendant WebMD, LLC (“WebMD”), by and through its undersigned
`
`counsel, respectfully moves to dismiss Plaintiff Debra Lebakken’s (“Plaintiff”) First
`
`Amended Complaint pursuant to Federal Rule of Civil Procedure 12(b)(6) for failure
`
`to state a claim upon which relief can be granted. WebMD submits the following
`
`arguments in support of this Motion and requests that the Court enter an order
`
`dismissing the First Amended Complaint with prejudice.
`
`I.
`
`Introduction
`
`This is one of more than a dozen Video Privacy Protection Act (“VPPA”)
`
`class actions plaintiff’s counsel and other members of the plaintiffs’ bar have filed
`
`in recent months in federal courts across the country. Challenging online content
`
`providers’ use of the Facebook Pixel, a piece of code installed on their websites,
`
`these actions seek to multiply the VPPA’s $2,500 in statutory damages by a putative
`
`nationwide class. This is the only such action within the Eleventh Circuit, which
`
`has twice affirmed the dismissal of similar claims.
`
`In 2017, Debra Lebakken subscribed to a free e-mail newsletter on
`
`WebMD.com, an online publisher of health news and information. Over four years
`
`later, in January 2022, Lebakken navigated to WebMD.com and watched
`
`unspecified videos. She does not allege that she accessed the videos through the
`
`newsletter, that she signed into the site, or that the videos were restricted to
`
`4
`
`

`

`Case 1:22-cv-00644-TWT Document 29 Filed 07/15/22 Page 6 of 23
`
`
`
`newsletter subscribers or accountholders. However, she alleges that by virtue of her
`
`email subscription, she is a “subscriber” within the meaning of the VPPA.
`
`Lebakken alleges that the Facebook Pixel transmits video viewing
`
`information to Facebook. According to Plaintiff, the Pixel also causes a user’s
`
`browser to transmit certain other information, the specifics of which depend on
`
`whether a user is a Facebook accountholder, whether she is logged in to her
`
`Facebook account, whether she has recently logged out of her account, and whether
`
`she has cleared her browser’s cookies. A Facebook accountholder allegedly can
`
`confirm that her information has been collected through a given Pixel on Facebook’s
`
`website.
`
`Although Lebakken alleges she is a Facebook accountholder, she does not
`
`allege that she was logged in to Facebook, had recently or long-ago logged out of
`
`Facebook, or had cleared her cookies; so it is unclear what, if any, identifying
`
`information was shared. Nor does she purport to have confirmed that WebMD’s
`
`Pixel collected her information through her Facebook account.
`
`Plaintiff failed to allege facts that could plausibly support a violation under
`
`the Act. First, she is not a “subscriber” within the meaning of the VPPA, and so
`
`cannot assert a claim. Plaintiff’s free newsletter subscription does not have the
`
`indicia of ongoing commitment necessary to establish that she is a “subscriber”
`
`under Eleventh Circuit precedent. Nor is there a sufficient nexus between her
`
`5
`
`

`

`Case 1:22-cv-00644-TWT Document 29 Filed 07/15/22 Page 7 of 23
`
`
`
`newsletter subscription and her video viewing on the website to bring any
`
`subscription within the reach of the statute.
`
`Second, Plaintiff has failed to allege that her personally identifiable
`
`information (“PII”) was disclosed in connection with her video views. Because she
`
`does not allege whether or when she logged into Facebook, she has not plausibly
`
`alleged that her Facebook ID was shared. And she has not alleged that WebMD ever
`
`had access to her Facebook ID such that it could share it. If she had not recently
`
`logged into Facebook, only a browser identifier was shared, which is not PII under
`
`the statute.
`
`Finally, Plaintiff fails to allege facts sufficient to suggest that any disclosure
`
`of PII that may have occurred, was done knowingly.
`
`For these reasons, the First Amended Complaint fails to state a claim upon
`
`which relief can be granted and should be dismissed with prejudice.
`
`II.
`
`Factual Background1
`
`A. Lebakken’s Newsletter Subscription
`
`Debra Lebakken is a frequent user of WebMD.com, a website operated by
`
`WebMD LLC that provides health information and news to the public. First
`
`Amended Complaint (“FAC”) ¶¶ 2, 64. In November 2017, she provided her e-mail
`
`address and birthday to WebMD to sign up for an account and a free newsletter.
`
`
`1 Pursuant to Federal Rule of Civil Procedure 12(b)(6), WebMD takes the allegations of
`Plaintiff’s Complaint as true only for the purposes of this motion.
`
`6
`
`

`

`Case 1:22-cv-00644-TWT Document 29 Filed 07/15/22 Page 8 of 23
`
`
`
`FAC ¶ 62. She does not allege that she ever read the newsletter or logged into a
`
`WebMD account.
`
`B. WebMD’s Alleged use of the Facebook Pixel
`
`At some unspecified point, WebMD began to host the Facebook Pixel on its
`
`website to better serve ads to its users. FAC ¶ 24. According to Plaintiff, the Pixel
`
`shares video viewing information with Facebook. Id. ¶¶ 24-29. The Pixel also causes
`
`certain information to be transmitted to Facebook, the specifics of which depend on
`
`the website user’s interactions with Facebook:
`
`•
`
`First, if a user is signed into Facebook, the Pixel purportedly prompts her
`
`browser to send data from a c_user cookie, a cookie installed by Facebook,
`
`back to Facebook. Id. ¶ 30. This data includes an unencrypted Facebook ID.
`
`Id.
`
`•
`
`Second, if a user has recently logged out of Facebook, the Pixel purportedly
`
`prompts her browser to send an encrypted Facebook ID and browser identifier
`
`via the fr_cookie to Facebook. Id. ¶¶ 32-32.The fr_cookie expires after 90
`
`days unless renewed. Id. ¶ 36.
`
`•
`
`Third, if a user does not have a Facebook account, the Pixel purportedly sends
`
`a browser identifier via a different combination of cookies. Id. ¶¶ 32-33.
`
`Plaintiff does not allege what happens if a user logged out of her Facebook
`
`account months ago or never previously logged into her account on that device or
`
`7
`
`

`

`Case 1:22-cv-00644-TWT Document 29 Filed 07/15/22 Page 9 of 23
`
`
`
`browser. Nor does she address what happens if a user clears her cookie cache or
`
`directs Facebook to restrict its use of information through privacy settings.
`
`Plaintiff’s allegations focus on Facebook, but she fails to give any clear
`
`indication as to the role of WebMD or its newsletter in these same allegations.
`
`Lebakken alleges that when a user subscribes to the WebMD newsletter, the Pixel
`
`causes her email address to be transmitted to Facebook. She also alleges that
`
`WebMD broadly shares customer lists with Facebook. However, she does not allege
`
`that either is disclosed in connection with video viewing information.
`
`C.
`
`Plaintiff’s Video Views
`
`In January 2022, Plaintiff navigated to WebMD.com and viewed several
`
`videos. She does not allege that she accessed these videos through a newsletter, that
`
`she was logged into a WebMD account, or that the videos were restricted to
`
`registered users. And although she is a Facebook accountholder, she does not allege
`
`whether she was logged into Facebook, had recently logged out, had cleared her
`
`cookie history, or had adjusted her Facebook privacy settings. Lebakken alleges that
`
`any Facebook user may determine whether specific Pixels gathered information
`
`pertaining to them, but she does not state that she has done so. Despite extremely
`
`detailed allegations regarding the capability of the Pixel and the types of cookies it
`
`shares under various factual circumstances, with respect to her own experience, she
`
`conclusorily alleges, “When Plaintiff Lebakken watched videos on WebMD.com,
`
`8
`
`

`

`Case 1:22-cv-00644-TWT Document 29 Filed 07/15/22 Page 10 of 23
`
`
`
`Defendant disclosed her Facebook ID, email address, and other identifiers to
`
`Facebook.” Id. ¶ 65.
`
`III. Legal Standard
`
`To withstand a motion to dismiss, a complaint must “give the defendant fair
`
`notice of what the claim is and the grounds upon which it rests,” as well as plausibly
`
`allege facts supporting a claim for which relief may be granted. Bell Atl. Corp. v.
`
`Twombly, 550 U.S. 544, 555 (2007); Ashcroft v. Iqbal, 556 U.S. 662, 663 (2009).
`
`The standard promulgated in Twombly and Iqbal requires that a complaint must do
`
`more than merely contain “labels and conclusions” or “a formulaic recitation of the
`
`elements of a cause of action.” Twombly, 550 U.S. at 555–56. Courts must view the
`
`complaint in the light most favorable to the plaintiff, accepting all well-pleaded
`
`factual allegations as true, but courts are not obligated to accept “a legal conclusion
`
`couched as a factual allegation.” Twombly, 550 U.S. 544, 555 (quoting Papasan v.
`
`Allain, 478 U.S. 265, 286 (1986)).
`
`IV. Argument
`
`
`
`To plead a violation of the Video Privacy Protection Act (“VPPA”), a plaintiff
`
`must allege: (1) she is a consumer under the statute, (2) the defendant is a video tape
`
`service provider, (3) who disclosed the plaintiff’s personally identifiable information
`
`(“PII”), (4) and did so knowingly. 18 U.S.C. § 2710(b)(1). Plaintiff failed to
`
`9
`
`

`

`Case 1:22-cv-00644-TWT Document 29 Filed 07/15/22 Page 11 of 23
`
`
`
`adequately allege that she is a consumer under the statute, that any PII was actually
`
`disclosed, and—if any PII was disclosed—that WebMD knowingly caused that
`
`disclosure. Therefore, her claim must be dismissed.
`
`A.
`
`Plaintiff is not a Consumer under the VPPA Because She Did Not
`Rent, Purchase, or Subscribe to Any Video Service from WebMD
`
`Plaintiff must be a “consumer” to state a VPPA claim. A consumer is a “renter,
`
`purchaser, or subscriber of goods or services from a video tape service provider.” 18
`
`U.S.C. § 2710(a)(1). “Video tape service provider” is further defined as “any person,
`
`engaged in the business . . . of rental, sale, or delivery of prerecorded video cassette
`
`tapes or similar audio visual materials.” 18 U.S.C. § 2710(a)(4). Plaintiff does not
`
`allege that she rented or purchased anything from WebMD. Thus, she must
`
`sufficiently allege that she is a “subscriber.” She did not.
`
`1.
`
`Plaintiff is not a “subscriber” under the VPPA.
`
`The Eleventh Circuit has interpreted the meaning of “subscriber” as requiring
`
`“some type of commitment, relationship, or association (financial or otherwise)
`
`between a person and an entity.” Ellis v. Cartoon Network, 803 F.3d 1251, 1256
`
`(11th Cir. 2015); see also Austin-Spearman v. AMC Network Entertainment LLC, 98
`
`F. Supp.3d 662, 669 (S.D.N.Y. 2015) (“[W]hat remains is the subscriber’s deliberate
`
`and durable affiliation with the provider . . . these arrangements necessarily require
`
`some sort of ongoing relationship between provider and subscriber.”). While
`
`“payment is not a necessary element of subscription,” it is “one factor a court should
`
`10
`
`

`

`Case 1:22-cv-00644-TWT Document 29 Filed 07/15/22 Page 12 of 23
`
`
`
`consider when determining whether an individual is a ‘subscriber’ under the VPPA.”
`
`Ellis 803 F.3d at 1256. Other factors to consider are “registration, commitment,
`
`delivery, [expressed association,] and/or access to restricted content.” Id. (alteration
`
`in original) (quoting Yershov v. Gannett Satellite Information Network, Inc., 104 F.
`
`Supp. 3d 135, 147 (D. Mass. 2015)).
`
`In Ellis, the court found no ongoing commitment or relationship between the
`
`plaintiff and defendant Cartoon Network when the plaintiff downloaded the free
`
`Cartoon Network app and viewed video clips on it. Ellis, 803 F.3d at 1257. “[S]imply
`
`downloading an app for free and using it to view content at no cost” was insufficient
`
`“to make a user of the app a ‘subscriber[.]’” Id. The ability of the plaintiff to at any
`
`time delete the Cartoon Network app and “never access its content again” led the
`
`court to conclude that the requisite ongoing commitment did not exist between the
`
`parties. Ellis, 803 F.3d at 1257.
`
`The Eleventh Circuit reiterated that holding in Perry v. Cable News Network,
`
`Inc., 854 F.3d 1336, 1344 (11th Cir. 2017), stating “[T]he ephemeral investment and
`
`commitment associated with [the] downloading of the [app] on his mobile
`
`device…is simply not enough to consider [plaintiff] a ‘subscriber.’”
`
`Like the plaintiffs in Ellis and Perry, Plaintiff here has only viewed free video
`
`clips on a publicly accessible forum. While Plaintiff submitted her email address in
`
`order to receive a free newsletter, this is less of an “ongoing commitment” than
`
`11
`
`

`

`Case 1:22-cv-00644-TWT Document 29 Filed 07/15/22 Page 13 of 23
`
`
`
`downloading an app, which remains on one’s device until deletion. Thus, Plaintiff
`
`cannot show the requisite ongoing commitment tying her to WebMD. She is at any
`
`time free to unsubscribe and “never access [WebMD’s] content again.” She made
`
`no payments, does not allege whether she actually received delivery of the
`
`newsletter, and does not allege that the newsletter gave her access to any restricted
`
`content. Casual consumption of WebMD’s free internet newsletter does not suffice
`
`to show the requisite “ongoing commitment or relationship” with WebMD. Thus,
`
`Plaintiff is not a “consumer” within the meaning of the VPPA and the claim should
`
`be dismissed.
`
`2.
`
`Plaintiff is not a subscriber of a video service.
`
`Even if Plaintiff adequately alleged that she was a “subscriber”—and she has
`
`not—Plaintiff has not alleged that she subscribed to a video service.
`
`The facts in this case are remarkably similar to those alleged in Austin-
`
`Spearman. See Austin-Spearman v. AMC Network Entertainment LLC, 98 F.
`
`Supp.3d 662, 669 (S.D.N.Y. 2015). In an initial pleading, the Austin-Spearman
`
`plaintiff alleged that she watched videos on AMC’s website related to the Walking
`
`Dead. Id. at 664, 671. The court found this fall short of subscription, with the court
`
`holding that “an individual must do more than simply take advantage of a provided
`
`service” in order be to a subscriber under the VPPA. Id. at 671. The plaintiff argued
`
`that she should be permitted leave to amend to allege that she had registered and
`
`12
`
`

`

`Case 1:22-cv-00644-TWT Document 29 Filed 07/15/22 Page 14 of 23
`
`
`
`provided her email address for AMC’s Walking Dead newsletter. Id. The court
`
`reluctantly granted leave to amend, remarking that it “remain[ed] skeptical that
`
`Austin-Spearman will be able to state a claim even after amendment” and noting that
`
`the proposed amendment raised “troubling questions and implications” as to
`
`“whether a plaintiff can constitute a subscriber under the VPPA if she subscribes
`
`only to a portion of the provider’s services that are distinct and set apart from its
`
`provision of videos.” Id.
`
`Although neither Ellis nor Perry directly addressed this question, they
`
`opinions suggest the answer is no. The Eleventh Circuit in Ellis expressly agreed
`
`with the Austin-Spearman court, finding, “[W]e generally agree with the approach
`
`and result of Austin-Spearman—the case held that a person who visited the free
`
`website of a cable television network to watch videos was not a ‘subscriber’ of the
`
`network under the VPPA.” Ellis, 803 F.3d at 1257-58 (taking issue only with the
`
`Austin-Spearman court’s agreement with the district court’s reasoning in Ellis).
`
`Perry more directly grappled with an allegation seeking to shoehorn a
`
`“subscription” into an otherwise uncognizable claim. The plaintiff in Perry had
`
`alleged that he downloaded and watched videos on the free CNN App, which sent
`
`his viewing history to a third party. In response to Ellis, the plaintiff in Perry had
`
`sought to amend his claim to allege that he had access to exclusive content on the
`
`CNN App by virtue of his cable television subscription and that through that
`
`13
`
`

`

`Case 1:22-cv-00644-TWT Document 29 Filed 07/15/22 Page 15 of 23
`
`
`
`subscription, he made indirect payments to CNN. Perry, 854 F.3d at 1341. The
`
`district court denied the amendment as futile and the Eleventh Circuit affirmed. Id.
`
`at 1341-42.
`
`The Perry court reasoned that the restricted content was viewable to plaintiff
`
`by virtue of his relationship with his television provider, not his relationship with
`
`CNN. Id. at 1343. The court noted that other than downloading the app and
`
`acknowledging his cable subscription, “there is no indication that Perry has engaged
`
`CNN in any other way in order to gain access to this exclusive feature.” Id.
`
`Moreover, the plaintiff “did not actively provide his personal information to CNN
`
`in exchange for the CNN App.” Id. In other words, although the plaintiff in Perry
`
`alleged that content was restricted and he made payments to access it, the Eleventh
`
`Circuit found he was not a subscriber because there was not a sufficient connection
`
`between the restricted content and the payments or commitments made. Id. at 1344.
`
`Here, there is a similar lack of connection in the allegations. Lebakken claims
`
`she provided her email address on WebMD’s website in 2017 when she signed up
`
`for a free electronic newsletter. FAC ¶¶ 62, 47. While she alleges that WebMD
`
`“frequently features its video content through its email newsletter,” id. ¶ 56, she does
`
`not allege that it did so in 2017 when she signed up, that she ever accessed any videos
`
`featured in the newsletter, or that the videos were solely accessible through the
`
`newsletter. Indeed, Plaintiff is conspicuous in her failure to allege that when she
`
`14
`
`

`

`Case 1:22-cv-00644-TWT Document 29 Filed 07/15/22 Page 16 of 23
`
`
`
`viewed videos in January 2022, she accessed those videos through the newsletter,
`
`that she was signed into the website, or that the video was restricted to
`
`accountholders. Rather, the FAC makes clear that the email newsletter is distinct
`
`from WebMD’s website, which provides publicly accessible videos and other
`
`content regardless of whether the viewer has signed up for the newsletter or
`
`otherwise created an account. Id. passim.
`
`The legislative history behind the VPPA further supports the interpretation
`
`that subscription to a video service is required to make one a consumer within the
`
`VPPA’s purview. Congress’s passage of the VPPA was motivated by the leak of
`
`then-Supreme Court nominee Robert Bork’s rental history from a brick-and-mortar
`
`video store. S. REP. 100-599 at *5; see also In re Nickelodeon Consumer Privacy
`
`Litigation, 827 F.3d 262, 284 (3d Cir. 2016) (“We do not think that, when Congress
`
`passed the Act, it intended for the law to cover factual circumstances far removed
`
`from those that motivated its passage.”). The narrow intent behind the VPPA was to
`
`monitor video rental stores, not providers that engage only in incidental video
`
`content creation. See Costanzo v. City of Omaha, No. 8:04CV99, 2004 WL 2359722,
`
`at *2 (D. Neb. Oct. 19, 2004) (finding that the VPPA is limited in its application to
`
`“private video stores”). Had Congress intended for the VPPA to cover providers of
`
`written materials such as email newsletters, it easily could have extended it to do so,
`
`but they did not. See S. REP. 100-599 at *11-12 (“[S]imply because a business is
`
`15
`
`

`

`Case 1:22-cv-00644-TWT Document 29 Filed 07/15/22 Page 17 of 23
`
`
`
`engaged in the sale or rental of video materials or services does not mean that all of
`
`its products or services are within the scope of the bill.”).
`
`Because Lebakken’s video viewing was unrelated to her email subscription,
`
`she was not a subscriber of a video service and her claim is not within the scope of
`
`the VPPA.
`
`B.
`
`Plaintiff Failed to Allege Facts Sufficient to Suggest that WebMD
`Shared Her Personally Identifiable Information in Connection
`with Video Views.
`
`The VPPA defines PII as to include “information which identifies a person as
`
`having requested or obtained specific video materials or services from a video tape
`
`service provider.” 18 U.S.C. § 2710(a)(3). To plead a violation of the VPPA,
`
`Plaintiff is required to allege that WebMD disclosed information that “identif[ies] a
`
`particular person—not just an anonymous individual—and connect[s] this particular
`
`person with his or her viewing history.” Robinson v. Disney Online, 152 F. Supp. 3d
`
`176, 179 (S.D.N.Y. 2015).
`
`1.
`
`Plaintiff fails to allege that her e-mail or Facebook ID was
`transmitted to Facebook.
`
`
`
`First, Plaintiff alleges that the Pixel transmits emails to Facebook when a user
`
`subscribes to the newsletter. FAC ¶ 45. However, she does not, and cannot, allege
`
`that this email address is transmitted together with video viewing information. She
`
`does not, and cannot, allege that WebMD had the Pixel on its website when she
`
`subscribed in 2017. Therefore, she has not adequately alleged that her email address
`
`16
`
`

`

`Case 1:22-cv-00644-TWT Document 29 Filed 07/15/22 Page 18 of 23
`
`
`
`was transmitted to Facebook, much less that it was transmitted in such a way that
`
`would connect it to her video views.
`
`Second, Plaintiff alleges that a WebMD visitor who watches a video while
`
`logged into Facebook transmits a specific c_user cookie to Facebook, which
`
`allegedly contains an “unencrypted Facebook ID.” FAC ¶ 30. However, while
`
`Plaintiff alleges she signed up for Facebook in 2007, FAC ¶ 63, she does not allege
`
`that she was logged into Facebook while she viewed videos on WebMD.com in
`
`January 2022. Therefore, she does not allege facts sufficient to suggest that her
`
`unencrypted Facebook ID was transmitted in connection with her video viewing
`
`history.
`
`Third, Plaintiff alleges that when a WebMD user who recently logged out of
`
`Facebook watches a video, the Pixel causes the fr_cookie, including an encrypted
`
`Facebook ID and browser information to be transmitted to Facebook. FAC ¶¶ 31-
`
`38. However, Plaintiff does not allege that she recently logged out of Facebook
`
`when she viewed videos on WebMD.com. Thus, she has not sufficiently alleged
`
`that her encrypted Facebook ID was sent to Facebook.
`
`2.
`
`Plaintiff fails to allege that WebMD disclosed any Facebook
`IDs.
`
`
`
`Plaintiff alleges that the information in two cookies that contained Facebook
`
`IDs (c_user and fr_cookies) were sent back to Facebook, but she does not allege that
`
`WebMD itself ever obtained the information in the cookies or otherwise knew site
`
`17
`
`

`

`Case 1:22-cv-00644-TWT Document 29 Filed 07/15/22 Page 19 of 23
`
`
`
`users’ Facebook IDs. In other words, any disclosure of Facebook IDs was between
`
`Plaintiff and Facebook, not between WebMD and Facebook.2
`
`3.
`
`Browser information is not PII.
`
`Plaintiff alleges that if a website user is not a Facebook accountholder, her
`
`browser transmits the _fbp cookie to Facebook, which identifies a browser.
`
`Although she does not address these scenarios, this would logically also be the case
`
`if the user had recently cleared her browser’s cookies or had logged out of Facebook
`
`more than 90 days prior. See FAC ¶ 36 (explaining the fr_cookie expires after 90
`
`days). However, Plaintiff does not explain how a browser identifier could be used
`
`to identify a person. Therefore, she has not sufficiently alleged how browser
`
`information could transform into PII. See In re Nickelodeon Consumer Priv. Litig.,
`
`827 F.3d 262, 283 (3d Cir. 2016) (holding after analysis of statutory history that a
`
`static personal identifier such as an IP address is not PII under the VPPA); In re Hulu
`
`Priv. Litig., No. C 11-03764 LB, 2014 WL 1724344 (N.D. Cal. Apr. 28, 2014) (“To
`
`an average person, an IP address or a digital code in a cookie file would likely be of
`
`little help in trying to identify an actual person.”).
`
`
`2 WebMD’s lack of knowledge about who was viewing its video content suggests that it could
`not have “knowingly” made any disclosures of PII, as required by the statute.
`
`18
`
`

`

`Case 1:22-cv-00644-TWT Document 29 Filed 07/15/22 Page 20 of 23
`
`
`
`C.
`Plaintiff Fails to Adequately Plead Any Alleged Disclosure Was
`Made Knowingly.
`
`Plaintiff has also failed to adequately plead that any alleged disclosure of PII
`
`was made knowingly. 18 U.S.C. §2710(b)(2)(B). To satisfy the statute, Plaintiff
`
`must “allege facts giving rise to a reasonable inference” that WebMD knowingly
`
`disclosed PII to a third party. Mollett v. Netflix, Inc., Case No. 5:11–CV–01629–
`
`EJD, 2012 WL 3731542 at *4 (N.D. Cal. Aug.17, 2012). “Knowingly” connotes
`
`actual knowledge, meaning a defendant must be consciously aware not only that it
`
`is transmitting code, but that the code communicates private information. In re Hulu
`
`Privacy Litigation, 86 F.Supp.3d 1090, 1095 (N.D. Cal. 2015). A defendant’s
`
`transmission of such data must be the equivalent of knowingly identifying a specific
`
`person as “having requested or obtained specific video materials or services.” See
`
`18 U.S.C. §2710(a)(3). Sending user identity and video material identity separately,
`
`even if simultaneously, does not necessarily create a sufficient connection to identify
`
`a user. In re Hulu, 86 F.Supp.3d at 1096.
`
`
`
`In In re Hulu, defendant Hulu added Facebook “Like” buttons to videos on its
`
`website. Id. at 1093. Whenever a user loaded a video watch page, the button would
`
`send the name of the video to Facebook. Id. If a user was logged into Facebook,
`
`the button would also send a c_user cookie, containing a numeric Facebook ID, to
`
`Facebook. Id. at 1093-94. These transmissions allowed Facebook to link the user’s
`
`identity and video choices to other information about the user. Id. at 1094. However,
`
`19
`
`

`

`Case 1:22-cv-00644-TWT Document 29 Filed 07/15/22 Page 21 of 23
`
`
`
`there were no facts suggesting that Hulu knew that Facebook might combine a user’s
`
`identity with the name of the video they watched. Id. at 1097. Because Hulu did
`
`not know that Facebook might combine the two distinct pieces of data to identify a
`
`specific user as having requested a specific video, the court found that it did not
`
`knowingly disclose PII. Id. at 1099.
`
`Here, Lebakken has alleged that both video information and identity
`
`information are shared with Facebook, but she has not alleged facts suggesting that
`
`WebMD knew that this information would be combined. Indeed, as discussed
`
`above, she has not alleged facts suggesting that WebMD itself knew the Facebook
`
`IDs that it purportedly disclosed. According to Plaintiff’s allegations, the c_user and
`
`fr_cookies containing Facebook IDs were transmitted by users’ browsers to
`
`Facebook, not by or to WebMD. See FAC ¶¶ 30, 47. While she alleges that WebMD
`
`sought to serve ads to those who would be interested in them (e.g., ads for
`
`antiperspirant to those researching excessive sweating), id. ¶¶ 2, 14, she does not
`
`allege facts suggesting that WebMD targeted specific users or knew that data sent to
`
`Facebook could identify specific subscribers in connection with videos they
`
`watched. Rather, she alleges that Facebook “processes [the data], analyzes it, and
`
`assimilates it into datasets.” Id. ¶ 20. This allegation suggests that what was visible
`
`to WebMD was aggregate data in a dataset, not any specific information about a
`
`specific person.
`
`20
`
`

`

`