Opposition Brief — Detrina Solomon, Petitioner v. Flipps Media, Inc., dba FITE, dba FITE TV

APPENDIX

TABLE OF CONTENTS

Page

APPENDIX A: Excerpts from Appellant’s Brief

(Dec. 22, 2023) ......................................................... 1a

APPENDIX B: Excerpts from Appellee’s Brief

(Jan. 26, 2024) ....................................................... 11a

APPENDIX C: Excerpts from Motion to

Dismiss (Dec. 23, 2022) ......................................... 20a

APPENDIX D: Excerpts from Opposition to

Motion to Dismiss (Jan. 24, 2023) ........................ 25a

1a

APPENDIX A

23-7597-cv

United States Court of Appeals

for the

Second Circuit

DETRINA SOLOMON, on behalf of herself

and all others similarly situated,

Plaintiff-Appellant,

– v. –

FLIPPS MEDIA, INC., dba FITE, dba FITE TV,

Defendant-Appellee.

ON APPEAL FROM THE

UNITED STATES DISTRICT COURT FOR

THE EASTERN DISTRICT OF NEW YORK

BRIEF FOR PLAINTIFF-APPELLANT

NICOMEDES S. HERRERA

HERRERA KENNEDY LLP

1300 Clay Street, Suite 600

Oakland, California 94612

(510) 422-4700

BRET D. HEMBD

HERRERA KENNEDY LLP

3500 West Olive Avenue,

Suite 300

Burbank, California 91505

(213) 394-3100

CHRISTOPHER J. CORMIER

BURNS CHAREST LLP

4725 Wisconsin Avenue, NW,

Suite 200

Washington, DC 20016

(202) 577-3977

Attorneys for Plaintiff-Appellant

2a

JURISDICTION

The district court had federal question jurisdiction

under 28 U.S.C. § 1331 because this case arises under

the Video Privacy Protection Act (VPPA), 18 U.S.C.

§ 2710. The district court dismissed the complaint

with prejudice on September 30, 2023 (JA116-26), and

entered final judgment for defendant-appellee Flipps

Media, Inc., dba FITE, dba FITE TV (“FITE”) on

October 3, 2023 (JA127). 1 Plaintiff-appellant Detrina

Solomon (“Solomon”) timely appealed on October 27,

2023. JA128. This Court has appellate jurisdiction

under 28 U.S.C. § 1291.

ISSUES ON APPEAL

1. Whether the complaint plausibly alleges that

FITE disclosed Solomon’s “personally identifiable

information” to Facebook in violation of the VPPA

when FITE transmitted Solomon’s Facebook ID and

the titles and URLs of videos she accessed to Facebook.

2. Whether the district court abused its discretion

by dismissing the complaint with prejudice under

Federal Rule of Civil Procedure 12(b)(6) and denying

leave to amend without previously informing Solomon

of the complaint’s deficiencies or ruling that

amendment to cure those deficiencies would be futile.

***

SUMMARY OF ARGUMENT

I.

Solomon plausibly has alleged that FITE

disclosed her “personally identifiable information”

under the VPPA when FITE disclosed her Facebook ID

1References to the Joint Appendix are designated “JA__.”

3a

and the titles and URLs of specific videos she accessed

to Facebook.

The

statutory

construction of “personally

identifiable information” is a purely legal question

that is a matter of first impression in this Court. In

this case, the Court can reach the correct result by

adopting a narrow rule that, regardless of whatever

else might be covered, “personally identifiable

information” necessarily includes that which a

disclosing party transmits to a particular recipient

with knowledge that the recipient can use that specific

information to personally identify the individual in

question. This result would be fully consistent with the

text, purpose, and legislative history of the statute.

***

If this Court adopts either of the two alternative

definitions of “personally identifiable information”

articulated by other Courts of Appeals, Solomon's

allegations are sufficient under those definitions as

well.

If this Court adopts the definition from the First

Circuit, it should hold that Solomon has plausibly

alleged that FITE's disclosure of her Facebook ID was

reasonably and foreseeably likely to personally

identify her to Facebook.

If this Court adopts the definition from the Third

and Ninth Circuits, it should hold that Solomon has

plausibly alleged that the disclosure would readily

permit an ordinary person to identify her. This is

because, as alleged in her complaint, a user’s Facebook

ID is something that any ordinary person can easily

use, via any web browser, to navigate directly to that

user’s public Facebook profile page. Thus, Solomon

4a

has plausibly alleged that a Facebook ID is by itself

sufficient to identify a Facebook user, regardless of

whatever specific content may or may not appear on

that user’s Facebook profile.

II. The district court abused its discretion by

denying Solomon leave to amend her complaint. In

doing so, the court disregarded clear Second Circuit

precedent. As this Court recently summarized and

reaffirmed in Mandala v. NTT Data, Inc., ---F.4th----,

2023 WL 8499054 (2d Cir. Dec. 8, 2023), “in the

absence of a valid rationale like undue delay or

futility, it is improper to simultaneously dismiss a

complaint with prejudice under Rule 12(b)(6) and deny

leave to amend when the district court has not

adequately informed the plaintiff`[] of its view of the

complaint's deficiencies.” Id. at *7.

As Solomon stated in opposing FITE’s motion to

dismiss, she was prepared to amend her complaint to

directly address any pleading deficiencies the district

court might identify. In denying her that opportunity,

the court did not find that Solomon had acted with

undue delay or that amendment would be futile. Nor

did the court identify any other valid rationale.

Nevertheless, the court dismissed the complaint and

denied leave to amend without previously identifying

any pleading deficiencies. In doing so, the court

exceeded the bounds of its discretion.

This Court should reverse so that Solomon can

amend her complaint to cure the perceived pleading

deficiencies and have her case adjudicated on the

merits.

ARGUMENT

***

5a

I. The Complaint Plausibly Alleges that FITE

Disclosed

Solomon’s

“Personally

Identifiable Information” to Facebook in

Violation of the VPPA.

To resolve this appeal, the Court first must

determine what information constitutes “personally

identifiable information” under the VPPA. This is a

question of first impression in this Court. See JA119;

Wilson v. Triller, Inc., 598 F. Supp. 3d 82, 90-91

(S.D.N.Y. 2022).

In the district court, Solomon did not advocate for a

particular standard on this issue; rather, she argued

that under either of the standards adopted by the

other Courts of Appeals to have considered the

question—the “foreseeability” standard of the First

Circuit, or the “ordinary person” standard of the Third

and Ninth Circuits-she has adequately alleged

disclosure of personally identifiable information.

JA80-87.

***

This Court need not formulate its own blanket

definition of personally identifiable information, nor

must this Court accept, reject, or attempt to synthesize

the standards formulated by the other Courts of

Appeals to resolve the question before it: whether

FITE’s disclosure of Solomon’s video viewing

information and Facebook ID to Facebook, which FITE

knew Facebook could use to personally identify her,

constitutes disclosure of personally identifiable

information under the VPPA. The Court should

answer this question in the affirmative in view of the

text, purpose, and legislative history of the statute.

6a

Solomon alleges that a Facebook ID is a unique

identifier “linked to an individual’s Facebook profile”

in a manner that “uniquely and personally identifies

that person’s Facebook account” (JA9-10 at ¶ 7), and

that Facebook can therefore use Solomon’s Facebook

ID to personally identify her (JA32 at ¶ 106). Solomon

further alleges that FITE knew that her Facebook ID

would be disclosed to Facebook along with the titles

and URLs of the videos she accessed. JA19 at ¶ 54;

JA32 at ¶ 107.

Solomon’s proposed rule would therefore comport

with the statutory text by prohibiting the disclosure of

specific types of information—here, Solomon’s

Facebook ID, coupled with the titles and

***

Moreover, Solomon alleges that Facebook IDs,

because they are uniquely assigned to each Facebook

user, identify individuals “more precisely than a name

or email address,” and that Facebook profiles, as a

general matter, contain “detailed and personal

information.” JA9-10 at ¶ 7. That is enough to satisfy

the ordinary person test. Solomon should not be

required to plead what specific items of personal

information may or may not appear on her public

Facebook profile.

The fact that a recipient of

Solomon’s Facebook ID can quickly and easily

navigate directly to her unique Facebook profile is

sufficient by itself to find that the Facebook ID readily

permits an ordinary person to identify her, regardless

of what specific information is publicly available on

that profile.

***

7a

II. The District Court Abused Its Discretion by

Denying Solomon Leave to Amend Her

Complaint.

A. This Court Strongly Favors Liberal

Grant of Leave to Amend After Dismissal

Under Rule 12(b)(6).

Federal Rule of Civil Procedure 15(a)(2) provides

that courts “should freely give leave” to amend a

complaint “when justice so requires.” Fed. R. Civ. P.

15(a)(2). This is a “liberal standard” that is “consistent

with [this Court’s] strong preference for resolving

disputes on the merits.” Attestor Value Master Fund

v. Republic of Argentina, 940 F.3d 825, 833 (2d Cir.

2019) (quoting Loreley Fin. (Jersey) No. 3 Ltd. v. Wells

Fargo Sec., LLC, 797 F.3d 160, 190 (2d Cir. 2015)). In

particular, “[t]his circuit strongly favors liberal grant

of an opportunity to replead after dismissal of a

complaint under Rule 12(b)(6).” Noto v. 22nd Century

Grp., Inc., 35 F.4th 95, 107 (2d Cir. 2022).

Thus, this Court has consistently held that “in the

absence of a valid rationale like undue delay or

futility, it is improper to simultaneously dismiss a

complaint with prejudice under Rule 12(b)(6) and deny

leave to amend when the district court has not

adequately informed the plaintiff[] of its view of the

complaint’s deficiencies.” Mandala, ---F.4th----, 2023

WL 8499054, at *7 (collecting cases).

B. Solomon Requested Leave to Amend and

Is Prepared to Address the Complaint’s

Perceived Deficiencies.

Here, in opposing FITE’s motion to dismiss under

Rule 12(b)(6), Solomon requested that if the district

8a

court were to grant the motion “in any respect,”

Solomon “should be granted leave to amend the

Complaint to remedy any perceived deficiencies.”

JA94 (citing McCarthy v. Dun & Bradstreet Corp., 482

F.3d 184, 200 (2d Cir. 2007)). In ruling on the motion

to dismiss, the district court informed Solomon for the

first time of its view regarding the complaint’s

supposed deficiencies.

JA116-26.

Having been

apprised of those perceived deficiencies, Solomon is

prepared to amend the complaint to address them.

First, with respect to the district court’s conclusion

that her “VPPA claim fails” because the complaint

“says nothing about any personal information on her

public Facebook profile page” (JA121), Solomon is

prepared to amend to allege that her public Facebook

profile page has at all relevant times displayed her

name.

Second, in response to the district court’s conclusion

that her allegations were insufficient to plausibly

allege that she “actually accessed any ‘prerecorded’

video” on FITE’s website, Solomon can and will amend

to “explicitly allege[]” that she accessed “indisputably

‘prerecorded’ video” content from FITE’s TrillerVerz

channel on one or more occasions during the relevant

period, as distinct from “live” content. 2 JA124.

To the extent this Court finds that deficiencies

remain after resolving the statutory construction

issues of first impression presented in this appeal,

Accordingly, the Court does not need to reach the issue of

whether the current version of the complaint plausibly alleges

this element of Solomon’s claim.

3

9a

Solomon remains ready and willing to make these

amendments to cure any perceived deficiencies.

C. The District Court Exceeded Its

Discretion

by

Simultaneously

Dismissing Solomon’s Complaint Under

Rule 12(b)(6) and Denying Leave to

Amend.

Despite Solomon’s request for leave to amend, the

district court simultaneously dismissed the complaint

with prejudice and denied leave to amend, without

having provided any prior notice of its view of the

complaint’s alleged deficiencies, and without any

finding of a “good reason” for the denial such as

“futility, bad faith, undue delay, or undue prejudice to

the opposing party.” MSP Recovery Claims, Series

LLC v. Hereford Ins. Co., 66 F.4th 77, 90 (2d Cir. 2023)

(quoting Bensch v. Est. of Umar, 2 F.4th 70, 81 (2d Cir.

2021)). In doing so, the district court exceeded the

bounds of its discretion. Mandala, ---F.4th----, 2023

WL 8499054, at *7; Loreley, 797 F.3d at 190-91.

The district court began its analysis by noting that

Solomon requested leave to amend “[i]n a footnote on

the final page of her brief.” JA124; see also JA125

(“During the subsequent briefing of the motion to

dismiss, Plaintiff elected to address leave to amend in

a conclusory footnote.”). Although the court did not

expressly find that Solomon had waived her request

for leave to amend by making it in a footnote, the court

implied that the use of a footnote was improper. This

Court has observed, however, that “form alone”

generally is not an appropriate basis on which to

“deem a request for leave to amend insufficient.”

Loreley, 797 F.3d at 190.

10a

Next, the district court cited an unpublished

summary order, Gregory v. ProNAi Therapeutics Inc.,

757 F. App’x 35 (2d Cir. 2018), as an example of this

Court “affirming denial of leave to amend where, inter

alia, ‘plaintiffs sought leave to amend in a footnote at

the end of their opposition to defendants’ motion to

dismiss,’ but ‘they included no

***

11a

APPENDIX B

IN THE

UNITED STATES COURT OF APPEALS

FOR THE SECOND CIRCUIT

DETRINA SOLOMON, on behalf of herself and all

others similarly situated,

Plaintiff-Appellant,

—against—

FLIPPS MEDIA, INC., DBA FITE, DBA FITE TV,

Defendant-Appellee.

ON APPEAL FROM THE UNITED STATES DISTRICT

COURT FOR THE EASTERN DISTRICT OF NEW YORK

(CENTRAL ISLIP)

BRIEF FOR DEFENDANT-APPELLEE

DAVID N. CINOTTI

BRENDAN M. WALSH

PASHMAN STEIN WALDER

HAYDEN, P.C.

21 Main Street, Suite 200

Hackensack, New Jersey

07601

(201) 488-8200

Attorneys for DefendantAppellee

***

12a

located through such a search. J.A. 22 (Compl. ¶ 63).

Plaintiff also did not explain in the complaint what

information she provided when she set up her

Facebook account.

The complaint is silent, for

example, on whether Plaintiff provided her real name

or any other identifying information when she opened

an account.

The complaint is also vague (perhaps deliberately

so) on how Pixel works. There are no facts to show, for

example, that FITE’s site itself captures or gathers the

FID and URLs and sends them directly to Meta’s

servers. That allegation would be particularly difficult

to make because Plaintiff does not allege that she

provided her FID to FITE or that FITE can access the

c_user cookie that Meta set on her browser. Rather,

Plaintiff’s theory appears to be that Pixel triggered or

caused her own browser to send the URLs and FID to

Meta’s servers when she accessed videos or events on

FITE’s site. See J.A. 90 (arguing in opposition to

motion to dismiss that FITE is liable for its “necessary

and active role in disclosing its subscribers’ PII to

Facebook” and that “[n]o information about

subscribers’ video habits would be transmitted to

Facebook at all if Defendant had not installed and

operated the Pixel on its websites”).

The complaint includes “exemplar screenshot

excerpts,” which allegedly show disclosures of URLs

and FIDs through the use of Pixel. See J.A. 20, 22, 24

(Compl. ¶¶ 57, 64, 69). The screenshots do not depict

information relating to Plaintiff herself; instead, the

complaint refers to an unnamed “individual.” See J.A.

20, 23, 24 (Compl. ¶¶ 58, 65, 70). There are no facts in

the complaint to show where Plaintiff obtained these

screenshots, although they appear to have been taken

13a

from an unidentified person’s web browser. Nor are

there facts in the complaint to establish that the

screenshots depict information in the form it was

received by Meta’s servers or to show that anyone at

FITE or Meta could gain access to, and read, the

depicted information.

One of the screenshots is reproduced below:

J.A. 24 (Compl. ¶ 69). According to the complaint,

the string of characters following the word “GET” in

box A includes the title of a video or event that the

unidentified user accessed by sending a “GET request”

to FITE’s website. See id. (Compl. ¶ 70). “A GET

request is a message sent from an HTTP client, such

as a web browser, to a server asking for the content

located at a particular URL.” United States v.

Raymonda, 780 F.3d 105, 110 n.1 (2d Cir. 2015).

When the unidentified user’s web browser requested

the content at the depicted URL from FITE’s server,

Pixel allegedly caused the user’s browser to send that

GET request to Meta’s servers as well. Because the

GET request is so difficult to read, Plaintiff

highlighted in the screenshot where she says the title

of the video or event can be found. Even with that

assistance it is difficult to decipher.

Moreover,

14a

because it is merely an “excerpt” of the GET request,

J.A. 24 (Compl. ¶ 69), locating the title could be even

more difficult than shown in the screenshot.

Box B allegedly shows the FID contained on the

c_user cookie of the unnamed person who accessed the

video. That is also difficult to make out. Again,

because the c_user cookie is set on the user’s browser

(by Meta), Pixel allegedly triggered the browser to

send the cookie and FID to Meta’s servers. There are

no allegations to show how someone could find the FID

unless they had access to the web browser where the

screenshots were obtained.

Plaintiff brought the case on behalf of all persons in

the United States who subscribed to FITE’s services

“or purchased a pay-per-view event from FITE and

accessed video content on FITE’s website . . . or app

while having a Facebook account.” J.A. 29 (Compl.

¶ 91). The complaint alleges a cause of action under

***

giant’s computers receive. That is not a “disclosure”

under the plain meaning of the word.

B.

The complaint does not plausibly allege

that FITE, rather than Plaintiff’s own web browser,

transmitted the URLs and FID to Meta’s servers.

Plaintiff has not sufficiently pleaded that FITE

“disclosed” her PII for another reason: she does not

plead facts to show that FITE itself transmitted to

Meta’s servers—or even possessed—what she claims

is PII. Plaintiff describes her attenuated theory of

FITE’s alleged “disclosure” of PII in paragraphs 50

15a

through 57 of her complaint. When read closely,

Plaintiff does not allege facts showing that FITE itself

disclosed Plaintiff’s FID and viewing history. Instead,

Plaintiff states in conclusory form that FITE

“disclosed” URLs containing video titles and FIDs to

Facebook. See J.A. 20, 22, 24 (Compl. ¶¶ 57, 64, 69).

Whether FITE “disclosed” PII as that term is used

in the VPPA is a legal conclusion that must be

supported by specific factual allegations.

See

Rothstein, 708 F.3d at 94 (“[W]e are not required to

credit conclusory allegations or legal conclusions

couched as factual allegations.”). Plaintiff vaguely

alleges that FITE discloses information “via the

Facebook Pixel.” J.A. 20 (Compl. ¶ 57). But that is

different from pleading facts to show that FITE sends

the URLs and FIDs to Facebook’s servers, which are

absent from the complaint. As explained below, the

specific factual allegations in the complaint—most

notably the exemplar transmission screenshots on

which Plaintiff relies—do not support Plaintiff’s legal

conclusion that FITE “disclosed” PII and, indeed,

appear to contradict that general allegation. See

DPWN Holdings, 747 F.3d at 151-52 (“Although

factual allegations of a complaint are normally

accepted as true on a motion to dismiss, that principle

does not apply to general allegations that are

contradicted by more specific allegations in the

[c]omplaint.” (internal citation and quotation marks

omitted)). Plaintiff glaringly fails to allege in the

complaint where the screenshots come from, but they

appear to be screenshots from some user’s web

browser and show that: (1) the Facebook c_user cookie

on the web browser transmitted the FID to Meta’s

servers, and (2) the web browser also transmitted the

16a

URLs as “GET” requests to Meta’s servers. See supra

at 7-8. That is not a disclosure by FITE.

First, the facts in the complaint do not establish

that FITE itself sent Meta’s servers Plaintiff’s FID.

Plaintiff does not allege that FITE ever possessed her

FID and thus she does not, and cannot, claim that

FITE provided her FID to Meta. Plaintiff alleges that

she provided certain personal information to FITE

when she created an account with FITE but does not

allege that she ever provided her FID to FITE. See

J.A. 14 (Compl. ¶ 31). Given this omission, the only

reasonable inference is that the c_user cookie that

Meta set on her browser transmitted the FID to Meta,

not FITE’s site or server.

The screenshots show the FID following “c_user=”

in Box B below (Plaintiff’s annotation in paragraph 57

of the complaint):

Courts have explained that the “c_user cookie” is a

Facebook cookie that Facebook sets on its users’

browsers, Smith, 262 F. Supp. 3d at 948, which

contains the user’s FID, and that Facebook (now Meta)

is the only company that can read the FID, see In re

Hulu Privacy Litig., 86 F. Supp. 3d at 1093-94, 1093

n.3, 1097. If Meta is the only entity that can read

17a

Facebook’s c_user cookie—the cookie that contains a

Facebook user’s numeric FID—it follows that FITE

would not have been able to obtain FIDs from the

c_user cookie to send back to Meta’s servers. And

because Plaintiff does not allege that FITE otherwise

obtained her FID, the only plausible conclusion is that

the c_user cookie on Plaintiff’s web browser is what

sent her FID to Meta’s servers. FITE could not have

disclosed Plaintiff’s FID when FITE did not have it,

and the FID was contained on a cookie on Plaintiff’s

browser that only Meta’s servers could access. See

Eichenberger, 876 F.3d at 986 (affirming dismissal of

VPPA claim premised on information that the

defendant “never disclosed and apparently never even

possessed”); Chutich v. Green Tree Acceptance, Inc.,

No. 88-cv-869, 1993 WL 173813, at *9 (D. Minn. Apr.

19, 1993) (“[I]t is axiomatic that a corporation cannot

disclose what it does not know . . . .”).

Second, the screenshots show, or at least strongly

suggest, that FITE’s website also did not communicate

the URLs to Meta’s servers. As illustrated in the

below screenshot (with FITE’s annotation in the top

left corner marked in red), a FITE.tv URL is embedded

within a Facebook.com URL that follows the word

“GET”:

18a

As one court has explained, a “GET” request is sent

by the user’s web browser to the web server associated

with the URL that the user requests to access; “[t]he

GET request specifies the page that the visitor wants

to retrieve . . . [and] provides information about the

visitor, like her language, operating system, browser

settings, and other technical parameters.” Smith, 262

F. Supp. 3d at 947. That the screenshots show a “GET”

request strongly suggests that the transmission

depicted came from some user’s web browser, not

FITE’s website. The complaint has no contrary

allegations and is notably silent on where Plaintiff

obtained the screenshots—from her or another user’s

web browser or from some other source.

Accordingly, Plaintiff’s conclusory allegation that

FITE “disclosed” the URLs and FIDs to Meta cannot

be credited. At most, Plaintiff has alleged that Pixel

triggered Plaintiff’s web browser and the c_user cookie

contained on it to send information to Meta’s servers.

Plaintiff’s reading would render any act that was

allegedly part of the causal chain leading to a

disclosure to itself be a disclosure. Congress could

have reached that result if it wished, including by

creating a cause of action against a defendant who

19a

“disclosed or caused the disclosure of” PII. Indeed,

other laws expressly incorporate causing a disclosure

when that was Congress’s intent. See 18 U.S.C. App.

3 § 5 (requiring notice of

***

20a

APPENDIX C

UNITED STATES DISTRICT COURT

EASTERN DISTRICT OF NEW YORK

DETRINA SOLOMON, on

behalf of herself and all

others similarly situated,

Plaintiff,

v.

FLIPPS MEDIA, INC. dba

FITE and FITE TV,

Defendant.

: No. 2:22-cv-05508: JMA-JMW

: Oral Argument

: Requested

:

Date of Service:

:

December 23, 2022

:

:

:

MEMORANDUM OF LAW IN SUPPORT OF

DEFENDANT FLIPPS MEDIA, INC.’S

MOTION TO DISMISS CLASS ACTION

COMPLAINT

PASHMAN STEIN WALDER

HAYDEN, P.C.

David N. Cinotti, Esq.

Brendan M. Walsh, Esq.

Court Plaza South

21 Main Street, Suite 200

Hackensack, New Jersey 07601

Attorneys for Defendant Flipps

Media, Inc.

21a

***

“Uniform Resource Locator” (“URL”) that her web

browser accessed when she watched a video on FITE’s

website, and (2) her numeric Facebook ID (“FID”). The

code in these transmissions—which, in the

screenshots in the complaint, consists of letters,

numbers, symbols, and other programming syntax

surrounding and interspersed among the alleged PII—

is a tiny portion of the millions or billions of other lines

of computer code received by Facebook’s servers each

day.

Based on those convoluted and insufficient

allegations, Plaintiff seeks to represent a class of all

Facebook accountholders in the United States who

accessed content on FITE’s website within the last two

years and to impose potentially millions of dollars in

statutory damages on FITE. The Court should reject

Plaintiff’s claim and dismiss the complaint for at least

four reasons.

First, Plaintiff does not plausibly allege that the

supposedly improper transmissions contained “PII” as

defined in the VPPA. PII is information that identifies

a specific person and a specific video that individual

has watched, but the complaint lacks facts showing

how someone could specifically identify Plaintiff

through her numeric FID. The complaint includes a

screenshot of an “exemplar Facebook profile” to show

the types of information that can be included on a

Facebook profile and alleges in conclusory fashion that

any ordinary person can use a numeric FID to match

a specific person with that numeric FID. But the

complaint does not allege what personal information

is available on Plaintiff’s public Facebook profile (e.g.,

22a

name, hometown, employer, picture, etc.) or how

someone could identify her as the person connected to

a numeric FID. Judge Jed S. Rakoff of the U.S.

District Court for the Southern District of New York

recently dismissed a VPPA claim against an affiliate

of FITE for this same pleading deficiency.

Additionally, Plaintiff has not plausibly alleged that

the browser transmissions that Pixel allegedly

triggered contained PII because most courts presented

with the legal question of what constitutes PII have

adopted an “ordinary-person” standard. The alleged

transmissions of PII here—consisting of excerpts from

complex computer code—do not meet that standard.

No ordinary person could review, or likely even find,

the unannotated versions of the alleged transmissions

of PII included in the complaint and use them to

identify a specific person as having watched a specific

video on FITE’s website.

Second, Plaintiff has not plausibly alleged that

FITE knowingly “disclosed” anything to anyone.

Under the plain meaning of “disclose,” and in

accordance with courts’ interpretation of the same

language in the analogous Privacy Act of 1974, a

defendant discloses PII when the defendant transmits,

or provides another individual access to, PII, which

that other individual reviews. Plaintiff merely alleges

that the URLs of the events she accessed on FITE’s

website and her FID were transmitted in complex

lines of code to Facebook’s servers. She does not allege

that any persons at Facebook reviewed that

information, and given the millions or billions of

similar transmissions received by Facebook’s servers

daily, it is simply not plausible that anyone did.

23a

Moreover, a careful parsing of the complaint reveals

that Plaintiff has not alleged that FITE was itself a

party to the allegedly unlawful disclosures. The

screenshots in the complaint strongly suggest that the

FID in the transmissions came not from FITE, but

from a Facebook tracking cookie to which only

Facebook has access and that Facebook places on its

users’ browsers. Plaintiff notably does not allege that

FITE ever possessed her numeric FID, a prerequisite

for FITE to have knowingly disclosed that information

to Facebook. The screenshots also strongly suggest

that the URLs were not sent to Facebook by FITE’s

website, but were “GET” requests sent directly from

Plaintiff’s web browser. The screenshots do not

support, and indeed, appear to contradict, Plaintiff’s

conclusory statements that FITE disclosed PII via

Pixel.

Third, the VPPA applies only to “prerecorded”

videos—not live broadcasts—but Plaintiff does not

specify in her complaint whether she watched

prerecorded videos or live events. Plaintiff’s effort to

shoehorn live events into the VPPA by alleging in

conclusory fashion that “live” events fall within the

VPPA because they are “first recorded as a video file”

before being streamed conflicts with the plain

language of the VPPA and should not be given any

weight. The Court should follow the lead of other

federal courts that have considered similar allegations

and reject Plaintiff’s efforts to expand the statute to

cover both live and prerecorded videos.

Finally, if the Court finds the statute ambiguous as

applied to Plaintiff’s allegations, it should dismiss the

complaint under the rule of lenity. That rule applies

24a

here because the VPPA has both civil and criminal

applications.

Because Plaintiff has not stated a claim upon which

relief can be granted, and because some deficiencies

cannot be cured by amendment, the complaint should

be dismissed with prejudice.

BACKGROUND

FITE is a digital streaming company that offers a

variety of live and on-demand video content in the

sports, entertainment, and music areas. (Compl. ¶¶ 2,

34.) Plaintiff alleges that FITE “offers 15,000+ hours

of videos on demand and streams 1000+ live events per

year to more than 5 million registered users

worldwide.” (Id. ¶ 34.) Plaintiff is a Texas resident

who claims to have streamed unidentified videos from

one of FITE’s services at some point within two years

of filing her complaint. (Id. ¶¶ 11-12.) She asserts a

single cause of action on behalf of herself and all other

persons within the proposed class for alleged

violations of the VPPA.

Congress enacted the VPPA in 1988 in response to

a local video store’s disclosure to a newspaper reporter

of the titles of videos that Supreme Court nominee

Robert Bork’s family had rented. S. Rep. No. 100-599,

at 5 (1988), reprinted in 1988 U.S.C.C.A.N. 4342-1,

4342-5, also available at 1988 WL 243503, at *4-5.

The act prohibits a “video tape service provider” from

“knowing[ly] disclos[ing], to any person, [PII]

concerning any consumer of such provider” without

***

25a

APPENDIX D

UNITED STATES DISTRICT COURT

EASTERN DISTRICT OF NEW YORK

DETRINA SOLOMON,

on behalf of herself and

all others similarly

situated,

Plaintiff,

v.

FLIPPS MEDIA, INC.

dba FITE and FITE TV,

Defendant.

Case No.: 2:22-cv05508-JMA-JMW

PLAINTIFF’S

OPPOSITION TO

DEFENDANT’S

MOTION TO

DISMISS AND

INCORPORATED

MEMORANDUM OF

LAW

***

behavior.” Eichenberger v. ESPN Inc., 876 F.3d 979,

985 (9th Cir. 2017) (quoting In re Nickelodeon

Consumer Privacy Litig., 827 F.3d 262, 267 (3d Cir.

2016)).

Whatever standard the Court applies,

Solomon’s allegations satisfy it.

A.

An Ordinary Person Can Readily Identify

Solomon Using Her Facebook ID.

The “ordinary person” test was established by the

Third Circuit in Nickelodeon, whose reasoning and

rule the Ninth Circuit adopted in Eichenberger.

According to the Nickelodeon court, there is a

“spectrum” of personally identifiable information. 827

F.3d at 282. Solomon’s Facebook ID easily falls on the

26a

“identifiable” side of that spectrum. “At one end” of

the spectrum is “a person’s actual name.” Id. Next is

information “such as a telephone number or a physical

address” that does not in itself identify a specific

person but could be used to do so “by consulting

publicly available sources.” Id. at 282–83. “Further

down the spectrum” is information such as a social

security number that requires “consulting another

entity” to match to a specific person. Id. at 283.

Finally, “even further down the spectrum” was the

kind of information before the Nickelodeon court: IP

addresses, “browser fingerprint[s],” and “unique

device identifier[s],” id. at 281–82, all of which “would

likely be of little help” to an “average person” trying to

identify someone specific. Id. at 283. Likewise, in

Eichenberger, the Ninth Circuit held that an ordinary

person would not be able to use streaming device serial

numbers to identify anyone specific where the serial

numbers could be linked to specific persons only by

stitching together “an enormous amount of

information” collected by defendant “from a variety of

sources” using defendant’s “complex” proprietary

methods of analysis. 876 F.3d at 986.

In arguing that Solomon’s Facebook ID does not

disclose Solomon’s identity, Defendant relies almost

entirely upon an unreported case from further down

the spectrum, Wilson v. Triller, 2022 WL 1138073

(S.D.N.Y. April 18, 2022). Wilson involved neither the

use of the Facebook Pixel nor the disclosure of a

Facebook ID; rather, the claims in that case were

based upon the defendant’s actions in disclosing to

corporate affiliates a unique user identification

number (UID) that had been generated by the

defendant, along with the video viewing history

27a

associated with that UID. Id. at *87. While the

plaintiff acknowledged that the disclosed information

was “‘anonymized’ and thus did not itself identify” her

or any other particular user, she nevertheless argued

the information was PII because it could be “used by”

the corporate affiliates “to associate the watch history

with a particular individual” by “combin[ing] it with

other information so as to deduce the true identity of

the individual associated with the video watch data.”

Id. at **90-91. The court rejected her argument,

noting that each UID was required to be paired with

that user’s Triller profile page, which may or may not

contain personal information about the user. Id. at

*92.

The court in Wilson was not faced with remotely the

same situation this Court faces here, where Solomon’s

personally identifiable Facebook ID itself was

transmitted to Facebook along with her video viewing

history. Rather, as with a social security number, an

additional step would have to be taken to connect the

anonymized UID to a profile page, and then to an

individual. See Nickelodeon, 827 F.3d at 283. And

unlike the publicly identifiable Facebook ID

transmitted here, whether the Triller profile page was

capable of identifying an individual Triller user would

depend on the level of information included on the

profile page, such as information in an “About Me”

page or a URL associated with a photograph of the

user. See Wilson, 2022 WL 1138073 at *92.

Unlike the anonymized UID in Wilson or the device

and other anonymized identifiers at issue in

Nickelodeon and Eichenberger, Solomon’s Facebook ID

readily permits an ordinary person to identify her. As

the Complaint explains, anyone, even someone with

28a

limited

technical

proficiency,

can

enter

“facebook.com/” and Solomon’s Facebook ID into a web

browser and be taken directly to her personal

Facebook page.

Compl. ¶ 7; see id. ¶¶ 62–63

(illustrating simple, one-step process for identifying a

person using her Facebook ID), ¶ 86 (alleging Solomon

was a Facebook user with a Facebook ID while she was

a FITE subscriber). Like looking up a telephone

number or address in a phone book, linking Solomon’s

Facebook ID to her identity is well within the reach of

an ordinary person, unaided by any advanced or

proprietary means. Solomon’s Facebook ID thus

satisfies the ordinary person test—a result expressly

contemplated by Eichenberger, see 876 F.3d at 986

(“[a] Facebook link or an email address may very well

readily enable an ‘ordinary person’ to identify an

individual”), and actually reached by a federal district

court in a recent decision applying Eichenberger to

another VPPA action regarding a company’s use of the

Pixel and addressing the Facebook ID. See Stark v.

Patreon, Inc., 2022 WL 7652166, at **7–8 (N.D. Cal.

Oct. 13, 2022).

B.

Solomon’s Facebook ID Is Reasonably and

Foreseeably Likely to Reveal Her Identity

When Disclosed to Facebook.

Solomon’s Facebook ID also handily satisfies the

First Circuit’s less-restrictive foreseeability test. In

Yershov, the First Circuit began by explaining this

standard in plain language:

Many types of information other than a

name can easily identify a person.

Revealing a person’s social security

number to the government, for example,

29a

plainly identifies the person. Similarly,

when a football referee announces a

violation by “No. 12 on the offense,”

everyone with a game program knows the

name of the player who was flagged.

820 F.3d at 486. The court then held that the

defendant disclosed PII when it disclosed to a third

party the GPS coordinates of its users’ devices,

together with special device identifiers unique per

device and per user, whenever its users watched a

video. Id. at 484–86. According to the complaint’s

allegations, the third-party recipient “ha[d] the ‘game

program,’ so to speak,” that allowed it to link the

coordinates and identifiers to specific persons. Id.

at 486. At any rate, the court suggested, “[g]iven how

easy it is to locate a GPS coordinate on a street map,”

GPS coordinates without more can constitute PII

under the right circumstances.

Id. (“[I]magine

[defendant] had disclosed that a person viewed 146

videos on a single device at 2 sets of specified GPS

coordinates . . . [T]his disclosure would enable most

people to identify what are likely the home and work

addresses of the viewer (e.g., Judge Bork’s home and

the federal courthouse).”).

Allowing that some

connections between information and identity may be

“too uncertain, or too dependent on too much yet-to-bedone, or unforeseeable

***