Second Circuit Rules On Scope Of VPPA Protection

On May 1, 2025, the United States Court of Appeals for the Second Circuit issued its decision in Solomon v. Flipps Media, Inc., affirming the dismissal of a putative class action alleging violations of the Video Privacy Protection Act ("VPPA"), 18 U.S.C. § 2710. Case No. 23-7597-cv (2nd Cir. May 1, 2025).

The plaintiff, Detrina Solomon, alleged that the defendant, Flipps Media, unlawfully disclosed her personally identifiable information ("PII") to Facebook through the use of the Facebook Pixel on its streaming platform. The Second Circuit held that Solomon failed to plausibly allege that Flipps Media disclosed PII as defined by the VPPA and upheld the district court's denial of leave to amend the complaint.

Second Circuit's Reasoning

The Second Circuit first adopted the "ordinary person" standard for defining PII, aligning with the approach of both the Third and Ninth Circuits. Under this standard, PII under the VPPA is information that would allow an ordinary person to identify a consumer's video-watching habits, not information that only a sophisticated technology company could use to do so. The Court rejected the broader "reasonable foreseeability" standard (adopted by the Second Circuit), which considers whether it was foreseeable that a third party could use the information to identify a consumer.

Once PII was defined, the Court then looked to whether the information transmitted by Flipps Media to Facebook—specifically, the Facebook ID (FID) and video titles embedded in computer code—would , with little or no extra effort, permit an ordinary person to identify a specific individual's video-watching behavior. The Court noted that the FID and video titles were embedded in complex code and not labeled in a way that would be readily understandable to an ordinary person. As such, the information disclosed would not "readily permit an ordinary person to identify a specific individual's video-watching behavior." In re Nickelodeon Consumer Privacy Litigation, 827 F.3d 262, 267 (3d Cir. 2016).

Under this definition, the Court found that the complaint did not plausibly allege that an ordinary person could use the disclosed information to identify Solomon or her video-watching history. The court emphasized the lack of detail in the complaint regarding how an ordinary person could access or interpret the Facebook Pixel data to identify a user.

With this in mind, and noting the Plaintiff's previous opportunities to address this deficiency, the Second Circuit upheld the district court's denial of leave to amend, noting that Solomon had multiple opportunities to address the deficiencies in her complaint but failed to do so, and her request to amend was made only in a conclusory footnote.

Circuit Split

The Second Circuit's adoption of the "ordinary person" standard is consistent with the approach taken by the Third Circuit in In re Nickelodeon Consumer Privacy Litigation and the Ninth Circuit in Eichenberger v. ESPN, Inc. Both of those courts held that PII under the VPPA is limited to information that would allow an ordinary person to identify a specific individual's video-watching behavior, rather than information that only a sophisticated entity could use to do so.

The Second Circuit expressly declined to follow the First Circuit's "reasonable foreseeability" standard articulated in Yershov v. Gannett Satellite Information Network, Inc. The First Circuit's approach would allow for VPPA liability if it was reasonably foreseeable to the disclosing party that the recipient could use the information to identify a consumer, even if the information would not be meaningful to an ordinary person. 820 F.3d 482 (1st Cir. 2016). The Second Circuit found this standard too broad and inconsistent with the statutory text and legislative history of the VPPA.

As a result, there exists a circuit split regarding the definition of "personally identifiable information" under the VPPA:

• The First Circuit (Yershov) applies a broader "reasonable foreseeability" standard, potentially allowing liability where a third party could, with its own resources, identify a consumer from the disclosed information.
• The Second, Third, and Ninth Circuits apply the narrower "ordinary person" standard, limiting liability to disclosures that would allow an ordinary person to identify a consumer's video-watching history without the need for sophisticated technological capabilities or additional information.

This split means that the scope of VPPA liability for disclosures of digital identifiers and tracking data may differ depending on the jurisdiction, with the Second, Third, and Ninth Circuits providing a more limited interpretation than the First Circuit.

Takeaways

1. Narrower Interpretation of PII Under the VPPA:
   The Second Circuit's adoption of the "ordinary person" standard limits the scope of what constitutes PII under the VPPA. Information that only a sophisticated third party (such as a technology company) could use to identify a consumer is not sufficient to trigger liability.
2. Implications for Use of Tracking Technologies:
   The decision provides important guidance for video service providers using tracking technologies like the Facebook Pixel. So long as the information disclosed does not, on its face, allow an ordinary person to identify a consumer's video-watching history, VPPA liability is unlikely.
3. Importance of Complaint Specificity:
   Plaintiffs must plead with specificity how the information disclosed could be used by an ordinary person to identify them and their video-watching habits. General allegations or reliance on the capabilities of sophisticated third parties will not suffice.
4. Procedural Considerations for Amending Complaints:
   Requests for leave to amend must be specific and timely. Courts are unlikely to grant leave to amend where plaintiffs fail to identify how they would cure deficiencies or only raise the issue in passing.
5. Legislative Context and Future Litigation:
   The court's reasoning reflects a reluctance to expand the VPPA's reach to cover modern digital tracking practices absent congressional action. Video service providers should continue to monitor developments, as legislative or regulatory changes could alter the landscape.

Conclusion

The Second Circuit's decision in Solomon v. Flipps Media provides significant clarity on the definition of PII under the VPPA and offers reassurance to video service providers regarding the use of digital tracking tools. However, the existence of a circuit split means that companies operating nationally should remain vigilant and consider the differing standards that may apply in other jurisdictions, particularly in the First Circuit.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.