The NBA Sinks The Second Shot: New York Federal Court Grants Second Motion To Dismiss In Putative Privacy Class Action

Duane Morris Takeaways: On October 6, 2025, in Salazar v. National Basketball Association, No. 22 Civ. 07935, 2025 WL 2830939 (S.D.N.Y. Oct. 6, 2025), Judge Jennifer L. Rochon of the U.S. District Court for the Southern District of New York dismissed a proposed digital privacy class action against the National Basketball Association ("NBA") because the plaintiff failed to plausibly allege that the NBA disclosed personally identifiable information in violation of the Video Privacy Protection Act ("VPPA"). The district court reasoned that, following Second Circuit precedent, an "ordinary person" would not be able to identify the plaintiff's video-watching habits from the alleged Pixel transmissions. Id. at *5. This ruling illustrates that district courts in the Second Circuit continue to interpret the phrase "personally identifiable information" contained within the VPPA narrowly, and that the uphill burdens that plaintiffs carry on adtech and VPPA claims against corporate defendants are continuing to grow steeper.

Case Background

In Salazar v. NBA, the plaintiff, Michael Salazar ("Plaintiff") alleged that the NBA disclosed his personal information, including personal viewing information, to Meta, the owner of Facebook and Instagram, via Meta Pixel (a common form of advertising technology or "adtech"). Id. at *1–3. According to Plaintiff, Meta Pixel is "a snippet JavaScript code" that allows online businesses to "track visitor activity on their website." Id. at *1. When Meta Pixel is activated, it supposedly tracks the visitors and the visitors' actions, including the pages they visit and the buttons they click. Id. Plaintiff filed his suit against the NBA on September 16, 2022. Id. at *2. He claimed that he signed up for an online newsletter to register for NBA.com and then that he separately watched videos on the NBA's website. Id. at *1. Plaintiff also alleged that after he watched videos on the NBA's website, not in connection with his subscription to the newsletter, his video-watching history was sent to Meta without his permission via the undisclosed use of Meta Pixel on the NBA's website. Id. at *5. In response, the NBA filed a motion to dismiss and argued that Plaintiff failed to plead that he was a consumer of goods and services within the meaning of the VPPA, because although he alleged that he viewed audio-visual content on the NBA's website, he did not allege that he viewed the materials that he actually subscribed to but rather, separate, and free content that was offered elsewhere on the website. So, put differently, the content containing adtech was not the content that created his statutory standing to sue under the VPPA. Id. at *2.

The district court agreed with the NBA and granted its first motion to dismiss under Rule 12(b)(6). Plaintiff, however, appealed the decision to the U.S. Court of Appeals for the Second Circuit. On appeal, the Second Circuit agreed with Plaintiff, vacated the district court's judgment, and remanded the case, finding that the plaintiff had "plausibly pleaded" that he was a consumer under the VPPA by alleging that he had subscribed to the NBA's digital newsletter. Id. The Second Circuit reasoned that as long as the plaintiff was a "subscriber" under the meaning of the VPPA, he only needed to allege that he separately viewed audio-visual content offered by the defendant in order to state a valid claim. The Duane Morris summary of the Second Circuit's decision is attached here which describes the opinion in more detail.

Notably, this decision was not the only time that Plaintiff raised these issues to an appellate court. In April, the U.S. Court of Appeals for the Sixth Circuit ruled against this exact same Plaintiff on the same issue, based on the argument that a plaintiff needed to subscribe to the audio-visual content he or she alleges was actually disclosed in order to have statutory standing to sue under the VPPA. Thus, the Sixth Circuit created the odd situation where this exact same Plaintiff, Michael Salazar, filed one lawsuit in New York where he had statutory standing and another in Tennessee where he did not. The Duane Morris summary of the Sixth Circuit's decision is attached here and also provides more detail.

Nonetheless, on remand from the Second Circuit, Plaintiff filed a First Amended Complaint and later filed a Second Amended Complaint. Id. In response, the NBA again moved to dismiss the claims under Rule 12(b)(6), this time arguing that (1) pursuant to binding Second Circuit precedent, there was no disclosure of personally identifiable information under the VPPA; and (2) the plaintiff did not allege knowing disclosure. Id. at *3.

The Court's Opinion

Judge Rochon agreed with the NBA and dismissed Plaintiff's proposed VPPA class action. Id. at *5. In reaching its decision, the Court applied the Second Circuit's "ordinary person" standard, which requires plaintiffs to show that the "personally identifiable information" includes information that would permit an "ordinary person" to identify a user's video-watching habits. Id. at *3.

Under the standard, the Court found that the personally identifiable information would not allow an ordinary person to identify Plaintiff's video-watching habits, relying on other cases in which the Second Circuit rejected Pixel-based VPPA claims that "mirror" the allegations at issue. Id. at *3, *5; see Soloman v. Flipps Media, Inc., 136 F.4th 41, 44 (2d Cir. 2025) (finding that the complaint did not "plausibly allege that an ordinary person could identify [the plaintiff]" because an ordinary person would not be able to decipher the "c_user" cookie and corresponding string of letters to be a person's Facebook ID); see also Hughes v. National Football League, 24-2656, 2025 WL 1720295 (2d Cir. June 20, 2025) (rejecting the argument that a user's Facebook ID could be identified based on lines of computer code because it was not plausible that an ordinary person would conclude that the phrase was a person's Facebook ID). The Court aligned with other district court rulings in finding the plaintiff's argument — that a person could use internet-based tools like ChatGPT to understand the code communication — to be unpersuasive, reasoning that the argument was "insufficient to demonstrate that an ordinary person would know what to do with the c_user information to pinpoint an individual's identity." Id. at *5. (citing Taino v. Bow Tie Cinemas, LLC, No. 23-CV-0537, 2025 WL 2652730, at *8 (S.D.N.Y. Sept. 16, 2025)).

Although Plaintiff asked the Court not to dismiss the complaint based on the holdings in Soloman and Hughes, claiming the Soloman and Hughes line of precedent was on unstable footing, the Court independently concluded that "[t]here is no basis for this Court to find that the Second Circuit's decision in Soloman runs afoul of the statutory text of the VPPA, and thus Plaintiff's reliance on these [alternative] cases does not convince the Court that Soloman is soon to be overruled." Id. at *4. In other words, "[b]ecause an ordinary person would not plausibly be able to identify Plaintiff's video-watching habits as a result of the Pixel transmissions, Plaintiff has not plausibly alleged that the NBA disclosed personally identifiable information in violation of the VPPA." Id. at *5.

Implications For Companies

This case is a success for defendants involved in other putative adtech class actions. Indeed, Salazar is another example of a district court applying a narrow interpretation of "personally identifiable information" under the Second Circuit's "ordinary person" standard and has broader implications outside of the VPPA to adtech class actions generally.

As a result, if corporate counsel is faced with an adtech class action, based on common-place technology installed on his or her organization's website, he or she should consider raising these arguments in a motion to dismiss or shortly thereafter, as Salazar and its progeny may prove to be a powerful tool to exit a putative class action early in the litigation..