{"id":2401,"date":"2025-09-10T18:04:22","date_gmt":"2025-09-10T22:04:22","guid":{"rendered":"https:\/\/blogs.duanemorris.com\/classactiondefense\/?p=2401"},"modified":"2025-09-10T18:04:22","modified_gmt":"2025-09-10T22:04:22","slug":"new-york-federal-court-dismisses-adtech-class-action-because-no-ordinary-person-could-identify-web-user","status":"publish","type":"post","link":"https:\/\/blogs.duanemorris.com\/classactiondefense\/2025\/09\/10\/new-york-federal-court-dismisses-adtech-class-action-because-no-ordinary-person-could-identify-web-user\/","title":{"rendered":"New York Federal Court Dismisses Adtech Class Action Because No Ordinary Person Could Identify Web User"},"content":{"rendered":"
\n
\"\"<\/a><\/figure>\n<\/div>\n\n\n

By Gerald L. Maatman, Jr., Justin Donoho, Hayley Ryan, and Ryan Garippo<\/strong><\/p>\n\n\n\n

Duane Morris Takeaways:<\/strong>\u00a0 On September 3, 2025, in Golden v. NBCUniversal Media, LLC, No. 22-CV-9858, 2025 WL 2530689 (S.D.N.Y. Sept. 3, 2025), Judge Paul A. Engelmayer of the U.S. District Court for the Southern District of New York granted <\/a>a motion to dismiss with prejudice for a media company on a claim that the company\u2019s use of website advertising technology on its website violated the Video Privacy Protection Act (\u201cVPPA\u201d).\u00a0 The ruling is significant as it shows that in the explosion of adtech class actions across the nation seeking millions or billions of dollars in statutory damages under not only the VPPA but also myriad other statutes providing for statutory penalties on similar theories that the website owner disclosed website activities to Facebook, Google, and other advertising agencies, the statute and its harsh penalties should not be triggered because no ordinary person could access and decipher the information transmitted.<\/em><\/p>\n\n\n\n

Background<\/strong><\/p>\n\n\n\n

This case is one of a multiplying legion of class actions that plaintiffs have filed nationwide alleging that Meta Pixel, Google Analytics, and other similar software embedded in defendants\u2019 websites secretly captured plaintiffs\u2019 web-browsing activity and sent it to Meta, Google, and other online advertising agencies.<\/p>\n\n\n\n

This software, often called website advertising technology or \u201cadtech,\u201d is a common feature on corporate, governmental, and other websites in operation today.  In adtech class actions, the key issue is often a claim brought under the VPPA, a federal or state wiretap act, a consumer fraud act, and even the Illinois Genetic Information Privacy Act (GIPA), because plaintiffs often seek millions (and sometimes even billions) of dollars, even from midsize companies, on the theory that hundreds of thousands of website visitors, times $2,500 per claimant in statutory damages under the VPPA, for example, equals a huge amount of damages.  Plaintiffs have filed the bulk of these types of lawsuits to date against healthcare providers, but they also have filed suits against companies that span nearly every industry including retailers, consumer products, and universities.  Several of these cases have resulted in multimillion-dollar settlements, several have been dismissed, the vast majority remain undecided, and especially with some district courts being more permissive than others in allowing adtech class actions to proceed beyond the motion to dismiss stage (as we blogged about here<\/a>), the plaintiffs\u2019 bar continues to file adtech class actions at an alarming rate.<\/p>\n\n\n\n

In Golden<\/em>, the plaintiff brought suit against a media company.  According to the plaintiff, she signed up for an online newsletter offered by the media company and, thereafter, visited the media company\u2019s website, where she watched videos.  Id. <\/em>at *2-4.  The plaintiff further alleged that, after she watched those videos, her video-watching history was sent to Meta without her permission via the media company\u2019s undisclosed use of the Meta Pixel on its website.  Id.<\/em>  Like plaintiffs in most adtech class action complaints, this plaintiff: (1) alleged that before the company sent the web-browsing data to the online advertising agency (e.g., <\/em>Meta), the company encrypted the data via the secure \u201chttps\u201d protocol (id.<\/em>, ECF No. 56 \u00b6 45); and (2) did not allege that any human had her encrypted web-browsing data or could retrieve it from the advertising agency\u2019s algorithms or that even the advertising agency, or any other entity or person, has her web-browsing data stored or could retrieve it from the advertising agency\u2019s algorithms in a decrypted (readable) format.  Based on the plaintiffs\u2019 allegations, the plaintiff alleged a violation of the VPPA.<\/p>\n\n\n\n

The media company moved to dismiss under Rule 12(b)(6), arguing that the media company did not adequately allege that the media company \u201cdisclosed\u201d the plaintiff\u2019s \u201cpersonally identifiable information\u201d (\u201cPII\u201d), defined under the VPPA as \u201cinformation which identifies a person as having requested or obtained specific video materials or services….\u201d  Id.<\/em>, 2025 WL 2530689, <\/em>at *5-6.<\/p>\n\n\n\n

The Court\u2019s Decision<\/strong><\/p>\n\n\n\n

The Court agreed with the media company and held that the plaintiff failed plausibly to plead any unauthorized \u201cdisclosure.\u201d <\/p>\n\n\n\n

As the Court explained, \u201cPII, under the VPPA, has three distinct elements: (1) the consumer’s identity, (2) the video material’s identity, and (3) the connection between them.\u201d  Id. <\/em>at *6.  Moreover, PII \u201cencompasses information that would allow an ordinary person to identify a consumer’s video-watching habits, but not information that only a sophisticated technology company could use to do so<\/em>.\u201d  Id. <\/em>(emphasis in original).  Therefore, \u201cto survive a motion to dismiss, a complaint must plausibly allege that the defendant\u2019s disclosure of information would, with little or no extra effort, permit an ordinary recipient to identify the plaintiff\u2019s video-watching habits.\u201d  Id.  <\/em>For these reasons, explained the Court, the Second Circuit has \u201ceffectively shut the door for Pixel-based VPPA claims.\u201d  Id. <\/em>at *7 (citing Hughes v. National Football League<\/em>, 2025 WL 1720295 (2d Cir. June 20, 2025)).<\/p>\n\n\n\n

Applying these standards, the Court dismissed the plaintiff\u2019s VPPA claim with prejudice, holding that, \u201c[i]n short, because the alleged disclosure could not be appreciated \u2014 decoded to reveal the actual identity of the user, and his or her video selections \u2014 by an ordinary person but only by a technology company such as Facebook, it did not amount to PII.\u201d  Id. <\/em>at *6-7.  In so holding, the Court cited an \u201cemergent line of authority\u201d shutting the door on VPPA claims not only in the Second Circuit but also in other U.S. Courts of Appeal.  See In Re Nickelodeon Consumer Priv. Litig.<\/em>, 827 F.3d 262, 283 (3d Cir. 2016) (affirming dismissal of VPPA case involving the use of Google Analytics, stating, \u201cTo an average person, an IP address or a digital code in a cookie file would likely be of little help in trying to identify an actual person\u201d); Eichenberger v. ESPN, Inc.<\/em>, 876 F.3d 979, 986 (9th Cir. 2017) (affirming dismissal of VPPA case because \u201can ordinary person could not use the information that Defendant allegedly disclosed [a device serial number] to identify an individual\u201d).<\/p>\n\n\n\n

Implications For Companies<\/strong><\/p>\n\n\n\n

The Court\u2019s holding in Golden<\/em> is a win for adtech class action defendants and should be instructive for courts around the country addressing adtech class actions brought under not only the VPPA, but also other statutes prohibiting \u201cdisclosures,” and the like.  These statutes should be interpreted similarly to require proof that an ordinary person could access and decipher the web-browsing data, identify the person, and link the person to the data. <\/p>\n\n\n\n

Consider a few examples.  A GIPA claim requires proof of a disclosure or a breach of confidentiality and privilege.  An eavesdropping claim under the California Information of Privacy Act (CIPA) \u00a7 632 requires proof of eavesdropping.  A trap and trace claim under CIPA \u00a7 638.51 requires proof that the data captured is reasonably likely to identify the source of the data.  A claim under the Electronic Communications Privacy Act (ECPA) requires proof of an interception.<\/p>\n\n\n\n

When adtech sends encrypted, inaccessible, anonymized transmissions to the advertising agency\u2019s algorithms, has there been any disclosure or breach of confidentiality and privilege (GIPA), eavesdropping (CIPA \u00a7 632), data capture reasonably likely to identify the source (CIPA \u00a7 638.51), or interception (ECPA)?\u00a0 Just as adtech transmissions are insufficient to amount to a disclosure under the VPPA, Golden <\/em>shows neither should adtech transmissions trigger these similarly worded statutes because no ordinary person could access and decipher the data transmitted.<\/p>\n","protected":false},"excerpt":{"rendered":"

By Gerald L. Maatman, Jr., Justin Donoho, Hayley Ryan, and Ryan Garippo Duane Morris Takeaways:\u00a0 On September 3, 2025, in Golden v. NBCUniversal Media, LLC, No. 22-CV-9858, 2025 WL 2530689 (S.D.N.Y. Sept. 3, 2025), Judge Paul A. Engelmayer of the U.S. District Court for the Southern District of New York granted a motion to dismiss … <\/p>\n

Continue reading “New York Federal Court Dismisses Adtech Class Action Because No Ordinary Person Could Identify Web User”<\/span><\/a><\/p>\n","protected":false},"author":575,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[59],"tags":[],"ppma_author":[7,122,145,127],"class_list":["post-2401","post","type-post","status-publish","format-standard","hentry","category-privacy-class-actions"],"authors":[{"term_id":7,"user_id":575,"is_guest":0,"slug":"gmaatman","display_name":"Gerald L. Maatman, Jr.","avatar_url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2022\/09\/maatmangerald-100x100.jpg","0":null,"1":"","2":"","3":"","4":"","5":"","6":"","7":"","8":""},{"term_id":122,"user_id":686,"is_guest":0,"slug":"jrdonoho","display_name":"Justin Donoho","avatar_url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2025\/02\/donohojustin-1-100x100.jpg","0":null,"1":"","2":"","3":"","4":"","5":"","6":"","7":"","8":""},{"term_id":145,"user_id":740,"is_guest":0,"slug":"hhryan","display_name":"Hayley Ryan","avatar_url":{"url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2025\/09\/ryanhayley.jpg","url2x":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2025\/09\/ryanhayley.jpg"},"0":null,"1":"","2":"","3":"","4":"","5":"","6":"","7":"","8":""},{"term_id":127,"user_id":692,"is_guest":0,"slug":"rgarippo","display_name":"Ryan Garippo","avatar_url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2024\/09\/garipporyan-100x100.jpg","0":null,"1":"","2":"","3":"","4":"","5":"","6":"","7":"","8":""}],"_links":{"self":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts\/2401","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/users\/575"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/comments?post=2401"}],"version-history":[{"count":0,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts\/2401\/revisions"}],"wp:attachment":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/media?parent=2401"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/categories?post=2401"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/tags?post=2401"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/ppma_author?post=2401"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}