Hughes v. Nat'l Football League

24-2656
Hughes v. Nat’l Football League

                           UNITED STATES COURT OF APPEALS
                               FOR THE SECOND CIRCUIT

                                       SUMMARY ORDER

RULINGS BY SUMMARY ORDER DO NOT HAVE PRECEDENTIAL EFFECT. CITATION TO A
SUMMARY ORDER FILED ON OR AFTER JANUARY 1, 2007, IS PERMITTED AND IS GOVERNED BY
FEDERAL RULE OF APPELLATE PROCEDURE 32.1 AND THIS COURT’S LOCAL RULE 32.1.1. WHEN
CITING A SUMMARY ORDER IN A DOCUMENT FILED WITH THIS COURT, A PARTY MUST CITE
EITHER THE FEDERAL APPENDIX OR AN ELECTRONIC DATABASE (WITH THE NOTATION
“SUMMARY ORDER”). A PARTY CITING A SUMMARY ORDER MUST SERVE A COPY OF IT ON
ANY PARTY NOT REPRESENTED BY COUNSEL.

        At a stated term of the United States Court of Appeals for the Second Circuit, held at the
Thurgood Marshall United States Courthouse, 40 Foley Square, in the City of New York, on the
20th day of June, two thousand twenty-five.

Present:
            DEBRA ANN LIVINGSTON,
                   Chief Judge,
            JON O. NEWMAN,
            RICHARD J. SULLIVAN,
                   Circuit Judges.
_____________________________________

BRANDON HUGHES, INDIVIDUALLY AND ON BEHALF
OF ALL OTHERS SIMILARLY SITUATED,

                         Plaintiff-Appellant,

ISRAEL JAMES,
                         Plaintiff,

                v.                                                  24-2656

NATIONAL FOOTBALL LEAGUE,

                  Defendant-Appellee.
_____________________________________

For Plaintiff-Appellant:                        JOSHUA I. HAMMACK, (Michael L. Murphy, on the
                                                brief), Bailey & Glasser, LLP, Washington, D.C.




                                                  1
For Defendant-Appellant:                         HILARY L. PRESTON, (Marisa Antonelli, Matthew X.
                                                 Etchemendy, on the brief), Vinson & Elkins LLP,
                                                 New York, NY.

       Appeal from an order and judgment of the United States District Court for the Southern

District of New York (Rochon, J.).

       UPON DUE CONSIDERATION, IT IS HEREBY ORDERED, ADJUDGED, AND

DECREED that the order and judgment of the district court is AFFIRMED.

       Plaintiff-appellant Brandon Hughes appeals from an order and judgment of the United

States District Court for the Southern District of New York (Rochon, J.), entered on September 5

and 6, 2024, respectively, granting defendant-appellee National Football League’s (the “NFL”)

motion to dismiss pursuant to Federal Rule of Civil Procedure 12(b)(6). On appeal, Hughes

initially asked us to vacate and remand in light of our decision in Salazar v. Nat’l Basketball Ass’n,

118 F.4th 533

 (2d Cir. 2024), which post-dated the district court’s order and judgment. Thereafter,

we decided Solomon v. Flipps Media, Inc., 

136 F.4th 41

 (2d Cir. 2025). Now, Hughes argues that

“Solomon does not alter the outcome here,” dkt. 44 at 1, and continues to ask us to vacate and

remand, while the NFL argues that Solomon “is binding and dispositive of this case”, dkt. 45 at 1,

and asks us to affirm. Because we agree with the NFL, we affirm the district court’s decision to

dismiss this case. We assume the parties’ familiarity with the underlying facts, the procedural

history of the case, and the issues on appeal.

       Hughes alleges that the NFL violated the Video Privacy Protection Act (“VPPA”) by

installing the Facebook Pixel (the “Pixel”) onto its website and app. The Pixel is a string of code

that can be installed onto a website/app and shares certain information about users with Facebook.




                                                   2
J. App’x at 269-70. The principal question now is whether Hughes can still plead a viable VPPA

claim against the NFL in light of our decision in Solomon. 1 We conclude that he cannot.

         We review de novo a district court’s grant of a motion to dismiss under Fed. R. Civ. P.

12(b)(6), accepting all factual allegations in the complaint as true and drawing all reasonable

inferences in the plaintiff’s favor. See, e.g., O’Donnell v. AXA Equitable Life Ins. Co., 

887 F.3d 124, 128

 (2d Cir. 2018). To survive a motion to dismiss, a complaint must contain sufficient

factual allegations to state a claim for relief that is plausible on its face. See, e.g., 

id.

         Both Salazar and Solomon were decided after the district court granted the NFL’s motion

to dismiss in this case. “Ordinarily, where circumstances have changed between the ruling below

and the decision on appeal, the preferred procedure is to remand to give the district court an

opportunity to pass on the changed circumstances, unless the new situation demands one result

only.” New England Merchs. Nat. Bank v. Iran Power Generation & Transmission Co., 

646 F.2d 779, 783-84

 (2d Cir.) (internal quotation marks omitted) (emphasis added), certified question

answered sub nom. Iran Nat’l Airlines Corp. v. Marschalk Co., 

453 U.S. 919

 (1981). This case

presents such a situation.




1
  The NFL also argues that the district court improperly concluded that Hughes had standing to bring his claim. The
NFL is mistaken. The crux of its argument is that Hughes lacks Article III standing to pursue a VPPA claim because
he supposedly consented to the disclosures in question. Not so. As a threshold matter, there is a factual dispute as to
whether Hughes actually consented to the disclosure of his information. Compare J. App’x 263 (alleging that
“[p]laintiff never gave [d]efendant express written consent to disclose his [p]ersonal [v]iewing [i]nformation”) with
Appellee’s Br. at 25 (arguing that plaintiff “consented to the disclosures at issue” by “agree[ing] to the NFL’s Privacy
Policy when he created his account on NFL.com”). In particular, the parties disagree as to whether the NFL’s Privacy
Policy informed users that their information may be disclosed rather than merely collected. In Salazar, we concluded
that this type of question “should be left for the district court to address in the first instance given that its resolution
will require detailed examination of the [relevant] Privacy Policy and [plaintiff’s] factual allegations showing his
acceptance of that policy.” Salazar, 

118 F.4th at 539

 n.4. So too here. Moreover, as the district court correctly
observed, the NFL’s argument at most establishes an affirmative defense and calls for an analysis of the merits of
plaintiff’s VPPA claim. Since the “threshold inquiry into standing ‘in no way depends on the merits,’” such an analysis
is inappropriate at this stage. Wakefield v. ViSalus, Inc., 

51 F.4th 1109

, 1118 n.7 (9th Cir. 2022) (quoting Whitmore
v. Arkansas, 

495 U.S. 149, 155

 (1990)).

                                                             3
       The VPPA provides that “[a] video tape service provider who knowingly discloses, to any

person, personally identifiable information concerning any consumer of such provider shall be

liable to the aggrieved person[.]” 

18 U.S.C. § 2710

(b)(1). In Solomon, we held that “‘personally

identifiable information’ encompasses information that would allow an ordinary person to identify

a consumer’s video-watching habits, but not information that only a sophisticated technology

company could use to do so.” 

136 F.4th at 52

; see also In re Nickelodeon Consumer Priv. Litig.,

827 F.3d 262, 290

 (3d Cir. 2016) (adopting the “ordinary person” standard); Eichenberger v.

ESPN, Inc., 

876 F.3d 979, 985

 (9th Cir. 2017) (same).

       Solomon effectively shut the door for Pixel-based VPPA claims. As is the case here,

Solomon involved a plaintiff who brought a VPPA claim against a defendant that had installed the

Pixel on its website. The plaintiff’s complaint included the following “exemplar” which showed

an example of the type of transmission that was sent to Facebook via the Pixel:




Solomon, 

136 F.4th at 46

. We concluded in Solomon that:

       The exemplar depicts some twenty-nine lines of computer code, and the video title is
       indeed contained in Box A following the GET request. The words of the title, however,
       are interspersed with many characters, numbers, and letters. It is implausible that an
       ordinary     person    would     look    at     the    phrase      “title%22%3A%22-

                                                4
        %E2%96%B7%20The%20Roast%20of%- 20Ric%20Flair” . . . and understand it to be a
        video title. It is also implausible that an ordinary person would understand, “with little or
        no extra effort,” the highlighted portion to be a video title as opposed to any of the other
        combinations        of    words    within     the    code,    such    as,   for    example,
        “%9C%93%20In%20the%20last%20weekend%20of%20-July%2C.”

        ...

        [I]t is [also] not plausible that an ordinary person, without [] annotation . . . , would see the
        “c_user” phrase on [a] server[] and conclude that the phrase was a person’s [Facebook ID
        (“FID”)].

Id. at 54

 (internal citations omitted).

        The same holds true here. Hughes’ complaint includes a similar screenshot depicting a

“single communication session sent from [a] device to Facebook” via the Pixel:




                                                   5
J. App’x at 273. While Hughes asserts that a viewer’s FID can be identified based on the string of

numerals following the “c_user” field, 

id.,

 it “is not plausible that an ordinary person, without []

annotation . . . , would see the ‘c_user’ phrase on [this communication] and conclude that the

phrase was a person’s FID.” Solomon, 

136 F.4th at 54

. And while the district court may not have

had the benefit of our decision in Solomon when it ruled on the NFL’s motion to dismiss, “[w]e

are free to affirm on any ground that finds support in the record, even if it was not the ground upon

which the trial court relied.” Beijing Neu Cloud Oriental Sys. Tech. Co. v. Int’l Bus. Machines

Corp., 

110 F.4th 106, 113

 (2d Cir. 2024) (internal quotation marks omitted).

       Hughes argues that, if permitted to amend his complaint, he would allege that: (1)

Facebook receives communications from the Pixel “in a way that is automatically translated into

a readable format and is displayed (or is displayable) on a user interface as plain text”; (2) an

ordinary person could plug the code into “ubiquitous internet-based tools like ChatGPT” to

“translate the code to reveal the Facebook ID and video title in plain English”; and (3) 75% of

Americans have a Facebook account. Dkt. 44 at 3. None of these arguments supports a VPPA

claim post-Solomon. In Solomon, we focused on whether an ordinary person would be able to

understand the actual underlying code communication itself, regardless of how the code is later

manipulated or used by Facebook. Solomon, 

136 F.4th at 52

 (“‘[P]ersonally identifiable

information’ encompasses information that would allow an ordinary person to identify a

consumer’s video-watching habits, but not information that only a sophisticated technology

company could use to do so.” (emphasis added)). The existence of tools like ChatGPT, which

were also prevalent at the time Solomon was decided, would not alter our conclusion in this case.

Finally, the ubiquity of Facebook accounts has no bearing on the ability of ordinary people to




                                                 6
interpret the Pixel communications depicted in Hughes’ complaint. Accordingly, we see no basis

for remanding because amendment would likely be futile.

                                       *      *      *

       We have considered appellant’s remaining arguments and find them to be without merit.

Accordingly, the order and judgment of the district court are AFFIRMED.

                                                  FOR THE COURT:
                                                  Catherine O’Hagan Wolfe, Clerk




                                              7