Saunders v. Hearst Television, Inc.

           UNITED STATES DISTRICT COURT                              
             DISTRICT OF MASSACHUSETTS                               

           CIVIL ACTION NO. 23-cv-10998-RGS                          


      MICHELE SAUNDERS and RICHARD HAYDEN,                           
    on behalf of themselves and all others similarly situated        

                          v.                                         

               HEARST TELEVISION, INC.                               


     MEMORANDUM AND ORDER ON DEFENDANT’S                             
    MOTION TO DISMISS THE AMENDED COMPLAINT                          
            FOR FAILURE TO STATE A CLAIM                             

                    January 11, 2024                                 

Hearst Television, Inc., is the owner of several mobile applications on 
which consumers can access various news stories.  Michele Saunders and    
Richard Hayden filed this putative class action against Hearst, claiming that 
it  disclosed  to  third  parties  their  personally  identifiable  information  – 
including a record of every video they viewed on Hearst’s apps1 – in violation 
of the Video Privacy Protection Act, 

18 U.S.C. § 2710

 (VPPA).  Plaintiffs seek 
declaratory and injunctive relief, damages, and attorneys’ fees and costs.  

1 A software application, or “app,” is a “[s]oftware designed to carry out 
a specific task other than one relating to the operation of the computer itself.”  
Application Software, Oxford English Dictionary (Sept. 2023 ed.).         
Hearst moves to dismiss plaintiffs’ First Amended Complaint (FAC) (Dkt.   
# 22) for failure to state a claim.2  The court will deny the motion.     

                   BACKGROUND                                        
Hearst owns various apps on which users can read and watch local and 
national news, sports, weather, traffic, politics, and entertainment stories.  
Plaintiffs, who are residents of Massachusetts and New Hampshire, watched 

videos of weather updates on two local news apps owned by Hearst – the    
WCVB 5 and WMUR 9 apps – for several years.  When Saunders downloaded     
the WCVB 5 app, she provided her email address and enabled geolocation    

services and push notifications.  Hayden also enabled geolocation services 
and push notifications when he downloaded the WMUR 9 app, but he did      
not provide his email address.                                            
Prior to filing this case, plaintiffs’ counsel retained a private research 

company to analyze what, if any, personal data is transmitted by Hearst’s 
apps when a user watches a video.  The analysis determined that Hearst    
integrates two application programming interfaces (APIs) into its apps: the 





2  Hearst  previously  moved  to  dismiss  plaintiffs’  initial  complaint.  
Because the FAC supersedes the original complaint, that motion is moot.  See 
Kolling v. Am. Power Conversion Corp., 

347 F.3d 11, 16

 (1st Cir. 2003).   
Braze API and the DoubleClick API.3  At a high level, Hearst shares data  
about its apps’ users with Braze and Google (the owner of the DoubleClick 

API) through these APIs to improve its marketing and analytics.  Specifically, 
the  Braze  API  assigns  users  a  user  ID,  a  unique  and  random  string  of 
numbers,  which  allows  Hearst  to  “[t]rack  [its]  users  across  devices  and 
platforms, improving the quality of [its] behavioral and demographic data.”  

Setting  User  IDs,  Braze,  https://www.braze.com/docs/developer_        
guide/platform_integration_guides/android/analytics/setting_user_ids/     
(last visited Jan. 11, 2024).  The DoubleClick API does not assign user IDs, 

but Hearst provides Google with a user’s advertising ID (AAID), which is a 
unique and random string of numbers associated with an individual device.  
Users can reset AAIDs, but plaintiffs claim that “because virtually no one 
knows about AAIDs, . . . virtually no one resets that identifier.”  FAC ¶ 48.   

Each time a user watches a video on one of Hearst’s apps, Hearst     
discloses to Braze the user’s email address and location at the time she  
watched the video,4 as well as a unique video ID associated with each video 


3  An  API  allows  different  apps  to  “talk”  to  each  other,  allowing 
companies to share application data with third parties.  See What is an API?, 
IBM, https://www.ibm.com/topics/api (last visited Jan. 11, 2024).         

4  Hearst  only  discloses  a  user’s  email  address  and  geolocation 
information to Braze and Google if the user has provided this information to 
Hearst.                                                                   
the user watched and data showing that the video was watched.  Similarly, in 
addition to the user’s AAID, Hearst discloses to Google a user’s geolocation, 

the title and ID of each video she watched, and data showing that the video 
was watched.  Although plaintiffs concede that they chose to share with   
Hearst geolocation information and, in Saunders’s case, her email address, 
they  allege  that  they  never  gave  Hearst  permission  to  disclose  this 

information to third parties.                                             
                     DISCUSSION                                      
“To survive a motion to dismiss, [plaintiffs’] complaint ‘must contain 

sufficient factual matter . . . to state a claim that is plausible on its face.”  
Saldivar v. Racine, 

818 F.3d 14, 18

 (1st Cir. 2016), quoting Ashcroft v. Iqbal, 

556 U.S. 662, 678

 (2009) (second alteration in original).  Under this familiar 
“make-or-break standard,” a claim has facial plausibility “when the plaintiff 

pleads sufficient factual content that allows the court to draw the reasonable 
inference  that  the  defendant  is  liable  for  the  misconduct  alleged.”  
Sepúlveda-Villarini v. Dep’t of Educ. of Puerto Rico, 

628 F.3d 25, 29

 (1st Cir. 
2010).    Although  the  standard  is  deferential  to  plaintiffs,  “[i]f  the  facts 

articulated in the complaint are ‘too meager, vague, or conclusory to remove 
the possibility of relief from the realm of mere conjecture,’ the complaint is 
vulnerable to a motion to dismiss.”  In re Curran, 

855 F.3d 19, 25

 (1st Cir. 
2017), quoting SEC v. Tambone, 

597 F.3d 436, 442

 (1st Cir. 2010).         

The VPPA prohibits a “video tape service provider” from “knowingly   
disclos[ing], to any person, personally identifiable information concerning 
any consumer of such provider.”  

18 U.S.C. § 2710

(b)(1).  A video tape service 
provider is “any person, engaged in the business, in or affecting interstate or 

foreign commerce, of rental, sale, or delivery of prerecorded video cassette 
tapes or similar audio visual materials,” and a consumer is “any renter,  
purchaser,  or  subscriber  of  goods  or  services  from  a  video  tape  service 

provider.”    

Id.

  § 2710(a).    The  statute  defines  personally  identifiable 
information (PII) as that which “identifies a person as having requested or 
obtained  specific  video  materials  or  services  from  a  video  tape  service 
provider.”  Id.  The VPPA creates a private right of action for “[a]ny person 

aggrieved by an act of a person in violation of” the statute.  Id. § 2710(c).   
Hearst moves to dismiss on seven grounds.  Five grounds are based on 
the pleadings, claiming that the FAC fails to adequately allege that: (1) Hearst 
is  a  “video  tape  service  provider,”  (2) plaintiffs  are  “consumers,”  (3) the 

disclosed  information  is  PII,  (4) the  transmission  was  knowing,  and 
(5) plaintiffs  suffered  actual  damages.    Hearst  also  claims  that  (6) the 
information was disclosed in the “ordinary course of business” so satisfies an 
exception to liability under the VPPA, and (7) plaintiffs’ reading of the VPPA 
violates the First Amendment.  The court addresses the arguments in turn.   

Plaintiffs Allege that Hearst Is a Video Tape Service Provider            
Hearst claims that it is not a video tape service provider because the 
statutory  definition  of  such  a  provider  is  limited  to  “distributors  of 
prerecorded videocassettes or similar media available at that time” Congress 

pass the VPPA.  Mot. to Dismiss the Am. Compl. for Failure to State a Claim 
(Mot. to Dismiss) (Dkt. # 26) at 9.  This is too narrow a reading of the VPPA.  
Although  originally  passed  in  the  era  of  rental  video  stores,  Congress 

amended the VPPA in 2012 because VHS tapes are “now obsolete . . . . Today, 
so-called ‘on-demand’ cable services and Internet streaming services allow 
consumers to watch movies or TV shows on televisions, laptop computers,   
and cell phones.”  S. Rep. 112-258, at 2.  The FAC’s allegations that Hearst 

“host[s] and deliver[s] thousands of videos” to one of every five homes in the 
United States are sufficient.  FAC ¶¶ 10, 14; Ambrose v. Boston Globe Media 
Partners, 

2022 WL 4329373

, at *2 (D. Mass. Sept. 19, 2022).               
The FAC Plausibly Alleges that Plaintiffs Are Consumers                   

Plaintiffs allege that they are subscribers of Hearst’s apps, which is 
sufficient to be a “consumer” under the VPPA.  See 

18 U.S.C. § 2710

(a)(1).  
The First Circuit has adopted a “broader common definition of the term”   
subscriber in the VPPA under which an individual need not pay a fee to be a 
subscriber.  See Yershov v. Gannett Satellite Info. Network, Inc., 

820 F.3d 482, 487-488

 (1st Cir. 2016).5  Instead, a person is a “subscriber” of an app 
if she provides some consideration to use the app.  

Id. at 489

.  In Yershov, 
the  sufficient  consideration  was  Yershov’s  “Android  ID  and  his  mobile 
device’s GPS location at the time he viewed a video, each linked to his viewing 

selections.”  

Id.

                                                         
According to the FAC, any time a user views a video on one of Hearst’s 
apps, the full name of the video and/or the video ID is provided to Braze and 

Google with the user’s AAID or user 

ID.

  Id. ¶¶ 55-57, 60-64, 66-68.  The FAC 
further alleges that Saunders provided her email address to the WCVB 5 app 
and that both Saunders and Hayden enabled geolocation services and push   
notifications.    FAC  ¶¶ 106,  112.    Taken  together,  the  FAC  alleges  that 

plaintiffs provided adequate consideration to use Hearst’s apps to obtain 
subscriber status under the VPPA.  See Yershov, 

820 F.3d at 489

.          




5 Hearst repeatedly argues that Yershov “is not binding precedent,”  
ostensibly because Yershov voluntarily dismissed his case after discovery.  
See, e.g., Mot. to Dismiss at 19-20; Reply in Further Support of Mot. to  
Dismiss the Amended Compl. (Reply) (Dkt. # 28) at 1-2 & n.1.  This is plainly 
incorrect.  The First Circuit’s decisions are of course binding on the court, 
and the ultimate disposition of Yershov does not alter this fact.         
The FAC Alleges that the Disclosed Information Is PII                     
The FAC alleges that the geolocation data, which was provided to third 

parties alongside video IDs and/or video titles, divulged the precise locations 
of plaintiffs when they viewed videos on Hearst’s apps.6  This information 
alone “would enable most people to identify what are likely the home and  
work  addresses  of  the  viewer.”    

Id. at 486

;  see  also  In  re  Nickelodeon 

Consumer Priv. Litig., 

827 F.3d 262, 289

 (3d Cir. 2016) (“GPS coordinates 
contain . . . power to identify a specific person.”); Louth v. NFL Enters. LLC, 

2022 WL 4130866

 at *3 (D.R.I. Sept. 12, 2022) (a “short string of numbers 

that links to a particular video name” is sufficient to identify a specific video).  
The FAC further alleges that if an individual enters the geolocation data into 








6 Hearst argues that the geolocation data pled in the FAC does not   
identify plaintiffs because the data “indicates the device(s) that sent GPS 
signals . . . may have been located in or around 1306 to 1314 Solano Avenue 
in Albany, California at some point in time,” but Saunders and Hayden reside 
in  Massachusetts  and  New  Hampshire.    Mot.  to  Dismiss  at  16  (citation 
omitted).  This is true, but the geolocation data pled in the FAC was from a 
“tester,” not plaintiffs.  See FAC ¶ 16.                                  
a  publicly  available  website,  “the  user’s  precise  location  is  displayed  in 
latitude, longitude, and on Google Maps.”7  FAC ¶ 39.                     

The allegations that Hearst disclosed plaintiffs’ unique user IDs and 
AAIDs and, in some cases, their email addresses, strengthens their claims.  
See Lamb v. Forbes Media LLC, 

2023 WL 6318033

, at *10 (S.D.N.Y. Sept.     
28, 2023) (“Courts have uniformly held Facebook IDs to constitute PII under 

the  VPPA,  particularly  where—as  here—the  plaintiff  alleges  that  her 
Facebook ID was disclosed alongside the viewed video’s URL and name.”);   
In re Nickelodeon, 

827 F.3d at 289

 n.174 (“[E]ven a numeric identifier might 

qualify as [PII].”).  The FAC thus limns a claim that the information disclosed 
was PII because it was reasonably and foreseeably likely that an ordinary 
person  would  be  able  to  both  identify  the  specific  videos  that  plaintiffs 
watched and know that it was likely plaintiffs who watched them.          

The FAC Adequately Pleads Knowledge                                       
Hearst  contends  that  the  FAC  does  not  adequately  allege  that  it 
knowingly transmitted PII because it did not believe that the data it was 
conveying was PII.  Mot. to Dismiss at 24-25.  But the FAC is rife with   

allegations that Hearst knew that it  was collecting data from users that 


7 Indeed, Hearst determined the likely address of the tester’s workplace 
using the geolocation data pled in the FAC despite plaintiffs not disclosing 
the actual address.  See Mot. to Dismiss at 16.                           
identified personalized information about them because, in exchange for the 
data, Braze and Google provided Hearst with analytics allowing it to provide 

advertisements  tailored  to  specific  users.    E.g.,  FAC  ¶¶ 96-105.    These 
allegations adequately plead knowledge.  See Yershov, 

820 F.3d at 486

;    
Golden v. NBCUniversal Media, LLC, 

2023 WL 5434378

, at *8 (S.D.N.Y.       
Aug. 23, 2023); Louth, 

2022 WL 4130866

, at *3.                            

Plaintiffs Need Not Plead Actual Damages                                  
The VPPA permits “[a]ny person aggrieved” by a violation of the statute 
to  recover  “actual  damages  but  not  less  than  liquidated  damages  in  an 

amount of $2,500,” punitive damages, attorneys’ fees and costs, and other 
equitable relief.  

18 U.S.C. § 2710

(c).  Hearst reads this provision to require 
plaintiffs to plead pecuniary loss.  Mot. to Dismiss at 26.  The court disagrees. 
The problem with Hearst’s reading of the statute is that the text of the 

VPPA does not condition recovery on proof of actual damages.  In Doe v.   
Chao, 

540 U.S. 614

 (2004), on which Hearst relies heavily, Doe argued that 
the Privacy Act of 1974, 5 U.S.C. § 552a, did not require proof of actual 
damages.    The  Privacy  Act  provides  that  if  the  United  States  violates  a 

provision of the statute, it “shall be liable to the individual in an amount 
equal to the sum of actual damages sustained by the individual as a result of 
the [violation], but in no case shall a person entitled to recovery receive less 
than the sum of $1,000.”  5 U.S.C. § 552a(g)(4).  The Court concluded that 
Doe needed to prove actual damages to prevail on a Privacy Act claim.  Chao, 

540 U.S. at 620

.  But in doing so, it noted that if Congress wished to allow 
recovery of liquidated damages for violations of the Privacy Act absent actual 
damages, it could have made the statute read “the Government would be     
liable to the individual for actual damages ‘but in no case . . . less than the 

sum of $1,000.’”  

Id. at 623

 (alteration in original).  That is nearly exactly 
how the VPPA is styled.  See 

18 U.S.C. § 2710

(c)(2)(A) (“The court may award 
actual  damages  but  not  less  than  liquidated  damages  in  an  amount  of 

$2,500.”).                                                                
Nor is the statute’s reference to a “person aggrieved” by violation of the 
statute  meant  to  cabin  viable  VPPA  claims  only  to  plaintiffs  who  have 
suffered actual damages.  The cases that Hearst cites in support of this  

argument  all  interpret  statutes  other  than  the  VPPA,  and  each  statute 
contains materially different language than that of the VPPA.  The court is 
comfortable that at this preliminary stage, and absent guidance from the  
First Circuit on the issue, plaintiffs may proceed without alleging any specific 

pecuniary loss.                                                           
The Ordinary Course of Business Exception Does Not Apply                  
The VPPA has a narrow exception for disclosures made “incident to the 

ordinary course of business.”  

18 U.S.C. § 2710

(b)(2)(E).  “[O]rdinary course 
of business” means “only debt collection activities, order fulfillment, request 
processing, and the transfer of ownership.”  

Id.

 § 2710(a).  The alleged uses 
of the information here – “marketing, advertising, and analytics” – do not 

fall within the exception’s narrow list of permissible uses.  FAC ¶ 29; see also 
Louth, 

2022 WL 4130866

, at *4 (disclosing PII to “measure analytics and   
increase  advertising  revenue”  does  not  fall  within  ordinary  course  of 

business exception).                                                      
The Application of the VPPA Alleged in the FAC Is Consonant with          
the First Amendment                                                       
Hearst  finally  argues  that  plaintiffs’  reading  of  the  VPPA  runs 
“headlong into the First Amendment” because the VPPA is a content- and    
speaker-based  regulation  that  would  not  survive  intermediate  or  strict 
scrutiny  as  applied  to  “any  communications  by  publishers  to  facilitate 

advertising.”  Mot. to Dismiss at 27-29.  Plaintiffs counter that Hearst’s 
speech is commercial speech, so the VPPA is subject to intermediate scrutiny.    
Commercial  speech  is  “expression  related  solely  to  the  economic 

interests of the speaker and its audience.”  Pharm. Care Mgmt. Ass’n v.   
Rowe, 

429 F.3d 294, 309

 (1st Cir. 2005), quoting El Dia, Inc. v. Puerto Rico 
Dep’t of Consumer Affs., 

413 F.3d 110, 115

 (1st Cir. 2005).  If the commercial 
speech concerns lawful activity and is not misleading, it may be regulated if 

the  government:  (1) “assert[s]  a  substantial  interest  in  support  of  its 
regulation”; (2) “demonstrate[s] that the restriction on commercial speech 
directly and materially advances that interest”; and (3) the regulation is 
“narrowly drawn.”  Florida Bar v. Went For It, Inc., 

515 U.S. 618, 624

 (1995), 

quoting Cent. Hudson Gas & Elec. Corp. v. Pub. Serv. Comm’n of New York,  

447 U.S. 557, 564-565

 (1980).  At bottom, the VPPA must evince a “fit     
between the legislature’s ends and the means chosen to accomplish those   

ends” that is “not necessarily perfect, but reasonable.”  Bd. of Trs. of State 
Univ. of New York v. Fox, 

492 U.S. 469, 481

 (1989), quoting Posadas de    
Puerto Rico Assocs. v. Tourism Co. of Puerto Rico, 

478 U.S. 328, 341

 (1986).   
As  plead  in  the  FAC,  Hearst’s  disclosure  of  PII  to  third  parties  is 

commercial speech.8  See Sorrell v. IMS Health Inc., 

564 U.S. 552, 563-565

 
(2011) (analyzing restrictions on the “sale, disclosure, and use of prescriber-


8  Even  if  the  disclosures  do  not  strictly  satisfy  the  definition  of 
commercial speech, speech that is “solely in the individual interest of the 
speaker and its specific business audience” and does not implicate matters 
of public concern is subject to “many of the same concerns that argue in favor 
of  reduced  constitutional  protection”  for  commercial  speech.    Dun  & 
Bradstreet, Inc. v. Greenmoss Builders, Inc., 

472 U.S. 749

, 761-762 & n.8 
(1985).  And the speech here is “solely motivated by the desire for profit,” 
which “is a force less likely to be deterred than others,” further counseling in 
favor of the application of intermediate scrutiny.  

Id. at 762

.           
identifying  information”  with  commercial  speech  framework);  see  also 
Boelter v. Hearst Commc’ns, Inc., 

192 F. Supp. 3d 427, 445-446

 (S.D.N.Y.  

2016) (disclosing identities of individuals who purchase products covered by 
state analog of VPPA is commercial speech).  The speech concerns lawful   
activity and is not misleading, and the court finds that the VPPA satisfies the 
intermediate scrutiny test.                                               

First,  Congress’s  interest  in  enacting  the  VPPA  was  to  “preserve 
personal privacy with respect to the rental, purchase or delivery of video 
tapes or similar audio visual materials.”  S. Rep. 100-599 at 1.  The Supreme 

Court  has  repeatedly  recognized  the  sanctity  of  personal  privacy.    E.g., 
Florida Bar, 

515 U.S. at 625

; Frisby v. Schultz, 

487 U.S. 474, 483-485

 (1988).  
Second, restricting Hearst from disclosing to third parties the precise videos 
that  plaintiffs  viewed  alongside  plaintiffs’  PII  directly  and  materially 

advances that interest.  Third, the court can conceive of no legitimate non-
commercial  First  Amendment  interest  of  Hearst  that  its  exploitation  of 
plaintiffs’ PII serves.  Finally, the VPPA is narrowly drawn because it applies 
only to a narrow group of business entities and specific group of consumers.  

The court is satisfied that the “fit” between Congress’s goal of protecting 
privacy in this realm and its means to do so is at least reasonable.  See Bd. of 
Trs. of State Univ. of New York, 

492 U.S. at 481

.                         
This conclusion is bolstered by the fact that the court is aware of no 
cases in any circuit – and Hearst cites none – holding that the VPPA violates 

the First Amendment.  Hearst’s reliance on Stark v. Patreon, Inc., 

656 F. Supp. 3d 1018

 (N.D. Cal. 2023), to argue otherwise is unavailing.  In Stark, 
the Northern District of California concluded that the VPPA might regulate 
both commercial and non-commercial speech and thus was subject to facial  

overbreadth review.  

Id. at 1034-1036

.  But it declined to engage in such 
review  at  the  motion-to-dismiss  stage  because  overbreadth  analysis 
“depends not only on statutory text but also on ‘actual fact.’”  

Id. at 1037

, 

quoting New York State Club Ass’n v. City of New York, 

487 U.S. 1, 14

 (1988).  
The court declines to raise a sua sponte facial challenge to the statute at this 
stage.                                                                    
                       ORDER                                         

For  the  foregoing  reasons,  Hearst’s  motion  to  dismiss  the  FAC  is 
DENIED.                                                                   
                         SO ORDERED.                                 
                         /s/ Richard G. Stearns                      
                         UNITED STATES DISTRICT JUDGE