Louth v. NFL Enterprises LLC

              UNITED STATES DISTRICT COURT                             
             FOR THE DISTRICT OF RHODE ISLAND                          

                             )                                         
DANIEL LOUTH, individually and on  )                                      
behalf of all others similarly situated,  )                               
 Plaintiff,                  )                                         
                             )                                         
 v.                          )   C.A. No. 1:21-cv-00405-MSM-PAS        
                             )                                         
NFL ENTERPRISES LLC.,           )                                         
 Defendant.                  )                                         
                             )                                         

                 MEMORANDUM AND ORDER                                  
Mary S. McElroy, United States District Judge.                            
  This is a putative class action arising under the Video Privacy Protection Act 
(“VPPA”), 

18 U.S.C. § 2710

, and Rhode Island’s Video Rental Privacy Act (“RIVRPA”), 
R.I.G.L. § 11-18-32.                                                      
  The VPPA prohibits video service providers from knowingly disclosing the 
“personally identifiable information” of its consumers to any person, with limited 
exceptions.  

18 U.S.C. § 2710

(b).  Similarly, the RIVRPA prohibits anyone from 
“reveal[ing], transmit[ing], publish[ing], or disseminate[ing] in any manner, any 
records which would identify the names and addresses of individuals, with the titles 
or nature of video films, records, cassettes, or the like, which they purchased, leased, 
rented, or borrowed. . .”  R.I.G.L. § 11-18-32.                           
  The defendant, NFL Enterprises LLC, now moves to dismiss the plaintiff’s 
complaint pursuant to Fed. R. Civ. P. 12(b)(6).  For the reasons that follow, the Court 
GRANTS IN PART and DENIES IN PART the defendant’s Motion.  (ECF No. 17.)  
                    I.   BACKGROUND                                    
  As alleged in the plaintiff’s First Amended Complaint, NFL Enterprises LLC 
owns and operates a mobile application (“NFL App”) which disseminates “live local 

and primetime games, exciting videos and highlights, and replays of every game.”  
(ECF No. 14 ¶ 2.)  Consumers can download the NFL App through the Google Play 
Store on Android devices or the Apple App Store on iOS devices.    ¶ 13.  Once 
downloaded, the NFL App requests permission from the user to access their location 
through the mobile device’s GPS.     At no point does NFL Enterprises receive 
permission from users to share their location information, personally identifiable 

information, or video viewing information with third parties.    ¶ 14.    
  The  plaintiff’s  counsel  retained  a  private  research  company  to  conduct  a 
dynamic analysis of the NFL App.    ¶ 16.  The researchers’ analysis revealed that 
NFL Enterprises transmits information sufficient to identify class members and the 
videos they watch to an unrelated third party.     Further, the analysis established 
that  the  defendant  incorporates  multiple  “application  programming  interfaces” 
(“APIs”) into the NFL App.    ¶ 17.  APIs “enable[] companies to open up their 

applications’  data  and  functionality  to  external  third-party  developers,  business 
partners, and internal departments within their companies.”    ¶ 18.      
  NFL Enterprises integrates the Anvato API, which is owned by Google, into 
the NFL App.    ¶ 20.  When a user enables location services, NFL Enterprises 
transmits  to  Google,  through  the  Anvato  API,  a  user’s  geolocation,  a  user’s 
advertising ID, and a unique video identifier of the video(s) the user viewed.    ¶ 21.  
The purpose of these disclosures, the plaintiff alleges upon description and analysis 
of the Anvato platform, is for NFL Enterprises to maximize its advertising revenue.  
¶ 59.                                                                  

  The plaintiff, Daniel Louth, used the NFL App from 2018 to 2021 in Rhode 
Island.    ¶¶ 78-79.  He never consented, agreed, or otherwise permitted the 
defendant to disclose his geolocation, advertising ID, and watch history to third 
parties.    ¶ 80.  He alleges, on behalf of himself and a putative class, that in 
violation of the VPPA and RIVRPA, NFL Enterprises, without consent, “knowingly 
and intentionally discloses its users’ personally identifiable information—including a 

record of every video viewed by the user—to unrelated third parties.”    ¶¶ 3, 82.  
             II.  MOTION TO DISMISS STANDARD                           
  On a motion to dismiss, the Court “must assume the truth of all well-plead[ed] 
facts and give plaintiff the benefit of all reasonable inferences therefrom.”  
                       , 

496 F.3d 1

, 5 (1st Cir. 2007).  To survive a motion 
to dismiss, the complaint must state a claim plausible on its face.       
    ,  

550 U.S. 544, 570

  (2007).    The  Court  assesses  the  sufficiency  of  the 

plaintiff’s factual allegations in a two-step process.                    
  , 

640 F.3d 1, 7, 11-13

 (1st Cir. 2011).  “Step one: isolate and ignore statements 
in the complaint that simply offer legal labels and conclusions or merely rehash 
cause-of-action elements.”                               , 

699 F.3d 50, 55

 (1st Cir. 2012).  “Step two: take the complaint’s well-pled (  non-conclusory, 
non-speculative) facts as true, drawing all reasonable inferences in the pleader’s 
favor, and see if they plausibly narrate a claim for relief.”     “The relevant question 
… in assessing plausibility is not whether the complaint makes any particular factual 
allegations but, rather, whether ‘the complaint warrant[s] dismissal because it failed 

   to  render  plaintiffs’  entitlement  to relief plausible.”         
           , 

711 F.3d 49, 55

 (1st Cir. 2013) (quoting                  
    , 

550 U.S. 544

, 569 n.14 (2007)).                                  
                     III.  DISCUSSION                                  
  A.   The Video Privacy Protection Act, 

18 U.S.C. § 2710

              
  To  state  a  claim  under  the  VPPA,  the plaintiff must  establish  that  NFL 

Enterprises acted as a video tape service provider that knowingly disclosed personally 
identifiable information to a third party in a manner that falls outside of one of the 
VPPA’s express statutory exceptions.   

18 U.S.C. § 2710

.                  
       1.   Disclosure of “Personally Identifiable Information”        
  The VPPA covers the disclosure of personally identifiable information (“PII”), 
defined in the statute to “includ[e] information which identifies a person as having 
requested or obtained specific video materials or services from a video tape service 

provider[.]”  

18 U.S.C. § 2710

(a)(3).  The First Circuit has held that the statutory 
language, though “awkward and unclear,” “reasonably conveys the point that PII is 
not limited to information that explicitly names a person” and that it sets forth “a 
minimum, but not exclusive, definition of [PII].”                         
        , 

820 F.3d 482, 486

 (1st Cir. 2016).  Disclosure of data is actionable 
where it is “reasonably and foreseeably likely to reveal which … videos” a consumer 
has watched.     Nevertheless, “there is certainly a point at which the linkage of 
information to identity becomes too uncertain, or too dependent on too much yet-to-
be done, or unforeseeable detective work,” to plausibly set forth a VPPA claim.      

  The initial question is whether the plaintiff’s allegations support a claim that 
NFL Enterprises disclosed PII and the specific videos that he obtained.  What is 
required at this stage is whether the plaintiff has alleged sufficient facts that the 
defendant’s  disclosure  of  data  to  a  third-party  (here,  Google),  reasonably  and 
foreseeably can identify consumers and which videos they watched.         
  The plaintiff alleges that NFL Enterprises discloses to Google via the Anvato 

API a user’s PII through geolocation, a user’s unique advertising ID (“AAID”), and 
the unique video identifier of the videos viewed by the user.  (ECF No. 14 ¶¶ 20, 67, 
72-73.)                                                                   
  As to a consumer’s geolocation, NFL Enterprises collects and transmits to 
Google this data at the time the consumer views videos.    ¶¶ 30-37.  The NFL App 
discloses a user’s geolocation “with more than three decimal places of accuracy (i.e., 
within less than forty feet of the user).”    ¶ 22.  “In other words, this type of 

geolocation can be considered precise, as it provides street level accuracy.”     The 
geolocation data disclosed, therefore, is “reasonably and foreseeably likely” to identify 
a user who watched videos on the NFL App.    , 

820 F.3d at 486

 (“Given    
how easy it is to locate a GPS coordinate on a map, this disclosure would enable most 
people to identify what are likely the home and work addresses of the viewer.”). 
  Secondly,  the  plaintiff  makes  allegations  concerning  NFL  Enterprises’ 
disclosure of AAID to Google.  (ECF No. 14 ¶ 38.)  An AAID is a “unique string of 
numbers that attaches to a device (such as a mobile phone).”    ¶ 39.  “An AAID is 

sent to advertisers and other third parties so they can track user activity across 
multiple  applications.”        The  data  collected  can  allow  companies  to  create 
inferences about the user’s identity.    ¶¶ 41-42.  While AAID are “resettable” by 
users, the plaintiff plausibly alleges that “AAID is a persistent identifier because 
virtually no one knows about AAIDs and, correspondingly, virtually no one resets 
their AAID.”    ¶ 40.  The plaintiff sufficiently alleges that AAID is PII because it is 

“unique both to a specific device and user” and allows Google “to identify and track 
specific users across multiple electronic devices, applications, and services that a 
consumer may use.”        , 

820 F.3d at 484

, 484 n.1.                     
  The plaintiff further buttresses his assertion that geolocation and AAID are 
PII with the argument that the combination of the two allows Google to identify 
specific users each time they watch a video because NFL Enterprises transmits both 
data groups allowing Google to “create synergetic inferences about user activity.”    

¶¶ 47-48.                                                                 
  In addition, the plaintiff alleges that when NFL Enterprises transmits a user’s 
geolocation and AAID, it also transmits a user’s video ID which identifies the video 
that is being watched.    ¶ 49.  This “MCP ID” is a “short string of numbers that 
links to a particular video name.”    ¶ 24.  Anvato’s platform confirms that it 
matches the MCP ID to the video title and content.    ¶ 55.  Thus, Google (via 
Anvato) can identify which users watch which videos using an MCP 

ID.

      
  Assuming the truth of these alleged facts, the disclosure of precise geolocation 

data,  AAID,  and  video  MCP  IDs  constitutes  PII  because  it  is  “reasonably  and 
foreseeably likely to reveal which [NFL] videos [the plaintiff] has obtained.”   , 

820 F.3d at 486

.                                                          
       2.   “Knowing” Disclosure of “Personally Identifiable Information” 
  The VPPA prohibits only “knowing” disclosures of PII.  

18 U.S.C. § 2710

(b)(1).  
A video tape service provider violates the VPPA when it “actually knew that it was 

disclosing: 1) a user’s identity; 2) the identity of the video material; and 3) the 
connection between the two— , that the given user had ‘requested or obtained’ the 
given video material.”              , 

86 F. Supp. 3d 1090, 1095

 (N.D. Cal. 
2015).                                                                    
  NFL Enterprises argues that while the plaintiff alleges facts regarding the 
analytics and ad targeting services that Google’s Anvato offers—which would require 
the PII disclosure—it does not set forth facts from which the Court could reasonably 

infer that NFL Enterprises actually used such services.                   
  But  the  Amended  Complaint  sets  forth  that  Google  markets  Anvato  as 
providing “100% workflow automation” with nine distinct services in one product, 
including “monetization” and “analytics” for mobile applications.  (ECF No. 14 ¶¶ 26-
27.)  Specifically, the Anvato platform offers “a fully managed, end-to-end video 
processing  and  management  platform  for  signal  acquisition,  live  and  video-on-
demand  editing,  hybrid  encoding,  social  and  premium  syndication,  dynamic  ad 
insertion,  authenticated  playback,  video  analytics  and  player  SDKs  across  all 
connected devices.”    ¶ 29.  “[D]ynamic ad insertion” and “video analytics” rely upon 

a user’s geolocation and AAID.                                            
  As  alleged,  the  Avanto  dashboard  transparently  shows  what  information 
Google is collecting, analyzing, and aggregating.    ¶ 75.  This includes what users 
are watching and where they are watching.     By using these dashboards, the 
plaintiff asserts, NFL Enterprises knows that it is disclosing a user’s geolocation, 
AAID, and watch history to Google.                                        

  Given the facts alleged, it can reasonably be inferred that NFL Enterprises 
knowingly transmits PII for the purpose of targeted advertising.  Furthermore, it 
cannot be said that upon discovery such a linkage is “too dependent on too much yet-
to-be done, or unforeseeable detective work.”   , 

820 F.3d at 486

.        
       3.   The “Ordinary Course of Business” Exception                
  The VPPA provides that a video tape service provider’s knowing disclosure of 
PII  is  permitted  if  “incident  to  the  ordinary  course  of  business.”    

18 U.S.C. § 2710

(b)(2)(E).  The statute defines the “ordinary course of business” as “only debt 
collection  activities,  order  fulfillment,  request  processing,  and  the  transfer  of 
ownership.”    § 2710(a)(2).                                              
  Viewing the alleged facts in the light most favorable to the plaintiff, as the 
Court must upon a motion to dismiss, NFL Enterprises discloses PII to Google to 
measure analytics and increase advertising revenue.  Such purposes do not fall into 
the narrow categories statutorily defined as the “ordinary course of business.”   ; 
                      , 

2012 WL 3282960

, at *7 (N.D. Cal. Aug. 10, 2012) 
(holding that the purposes of “[m]arket research and web analytics,” were “not in the 

ordinary  course  of  [the  defendant’s]  business  of  delivering  video  content  to 
consumers”).                                                              
  It may be determined upon discovery that NFL Enterprises uses Anvato only 
for  “end-to-end  video  processing  and  management”  functions,  but,  at  this  early 
pleading stage, the plaintiff sets forth a plausible case that it uses those services in 
violation of the VPPA.                                                    

       4.   “Video Tape Service Provider”                              
  The plaintiff’s claim is premised upon the disclosure of PII when watching live 
game content and video clips, the latter including prerecorded game highlights and 
other videos.  (ECF No. 14 ¶¶ 2, 79.)  NFL Enterprises argues that, under the plain 
language of the VPPA, it cannot be a “video tape service provider” with respect to 
“live” game content.  A “video tape service provider” is “any person, engaged in the 
business, in or affecting interstate or foreign commerce, of rental, sale, or delivery of 

       video cassette tapes or similar audio visual materials ….”  

18 U.S.C. § 2170

(a)(4) (emphasis added).                                              
  The plaintiff asserts that live content should be included as a “similar audio 
visual materia[l]” but the Court finds this interpretation goes too far.  The adjective 
“prerecorded”  modifies  both  “video  cassette  tapes”    “similar  audio  visual 
materials.”  This is confirmed in a Sente Report recommending passage of the VPPA, 
specifically identifying “laser discs, open-reel movies, and CDI technologies,” as the 
types of technologies that provide “similar audio visual materials,” beyond video 
cassette tapes.   S. Rep. No. 100-599, at 5 (1988),  q988 U.S.C.C.A.N.    

4342.  This Report “suggests Congress’ intent to cover new technologies for pre-
recorded video content.”   , 

2012 WL 328960

, at * 6.                      
  As such, NFL Enterprises’ Motion to Dismiss the plaintiff’s VPPA claims is 
granted to the extent they rely upon the consumption of live content but denied as to 
pre-recorded content.                                                     
  B.   The Rhode Island Video Protection Act, R.I.G.L. §11-18-32       

  The plaintiff also brings a claim under the Rhode Island Video Protection Act, 
R.I.G.L. §11-18-32 (“RIVPRA”), which provides in relevant part that.      
  It shall be unlawful for any person                                  
            with the titles or nature of video films, records, cassettes, or the 
  like, which they purchased, leased, rented, or borrowed, from libraries, book 
  stores, video stores, or record and cassette shops or any retailer or distributor 
  of those products, whether or not the identities and listings are kept in a 
  remote  computing  service  or  electronic  storage  or  the  disclosure  is  made 
  through or by a remote computing service… (emphasis added).          

  Unlike the VPPA, under which “PII is not limited to information that explicitly 
names a person” and sets forth “a minimum, but not exclusive, definition of [PII],” 
   , 

820 F.3d at 486

, the RIVPRA specifically prohibits disclosure of “names and 
addresses.”  R.I.G.L. §11-18-32(a).  Here, the plaintiff does not allege that NFL 
Enterprises specifically disclosed his name and address and therefore his RIVPRA 
claims are dismissed.                                                     
                     IV.  CONCLUSION                                   
  For the foregoing reasons, NFL Enterprises’ Motion to Dismiss (ECF No. 17) 
is GRANTED on the plaintiff’s RIVPRA claim in its entirety (Count II) and any aspect 

of the VPPA claim (Count I) that is premised upon the consumption of live content.  
The Motion is DENIED as to the plaintiff’s VPPA claim concerning pre-recorded 
content.                                                                  

IT IS SO ORDERED.                                                         

_________________________________                                         
Mary S. McElroy                                                           
United States District Judge                                              

September 12, 2022