23-1147 Salazar v. NBA

In the United States Court of Appeals For the Second Circuit

August Term, 2023

(Argued: April 2, 2024 Decided: October 15, 2024)

Docket No. 23-1147

MICHAEL SALAZAR, INDIVIDUALLY AND ON BEHALF OF ALL OTHERS SIMILARLY SITUATED,

Plaintiff-Appellant,

–v.–

NATIONAL BASKETBALL ASSOCIATION,

Defendant-Appellee.

Before: RAGGI, LEE, and ROBINSON, Circuit Judges.

Plaintiff-Appellant Michael Salazar appeals from an August 8, 2023 judgment of the United States District Court for the Southern District of New York (Rochon, J.) dismissing his putative class action complaint against Defendant-Appellee the National Basketball Association (NBA) for alleged violations of the Video Privacy Protection Act (VPPA),

. The VPPA makes it unlawful for a “video tape service provider” to “knowingly disclose[], to any person, personally identifiable information concerning any consumer of such provider.”

(b)(1). The statute defines “consumer” to mean “any renter, purchaser, or subscriber of goods or services from a video tape service provider.”

§ 2710(a)(1). It does not define the terms “goods or services” and “subscriber.”

Salazar alleges that (1) he signed up for the NBA’s free online newsletter, meaning he exchanged information including his email address in return for periodic emails from the NBA; (2) he visited the NBA’s website, NBA.com, where he watched videos; and (3) the NBA violated the VPPA by knowingly disclosing, without Salazar’s permission, certain information about Salazar and the videos he watched.

We must answer two questions on appeal. First, has Salazar pled that he suffered a sufficiently “concrete” injury to confer Article III standing under TransUnion LLC v. Ramirez,

(2021)? Second, did the district court err in holding that Salazar is not a “subscriber of goods or services” based on its reasoning that the online newsletter is not an audiovisual “good or service,” and that signing up for the newsletter did not make Salazar a VPPA “subscriber”?

We answer both questions in the affirmative. Salazar’s alleged injuries are sufficiently concrete to confer Article III standing. And the district court erred by holding that Salazar is not a “subscriber of goods or services” from the NBA. Accordingly, we VACATE the district court’s judgment and REMAND for further proceedings.

JOSHUA I. HAMMACK (Michael L. Murphy, on the brief), Bailey & Glasser, LLP, Washington, D.C., for Plaintiff-Appellant.

MATTHEW X. ETCHEMENDY, Vinson & Elkins LLP, Washington, D.C. (Hilary L. Preston, Marisa Antonelli, Vinson & Elkins LLP, New York, NY, on the brief), for Defendant-Appellee.

Jordan L. Von Bokern, U.S. Chamber Litigation Center, Washington, D.C.; Adam G. Unikowsky, Jenner & Block LLP, Washington, D.C.; Allison N. 2 Douglis, Jenner & Block LLP, New York, NY, for Amicus Curiae The Chamber of Commerce of the United States of America, in Support of Defendant- Appellee.

ROBINSON, Circuit Judge:

The Video Privacy Protection Act (VPPA) makes it unlawful for a “video

tape service provider” to “knowingly disclose[], to any person, personally

identifiable information concerning any consumer of such provider.”

(b)(1). Enacted in 1988, the VPPA includes language like “video tape service

provider” and “prerecorded video cassette tapes”—terms that invoke a bygone

era of video technology. In this case, we must grapple with how the language of

this statute applies in today’s increasingly online world.

Plaintiff-Appellant Michael Salazar says he signed up for an online email

newsletter offered by Defendant-Appellee the National Basketball Association

(NBA). He further alleges he visited the NBA’s website, NBA.com, where he

watched videos. After he watched those videos, his video-watching history and

“Facebook ID” (we describe both below) were disclosed to Meta Platforms, Inc.

(Meta) without his permission. Those disclosures, Salazar contends, violated the

VPPA.

3 The central question in this appeal is whether Salazar is a “consumer” under

the VPPA so that the knowing disclosure by a video tape service provider of his

video viewing history violates that statute. The VPPA defines “consumer” to

mean “any renter, purchaser, or subscriber of goods or services from a video tape

service provider.”

§ 2710(a)(1). But the Act doesn’t define most of the words

within that definition, including “goods or services” and “subscriber.” We must

construe both these terms for the first time in this Circuit.

Salazar contends that when he signed up for the NBA’s online newsletter

through NBA.com, he exchanged personal information in return for emailed NBA-

related updates, thereby making him a “subscriber of goods or services,” and,

accordingly, a VPPA “consumer.” And by offering videos on NBA.com, the NBA

became a “video tape service provider” prohibited by the VPPA from disclosing

the personally identifiable information of consumers like Salazar. So, Salazar

submits, when he watched NBA.com videos, and when the NBA then disclosed

his Facebook ID and video-watching history to Meta without his consent, the NBA

violated the VPPA.

The NBA counters that Salazar is not a VPPA “consumer” because the

online newsletter he signed up for is not an audiovisual “good or service,” and

signing up for the newsletter did not in any event make him a “subscriber” under

4 the statute. It also asserts that Salazar has not pled a sufficiently “concrete” injury

to confer Article III standing under the standards set forth by the Supreme Court

in TransUnion LLC v. Ramirez,

(2021).

The United States District Court for the Southern District of New York

(Rochon, J.) dismissed Salazar’s suit in an August 8, 2023 judgment. Although it

concluded that Salazar had standing to sue, it ruled for the NBA on the merits,

holding that Salazar had not plausibly pled that he is a “consumer” under the

VPPA. The court held that the phrase “goods or services” within the VPPA’s

definition of “consumer” is limited to audiovisual “goods or services”—which the

online newsletter is not—and that signing up for an online newsletter did not

make Salazar a VPPA “subscriber.” See generally Salazar v. National Basketball

Association,

(S.D.N.Y. 2023).

As a threshold matter, we hold that Salazar has pled an injury that confers

Article III standing. His core alleged harm—that his personal information was

disclosed to a third party, without his consent, in violation of the VPPA—“has a

‘close relationship’ to a harm traditionally recognized as providing a basis for a

lawsuit in American courts”: public disclosure of private facts. TransUnion,

. Salazar’s injury therefore satisfies Article III standing’s concreteness

requirement.

5 On the merits, we hold that the district court erred in determining that

Salazar failed to plausibly plead that he is a “consumer” under the VPPA because

we conclude that he satisfactorily alleged he was a “subscriber of goods or

services” from the NBA. The VPPA’s text, structure, and purpose compel the

conclusion that that phrase is not limited to audiovisual “goods or services,” and

the NBA’s online newsletter falls within the plain meaning of that phrase. And by

trading personal information like his email and IP addresses in return for receiving

the online newsletter, Salazar became a “subscriber of” that newsletter.

Accordingly, we VACATE the district court’s judgment and REMAND for further

proceedings.

6 BACKGROUND 1

I. The NBA, NBA.com, the “Facebook Pixel,” and the NBA’s Online Newsletter

The NBA is a professional sports league headquartered in New York. It

owns the website NBA.com, on which people can watch “a broad selection of

video content.” Jt. App’x at 10. 2 The NBA says these videos are free.

Salazar doesn’t allege that he had to pay any money to watch the videos. But

he does plead that the NBA, using certain bits of code, extracts information from

NBA.com video-watchers like him.

The code most relevant to this case is a “tracking pixel”—a piece of code

embedded on a website someone visits. As its name suggests, a tracking pixel

tracks users as they navigate the website, reporting back to the pixel’s owner. The

information tracked depends on the tracking pixel’s configuration.

1Unless otherwise indicated, we draw this account from the allegations in Salazar’s Class Action Complaint. Since we are evaluating the NBA’s motion to dismiss for failure to state a claim, we presume these allegations to be true. See Ashcroft v. Iqbal,

(2009).

2 Salazar also alleges that people can watch these videos through a smartphone application (app). The district court concluded that Salazar “does not allege he downloaded any such application, or even specify what application he is referring to,” so “no such claim [based on use of the app] has been adequately pleaded.” Salazar v. National Basketball Association,

, 246 n.4 (S.D.N.Y. 2023). Beyond cursorily noting that the NBA delivers video content “[t]hrough NBA.com and an app,” Salazar doesn’t challenge that conclusion on appeal. Appellant’s Br. at 5. He therefore has abandoned any challenges based on the allegations concerning a smartphone application as opposed to a website. See United States v. Quiroz,

(2d Cir. 1994) (“It is well established that an argument not raised on appeal is deemed abandoned[.]” (internal quotation marks omitted)).

7 Here, Salazar alleges that Meta owns a tracking pixel, which we call the

“Facebook Pixel.” The NBA has installed the Facebook Pixel on NBA.com. Meta

coded that pixel to collect and send to it (1) the title of the NBA.com video a user

watched, (2) that video’s URL, and (3) the user’s “Facebook ID” (FID)—a number

unique to each individual Facebook account. Id. at 15. We call this disclosed

information “personal viewing information.”

By possessing the video title and URL of watched videos associated with a

given FID, Meta can link a given Facebook profile to those watched videos. And

with that information, Meta can send a user targeted advertisements. The NBA

receives financial renumeration from this arrangement.

The NBA also allows people to sign up for an “online newsletter.” Id. at 12.

Here too, Salazar doesn’t contend that he had to pay any money to sign up for the

newsletter. Instead, he alleges that he gave the NBA certain personal information,

and in return, the NBA sent him “emails and other communications.” Id. at 12, 19.

II. Salazar’s Allegations

Salazar’s VPPA claim rests on three primary allegations: (1) he has a

Facebook account; (2) he signed up for the NBA’s online newsletter; and (3) he

watched NBA.com videos while logged into his Facebook account.

8 First, since 2010, Salazar “has had a Facebook account.” Id. at 10, 20. He

therefore has an FID associated with that account.

Second, starting in 2022, Salazar “signed up for a digital subscription to

NBA.com.” Salazar, 685 F. Supp. 3d at 237; see also Jt. App’x at 10, 19–20. In doing

so, he gave NBA.com information including his email address, IP address, “and

any cookies associated with his device” in return for “emails and other

communications” from the NBA. Jt. App’x at 19.

An IP address is “the numeric address of a computer on the Internet” that

typically consists of “four parts separated by dots and containing up to three digits

in each part.” IP Address, Merriam-Webster’s Unabridged Dictionary,

https://unabridged.merriam-webster.com/unabridged/ip%20address

[https://perma.cc/8DK2-U6F9] (last visited Sept. 4, 2024). Salazar alleges that his

IP address “informs Defendant as to the city and zip code he resides in as well as

his physical location.” Jt. App’x at 19.

A “cookie” is “a small file or part of a file that is stored on the computer of

a World Wide Web user, that is created and subsequently read by a website server,

and that contains personal user information (such as a user identification code,

customized preferences, or a record of pages visited).” Cookie, Merriam-Webster’s

Unabridged Dictionary, https://unabridged.merriam-

9 webster.com/unabridged/cookie [https://perma.cc/GFE3-ALB9] (last visited Sept.

4, 2024).

There are presently no allegations in Salazar’s complaint that he watched or

accessed NBA.com videos through the online newsletter. He has, however,

submitted that he could amend his complaint to plausibly allege that “the NBA’s

online newsletter gave subscribers ‘exclusive content or enhanced access’ to video

content.” Appellant’s Br. at 34–35 (quoting Jt. App’x at 210).

Third, also starting in 2022, Salazar has watched NBA.com videos through

NBA.com “while logged into his Facebook account.” Jt. App’x at 10. Watching

videos while logged into his Facebook account caused his personal viewing

information to be transmitted to Meta. 3 See id. Salazar alleges that the NBA didn’t

give him notice that it was disclosing his personal viewing information; nor did it

ask for his consent.

Putting the pieces together, Salazar alleges that signing up for the online

newsletter made him a “subscriber of goods or services,” and, therefore, a

3 Salazar’s complaint specifies that when he watched NBA.com videos “while logged into his Facebook account,” his personal viewing information was disclosed to Meta due to the website’s use of the Facebook Pixel. Jt. App’x at 10, 15–16. For purposes of this appeal, we need not delve into the technical mechanics of that disclosure. It is enough to presume that what Salazar alleges is true—when he (1) was logged into his Facebook account and (2) watched a video on NBA.com, his personal viewing information was transmitted to Meta because the NBA had installed the Facebook Pixel on its website.

10 “consumer” under the VPPA. And watching videos on NBA.com caused his

“personally identifiable information”—his personal viewing information—to be

disclosed to Meta without his consent. So, Salazar says, the NBA violated the

VPPA.

III. District Court Proceedings

Salazar filed his putative class action complaint in September 2022,

purporting to represent “[a]ll persons in the United States with a digital

subscription to an online website owned and/or operated by [the NBA] that had

their Personal Viewing Information disclosed to [Meta] by [the NBA].” Id. at 20.

He raised a single cause of action: violation of the VPPA.

The NBA moved to dismiss pursuant to Federal Rules of Civil Procedure

12(b)(1) and 12(b)(6). It sought dismissal under Rule 12(b)(1) for lack of subject

matter jurisdiction because Salazar did not allege a sufficiently concrete injury to

confer Article III standing, and alternatively under Rule 12(b)(6) because Salazar

failed to state a claim upon which relief can be granted.

On the merits, the NBA primarily argued that Salazar was not a “consumer”

under the VPPA since he was not a “renter, purchaser, or subscriber of goods or

services from a video tape service provider.” Id. at 49 (quoting

(a)(1)). It stressed that the online newsletter was not an audiovisual good or

11 service, and thus did not qualify as “goods or services” under the VPPA. And it

argued that, in any event, signing up for the newsletter did not make him a VPPA

“subscriber.” The NBA also argued in the alternative that it did not “knowingly

disclose” any personally identifiable information to Meta. 4

In an August 2023 opinion, the district court denied the NBA’s motion to

dismiss for lack of standing but granted its motion to dismiss for failure to state a

claim. See Salazar, 685 F. Supp. 3d at 247.

With respect to Article III standing, the court explained that Salazar’s

alleged harm—deprivation of privacy rights based on the NBA’s non-consensual

disclosure of his personal viewing information—was closely related to two

4We express no view on whether the NBA’s disclosure, as alleged by Salazar, constitutes a “knowing[]” disclosure by the NBA.

(b)(1).

The NBA also argued in the alternative to the district court that Salazar had consented to disclosure of his personally identifiable information by assenting to the NBA’s privacy policy. Salazar concedes that NBA.com’s privacy policy states that it collects certain “Personal Information” from site visitors. But he contends that this policy doesn’t say that the NBA “will share digital subscribers’ private and protected Personal Viewing Information with third parties, including [Meta].” Jt. App’x at 14–15. As a result, he alleges, the NBA failed to satisfy the VPPA’s consent requirements. The NBA does not raise this argument on appeal and concedes the argument should be left for the district court to address in the first instance given that its resolution will require “detailed examination of the NBA’s Privacy Policy and Mr. Salazar’s factual allegations showing his acceptance of that policy.” Appellee’s Br. at 52 n.16. We agree.

The NBA also argued before the district court that it should dismiss Salazar’s class allegations because the NBA’s Terms of Use provision, to which it says Salazar agreed, includes an enforceable class action waiver. The NBA concedes here that this “argument is not an alternative basis for affirming the” court’s dismissal “of the entire complaint,” so “it is not properly resolved on this appeal.”

Accordingly, this argument is not before us in this appeal.

12 traditionally recognized common-law analogs: disclosure of private facts and

intrusion upon seclusion. See

at 239–42. Accordingly, the court held that

Salazar pled a concrete Article III injury under TransUnion.

.

On the merits, the court concluded that Salazar failed to plead a VPPA claim

because he had not plausibly alleged that he was a VPPA “consumer.”

.

It rejected Salazar’s argument that his signing up for the online newsletter made

him a “subscriber” under the VPPA, reasoning that “the VPPA only applies to

consumers (including subscribers) of audio video services.”

. The court

also rejected Salazar’s argument that the newsletter’s links to videos available on

NBA.com affect the calculus. It reasoned that the newsletter’s inclusion of links to

content otherwise “generally accessible on the NBA.com website” did not

constitute a sufficient exchange of value to create a subscriber relationship “given

the lack of allegations regarding exclusive content or enhanced access” to

audiovisual services through the newsletter.

at 245–46.

Because the court concluded that Salazar had not plausibly alleged that he

was a VPPA “consumer,” it did not address the NBA’s remaining arguments.

. It further denied Salazar’s “blanket request for leave to amend his

Complaint ‘to address any issues the Court raises in its Order’” since Salazar had

the opportunity to view the NBA’s arguments for dismissal and didn’t describe

13 the substance of a proposed amendment.

at 246–47. The court therefore

entered judgment dismissing the case, which Salazar timely appealed.

DISCUSSION

The NBA argues that the district court erred by concluding that Salazar has

Article III standing to sue. Salazar contends that the court erred on the merits by

holding that he is not a “consumer” as defined in the VPPA.

We hold that Salazar sufficiently pled that he has Article III standing and

that he is a “subscriber of goods or services from a video tape service provider”

and therefore a “consumer” under the VPPA.

(a)(1). We elaborate

below.

I. Standing

We start by evaluating whether Salazar has adequately pled injury as

necessary to demonstrate Article III standing to sue for a violation of the VPPA.

He has. Salazar’s alleged injury stems from the unauthorized disclosure of his

personal viewing information, which is closely related to at least one common-law

analog traditionally recognized as providing a basis for a lawsuit in American

courts: public disclosure of private facts.

Since “standing is challenged on the basis of the pleadings, we accept as true

all material allegations of the complaint,” which we construe “in favor of the

14 complaining party.” Bohnak v. Marsh & McLennan Companies, Inc.,

(2d Cir. 2023) (internal quotation marks omitted). We do so in this context without

deferring to the district court.

A federal court lacks subject matter jurisdiction—and therefore cannot

consider a lawsuit’s merits—unless three constitutional standing requirements are

met. First, the plaintiff must have suffered an “injury in fact that is concrete,

particularized, and actual or imminent.” TransUnion,

. Second, that

injury must be traceable to the defendant’s challenged conduct—it must have been

“likely caused by the defendant.”

And third, it must be likely that the injury

would “be redressed by judicial relief.”

As “[t]he party invoking federal

jurisdiction,” Salazar bears the burden of establishing Article III standing. Lujan

v. Defenders of Wildlife,

(1992).

The NBA argues that Salazar has not alleged that he has suffered a

“concrete” injury in fact. We disagree.

Article III standing requires that “[o]nly those plaintiffs who have been

concretely harmed by a defendant’s statutory violation may sue that private

defendant over that violation in federal court.” TransUnion,

; see also

Bohnak,

(explaining that “TransUnion is the touchstone for”

assessing the concreteness requirement). To allege a concrete harm, a plaintiff

15 must point to “a close historical or common-law analogue for their asserted

injury.” TransUnion,

. But they need not present an “exact

duplicate.”

. Rather, “what matters is ‘whether the alleged injury to the

plaintiff has a ‘close relationship’ to a harm ‘traditionally’ recognized as providing

a basis for a lawsuit in American courts.’” Packer on behalf of 1-800-Flowers.Com,

Inc. v. Raging Capital Management, LLC,

, 52 (2d Cir. 2024) (quoting

TransUnion,

).

Both tangible and intangible harms can satisfy the concreteness

requirement. “[T]raditional tangible harms” like physical and monetary harms

“readily qualify as concrete.” TransUnion,

. So do “[v]arious

intangible harms” closely related to a traditionally recognized harm.

One intangible harm that readily qualifies as concrete is the public

disclosure of private facts.

This “well-established common-law analog,”

Bohnak,

, is triggered when one “gives publicity to a matter

concerning the private life of another, . . . if the matter publicized is of a kind that

16 (a) would be highly offensive to a reasonable person, and (b) is not of legitimate

concern to the public,”

(quoting Restatement (Second) Torts § 652D). 5

Our conclusion that Salazar has pled that he suffered an injury closely

related to the public disclosure of private facts analog is guided by our recent

decision in Bohnak. There, Bohnak had sued her former employer for failing to

adequately protect and warn her about the vulnerability of personal information

including her social security number, driver’s license, and passport information.

That information was stolen when her employer was targeted in a data breach. Id.

at 280–82.

We had “no trouble” concluding that “Bohnak’s alleged harm [wa]s

sufficiently concrete to support her claims for damages” because her core alleged

injury—exposure of her personally identifiable information to unauthorized third

parties—“bears some relationship to a well-established common-law analog:

public disclosure of private facts.” Id. at 285. In reaching this conclusion, we

stressed that “[i]n TransUnion itself, the Supreme Court specifically recognized

5Because we hold that Salazar’s alleged harm is closely related to the public disclosure of private facts analog, we need not examine whether it is closely related to the other analog the district court identifies: the “intrusion upon seclusion” tort. Cf. Eichenberger v. ESPN, Inc.,

, 983–84 (9th Cir. 2017) (holding, pre-TransUnion, that an alleged VPPA violation was related to the intrusion upon seclusion tort); Perry v. Cable News Network, Inc.,

, 1340–41 (11th Cir. 2017) (same).

17 that ‘disclosure of private information’ was an intangible harm ‘traditionally

recognized as providing a basis for lawsuits in American courts.’”

at 286

(quoting TransUnion,

). And because Bohnak’s alleged harm was

closely related to a common-law analog, it did not matter whether she had

“assert[ed] a common law claim for public disclosure of private facts” against her

employer or whether the relevant “common law recognize[d] a tort relating to

publication of private facts.” Id. at 286.

For these reasons, we similarly have “no trouble” holding here that Salazar’s

alleged harm is sufficiently concrete to withstand dismissal. Id. at 285. Like

Bohnak, Salazar’s core allegation is that his personally identifiable information

was exposed to an unauthorized third party. Jt. App’x at 24. And Salazar doesn’t

just allege that his data was exposed to a third party; rather, he asserts that it was

disclosed as a result of an arrangement between the NBA and Meta pursuant to

which the NBA deliberately uses the Facebook Pixel. This alleged harm is closely

related to the public disclosure of private facts analog.

The NBA’s arguments to the contrary are unpersuasive. To the NBA, the

disclosure in Bohnak—to hackers through a data breach—is quite different from

“limited disclosures to a single legitimate business” like Meta because hackers

have a “known penchant for trading illegally acquired [personally identifiable

18 information] ‘through the dark web,’” thereby making the disclosure in Bohnak

more analogous to a public disclosure of private facts than the disclosure of

Salazar’s information to Meta. Appellee’s Br. at 24 n.7 (quoting Bohnak,

).

Based on this asserted lack of publicity, the NBA insists that Salazar’s

allegations of injury are more like those held insufficient in cases from other

circuits involving mail vendor corporations and a different statute: the Fair Debt

Collection Practices Act (FDCPA). In those cases, plaintiffs sued debt collection

agencies for violating the FDCPA by giving their personal information to mail

vendors, which then used the disclosed information to send the plaintiffs

prewritten letters notifying them about their outstanding debts. See Appellee’s Br.

at 21–25 (citing Hunstein v. Preferred Collection & Management Services, Inc.,

(11th Cir. 2022) (en banc); Shields v. Professional Bureau of Collections of

Maryland, Inc.,

(10th Cir. 2022); Nabozny v. Optio Solutions LLC,

(7th Cir. 2023). 6 These courts concluded that any harm from such

6The NBA also cites some of these cases to suggest that an alleged harm isn’t closely related to a common-law analog if the plaintiff doesn’t plead a required element of that analog. See, e.g., Hunstein v. Preferred Collection and Management Services, Inc.,

(11th Cir. 2022)

19 limited disclosures—to mail vendors who then sent the information back to its

owner—was not closely related to harm from the public disclosure of private facts

analog. See Hunstein, 48 F.4th at 1245–49; Shields, 55 F.4th at 828–29; Nabozny, 84

F.4th at 735–38.

(en banc) (holding that Hunstein’s alleged harm wasn’t closely related to the public disclosure of private facts tort because his allegations were “missing an element essential to liability”: “disclosure to the public”) (internal quotation marks omitted). Not every circuit has adopted that approach. See, e.g., Shields v. Professional Bureau of Collections of Maryland, Inc.,

(10th Cir. 2022) (“Shields did not have to plead and prove the tort’s elements to prevail. But to proceed, she had to at least allege a similar harm.”); Barclift v. Keystone Credit Services, LLC,

(3d Cir. 2024) (“We believe that if the Court wanted us to compare elements, it would have simply said so. So when asking whether a plaintiff’s intangible injury is ‘concrete,’ we will examine the kind of harm at issue.”), petition for cert. filed, No. 23-1327 (June 20, 2024).

Nor have we. This Court has applied TransUnion in at least four published opinions to determine whether an alleged harm satisfies Article III standing’s concreteness requirement. We did not, in any of those cases, hold that TransUnion demands that a plaintiff adequately plead every element of a common-law analog to satisfy the concreteness requirement. See Maddox v. Bank of New York Mellon Trust Company, N.A.,

, 62–66 (2d Cir. 2021); Bohnak v. Marsh & McLennan Companies, Inc.,

, 283–87 (2d Cir. 2023); Saba Capital Cef Opportunities 1, Ltd. v. Nuveen Floating Rate Income Fund,

, 114–17 (2d Cir. 2023); Packer on behalf of 1-800 Flowers.Com, Inc. v. Raging Capital Management, LLC,

, 51–56 (2d Cir. 2024); see also Stafford v. International Business Machines Corporation,

, 67–69 (2d Cir. 2023) (applying TransUnion to the mootness doctrine, which “is standing set in a time frame”) (internal quotation marks omitted). Instead, we followed the Supreme Court’s directive in TransUnion that the concrete injury requirement for standing does not demand that a plaintiff alleging intangible harm identify and establish an “exact duplicate” in common law, but asks “whether a plaintiff’s asserted harm has a ‘close relationship’ to a harm traditionally recognized as providing a basis for a lawsuit in American courts.” TransUnion LLC v. Ramirez,

, 433–34 (2021) (stating that “publication is essential to liability” in explaining why “mere presence of an inaccuracy in an internal credit file” that was not disclosed to third-party was not analogous to harm from defamatory statement, without suggesting that plaintiff must satisfy all elements of defamation to show “close relationship” to defamation analog (internal quotation marks omitted)); see

(holding dissemination of misleading credit reports is analogous to harm from defamation even though defendant asserted reports were “only misleading and not literally false,” because harm from misleading statement of “being labeled a ‘potential terrorist’ . . . bears a sufficiently close relationship to the harm from a false and defamatory statement”).

20 Glossing over the numerous factual and legal distinctions between the mail

vendor cases and Salazar’s allegations, the NBA submits that the mail vendor

“cases are on all fours” with this one because they all involve “limited disclosures

to a single legitimate business.” Appellee’s Br. at 23, 24 n.7. The analogy is inapt.

Meta isn’t a “ministerial intermediary” like a mail vendor, Nabozny, 84 F.4th at

736—it’s one of the world’s largest companies, employing more than 67,000

people, with 2024 revenues exceeding $142 billion, see Forbes, Profile, Meta

Platforms, https://www.forbes.com/companies/meta-platforms/?list=global2000

[https://perma.cc/8S94-9M7A] (last visited Sept. 4, 2024).

More to the point, Meta’s use of the disclosed data is very different from

that of the mail vendor. Unlike in the mail vendor cases, Salazar doesn’t allege

that his personal viewing information was disclosed to an intermediary so that it

could be bounced back to him on behalf of the entity that properly possessed the

information. One of Salazar’s allegations is that the NBA discloses users’ personal

viewing information to Meta, which then harnesses that information “to show the

user targeted ads”—ads that Meta chooses for its own commercial purposes, not

the NBA’s or the user’s purposes. Jt. App’x at 15 (emphasis added). Moreover,

nothing in the complaint suggests that Meta can’t sell, disclose, or otherwise use

Salazar’s data for additional purposes. In addition, Salazar alleges that Meta

21 “cross-referenc[es]” “this highly sought-after information” “to the data it already

has in [its] own detailed profiles.”

at 16–17. And the information is being used

for digital advertising,

at 15–16, an industry that “underlies many of the

Internet’s most widely used services,” Brief of the Chamber of Commerce of the

United States of America as Amicus Curiae in Support of Defendant-Appellee at 15.

Given the nature of the companies involved, intended and potential uses of

the disclosed information, and resulting enhanced disclosure risks, we see little

daylight between the nature of the harm Salazar alleges and the harm flowing

from the public disclosure of private facts common-law analog. Therefore, Salazar

has satisfactorily pled a concrete injury sufficient to confer Article III standing and

to withstand dismissal under Rule 12(b)(1).

The NBA does not argue that Salazar has otherwise failed to plead that his

alleged injury satisfies Article III standing requirements at the motion to dismiss

stage. That makes sense. His alleged injury in fact is particularized and actual—

his personal viewing information was disclosed without his consent to a third

party. That alleged harm is traceable to the NBA’s installation of the Facebook

Pixel on NBA.com. And Salazar’s requested relief—declaratory, injunctive, and

monetary relief for violating the VPPA—would likely redress his injury.

Accordingly, Salazar has alleged a sufficient harm to confer Article III standing,

22 and the district court correctly denied the NBA’s motion to dismiss for lack of

subject matter jurisdiction.

II. Merits

To survive Rule 12(b)(6) dismissal, a complaint’s factual allegations must

“state a claim to relief that is plausible on its face.” Bell Atlantic Corp. v. Twombly,

(2007). On appeal, we review the complaint without deference

to the district court’s assessment, accepting as true all its factual allegations and

drawing all inferences in the plaintiff’s favor. See Nicosia v. Amazon.com, Inc.,

(2d Cir. 2016); Peretti v. Authentic Brands Group LLC,

(2d Cir. 2022). That means the plaintiff’s allegations must enable the court to

reasonably infer that the defendant is liable for the alleged misconduct. Ashcroft

v. Iqbal,

(2009).

Applying these standards, we must determine whether Salazar plausibly

pled that he was a “subscriber of goods or services” as understood in the VPPA.

For the reasons set forth below, we conclude that he did. The phrase “goods or

services” in the VPPA is not cabined to audiovisual goods or services, but also

reaches the NBA’s online newsletter. By alleging that he exchanged personal

information in return for periodically receiving the online newsletter, Salazar

plausibly pled that he is a “subscriber of” that newsletter.

23 A. The VPPA

In 1987, a newspaper published an article called The Bork Tapes, see Michael

Doland, The Bork Tapes, Washington City Paper (Sept. 25, 1987), which identified

146 films that Judge Robert Bork and his family had rented from a video store. At

the time of publication, the Senate Judiciary Committee was holding hearings on

Judge Bork’s nomination to the Supreme Court. See S. Rep. No. 100-599, at 5 (1988);

Ellis v. Cartoon Network, Inc.,

, 1252–53 (11th Cir. 2015); Yershov v.

Gannett Satellite Information Network, Inc.,

(1st Cir. 2016).

Senators quickly decried the publication. As Senator Patrick Leahy

commented during the nomination hearings:

It is nobody’s business what Oliver North or Robert Bork or Griffin Bell or Pat Leahy watch on television or read or think about when they are home. . . . In an era of interactive television cables, the growth of computer checking and check-out counters, of security systems and telephones, all lodged together in computers, it would be relatively easy at some point to give a profile of a person and tell what they buy in a store, what kind of food they like, what sort of television programs they watch, who are some of the people they telephone. . . . I think that is wrong. I think that really is Big Brother, and I think it is something that we have to guard against. . . .

Privacy is not a conservative or a liberal or moderate issue. It is an issue that goes to the deepest yearnings of all Americans that we are free and we

24 cherish our freedom and we want our freedom. We want to be left alone.

S. Rep. No. 100-599, at 5–6 (quoting Hearings on Nomination of Robert H. Bork to be

Associate Justice of the Supreme Court of the United States Before the Senate Committee

on the Judiciary, 100th Cong. 1374 (1987)) (alterations adopted).

The Bork Tapes was the catalyst for the VPPA. See id. at 5; S. Rep. No. 112-

258, at 2 (2012); Ellis, 803 F.3d at 1252–53. A bipartisan group of Senators, including

Senator Leahy, introduced legislation in May 1988 “to preserve personal privacy

with respect to the rental, purchase, or delivery of video tapes or similar audio

visual materials.” S. 2361, 100th Cong. (1988); see also S. Rep. No. 100-599, at 1

(same). That bill became the VPPA. See Video Privacy Protection Act of 1988,

Stat. 3195.

The VPPA prohibits a “video tape service provider” from “knowingly

disclos[ing], to any person, personally identifiable information concerning any

consumer of such provider,” subject to certain enumerated exceptions, such as in

cases where the provider has obtained a consumer’s “informed, written consent.”

(b). The Act thereby “reflects the central principle of the Privacy

Act of 1974: that information collected for one purpose may not be used for a

different purpose without the individual’s consent.” S. Rep. No. 100-599, at 8.

25 By 2012, Congress recognized that “the Internet ha[d] revolutionized the

way that American consumers rent and watch movies and television programs,”

such that the way “Americans used to watch videos in 1998—the VHS cassette

tape—[wa]s now obsolete.” S. Rep. 112-258, at 2. These new technologies had

created a problem: Americans couldn’t “share information about their video

preferences on social media sites on an ongoing basis” without violating the 1988

VPPA, which required obtaining consent from the consumer for each disclosure

of viewing information.

at 2–3. The solution? Amend the statute “to clarify

that a video tape service provider may obtain a consumer’s informed, written

consent on an ongoing basis and that consent may be obtained through the

Internet.” Video Privacy Protection Act Amendments Act of 2012,

Stat. 2414; see

(b)(2)(B) (authorizing a video tape service

provider to disclose consumers’ personally identifiable information “to any

person with the informed, written consent (including through an electronic means

using the Internet) of the consumer” provided either “at the time the disclosure is

sought” or “in advance for a set period of time, not to exceed 2 years or until

consent is withdrawn by the consumer, whichever is sooner”).

Otherwise, much of the 1988 VPPA’s text remains unchanged. Like the

original version, the current VPPA holds liable “[a] video tape service provider

26 who knowingly discloses, to any person, personally identifiable information

concerning any consumer of such provider.”

(b)(1). And the Act

provides consumers with a private right of action for violations of the statute.

§ 2710(c) (authorizing award of “actual damages but not less than liquidated

damages in an amount of $2,500,” punitive damages, reasonable attorneys’ fees

and litigation costs, and appropriate “preliminary and equitable relief”).

Central to this case is the VPPA’s “Definitions” section. See id. § 2710(a).

The VPPA defines the term “consumer” to mean “any renter, purchaser, or

subscriber of goods or services from a video tape service provider.” Id.

§ 2710(a)(1). But the phrase “subscriber of goods or services” is not explicitly

defined in the statute. Our task here is to construe that phrase. The parties have

focused their arguments on two questions: Is the digital newsletter a “good or

service”? And is Salazar a subscriber? We consider each in turn.

B. “Goods or Services”

The parties contest whether the online newsletter Salazar signed up for

qualifies as “goods or services” as that phrase is used in the VPPA. The NBA

doesn’t contend that the newsletter is not a good or service generally; rather, it

insists that statutory context compels the conclusion that a consumer under the

VPPA must specifically rent, purchase, or subscribe to audiovisual “goods or

27 services.” The NBA reasons that because the VPPA defines a “consumer” as one

who rents, purchases, or subscribes to services “from a video tape service provider,”

id. at § 2710(a)(1) (emphasis added), those services must, by definition, be

audiovisual services. Salazar disagrees and argues that nothing in the statute

limits the definition of “consumer” to those who rent, purchase, or subscribe to a

particular class of services—namely, audiovisual content.

Considering the text, structure, and purpose of the VPAA, we agree with

Salazar. And we conclude that the NBA’s policy based counterarguments are

unpersuasive.

i. Text, Structure and Purpose

When interpreting a statutory provision, we start with the text. See

Wisconsin Central Limited v. United States,

(2018). Because the

VPPA does not define the phrase “goods or services,” we presume that its plain

meaning applies. See Perrin v. United States,

(1979) (“A fundamental

canon of statutory construction is that, unless otherwise defined, words will be

interpreted as taking their ordinary, contemporary, common meaning.”). In

assessing the words’ plain meaning, we consider “the language itself, the specific

context in which that language is used, and the broader context of the statute as a

whole.” Robinson v. Shell Oil Co.,

(1997). Applying this guidance,

28 we conclude that the plain language of the “consumer” definition, the VPAA’s

terminology in other sections, and the structure of the statute as a whole support

Salazar’s view. And his read is entirely consistent with the statute’s purpose.

Congress defined “consumer” as “any renter, purchaser, or subscriber of

goods or services from a video tape service provider.”

(a)(1)

(emphasis added). “[R]ead naturally, the word ‘any’ has an expansive meaning.”

Ali v. Federal Bureau of Prisons,

(2008) (internal quotation marks

omitted). And a statute’s use of the word “‘or’ is ‘almost always disjunctive.’”

Encino Motorcars, LLC v. Navarro,

(2018) (quoting United States v.

Woods,

(2013)). So by using expansive words like “any” and “or,”

Congress codified a “consumer” definition that “bespeaks breadth.”

Comparing this language to other definitions in the statute reinforces this

conclusion. Congress deployed similarly broad language in the “video tape

service provider” definition. That definition classifies “any person, engaged in the

business, in or affecting interstate or foreign commerce, of rental, sale, or delivery

of prerecorded video cassette tapes or similar audio visual materials” as a “video

tape service provider.”

(a)(4) (emphasis added). But while the

“consumer” and “video tape service provider” definitions share similarly

expansive language, there is also a critical distinction between the two provisions:

29 Unlike the “consumer” definition, which makes no mention of audiovisual

materials, the “video tape service provider” definition requires the provider to

deal in “audio visual materials.”

This meaningful variation shows that

Congress knew to include an audiovisual limitation in the VPPA when it wanted

one to apply. In fact, Congress twice deploys the term “audio visual material” (or

materials) in the VPAA—first in the “video tape service provider” definition, and

next in a provision establishing when a video tape service provider may lawfully

disclose personally identifiable information. See

§ 2710(a)(4), (b)(2)(D)(ii). 7 As

the Supreme Court has instructed, we should not “lightly assume that Congress

has omitted from its adopted text requirements that it nonetheless intends to

apply,” especially when it “has shown elsewhere in the same statute that it knows

how to make such a requirement manifest.” Jama v. Immigration and Customs

Enforcement,

(2005); see also Yale New Haven Hospital v. Becerra,

(2d Cir. 2022) (explaining principle of meaningful variation, i.e., “where

a statutory scheme has used one term in one place, and a materially different term

in another, the presumption is that the different term denotes a different idea”

7 In the “video tape service provider” definition, the relevant text is plural: “audio visual materials.”

(a)(4). In the provision enumerating when a video tape service provider may lawfully disclose personally identifiable information, the language is singular: “audio visual material.”

§ 2710(b)(2)(D)(ii).

30 (quoting Southwest Airlines Co. v. Saxon,

(2022)) (alterations

adopted)).

This textual divergence highlights the flaw in the NBA’s argument that the

“consumer” and “video tape service provider” definitions share “a suggestively

parallel structure” that supports reading an audiovisual limitation into the

definition of “goods or services.” Appellee’s Br. at 31. To the NBA, the phrase

“renter, purchaser, or subscriber” in the “consumer” definition is parallel to the

“rental, sale, or delivery” language in the “video tape service provider” definition.

That means, the NBA says, the term “goods or services” must be parallel to

“prerecorded video cassette tapes or similar audio visual materials,” with a

similarly cabined scope. Compare

(a)(1), with

§ 2710(a)(4).

We need not decide whether the phrase “renter, purchaser, or subscriber”

in the definition of “consumer” is intended to mirror the phrase “rental, sale or

delivery” in the definition of “video tape service provider.” 8 Even if that were

correct, it would not support the NBA’s conclusion that the term “goods or

8Salazar actually relies on the same parallelism to make a different argument—one we also need not reach. He argues that “renter” in the definition of “consumer” mirrors “rental” in the definition of “video tape service provider,” and “purchaser” mirrors “sale,” so “subscriber” must mirror “delivery.” Following this logic, a “subscriber” is someone who receives goods or services. Under that interpretation, someone who simply watches online videos could be considered a VPPA “consumer.”

31 services” in the definition of “consumer” mirrors the term “prerecorded video

cassette tapes or similar audio visual materials” in the “video tape service

provider” definition. Tellingly, Congress chose to deviate from any parallelism by

using the terms “goods or services” in the “consumer” definition and

“prerecorded video cassette tapes or similar audio-visual materials” in the “video

tape service provider” definition. Again, Congress’s decision to use different

words in different definitions strongly signals its intent to convey different

meanings. See Jama,

.

In addition, the NBA’s interpretation is hard to harmonize with other

language in the statute. The definition of “personally identifiable information”

includes “information which identifies a person as having requested or obtained

specific video materials or services from a video tape service provider.”

§ 2710(a)(4) (emphasis added). But if “goods or services” are, by definition,

audiovisual materials, then Congress’s express restriction in the definition of

“personally identifiable information” to information about “video materials or

services” would be superfluous. See generally Corley v. United States,

(2009) (holding that a “statute should be construed . . . so that no part will be

inoperative or superfluous” (internal quotation marks omitted)).

32 We are likewise unpersuaded by the NBA’s reliance on the title of the

VPAA’s liability provision: “Video Tape Rental and Sale Records.”

(b). The NBA argues that by explicitly tying “video” to “rental and sale

records” in that title, Congress showed that the relationship between consumers

and providers is restricted to those who rent, purchase, or subscribe to videos.

There are at least two problems with this argument. First, headings and

titles in statutes “cannot limit the plain meaning of the text.” Rajah v. Mukasey,

(2d Cir. 2008) (internal quotation marks omitted). Second, the title of

the liability provision tells us little about the meaning of “consumer” in the VPPA.

The parties agree that sharing information that is not about video materials or

services is beyond the scope of the statute. But as explained further below, it’s the

definition of “personally identifiable information” that limits what can be shared,

not the definition of “consumer.”

Nor are we persuaded by the NBA’s argument that the phrase “from a video

tape service provider” somehow cabins “goods or services” to audiovisual goods

or services.” The definition of “video tape service provider” is broad,

encompassing “any person[] engaged in the business . . . of rental, sale, or delivery of

prerecorded video cassette tapes or similar audio visual materials.”

(a)(4) (emphasis added). That definition is not limited to entities that deal

33 exclusively in audiovisual content; rather, audiovisual content need only be part of

the provider’s book of business.

(a)(4). Thus, by its plain terms,

the statute applies equally to a business dealing primarily in audiovisual materials

(think Blockbuster) and one dealing in primarily non-audiovisual materials (think

a general store that rents out a few movies). Congress cast a wide net in defining

“video tape service provider,” to ensure that businesses dealing in audiovisual

goods or services satisfy the definition even if they also deal in non-audiovisual

goods or services.9

Given that “video tape service provider” is defined broadly to include even

those businesses that dabble in video rentals, it makes sense that “consumer”

should be understood to encompass a renter, purchaser, or subscriber of any of the

provider’s “goods or services”—audiovisual or not. Under the VPPA’s expansive

language, such a business may not disclose “personally identifiable information”

pertaining to its consumers regardless of the particular goods or services rented,

purchased, or subscribed to.

This is not to say the VPPA’s reach is boundless. As noted above, the statute

only prohibits video tape service providers from “knowingly disclos[ing]

9We express no view on whether the VPPA applies only to businesses dealing in “prerecorded” audiovisual goods or services as opposed to “live” video services, an issue not presented in this appeal.

34 personally identifiable information.”

(b)(1) (emphasis added). And

the “personally identifiable information” definition “includes information which

identifies a person as having requested or obtained specific video materials or

services from a video tape service provider.”

§ 2710(a)(3) (emphasis added).

That means the general store owner who also rented out a few movies wouldn’t

be liable under the VPPA for disclosing particular customers’ bread-buying habits;

that information, which does not relate to video materials or services, is not

“personally identifiable information” under the VPAA. 10

Our read of the statute not only reflects the language and structure of the

VPAA; it’s also “consistent with Congress’s intended purpose.” Bustamante v.

Napolitano,

(2d Cir. 2009). As we explained above, Senate

10True, the “personally identifiable information” definition uses the word “include.” Some of the legislative history suggests that Congress intentionally used that word to help keep the “personally identifiable information” term broad, too. See S. Rep. No. 100-599, at 12 (1988) (“[P]aragraph (a)(3) uses the word ‘includes’ to establish a minimum, but not exclusive, definition of personally identifiable information.”) But that Senate report also stresses that the VPPA’s definition of “personally identifiable information” contains the word “video” to make clear that only audiovisual information is protected. See

(“[T]he definition of personally identifiable information includes the term ‘video’ to make clear that simply because a business is engaged in the sale or rental of video materials or services does not mean that all of its products or services are within the scope of the bill. For example, a department store that sells video tapes would be required to extend privacy protection to only those transactions involving the purchase of video tapes and not other products.”). So while there may be breathing room in the statute to explore what exactly is “personally identifiable information”—we need not and do not explore that argument in this appeal—the VPPA’s text, structure and purpose make clear that the disclosed information must still be related to audiovisual materials or services.

35 Judiciary Committee members understood the VPPA to “prohibit[] video service

providers from disclosing personally identifiable information except in certain,

limited circumstances.” S. Rep. No. 100-599, at 5; see also S. Rep. No. 112-258, at 2

(same). Grafting unstated limitations on the broad definition of “consumer,” and

by extension, “goods or services,” would be inconsistent with Congress’s purpose

here.

ii. NBA’s Policy Arguments

Given the clear meaning of the VPPA evidenced by its statutory text and

context, we are unpersuaded by the NBA’s policy arguments for a different

construction. The NBA insists that failing to cabin “goods or services” to

audiovisual goods or services would produce anomalous results. It contends that

under a broad construction of the term, someone who just watches a video on a

website “with no other relationship to the company would not receive VPPA

privacy protections vis-à-vis their viewing of these videos, because they have no

‘renter,’ ‘purchaser,’ or ‘subscriber’ relationship to the company,” but someone

who “previously and unrelatedly bought a hammer at one of the company’s brick-

and-mortar stores, and then watched a free video on the website” would be a VPPA

consumer. Appellee’s Br. at 40. To the NBA, it makes no sense that the VPPA can

be triggered by a consumer interaction unrelated to videos.

36 Even presuming that merely watching a free video—and giving up personal

information in the process—does not make someone a VPPA “consumer,” 11 the

purportedly anomalous results identified by the NBA do not justify artificially

cabining the statute’s scope in a way that is inconsistent with its plain meaning

and purpose.

For starters, the statute’s express terms control. See Bostock v. Clayton County,

Georgia,

(2020) (“When the express terms of a statute give us one

answer and extratextual considerations suggest another, it’s no contest. Only the

written word is the law, and all persons are entitled to its benefit.”); Pennsylvania

Department of Corrections v. Yeskey,

(1998) (“[T]he fact that a statute

can be applied in situations not expressly anticipated by Congress does not

demonstrate ambiguity. It demonstrates breadth.” (internal quotation marks

omitted)).

We’re also unconvinced that broadly defining “goods or services” produces

anomalous results. Take the NBA’s hypothetical: a consumer buys a hammer, then

watches free videos on the vendor’s website. The NBA suggests that it is

11Salazar does not contend that, independent of his registering for the newsletter, simply watching videos on NBA.com—thereby intentionally or unintentionally providing his personal viewing information to the NBA—makes him a “renter, purchaser, or subscriber of goods or services from a video tape service provider.” We therefore express no view on this question.

37 anomalous that this consumer is subject to privacy protections under the VPPA.

But considering the privacy protective goals of the VPPA with respect to

individuals’ video viewing information, this scenario does not strike us as

anomalous. Especially given the broad definition of consumer in the VPPA,

allowing disclosure of the consumer’s video viewing information would be out of

sync with the statute’s goals.

To summarize: The phrase “goods or services” in the VPPA’s definition of

“consumer” is not cabined to only audiovisual “goods or services.” The NBA’s

online newsletter therefore is a qualifying good or service.

C. “Subscriber”

Even if the NBA digital newsletter is a “good or service,” we still must

decide whether Salazar is a subscriber of that good or service such that he is a

“consumer” within the VPPA. Salazar alleges that he “became a digital subscriber

of NBA.com by providing, among other information, email address and IP

address, . . . and any cookies associated with his device.” Jt. App’x at 19. The NBA

38 contends these actions do not signify a sufficient relationship between Salazar and

the NBA, and therefore don’t make Salazar a “subscriber” under the VPPA. 12

Two other circuits have tackled this question. In Ellis, the Eleventh Circuit

confronted a case in which a plaintiff downloaded an Android application to

watch video clips.

. Although the plaintiff didn’t pay any money,

the application recorded and shared his device-unique “Android ID” and video-

viewing information with a third-party data analytics company.

The Eleventh

Circuit held that “payment is not a necessary element of subscription,” but

“‘subscription’ involves some type of commitment, relationship, or association

(financial or otherwise) between a person and an entity,” which “involve[s] either

payment, registration, commitment, delivery, . . . or access to restricted content.”

(internal quotation marks omitted). That plaintiff, however, had not

made any payments, an account, or a profile; “provide[d] any personal

information”; “sign[ed] up for any periodic services or transmissions”; or

12Salazar insists that “everyone agrees Mr. Salazar subscribes to the NBA’s newsletter.” Reply Br. at 3; see also Appellant’s Br. at 17 n.3 (arguing that “this appeal does not concern the meaning” of the “subscriber” term). We disagree. The NBA concedes only that Salazar himself alleges “he signed up for a free NBA email newsletter.” Appellee’s Br. at 3. It also argued before the district court that Salazar’s allegations “at most” supported an argument that he subscribed to the online newsletter, which the NBA contended was not an audiovisual good or service. See

at 11 (quoting Jt. App’x at 50). We don’t read the NBA’s alternative argument as a concession that signing up for that newsletter made Salazar a “subscriber” of that newsletter as understood under the VPPA.

39 otherwise “ma[d]e any commitment or establish[ed] any relationship that would

allow him to have access to exclusive or restricted content.”

. All he did

was download a free app and use it to view content. So, the court concluded, he

was not a VPPA “subscriber.”

.

The First Circuit faced a similar set of facts in Yershov. There, someone also

downloaded an app in order to, among other things, watch videos.

. Each time the plaintiff used the app to watch videos, the video’s title, his

device’s GPS coordinates, and his device’s unique Android ID were sent to a third-

party data analytics company, which used the information for, among other

things, targeted advertising.

at 484–85. The First Circuit agreed with the

Eleventh Circuit that someone does not have to pay money to be a VPPA

subscriber.

at 487–88. But unlike the Eleventh Circuit, the First Circuit held

that the Yershov plaintiff was a VPPA subscriber.

. It explained:

To use the App, Yershov did indeed have to provide Gannett with personal information, such as his Android ID and his mobile device’s GPS location at the time he viewed a video, each linked to his viewing selections. While he paid no money, access was not free of a commitment to provide consideration in the form of that information, which was of value to Gannett. And by installing the App on his phone, thereby establishing seamless access to an electronic version of USA Today, Yershov established a relationship with Gannett that is materially different from what would have been the case had USA Today simply remained one of millions of sites 40 on the web that Yershov might have accessed through a web browser.

.

We agree with both the Eleventh and First Circuits that someone doesn’t

have to spend money to be a VPPA “subscriber.” Otherwise, the term “subscriber”

would be rendered superfluous by the terms “purchaser” and “renter” in the

definition of “consumer.” Someone in 1988 (or 2012, for that matter) who paid

money for permanent access to audiovisual material would be a “purchaser,” and

someone who exchanged money for temporary access would be a “renter.” If the

payment of money was an essential condition of being a “subscriber,” then anyone

who was a “subscriber” would also be either a “renter” or “purchaser.” See

at

487–88. 13

It’s also easy to imagine subscriptions that don’t require monetary payment.

Someone can, for example, subscribe to a YouTube channel by signing into a

YouTube account (which requires no monetary payment) and clicking the

“subscribe” icon on a content creator’s channel. YouTube Help, Subscribe to

YouTube channels, https://support.google.com/youtube/answer/4489286

13Although some dictionary definitions in circulation around the time the VPPA was enacted, and later amended, suggest that a someone must pay money to be a subscriber, other definitions don’t. See, e.g., Yershov,

(comparing dictionary definitions).

41 [https://perma.cc/RM2E-FMX8] (last visited Sept. 4, 2024). Subscribing causes

YouTube to “automatically send . . . notifications about the highlights from that

channel.”

These types of subscriptions aren’t only a feature of the modern internet. As

the First Circuit explained, they existed in the 1980s through “the reasonably

common retailing practice of introductory enticements”:

Suppose a customer in 1988 obtained several videos from a new commercial supplier at no charge, or with money back. We can discern no reason why Congress would have wanted different disclosure rules to apply to those transactions than to ones where a monetary payment is made. And because we think that Congress cast such a broadly inclusive net in the brick-and-mortar world, we see no reason to construe its words as casting a less inclusive net in the electronic world when the language does not compel that we do so. See Barr v. United States,

(1945) (“[I]f Congress has made a choice of language which fairly brings a given situation within a statute, it is unimportant that the particular application may not have been contemplated by the legislators.”).

Yershov,

.

Here, although Salazar does not allege that he paid the NBA money, he does

allege that he provided the NBA with his personal information when he signed up

for the newsletter. In return for receiving periodic NBA-related updates, Salazar

exchanged, at a minimum, (1) his email address, (2) his IP address, and (3) cookies

associated with his device. He further alleges that through his IP address, the NBA

42 can identify “the city and zip code he resides in as well as his physical location.”

Jt. App’x at 19.

That information is not insignificant. By receiving it, the NBA learned how

to directly reach out to Salazar. It discovered where his device was. It gained

access to additional information stored in any cookies on his device. These tools

increased the NBA’s potential to urge Salazar to visit NBA.com and watch videos

on it, making the NBA’s relationship with him distinct from its relationship with

casual NBA.com video-watchers who had not signed up for the newsletter. 14

Accepting these allegations as true and drawing all reasonable inferences in

Salazar’s favor, as we must at the pleadings stage, Salazar plausibly alleged that

he gave the NBA valuable personal information in exchange for access to the

online newsletter. Cf. Yershov,

(reasoning that the plaintiff provided

“consideration in the form of” “personal information” including his Android ID

and device’s GPS location). This is sufficient at the pleadings stage to satisfy the

requirement that Salazar allege that he became a “subscriber of” the NBA’s online

newsletter.

14That is not to say that a NBA.com video-watcher who does not sign up for the online newsletter is not also a VPPA “subscriber.” Salazar does not argue that he was a subscriber merely by virtue of any information acquired by the NBA based solely on his viewing the videos on NBA.com. We therefore leave that question for another day.

43 CONCLUSION

Our ruling is narrow: We hold on the merits only that Salazar has plausibly

pled that he is a “subscriber of goods or services” and that the district court

therefore erred in dismissing his complaint pursuant to Fed. R. Civ. P. 12(b)(6).

We leave the district court to address the NBA’s alternative arguments in the first

instance. And, of course, our conclusions are conditioned on the necessary

pleading-stage presumption that Salazar’s allegations are true. Further factual

developments may ultimately paint a different picture.

The VPPA is no dinosaur statute. Congress deployed broad language in

defining the term “consumer,” showing it did not intend for the VPPA to gather

dust next to our VHS tapes. Our modern means of consuming content may be

different, but the VPPA’s privacy protections remain as robust today as they were

in 1988.

The district court’s judgment is VACATED, and the case is REMANDED

for further proceedings consistent with this opinion.

44