24-2656 Hughes v. Nat’l Football League UNITED STATES COURT OF APPEALS FOR THE SECOND CIRCUIT SUMMARY ORDER RULINGS BY SUMMARY ORDER DO NOT HAVE PRECEDENTIAL EFFECT. CITATION TO A SUMMARY ORDER FILED ON OR AFTER JANUARY 1, 2007, IS PERMITTED AND IS GOVERNED BY FEDERAL RULE OF APPELLATE PROCEDURE 32.1 AND THIS COURT’S LOCAL RULE 32.1.1. WHEN CITING A SUMMARY ORDER IN A DOCUMENT FILED WITH THIS COURT, A PARTY MUST CITE EITHER THE FEDERAL APPENDIX OR AN ELECTRONIC DATABASE (WITH THE NOTATION “SUMMARY ORDER”). A PARTY CITING A SUMMARY ORDER MUST SERVE A COPY OF IT ON ANY PARTY NOT REPRESENTED BY COUNSEL.

At a stated term of the United States Court of Appeals for the Second Circuit, held at the Thurgood Marshall United States Courthouse, 40 Foley Square, in the City of New York, on the 20th day of June, two thousand twenty-five.

Present: DEBRA ANN LIVINGSTON, Chief Judge, JON O. NEWMAN, RICHARD J. SULLIVAN, Circuit Judges. _____________________________________ BRANDON HUGHES, INDIVIDUALLY AND ON BEHALF OF ALL OTHERS SIMILARLY SITUATED, Plaintiff-Appellant, ISRAEL JAMES, Plaintiff, v. 24-2656 NATIONAL FOOTBALL LEAGUE, Defendant-Appellee. _____________________________________ For Plaintiff-Appellant: JOSHUA I. HAMMACK, (Michael L. Murphy, on the brief), Bailey & Glasser, LLP, Washington, D.C.

For Defendant-Appellant: HILARY L. PRESTON, (Marisa Antonelli, Matthew X.

Etchemendy, on the brief), Vinson & Elkins LLP, New York, NY.

Appeal from an order and judgment of the United States District Court for the Southern District of New York (Rochon, J.).

UPON DUE CONSIDERATION, IT IS HEREBY ORDERED, ADJUDGED, AND DECREED that the order and judgment of the district court is AFFIRMED.

Plaintiff-appellant Brandon Hughes appeals from an order and judgment of the United States District Court for the Southern District of New York (Rochon, J.), entered on September 5 and 6, 2024, respectively, granting defendant-appellee National Football League’s (the “NFL”) motion to dismiss pursuant to Federal Rule of Civil Procedure 12(b)(6). On appeal, Hughes initially asked us to vacate and remand in light of our decision in Salazar v. Nat’l Basketball Ass’n, 118 F.4th 533 (2d Cir. 2024), which post-dated the district court’s order and judgment. Thereafter, we decided Solomon v. Flipps Media, Inc., 136 F.4th 41 (2d Cir. 2025). Now, Hughes argues that “Solomon does not alter the outcome here,” dkt. 44 at 1, and continues to ask us to vacate and remand, while the NFL argues that Solomon “is binding and dispositive of this case”, dkt. 45 at 1, and asks us to affirm. Because we agree with the NFL, we affirm the district court’s decision to dismiss this case. We assume the parties’ familiarity with the underlying facts, the procedural history of the case, and the issues on appeal.

Hughes alleges that the NFL violated the Video Privacy Protection Act (“VPPA”) by installing the Facebook Pixel (the “Pixel”) onto its website and app. The Pixel is a string of code that can be installed onto a website/app and shares certain information about users with Facebook.

J. App’x at 269-70. The principal question now is whether Hughes can still plead a viable VPPA claim against the NFL in light of our decision in Solomon. 1 We conclude that he cannot.

We review de novo a district court’s grant of a motion to dismiss under Fed. R. Civ. P. 12(b)(6), accepting all factual allegations in the complaint as true and drawing all reasonable inferences in the plaintiff’s favor. See, e.g., O’Donnell v. AXA Equitable Life Ins. Co., 887 F.3d 124, 128 (2d Cir. 2018). To survive a motion to dismiss, a complaint must contain sufficient factual allegations to state a claim for relief that is plausible on its face. See, e.g., id. Both Salazar and Solomon were decided after the district court granted the NFL’s motion to dismiss in this case. “Ordinarily, where circumstances have changed between the ruling below and the decision on appeal, the preferred procedure is to remand to give the district court an opportunity to pass on the changed circumstances, unless the new situation demands one result only.” New England Merchs. Nat. Bank v. Iran Power Generation & Transmission Co., 646 F.2d 779, 783-84 (2d Cir.) (internal quotation marks omitted) (emphasis added), certified question answered sub nom. Iran Nat’l Airlines Corp. v. Marschalk Co., 453 U.S. 919 (1981). This case presents such a situation.

The NFL also argues that the district court improperly concluded that Hughes had standing to bring his claim. The NFL is mistaken. The crux of its argument is that Hughes lacks Article III standing to pursue a VPPA claim because he supposedly consented to the disclosures in question. Not so. As a threshold matter, there is a factual dispute as to whether Hughes actually consented to the disclosure of his information. Compare J. App’x 263 (alleging that “[p]laintiff never gave [d]efendant express written consent to disclose his [p]ersonal [v]iewing [i]nformation”) with Appellee’s Br. at 25 (arguing that plaintiff “consented to the disclosures at issue” by “agree[ing] to the NFL’s Privacy Policy when he created his account on NFL.com”). In particular, the parties disagree as to whether the NFL’s Privacy Policy informed users that their information may be disclosed rather than merely collected. In Salazar, we concluded that this type of question “should be left for the district court to address in the first instance given that its resolution will require detailed examination of the [relevant] Privacy Policy and [plaintiff’s] factual allegations showing his acceptance of that policy.” Salazar, 118 F.4th at 539 n.4. So too here. Moreover, as the district court correctly observed, the NFL’s argument at most establishes an affirmative defense and calls for an analysis of the merits of plaintiff’s VPPA claim. Since the “threshold inquiry into standing ‘in no way depends on the merits,’” such an analysis is inappropriate at this stage. Wakefield v. ViSalus, Inc., 51 F.4th 1109, 1118 n.7 (9th Cir. 2022) (quoting Whitmore v. Arkansas, 495 U.S. 149, 155 (1990)).

The VPPA provides that “[a] video tape service provider who knowingly discloses, to any person, personally identifiable information concerning any consumer of such provider shall be liable to the aggrieved person[.]” 18 U.S.C. § 2710(b)(1). In Solomon, we held that “‘personally identifiable information’ encompasses information that would allow an ordinary person to identify a consumer’s video-watching habits, but not information that only a sophisticated technology company could use to do so.” 136 F.4th at 52; see also In re Nickelodeon Consumer Priv. Litig., 827 F.3d 262, 290 (3d Cir. 2016) (adopting the “ordinary person” standard); Eichenberger v. ESPN, Inc., 876 F.3d 979, 985 (9th Cir. 2017) (same).

Solomon effectively shut the door for Pixel-based VPPA claims. As is the case here, Solomon involved a plaintiff who brought a VPPA claim against a defendant that had installed the Pixel on its website. The plaintiff’s complaint included the following “exemplar” which showed an example of the type of transmission that was sent to Facebook via the Pixel:

Solomon, 136 F.4th at 46. We concluded in Solomon that: The exemplar depicts some twenty-nine lines of computer code, and the video title is indeed contained in Box A following the GET request. The words of the title, however, are interspersed with many characters, numbers, and letters. It is implausible that an ordinary person would look at the phrase “title%22%3A%22- %E2%96%B7%20The%20Roast%20of%- 20Ric%20Flair” . . . and understand it to be a video title. It is also implausible that an ordinary person would understand, “with little or no extra effort,” the highlighted portion to be a video title as opposed to any of the other combinations of words within the code, such as, for example, “%9C%93%20In%20the%20last%20weekend%20of%20-July%2C.”

...

[I]t is [also] not plausible that an ordinary person, without [] annotation . . . , would see the “c_user” phrase on [a] server[] and conclude that the phrase was a person’s [Facebook ID (“FID”)]. Id. at 54 (internal citations omitted).

The same holds true here. Hughes’ complaint includes a similar screenshot depicting a “single communication session sent from [a] device to Facebook” via the Pixel:

J. App’x at 273. While Hughes asserts that a viewer’s FID can be identified based on the string of numerals following the “c_user” field, id., it “is not plausible that an ordinary person, without [] annotation . . . , would see the ‘c_user’ phrase on [this communication] and conclude that the phrase was a person’s FID.” Solomon, 136 F.4th at 54. And while the district court may not have had the benefit of our decision in Solomon when it ruled on the NFL’s motion to dismiss, “[w]e are free to affirm on any ground that finds support in the record, even if it was not the ground upon which the trial court relied.” Beijing Neu Cloud Oriental Sys. Tech. Co. v. Int’l Bus. Machines Corp., 110 F.4th 106, 113 (2d Cir. 2024) (internal quotation marks omitted).

Hughes argues that, if permitted to amend his complaint, he would allege that: (1) Facebook receives communications from the Pixel “in a way that is automatically translated into a readable format and is displayed (or is displayable) on a user interface as plain text”; (2) an ordinary person could plug the code into “ubiquitous internet-based tools like ChatGPT” to “translate the code to reveal the Facebook ID and video title in plain English”; and (3) 75% of Americans have a Facebook account. Dkt. 44 at 3. None of these arguments supports a VPPA claim post-Solomon. In Solomon, we focused on whether an ordinary person would be able to understand the actual underlying code communication itself, regardless of how the code is later manipulated or used by Facebook. Solomon, 136 F.4th at 52 (“‘[P]ersonally identifiable information’ encompasses information that would allow an ordinary person to identify a consumer’s video-watching habits, but not information that only a sophisticated technology company could use to do so.” (emphasis added)). The existence of tools like ChatGPT, which were also prevalent at the time Solomon was decided, would not alter our conclusion in this case.

Finally, the ubiquity of Facebook accounts has no bearing on the ability of ordinary people to

interpret the Pixel communications depicted in Hughes’ complaint. Accordingly, we see no basis for remanding because amendment would likely be futile.

* * * We have considered appellant’s remaining arguments and find them to be without merit.

Accordingly, the order and judgment of the district court are AFFIRMED.

FOR THE COURT: Catherine O’Hagan Wolfe, Clerk