Juan Bautista Berenguer sued various municipalities and their employees, alleging violations of the Driver's Privacy Protection Act ("DPPA"), 18 U.S.C. §§ 2721 - 25. After the issuance of our opinions in McDonough v. Anoka County , 799 F.3d 931 (2015), and Tichich v. City of Bloomington , 835 F.3d 856 (2016), Berenguer conceded that only his claims against the City of Bloomington and the City of Shakopee were timely and plausible. Defendants' motions to dismiss for failure to state a claim were granted by the district court, 1 which ruled that Berenguer had failed to plead frequent suspicious accesses by either Bloomington or Shakopee. Berenguer appeals, and we affirm.

I.

Juan Bautista Berenguer is a former Major League Baseball player who pitched for two World Series winners: the 1984 Detroit Tigers and the 1987 Minnesota Twins. After retiring from baseball in 1992, he settled in Minnesota where he lives today. Berenguer requested an audit by the Minnesota Department of Public Safety in May 2014. The audit revealed *481 that officers from over thirty different departments had accessed his information more than 125 times after 2005. Berenguer requested further information, which revealed that on several occasions officers had also accessed the names of his children, Jody and Andrew Berenguer.

The DPPA prohibits state motor vehicle departments from disclosing personal information contained in a record except for uses explicitly permitted by the statute. See 18 U.S.C. § 2721 (a) - (b). Any "person who knowingly obtains, discloses or uses personal information, from a motor vehicle record, for a purpose not permitted" is liable to the individual accessed. Id. § 2724. A court may award an individual whose personal information has been improperly accessed "actual damages, but not less than liquidated damages in the amount of $2,500," attorney fees, and also punitive damages when there is "proof of willful or reckless disregard of the law." Id. § 2724.

On December 10, 2014, Berenguer filed suit against thirty-six municipalities, the current and former commissioners of the Minnesota Department of Public Safety, hundreds of John and Jane Does, and fifty Entity Does. Berenguer's complaint alleged that these entities and individuals had violated the DPPA by accessing or disclosing his personal information without a permissible purpose. Many of the defendants moved to dismiss the claims as insufficiently pled and barred by the statute of limitations. Berenguer's case was informally stayed pending decisions in other cases with similar issues. After Tichich was decided in 2016, the district court asked the parties to submit supplemental briefs to address the potential impact of prior decisions on Berenguer's claims.

Berenguer's supplemental brief to the district court conceded that only his claims against the cities of Bloomington and Shakopee were timely under McDonough . 2 Berenguer's audit showed that employees at the Shakopee police department had obtained his information on four different occasions between 2005 and 2011-once within the statute of limitations. Employees at the Bloomington police department had accessed it nineteen times between 2005 and 2011. The audits for Berenguer's children revealed five simultaneous accesses by employees at Bloomington and Shakopee (four from Bloomington and one from Shakopee). Only one of these accesses came within the statute of limitations (one by the Bloomington police department). The district court concluded that the accesses had not shown an impermissible purpose and granted defendants' motions to dismiss. Berenguer appeals.

II.

As a preliminary matter, defendants argue for the first time on appeal that Berenguer lacks Article III standing to bring his DPPA claim because he did not demonstrate an injury in fact.

Article III standing requires "(1) an injury that is (2) 'fairly traceable to the defendant's allegedly unlawful conduct' and that is (3) 'likely to be redressed by the requested relief.' " Lujan v. Defenders of Wildlife , 504 U.S. 555 , 590, 112 S.Ct. 2130 , 119 L.Ed.2d 351 (1992) (quoting Allen v. Wright , 468 U.S. 737 , 751, 104 S.Ct. 3315 , 82 L.Ed.2d 556 (1984) ). Although Congress cannot evade Article III's standing requirement by conferring the right to sue on a person who would not otherwise have standing, *482 Spokeo, Inc. v. Robins , --- U.S. ----, 136 S.Ct. 1540 , 1548, 194 L.Ed.2d 635 (2016), Congress may "elevate de facto concrete injuries, whether tangible or intangible, into legally cognizable injuries." Heglund v. Aitkin County , 871 F.3d 572 , 577 (8th Cir. 2017). When considering whether an intangible harm constitutes an injury in fact, courts examine whether the alleged harm "has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts." Spokeo , 136 S.Ct. at 1549 .

A person's control over information concerning her person was a cognizable concept in the common law as an invasion of privacy, Heglund , 871 F.3d at 577-78 , and Congress has explained that the DPPA was intended as protection against "potential harm to privacy from state officials accessing drivers' personal information for improper reasons." Id. at 577 . Such intangible harm provides standing for Berenguer. See id. at 578 .

III.

Defendants argue and the district court held, however, that Berenguer failed to plead a plausible claim for relief. We review grants of motions to dismiss de novo. McDonough , 799 F.3d at 945 .

In order to succeed in a DPPA lawsuit, a plaintiff must establish that a defendant "1) knowingly 2) obtained, disclosed, or used personal information, 3) from a motor vehicle record, 4) for a purpose not permitted." Id. A DPPA complaint thus must plead "enough fact[s] to raise a reasonable expectation that discovery will reveal evidence" that defendants obtained the plaintiff's information for an impermissible purpose. See Bell Atlantic Corp. v. Twombly , 550 U.S. 544 , 556, 127 S.Ct. 1955 , 167 L.Ed.2d 929 (2007). "[G]eneralized allegations" that are "merely consistent with the liability" of a defendant "stop[ ] short of the line between possibility and plausibility of entitlement to relief" and are insufficient to meet the pleading standards. McDonough , 799 F.3d at 947 (quoting Twombly , 550 U.S. at 557 , 127 S.Ct. 1955 ). When a complaint does not allege "concerted activity," a plaintiff must plead something more to survive a motion to dismiss. Id.

Courts evaluate each defendant's alleged conduct independently in order to ensure that the plaintiff has pled sufficient facts to show an impermissible purpose by each defendant. Id. at 946. That does not mean that we assess the allegations in isolation, however. Id. We read the complaint as a whole and consider all claims when assessing the plausibility of those timely filed. Id.

One way for a plaintiff to "nudge the allegations across the line of plausibility" is to plead frequent accesses and suspicious access timing patterns. Id. at 947 ; see also Tichich , 835 F.3d at 866-67 . When determining whether the number of alleged accesses is frequent, "sequential accesses occurring within a several-minute time span" should be considered as one. Id. at 867 . In McDonough , we identified three categories of suspicious access patterns that might give rise to a plausible claim:

1) accesses on the same day as or within a few hours of accesses by other, unrelated entities during the limitations period; 2) multiple late-night accesses during the limitations period; or 3) a history of frequent suspicious accesses fitting the above criteria, even if prior to the limitations period, coupled with accesses within the limitations period.

Id. at 950 . It is significant if a complaint alleges evidence of local fame, of a relationship between the plaintiff and particular officers, or of an access timed with a *483 significant event that could spark an interest in the plaintiff's personal information. Tichich , 835 F.3d at 866 . We have concluded, for example, that a plaintiff had pled a suspicious access pattern by alleging more than a hundred accesses-including late night accesses-within the statute of limitations period. In another illustrative example, one plaintiff's information was accessed by different agencies more than a hundred times within a week. See McDonough , 799 F.3d at 951-53 . In contrast, a different case with eighteen accesses within its limitations period, only one of which was a late night access, was not found to be suspicious. See Tichich , 835 F.3d at 870-71 .

Berenguer does not allege that more than one agency accessed his information on the same day within the statute of limitations period. Nor does he allege any late night accesses within that period. Shakopee employees accessed his information four times between 2005 and 2011; only one was during the early morning, and only one fell within the limitations period. Including sequential accesses by the same user, Berenguer's information was accessed by Bloomington employees twelve times between 2005 and 2011. Only two of those occurred within the statute of limitations period, and each access was by a different user. The fact that the records of his children were accessed at the same time as his own on several occasions is insufficient to establish a pattern of suspicious accesses. These simultaneous accesses occurred months apart, and only one was within the statute of limitations period. None "reveal a pattern that would indicate that they were unlawful or unpermitted." See id. at 868 . Berenguer thus failed to plead sufficient facts to show an impermissible purpose by the defendants. See McDonough , 799 F.3d at 946 .

IV.

For these reasons, we affirm the judgment of the district court.