Ryan Perry v. Cable News Network, Inc.

RESTANI, Judge: Appellant Ryan Perry' (“Perry”) appeals the district court’s dismissal of his complaint pursuant to Federal Rule of Civil Procedure 12(b)(6). The district court held that Perry failed to state a claim under the Video Privacy Protection Act (“VPPA”) both because Perry is not a statutory “consumer” and the information at issue is not “personally identifiable information.” The district court also reasoned that Perry’s proposed amendments to his complaint would be futile. We affirm. BACKGROUND According to Perry’s complaint, Appel-lee Cable News Network, Inc. is a producer of news programming for television. Cable News Network, Inc. along with its subsidiary Appellee CNN Interactive Group, Inc. (collectively, “CNN”) offer media content on a mobile software application (or “app”), and Perry alleges that CNN’s proprietary app (the “CNN App”) is available for download on mobile devices, including on Apple, Inc. (“Apple”)’s iPhone. Through the CNN App, users can get breaking news alerts, follow stories, and watch video clips and coverage of live events. The CNN App. may be downloaded through the Apple iTunes Store. The CNN App never seeks the user’s consent to disclose the user’s personal data to any third parties. Perry, who is a citizen of Illinois, began using the CNN App in early 2013 on his iPhone. He never consented to *1339 allow CNN to disclose his personally identifiable information. Perry alleges that the CNN App, without a user’s knowledge, both tracks the user’s views of news articles and videos and also collects a record of this viewing activity. When a user closes the CNN App, CNN sends the collected record of viewing activity to a company called Bango, a third party company that conducts data analyt-ics. CNN also sends Bango a media access control address (“MAC address”), which is a unique string of numbers associated with a particular user’s specific mobile device. Bango then uses the MAC address to link an internet user’s unique device identifier to the user’s other internet activity in order to understand the user’s online behavior. Bango constructs a digital file related to the user’s online behavior by accessing information available to Bango from an extensive range of networks and devices. Bango is able to compile personal information, including the user’s name, location, phone number, email address, and payment information, and it can attribute this information to a single user across different devices and platforms. On February 18, 2014, Perry filed a proposed class action in the district court. In his first amended complaint, Perry sets forth one cause of action for violation of the VPPA, 18 U.S.C. § 2710. Perry seeks injunctive relief and both statutory and punitive damages due to CNN’s allegedly unlawful disclosures of personally identifiable information. Following this court’s opinion in Ellis v. Cartoon Network, Inc., 803 F.3d 1251 (11th Cir. 2015), in which we affirmed the dismissal of a complaint bringing similar allegations pursuant to the VPPA, Perry, sought leave of the district court to amend his complaint. On April 20, 2016, the district court granted CNN’s motion to dismiss the amended complaint, reasoning that further amendment to the complaint would be futile. Perry appeals. JURISDICTION AND STANDARD OF REVIEW We have jurisdiction of this appeal pursuant to 28 U.S.C. § 1291. We review de novo the issue of whether a party has standing. Palm Beach Golf Ctr.-Boca, Inc. v. John G. Sarris, D.D.S., P.A., 781 F.3d 1245, 1251 (11th Cir. 2015). We also review de novo a district court’s decision to deny leave to amend for futility. Cockrell v. Sparks, 510 F.3d 1307, 1310 (11th Cir. 2007) (per curiam). DISCUSSION I. Standing CNN argues Perry has not alleged a legally cognizable injury in the light of the Supreme Court’s decision in Spokeo, Inc. v. Robins, — U.S. —, 136 S.Ct. 1540, 194 L.Ed.2d 635 (2016) because Perry’s alleged violation of a statutory right is not on its own sufficiently concrete. Federal jurisdiction is circumscribed by the case or controversy requirement of Article III of the Constitution, essential to which is the doctrine of standing. U.S. Const, art. III, § 2, cl. 1; Lujan v. Defenders of Wildlife, 504 U.S. 555, 559-60, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992). To demonstrate standing, a “plaintiff must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.” Spokeo, 136 S.Ct. at 1547. An injury in fact is both “concrete and partic *1340 ularized” as well as “actual or imminent, not conjectural or hypothetical[J” Friends of the Earth, Inc. v. Laidlaw Envtl. Servs. (TOC), Inc., 528 U.S. 167, 180, 120 S.Ct. 693, 145 L.Ed.2d 610 (2000). In Spokeo, the Supreme Court vacated the decision of the Court of Appeals and remanded the issue of whether a plaintiff sufficiently alleged a concrete injury where the plaintiff claimed a statutory violation of the Fair Credit Reporting Act (“FCRA”). 136 S.Ct. at 1545-46. The plaintiff alleged that a website had published inaccurate information about him. Id, at 1544. The Supreme Court emphasized that in addition to being particularized, intangible injuries, including statutory violations, must still be concrete. Id, at 1548 (“A ‘concrete’ injury must be ‘de facto’; that is, it must actually exist.”). The Supreme Court stated that “both history and the judgment of Congress play important roles” in determining whether an intangible harm is concrete, explaining that “it is instructive to consider whether an alleged intangible harm has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts.” Id. at 1549. The Supreme Court held that the plaintiff there had only alleged a “bare procedural violation” of the FRCA because the violation, on its own, may not cause any harm or present a material risk of harm. Id. at 1550. Perry has established his standing to file this action because his alleged injury is sufficiently concrete. Although Perry does not allege any additional harm beyond the statutory violation, the Supreme Court has made clear that our analysis does not end there. See Spokeo, 136 S.Ct. at 1549. Instead, “the violation of a procedural right granted by statute can be sufficient in some circumstances to constitute injury in fact” so that “a plaintiff in such a case need not allege any additional harm beyond the one Congress has identified.” Id.; see also Havens Realty Corp. v. Coleman, 455 U.S. 363, 373, 102 S.Ct. 1114, 71 L.Ed.2d 214 (1982) (instructing that injury in fact “may exist solely by virtue of ‘statutes creating legal rights, the invasion of which creates standing....’” (quoting Warth v. Seldin, 422 U.S. 490, 500, 95 S.Ct. 2197, 45 L.Ed.2d 343 (1975))). The structure and purpose of the VPPA supports the conclusion that it provides actionable rights. Subject to certain exceptions, the VPPA prohibits the wrongful disclosure by a video tape service provider of video tape rental or sale records. 18 U.S.C. § 2710. It creates a cause of action for “[a]ny person aggrieved by any act of a person in violation of this section.” 18 U.S.C. § 2710(c)(1). The statute was enacted in response to a newspaper’s publication of Supreme Court nominee Judge Robert H. Bork’s video rental history from a particular store, and it seeks “‘to preserve personal privacy with respect to the rental, purchase, or delivery of video tapes or similar audio visual materials....’” Ellis, 803 F.3d at 1252-53 (quoting 134 Cong. Rec. S5396-08, S. 2361 (May 10, 1988)). We conclude that violation of the VPPA constitutes a concrete harm. See In re Nickelodeon, 827 F.3d 262, 274 (3d Cir. 2016) (“While perhaps ‘intangible,’ the harm is also concrete in the sense that it involves a clear de facto injury, ⅛ the unlawful disclosure of legally protected information.”). Indeed, the VPPA’s creation of a cause of action for this type of an invasion of privacy “has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in En *1341 glish or American courts.” Spokeo, 136 S.Ct. at 1549. Since the early 1900s, “the existence of a right of privacy [has been] recognized in the great majority of the American jurisdictions that have considered the question.” Restatement (Second) of Torts § 652A cmt. a. (Am. Law Inst. 1977); see also U.S. Dep’t of Justice v. Reporters Comm. for Freedom of the Press, 489 U.S. 749, 763, 109 S.Ct. 1468, 103 L.Ed.2d 774 (1989) (“[B]oth the common law and the literal understandings of privacy encompass the individual’s control of information concerning his or her person.”). Further, in the tort of intrusion upon seclusion, 1 “[t]he intrusion itself makes the defendant subject to liability, even though there is no publication or other use,” meaning a showing of additional harm is not necessary to create liability. Restatement (Second) of Torts § 652B cmt. b (emphasis added). The VPPA is similar but subjects a video service provider to liability only when that provider actually discloses the consumer’s personal information. Supreme Court precedent has recognized in the privacy context that an individual has an interest in preventing disclosure of personal information. See Reporters Comm. for Freedom of the Press, 489 U.S. at 762, 109 S.Ct. 1468 (“[C]ases sometimes characterized as protecting ‘privacy’ have in fact involved ... the individual interest in avoiding disclosure of personal matters, .... ” (quoting Whalen v. Roe, 429 U.S. 589, 598-600, 97 S.Ct. 869, 51 L.Ed.2d 64 (1977))). Accordingly, we hold that a plaintiff such as Perry has satisfied the concreteness requirement of Article III standing, where the plaintiff alleges a violation of the VPPA for a wrongful disclosure. 2 II. Video Privacy Protection Act Although Perry concedes that his complaint fails to state a claim under the VPPA, he argues that the district court erred in denying leave to amend. Specifically, Perry argues that, if permitted, he would amend his complaint to. “allege that in addition to downloading the CNN App and viewing CNN content on his iPhone, he also subscribed to CNN’s television channel through his cable package.” Perry also contends that CNN’s transmission of his MAC address and video history is “personally identifiable information” as defined in the VPPA. The VPPA generally prohibits “[a] video tape service provider [from] knowingly disclosing], to any person, personally identifiable information concerning any consumer of such provider.” 18 U.S.C. § 2710(b). The statute defines “consumer” as “any renter, purchaser, or subscriber of goods or services from a video tape service provider[.]” Id. § 2710(a)(1). In interpreting the term “subscriber,” we have previously said that the term requires some sort of “ongoing commitment or relationship between the user and the entity which owns and operates the app.” Ellis, 803 F.3d at 1257. The district court properly held that Perry’s attempt to amend his corn- *1342 plaint is futile. Our decision in Ellis controls and requires the conclusion that Perry is not a “subscriber” within the meaning of the VPPA because Perry has failed to sufficiently plead new allegations that would distinguish his case from Ellis. 3 Similar to the situation here, in Ellis, a plaintiff alleged that he was a subscriber of a Cartoon Network free mobile app where he viewed videos on the app and Cartoon Network sent his viewing history and his mobile device identification number to Bango without the plaintiffs consent. 803 F.3d at 1253-54. We held that the plaintiff there was not a “subscriber,” reasoning that “downloading an app for free and using it to view content at no cost is not enough to make a user of the app a ‘subscriber’ under the VPPA.... [S]uch a user is free to delete the app without consequences whenever he likes, and never access its content again.” Id. at 1257. By the same token, Perry is not a subscriber of CNN because he has not demonstrated an ongoing commitment or relationship with CNN. Just as the plaintiff in Ellis, Perry did not “sign up for or establish an account with” CNN, “provide any personal information to” CNN, “make any payments” to CNN in using its app, “become a registered user” of CNN or its app, “receive a [CNN] ID,” “establish a [CNN] profile,” “sign up for any periodic services or transmissions,” nor “make any commitment or establish any relationship that would allow him to have access to exclusive or restricted content.” Id. Perry, through his proposed amendment regarding his cable television subscription, 4 attempts to address the aforementioned factors in Ellis by claiming that he received some exclusive or restricted content on the CNN App based on his relationship with his cable television provider and that he made payments to CNN. Perry’s proposed amendment, however, shows a commitment to only his cable television provider, rather than to CNN. First, Perry contends that because of his television subscription he is able to access “certain features” on the CNN App that a typical CNN App user cannot. From Perry’s cursory explanation, it appears that he accesses these features due to his status as a subscriber of his cable television provider. 5 The only example of a feature that Perry provides is that a user of the CNN App can watch live television on the CNN *1343 App, if the user has a cable television subscription, selects their cable service provider in the CNN App, and signs in using their credentials for an online account that the user maintains with their cable television provider. But, Perry’s choice to watch CNN live on the CNN App (after logging in) rather than on his television does not somehow convert him into a subscriber of CNN. Again, Perry can access this live television on the CNN App solely because of his separate relationship with his cable television provider, as is clear by the fact that Perry has to select his cable television provider, that Perry uses the credentials associated with his cable television provider’s account (not a separate CNN account), and that the content available on his television and on the CNN App appear to be the same. Notably, a person, who has not downloaded the CNN App, but has a subscription to the same cable television provider could access the same content as Perry on his or her television. Yet, that person would not be a subscriber of CNN. Outside of downloading the CNN App and perhaps acknowledging in the app that he has a cable television subscription, there is no indication that Perry has engaged CNN in any other way in order to gain access to this exclusive feature. This is insufficient to create the requisite “ongoing commitment or relationship” with CNN. Ellis, 803 F.3d at 1256-57 (describing a subscription as involving “some type of commitment, relationship, or association (financial or otherwise) between a person and an entity”). Second, Perry’s argument that CNN indirectly receives a monetary benefit by virtue of Perry’s direct payments to his cable television provider similarly misses the mark. Perry’s distinct financial relationship with his cable television provider does not shed light on his commitment to CNN because, for instance, if his cable television provider removed CNN from Perry’s cable package, it would not affect Perry’s ability to use the CNN App for free video content. Perry’s citation to the First Circuit’s decision in Yershov v. Gannett Satellite Information Network, Inc., 820 F.3d 482 (1st Cir. 2016) does not alter our holding. Not only are we bound by our decision in Ellis, the reasoning with which the First Circuit appears to take some issue, but also Yershov is distinguishable. There, the First Circuit distinguished Ellis by noting that the plaintiff in Yershov, in order to use the app at issue, provided his mobile device identification number and GPS location to the proprietor of the app. Id at’ 489. That fact was sufficient to “establish a relationship” with the proprietor of the app. Id. In the present case, however, Perry admitted before the district court that he was never required to register for the CNN App, even stating that the CNN App did not request his email address, his credit card number, or his GPS location. 6 Perry, therefore, did not actively provide his personal information to CNN in exchange for the CNN App nor has he demonstrated that he manifested his relation *1344 ship with and commitment to CNN in any meaningful way. We decide that the ephemeral investment and commitment associated with Perry’s downloading of the CNN App on his mobile device, even with the fact that he has a separate cable television subscription that includes CNN content, is simply not enough to consider him a “subscriber” under Ellis. Perry still “is free to delete the app without consequences whenever he likes, and never access its content again.” Ellis, 803 F.3d at 1257. Accordingly, the district court correctly determined that Perry’s cable subscription as described is not the something “more” under Ellis necessary to state a claim under the VPPA. Id. at 1258. At most, the cable subscription shows that Perry is a subscriber of his cable television provider. Having concluded that the district court did not err in concluding that Perry is not a “subscriber” as defined by the VPPA such that CNN may be held liable, we need not address the second prong for liability under the VPPA, whether CNN provided Perry’s “personally identifiable information” to a third party. CONCLUSION F.or the reasons stated above, the judgment of the district court is AFFIRMED. Footnotes [1] The Restatement defines this tort as follows: "[o]ne who intentionally intrudes, physically or otherwise, upon the solitude or seclusion of another or his private affairs or concerns, is subject to liability to the other for invasion of his privacy, if the intrusion would be highly offensive to a reasonable person.” Restatement (Second) of Torts § 6S2B. It provides examples, including the "opening [of a plaintiff’s] private and personal mail, searching his safe or his wallet, [and] examining his private bank account.” Id. § 652B cmt. b. [2] For the reasons stated above, we deny CNN's motion to dismiss this appeal and Perry’s subsequent motion for sanctions. [3] Perry limits his appeal to arguing that he is a ''subscriber” as described in 18 U.S.C. § 2710(a)(1). We limit our discussion accordingly. [4] Before us and the district court, Perry has provided few specific details about his proposed allegation or the contents of his cable subscription. Therefore, although he is entitled to reasonable inferences, such inferences may logically derive only from factual allegations actually made. See Ashcroft v. Iqbal, 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009) (“A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.”). We conduct our review accordingly. [5] Perry does not state a cause of action against his cable television service provider. Although his only claim is an alleged violation of the VPPA, he makes no allegation that his cable television provider is a “video service provider” within the meaning of the VPPA. See 18 U.S.C. § 2710(a)(4). And, in any event, it appears that the conduct of his cable television provider in this context is governed by another law. See 47 U.S.C. § 551(c) (discussing a cable operator's duty to not disclose personally identifiable information subject to certain exceptions); see also 47 U.S.C. § 338(i)(4)(A) (providing a similar duty for satellite carriers). [6] Perry claims instead that he was “de facto registered” as apps, in general, are unique because their proprietors can automatically access personal data on a user's mobile device. Perry’s argument, which rests on the assumption that, upon download, a proprietor of an app gains access to a wealth of personal information belonging to a user, would require the conclusion that every app user is a subscriber. This is so because the exchange of this personal information necessarily occurs, in Perry’s view, with the download and normal use of an app. But, such a broad definition of subscriber would squarely conflict with our holding in Ellis by eliminating the condition that a subscriber have an "ongoing commitment or relationship” with the app’s proprietor. See 803 F.3d at 1257.