Campos v. Tubi, Inc.

IN THE UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION SYLVIA CAMPOS, individually and on ) behalf of a class of similarly situated ) individuals, ) ) Plaintiff, ) No. 23-cv-3843 ) v. ) Judge John J. Tharp, Jr. ) TUBI, INC., ) ) Defendant. ) MEMORANDUM OPINION AND ORDER Plaintiff Sylvia Campos has brought an amended class action complaint against defendant Tubi, Inc. under the Video Privacy Protection Act (“VPPA”), 18 U.S.C. § 2710 , et seq. She alleges that Tubi, an online video streaming platform, violated the VPPA when it knowingly disclosed her and other putative class members’ personal identifiable information (“PII”) to third parties without their consent. In response, Tubi has moved to compel arbitration of Campos’s dispute on the basis that Campos assented to Tubi’s Terms of Use (“TOU”), which include a mandatory arbitration provision, by registering for a Tubi account on its website. Alternatively, it seeks to dismiss her amended complaint under Fed. R. Civ. P. 12(b)(6) for failure to state a claim. For the reasons that follow, Tubi’s motion to compel arbitration is denied, and its motion to dismiss in the alternative is also denied. BACKGROUND Tubi is an online platform for streaming movies and TV shows. Anyone can stream Tubi’s content for free because the site is supported by unskippable advertising breaks rather than subscription fees. Registering an account with Tubi, while not necessary to stream content, provides access to certain additional features such as the ability to create a watch list that can be revisited later. In 2021, Campos registered for a Tubi account using Tubi’s mobile app for Android phones. The Tubi app’s account registration page 1s reproduced via screenshot below: cris] UT el iiic:te Sate ER Lite mite OPT TMM ERO amy tele Om eo Ld he □□□ Mare) Tn em eet) oo Vier) (ee elated =] | ha LE) Tubi’s Reply at 4, ECF No. 23; see also Elliot Decl. ¥ 5. The page has a dark blue or black background, a small “Skip” button1 on the top right, and, near the top, promotional copy in large, white font: “Unlimited Movies, Shows and More”. Immediately below that, also in white font but smaller, there is a sub-heading: “Over 15,000 of your favorite movies and shows for free.” Beneath those lines of copy there is an illustration of a man lounging and watching TV. Those elements cover approximately the top two-thirds of the registration page. The bottom third of the page has three evenly spaced, almost-evenly sized buttons: an orange-red button with white “Continue with Email” text, a white button with black “Continue with Google” text, and a blue button with white “Continue with Facebook” text. The lines of text in those “Continue with…” buttons are approximately the same size as the sub-heading copy near the top (“Over 15,000 of your…”).2 Those components cover about the top five-sixths of the page. As for the bottom sixth, there is some blank space, followed by, in the center, some gray text that is smaller than any of the copy or buttons above and less vivid than the white font used above. It says, “Have an account?” To the right, there is slightly larger, seemingly bolded, white “Sign In” text, presumably a clickable element. Beneath that sign-in segment, finally, we reach a line of text in the same small font. It says, “[starting in gray] By registering, you agree to Tubi TV’s [alternates to white] Terms of Use 1 A digital “button” means, here and elsewhere in the opinion, that there is a somewhat rectangular shape surrounding the text indicating that an action will be performed if the user clicks or taps the shape, much like a button in the physical world. Here, the skip button has white text, and the “button” is a dark gray pill shape surrounding the text and is shaded such that it is differentiated from the dark blue background. 2 Above the three “Continue with. . .” buttons are three dots, the first of which is bright white and the other two are gray. It is not clear what those dots represent—presumably, they are indicators for various slides of illustrations and/or promotional language above. Since the parties do not address them, the Court will consider the page in the static, screenshotted form in which it is presented. [alternates to gray] and [alternates to white] Privacy Policy.” There is one final line at the bottom, in small white font, that says, “Do Not Sell My Info.” The small white “Terms of Use” text is a hyperlink that redirects the user to Tubi’s TOU when clicked. The first page of the TOU document concludes with the following language in bold3: IMPORTANT NOTICE REGARDING ARBITRATION: BY USING ANY TUBI SERVICES AND ACCEPTING THESE TERMS OF USE YOU ARE AGREEING (WITH LIMITED EXCEPTION) TO RESOLVE ANY DISPUTE BETWEEN YOU AND US THROUGH BINDING, INDIVIDUAL ARBITRATION RATHER THAN IN COURT. YOU AND TUBI WAIVE THE RIGHT TO BRING OR PARTICIPATE IN A CLASS ACTION IN CONNECTION WITH SUCH DISPUTES. PLEASE REVIEW CAREFULLY SECTION 10 TITLED “ARBITRATION AGREEMENT AND CLASS ACTION WAIVER” BELOW FOR DETAILS REGARDING ARBITRATION (INCLUDING THE PROCEDURE TO OPT OUT OF ARBITRATION). Ex. 1 to Elliot Decl. at 1, ECF No. 13-1. Section 10 of the TOU provides the terms of the arbitration agreement and class action waiver. Id. at 21-26 . Since the precise language of the arbitration clause and class action waiver are not subject to differing interpretations by the parties and do not otherwise bear on the outcome of any motion before the Court, it is unnecessary to detail them here. The “Continue with Email” button redirects the user to a registration form, a screenshot of which is reproduced below: 3 To be precise, about half of the last sentence in the notice is continued onto the second page of the TOU (assuming that the PDF exhibit reproducing the TOU accurately reflects the pagination in the original). AU] ae elu Nel) er-varel Md sar] boss) (0) 1 Bic | am ants ET PTTsDielat cust Elliot Decl. ¥ 9. The email registration page is a basic form that asks for the registrant’s first name, age, gender, email address, and password. Below the text boxes is a “Register” button. Below that “Register” button is small gray text that reads: “We use this information to confirm that you’re meeting the age requirement set out in our Terms of Use and to personalize your experience. Questions? Let us know at support@tubi.tv”. “Terms of Use” and the email address are in a vivid white underlined font, which constrasts with the gray text used for almost all the other words on the page (except for the “tubi” logo at the top and the “Register” button. Presumably, clicking on “Terms of Use” on the registration page would take a user to the same document to which the “Terms of Use” hyperlink on the first reproduced screen of the app directed the user. Tubi’s vice president and deputy general counsel Matthew Elliot has submitted a declaration stating, in part, “an individual in Illinois who provided the name ‘Sylvia Cmpos’ [sic] registered an account with Tubi using Tubi’s Android app. Tubi believes that this account was created by Plaintiff, given Plaintiff’s allegations that she is an Illinois citizen and that she created a Tubi account in the past two years. As noted above, any person who creates a Tubi account—as Plaintiff says she did—must agree to the Tubi TOU.” Elliot Decl. ¶ 17. There is no evidence that Campos registered using that “Continue with Email” page, as opposed to using her google or Facebook accounts, though plaintiff’s response brief assumes that she did. Resp. at 6. ANALYSIS Tubi seeks to enforce individual arbitration of Campos’s dispute. It contends that she manifested her assent to Tubi’s TOU, which included the mandatory arbitration clause and class action waiver, by registering for her account through the Tubi app. In the alternative—meaning that if the Court declines to compel arbitration—Tubi seeks dismissal of Campos’s amended class action complaint for failure to state a claim pursuant to Rule 12(b)(6). It argues that her allegations about Tubi’s alleged disclosures of her PII fall short of the applicable plausibility pleading standard. The Court will address each motion in turn. I. Tubi’s Motion to Compel Arbitration “Under the [Federal Arbitration Act], arbitration should be compelled if three elements are present: (1) an enforceable written agreement to arbitrate, (2) a dispute within the scope of the arbitration agreement, and (3) a refusal to arbitrate.” Scheurer v. Fromm Family Foods LLC, 863 F.3d 748, 752 (7th Cir. 2017). Campos does not dispute the second or third elements, only the first. She contends that she should be not “be required to submit to arbitration a[] dispute which [s]he has not agreed so to submit.” Zurich Am. Ins. Co. v. Watts Industries, Inc., 417 F.3d 682 , 687 (7th Cir. 2005). As the party seeking to compel arbitration, Tubi bears the burden of offering “sufficient evidence to allow a factfinder to conclude that the parties agreed to arbitrate.” Melvin v. Big Data Arts, LLC, 553 F. Supp. 3d 447 , 450 (N.D. Ill. 2021) (citing Tinder v. Pinkerton Security, 305 F.3d 728, 735 (7th Cir. 2002). The parties agree that Illinois principles of contract formation govern this inquiry. See Faulkenberg v. CB Tax Franchise Systems, LP, 637 F.3d 801, 809 (7th Cir. 2011). Since the parties do not dispute any other aspect of contract formation, enforceability, or interpretation, the resolution of this motion hinges solely on whether Campos agreed to be bound by Tubi’s TOU by creating her Tubi account. It is a basic tenet of contract law that “[i]n order for there to be a contract between parties, there must be a meeting of the minds or mutual assent as to the terms of the contract.” See Midland Hotel Corp. v. Reuben H. Donnelley Corp., 515 N.E.2d 61, 65 (Ill. 1987). In Illinois, “[w]hether mutual assent or an intent to accept exists is determined by an objective standard.” Arbogast v. Chicago Cubs Baseball Club, LLC, 2021 IL App (1st) 210526, ¶ 20 . “Only the parties’ overt acts and the communications between them may be considered in determining whether and upon what terms they have entered into a contract.” Id. In contesting the fact of her assent, Campos cannot rest on the mere fact that she did not actually notice the prompt on the bottom of the registration page—“By registering, you agree to Tubi TV’s Terms of Use and Privacy Policy” (hereafter, Tubi’s “Prompt”)—or otherwise ever read the TOU.4 “[W]hile a party to an internet transaction may lack actual knowledge of additional terms and conditions, she may nonetheless have constructive knowledge of those terms where the website provides clear and conspicuous notice of them.” Wilson v. Redbox Automated Retail, LLC, 4 Campos does not dispute that she encountered the registration pages that Tubi has identified in its briefing. 448 F. Supp. 3d 873 , 882 (N.D. Ill. 2020); see also Anand v. Heath, No. 19-CV-00016, 2019 WL 2716213 , at *3 (N.D. Ill. June 28, 2019) (“A party has constructive knowledge of a contractual term if she is on inquiry notice of the term and assents to it through the conduct that a reasonable person would understand to constitute assent.”). By the same token, Tubi’s mere placement of its Prompt somewhere on its mobile app registration page is not dispositive either. “[W]e cannot presume that a person who clicks on a box that appears on a computer screen has notice of all contents not only of that page but of other content that requires further action (scrolling, following a link, etc.)[.] Indeed, a person using the Internet may not realize that she is agreeing to a contract at all, whereas a reasonable person signing a physical contract will rarely be unaware of that fact.” Sgouros v. TransUnion Corp., 817 F.3d 1029, 1035 (7th Cir. 2016); cf. Arbogast, 2021 IL App (1st) 210526, ¶ 27 (“An offeree, regardless of apparent manifestation of his consent, is not bound by inconspicuous contractual provisions of which he is unaware, contained in a document whose contractual nature is not obvious.” (cleaned up)). In applying basic contract principles to the not-so-basic world of online adhesion contracts, the Court must engage in the “fact-intensive inquiry” of whether “a reasonable person in [the plaintiff’s] shoes would have realized that [s]he was assenting to” the TOU when she followed the link to fill out a registration form.5 Sgouros, 817 F.3d at 1034-35 . Courts in the Seventh Circuit have considered several non-dispositive factors in conducting this assessment, including: 5 The parties disagree on how best to characterize Tubi’s registration page—that is, whether it falls into the “clickwrap” category of web-based contracts or the “hybridwrap” category, which is a mix of clickwrap and “browsewrap” agreements. Courts have defined and differentiated these categories for several years, see, e.g., Anand, 2019 WL 2716213 , at *3; Van Tassell v. United Mktg. Group, LLC, 795 F. Supp. 2d 770, 790-92 (N.D. Ill. 2011), and not all courts have identified the same number and types of categories, see, e.g., Berkson v. Gogo LLC, 97 F.Supp.3d 359 , 394402 (E.D.N.Y. 2015) (identifying four general types of online contracts: (1) Browsewrap; (2) Clickwrap; (3) Scrollwrap; and (4) Sign-in-wrap agreements). The Court must always determine whether “the existence of the terms were reasonably communicated to the user,” Meyer v. Uber (1) whether there is a clear prompt directing the purchaser to read the terms; (2) the size of the prompt; (3) use of a bold font or contrasting colors; (4) the visual clarity of the website’s layout; (5) whether the user can see the link to the terms without having to scroll; and (6) the spatial proximity between the notice and the mechanism for manifesting assent, such as a purchase button. Domer v. Menard, Inc., No. 22-CV-444-JDP, 2023 WL 4762593 at *3 (W.D. Wis. July 26, 2023). In examining all the relevant circumstances, the Court finds that Tubi has not established that it reasonably communicated the existence of its TOU to Campos. The Prompt is in the smallest font on the screen, and it is very nearly at the bottom. The relevant text of the Prompt, “By registering, you agree to Tubi TV’s,” is in a gray font that contrasts poorly with the background. To be sure, a user does not seem to need to scroll to see it, a fact that favors Tubi’s position. But at the same time, even if a user does not need to scroll to see the Prompt, a reasonable user registering for a Tubi account would not be expected to read it. This is because the Prompt on the first screen is not spatially coupled with any mechanism for manifesting assent. Nothing on the screen indicates that clicking one of the “Continue with…” buttons manifests assent to the terms of use; to the contrary, the Prompt indicates that some other action—registering—is required to assent to the TOU. And there is nothing on the first screen of the app that tells one how to register. “Normally, courts will find a sufficient spatial connection where a consumer has an opportunity to review the terms and conditions in the form of a hyperlink placed directly adjacent to the button by which the consumer manifests assent.” Wilson, 448 F. Supp. at 883. But that is Techs., Inc., 868 F.3d 66, 76 (2d Cir. 2017), and these categories are occasionally helpful shorthands in conducting that analysis. But it is unnecessary to expound on them in much detail or find a perfectly fitting category here. To clarify the parties’ dispute, Tubi’s registration page fits most closely with the hybridwrap or “sign-in-wrap” camp. See Wilson, 448 F. Supp. at 882. Nonetheless, the Court’s duty to inquire into the reasonableness of Tubi’s presentation of its terms and whether Campos objectively assented to them remains unchanged; the basic principles of contract law do not apply differently depending on the type of “wrap” at issue. not the case here—the Prompt and the manifest assent button (“Register”) are not even on the same screen. Moreover, the prominent and colorful “Continue with…” buttons would be of much more interest and relevance to a prospective Tubi user than would the small and obscure text at the bottom of the first screen. Having been invited to “Continue with” their exploration of the app, it is unlikely that Campos or others would have expected or noticed the “Terms of Use” prompt on the first screen advising that registration (which is otherwise unmentioned on the first screen) equals assent. Tubi attempts to distinguish Wilson, 448 F. Supp. 873 , by noting that the webpage in that case was cluttered and included multiple irrelevant, intervening buttons and information, and that is supposedly not the case here. While it is true that Tubi’s page is less cluttered than the one in Wilson, Tubi’s registration page suffers from a more significant discontinuity: the placement of the Prompt advising of the consequence of registering on an entirely different screen. That discontinuity is compounded by the fact that the registration button, on the second screen, says nothing at all about registration constituting assent to the TOU. While the second screen explains what some of the registration information is used for (“We use this information to confirm that you’re meeting the age requirement set out in our Terms of Use and to personalize your experience. Questions? Let us know at support@tubi.tv”), nowhere does it advise that by registering, a customer assents to Tubi’s Terms of Use.6 Tubi has submitted an exhibit reproducing screenshots of webpages from multiple cases where Courts have upheld the validity of web agreements that are similar in some respects to Tubi’s. Ex. 1 to Def.’s Reply, ECF No. 23-1. None of those screenshots separate the terms of use 6 And more problematic still, so far as the record reflects, there is no way to advance from the registration screen without registering; there appears to be no “skip” or “continue without registering” prompt. prompt from the assent button on different screens, however. See Meyer v. Uber Technologies, Inc., 868 F.3d 66, 81-82 (2d Cir. 2017); Bold Limited v. Rocket Resume, Inc., No. 22-cv-01045, 2023 WL 4157626 , at *4 (N.D. Cal. June 22, 2023); Regan v. Pinger, Inc., No 20-CV-02221, 2021 WL 706465 , at *1–2 (N.D. Cal. 2021); Ball v. Skillz, Inc., No. 2:20-cv-00888, 2020 WL 6685514 , at *1 (D. Nev. Nov. 12, 2020); Anderson v. Amazon.com, Inc., 490 F. Supp. 3d 1265 , 1269 (M.D. Tenn. 2020); Selden v. Airbnb, Inc., No. 16-cv-00933, 2016 WL 6476934 , at *9 (D.D.C. Nov. 1, 2016). That Tubi’s Prompt is on a different screen than the registration button, coupled with the absence of any warning on the registration page that registration equates to assent, weighs heavily against a finding that Tubi reasonably presented the existence of its TOU to Campos. Another shortcoming with Tubi’s page is that the hyperlink to its TOU is not reasonably visually conspicuous. “Where the terms are not displayed but must be brought up by using a hyperlink, courts . . . have looked for a clear prompt directing the user to read them.” Sgouros, 817 F.3d at 1035 . “Courts have found links to terms and conditions insufficiently conspicuous where the ‘characteristics of the hyperlink raise concerns as to whether a reasonable user’ would recognize the text as a hyperlink.” Wilson, 448 F. Supp. at 885 (quoting Cullinane v. Uber Techs., Inc., 893 F.3d 53, 63 (1st Cir. 2018)). Here, as in Wilson: The hyperlinks that [Campos] would have encountered appear in white text, which does provide some contrast with the surrounding gray text. At the same time, other non-hyperlink text on the Sign In screen appears in white. Using a different color for the hyperlink from the surrounding text, by itself, is not sufficient to render the hyperlink reasonably conspicuous. Indeed, coloring can be for aesthetic purposes. Courts have required more than mere coloring to indicate the existence of a hyperlink to a contract. There must be some other distinguishing characteristic to inform consumers that there was in fact a hyperlink that should be clicked and that a contract should be reviewed, such as words to that effect, underlining, bolding, capitalization, italicization, or large font. Id. (cleaned up) (citing Cullinane, 893 F.3d at 63 (“While not all hyperlinks need to have the same characteristics, they are commonly blue and underlined.” (internal quotation marks omitted))). On the following page with the actual registration form, unlike the initial page containing the “Continue with…” buttons, Tubi underlines its hyperlinks and make them more conspicuous. But it does not, and cannot, argue that the prompt on that page (“We use this information to confirm that you’re meeting the age requirement set out in our Terms of Use and to personalize your experience. Questions? Let us know at support@tubi.tv”) was the relevant prompt to give Campos notice that her registration would constitute assent. The cases and screenshots in Tubi’s Exhibit 1 each involve more conspicuously displayed hyperlinks than Tubi’s TOU hyperlink on the initial registration page at issue here. See Meyer v. Uber Technologies, Inc., 868 F.3d 66, 81-82 (2d Cir. 2017) (capitalized, underlined, and blue with no other similarly formatted non-hyperlink text on the screen); Bold Limited v. Rocket Resume, Inc., No. 22-cv-01045, 2023 WL 4157626 , at *4 (N.D. Cal. June 22, 2023) (same); Regan v. Pinger, Inc., No 20-CV-02221, 2021 WL 706465 , at *1–2 (N.D. Cal. 2021) (hyperlinks in highly contrasting bright green on pages where all other green font text causes an action); Ball v. Skillz, Inc., No. 2:20-cv-00888, 2020 WL 6685514 , at *1 (D. Nev. Nov. 12, 2020) (hyperlink underlined and directly beneath the assent mechanism with minimal other text on the screen); Anderson v. Amazon.com, Inc., 490 F. Supp. 3d 1265 , 1269 (M.D. Tenn. 2020) (hyperlinks noted through contrasting color and underlined); Selden v. Airbnb, Inc., No. 16-cv-00933, 2016 WL 6476934 , at *9 (D.D.C. Nov. 1, 2016) (hyperlinks noted through contrasting color and other similarly formatted text on the page also performs action once clicked). Here, once again quite like in Wilson, “the Court finds the gray disclosure text surrounding the hyperlinks not reasonably conspicuous because there is insufficient contrast between the gray text and the black background.” 448 F. Supp. 3d at 886 (citing Cullinane, 893 F.3d at 64 (finding the notification text to be inconspicuous where it “was displayed in dark gray small-sized non-bolded font against a black background.”)). In their briefs, the parties dispute the relevance of this Court’s reasoning in Anand, 2019 WL 2716213 , a prior opinion where the Court found a defendant’s webpage insufficiently designed to give adequate notice of terms of use. Tubi is correct that the webpage at issue in that case suffered from a fatal defect that is not particularly relevant here: The problem for the defendants is not that the notice regarding mandatory arbitration and the terms and conditions hyperlink were insufficiently conspicuous (though that point is arguable), but rather that there was nothing that told the user that she would manifest her assent to those terms and conditions by clicking “Continue.” Anand, 2019 WL 2716213 at *4. Here, unlike in Anand, there is an appropriate description of the act that would manifest assent to the terms and conditions. That’s not the problem. Here, the problem is that the warning is divorced from the act of assent, making it unlikely that a prospective user like Campos would receive the warning before performing the act of consent. As a final matter, Tubi argues that reasonable mobile app users should already expect that they will be subject to terms of use. It quotes dicta from a District of D.C. opinion for the proposition that: The act of contracting for consumer services online is now commonplace in the American economy. Any reasonably-active adult consumer will almost certainly appreciate that by signing up for a particular service, he or she is accepting the terms and conditions of the provider. Notifications to that effect—be they check boxes or hyperlinks—abound. Reply at 5 (quoting Selden, 2016 WL 6476934 , at *5). Even if the Court were to adopt that general logic—unlikely given the dissonance between that view and Illinois law as it stands—it would not mandate a different outcome here. According to the pleadings, Tubi does not require users to register for an account to watch its content, registration only provides a handful of modest features that are unavailable to unregistered users, and registration is free. There is no indication that Tubi, like various other ad-supported video streaming platforms, allows registered users to comment on its content, generate their own content (e.g., upload their own videos), or otherwise interact with other users—functions that may suggest that account usage may be tied to certain terms and conditions given their hazards. Therefore, Tubi’s site is meaningfully different from other online engagements where consumers may more reasonably expect their conduct and interactions to be subject to terms and conditions (e.g., purchasing goods, paying fee-based subscriptions to access content, or registering accounts for permission to interact with content and/or other users). For the foregoing reasons, Tubi’s motion to compel arbitration is denied. II. Tubi’s Motion to Dismiss for Failure to State a Claim As an alternative to compelling arbitration, Tubi moves to dismiss Campos’s complaint for failure to state a claim. To survive a motion to dismiss for failure to state a claim, the complaint must contain “a short and plain statement of the claim showing that the pleader is entitled to relief.” Kaminski v. Elite Staffing, Inc., 23 F.4th 774, 776 (7th Cir. 2022) (quoting Fed. R. Civ. P. 8(a)(2)). Plaintiffs need not plead facts corresponding to every element of a legal theory. Chapman v. Yellow Cab Cooperative, 875 F.3d 846, 848 (7th Cir. 2017). Instead, the plaintiff need only plead a plausible claim. Rowlands v. United Parcel Serv. - Fort Wayne, 901 F.3d 792, 800 (7th Cir. 2018). “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Allen v. Brown Advisory, LLC, 41 F.4th 843, 850 (7th Cir. 2022) (quoting Ashcroft v. Iqbal, 566 U.S. 662, 678 (2009)). In deciding a motion to dismiss, the Court accepts the well-pleaded factual allegations in a plaintiff’s complaint as true and “draw[s] all reasonable inferences in his favor.” Id. But legal conclusions, such as threadbare recitals of a cause of action, “are not entitled to the assumption of truth.” Iqbal, 566 U.S. at 679 . The Court may also consider documents extrinsic to the complaint as long as the complaint refers to them, they are central to the plaintiff’s claim, and a party attaches them to a pleading or motion to dismiss. Hackman v. Dickerson Realtors, Inc., 520 F. Supp. 2d 954, 963-64 (N.D. Ill. 2007). Generally speaking, the VPPA prohibits video tape service providers from knowingly disclosing a consumer’s personal identifiable information—which “includes information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider,” § 2710(a)(3)—to any other person without first obtaining that consumer’s informed, written consent. § 2710(b). Thus, to prevail on a VPPA claim, a plaintiff must be able to show that the defendant disclosed the specific combination of (a) “the consumer’s identity”; (b) “the video material’s identity”; and (c) “the connection between them.” In re Hulu Priv. Litig., 86 F. Supp. 3d 1090, 1095 (N.D. Cal. 2015). Tubi does not argue that Campos consented to any disclosures or that it is not subject to VPPA. The only question before the Court on this motion is whether Campos’s complaint, once stripped of its legal conclusions and bare recitals of VPPA’s elements, sets forth sufficient facts to make it plausible that Tubi unlawfully disclosed Campos’s PII to third parties. The Court concludes that it does. A. Campos’s Allegations. The overarching theory of the complaint is simple. Tubi does not generate revenue from subscriptions or rentals or purchasing fees. Rather, Tubi’s “revenue is derived solely from selling advertising space on” its videos. Am. Compl. ¶ 5. To make the most of that model, Campos alleges, Tubi capitalizes on a broad swath of data it collects about its users—including information about their identities and video histories—by disclosing that data to third-party advertisers, who in turn use that combination of identity and video history data to target particular users with particular advertisements on Tubi’s platform. ¶ 6. The complaint supports this theory through a variety of factual allegations, some of which are supported by documentary evidence. First, with respect to data collection, Campos alleges that Tubi collects data about its users, including the VPPA-relevant PII data, through multiple avenues. It is already clear that Tubi actually collects certain data from users (i.e., name, age, gender, email) during its account registration process. See supra Background. In addition, Campos alleges that Tubi uses a “sophisticated tracking technology” to collect that PII while users engage with Tubi’s site or app, including their viewing history. ¶ 6. The complaint cites Tubi’s own Privacy Policy, which states that Tubi “may collect” the relevant information—users’ identities and other personal characteristics (e.g., birthdays, email addresses, genders, locations), the video material’s identity, and the connection between them—during the registration process and over the course of the user’s engagement with Tubi’s site. ¶ 24. Beyond that, Campos’s complaint further alleges that Tubi has partnered with TransUnion, a credit reporting agency, to accumulate even more personal data about its users for, as a cited press release implies, the purpose of further targeting ads to users. ¶ 31 . These facts provide ample grounds to infer that Tubi collects users’ data, including individual-level viewing history and other PII, for the purposes of targeting them with ads. To be sure, collecting data like information about the user’s identity, location, viewing device, and content viewing history does not itself violate the VPPA. Nor is aggregating or anonymizing it and sharing with third parties. Rather, Campos must have alleged sufficient factual material that makes it plausible that Tubi disclosed the combination of viewing history and individual-identifying data to third parties. With respect to pleading this fact, the complaint alleges that Tubi disclosed the relevant combination of information to third-party advertising companies. In support of that allegation, it again cites to Tubi’s Privacy Policy. The Policy states that Tubi “may” share the information that it collects about its users with third parties such as business partners, advertising technology companies, and advertisers. ¶ 26. The version of the Privacy Policy that Tubi attached to its motion to dismiss goes beyond the conjectural “may” language to affirm that Tubi discloses the relevant categories of information to others in connection with advertising and marketing purposes.7 This language can be found in the sections providing notice in compliance with the California Consumer Privacy Act and several other states’ consumer protection laws. Ex. B at pp. 9-19, ECF No. 13-2.8 Campos also alleges that Tubi partnered with TransUnion to improve its advertisers’ abilities to target individual users using Tubi’s data, ¶ 33; a Mozilla Foundation review of Tubi “confirms that Tubi matches third-party data to ‘existing customers’ to allow advertisers to target specific individuals,” ¶ 34; and (3) Tubi’s 2023 “Audience Insights” report suggests that Tubi collects and discloses its subscribers’ viewing data at multiple points, ¶¶ 29-31. B. Sufficiency of the Complaint. Throughout its briefing, Tubi seeks to hold Campos to an excessively high pleading standard and unduly ignores Campos’s factual allegations. It argues that: Far from presenting any analysis of Tubi’s website and platform— such as by forensically tracking the purported VPPA PII that allegedly traveled from Tubi’s platform to its advertisers—Plaintiff does not identify how Tubi allegedly transmits VPPA PII to third parties; the specific types of data points that Tubi allegedly transmits; the specific third parties to whom Tubi allegedly 7 It does not explicitly state that it discloses the two relevant categories of information— (1) users’ identities and (2) their video watching history—together (meaning in a way where the two pieces of information can be linked). But it does indicate that Tubi discloses both. 8 Tubi attached a Privacy Policy document that notes it is effective as of July 1, 2023. It is unclear whether this was the policy in place at the time of Campos’s usage and, if not, whether and how the relevant portions of the policy have changed since then. Since the parties do not contest the validity or relevance of the document, the Court considers it in issuing this ruling. transmits the VPPA PII; or whether Tubi allegedly transmits the VPPA PII in a form that would reveal the “connection” between “the consumer’s identity” and “the video material’s identity.” Memo. at 16 (quoting In re Hulu Priv. Litig., 86 F. Supp. 3d at 1095 ). The VPPA claim at issue is not subject to Fed. R. Civ. P. 9(b)’s heightened standard for allegations sounding in fraud. Campos does not need to plead the circumstances of every alleged disclosure with particularity. This is especially so given the informational asymmetry at play; Tubi would not, of course, have made Campos privy to any potential disclosures. “Fed. R. Civ. P. 8(a)(2) requires only ‘a short and plain statement of the claim showing that the pleader is entitled to relief.’ Specific facts are not necessary; the statement need only ‘give the defendant fair notice of what the . . . claim is and the grounds upon which it rests.’” Erickson v. Pardus, 551 U.S. 89, 93 (2007) (quoting Fed. R. Civ. P. 8(a)(2) and Twombly, 550 U.S. at 555). Neither Twombly nor Iqbal undermined Rule 8’s notice-pleading regime, which simply requires that “the plaintiff must give enough details about the subject-matter of the case to present a story that holds together.” Swanson v. Citibank, N.A., 614 F.3d 400 (7th Cir. 2010). Here, Tubi has fair notice of the nature of the claim against it. Does it collect and then disclose users’ viewing history and specific-individual-identifying information, such as names, demographic info, and device and location information, ¶ 35, to third-party advertisers and advertising companies, ¶ 6, to enable individual-level ad targeting, as its Privacy Policy implies it has permission to do, ¶¶ 6, 27, 33? Contrast Campos’s complaint with what would be a “barebones,” merely cause-of-actionreciting VPPA complaint: “Tubi collects and shares information which identifies me as having requested or obtained specific video materials or services from Tubi without my or other users’ consent.” Tubi would have no notice of the claim against it, and allowing the case to proceed to discovery would not be appropriate in such a situation. What kind of information did Tubi collect and share, and with whom? Did Tubi share people’s names and watch histories with curious journalists looking to find out what kinds of content certain users watched? Did Tubi sell email addresses and movie history to data brokers/aggregators who would then go on to reorganize and sell that data to content creators like movie studios? The possibilities are endless, and that is why that sort of complaint would not be permitted to proceed. Here, on the other hand, Campos has alleged a specific claim based on specific factual allegations and circumstantial evidence. As with any case, those allegations may ultimately prove untrue, but the merits of Campos’s claim does not matter at this stage—only its plausibility. Despite Campos’s low bar at the pleading stage, Tubi takes issue with several of her allegations and her characterizations of the documentary evidence to which her complaint refers. And Tubi is right that, contrary to Campos’s suggestion, none of the documents “make clear” that Tubi discloses users’ PII to third parties in a non-VPPA-compliant manner—meaning in a manner that would permit the third party to learn an individual’s identity and their viewing history. Tubi’s arguments about the Audience Insights report, for instance, are well taken. The portions of the Audience Insights report to which Campos cites are benign and entirely consistent with Tubi disclosing anonymized and/or aggregated data, which the VPPA does not prohibit. Campos does not respond to this point in her opposition brief, and the Court is disinclined to give any weight to that document at this juncture. But, as discussed below, Campos does not need to have found an admission of liability by Tubi in each of its documents to survive the motion to dismiss. Nor do each of Campos’s factual allegations need to be proven by the documents they reference; as long as those documents do not directly controvert her allegations, thereby showing that she pleaded herself out of court, she is entitled to have the Court draw all reasonable inferences from their contents in her favor. See Massey v. Merrill Lynch & Co., Inc., 464 F.3d 642, 650 (7th Cir. 2006) (“[A]s a general concept, a party need not plead much to survive a motion to dismiss: a party need not plead specific facts, legal theories, nor anticipate any defenses. The dangers almost always come from pleading too much—not too little. Thus, a party may plead itself out of court by either including factual allegations that establish an impenetrable defense to its claims or by attaching exhibits that establish the same.” (internal citations omitted)); see also Tamayo v. Blagojevich, 526 F.3d 1074, 1086 (7th Cir. 2008) (“A plaintiff pleads himself out of court when it would be necessary to contradict the complaint in order to prevail on the merits. If the plaintiff voluntarily provides unnecessary facts in her complaint, the defendant may use those facts to demonstrate that she is not entitled to relief.” (cleaned up)). Here, none of the documents directly contradict her claims, and some, e.g., the Privacy Policy, provide fertile grounds for drawing the reasonable inferences that Campos needs to make her claim plausible. With respect to the Privacy Policy, Tubi argues that it does not bear out Campos’s claim about disclosure because (1) it uses permissive language (i.e., only says that Tubi “may” share certain categories of information) and (2) nowhere does the Privacy Policy state that it may or may not—let alone will or will not—share the relevant data combination: information about an individual’s identity in conjunction with their viewing history. But Tubi’s argument about the Privacy Policy is misplaced. Tubi cites a case for the proposition that “allegations about what defendant ‘might’ do were impermissibly conclusory.” Memo. at 12 (citing U.S. ex rel. Fowler v. Caremark RX, Inc., No. Civ.A.03 C 8714, 2006 WL 3469537 , at *9 (N.D. Ill. Nov. 30, 2006)). But there is a critical difference between that case and this one: here, Campos isn’t alleging that Tubi might disclose users’ VPPA PII; rather, she firmly alleges that Tubi does disclose users’ VPPA PII, and she bases that in part on Tubi’s own warnings that it may choose to do so and, as discussed, some instances where it says it actually will. And although the Privacy Policy does not explicitly say that it shares the relevant VPPAPII combination with third parties, it does state that it discloses both categories of information, and it states that “We and our advertising partners use certain personal information to deliver online advertisements to you on your devices tailored to your interests. This may be considered ‘Selling or Sharing’ under California law and ‘Targeted Advertising’ under Virginia and other state privacy laws.” That Tubi knowingly disclosed the relevant combination of information to its advertising partners, in contravention of the VPPA, is a plausible inference based on the Privacy Policy, in tandem with the other facts that Campos has alleged and that the Court must take as true.. Tubi cites a few cases where courts declined to find plausible privacy claims based on subjunctive language in defendants’ privacy policies. See Nashel v. New York Times Co., No. 2:22CV-10633, 2022 WL 6775657 (E.D. Mich. Oct. 11, 2022); Gamez v. VF Corp., No. CV 18-6246, 2018 WL 6333560 , at *3 (C.D. Cal. Nov. 21, 2018). These can be distinguished by the simple fact that Tubi’s Policy not only includes suspicious “may” language but actually later affirms that Tubi disclosed various categories of information to third parties.9 See, e.g., Gottsleben v. Informa 9 Tubi argues that since Campos did not cite that language specifically in her complaint, she should not be permitted to rely on it because that would be akin to amending her compliant via response brief. Reply at 11-12 (citing Pirelli Armstrong Tire Corp. Retiree Med. Benefits Tr. v. Walgreen Co., 631 F.3d 436, 448 (7th Cir. 2011)). But that is not what Campos does. Campos cites the Privacy Policy in support of her allegation that Tubi collects and discloses subscriber information. Tubi attached the whole Policy, thus bringing the portions that Campos did not quote into the scope of the pleadings. That is different from the amendment-through-response in Pirelli. 631 F.3d at 448 (affirming dismissal of plaintiff’s unjust enrichment claim because it was not pleaded as an alternative to the inviable fraud theory, though the plaintiff attempted to restyle it as an alternative pleading through its response brief). In any event, the Seventh Circuit has explained many times that a plaintiff may supplement the fact allegations of a complaint in response to a motion to dismiss so long as the supplementary information is consistent with the allegations of the complaint. See, e.g., Denwiddie v. Mueller, 775 F. App’x 817 , 819-20 (7th Cir. 2019) (“We consider both her complaint and the additional allegations, consistent with the complaint, that she Media, Inc., No. 1:22-CV-866, 2023 WL 4397226 at *5 (W.D. Mich. July 7, 2023) (finding a claim about improper disclosure of customer subscription information viable because, inter alia, the Gottsleben defendant’s privacy policy, unlike in Nashel, “indicated that it was disclosing customer information to third parties,” and drawing reasonable inference from the privacy policy’s indication of disclosure of “customer information” that “information about its customers’ subscriptions” was also disclosed.). The present case can also be distinguished on the basis that Campos’s complaint is not reliant solely on the Privacy Policy’s language. In short, Campos does not need a “smoking gun” in her complaint. The relevant pieces of circumstantial evidence, such as Tubi’s own words saying that it might engage in various aspects of the accused conduct, in conjunction with the other factual allegations about Tubi’s practices, its emphasis on hyper-specific ad targeting, and business model—some supported by suggestive documentary evidence—are sufficient to support the plausibility of Campos’s claim. Cf. In re Text Messaging Antitrust Litig., 630 F.3d 622, 628-29 (7th Cir. 2010) (“We need not decide whether the circumstantial evidence that we have summarized is sufficient to compel an inference of conspiracy; the case is just at the complaint stage and the test for whether to dismiss a case at that stage turns on the complaint’s ‘plausibility.’” (emphasis in original)). After taking those factual allegations as true and drawing reasonable inferences based on those allegations and the raised in response to the motion to dismiss.”) (citing Smith v. Dart, 803 F.3d 304, 311 (7th Cir. 2015)). documentary evidence in Campos’s favor, the Court has no trouble finding that Campos’s complaint generates “a nonnegligible probability that the claim is valid.” Jd. * * * For the foregoing reasons, defendant Tubi’s motions to compel arbitration and to dismiss are both denied. fe i. eye Dated: February 8, 2024 John J. Tharp, Jr. United States District Judge