/>iAs technology evolves, old laws can gain new life. Over the past few years, plaintiffs have been using decades-old privacy statutes, including pen register, wiretapping, interception and video protection statutes, taking what were previously considered well-established rules with a relatively limited scope and using them to challenge businesses that incorporate popular new technologies to engage with their consumers. Typically, these lawsuits have not progressed very far — most either result in a settlement or are dismissed. But a recent decision reflects what might happen when these cases proceed past the pleading stage.
In one of the first cases of its kind to reach a class certification determination, the United States District Court for the Southern District of Florida recently refused to certify a proposed class of Univision NOW subscribers who alleged that Univision NOW shared their identities and viewing histories with Meta Platforms. Specifically, the class representatives alleged Univision NOW, a Spanish-language video-streaming service, used a tracking pixel — Meta Pixel — to collect and transmit their personal viewing information without their knowledge and consent in violation of the federal Video Privacy Protection Act (VPPA). The plaintiffs asserted that Univision NOW embedded a Meta Pixel on its website to track users as they navigated the site, and the pixel then reported back to the pixel’s owner, Meta Platforms. The plaintiffs sought class certification of all Univision NOW subscribers whose information was allegedly disclosed to Meta.
History of the VPPA
Congress passed the VPPA in 1988 in response to concerns about the privacy of consumers’ video rental history, particularly after Supreme Court nominee Robert Bork had his video rental history exposed in a newspaper article during his confirmation hearing. In short, the VPPA prohibits “video tape service providers” from knowingly disclosing a consumer’s personal identifying information together with their video viewing history without informed written consent. It provides actual or liquidated damages of $2,500 per violation, plus attorney’s fees, litigation costs and injunctive relief. The VPPA, historically applied to video store rentals, has seen a recent increase in use in privacy class actions against website owners with video functionality on their websites. Plaintiffs in these more recent lawsuits contend that a tracking pixel — such as a Google pixel or a Meta Pixel — embedded on a website constitutes an unlawful disclosure of their video viewing history.
The perceived strength of these claims has fluctuated significantly over the past two years. By fall 2023, it was thought that the VPPA class action wave would be slowed by a relatively high dismissal rate. While over 100 VPPA class actions were brought against online news outlets, streaming services, retailers and others that integrated pixel tracking, 17 were dismissed by courts, 29 were voluntarily dismissed by plaintiffs and only 19 resulted in classwide settlements or other public statements. However, a Second Circuit Court of Appeals opinion from earlier this year revived a previously dismissed VPPA claim, purportedly breathing some new life into the viability of these claims. The Southern District of Florida, however, is one of the first courts to consider the certification of a VPPA class.
The Univision NOW Case
In spring 2023, subscribers to Univision NOW brought a claim against the streaming service under the VPPA for its use of the Meta Pixel. Although Univision NOW filed a motion to dismiss, the district court denied the motion. The court was unpersuaded by Univision NOW’s arguments that the allegations against it were too vague, that it did not act “knowingly” and that the plaintiffs lacked standing. The case was allowed to proceed, and the plaintiffs had seven months to gather enough evidence to certify their class.
After class certification discovery, the plaintiffs filed their certification motion seeking to represent a class of Univision NOW subscribers. On October 1, 2024, nearly one year after rejecting Univision NOW’s motion to dismiss, the district court rejected the plaintiffs’ request for class certification, largely due to their failure to satisfy “numerosity,” one of the four essential elements required for class certification under the Federal Rule of Civil Procedure 23(a). The plaintiffs were unable to prove the numerosity requirement because the evidence was too speculative to rely on to identify a sufficiently large number of individuals reportedly affected by Univision NOW’s VPPA violation. The plaintiffs had argued that Univision NOW disclosed the viewing information of over 35,000 subscribers but acknowledged there were a number of impediments to Univision’s transmission of information to Meta.
The plaintiffs’ theory of automatic data transmission was undercut by their concessions to Univision NOW’s expert testimony that various conditions must be met for the pixel to automatically transmit. In addition to viewing or selecting a prerecorded video through the website, a subscriber must also have (1) a Facebook account at the time video was selected, (2) used a web browser that did not block the pixel by default, (3) been simultaneously logged into the subscriber’s own Facebook account while selecting the video, (4) been simultaneously logged into Facebook on the same device that the subscriber used to select the video, (5) been simultaneously logged into Facebook using the same browser from which the subscriber selected the video and (6) not deployed any number of browser settings or add-on software that would have blocked the pixel. While the court found that the putative class members were ascertainable because the number of subscribers could be identified with reasonable feasibility, class certification was not warranted because the plaintiffs failed to show that Univision NOW disclosed the personal information and record of videos viewed by a single subscriber (including the three named plaintiffs). The court referred to the plaintiffs’ failure to supply anything more than speculation of the class size as “particularly problematic.”
The plaintiffs tried to save their class certification request by reducing the potential class to approximately 17,000 individuals, based on estimates of individuals who used Facebook and certain web browsers, but the court found that plaintiffs had ignored certain expert testimony that limited this number to roughly 15,000. The court then concluded that even those estimates were still too speculative based on the conditions required for transmission of the information. Without the ability to determine class size, the plaintiffs failed to satisfy the numerosity requirement. With the plaintiffs having failed to establish this essential requirement, the court declined to evaluate whether the class would have satisfied any of Rule 23(a)’s other elements, namely, commonality (whether the class would have shared legal questions among the group), typicality (whether the representative plaintiffs’ claims were typical of the class) or adequacy of representation.
The U.S. District Court for the Southern District of Florida’s focus on numerosity reflects that plaintiffs have a substantial burden to prove with evidence that they can identify a class of people who were affected by the claims alleged. The burden is on the plaintiff to prove their claims for certification, not on the defendants to prove the negative. Compared to commonality or typicality, which usually require a deeper examination of the legal issues and factual similarities across the class, numerosity usually only requires basic evidence of class size. While numerosity is often an overlooked element in class actions, the Univision NOW case is an example where the courts will not simply give lip service to an allegation that the number of people impacted is significant; instead, plaintiffs must bring forth proof that the number of individuals affected by the conduct meets class certification requirements. Given that pixel-tracking allegations may rely on a set of assumptions regarding who has accessed a website, what they have accessed, when they did so and how, as well as what conditions exist for the transmission of data, defendants may be able to stop VPPA classes from being certified, reduce litigation costs and avoid expensive payouts.
