The US Court of Appeals for the Second Circuit has repeatedly affirmed dismissals of putative class actions brought under the Video Privacy Protection Act (VPPA) based on the use of third-party tracking technologies. The Second Circuit found that strings of code transmitted by the Meta Pixel do not constitute “personally identifiable information” for purposes of the VPPA because it’s not information that would readily permit an ordinary person to identify a specific individual’s video-watching behavior.
In Solomon v. Flipps Media Inc.[1] and Hughes v. NFL[2], the Second Circuit enforced this important limitation on the VPPA’s applicability to websites’ use of tracking technologies such as the Meta Pixel. In the court’s own words, its decision in Solomon “effectively shut the door for Pixel-based VPPA claims.”[3]
BACKGROUND OF PIXEL-BASED VPPA LITIGATION
The VPPA[4] is a 1988 statute that Congress enacted in response to a newspaper publishing a list of 146 films that former US Supreme Court nominee Robert Bork had rented from brick-and-mortar video stores.
To state a claim under the VPPA, a plaintiff must plead and prove that a video tape service provider knowingly disclosed a consumer’s “personally identifiable information” (PII) to a third party. Critically, the statute does not define PII. The statute’s lack of clarity has resulted in plaintiffs’ attorneys attempting to revive the decades-old law into a context that was unforeseen at the time of its enactment: video content viewable via the internet.
Using the VPPA, plaintiffs’ attorneys have targeted tracking pixels routinely deployed on websites. These technologies, often supplied by third-party social media companies such as Meta and consented to by users, can provide analytics regarding a user’s activity on websites, including purchase actions and content viewed. Among other things, this may allow for targeted advertising (such that a user receives ads more likely to be of interest to them).
THE SOLOMON DECISION
In Solomon, the Second Circuit grappled with the applicable standard to determine whether the information at issue constituted PII under the VPPA. It followed the Third and Ninth Circuits’ view, known as the ordinary person standard. Under this standard, PII “encompasses information that would allow an ordinary person to identify a consumer’s video-watching habits, but not information that only a sophisticated technology company could use to do so.”[5] In other words, the question was whether the complaint plausibly alleged that the disclosed information “would, with little or no effort, permit an ordinary recipient to identify [the plaintiff’s] video matching habits.”[6]
The court then applied the ordinary person standard in the context of the Meta Pixel. The Pixel allegedly transmitted the title of a video on the defendant’s website along with the user’s Facebook ID. However, the court found that although the video’s title was present in the transmitted data, an ordinary person would not understand, with little or no extra effort, that it was a video title. This is because the video’s title was contained within 29 lines of computer code, interrupted by various numbers, letters, and characters.
Similarly, the court found that the plaintiff failed to plausibly allege the plaintiff’s Facebook ID embedded in a string of code was PII because an ordinary person, without assistance, would not understand it to be disclosing plaintiff’s identity. Thus, the Second Circuit affirmed the dismissal and held that neither (1) the video’s title nor (2) the user’s Facebook ID constituted PII under the VPPA.
HUGHES EXPANDS ON SOLOMON’S REASONING
Just over a month after deciding Solomon, the Second Circuit again faced a Meta Pixel VPPA claim in Hughes. The court held that Solomon was not limited to the particular facts of that case, but rather applied broadly to “effectively shut the door for Pixel-based VPPA claims.”[7]
Further, the court rejected three new arguments advanced by the plaintiff that were not present in Solomon: (1) Facebook receives Pixel transmissions in a readable form, (2) an ordinary person could plug the code into widely used tools such as ChatGPT to “translate” the code and reveal the Facebook ID and video title in plain English, and (3) Facebook is nearly ubiquitous, with 75% of Americans holding an account.
In rejecting all three arguments, the court held that the only relevant inquiry is “whether an ordinary person would be able to understand the actual underlying code communication itself.”[8] Therefore, the court found that the plaintiff’s first two arguments—both of which related to how the code could later be manipulated by the user or viewed by Facebook—were irrelevant to the PII inquiry.
Regarding the ubiquity of Facebook, the court determined that this fact “has no bearing on the ability of ordinary people to interpret the Pixel communications depicted in Hughes’ complaint.”[9] Accordingly, the Second Circuit affirmed dismissal of the plaintiff’s complaint without leave to amend.
IMPLICATIONS OF SOLOMON AND HUGHES
The Second Circuit’s decisions have several important implications.
First, these decisions effectively cut off Second Circuit district courts as a viable path for Meta Pixel-based VPPA claims. The court has now (twice) made its point abundantly clear—similar allegations about PII embedded in blocks of code are insufficient to state a VPPA claim. With the Second Circuit’s law settled, defendants now stand on far stronger grounds to seek dismissal of run-of-the-mill VPPA claims involving a Facebook ID and a video’s URL.
Second, the court’s outright rejection of the after-the-fact manipulation arguments advanced by the plaintiff in Hughes further affirms the clarity provided by Solomon. For example, a plaintiff cannot evade the ordinary person standard by using tools to help understand the code. If the content does not “with little or no effort” permit an ordinary person to identify the plaintiff’s video matching habits, then it’s not PII.
Third, Solomon and Hughes will likely play an important role in shaping other jurisdictions’ application of the VPPA to tracking pixel cases. The Third Circuit[10] and Ninth Circuit[11] have both adopted the ordinary person standard. The Second Circuit’s reasoning will likely be persuasive as other federal courts consider the PII question in this context.
[1] Solomon v. Flipps Media, Inc., 136 F.4th 41 (2d Cir. 2025).
[2] Hughes v. Nat’l Football League, No. 24-2656, 2025 WL 1720295 (2d Cir. June 20, 2025).
[3] Id. at *2.
[4] 18 USC § 2710.
[5] Solomon, 136 F.4th at 52 (emphasis added).
[6] Id. at 54 (quoting In re Nickelodeon Consumer Priv. Litig., 827 F.3d 262, 284 (3d Cir. 2016) (internal quotations omitted)).
[7] Hughes, 2025 WL 1720295, at *2.
[8] Id. at *3.
[9] Id.
[10] See In re Nickelodeon Consumer Priv. Litig., 827 F.3d 262, 267 (3d Cir. 2016).
[11] See Eichenberger v. ESPN, Inc., 876 F.3d 979, 985 (9th Cir. 2017).
[View source.]
