Document ID: s3://data.kl3m.ai/documents/govinfo/USCOURTS/USCOURTS-ca9-12-17045/USCOURTS-ca9-12-17045-0/pdf.json

Parties Involved:
Tracy Hellwig
Appellant
Meghan Mollett
Appellant
Netflix, Inc.
Appellee

Document Text:

FOR PUBLICATION

UNITED STATES COURT OF APPEALS

FOR THE NINTH CIRCUIT

MEGHAN MOLLETT and TRACY

HELLWIG, individually on behalf of

themselves and all others similarly

situated,

Plaintiffs-Appellants,

v.

NETFLIX, INC., a Delaware

Corporation,

Defendant-Appellee.

No. 12-17045

D.C. No.

11-cv-01629-

EJD-PSG

OPINION

Appeal from the United States District Court

for the Northern District of California

Edward J. Davila, District Judge, Presiding

Argued and Submitted

February 6, 2015—San Francisco, California

Filed July 31, 2015

 Case: 12-17045, 07/31/2015, ID: 9629852, DktEntry: 26-1, Page 1 of 11
2 MOLLETT V. NETFLIX, INC.

Before: Richard C. Tallman and Johnnie B. Rawlinson,

Circuit Judges, and Raymond J. Dearie, Senior District

Judge.*

Opinion by Judge Dearie

SUMMARY**

Video Privacy Protection Act

The panel affirmed the dismissal of claims brought under

the Video Privacy Protection Act and California Civil Code

§ 1799.3 against Netflix, Inc., a subscription videostreaming

service.

The panel held that Netflix did not violate these statutes

by permitting certain disclosures about subscribers’ viewing

history to third parties ̄specifically subscribers’ family,

friends, and guests. The panel concluded that the

complained-of disclosures were lawfully made to Netflix’s

own subscribers and, therefore, were not actionable under the

VPPA or the California Civil Code.

* Honorable Raymond J. Dearie, Senior District Judge for the U.S.

District Court for the Eastern District of New York, sitting by designation.

** This summary constitutes no part of the opinion of the court. It has

been prepared by court staff for the convenience of the reader.

 Case: 12-17045, 07/31/2015, ID: 9629852, DktEntry: 26-1, Page 2 of 11
MOLLETT V. NETFLIX, INC. 3

COUNSEL

Rachele R. Rickert (argued), Francis M. Gregorek, Betsy C.

Manifold, and Marisa C. Livesay, Wolf Haldenstein Adler

Freeman & Herz LLC, San Diego, California; Mary Jane Fait

and Theodore B. Bell, Wolf Haldenstein Adler Freeman &

Herz LLC, Chicago, Illinois, for Plaintiffs-Appellants.

Keith E. Eggleton (argued), Rodney G. Strickland, Jr., Brian

M. Willen, and Jessica L. Snorgrass, Wilson Sonsini

Goodrich & Rosati, Palo Alto, California, for DefendantAppellee.

OPINION

DEARIE, Senior District Judge:

Plaintiffs-Appellants Meghan Mollett and Tracy Hellwig

appeal the district court’s dismissal of their claims against

Defendant-Appellee Netflix, Inc. (“Netflix”), a subscription

video streaming service, for violations of the Video Privacy

Protection Act (“VPPA”), 18 U.S.C. § 2710, and California

Civil Code § 1799.3. On behalf of themselves and other

similarly-situated Netflix subscribers, Plaintiffs allege that

Netflix violated these statutes by permitting certain

disclosures about their viewing history to third

parties—specifically, subscribers’ family, friends, and guests.

We conclude, however, that the complained-of disclosures

were lawfully made to Netflix’s own subscribers and,

therefore, are not actionable under the VPPA or the California

Civil Code. We affirm the decision of the district court.

 Case: 12-17045, 07/31/2015, ID: 9629852, DktEntry: 26-1, Page 3 of 11
4 MOLLETT V. NETFLIX, INC.

I.

Netflix is the world’s largest subscription service for

viewing movies, television programs, and other video

content. The company launched in 1999 as an online DVD

rental service that delivers DVDs to subscribers through the

mail, and expanded in 2007 to allow subscribers to stream

videos instantly online. As of the filing of Plaintiffs’

complaint, Netflix had more than 20 million subscribers;

approximately 48 percent use the service’s instant streaming

feature.

To become a Netflix subscriber, a consumer must create

an account on Netflix’s website. As part of the account setup,

a consumer must create a password, which she must enter

whenever logging into the account. Once a subscriber has an

account, she can begin ordering videos. Depending on the

type of account the subscriber purchased, she can either order

DVDs for home delivery or stream videos instantly over the

Internet, or both. To ease the ordering of DVDs for home

delivery, a subscriber can create a list of DVDs that she

wishes to view. That list is known as the “queue.” Depending

on the terms of subscription, Netflix mails one or more of the

DVDs listed in the queue to the subscriber. Once a subscriber

returns a DVD to Netflix, Netflix mails out the next available

DVD in the subscriber’s queue.

Many of the videos in a subscriber’s queue can also be

viewed instantly by streaming them over the Internet onto a

subscriber’s computer or portable computing device,

including televisions or video game systems. To stream a

video instantly, a subscriber simply logs into her passwordprotected account, selects a video, and presses play. Videos

that are available for instant streaming can be displayed on a

 Case: 12-17045, 07/31/2015, ID: 9629852, DktEntry: 26-1, Page 4 of 11
MOLLETT V. NETFLIX, INC. 5

subscriber’s television through use of a Netflix-ready device,

such as a video game console, an Internet-connected

television, or a specially-designed DVD player. In order to

stream a video on a television through a Netflix-ready device,

a subscriber must first register the device in the subscriber’s

password-protected online account. After the device is

activated and connected to a television, the subscriber can

play videos by turning on the television and selecting a video

available through Netflix. A password is not required to

watch a video once the Netflix-ready device is activated.

To assist its subscribers in adding videos to their queues

or selecting videos to watch instantly, Netflix provides its

customers with lists of recommended videos. These

recommendations are generated through the use of predictive

software that analyzes, among other things, a subscriber’s

rental history. Recommendations are displayed to subscribers

through category-based lists. For instance, when Netflix

recommends movies based on a subscriber’s recentlywatched video, suggested movies are placed in a list titled

“Like [Name of Recently-Watched Film]” or “Because You

Liked [Name of Recently-Watched Film].” These lists of

recommended films include each video’s title, an image of its

DVD cover art, a written description of the video’s content,

and its Motion Picture Association of America rating.

Netflix displays a subscriber’s queue and

recommendation lists automaticallyon a subscriber’s account

home page. Once a subscriber has connected her account to

a Netflix-ready device, these lists are also automatically

displayed on the subscriber’s television when the television

is turned on and Netflix is activated. Specifically, Netflix

displays a list of “recently watched” video titles, the

subscriber’s queue, and lists of video titles recommended by

 Case: 12-17045, 07/31/2015, ID: 9629852, DktEntry: 26-1, Page 5 of 11
6 MOLLETT V. NETFLIX, INC.

Netflix. While a subscriber can edit and delete titles from her

queue, she cannot hide or remove the queue or the other lists

displayed by Netflix. The contents of these lists, as a result,

are visible to family members, friends, or guests of Netflix

subscribers who use a subscriber’s account to stream videos,

or are in the presence of a subscriber when she is accessing

her account through a Netflix-ready device. Plaintiffs alleged

in their April 4, 2011, complaint that these disclosures violate

the VPPA and California Civil Code § 1799.3.

In its motion to dismiss for failure to state a claim, Netflix

asserts that (1) its disclosures of personal information are

made to subscribers themselves and therefore permissible,

and (2) any disclosures to third parties are not made

knowingly, as required by the VPPA, or in willful violation

of the law, as required byCalifornia Civil Code § 1799.3. The

district court granted Netflix’s motion on both of these

grounds and dismissed Plaintiffs’ complaint with prejudice.

Plaintiffs timely appealed the district court’s order.

II.

“We review de novo the district court’s grant of a motion

to dismiss under Rule 12(b)(6), accepting all factual

allegations in the complaint as true and construing them in

the light most favorable to the nonmoving party.” Skilstaf,

Inc. v. CVS Caremark Corp., 669 F.3d 1005, 1014 (9th Cir.

2012). “To survive a motion to dismiss, a complaint must

contain sufficient factual matter, accepted as true, to ‘state a

claim to relief that is plausible on its face.’” Ashcroft v. Iqbal,

556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v.

Twombly, 550 U.S. 544, 570 (2007)). We will uphold a

district court’s decision to dismiss “where there is either a

lack of a cognizable legal theory or the absence of sufficient

 Case: 12-17045, 07/31/2015, ID: 9629852, DktEntry: 26-1, Page 6 of 11
MOLLETT V. NETFLIX, INC. 7

facts alleged under a cognizable legal claim.” Hinds Invs.,

L.P. v. Angioli, 654 F.3d 846, 850 (9th Cir. 2011).

III.

A.

The interpretation of this section of the VPPA is an issue

of first impression for this Circuit. The VPPA was enacted in

1988 in response to the Washington City Paper’s publication

of then-Supreme Court nominee Robert Bork’s video rental

history. See S. Rep. 100-599, at 5 (1988), reprinted in 1988

U.S.C.C.A.N. 4342-1. The paper had obtained (without Judge

Bork’s knowledge or consent) a list of the 146 films that the

Bork family had rented from a Washington, D.C.-area video

store. Id. Members of the Judiciary Committee “denounced

the disclosure” and Congress acted swiftly to enact the

VPPA. Id. According to the Senate Report on the VPPA,

Congress’s purpose when enacting the statute was “[t]o

preserve personal privacy with respect to the rental, purchase

or delivery of video tapes or similar audio visual materials.”

Id. at 1.

“The Act allows consumers to maintain control over

personal information divulged and generated in exchange for

receiving services from video tape service providers. The Act

reflects the central principle of the Privacy Act of 1974: that

information collected for one purpose may not be used for a

different purpose without the individual’s consent.” Id. at 8.

Congress’s intent in passing the VPPA therefore evinces the

principle that protection is merited when the consumer lacks

control over the dissemination of the information at issue.

 Case: 12-17045, 07/31/2015, ID: 9629852, DktEntry: 26-1, Page 7 of 11
8 MOLLETT V. NETFLIX, INC.

Consistent with Congress’s purpose, the statute’s

language is broad. The VPPA prohibits a “video tape service

provider” from knowingly disclosing “personally identifiable

information” about one of its consumers “to any person,” and

provides for liquidated damages in the amount of $2,500 for

violation of its provisions. 18 U.S.C. §§ 2710(b) and

2710(c)(2) (emphasis added). The VPPA, however, does not

prohibit all disclosures. The Act provides several exceptions

to the disclosure prohibition, allowing disclosure of a

consumer’s video rental history to the consumer himself, or

to third parties when the consumer has provided written

consent or the third party has obtained a warrant or court

order. Id. § 2710(b)(2). Relevant here is section

2710(b)(2)(A), which permits video tape service providers to

“disclose personally identifiable information concerning any

consumer . . . to the consumer.” Id. § 2710(b)(2)(A). The

VPPA defines the term “consumer” as “any renter, purchaser,

or subscriber of goods or services from a video tape service

provider.” Id. § 2710(a)(1). The VPPA does not define the

term “disclosure.” A video service provider that makes a

disclosure of personally identifiable information to a

consumer or subscriber is not subject to civil liability.

Therefore, in order to plead a plausible claim under

section 2710(b)(1), a plaintiff must allege that (1) a defendant

is a “video tape service provider,” (2) the defendant disclosed

“personally identifiable information concerning any

customer” to “any person,” (3) the disclosure was made

knowingly, and (4) the disclosure was not authorized by

section 2710(b)(2). At dispute here are the third and fourth

elements.

Based on the allegations in the complaint, Plaintiffs have

failed to plead a plausible violation of the VPPA because, as

 Case: 12-17045, 07/31/2015, ID: 9629852, DktEntry: 26-1, Page 8 of 11
MOLLETT V. NETFLIX, INC. 9

we now hold, the disclosure alleged by Plaintiffs is a

disclosure “to the consumer” that is permitted by the Act. The

complaint alleges that upon setting up a Netflix account,

personally identifiable information, by default, is only

disclosed to a Netflix subscriber through her passwordprotected account. Under those circumstances, a subscriber’s

queue or recommendation lists are only viewable by the

subscriber. Netflix subscribers can then elect to display on

their televisions what would otherwise be password-protected

information by registering Netflix-ready devices in their

accounts. Thereafter, Netflix automatically displays on a

television what it displays on a subscriber’s computer:

streamed instant videos, the subscriber’s queue, and video

recommendations. This is plainly a disclosure “to the

consumer” as contemplated by the VPPA. When Netflix

displays a subscriber’s queue, viewing history, or

recommendation lists in her online account, that is a

disclosure directly to the consumer. The nature of that

disclosure does not change when subscribers choose to

display the same content on their television screens. The

subscriber’s choice to do so does not trigger some new

statutory duty on the part of Netflix.

The fact that a subscriber may permit third parties to

access her account, thereby allowing third parties to view

Netflix’s disclosures, does not alter the legal status of those

disclosures. No matter the particular circumstances at a

subscriber’s residence, Netflix’s actions remain the same: it

transmits information automatically to the device that a

subscriber connected to her Netflix account. The lawfulness

of this disclosure cannot depend on circumstances outside of

Netflix’s control. There is nothing to suggest that the VPPA

prohibits disclosures “to the consumer” when they are

incidentally also received by third parties as the subscriber

 Case: 12-17045, 07/31/2015, ID: 9629852, DktEntry: 26-1, Page 9 of 11
10 MOLLETT V. NETFLIX, INC.

may independently permit. Our conclusion is consistent with

the legislative intent of the VPPA—where the subscriber

controls which third parties may access her Netflix account

and where the “personally identifiable information” is

disclosed to only a select group of individuals, both the letter

and the spirit of the law are sustained.

Plaintiffs insist that Netflix is required to transmit

information in a reasonably secure manner or undertake

certain technical fixes to prevent incidental disclosures to

third parties. But the VPPA does not prescribe a technical

regime for disclosure. “Just because Congress’[s] goal was to

prevent the disclosure of private information, does not mean

that Congress intended the implementation of every

conceivable method of preventing disclosures.” Daniel v.

Cantrell, 375 F.3d 377, 384 (6th Cir. 2004). To hold

otherwise would convert section 2710(b)(1) from a

prohibition on unlawful disclosure to a requirement of secure

disclosure—an outcome plainly not supported bythe VPPA’s

text.

As plaintiff’s complaint pleads only a lawful disclosure

under the VPPA, the district court was correct to dismiss the

first count of Plaintiffs’ complaint. We need not, therefore,

address whether Plaintiffs adequately alleged a “knowing”

disclosure.

B.

The second count of Plaintiffs’ complaint alleges that

Netflix disclosed its subscribers’ personal information to third

parties in violation of California Civil Code § 1799.3. Netflix

argues, as it did with respect to count one, that California law

 Case: 12-17045, 07/31/2015, ID: 9629852, DktEntry: 26-1, Page 10 of 11
MOLLETT V. NETFLIX, INC. 11

authorizes its disclosure and that any such disclosure was not

done in “willful violation” of the law.

Section 1799.3(a) provides that “[n]o person providing

video recording sales or rental services shall disclose any

personal information or the contents of any record, including

sales or rental information . . . to any person, other than the

individual who is the subject of the record, without the

written consent of that individual.” Cal. Civ. Code

§ 1799.3(a). Section 1799.3(c) makes a person liable for civil

penalties for “any willful violation” of section 1799.3(a).

Thus, section 1799.3(a), like the VPPA, authorizes

disclosures made to “the individual who is the subject of the

record.”

For the same reasons that Plaintiffs fail to plead a

violation of the VPPA, Plaintiffs also fail to plead a violation

of California Civil Code § 1799.3. While phrased in slightly

different language than the VPPA, the California Civil Code

plainly excludes liability for disclosures to a subscriber who

is the subject of a record. Netflix’s disclosure of personal

information was made to its subscribers and therefore it is not

liable under section 1799.3. Accordingly, the district court

properly dismissed the California state law claim on this

ground, and we need not consider its alternative ground for

dismissal.

IV.

For the foregoing reasons, we conclude that Plaintiffs

have failed to plead a claim under the VPPA and California

Civil Code § 1799.3. We AFFIRM the judgment of the

district court.

 Case: 12-17045, 07/31/2015, ID: 9629852, DktEntry: 26-1, Page 11 of 11