FOR PUBLICATION

UNITED STATES COURT OF APPEALS

FOR THE NINTH CIRCUIT

CHAD EICHENBERGER,

Plaintiff-Appellant,

v.

ESPN, INC., a Delaware

corporation,

Defendant-Appellee.

No. 15-35449

D.C. No.

2:14-cv-00463-TSZ

OPINION

Appeal from the United States District Court

for the Western District of Washington

Thomas S. Zilly, Senior District Judge, Presiding

Argued and Submitted October 3, 2017

Pasadena, California

Filed November 29, 2017

Before: Susan P. Graber, Mary H. Murguia,

and Morgan Christen, Circuit Judges.

Opinion by Judge Graber
2 EICHENBERGER V. ESPN

SUMMARY*

Video Privacy Protection Act

The panel affirmed the district court’s dismissal under

Fed. R. Civ. 12(b)(6) of an action alleging that ESPN, Inc.

disclosed the plaintiff’s “personallyidentifiable information”

in violation of the Video Privacy Protection Act of 1998 by

giving a third party, Adobe Analytics, the plaintiff’s Roku

device serial number and by identifying videos he watched

through the WatchESPN application.

The panel rejected ESPN’s contention that the plaintiff

lacked standing. The panel held that every disclosure of an

individual’s “personally identifiable information” and videoviewing history offends the interests that the statute protects,

and that the plaintiff need not allege any further harm to have

standing.

The panel held that “personally identifiable information”

under the statute means only that information that would

readily permit an ordinary person to identify a specific

individual’s video-watching behavior. Applying that

definition here, the panel concluded that an ordinary person

could not use the information that ESPN allegedly disclosed

to identify an individual, because the allegedly-disclosed

information cannot identify an individual unless it is

combined with other data in Adobe’s possession—data that

ESPN never disclosed and apparently never even possessed. 

* This summary constitutes no part of the opinion of the court. It has

been prepared by court staff for the convenience of the reader.
EICHENBERGER V. ESPN 3

The panel concluded that the plaintiff therefore failed to state

a claim under Rule 12(b)(6).

COUNSEL

John A. Lawson (argued), Roger Perlstadt, and Ryan D.

Andrews, Edelson PC, Chicago, Illinois, for PlaintiffAppellant.

Daniel P. Collins (argued) and Glenn D. Pomerantz, Munger

Tolles & Olson LLP, Los Angeles, California; Bryan H.

Heckenlively, Jonathan H. Blavin, and Rosemarie T. Ring,

Munger Tolles &Olson LLP, San Francisco, California; AnaMaria Popp, Cairncross & Hempelmann P.C., Seattle,

Washington; for Defendant-Appellee.

Marc Rotenerg and Alan Butler, Washington, D.C., as and for

Amicus Curiae Electronic Privacy Information Center.

OPINION

GRABER, Circuit Judge:

Plaintiff Chad Eichenberger allegesthatDefendant ESPN,

Inc. violated the Video Privacy Protection Act of 1988

(“VPPA”), which bars a “video tape service provider” from

knowingly disclosing “personally identifiable information

concerning any consumer of such provider.” 18 U.S.C.

§ 2710(b)(1). The district court dismissed the action under

Federal Rule of Civil Procedure 12(b)(6) on the ground that

the operative complaint fails to state a claim that the
4 EICHENBERGER V. ESPN

information disclosed was “personally identifiable

information” within the meaning of the VPPA. We affirm.

FACTUAL AND PROCEDURAL HISTORY

We accept as true all factual allegations in the operative

complaint, and we construe them in the light most favorable

to Plaintiff as the non-moving party. Mollett v. Netflix, Inc.,

795 F.3d 1062, 1065 (9th Cir. 2015).

Defendant produces sports-related news and

entertainment programming. Though best known for its

television channel, Defendant also offers access to video

content through an application called the “WatchESPN

Channel,” which is available on the Roku digital streaming

device. Roku allows users to view videos and other content

on their televisions by means of Internet streaming.

Plaintiff downloaded the WatchESPN Channel on his

Roku device and used it to watch sports-related news and

events. He did not consent to Defendant’s sharing his

information with a third party. But every time Plaintiff

watched a video, Defendant knowingly disclosed to a third

party, Adobe Analytics: (1) Plaintiff’s Roku device serial

number and (2) the identity of the video that he watched.

Adobe uses the information obtained from Defendant to

identify specific consumers by connecting that information

“with existing data already in Adobe’s profile of th[ose]

individual[s].” Adobe obtains the additional

information—such as “email addresses, account information,

or Facebook profile information, including photos and

usernames”—from sources other than Defendant. Adobe

gives the resulting data back to Defendant in an aggregated
EICHENBERGER V. ESPN 5

form; Defendant in turn provides advertisers with aggregated

information about its users’ demographics.

In this action, Plaintiff alleges that Adobe used the

foregoing process to identify him as having watched specific

videos. He argues that Defendant disclosed his “personally

identifiable information” by giving Adobe his Roku device

serial number and identifying the videos that he watched,

because Defendant knew that Adobe could and would use that

information to identify him. The district court dismissed the

action on the ground that the information that Defendant

disclosed did not constitute “personally identifiable

information” within the meaning of the VPPA. Plaintiff

timely appeals.

STANDARD OF REVIEW

We review de novo the district court’s decision to grant

a motion to dismiss a claim under Rule 12(b)(6). Mollett,

795 F.3d at 1065. To survive a motion to dismiss, the claim

must be plausible on its face. Ashcroft v. Iqbal, 556 U.S. 662,

678 (2009). We must uphold a district court’s decision to

dismiss either if a cognizable legal theory is absent or if the

facts alleged fail to suffice under a cognizable claim. Mollett,

795 F.3d at 1065.

DISCUSSION

A. Standing

Defendant first argues that Plaintiff lacks Article III

standing because he has not alleged a concrete harm as

required by Spokeo, Inc. v. Robins(Spokeo I), 136 S. Ct. 1540

(2016). We disagree.
6 EICHENBERGER V. ESPN

To have Article III standing, a plaintiff must have

suffered an injury in fact that is (1) concrete and

particularized, (2) traceable to the defendant, and

(3) redressable by judicial order. Lujan v. Defs. of Wildlife,

504 U.S. 555, 560–61 (1992). For an injury to be concrete,

it “must be ‘de facto’; that is, it must actually exist.” Spokeo

I, 136 S. Ct. at 1548. Nevertheless, an intangible harm may

qualify as an injury in fact. Id. at 1549. In determining

whether an intangible injury is sufficiently concrete, “both

history and the judgment of Congress play important roles.” 

Id.

In Spokeo I, the Supreme Court addressed whether a

violation of procedural requirements imposed by the Fair

Credit Reporting Act (“FCRA”), alone, could constitute an

injury in fact sufficient to confer standing. Id. at 1549. 

There, the plaintiff(Robins) claimed that Spokeo had violated

the FCRA by disseminating inaccurate information about

him. Id. at 1546. Initially, we held that the alleged violation,

by itself, sufficed to confer Article IIIstanding. The Supreme

Court vacated our decision and remanded, explaining that

Article III “requires a concrete injury even in the context of

a statutory violation” and that a “bare procedural violation,

divorced from any concrete harm,” is not enough. Id. at

1549. On remand, we held that even though Robins alleged

procedural violations of the FCRA, he alleged a sufficient

risk of harm (for example, the loss of employment

opportunities) to obtain standing. Robins v. Spokeo, Inc.

(Spokeo II), 867 F.3d 1108, 1118 (9th Cir. 2017).

Importantly, Spokeo concerned procedural violations of

the FCRA that would not invariably injure a concrete interest. 

Id. at 1114 (describing the FCRA provisions at issue as

“procedural requirements” (emphasis added)); id. at 1116
EICHENBERGER V. ESPN 7

(examining the plaintiff’s “procedural rights” (emphasis

added)). Indeed, the central provision at issue in Spokeo was

15 U.S.C. § 1681e(b), which falls under the FCRA’s

“Compliance procedures” section and requires consumer

reporting agencies to take “reasonable procedures to assure

maximum possible accuracy” of the information they report. 

But a violation of that provision does not necessarily affect a

plaintiff’s concrete interests. See Spokeo I, 136 S. Ct. at 1550

(noting that “not all inaccuracies cause harm or present any

material risk of harm” and giving, as an example, the

dissemination of a consumer’s incorrect zip code). As a

consequence, the Spokeo plaintiff had to plead additional

harm to obtain standing. Id.

By contrast, 18 U.S.C. § 2710(b)(1), the VPPA provision

at issue here, codifies a context-specific extension of the

substantive right to privacy: “A video tape service provider

who knowingly discloses, to any person, personally

identifiable information concerning any consumer of such

provider shall be liable to the aggrieved person . . . .” That

provision does not describe a procedure that video service

providers must follow. Rather, it protects generally a

consumer’s substantive privacy interest in his or her videoviewing history. Mollett, 795 F.3d at 1065 (citing S. Rep.

No. 100-599, at 1 (1988), reprinted in 1988 U.S.C.C.A.N.

4342). Accordingly, every disclosure of an individual’s

“personally identifiable information” and video-viewing

history offends the interests that the statute protects.

Congressional judgment leaves little doubt that 18 U.S.C.

§ 2710(b)(1) is a substantive provision that protects concrete

interests. Congress enacted the VPPA “to extend privacy

protection to records that contain information about

individuals.” S. Rep. No. 100-599, at 2. To that end, the
8 EICHENBERGER V. ESPN

VPPA permits consumers to obtain damages for a violation

of § 2710(b)(1) without showing consequential harm. 

18 U.S.C. § 2710(c)(2).1 The VPPA does not protect only

against harms such as embarrassment and harassment—as

Defendant argues. Rather, the statute also protects privacy

interests more generally by ensuring that consumers retain

control over their personal information. See S. Rep. No. 100-

599, at 6–7 (explaining that the VPPA protects against

intrusion in an age when consumers “provide to businesses

. . . personal information without having any control over

where that information goes”).

Historical practice confirms that understanding. 

Violations of the right to privacy have long been actionable

at common law. See Braitberg v. Charter Commc’ns, Inc.,

836 F.3d 925, 930 (8th Cir. 2016) (stating that “there is a

common law tradition of lawsuits for invasion of privacy”). 

Indeed, the Supreme Court has noted that “both the common

law and the literal understanding of privacy encompass the

individual’s control of information concerning his or her

person.” U.S. Dep’t of Justice v. Reporters Comm. for

Freedom of the Press, 489 U.S. 749, 763 (1989). Tellingly,

privacy torts do not always require additional consequences

to be actionable. See, e.g., Restatement (Second) of Torts

§ 652B cmt. b. (Am. Law Inst. 1977) (recognizing the tort of

1

In Defendant’s view, the word “aggrieved” suggests that the statute

requires a showing of additional harm and that, without such a showing,

a consumer does not have standing. We disagree. The Supreme Court has

explained that the term “aggrieved” demonstrates an “intent to cast the

standing net broadly.” Fed. Election Comm’n v. Akins, 524 U.S. 11, 19

(1998) (addressing the term in the context of prudential standing). 

Regardless, congressional historyclearlyshows that Congress thought that

every unauthorized disclosure “aggrieves” a consumer. Mollett, 795 F.3d

at 1065.
EICHENBERGER V. ESPN 9

intrusion upon seclusion, for which the “intrusion itself”

makes the defendant liable). The VPPA functions in the

same way.

Thus, although the FCRA outlines procedural obligations

that sometimes protect individual interests, the VPPA

identifies a substantive right to privacy that suffers any time

a video service provider discloses otherwise private

information. As a result, every 18 U.S.C. § 2710(b)(1)

violation “present[s] the precise harm and infringe[s] the

same privacy interests Congress sought to protect” by

enacting the VPPA. Van Patten v. Vertical Fitness Grp.,

LLC, 847 F.3d 1037, 1043 (9th Cir. 2017) (so holding with

respect to the Telephone Consumer Protection Act of 1991). 

Accordingly, Spokeo I and Spokeo II are distinguishable from

this VPPA claim, and Plaintiff need not allege any further

harm to have standing. Id.2 We therefore join the two other

circuits that, after Spokeo I, have found Article IIIstanding in

similar cases arising under the VPPA. Perry v. Cable News

Network, Inc., 854 F.3d 1336, 1341 (11th Cir. 2017); In re

Nickelodeon Consumer Privacy Litig., 827 F.3d 262, 274 (3d

Cir. 2016), cert. denied, 137 S. Ct. 624 (2017).

2 The VPPA’s history shows why an allegation of additional harm is

unnecessary. Congress enacted the VPPA after a newspaper published

Supreme Court nominee Robert Bork’s video rental history. Notably,

Judge Bork’s rental history was decidedly commonplace, and the article

did not hurt his nomination. Case Comment, Statutory

Interpretation—The Video Privacy Protection Act—Eleventh Circuit

Limits the Scope of “Subscriber” for VPPA Protections.—Ellis v. Cartoon

Network, Inc., 803 F.3d 1251 (11th Cir. 2015), 129 Harv. L. Rev. 2011,

2018–19 (2016). Were we to accept Defendant’s argument regarding

standing, the VPPA would not provide legal recourse to those in the

precise situation that prompted the statute’s enactment in the first place.
10 EICHENBERGER V. ESPN

B. “Personally Identifiable Information”

The district court dismissed Plaintiff’s claim on the

ground that the allegedly disclosed information did not

constitute “personally identifiable information” within the

meaning of the VPPA. The VPPA defines “personally

identifiable information” to “include[] information which

identifies a person as having requested or obtained specific

video materials or services from a video tape service

provider.” 18 U.S.C. § 2710(a)(3). We agree with the district

court’s conclusion.

As an initial matter, “personally identifiable information”

must include more information than that which, by itself,

identifies an individual as having watched certain videos. 

Instead, “personally identifiable information” covers some

information that can be used to identify an individual.

Two reasons support that conclusion, and both flow

directly from the VPPA’s text. First, § 2710(a)(3) uses the

open-ended word “includes,” which suggests that the

proffered definition describes only one example of

“personally identifiable information.” Read in context, the

word “includes” seems particularlydeliberate here. Compare

18 U.S.C. § 2710(a)(3) (using the word “includes”) with

18 U.S.C. § 2710(a)(1), (a)(2) & (a)(4) (using the word

“means” to define other statutory terms). Second, Congress

used the word “identifiable.” 18 U.S.C. § 2710(a)(3)

(emphasis added). And the suffix “able” means “capable of.” 

Webster’s Third New Int’l Dictionary 4, 1123 (unabr. ed.

1981). It follows, then, that the term “personally identifiable

information” covers some information that is “capable of”

identifying a person, as well as information that, standing

alone, identifies a person.
EICHENBERGER V. ESPN 11

The question remains, though: Under the VPPA, what

information did Congress intend to cover as “capable of”

identifying an individual? Two circuits have considered that

question in similar cases, and each has articulated a different

standard. Yershov v. Gannett Satellite Info. Network, Inc.,

820 F.3d 482, 486 (1st Cir. 2016); In re Nickelodeon

Consumer Privacy Litig., 827 F.3d 262, 284 (3d Cir. 2016).

In Yershov, the First Circuit held that the term “personally

identifiable information” encompasses “information

reasonably and foreseeably likely to reveal which . . . videos

[a person] has obtained.” 820 F.3d at 486 (emphasis added). 

The court concluded that an iPhone user’s GPS coordinates

and device identifier fell within that definition. Id. In a

similar case, though, the Third Circuit held that a unique IP

address did not qualify as “personally identifiable

information,” because the term includes onlyinformation that

“readily permit[s] an ordinary person to identify a [particular

individual as having watched certain videos].” In re

Nickelodeon, 827 F.3d at 290 (emphasis added). We adopt

the Third Circuit’s “ordinary person” standard.

The “ordinary person” test better informs video service

providers of their obligations under the VPPA. The VPPA

protects consumer privacy by directing video service

providers not to do certain things with consumer information. 

To that end, 18 U.S.C. § 2710(b)(1) focuses on what

information a video service provider “knowingly discloses.” 

In other words, the statute views disclosure from the

perspective of the disclosing party. It looks to what

information a video service provider discloses, not to what

the recipient of that information decides to do with it. As a

result, “personally identifiable information” must have the

same meaning without regard to its recipient’s capabilities. 
12 EICHENBERGER V. ESPN

Holding otherwise would make “[t]he lawfulness of [a]

disclosure . . . depend on circumstances outside of [a video

service provider’s] control.” Mollett, 795 F.3d at 1066. The

Third Circuit’s “ordinary person” test, by contrast, provides

video service providers with enough guidance to complywith

the VPPA’s requirements.

The interpretation that we adopt fits most neatly with the

regime that the VPPA’s enacting Congress likely had in

mind. In 1988, the Internet had not yet transformed the way

that individuals and companies use consumer data—at least

not to the extent that it has today. Then, the VPPA’s

instructions were clear. The manager of a video rental store

in Los Angeles understood that if he or she disclosed the

name and address of a customer—along with a list of the

videos that the customer had viewed—the recipient of that

information could identify the customer. By contrast, it was

clear that, if the disclosure were that “a local high school

teacher” had rented a particular movie, the manager would

not have violated the statute. That was so even if one

recipient of the information happened to be a resourceful

private investigator who could, with great effort, figure out

which of the hundreds of teachers had rented the video. 

Plaintiff’s Roku device serial number is like the information

in the latter scenario. It creates a sizable “pool” of possible

viewers—here, Roku users—just as the information in the

latter example does—there, high school teachers.

It is true that today’s technology may allow Adobe to

identify an individual from the large pool by using other

information—as Plaintiff alleges. But the advent of the

Internet did not change the disclosing-party focus of the

statute. And we are not persuaded that the 1988 Congress

intended for the VPPA to cover circumstances so different
EICHENBERGER V. ESPN 13

from the ones that motivated its passage. Therefore, drawing

on the Third Circuit’s reasoning, we hold that “personally

identifiable information” means only that information that

would “readily permit an ordinary person to identify a

specific individual’s video-watching behavior.” In re

Nickelodeon, 827 F.3d at 267.

Applying that definition here, the operative complaint is

deficient. Plaintiff alleges that Defendant disclosed to

Adobe: (1) his Roku device serial number and (2) the names

of the videos that he watched. As Plaintiff concedes, that

information cannot identify an individual unless it is

combined with other data in Adobe’s possession—data that

ESPN never disclosed and apparently never even possessed. 

Indeed, according to Plaintiff, Adobe can identify individuals

only because it uses a complex “Visitor Stitching technique”

to link an individual’s Roku device number with other

identifying information derived from “an enormous amount

of information” collected “from a variety of sources.” We

conclude that an ordinary person could not use the

information that Defendant allegedly disclosed to identify an

individual. Plaintiff has therefore failed to state a claim under

Rule 12(b)(6).

Our decision today, though it adopts a different test, does

not necessarily conflict with Yershov. The First Circuit’s

holding in that case was quite narrow. The court held

only that the transaction described in the

complaint—wherebyYershov used themobile

device application that Gannett provided to

him, which gave Gannett the GPS location of

Yershov’s mobile device at the time he

viewed a video, his device identifier, and the
14 EICHENBERGER V. ESPN

titles of the videos he viewed in return for

access to Gannett’s video content—plausibly

plead[ed] a case that the VPPA’s prohibition

on disclosure applies.

Yershov, 820 F.3d at 489. The First Circuit relied, in part, on

the nature of GPS location data, which the court noted

“would enable most people to identify [an individual’s home

and work addresses].” Id. at 486 (emphasis added). And the

court expressly noted that, at some point, “the linkage of

information to identity becomes too uncertain” to trigger

liability under the VPPA. Id. That is precisely the situation

here.

Nor does our holding make the statute powerless. Names

and addresses, of course, still qualify. See 18 U.S.C.

§ 2710(b)(2)(D) (permitting video service providers to

“disclose personally identifiable information . . . if [among

other conditions] the disclosure is solely of the names and

addresses of consumers” (emphasis added)). It is not difficult

to imagine other examples that may also count—for example,

an individual’s name and telephone number or an individual’s

name and birthday or, as in Yershov, the GPS coordinates of

a particular device. And modern technology may indeed

alter—or may already have altered—what qualifies under the

statute. A Facebook link or an email address may very well

readily enable an “ordinary person” to identify an individual. 

We need not and do not opine on the merits of those theories. 

The allegations before us, though, are simply too attenuated

to qualify under the standard that we adopt today.

3

3

In view of our holding, we need not reach any other issue. We

therefore do not decide, for example, whether Plaintiff has adequately

alleged his status as a “consumer” under the VPPA.
EICHENBERGER V. ESPN 15

CONCLUSION

Plaintiff has Article III standing to bring his claim

because 18 U.S.C. § 2710(b)(1) is a substantive provision

protecting consumers’ concrete interest in their privacy. We

affirm the judgment of dismissal because the information

described in Plaintiff’s complaint does not constitute

“personally identifiable information” under the VPPA.

AFFIRMED.