Meghan Mollett v. Netflix, Inc.

FOR PUBLICATION
UNITED STATES COURT OF APPEALS
FOR THE NINTH CIRCUIT
MEGHAN MOLLETT and TRACY No. 12-17045
HELLWIG, individually on behalf of
themselves and all others similarly D.C. No.
situated, 11-cv-01629-
Plaintiffs-Appellants, EJD-PSG
v.
OPINION
NETFLIX, INC., a Delaware
Corporation,
Defendant-Appellee.
Appeal from the United States District Court
for the Northern District of California
Edward J. Davila, District Judge, Presiding
Argued and Submitted
February 6, 2015—San Francisco, California
Filed July 31, 2015
2 MOLLETT V. NETFLIX, INC.
Before: Richard C. Tallman and Johnnie B. Rawlinson,
Circuit Judges, and Raymond J. Dearie, Senior District
Judge.*
Opinion by Judge Dearie
SUMMARY**
Video Privacy Protection Act
The panel affirmed the dismissal of claims brought under
the Video Privacy Protection Act and California Civil Code
§ 1799.3 against Netflix, Inc., a subscription videostreaming
service.
The panel held that Netflix did not violate these statutes
by permitting certain disclosures about subscribers’ viewing
history to third parties¯specifically subscribers’ family,
friends, and guests. The panel concluded that the
complained-of disclosures were lawfully made to Netflix’s
own subscribers and, therefore, were not actionable under the
VPPA or the California Civil Code.
*
Honorable Raymond J. Dearie, Senior District Judge for the U.S.
District Court for the Eastern District of New York, sitting by designation.
**
This summary constitutes no part of the opinion of the court. It has
been prepared by court staff for the convenience of the reader.
MOLLETT V. NETFLIX, INC. 3
COUNSEL
Rachele R. Rickert (argued), Francis M. Gregorek, Betsy C.
Manifold, and Marisa C. Livesay, Wolf Haldenstein Adler
Freeman & Herz LLC, San Diego, California; Mary Jane Fait
and Theodore B. Bell, Wolf Haldenstein Adler Freeman &
Herz LLC, Chicago, Illinois, for Plaintiffs-Appellants.
Keith E. Eggleton (argued), Rodney G. Strickland, Jr., Brian
M. Willen, and Jessica L. Snorgrass, Wilson Sonsini
Goodrich & Rosati, Palo Alto, California, for Defendant-
Appellee.
OPINION
DEARIE, Senior District Judge:
Plaintiffs-Appellants Meghan Mollett and Tracy Hellwig
appeal the district court’s dismissal of their claims against
Defendant-Appellee Netflix, Inc. (“Netflix”), a subscription
video streaming service, for violations of the Video Privacy
Protection Act (“VPPA”), 18 U.S.C. § 2710, and California
Civil Code § 1799.3. On behalf of themselves and other
similarly-situated Netflix subscribers, Plaintiffs allege that
Netflix violated these statutes by permitting certain
disclosures about their viewing history to third
parties—specifically, subscribers’ family, friends, and guests.
We conclude, however, that the complained-of disclosures
were lawfully made to Netflix’s own subscribers and,
therefore, are not actionable under the VPPA or the California
Civil Code. We affirm the decision of the district court.
4 MOLLETT V. NETFLIX, INC.
I.
Netflix is the world’s largest subscription service for
viewing movies, television programs, and other video
content. The company launched in 1999 as an online DVD
rental service that delivers DVDs to subscribers through the
mail, and expanded in 2007 to allow subscribers to stream
videos instantly online. As of the filing of Plaintiffs’
complaint, Netflix had more than 20 million subscribers;
approximately 48 percent use the service’s instant streaming
feature.
To become a Netflix subscriber, a consumer must create
an account on Netflix’s website. As part of the account setup,
a consumer must create a password, which she must enter
whenever logging into the account. Once a subscriber has an
account, she can begin ordering videos. Depending on the
type of account the subscriber purchased, she can either order
DVDs for home delivery or stream videos instantly over the
Internet, or both. To ease the ordering of DVDs for home
delivery, a subscriber can create a list of DVDs that she
wishes to view. That list is known as the “queue.” Depending
on the terms of subscription, Netflix mails one or more of the
DVDs listed in the queue to the subscriber. Once a subscriber
returns a DVD to Netflix, Netflix mails out the next available
DVD in the subscriber’s queue.
Many of the videos in a subscriber’s queue can also be
viewed instantly by streaming them over the Internet onto a
subscriber’s computer or portable computing device,
including televisions or video game systems. To stream a
video instantly, a subscriber simply logs into her password-
protected account, selects a video, and presses play. Videos
that are available for instant streaming can be displayed on a
MOLLETT V. NETFLIX, INC. 5
subscriber’s television through use of a Netflix-ready device,
such as a video game console, an Internet-connected
television, or a specially-designed DVD player. In order to
stream a video on a television through a Netflix-ready device,
a subscriber must first register the device in the subscriber’s
password-protected online account. After the device is
activated and connected to a television, the subscriber can
play videos by turning on the television and selecting a video
available through Netflix. A password is not required to
watch a video once the Netflix-ready device is activated.
To assist its subscribers in adding videos to their queues
or selecting videos to watch instantly, Netflix provides its
customers with lists of recommended videos. These
recommendations are generated through the use of predictive
software that analyzes, among other things, a subscriber’s
rental history. Recommendations are displayed to subscribers
through category-based lists. For instance, when Netflix
recommends movies based on a subscriber’s recently-
watched video, suggested movies are placed in a list titled
“Like [Name of Recently-Watched Film]” or “Because You
Liked [Name of Recently-Watched Film].” These lists of
recommended films include each video’s title, an image of its
DVD cover art, a written description of the video’s content,
and its Motion Picture Association of America rating.
Netflix displays a subscriber’s queue and
recommendation lists automatically on a subscriber’s account
home page. Once a subscriber has connected her account to
a Netflix-ready device, these lists are also automatically
displayed on the subscriber’s television when the television
is turned on and Netflix is activated. Specifically, Netflix
displays a list of “recently watched” video titles, the
subscriber’s queue, and lists of video titles recommended by
6 MOLLETT V. NETFLIX, INC.
Netflix. While a subscriber can edit and delete titles from her
queue, she cannot hide or remove the queue or the other lists
displayed by Netflix. The contents of these lists, as a result,
are visible to family members, friends, or guests of Netflix
subscribers who use a subscriber’s account to stream videos,
or are in the presence of a subscriber when she is accessing
her account through a Netflix-ready device. Plaintiffs alleged
in their April 4, 2011, complaint that these disclosures violate
the VPPA and California Civil Code § 1799.3.
In its motion to dismiss for failure to state a claim, Netflix
asserts that (1) its disclosures of personal information are
made to subscribers themselves and therefore permissible,
and (2) any disclosures to third parties are not made
knowingly, as required by the VPPA, or in willful violation
of the law, as required by California Civil Code § 1799.3. The
district court granted Netflix’s motion on both of these
grounds and dismissed Plaintiffs’ complaint with prejudice.
Plaintiffs timely appealed the district court’s order.
II.
“We review de novo the district court’s grant of a motion
to dismiss under Rule 12(b)(6), accepting all factual
allegations in the complaint as true and construing them in
the light most favorable to the nonmoving party.” Skilstaf,
Inc. v. CVS Caremark Corp., 669 F.3d 1005, 1014 (9th Cir.
2012). “To survive a motion to dismiss, a complaint must
contain sufficient factual matter, accepted as true, to ‘state a
claim to relief that is plausible on its face.’” Ashcroft v. Iqbal,
556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v.
Twombly, 550 U.S. 544, 570 (2007)). We will uphold a
district court’s decision to dismiss “where there is either a
lack of a cognizable legal theory or the absence of sufficient
MOLLETT V. NETFLIX, INC. 7
facts alleged under a cognizable legal claim.” Hinds Invs.,
L.P. v. Angioli, 654 F.3d 846, 850 (9th Cir. 2011).
III.
A.
The interpretation of this section of the VPPA is an issue
of first impression for this Circuit. The VPPA was enacted in
1988 in response to the Washington City Paper’s publication
of then-Supreme Court nominee Robert Bork’s video rental
history. See S. Rep. 100-599, at 5 (1988), reprinted in 1988
U.S.C.C.A.N. 4342-1. The paper had obtained (without Judge
Bork’s knowledge or consent) a list of the 146 films that the
Bork family had rented from a Washington, D.C.-area video
store. Id. Members of the Judiciary Committee “denounced
the disclosure” and Congress acted swiftly to enact the
VPPA. Id. According to the Senate Report on the VPPA,
Congress’s purpose when enacting the statute was “[t]o
preserve personal privacy with respect to the rental, purchase
or delivery of video tapes or similar audio visual materials.”
Id. at 1.
“The Act allows consumers to maintain control over
personal information divulged and generated in exchange for
receiving services from video tape service providers. The Act
reflects the central principle of the Privacy Act of 1974: that
information collected for one purpose may not be used for a
different purpose without the individual’s consent.” Id. at 8.
Congress’s intent in passing the VPPA therefore evinces the
principle that protection is merited when the consumer lacks
control over the dissemination of the information at issue.
8 MOLLETT V. NETFLIX, INC.
Consistent with Congress’s purpose, the statute’s
language is broad. The VPPA prohibits a “video tape service
provider” from knowingly disclosing “personally identifiable
information” about one of its consumers “to any person,” and
provides for liquidated damages in the amount of $2,500 for
violation of its provisions. 18 U.S.C. §§ 2710(b) and
2710(c)(2) (emphasis added). The VPPA, however, does not
prohibit all disclosures. The Act provides several exceptions
to the disclosure prohibition, allowing disclosure of a
consumer’s video rental history to the consumer himself, or
to third parties when the consumer has provided written
consent or the third party has obtained a warrant or court
order. Id. § 2710(b)(2). Relevant here is section
2710(b)(2)(A), which permits video tape service providers to
“disclose personally identifiable information concerning any
consumer . . . to the consumer.” Id. § 2710(b)(2)(A). The
VPPA defines the term “consumer” as “any renter, purchaser,
or subscriber of goods or services from a video tape service
provider.” Id. § 2710(a)(1). The VPPA does not define the
term “disclosure.” A video service provider that makes a
disclosure of personally identifiable information to a
consumer or subscriber is not subject to civil liability.
Therefore, in order to plead a plausible claim under
section 2710(b)(1), a plaintiff must allege that (1) a defendant
is a “video tape service provider,” (2) the defendant disclosed
“personally identifiable information concerning any
customer” to “any person,” (3) the disclosure was made
knowingly, and (4) the disclosure was not authorized by
section 2710(b)(2). At dispute here are the third and fourth
elements.
Based on the allegations in the complaint, Plaintiffs have
failed to plead a plausible violation of the VPPA because, as
MOLLETT V. NETFLIX, INC. 9
we now hold, the disclosure alleged by Plaintiffs is a
disclosure “to the consumer” that is permitted by the Act. The
complaint alleges that upon setting up a Netflix account,
personally identifiable information, by default, is only
disclosed to a Netflix subscriber through her password-
protected account. Under those circumstances, a subscriber’s
queue or recommendation lists are only viewable by the
subscriber. Netflix subscribers can then elect to display on
their televisions what would otherwise be password-protected
information by registering Netflix-ready devices in their
accounts. Thereafter, Netflix automatically displays on a
television what it displays on a subscriber’s computer:
streamed instant videos, the subscriber’s queue, and video
recommendations. This is plainly a disclosure “to the
consumer” as contemplated by the VPPA. When Netflix
displays a subscriber’s queue, viewing history, or
recommendation lists in her online account, that is a
disclosure directly to the consumer. The nature of that
disclosure does not change when subscribers choose to
display the same content on their television screens. The
subscriber’s choice to do so does not trigger some new
statutory duty on the part of Netflix.
The fact that a subscriber may permit third parties to
access her account, thereby allowing third parties to view
Netflix’s disclosures, does not alter the legal status of those
disclosures. No matter the particular circumstances at a
subscriber’s residence, Netflix’s actions remain the same: it
transmits information automatically to the device that a
subscriber connected to her Netflix account. The lawfulness
of this disclosure cannot depend on circumstances outside of
Netflix’s control. There is nothing to suggest that the VPPA
prohibits disclosures “to the consumer” when they are
incidentally also received by third parties as the subscriber
10 MOLLETT V. NETFLIX, INC.
may independently permit. Our conclusion is consistent with
the legislative intent of the VPPA—where the subscriber
controls which third parties may access her Netflix account
and where the “personally identifiable information” is
disclosed to only a select group of individuals, both the letter
and the spirit of the law are sustained.
Plaintiffs insist that Netflix is required to transmit
information in a reasonably secure manner or undertake
certain technical fixes to prevent incidental disclosures to
third parties. But the VPPA does not prescribe a technical
regime for disclosure. “Just because Congress’[s] goal was to
prevent the disclosure of private information, does not mean
that Congress intended the implementation of every
conceivable method of preventing disclosures.” Daniel v.
Cantrell, 375 F.3d 377, 384 (6th Cir. 2004). To hold
otherwise would convert section 2710(b)(1) from a
prohibition on unlawful disclosure to a requirement of secure
disclosure—an outcome plainly not supported by the VPPA’s
text.
As plaintiff’s complaint pleads only a lawful disclosure
under the VPPA, the district court was correct to dismiss the
first count of Plaintiffs’ complaint. We need not, therefore,
address whether Plaintiffs adequately alleged a “knowing”
disclosure.
B.
The second count of Plaintiffs’ complaint alleges that
Netflix disclosed its subscribers’ personal information to third
parties in violation of California Civil Code § 1799.3. Netflix
argues, as it did with respect to count one, that California law
MOLLETT V. NETFLIX, INC. 11
authorizes its disclosure and that any such disclosure was not
done in “willful violation” of the law.
Section 1799.3(a) provides that “[n]o person providing
video recording sales or rental services shall disclose any
personal information or the contents of any record, including
sales or rental information . . . to any person, other than the
individual who is the subject of the record, without the
written consent of that individual.” Cal. Civ. Code
§ 1799.3(a). Section 1799.3(c) makes a person liable for civil
penalties for “any willful violation” of section 1799.3(a).
Thus, section 1799.3(a), like the VPPA, authorizes
disclosures made to “the individual who is the subject of the
record.”
For the same reasons that Plaintiffs fail to plead a
violation of the VPPA, Plaintiffs also fail to plead a violation
of California Civil Code § 1799.3. While phrased in slightly
different language than the VPPA, the California Civil Code
plainly excludes liability for disclosures to a subscriber who
is the subject of a record. Netflix’s disclosure of personal
information was made to its subscribers and therefore it is not
liable under section 1799.3. Accordingly, the district court
properly dismissed the California state law claim on this
ground, and we need not consider its alternative ground for
dismissal.
IV.
For the foregoing reasons, we conclude that Plaintiffs
have failed to plead a claim under the VPPA and California
Civil Code § 1799.3. We AFFIRM the judgment of the
district court.