Antitrust Law Daily Wrap Up, PRIVACY—S.D.N.Y.: Claims that Today.com shared PII with Facebook without consent tossed, (Sep 4, 2025)

By Patricia K. Ruiz, J.D.

The plaintiff failed to show how an ordinary person could discern that code provided in the complaint contained Golden’s FID or the titles of the videos she watched.

The U.S. District Court for the Southern District of New York dismissed a putative class action against NBCUniversal Media, LLC (NBCU) claiming violations of the Video Privacy Protection Act (VPPA) and unjust enrichment. The complaint alleged NBCU—without users’ consent—knowingly disclosed to Meta Platforms, Inc. (Facebook) the users’ personally identifiable information (PII) and information about their video consumption. The court found that disclosures comprehensible only to Facebook or other sophisticated actors are not PII, foreclosing the plaintiff’s VPPA claim. The court also dismissed the plaintiff’s unjust enrichment claim, finding that it was duplicative of the VPPA claim (Golden v. NBCUniversal Media, LLC, No. 1:22-cv-09858-PAE (S.D.N.Y. Sept. 3, 2025)).

Newsletter sign-up. NBCU owns and operates Today.com, which offers both live and on-demand video content. The website allows users to sign up for a daily digital newsletter, directing users to enter an email address and click “sign up.” Newsletter recipients provide NBCU with their internet protocol (IP) address, which conveys to NBCU the device’s city, zip code, and physical location. Once a user signs up, a daily digital newsletter is delivered to the email address that the user provided to Today.com. As of May 2025, Today.com’s privacy policy states that it automatically collects certain information, including “content you view and duration.” However, the policy does not disclose that Today.com shares that information with third parties, including Facebook.

Facebook tracking pixel. Today.com installed Facebook’s tracking pixel to transmit certain information about users to Facebook, which Facebook uses to target ads for particular users. The pixel tracks users’ actions on Facebook advertisers’ websites and reports these to Facebook. The advertiser informs Facebook which website events it wishes to track; in turn, Facebook generates corresponding pixel code for the advertiser to include in the code of its website. Thus, when a digital newsletter recipient watches video content, Today.com transmits to Facebook a cookie with the video content name, the URL of the video that was viewed, and, for visitors with an active and logged-in Facebook account, the viewer’s Facebook ID (FID), a unique and persistent identifier Facebook assigns to each Facebook user. Any “ordinary user” can use an FID to look up a Facebook profile, allowing them to identify the person who watched the video and revealing any public details displayed on that profile.

Allegations. In 2022, the plaintiff, who has had a Facebook account since approximately 2012, signed up to receive a Today.com newsletter and has since received emails and other communications from the website. She accessed audio-visual content via hyperlinks provided in the newsletters and has accessed Today.com’s content through its website and mobile app, and, during the relevant period, did so while concurrently logged into her Facebook account. She alleged she never agreed, authorized, or otherwise consented to NBCU’s disclosure of her personal video viewing information to Facebook and has not been given written notice stating that it is NBCU’s practice to do so.

“Consumer” under VPPA. On an earlier motion to dismiss by NCBU, the decisive issue was whether the plaintiff had plausibly pleaded that she was “a subscriber of goods and services,” and thus a “consumer” within the meaning of the VPPA. The court granted the motion to dismiss, and, while the plaintiff’s appeal was pending, the U.S. Court of Appeals for the Second Circuit held that newsletter subscribers can be VPPA “consumers.” The instant court issued an indicative ruling that, were this case remanded, it would deny NBCU’s motion to dismiss. The Second Circuit dismissed the plaintiff’s appeal and remanded the case to the instant court. With the court’s permission, the plaintiff filed her fifth amended complaint (FAC), the operative complaint.

VPPA claim. NBCU moved to dismiss the operative complaint, arguing that the complaint does not adequately allege that NBCU disclosed Golden’s PII under the VPPA. The FAC undisputedly alleges that NBCU, through the Facebook Pixel, transmitted Golden’s URL, FID, and video-watching history, and its basis for claiming that NBCU disclosed the plaintiff’s PII is that an FID uniquely identifies a Facebook user. Under the VPPA, PII has three distinct elements: (1) the consumer’s identity; (2) the video material’s identity; and (3) the connection between them. It constitutes more than just information that identifies an individual, but also information that can be used to identify an individual.

The FAC alleged the defendant disclosed users’ video-viewing activity to Facebook via the Pixel, specifically by transmitting URLs, FIDs, and video-watching history without their knowledge or consent. It includes a screenshot of computer code showing the alleged transmissions to Facebook and alleges that, because a person with the right tools can use an FID to identify a specific Facebook user, the data constitutes PII. The FAC, however, does not explain how an ordinary person, with little or no extra effort, could discern that this code contained Golden’s FID or the titles of the videos she watched. At most, it pleads that Facebook, through its proprietary systems, could decode these technical strings. The court found that disclosures comprehensible only to Facebook or other sophisticated actors are not PII, foreclosing the plaintiff’s claim. Thus, the court dismissed the VPPA claim.

Unjust enrichment. To allege unjust enrichment under New York law, a plaintiff must plead the defendant benefitted at the plaintiff’s expense and that equity and good conscience require restitution. The court found that the plaintiff’s unjust enrichment claim effectively replicated the VPPA allegations and that, by failing to respond to NBCU’s motion to dismiss, waived any opposition. The court dismissed the unjust enrichment claim as duplicative of the VPPA claim.

The Case is No. 1:22-cv-09858-PAE.

Judge: Engelmayer, P.

Attorneys: Michael Lee Murphy (Bailey & Glasser LLP) for Sherhonda Golden. Benjamin Scott Thomassen (ZwillGen PLLC) for NBCUniversal Media, LLC.

Companies: NBCUniversal Media, LLC

Cases: Privacy CyberPrivacyFeed DataPrivacy NewYorkNews