Calif., N.Y. Plaintiffs File VPPA Class Actions Over Use of Meta Tracking Pixels

Two privacy class actions filed this week in federal courts in New York and California allege defendants violated the Video Privacy Protection Act by disclosing plaintiffs’ identities and video-viewing history to Facebook parent Meta via tracking pixels.

Plaintiff Daisy Garza of San Francisco visited the Alamo Drafthouse Cinemas website, where the theater chain has installed tracking pixels from an “army of advertisers,” said her Monday complaint (docket 3:23-cv-05719) in U.S. District Court for Northern California in San Francisco. The advertisers -- Meta, TikTok, The Trade Desk, NextRoll and Google -- “not only remember the Alamo, but exactly who watched what, when, and where,” it said.

The tracking pixels “secretly and surreptitiously send consumers’ personally identifiable information (PII) to third-party providers -- every time consumers purchase a movie ticket on Alamo’s website,” the complaint said. Facebook, TikTok and other platforms “collect the titles of the movies consumers purchased tickets to see, along with the cinema locations where those movies aired,” it said.

Some pixels include unique user ID numbers the companies use to identify individuals and link them to their movie metadata, said the complaint. Others identify individuals and link them to their movie metadata by also “collecting their browsers’ IP addresses and cross referencing that with other websites that individual’s IP address visited,” it said. “All this is done to build digital dossiers on people and retarget them for advertising with alarming accuracy,” it said.

Alamo tracks three events on its website: “Purchase,” “PageView” and “Button Click Automatically Detected,” said the complaint. When a customer clicks a button to buy tickets, “at least two Meta Tracking Pixel events are installed” on the page, and the pixel transmits the button click event to Meta, including metadata that tells it “exactly which movie a consumer is purchasing tickets for and which Alamo theater location those tickets are for,” it said.

When a user buys tickets on the website, Alamo “compels a visitor’s browser to transmit” a cookie to Facebook called “c_user,” which contains the visitor’s unencrypted Facebook ID, the complaint said. “A Facebook ID allows anybody -- not just Facebook -- to identify the individual consumer,” it said.

Through the Meta Pixel’s code, the cookies combine the identifiers with the event data, “allowing Meta to know, among other things, that a given consumer purchased a ticket to a particular movie at a particular Alamo cinema location,” it said. When Garza bought tickets, event data included ticket price and number of tickets, “allowing these third parties to infer whether Ms. Garza was going solo or on a date,” it said.

The plaintiff also claims violation of the California Civil Code that prohibits an entity providing video recording sales from disclosing personal or sales information. She seeks awards of statutory and punitive damages, pre- and post-judgment interest, attorneys’ fees and legal costs, plus injunctive relief.

In the New York VPPA class action, plaintiff Keith Messner had to provide his PII, including billing information, to watch video content on Stingray Music USA’s subscription streaming platform, Qello, said his complaint Tuesday (docket 6:23-cv-06636) in U.S. District Court for Western New York in Rochester.

Stingray violated the VPPA by knowingly disclosing without his consent Messner’s information identifying that he requested specific video materials from a videotape provider, said the complaint. Stingray uses the Meta Pixel to track and disclose to third-party business partners subscribers’ viewed video history and unique identifiers and “profits handsomely from its unauthorized disclosure” "at the expense of its digital subscribers’ privacy,” it said.

The streaming company shared Messner’s unique Facebook ID and video content viewed as a single data point, allowing “any ordinary person” to use it to easily locate, access and view his account or profile, the complaint said. After watching a Beyonce concert on Qello, the Rochester, New York, resident received a targeted ad for tickets to the singer’s Renaissance tour on his Facebook page, it said.

Stingray’s “wrongful acquisition and use” of Messner’s PII deprived him and class members’ control of that information and prevented them from “realizing its full value for themselves,” said the complaint. Messner seeks injunctive relief to “protect the interests” of him and class members including “reformation of practices and an accounting and purging of wrongfully obtained personal information.” He also seeks awards of actual, general, special, incidental, statutory, treble, punitive, liquidated and consequential damages and/or restitution; disgorgement of monies obtained as a result of the wrongful conduct alleged; pre- and post-judgment interest; and attorneys’ fees and legal costs.