## Facts

- ESPN provided video programming through the WatchESPN Channel available on Roku devices.
- Chad Eichenberger downloaded and used the WatchESPN Channel to watch videos.
- Eichenberger alleged ESPN transmitted to Adobe Analytics (a third-party) (1) his Roku device serial number and (2) the specific videos he watched.
- Adobe allegedly combined ESPN’s data with Adobe’s existing consumer data to identify users and returned aggregated demographic information to ESPN.
- ESPN allegedly used aggregated viewing and demographic information for advertising-related purposes.
- Eichenberger alleged he did not consent to any disclosure and sued under the Video Privacy Protection Act (VPPA), 18 U.S.C. § 2710.

## Issues

1. Whether an alleged VPPA violation, without additional consequential harm, constitutes a concrete injury sufficient for Article III standing.
2. Whether disclosure of a Roku device serial number and associated video titles to a third party constitutes “personally identifiable information” (PII) under the VPPA.

## Decision

- The court held Eichenberger had Article III standing because the VPPA protects a substantive privacy interest in video-viewing information, and an alleged unlawful disclosure constitutes a concrete injury.
- The court held the disclosed Roku serial number and video titles were not VPPA PII because they would not readily allow an ordinary person to identify a specific individual’s video-viewing behavior.
- The court affirmed dismissal under Rule 12(b)(6) for failure to state a VPPA claim.

## Legal Principles

- A plaintiff has Article III standing to sue for a VPPA violation where the alleged disclosure implicates the statute’s substantive privacy right; additional harm beyond the statutory violation is not required.
- For VPPA purposes, “personally identifiable information” is limited to information that would readily permit an ordinary person to identify a specific individual’s video-viewing behavior.
- Information is not VPPA PII merely because a third party could identify the viewer by combining the disclosed data with separate data from proprietary sources not disclosed by the defendant.

## Conclusion

The Ninth Circuit recognized standing based on an alleged VPPA privacy violation but held that ESPN’s disclosure of a Roku serial number and video titles, without direct identifying information, did not qualify as VPPA “personally identifiable information,” so the complaint was properly dismissed.


Eichenberger v. ESPN, Inc., 876 F.3d 979 (9th Cir. 2017)