## Facts

- Children under 13 brought a consolidated class action alleging online tracking on Nickelodeon/Viacom child-directed websites, including Nick.com.
- Viacom encouraged children to register profiles and allegedly collected demographic data (e.g., gender and birthday) and tracked videos played and pages visited.
- Plaintiffs alleged Viacom placed first-party cookies without parental consent, collecting IP address, browser/device settings, and browsing history, and shared data with Google.
- Plaintiffs alleged Google placed third-party cookies assigning unique identifiers that could be linked to information disclosed by Viacom and used for targeted advertising, including tracking across sites.
- Viacom’s website included privacy-related statements that plaintiffs alleged created an expectation that certain information would not be collected.
- The district court dismissed all claims with prejudice after amendment; plaintiffs appealed.

## Issues

1. Whether the alleged online tracking and disclosure constituted a concrete injury sufficient for Article III standing.
2. Whether cookie-based tracking and related conduct stated claims under the Wiretap Act and the Stored Communications Act.
3. Whether the Video Privacy Protection Act (VPPA) applied, including (a) whether a recipient can be liable and (b) whether IP addresses and similar identifiers are “personally identifiable information.”
4. Whether state statutory claims (including New Jersey CROA and California privacy statute theories) were plausibly pleaded.
5. Whether plaintiffs stated a New Jersey intrusion-upon-seclusion claim against Viacom and/or Google, and whether COPPA preempted that claim.

## Decision

- The Third Circuit held plaintiffs had Article III standing based on alleged unlawful disclosure of legally protected privacy interests.
- The court affirmed dismissal of Wiretap Act and Stored Communications Act claims.
- The court affirmed dismissal of VPPA claims against Google because the statute targets disclosers, not mere recipients of information.
- The court affirmed dismissal of VPPA claims against Viacom because the disclosed data (e.g., IP addresses and other static identifiers) was not “personally identifiable information” under the VPPA.
- The court affirmed dismissal of the state statutory claims, concluding the alleged web-tracking did not fall within the statutes invoked.
- The court reversed dismissal of the New Jersey intrusion-upon-seclusion claim against Viacom and remanded for further proceedings.
- The court affirmed dismissal of the intrusion-upon-seclusion claim against Google.
- The court held COPPA did not preempt the intrusion-upon-seclusion claim against Viacom.

## Legal Principles

- Alleged unlawful disclosure of information protected by privacy statutes can constitute a concrete injury for Article III standing at the pleading stage.
- Cookie-based collection of web-browsing information, as pleaded, did not satisfy the statutory elements required for liability under the Wiretap Act or the Stored Communications Act.
- VPPA liability in a private action is limited to an entity that “knowingly discloses” qualifying information; an entity that merely receives information is not liable under the VPPA on that theory.
- Under the VPPA as applied, IP addresses and similar static digital identifiers, without more direct identification, are not “personally identifiable information.”
- Under New Jersey law, intrusion upon seclusion requires an intentional intrusion that would be highly offensive to a reasonable person; a website operator’s privacy representations can bear on whether users had a reasonable expectation of privacy.
- COPPA does not categorically preempt state common-law privacy claims that supplement rather than conflict with COPPA’s protections.

## Conclusion

The Third Circuit permitted the litigation to proceed only on a New Jersey intrusion-upon-seclusion theory against Viacom, while otherwise affirming dismissal of federal privacy claims (including VPPA, Wiretap Act, and SCA) and state statutory claims, and holding that COPPA did not preempt the surviving common-law claim.


In re Nickelodeon Consumer Privacy Litig., 827 F.3d 262 (3d Cir. 2016)