Meta Pixels Case Dismissed by Second Circuit–Solomon v. Triller

May 5, 2025 · by · in Privacy/Security

This ruling combines three common blog topics: (1) the VPPA 🙄, which always gets an eyeroll emoji because so many VPPA cases are obviously meritless, (2) the Meta Pixel cases, which are the modern successors to the 2003 Pharmatrak case I still teach in Internet Law, and (3) the definition of “personally identifiable information,” which has become incoherent in light of modern reidentification techniques that can uniquely identify people based on seemingly trivial scraps of data. The Second Circuit, looking to issue as narrow a ruling as possible in the face of this melange of complex topics, reads the VPPA’s definition of “personally identifiable information” in a defense-favorable way, which defeats this VPPA lawsuit over Meta Pixels.

* * *

The defendant operates the Triller (formerly “FITE”) video service. Wikipedia says Triller “allows users to create and share short-form videos, including videos set to, or automatically synchronized to, music using artificial intelligence technology,” so it occupied some of the same niche as Musical.ly pre-TikTok. Wikipedia also indicates that the service expanded into live sports broadcasts such as boxing. This is Triller’s second appearance on the blog.

The court summarizes the Meta Pixel’s operation:

During the installation process, FITE configured the Pixel on its website to include PageView. Since the implementation of the Pixel, every time a FITE consumer accesses a video on a FITE application or website, FITE, through the Pixelʹs PageView, sends Facebook certain information about the user and her viewing history. The following is an ʺexemplar screenshotʺ depicting the transmission that FITE sends Facebook via the Pixelʹs PageView.

The court provides a screenshot of the information passed to Facebook in the URL via the GET command:

Box A contains the video title watched by a viewer. Box B includes the viewer’s Facebook ID.

“FITE does not disclose or discuss the Pixel specifically in its Terms of Use, Privacy Policy, or any other material provided to subscribers, nor does FITE provide an opportunity for its consumers to decline or withdraw consent to FITEʹs use of the Pixel.” In contrast, adequate privacy policy disclosures ended a different Pixels case.

* * *

“It is undisputed that FITE is a video service provider that knowingly disclosed certain information about Solomon to Facebook ‐‐ namely, computer code that denoted the titles and URLs of the videos Solomon accessed and her FID. If that information constitutes ‘personally identifiable information,’ then Solomon would have plausibly alleged a violation of the VPPA.”

However, the VPPA doesn’t define “personally identifiable information,” and:

Courts across the country, including lower courts in this circuit, have observed that the VPPA is ʺʹnot well drafted,ʹʺ and that its definition of personally identifiable information is ʺoblique[]ʺ and not ʺclearʺ

Sounds like a recipe for jurisprudential confusion. The court discusses three precedents (all from nearly a decade ago): the First Circuit’s Yershov case reaching a plaintiff-friendly outcome and the Third Circuit’s Nickelodeon and Ninth Circuit’s Eichenberger cases, reaching less plaintiff-friendly outcomes.

The Second Circuit sides with the 3rd and 9th Circuits and against the 1st Circuit to conclude:

ʺpersonally identifiable informationʺ encompasses information that would allow an ordinary person to identify a consumerʹs video‐watching habits, but not information that only a sophisticated technology company could use to do so.

The “ordinary person” standard might sound OK in the abstract, and it answers the question in this case. However, I have no idea how to ascertain the technical expertise of an “ordinary person” without doing expensive consumer survey work.

Applying its “ordinary person” standard, the court says the plaintiff loses:

The exemplar [screenshot above] depicts some twenty‐nine lines of computer code, and the video title is indeed contained in Box A following the GET request. The words of the title, however, are interspersed with many characters, numbers, and letters. It is implausible that an ordinary person would look at the phrase ʺtitle%22%3A%22-%E2%96%B7%20The%20Roast%20of%‐20Ric%20Flairʺ ‐‐ particularly if the highlighting in Box A is removed ‐‐ and understand it to be a video title.14 It is also implausible that an ordinary person would understand, ʺwith little or no extra effort,ʺ the highlighted portion to be a video title as opposed to any of the other combinations of words within the code, such as, for example, ʺ%9C%93%20In%20the%20last%20weekend%20of%20‐July%2C.ʺ…

Because the redacted sequence of numbers in the second line of Box B is not labeled, the FID would be just one phrase embedded in many other lines of code. And if the numbers in the exemplar were not redacted, what an individual would see is, for example, a phrase such as ʺc_user=123456ʺ or ʺc_user=00000000.ʺ Although a section of the code in Box A does state ʺ[h]ost: www.facebook.com,ʺ it is not plausible that an ordinary person, without the annotation of Box B, would see the ʺc_userʺ phrase on FITEʹs servers and conclude that the phrase was a personʹs FID.

All of this is true, but with a few quick Google searches, an ordinary person would be able to read this URL like a champ. So the court is assuming that consumers are not technically sophisticated, not intellectually curious, and not motivated to do simple searches. Other than that, the court’s approach makes sense. 🙄 (Well, about as much sense as any other recent VPPA Pixels case…).

The district court dismissed this case, but many Meta Pixel cases have survived motions to dismiss. I haven’t tried to systematically track or organize the Pixel cases because they are so voluminous and, in many cases, so obviously meritless. I figured the shit will get real when any Meta Pixel cases survive on appeal and we find out where they actually have any merit. As this ruling reinforces, many Meta Pixel plaintiffs face significant uphill challenges.

Case Citation: Solomon v. Flipps Media, Inc., 2025 WL 1256641 (2d Cir. May 1, 2025)

More Posts on the Pixel Cases