Keogh v. Meta Platforms, Inc.

680 F.Supp.3d 601

Kyle KEOGH, on behalf of himselfand all others similarly situated, Plaintiff, v. META PLATFORMS, INC., Defendant.

CIVIL ACTION NO. 6:23-CV-5004-KDB

United States District Court, D. South Carolina, Greenville Division

Signed February 14, 2023

Blake Garrett Abbott, Paul J. Doolittle, Poulin Willey Anastopoulo LLC, Charleston, SC, Stefan Bogdanovich, Pro Hac Vice, Bursor and Fisher PA, Walnut Creek, CA, for Plaintiff.

Allie Aleece Maples, Joshua S. Whitley, Smyth Whitley, LLC, Charleston, SC, Darcy Caitlyn Harris, Pro Hac Vice, Lauren R. Goldman, Gibson Dunn and Crutcher LLP, New York, NY, Elizabeth Katharine McCloskey, Pro Hac Vice, Gibson Dunn and Crutcher LLP, San Francisco, CA, Jonathan Charles Bond, Pro Hac Vice, Gibson Dunn and Crutcher LLP, Washington, DC, for Defendant.

ORDER

Kenneth D. Bell, District Judge

In this putative class action, Plaintiff seeks to hold Defendant Meta Platforms, Inc. ("Meta") liable to all Facebook account holders in the United States who visited South Carolina DMV's ("SCDMV") website since October 2019 for alleged violations of the Drivers' Privacy Protection Act, 18 U.S.C. § 2721, et seq. ("DPPA"). More specifically, Plaintiff alleges that by tracking computer "cookies" generated when Facebook members visit the SCDMV website, Meta unlawfully obtains personal information (Facebook ID numbers), which it then uses in its advertising efforts. In response to the Complaint, Meta has moved to dismiss the action, arguing that Plaintiff has not alleged a violation of the statute as a matter of law. See Doc. No. 10.

The Court has carefully considered this motion, the parties' briefs and exhibits and oral argument on the motion from the parties' counsel on February 13, 2024. In practical effect, Plaintiff contends that simply by visiting the SCDMV website for any purpose (or even by mistake) every Facebook account holder suffers a violation of the DPPA. But, the statute does not sweep nearly that broadly. Rather, its proscription is limited to obtaining or disclosing statutorily defined "personal information from a motor vehicle record" for a use not permitted by the statute. See 18 U.S.C. § 2722. Because the Court finds that, at a minimum, the Complaint fails to sufficiently assert that the alleged personal information obtained by Meta came "from a motor vehicle record" Plaintiff's allegations fall short of a violation of the DPPA. Therefore, Meta's motion will be granted and this case dismissed.

I. LEGAL STANDARD

Under Rule 8(a)(2) of the Federal Rules of Civil Procedure, a complaint must contain a "short and plain statement of the claim showing that the pleader is entitled to relief." Rule 12(b)(6) of the Federal Rules of Civil Procedure authorizes the dismissal of a complaint if it fails to state a claim upon which relief can be granted. The purpose of Rule 12(b)(6) is to expose deficient allegations "at the point of minimum expenditure of time and money by the parties and the court." Bell Atl. Corp. v. Twombly, 550 U.S. 544, 558, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007).

To survive a Rule 12(b)(6) motion to dismiss, the plaintiff must plead facts sufficient to "state a claim to relief that is plausible on its face." Ashcroft v. Iqbal, 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009) (citing Twombly, 550 U.S. at 570, 127 S.Ct. 1955). "A claim has facial plausibility when the pleaded factual content allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Id. (citing Twombly, 550 U.S. at 556, 127 S.Ct. 1955). In evaluating whether a claim is sufficiently stated, "[the] court accepts all well-pled facts as true and construes these facts in the light most favorable to the plaintiff," but does not consider "legal conclusions, elements of a cause of action, . . . bare assertions devoid of further factual enhancement[,] . . . unwarranted inferences, unreasonable conclusions, or arguments." Nemet Chevrolet, Ltd. v. Consumeraffairs.com, Inc., 591 F.3d 250, 255 (4th Cir. 2009); see Twombly, 550 U.S. at 555, 127 S.Ct. 1955 (A claim will not survive a motion to dismiss if it contains nothing more than "labels and conclusions, and a formulaic recitation of a cause of action's elements."). That said, "a well-pleaded complaint may proceed even if it strikes a savvy judge that actual proof of those facts is improbable, and that a recovery is very remote and unlikely." Id. (internal citation and quotation marks omitted). In other words, a motion to dismiss under Rule 12(b)(6) determines only whether a claim is stated; "it does not resolve contests surrounding the facts, the merits of a claim, or the applicability of defenses." Republican Party v. Martin, 980 F.2d 943, 952 (4th Cir. 1992).

II. FACTS AND PROCEDURAL HISTORY

Plaintiff is a South Carolina citizen with a Facebook account who alleges that he visited the SCDMV's website in September 2022 to complete various kinds of online "private business" with the agency. Doc. No. 1 at ¶¶ 6, 43-44. Plaintiff does not allege that he visited any particular webpage or clicked any particular button on the site.¹ Further, while he generally alleges that Meta used information related to his online visit to the SCDMV "to help it in its advertising efforts," he does not describe or even allege that he received any advertising from Meta concerning his DMV visit. See id. at ¶ 46.

With respect to Meta's connection to the SCDMV, Plaintiff alleges that the DMV uses the "Meta Pixel" on its website. Id. at ¶ 20. The Meta Pixel "is a piece of code" that third-party web developers can "integrate into their website." Id. at ¶ 17. Developers can then use the Pixel to (1) measure certain actions users take on the developers' own sites, such as the webpages users view and the buttons they click, and (2) send that information to Meta to help assess and improve the effectiveness of the developers' advertising. Id. at ¶¶ 16-17. Plaintiff alleges the DMV "transmits two distinct events to Meta" through the Pixel: "PageView" and "Button Click." Id. at ¶ 20. The first event (PageView) "tells Meta which specific website URL the driver has navigated to." Id. at ¶ 21. The second event (Button Click) tells Meta "when a driver clicks on a particular button on a webpage, along with the text of that button." Id. at ¶ 22.

Plaintiff alleges that "[w]hen [he] was navigating the South Carolina DMV website, Meta obtained and used his personal information, along with various event data, including PageView, microdata and Button Click." Id. at ¶ 45. The "personal information" plaintiff alleges Meta obtained consists of "identifiers for [plaintiff] including the c_user and fr cookies . . . on his web browser." Id.; see also id. at ¶¶ 57, 59 ("The Facebook ID numbers [contained in the c_user and fr cookies] are 'personal information.' ").

Contractual "Terms of Service" and related disclosures govern Plaintiff's relationship with Facebook. When users sign up for a Facebook account, they agree to Meta's Terms of Service, Privacy Policy and Cookies Policy. Doc. No. 10-2 (Terms of Service), 10-3 (Privacy Policy) and 10-4 (Cookies Policy).² The Terms state that Meta shows users "personalized ads, offers, and other sponsored or commercial content to help [them] discover content, products, and services that are offered by the many businesses and organizations that use Facebook and other Meta Products." Id. To provide these services, the Terms explain, Meta "collect[s] and use[s] your personal data." Id. The Terms link to the Privacy Policy for more information.

The Privacy Policy "describes the information [Meta] process[es] to provide Meta Products," including Facebook and the Meta Business Tools (which include the Meta Pixel). Doc. No. 10-3. Among other things, the Privacy Policy tells users that Meta "receive[s] information using cookies and similar technologies, like the Meta Pixel or Social Plugins, when you visit other websites and apps that use our Business Tools or other Meta Products," and specifically explains that Meta can receive "a variety of your information and activities on and off our Products," including "[y]our device information," "[h]ow you use [third-party websites'] products and services," and "[w]ebsites you visit and cookie data, like through . . . the Meta Pixel." Id. The Privacy Policy links to the Cookies Policy for additional information. Id. The Privacy Policy also discloses that Meta then uses this information "to personaliz[e] features, content and recommendations, such as your Facebook Feed, Instagram feed, Stories, and ads." Id. Meta gives users the option of turning off "ads based on [their] activity on other websites." Id.

Cookies are "small pieces of text used to store information on web browsers." Doc. No. 10-4. They "store and receive identifiers and other information on computers, phones and other devices," and they can serve a number of different functions—for example, "personalizing content, tailoring and measuring ads, and providing a safer experience." Id. Meta's Cookies Policy tells users that Meta "use[s] cookies if you have a Facebook or Instagram account, use the Meta Products, including our website and apps, or visit other websites and apps that use the Meta Products." Id. The policy explains that cookies allow Meta to "understand the information that we receive about you, including information about your use of other websites," and that Meta "use[s] cookies to help us show ads and to make recommendations for businesses and other organizations to people who may be interested in the products, services, or causes they promote." Id. The Cookies Policy also describes the two cookies at issue here, the "c_user" and "fr" cookies. Id. The c_user cookie is used to authenticate users and keep them logged in as they navigate between Facebook pages, and to remember a browser, so that users "don't have to keep logging in to Facebook and . . . can more easily log in to Facebook via third-party apps...