          Case: 16-13031   Date Filed: 04/27/2017   Page: 1 of 15


                                                                    [PUBLISH]



           IN THE UNITED STATES COURT OF APPEALS

                    FOR THE ELEVENTH CIRCUIT
                      ________________________

                            No. 16-13031
                      ________________________

                  D.C. Docket No. 1:14-cv-02926-ELR



RYAN PERRY,

                                                         Plaintiff - Appellant,

                                  versus

CABLE NEWS NETWORK, INC.,
Delaware corporation,
CNN INTERACTIVE GROUP, INC.,
a Delaware corporation,

                                                      Defendants - Appellees.

                      ________________________

               Appeal from the United States District Court
                  for the Northern District of Georgia
                     ________________________


                            (April 27, 2017)
                Case: 16-13031       Date Filed: 04/27/2017       Page: 2 of 15


Before WILSON and BLACK, Circuit Judges, and RESTANI, ∗ Judge.

RESTANI, Judge:

       Appellant Ryan Perry (“Perry”) appeals the district court’s dismissal of his

complaint pursuant to Federal Rule of Civil Procedure 12(b)(6). The district court

held that Perry failed to state a claim under the Video Privacy Protection Act

(“VPPA”) both because Perry is not a statutory “consumer” and the information at

issue is not “personally identifiable information.” The district court also reasoned

that Perry’s proposed amendments to his complaint would be futile. We affirm.

                                      BACKGROUND

       According to Perry’s complaint, Appellee Cable News Network, Inc. is a

producer of news programming for television. Cable News Network, Inc. along

with its subsidiary Appellee CNN Interactive Group, Inc. (collectively, “CNN”)

offer media content on a mobile software application (or “app”), and Perry alleges

that CNN’s proprietary app (the “CNN App”) is available for download on mobile

devices, including on Apple, Inc. (“Apple”)’s iPhone. Through the CNN App,

users can get breaking news alerts, follow stories, and watch video clips and

coverage of live events.




∗
 Honorable Jane A. Restani, Judge for the United States Court of International Trade, sitting by
designation.


                                                2
              Case: 16-13031     Date Filed: 04/27/2017     Page: 3 of 15


      The CNN App may be downloaded through the Apple iTunes Store. The

CNN App never seeks the user’s consent to disclose the user’s personal data to any

third parties. Perry, who is a citizen of Illinois, began using the CNN App in early

2013 on his iPhone. He never consented to allow CNN to disclose his personally

identifiable information.

      Perry alleges that the CNN App, without a user’s knowledge, both tracks the

user’s views of news articles and videos and also collects a record of this viewing

activity. When a user closes the CNN App, CNN sends the collected record of

viewing activity to a company called Bango, a third party company that conducts

data analytics. CNN also sends Bango a media access control address (“MAC

address”), which is a unique string of numbers associated with a particular user’s

specific mobile device.

      Bango then uses the MAC address to link an internet user’s unique device

identifier to the user’s other internet activity in order to understand the user’s

online behavior. Bango constructs a digital file related to the user’s online

behavior by accessing information available to Bango from an extensive range of

networks and devices. Bango is able to compile personal information, including

the user’s name, location, phone number, email address, and payment information,

and it can attribute this information to a single user across different devices and

platforms.


                                           3
             Case: 16-13031     Date Filed: 04/27/2017    Page: 4 of 15


      On February 18, 2014, Perry filed a proposed class action in the district

court. In his first amended complaint, Perry sets forth one cause of action for

violation of the VPPA, 18 U.S.C. § 2710. Perry seeks injunctive relief and both

statutory and punitive damages due to CNN’s allegedly unlawful disclosures of

personally identifiable information.

      Following this court’s opinion in Ellis v. Cartoon Network, Inc., 803 F.3d

1251 (11th Cir. 2015), in which we affirmed the dismissal of a complaint bringing

similar allegations pursuant to the VPPA, Perry sought leave of the district court to

amend his complaint. On April 20, 2016, the district court granted CNN’s motion

to dismiss the amended complaint, reasoning that further amendment to the

complaint would be futile. Perry appeals.

              JURISDICTION AND STANDARD OF REVIEW

      We have jurisdiction of this appeal pursuant to 28 U.S.C. § 1291. We

review de novo the issue of whether a party has standing. Palm Beach Golf Ctr.-

Boca, Inc. v. John G. Sarris, D.D.S., P.A., 781 F.3d 1245, 1251 (11th Cir. 2015).

We also review de novo a district court’s decision to deny leave to amend for

futility. Cockrell v. Sparks, 510 F.3d 1307, 1310 (11th Cir. 2007) (per curiam).




                                          4
              Case: 16-13031     Date Filed: 04/27/2017    Page: 5 of 15


                                    DISCUSSION

I.    Standing

      CNN argues Perry has not alleged a legally cognizable injury in the light of

the Supreme Court’s decision in Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016)

because Perry’s alleged violation of a statutory right is not on its own sufficiently

concrete.

      Federal jurisdiction is circumscribed by the case or controversy requirement

of Article III of the Constitution, essential to which is the doctrine of standing.

U.S. Const. art. III, § 2, cl. 1; Lujan v. Defenders of Wildlife, 504 U.S. 555, 559–

60 (1992). To demonstrate standing, a “plaintiff must have (1) suffered an injury

in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and

(3) that is likely to be redressed by a favorable judicial decision.” Spokeo, 136 S.

Ct. at 1547. An injury in fact is both “concrete and particularized” as well as

“actual or imminent, not conjectural or hypothetical[.]” Friends of the Earth, Inc.

v. Laidlaw Envtl. Servs. (TOC), Inc., 528 U.S. 167, 180 (2000).

      In Spokeo, the Supreme Court vacated the decision of the Court of Appeals

and remanded the issue of whether a plaintiff sufficiently alleged a concrete injury

where the plaintiff claimed a statutory violation of the Fair Credit Reporting Act

(“FCRA”). 136 S. Ct. at 1545–46. The plaintiff alleged that a website had

published inaccurate information about him. Id. at 1544. The Supreme Court


                                           5
              Case: 16-13031     Date Filed: 04/27/2017    Page: 6 of 15


emphasized that in addition to being particularized, intangible injuries, including

statutory violations, must still be concrete. Id. at 1548 (“A ‘concrete’ injury must

be ‘de facto’; that is, it must actually exist.”). The Supreme Court stated that “both

history and the judgment of Congress play important roles” in determining whether

an intangible harm is concrete, explaining that “it is instructive to consider whether

an alleged intangible harm has a close relationship to a harm that has traditionally

been regarded as providing a basis for a lawsuit in English or American courts.”

Id. at 1549. The Supreme Court held that the plaintiff there had only alleged a

“bare procedural violation” of the FRCA because the violation, on its own, may

not cause any harm or present a material risk of harm. Id. at 1550.

      Perry has established his standing to file this action because his alleged

injury is sufficiently concrete. Although Perry does not allege any additional harm

beyond the statutory violation, the Supreme Court has made clear that our analysis

does not end there. See Spokeo, 136 S. Ct. at 1549. Instead, “the violation of a

procedural right granted by statute can be sufficient in some circumstances to

constitute injury in fact” so that “a plaintiff in such a case need not allege any

additional harm beyond the one Congress has identified.” Id.; see also Havens

Realty Corp. v. Coleman, 455 U.S. 363, 373 (1982) (instructing that injury in fact

“may exist solely by virtue of ‘statutes creating legal rights, the invasion of which

creates standing . . . .’” (quoting Warth v. Seldin, 422 U.S. 490, 500 (1975))).


                                           6
              Case: 16-13031      Date Filed: 04/27/2017    Page: 7 of 15


      The structure and purpose of the VPPA supports the conclusion that it

provides actionable rights. Subject to certain exceptions, the VPPA prohibits the

wrongful disclosure by a video tape service provider of video tape rental or sale

records. 18 U.S.C. § 2710. It creates a cause of action for “[a]ny person aggrieved

by any act of a person in violation of this section.” 18 U.S.C. § 2710(c)(1). The

statute was enacted in response to a newspaper’s publication of Supreme Court

nominee Judge Robert H. Bork’s video rental history from a particular store, and it

seeks “‘to preserve personal privacy with respect to the rental, purchase, or delivery

of video tapes or similar audio visual materials . . . .’” Ellis, 803 F.3d at 1252–53

(quoting 134 Cong. Rec. S5396-08, S. 2361 (May 10, 1988)). We conclude that

violation of the VPPA constitutes a concrete harm. See In re Nickelodeon, 827

F.3d 262, 274 (3d Cir. 2016) (“While perhaps ‘intangible,’ the harm is also

concrete in the sense that it involves a clear de facto injury, i.e., the unlawful

disclosure of legally protected information.”).

      Indeed, the VPPA’s creation of a cause of action for this type of an invasion

of privacy “has a close relationship to a harm that has traditionally been regarded

as providing a basis for a lawsuit in English or American courts.” Spokeo, 136 S.

Ct. at 1549. Since the early 1900s, “the existence of a right of privacy [has been]

recognized in the great majority of the American jurisdictions that have considered

the question.” Restatement (Second) of Torts § 652A cmt. a. (Am. Law Inst.


                                            7
                Case: 16-13031         Date Filed: 04/27/2017        Page: 8 of 15


1977); see also U.S. Dep’t of Justice v. Reporters Comm. for Freedom of the Press,

489 U.S. 749, 763 (1989) (“[B]oth the common law and the literal understandings

of privacy encompass the individual’s control of information concerning his or her

person.”). Further, in the tort of intrusion upon seclusion, 1 “[t]he intrusion itself

makes the defendant subject to liability, even though there is no publication or

other use,” meaning a showing of additional harm is not necessary to create

liability. Restatement (Second) of Torts § 652B cmt. b (emphasis added). The

VPPA is similar but subjects a video service provider to liability only when that

provider actually discloses the consumer’s personal information. Supreme Court

precedent has recognized in the privacy context that an individual has an interest in

preventing disclosure of personal information. See Reporters Comm. for Freedom

of the Press, 489 U.S. at 762 (“[C]ases sometimes characterized as protecting

‘privacy’ have in fact involved . . . the individual interest in avoiding disclosure of

personal matters, . . . .” (quoting Whalen v. Roe, 429 U.S. 589, 598–600 (1977))).

Accordingly, we hold that a plaintiff such as Perry has satisfied the concreteness




1
  The Restatement defines this tort as follows: “[o]ne who intentionally intrudes, physically or
otherwise, upon the solitude or seclusion of another or his private affairs or concerns, is subject
to liability to the other for invasion of his privacy, if the intrusion would be highly offensive to a
reasonable person.” Restatement (Second) of Torts § 652B. It provides examples, including the
“opening [of a plaintiff’s] private and personal mail, searching his safe or his wallet, [and]
examining his private bank account.” Id. § 652B cmt. b.


                                                  8
               Case: 16-13031       Date Filed: 04/27/2017      Page: 9 of 15


requirement of Article III standing, where the plaintiff alleges a violation of the

VPPA for a wrongful disclosure. 2

II.    Video Privacy Protection Act

       Although Perry concedes that his complaint fails to state a claim under the

VPPA, he argues that the district court erred in denying leave to amend.

Specifically, Perry argues that, if permitted, he would amend his complaint to

“allege that in addition to downloading the CNN App and viewing CNN content on

his iPhone, he also subscribed to CNN’s television channel through his cable

package.” Perry also contends that CNN’s transmission of his MAC address and

video history is “personally identifiable information” as defined in the VPPA.

       The VPPA generally prohibits “[a] video tape service provider [from]

knowingly disclos[ing], to any person, personally identifiable information

concerning any consumer of such provider.” 18 U.S.C. § 2710(b). The statute

defines “consumer” as “any renter, purchaser, or subscriber of goods or services

from a video tape service provider[.]” Id. § 2710(a)(1). In interpreting the term

“subscriber,” we have previously said that the term requires some sort of “ongoing

commitment or relationship between the user and the entity which owns and

operates the app.” Ellis, 803 F.3d at 1257.


2
 For the reasons stated above, we deny CNN’s motion to dismiss this appeal and Perry’s
subsequent motion for sanctions.


                                              9
               Case: 16-13031        Date Filed: 04/27/2017       Page: 10 of 15


       The district court properly held that Perry’s attempt to amend his complaint

is futile. Our decision in Ellis controls and requires the conclusion that Perry is not

a “subscriber” within the meaning of the VPPA because Perry has failed to

sufficiently plead new allegations that would distinguish his case from Ellis. 3

Similar to the situation here, in Ellis, a plaintiff alleged that he was a subscriber of

a Cartoon Network free mobile app where he viewed videos on the app and

Cartoon Network sent his viewing history and his mobile device identification

number to Bango without the plaintiff’s consent. 803 F.3d at 1253–54. We held

that the plaintiff there was not a “subscriber,” reasoning that “downloading an app

for free and using it to view content at no cost is not enough to make a user of the

app a ‘subscriber’ under the VPPA. . . . [S]uch a user is free to delete the app

without consequences whenever he likes, and never access its content again.” Id.

at 1257.

       By the same token, Perry is not a subscriber of CNN because he has not

demonstrated an ongoing commitment or relationship with CNN. Just as the

plaintiff in Ellis, Perry did not “sign up for or establish an account with” CNN,

“provide any personal information to” CNN, “make any payments” to CNN in

using its app, “become a registered user” of CNN or its app, “receive a [CNN] ID,”


3
 Perry limits his appeal to arguing that he is a “subscriber” as described in 18 U.S.C.
§ 2710(a)(1). We limit our discussion accordingly.


                                                10
               Case: 16-13031        Date Filed: 04/27/2017        Page: 11 of 15


“establish a [CNN] profile,” “sign up for any periodic services or transmissions,”

nor “make any commitment or establish any relationship that would allow him to

have access to exclusive or restricted content.” Id. Perry, through his proposed

amendment regarding his cable television subscription,4 attempts to address the

aforementioned factors in Ellis by claiming that he received some exclusive or

restricted content on the CNN App based on his relationship with his cable

television provider and that he made payments to CNN.

       Perry’s proposed amendment, however, shows a commitment to only his

cable television provider, rather than to CNN. First, Perry contends that because of

his television subscription he is able to access “certain features” on the CNN App

that a typical CNN App user cannot. From Perry’s cursory explanation, it appears

that he accesses these features due to his status as a subscriber of his cable

television provider. 5 The only example of a feature that Perry provides is that a


4
  Before us and the district court, Perry has provided few specific details about his proposed
allegation or the contents of his cable subscription. Therefore, although he is entitled to
reasonable inferences, such inferences may logically derive only from factual allegations actually
made. See Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (“A claim has facial plausibility when
the plaintiff pleads factual content that allows the court to draw the reasonable inference that the
defendant is liable for the misconduct alleged.”). We conduct our review accordingly.
5
  Perry does not state a cause of action against his cable television service provider. Although
his only claim is an alleged violation of the VPPA, he makes no allegation that his cable
television provider is a “video service provider” within the meaning of the VPPA. See 18 U.S.C.
§ 2710(a)(4). And, in any event, it appears that the conduct of his cable television provider in
this context is governed by another law. See 47 U.S.C. § 551(c) (discussing a cable operator’s
duty to not disclose personally identifiable information subject to certain exceptions); see also 47
U.S.C. § 338(i)(4)(A) (providing a similar duty for satellite carriers).


                                                11
              Case: 16-13031     Date Filed: 04/27/2017    Page: 12 of 15


user of the CNN App can watch live television on the CNN App, if the user has a

cable television subscription, selects their cable service provider in the CNN App,

and signs in using their credentials for an online account that the user maintains

with their cable television provider. But, Perry’s choice to watch CNN live on the

CNN App (after logging in) rather than on his television does not somehow

convert him into a subscriber of CNN. Again, Perry can access this live television

on the CNN App solely because of his separate relationship with his cable

television provider, as is clear by the fact that Perry has to select his cable

television provider, that Perry uses the credentials associated with his cable

television provider’s account (not a separate CNN account), and that the content

available on his television and on the CNN App appear to be the same. Notably, a

person, who has not downloaded the CNN App, but has a subscription to the same

cable television provider could access the same content as Perry on his or her

television. Yet, that person would not be a subscriber of CNN. Outside of

downloading the CNN App and perhaps acknowledging in the app that he has a

cable television subscription, there is no indication that Perry has engaged CNN in

any other way in order to gain access to this exclusive feature. This is insufficient

to create the requisite “ongoing commitment or relationship” with CNN. Ellis, 803

F.3d at 1256–57 (describing a subscription as involving “some type of




                                           12
             Case: 16-13031      Date Filed: 04/27/2017    Page: 13 of 15


commitment, relationship, or association (financial or otherwise) between a person

and an entity”).

      Second, Perry’s argument that CNN indirectly receives a monetary benefit

by virtue of Perry’s direct payments to his cable television provider similarly

misses the mark. Perry’s distinct financial relationship with his cable television

provider does not shed light on his commitment to CNN because, for instance, if

his cable television provider removed CNN from Perry’s cable package, it would

not affect Perry’s ability to use the CNN App for free video content.

      Perry’s citation to the First Circuit’s decision in Yershov v. Gannett Satellite

Information Network, Inc., 820 F.3d 482 (1st Cir. 2016) does not alter our holding.

Not only are we bound by our decision in Ellis, the reasoning with which the First

Circuit appears to take some issue, but also Yershov is distinguishable. There, the

First Circuit distinguished Ellis by noting that the plaintiff in Yershov, in order to

use the app at issue, provided his mobile device identification number and GPS

location to the proprietor of the app. Id. at 489. That fact was sufficient to

“establish a relationship” with the proprietor of the app. Id. In the present case,

however, Perry admitted before the district court that he was never required to

register for the CNN App, even stating that the CNN App did not request his email




                                          13
               Case: 16-13031       Date Filed: 04/27/2017       Page: 14 of 15


address, his credit card number, or his GPS location.6 Perry, therefore, did not

actively provide his personal information to CNN in exchange for the CNN App

nor has he demonstrated that he manifested his relationship with and commitment

to CNN in any meaningful way.

       We decide that the ephemeral investment and commitment associated with

Perry’s downloading of the CNN App on his mobile device, even with the fact that

he has a separate cable television subscription that includes CNN content, is simply

not enough to consider him a “subscriber” under Ellis. Perry still “is free to delete

the app without consequences whenever he likes, and never access its content

again.” Ellis, 803 F.3d at 1257. Accordingly, the district court correctly

determined that Perry’s cable subscription as described is not the something

“more” under Ellis necessary to state a claim under the VPPA. Id. at 1258. At

most, the cable subscription shows that Perry is a subscriber of his cable television

provider. Having concluded that the district court did not err in concluding that

Perry is not a “subscriber” as defined by the VPPA such that CNN may be held


6
  Perry claims instead that he was “de facto registered” as apps, in general, are unique because
their proprietors can automatically access personal data on a user’s mobile device. Perry’s
argument, which rests on the assumption that, upon download, a proprietor of an app gains
access to a wealth of personal information belonging to a user, would require the conclusion that
every app user is a subscriber. This is so because the exchange of this personal information
necessarily occurs, in Perry’s view, with the download and normal use of an app. But, such a
broad definition of subscriber would squarely conflict with our holding in Ellis by eliminating
the condition that a subscriber have an “ongoing commitment or relationship” with the app’s
proprietor. See 803 F.3d at 1257.


                                               14
             Case: 16-13031    Date Filed: 04/27/2017    Page: 15 of 15


liable, we need not address the second prong for liability under the VPPA, whether

CNN provided Perry’s “personally identifiable information” to a third party.

                                 CONCLUSION

      For the reasons stated above, the judgment of the district court is

      AFFIRMED.




                                         15
