Hughes v. NFL: Second Circuit Shuts the Door on Pixel-Based VPPA Claims
by Re-affirming the “Ordinary Person” Standard

Introduction

In Hughes v. National Football League, the United States Court of Appeals for the Second Circuit confronted once more a modern wave of privacy litigation: lawsuits that accuse media companies of violating the Video Privacy Protection Act (VPPA) by deploying the Facebook “Pixel” on their websites and mobile applications. Brandon Hughes, on behalf of a putative class of NFL.com users, alleged that the NFL’s installation of the Pixel caused the disclosure of his video-viewing history and Facebook identification information without consent, thereby infringing the VPPA.

The district court (Rochon, J.) dismissed the complaint under Federal Rule of Civil Procedure 12(b)(6), finding that Hughes failed to state a plausible statutory claim. While the appeal was pending, the Second Circuit decided two key VPPA cases: Salazar v. NBA (2024) and, more critically, Solomon v. Flipps Media, Inc. (2025). In Solomon the court adopted an “ordinary person” benchmark for determining whether data constitutes “personally identifiable information” (PII) under the VPPA, and ruled that code strings transmitted through the Facebook Pixel do not satisfy that standard.

Armed with Solomon, the NFL urged affirmance, arguing that the precedent is dispositive. Hughes conceded the relevance of Solomon but sought remand to amend his complaint. The Second Circuit declined, holding that amendment would be futile and explicitly “shut the door” on Pixel-based VPPA theories predicated on the ordinary-person test.

Summary of the Judgment

The Second Circuit (Livingston, C.J., Newman & Sullivan, JJ.) affirmed the district court’s dismissal in a non-precedential “Summary Order,” yet its reasoning carries significant persuasive weight:

  • No Plausible VPPA Claim Post-Solomon. The court ruled that the information transmitted by the Pixel—namely Facebook IDs (FIDs) embedded in a c_user cookie and obfuscated video titles embedded in a GET request—cannot be understood by an “ordinary person” without specialized technological decoding. Consequently, such data is not PII under the VPPA.
  • Futility of Amendment. Hughes’s proposed amendments (e.g., the availability of translation tools like ChatGPT and the ubiquity of Facebook) would not transform incomprehensible code into PII readable by an ordinary reader of the underlying communication. The complaint therefore cannot be salvaged.
  • Standing Unaffected. Although the NFL renewed a standing argument (claiming Hughes consented via the Privacy Policy), the panel reiterated—echoing Salazar—that disputed consent is a merits question, not a jurisdictional defect, and thus not grounds for dismissal at the pleading stage.

Analysis

1. Precedents Cited

The opinion knits together a tapestry of recent and older authority:

  • Solomon v. Flipps Media, Inc., 136 F.4th 41 (2d Cir. 2025) – The fulcrum of the decision. It sets the “ordinary person” threshold for PII and specifically examines Facebook Pixel transmissions, holding that a lay observer would not comprehend those code strings as conveying a person’s identity and video selections.
  • Salazar v. NBA, 118 F.4th 533 (2d Cir. 2024) – Decided between the district court’s order and this appeal, Salazar recognized the possibility of VPPA liability for digital tracking but did not squarely address Pixel code. Its open questions were answered restrictively by Solomon.
  • In re Nickelodeon Consumer Privacy Litig., 827 F.3d 262 (3d Cir. 2016) & Eichenberger v. ESPN, Inc., 876 F.3d 979 (9th Cir. 2017) – Both circuits had earlier embraced an ordinary-person notion of PII, paving the way for the Second Circuit’s adoption.
  • Secondary references include O'Donnell v. AXA Equitable Life, Wakefield v. ViSalus, and procedural authorities on remand practice (New England Merchants National Bank).

2. Legal Reasoning

The panel’s reasoning unfolds in three logical moves:

  1. Step One: Determine Governing Law. Because Solomon was decided while Hughes’s appeal was pending, the doctrine of intervening precedent obliged the panel to apply it. Remand is unnecessary, the court noted, when the “new situation demands one result only.”
  2. Step Two: Apply the Ordinary-Person Standard. The VPPA’s statutory term “personally identifiable information” encompasses only data that an average observer could recognize, without the aid of specialized tools, as tying a specific individual to specific video content. Pixel-generated transmissions—laden with URL-encoding, numerical identifiers, and internal cookie labels—fail that test. The court gave concrete examples (e.g., title%22%3A%22-%E2%96%B7%20The%20Roast...) to illustrate why no layperson would discern a video title or user identity.
  3. Step Three: Assess the Futility of Amendment. Hughes’s reliance on external decoding technologies would transform the test from an “ordinary person” inquiry into an “ordinary person with AI tools” inquiry—precisely what Solomon rejected. Consequently, amendment could not cure the legal deficiency.

3. Impact of the Decision

The significance of Hughes radiates across three spheres:

  • VPPA Litigation Landscape. Together, Solomon and Hughes effectively extinguish most, if not all, claims premised solely on Facebook Pixel data within the Second Circuit. Plaintiffs must now allege disclosures that appear intelligible on their face, or combine with readily understandable metadata, to survive Rule 12(b)(6).
  • Strategic Implications for Businesses. Media companies utilizing third-party pixels gain a clearer safe harbor: so long as the transmitted strings remain indecipherable to ordinary users, VPPA exposure is minimal. Compliance efforts may shift toward transparent user notice and cookie-banner practices rather than wholesale code removal.
  • Doctrinal Clarification. The decision reinforces a textual, audience-centric reading of “PII,” contrasting with broader, technology-centric perspectives. Future courts faced with cross-border data, mobile SDKs, or novel identifiers are likely to ask first, “Could grandma read it?”

Complex Concepts Simplified

  • Video Privacy Protection Act (VPPA) – A 1988 statute sparked by a leaked video rental history of Judge Robert Bork. It bans video-service providers from knowingly disclosing personally identifiable information about consumers and supplies statutory damages of $2,500 per violation.
  • Facebook Pixel – A short JavaScript snippet embedded in websites/apps that tracks user interactions (page views, video plays) and sends data back to Meta (Facebook) servers for ad retargeting and analytics.
  • Facebook ID (FID) / c_user Cookie – A numeric identifier assigned to each Facebook account. It resides in the c_user cookie and, when transmitted, can in theory be matched to a Facebook profile.
  • Personally Identifiable Information (PII) Under the VPPA – Limited to information that allows an “ordinary person” (without special expertise) to connect a specific individual to specific videos. Mere encrypted, hashed, or URL-encoded data fails the test.
  • Rule 12(b)(6) – A motion to dismiss for “failure to state a claim.” The court assumes facts pleaded are true but asks whether, as a matter of law, the allegations articulate a plausible right to relief.
  • Article III Standing – Constitutional requirement that a plaintiff show injury in fact, traceability, and redressability. Consent is typically a merits defense, not a standing prerequisite.
  • Summary Order – A form of disposition used by the Second Circuit for non-precedential decisions. While not binding as precedent under the court’s rules, such orders often carry persuasive authority, especially when they rely on binding precedent like Solomon.

Conclusion

Hughes v. NFL may be styled a “Summary Order,” but its message is anything but summary for privacy litigants: the Second Circuit has closed the path for VPPA claims that hinge solely on arcane Pixel transmissions. By harnessing the new precedent of Solomon v. Flipps Media, the court crystallized the “ordinary person” benchmark for PII and underscored that sophisticated back-end data mining cannot retroactively convert opaque code into statutorily protected information.

Key takeaways include: (1) the centrality of lay intelligibility to VPPA liability; (2) the limited reach of consent arguments at the pleading stage; and (3) a foreseeable contraction of VPPA class-action exposure in the Second Circuit. Going forward, plaintiffs must identify disclosures that are transparent on their face, or develop alternative statutory or state-law theories, to hold online media companies liable for digital tracking practices.

In short, Hughes cements the Second Circuit as one of the most defendant-friendly venues for VPPA disputes involving the Facebook Pixel and signals to technologists and lawyers alike that transparency—not post-hoc technological wizardry—will govern the definition of privacy violations.