From Magistrate Judge Virginia DeMarchi’s opinion last week in M.K. v. Google LLC (N.D. Cal.):
The following facts are based on the allegations of the FAC [First Amended Complaint]. In 2020, M.K. was a student at a public elementary school in the District. In March 2020, due to the COVID-19 pandemic, the District closed its school buildings, and M.K. began attending school remotely using a Google platform. According to the FAC, “M.K’s parents were not given an option to opt out or an alternative to receive education if they did not wish to submit M.K. to the risks of attending school on the Google platform.”
The District assigned M.K. a Google account. Using this account, M.K. “[was] allowed to access online videos provided by Google’s YouTube, a video sharing platform[,] as well as Google [Slide Show], a platform that allows individuals to watch videos as well as insert videos and messages into slideshows to watch.” The District logged M.K. out of his Google account at the end of each school day.
According to the FAC, M.K. used multiple devices to access his Google account, including his personal iPad and, later, a Google Chromebook computer supplied by the District. M.K. watched videos on Google’s YouTube and Slide Show platforms while logged into the Google platform for school. M.K.’s teachers informed his parents that M.K. was watching videos during class when he should have been focused on his lessons. M.K.’s teachers further advised M.K.’s parents that the teachers could see M.K.’s online activity during class time. Based on this information, M.K. alleges that Google gave the District and other unidentified third parties access to M.K.’s online activity.
On or about January 14, 2021, one of M.K’s teachers reported receiving a sexually explicit communication from M.K. via a Google chat message. M.K. alleges that his Google account had been hacked and that he did not send the message. The District investigated the message incident. As part of that investigation, the District obtained and reviewed information about the dates and times M.K.’s Google account was accessed, the activities the account user engaged in while logged in to the account, and the IP addresses used to access the account.
According to the FAC, on or about January 27, 2021, M.K.’s teacher “scheduled a parent-teacher zoom call and made a teacher suspension on the basis of ‘Sexual Harassment via Google Classroom.'” The [Complaint] describes the suspension variously as a “teacher removal from class,” a two-day suspension from school, an exclusion from “his regular school day” that lasted “weeks,” and a “permanent[ ]” removal from class. M.K. eventually stopped attending school in the District….
The court held that this sufficiently alleged a violation of the Video Privacy Protection Act:
Congress enacted the Video Privacy Protection Act (“VPPA”) “to preserve personal privacy with respect to the rental, purchase or delivery of video tapes or similar audio visual materials.” The statute forbids “video tape service provider[s]” from knowingly disclosing “personally identifiable information concerning any consumer.” A person aggrieved by a violation of the statute may bring an action for actual damages of not less than $2,500, punitive damages, attorneys’ fees, and injunctive relief. To state a claim for violation of the VPPA, M.K. must plausibly allege that (1) Google is a “video tape service provider,” (2) M.K. is a “consumer,” (3) Google knowingly disclosed M.K.’s “personally identifiable information” to “any person,” and (4) the disclosure was not a permitted disclosure authorized under § 2710(b)(2).
[1.] M.K. alleges that Google is a video tape service provider because it delivers audio visual materials similar to prerecorded video cassette tapes…. Google does not dispute that it is a video tape service provider within the meaning of the VPPA ….
[2.] For purposes of the VPPA, a consumer is “any renter, purchaser, or subscriber of goods or services” from a video tape service provider. The VPPA does not define the term “subscriber.” While the parties appear to agree that a person may be a subscriber even if he does not pay for a subscription, they disagree about whether M.K. is a subscriber of goods and services from Google. M.K. contends that he is a subscriber because he has a Google account, including a unique login, and he argues that it does not matter that the District required him to have such an account or arranged for him to get it. Google argues that M.K. is not a subscriber because his relationship is with the District only, and not with Google….
Google argues that M.K. only has a relationship with the District. It contends that the District provided M.K. with a Google account so that he could attend school remotely using a service Google provided to the District, and that his access to Google’s video content was made possible solely by virtue of his status as a student in the District. Id. M.K. responds that he had a Google account, with a unique login, through which he obtained access to YouTube videos and videos on Google Slide Show. He also alleges that, by virtue of that account, Google had his personal information and tracked the videos he watched. He argues that these facts support the existence of a subscriber relationship between M.K. and Google.
The Court agrees that M.K. plausibly alleges the existence of a subscriber relationship with Google. The fact that M.K. obtained his Google account through the District for the purpose of attending school remotely does not undermine his allegation that he is, in fact, a Google account-holder. While the [Complaint] pleads few details about that account-holder relationship, the Court may reasonably infer from M.K.’s allegations that he did not merely view videos while surfing the web. Rather, the allegations in the [Complaint] support an inference that he watched videos while logged into his Google account using an application or service provided by Google that collected information about the content he viewed and associated that activity with him. See [Complaint] ¶¶ 8-10 (“The District’s school principal and tech department … told parent [that] District staff had accessed student’s activity on Google Slide Show…. M.K. watched videos offered by Google, LLC’s Youtube and Slide Show platform.”).
In these circumstances, the Court concludes that M.K. adequately alleges that he is a subscriber of Google’s services for purposes of the VPPA.
[3.] The VPPA provides that a video tape service provider is exempt from liability for disclosure of a consumer’s personally identifiable information “if the disclosure is incident to the ordinary course of business of the video tape service provider.” The statute defines “ordinary course of business” as “only debt collection activities, order fulfillment, request processing, and the transfer of ownership.” The Court agrees with Google that the [Complaint] does not plausibly allege that Google disclosed M.K.’s personal information to third parties other than the District.
With respect to the District, Google argues that “[a]ny disclosure of M.K.’s information to the District so that it could manage the [Google Workspace for Education] account that it provided to M.K.—e.g., to determine whether he was participating in class or watching YouTube videos, or whether his account had been used to disseminate inappropriate content—would be incidental to Google carrying out its agreements with its subscriber, the District, in its business operations,” thereby falling within the statutory exemption. M.K. disputes that the disclosures he alleges qualify for the exemption.
“[T]he permissibility of disclosure under the VPPA turns on the underlying purpose for which [the provider] provides the information to a third party.” While Google may have meritorious arguments that its disclosure of M.K.’s personal information to the District was not an unauthorized disclosure within the meaning of the VPPA, the Court cannot conclude, at the pleading stage, that the alleged disclosures were merely incidental to Google’s fulfillment of its contractual obligations to the District. {M.K. has no duty to foreclose an ordinary course of business defense in his complaint.} The [Complaint] contains no information about any such contractual obligations, and they are not otherwise part of the record before the Court.
Accordingly, the Court concludes that M.K.’s VPPA claim survives Google’s challenge on this basis as well, to the extent the claim challenges Google’s alleged disclosure of M.K.’s personal information to the District….
