CLASS ACTION DISMISSED!: Federal Court Rules Hashed Pixel Data Is Not Personally Identifiable Information

Hi, CIPA World! I’m Kelly Sandberg, and this is my first blog as the newest addition at Troutman Amin.

In Haley Berryman v. Reading International, Judge Engelmayer dismissed the plaintiff’s Video Privacy Protection Act (“VPPA”) and the New York Video Consumer Privacy Act (“NY VCPA”). Berryman v. Reading International, Inc., No. 24 CIV. 750 (PAE), 2026 WL 699835 (S.D.N.Y. Mar. 12, 2026). The court found that the website tracking data transmitted to Facebook via Facebook Pixel did not qualify as “personally identifiable information” (“PII”) applying the case of Solomon v. Flipps Media, Inc. to determine whether there was because “it was implausible that an ordinary person could, on the basis of [the] disclosures, [would] discern the actual identity of the user and her video selections.”

Reading International, owns and operates the Angelika Film Centers (“Reading International”) and its website, where users can watch movie trailers, find information about the firms, and purchase theater tickets. Reading International allegedly installed the Facebook Pixel which allows advertisers to review and track a user’s activities on the website. When the data is captured, a record is provided to Facebook where the data is then compiled and is used for targeted ads.

In October of 2022, the plaintiff subscribed to the Reading International-owned website by creating an account. She watched movie trailers and purchased tickets using the website for the screening of Barbie.

Then, in February of 2024, she filed a complaint against Reading International alleging that they disclosed private data about her online viewing data to Facebook without her knowledge and consent by using Facebook Pixel to track her activity on the website and using the information for the creation of targeted advertisements. She claimed that this violated the VPPA by unlawfully sharing her private video-viewing history.

Under 18 U.S.C. § 2710, a violation will result when “video tape service providers…disclose personally identifiable information about consumers’ video-watching habits.” For information to qualify as “personally identifiable information,” there must be revelation of the consumer’s identity, the video material’s identity, and the connection between them.

Judge Engelmayer relied the recent Second Circuit case, Solomon v. Flipps Media, Inc., 136 F.4th 41 (2d Cir. 2025) to determine whether the transmitted data constituted PII under the VPPA. To do so the court applied the “ordinary person” standard. Under this standard a plaintiff is required to plausibly allege that a violation resulted because of a defendant’s use of “the kind of information that would readily permit an ordinary person to identify a specific individual’s video-watching behavior.”

Applying this framework, the court found that it was implausible that an ordinary person viewing a “c_user” cookie would recognize it as a specific individuals Facebook ID or know how to utilize it to identify the user.

The court also addressed the “Advance Matching” feature, which collects user information such as names and emails and hashes prior to the transmission. The court explained that while the Pixel did collect the names and emails, the information was hashed into a computed summary of digital date prior to transmission to Facebook. That hashed data “cannot be reversed back into the original data” by an ordinary person. As such, the information would only be decipherable to a computer with sophisticated technology. “And even if the resultant hash were a format comprehensible to an ordinary person and revealing of the [website] subscriber’s identity—which it is not—it would not reveal the ‘connection between’ that identity and the videos she viewed.”

Finally, the court concluded that the transmitted URL’s were insufficient to establish a violation. Although the example URL contained the word “Barbie,” the court stated that a mere reference to a movie in a URL “does not reveal the user’s connection to it—e.g., whether a ticket was purchased, film was viewed, or some other interaction occurred.”

Because the transmitted date would not allow an “ordinary person” to identify the plaintiff and her specific viewing habits “ with little or no extra effort,” the court dismissed the VPPA claim.

Based on both the case here, and in the case of Solomon v. Flipps Media, Inc., it is clear that Pixel based VPPA claims require a difficult standard in proving that the type of information obtained by the use of Pixel can be used by ordinary people to track another person’s video watching habits.