Meghan MOLLETT and Tracy Hellwig, individually on behalf of themselves and all others similarly situated, Plaintiffs-Appellants, v. NETFLIX, INC., a Delaware Corporation, Defendant-Appellee, 795 F.3d 1062

OPINION DEARIE, Senior District Judge: Plaintiffs-Appellants Meghan Mollett and Tracy Hellwig appeal the district court’s dismissal of their claims against Defendant-Appellee Netflix, Inc. (“Net-flix”), a subscription video streaming service, for violations of the Video Privacy Protection Act (‘VPPA”), 18 U.S.C. § 2710, and California Civil Code § 1799.3.

On behalf of themselves and other similarly-situated Netflix subscribers, Plaintiffs allege that Netflix violated these statutes by permitting certain disclosures about their viewing history to third parties— specifically, subscribers’ family, friends, and guests. We conclude, however, that the complained-of disclosures were lawfully made to Netflix’s own subscribers and, therefore, are not actionable under the VPPA or the California Civil Code. We affirm the decision of the district court. I. Netflix is the world’s largest subscription service for viewing movies, television programs, and other video content.

The company launched in 1999 as an online DVD rental service that delivers DVDs to subscribers through the mail, and expanded in 2007 to allow subscribers to stream videos instantly online. As of the filing of Plaintiffs’ complaint, Netflix had more than 20 million subscribers; approximately 48 percent use the service’s instant streaming feature. To become a Netflix subscriber, a consumer must create an account on Netflix’s website. As part of the account setup, a consumer must create a password, which she must enter whenever logging into the account.

Once a subscriber has an account, she can begin ordering videos. Depending on the type of account the subscriber purchased, she can either order DVDs for home delivery or stream videos instantly over the Internet, or both. To ease the ordering of DVDs for home delivery, a subscriber can create a list of DVDs that she wishes to view. That list is known as the “queue.” Depending on the terms of subscription, Netflix mails one or more of the DVDs listed in the queue to the subscriber. Once a subscriber returns a DVD to Netflix, Netflix mails out the next available DVD in the subscriber’s queue.

Many of the videos in a subscriber’s queue can also be viewed instantly by streaming them over the Internet onto a subscriber’s computer or portable computing device, including televisions or video game systems. To stream a video instantly, a subscriber simply logs into her password-protected account, selects a video, and presses play. Videos that are available for instant streaming can be displayed on a subscriber’s television through use of a Netflix-ready device, such as a video game console, an Internet-connected television, or a specially-designed DVD player.

In order to stream a video on a television through a Netflix-ready device, a subscriber must first register the device in the subscriber’s password-protected online account. After the device is activated and connected to a television, the subscriber can play videos by turning on the television and selecting a video available through Netflix. A password is not required to watch a video once the Netflix-ready device is activated. To assist its subscribers in adding videos to their queues or selecting videos to watch instantly, Netflix provides its customers with lists of recommended videos.

These recommendations are generated through the use of predictive software that analyzes, among other things, a subscriber’s rental history. Recommendations are displayed to subscribers through category-based lists.

For instance, when Netflix recommends movies based on a subscriber’s recently-watched video, suggested movies are placed in a list titled “Like [Name of Recently-Watched Film]” or “Because You Liked [Name of Recently-Watched Film].” These lists of recommended films include each video’s title, an image of its DVD cover art, a written description of the video’s content, and its Motion Picture Association of America rating. Netflix displays a subscriber’s queue and recommendation lists automatically on a subscriber’s account home page.

Once a subscriber has connected her account to a Netflix-ready device, these lists are also automatically displayed on the subscriber’s television when the television is turned on and Netflix is activated. Specifically, Net-flix displays a list of “recently watched” video titles, the subscriber’s queue, and lists of video titles recommended by Net-flix. While a subscriber can edit and delete titles from her queue, she cannot hide or remove the queue or the other lists displayed by Netflix.

The contents of these lists, as a result, are visible to family members, friends, or guests of Netflix subscribers who use a subscriber’s account to stream videos, or are in the presence of a subscriber when she is accessing her account through a Netflix-ready device. Plaintiffs alleged in their April 4, 2011, complaint that these disclosures violate the VPPA and California Civil Code § 1799.3.

In its motion to dismiss for failure to state a claim, Netflix asserts that (1) its disclosures of personal information are made to subscribers themselves and therefore permissible, and (2) any disclosures to third parties are not made knowingly, as required by the VPPA, or in willful violation of the law, as required by California Civil Code § 1799.3. The district court granted Netflix’s motion on both of these grounds and dismissed Plaintiffs’ complaint with prejudice. Plaintiffs timely appealed the district court’s order.

II. “We review de novo the district court’s grant of a motion to dismiss under Rule 12(b)(6), accepting all factual allegations in the complaint as true and construing them in the light most favorable to the nonmov-ing party.” Skilstaf, Inc. v. CVS Caremark Corp., 669 F.3d 1005, 1014 (9th Cir.2012). “To survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’ ” Ashcroft v. Iqbal, 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009) (quoting Bell Atl. Corp. v.

Twombly, 550 U.S. 544, 570, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007)). We will uphold a district court’s decision to dismiss “where there is either a lack of a cognizable legal theory or the absence of sufficient facts alleged under a cognizable legal claim.” Hinds Invs., L.P. v. Angioli, 654 F.3d 846, 850 (9th Cir.2011). III. A. The

interpretation of this

section of the VPPA is an issue of first impression for this Circuit. The VPPA was enacted in 1988 in response to the Washington City Paper’s publication of then-Supreme Court nominee Robert Bork’s video rental history. See S. Rep. 100-599, at 5 (1988), reprinted in 1988 U.S.C.C.A.N. 4342-1. The paper had obtained (without Judge Bork’s knowledge or consent) a list of the 146 films that the Bork family had rented from a Washington, D.C.-area video store. Id. Members of the Judiciary Committee “denounced the disclosure” and Congress acted swiftly to enact the VPPA. Id.

According to the Senate Report on the VPPA, Congress’s purpose when enacting the statute was “[t]o preserve personal privacy with respect to the rental, purchase or delivery of video tapes or similar audio visual materials.” Id. at 1. “The Act allows consumers to maintain control over personal information divulged and generated in exchange for receiving services from video tape service providers. The Act reflects the central principle of the Privacy Act of 1974: that information collected for one purpose may not be used for a different purpose without the individual’s consent.” Id. at 8.

Congress’s intent in passing the VPPA therefore evinces the principle that protection is merited when the consumer lacks control over the dissemination of the information at issue. Consistent with Congress’s purpose, the statute’s language is broad. The VPPA prohibits a “video tape service provider” from knowingly disclosing “personally identifiable information” about one of its consumers “to any person,” and provides for liquidated damages in the amount of $2,500 for violation of its provisions. 18 U.S.C. §§ 2710(

b) and 2710(c)(2) (emphasis added). The VPPA, however, does not prohibit all disclosures. The Act provides several exceptions to the disclosure prohibition, allowing disclosure of a consumer’s video rental history to the consumer himself, or to third parties when the consumer has provided written consent or the third party has obtained a warrant or court order. Id. § 2710(b)(2). Relevant here is

section 2710(b)(2)(A), which permits video tape service providers to “disclose personally identifiable information concerning any consumer ... to the consumer.” Id. § 2710(b)(2)(A). The VPPA defines the term “consumer” as “any renter, purchaser, or subscriber of goods or services from a video tape service provider.” Id. § 2710(a)(1). The VPPA does not define the' term “disclosure.” A video service provider that makes a disclosure of personally identifiable information to a consumer or subscriber is not subject to civil liability. Therefore, in order to plead a plausible claim under

section 2710(b)(1), a plaintiff must allege that (1) a defendant is a “video tape service provider,” (2) the defendant disclosed “personally identifiable information concerning any customer” to “any person,” (3) the disclosure was made knowingly, and (4) the disclosure was not authorized by

section 2710(b)(2). At dispute here are the third and fourth elements. Based on the allegations in the complaint, Plaintiffs have failed to plead a plausible violation of the VPPA because, as we now hold, the disclosure alleged by Plaintiffs is a disclosure “to the consumer” that is permitted by the Act. The complaint alleges that upon setting up a Net-flix account, personally identifiable information, by default, is only disclosed to a Netflix subscriber through her password-protected account. Under those circumstances, a subscriber’s queue or recommendation lists are only viewable by the subscriber.

Netflix subscribers can then elect to display on their televisions what would otherwise be password-protected information by registering Netflix-ready devices in their accounts. Thereafter, Net-flix automatically displays on a television what it displays on a subscriber’s computer: streamed instant videos, the subscriber’s queue, and video recommendations. This is plainly a disclosure “to the consumer” as contemplated by the VPPA. When Netflix displays a subscriber’s queue, viewing history, or recommendation lists in her online account, that is a disclosure directly to the consumer.

The nature of that disclosure does not change when subscribers choose to display the same content on their television screens. The subscriber’s choice to do so does not trigger some new statutory duty on the part of Netflix. The fact that a subscriber may permit third parties to access her account, thereby allowing third parties to view Netflix’s disclosures, does not alter the legal status of those disclosures.

No matter the particular circumstances at a subscriber’s residence, Netflix’s actions remain the same: it transmits information automatically to the device that a subscriber connected to her Netflix account. The lawfulness of this disclosure cannot depend on circumstances outside of Netflix’s control. There is nothing to suggest that the VPPA prohibits disclosures “to the consumer” when they are incidentally also received by third parties as the subscriber may independently permit.

Our conclusion is consistent with the legislative intent of the VPPA — -where the subscriber controls which third parties may access her Netflix account and where the “personally identifiable information” is disclosed to only a select group of individuals, both the letter and the spirit of the law are sustained. Plaintiffs insist that Netflix is required to transmit information in a reasonably secure manner or undertake certain technical fixes to prevent incidental disclosures to third parties.

But the VPPA does not prescribe a technical regime for disclosure. “Just because Congresses] goal was to prevent the disclosure of private information, does not mean that Congress intended the implementation of every conceivable method of preventing disclosures.” Daniel v. Cantrell, 375 F.3d 377, 384 (6th Cir.2004). To hold otherwise would convert

section 2710(b)(1) from a prohibition on unlawful disclosure to a requirement of secure disclosure — an outcome plainly not supported by the VPPA’s text. As plaintiffs complaint pleads only a lawful disclosure under the VPPA, the district court was correct to dismiss the first count of Plaintiffs’ complaint. We need not, therefore, address whether Plaintiffs adequately alleged a “knowing” disclosure. B. The second count of Plaintiffs’ complaint alleges that Netflix disclosed its subscribers’ personal information to third parties in violation of California Civil Code § 1799.3.

Netflix argues, as it did with respect to count one, that California law authorizes its disclosure and that any such disclosure was not done in “willful violation” of the law.

Section 1799.3(

a) provides that “[n]o person providing video recording sales or rental services shall disclose any personal information or the contents of any record, including sales or rental information ... to any person, other than the individual who is the subject of the record, without the written consent of that individual.” Cal. Civ.Code § 1799.3(a).

Section 1799.3(

c) makes a person liable for civil penalties for “any willful violation” of

section 1799.3(a). Thus,

section 1799.3(a), like the VPPA, authorizes disclosures made to “the individual who is the subject of the record.” For the same reasons that Plaintiffs fail to plead a violation of the VPPA, Plaintiffs also fail to plead a violation of California Civil Code § 1799.3. While phrased in slightly different language than the VPPA, the California Civil Code plainly excludes liability for disclosures to a subscriber who is the subject of a record. Netflix’s disclosure of personal information was made to its subscribers and therefore it is not liable under

section 1799.3. Accordingly, the district court properly dismissed the California state law claim on this ground, and we need not consider its alternative ground for dismissal. IV. For the foregoing reasons, we conclude that Plaintiffs have failed to plead a claim under the VPPA and California Civil Code § 1799.3. We AFFIRM the judgment of the district court.