Run a free scan

Hughes v. NFL: Solomon decides Pixel video claims in the Second Circuit, even with an NFL+ subscription

Paying for a video product does not rescue a Pixel claim in the Second Circuit if the request itself is unreadable to an ordinary person. This case also shows what plaintiffs now attach to complaints: a captured request from a named article page, with the c_user field pointed out.

US Court of Appeals for the Second Circuit · Video Privacy Protection Act · Summary order, 20 June 2025; certiorari denied 9 March 2026

The problem

Brandon Hughes subscribed to NFL.com’s email newsletter from 2020 and to NFL+, the league’s paid streaming product, in at least August 2022. He watched videos on NFL.com and in the NFL App while logged into Facebook. He alleged that the Meta Pixel on NFL.com, and Facebook SDKs in the app, sent Facebook the video name, its URL and his Facebook ID, and that he was never asked for consent (SAC ¶¶ 33–34, 48–50, App. 49a–55a).

Case record

Court
US Court of Appeals for the Second Circuit, on appeal from the Southern District of New York
Case number
No. 24-2656; S.D.N.Y. No. 1:22-cv-10743-JLR; S. Ct. No. 25-868
Parties
Brandon Hughes v. National Football League
Counsel
Hughes: Bailey & Glasser; Peiffer Wolf ([App. 63a](https://www.supremecourt.gov/DocketPDF/25/25-868/392021/20260116172605156_25-%20Petition.pdf)). NFL: Vinson & Elkins in the Supreme Court ([docket](https://www.supremecourt.gov/search.aspx?filename=/docket/docketfiles/html/public/25-868.html))
Laws
Video Privacy Protection Act, 18 U.S.C. § 2710
Stage
Dismissal affirmed 20 June 2025 (non-precedential summary order); cert denied 9 March 2026
Amount
None
Source review
17 October 2026

What was alleged

What was alleged
ClaimWhat the law requiresFacts allegedResult
VPPA, § 2710(b)(1)Knowing disclosure of a consumer's personally identifiable information by a video tape service provider"NFL.com sends to Facebook the video content name, its URL, and, most notably, the viewers' Facebook ID" ([SAC ¶ 33, App. 49a](https://www.supremecourt.gov/DocketPDF/25/25-868/392021/20260116172605156_25-%20Petition.pdf)); the NFL profited from targeted ads ([¶ 37](https://www.supremecourt.gov/DocketPDF/25/25-868/392021/20260116172605156_25-%20Petition.pdf))Dismissed with prejudice; affirmed on PII

The proposed class was "[a]ll persons in the United States with a digital subscription to an online website or product owned and/or operated by Defendant that had their Personal Viewing Information disclosed to Facebook by Defendant" (SAC ¶ 52, App. 56a). The complaint sought USD 2,500 per class member and punitive damages (App. 62a).

Technical issue

  • Tools or vendors: the Meta Pixel on NFL.com; one or more Facebook SDKs in the NFL App (SAC ¶¶ 33–34).
  • Where: videos embedded in NFL.com articles, and app content limited to NFL+ subscribers (SAC ¶ 49).
  • What data: video name, URL and Facebook ID. The complaint’s exhibit is a capture from the article "Burton: Jalen Ramsey refusing to praise Bills ahead of Week 1 matchup", taken on or about 8 September 2022, labelled an "HTTP single communication session sent from the device to Facebook, reveals the video name, URL and the viewer’s FID (c_user field)" (SAC ¶¶ 41–42, App. 52a–53a).
  • When: on playback, with no notice or opt-out offered (SAC ¶ 50).
  • How it came to light: the plaintiff’s own capture. The complaint also tracks NFL privacy policy changes, noting an "Internet-Based Advertising" section first added on 10 October 2023 (SAC ¶ 30, App. 48a).

Inth’s technical interpretation: the capture is a single browser request, which is exactly what a HAR file or DevTools shows. Anyone can reproduce it on their own site in a minute. The page that fired it was an article with an embedded video, not a dedicated video page, which is why an inventory of "video routes" must include any template that can embed a player. The app side is harder to see: SDK traffic does not show in a browser.

Illustrative pattern, not the defendant’s code.

// Bad: article template fires a content event when an embedded clip plays
embed.addEventListener('play', () => {
  fbq('track', 'ViewContent', { content_name: article.headline, content_type: 'video' });
});

Illustrative pattern, not the defendant’s code.

// Fixed: ad events from article templates carry no headline or clip identity,
// and wait for consent. Generic consent check, not a specific library API.
embed.addEventListener('play', () => {
  if (consent.has('marketing')) fbq('trackCustom', 'VideoStart'); // no title, no URL params
});

The fixed version still sends the page URL in dl. If article URLs carry the headline, keep the Pixel off those pages until your consent position is settled.

Timeline

Timeline
DateEvent
27 November 2023Second Amended Complaint ([App. 63a](https://www.supremecourt.gov/DocketPDF/25/25-868/392021/20260116172605156_25-%20Petition.pdf))
5 September 2024Dismissed with prejudice: newsletter not an audiovisual service; no allegation of prerecorded NFL+ viewing ([App. 10a–25a](https://www.supremecourt.gov/DocketPDF/25/25-868/392021/20260116172605156_25-%20Petition.pdf))
15 October 2024[Salazar v. NBA](/enforcement/salazar-v-nba) removes that ground
1 May 2025[Solomon v. Flipps](/enforcement/solomon-v-flipps) adopts the ordinary-person PII test
20 June 2025Affirmed on PII grounds ([App. 1a–9a](https://www.supremecourt.gov/DocketPDF/25/25-868/392021/20260116172605156_25-%20Petition.pdf))
21 August 2025Rehearing denied ([docket](https://www.supremecourt.gov/search.aspx?filename=/docket/docketfiles/html/public/25-868.html))
16 January 2026Cert petition filed; the NFL waived a response
9 March 2026Certiorari denied

Outcome

The district court never reached PII; it held Hughes was not a "consumer". The Second Circuit affirmed on a different ground: "Solomon effectively shut the door for Pixel-based VPPA claims" (App. 4a). Like Solomon’s exemplar, Hughes’s capture did not make it plausible that an ordinary person "would see the 'c_user' phrase on [this communication] and conclude that the phrase was a person’s FID" (App. 7a).

The court refused a remand to amend. Hughes offered to allege that Facebook renders the data as plain text, that "ubiquitous internet-based tools like ChatGPT" can decode it, and that 75% of Americans have Facebook accounts. The panel said the test looks at "whether an ordinary person would be able to understand the actual underlying code communication itself, regardless of how the code is later manipulated or used by Facebook" (App. 8a).

In a footnote the court rejected the NFL’s argument that Hughes lacked standing because he consented by accepting the privacy policy. Whether that policy disclosed sharing, as opposed to collection, was a factual dispute and at most an affirmative defence (App. 3a n.1).

As a summary order, the decision has no precedential effect, but it states how the circuit reads Solomon. The Supreme Court denied review on 9 March 2026 (docket).

What it cost

What it cost
ItemAmount
Damages or settlementNone
Statutory exposure claimedUSD 2,500 per class member, plus punitive damages ([App. 62a](https://www.supremecourt.gov/DocketPDF/25/25-868/392021/20260116172605156_25-%20Petition.pdf))
Fees and costsNot stated in the cited record

Why it matters

  • Inside the Second Circuit, Pixel VPPA claims now fail at the pleading stage; Salazar v. NBA was dismissed on remand on the same reasoning.
  • The NFL’s consent defence is still untested. A privacy policy that says data is "collected" may not show consent to "disclosure", and the court treated that as a fact question.
  • The petition argued that the ordinary-person test is atextual under recent Supreme Court cases; the Court did not take it up (Pet. at 10–12). The pending Salazar v. Paramount case is about "consumer", not PII.
  • Related: VPPA, Notice, consent scope and assent.

How Inth catches this

  • Code audit: flags a pull request that adds a Pixel event to an article or embed component, or adds the Facebook SDK to the mobile app, and traces the headline or clip title into event parameters.
  • Website audit: records the facebook.com/tr request from the article page, with page, time, region and consent state. It cannot see SDK traffic from a native app.
  • Consent banner: holds the Meta Pixel helper until marketing is granted under an opt-in policy. New York is not in Inth’s listed opt-in regions; an opt-in policy there is your configuration.
  • Evidence: observation records and consent records that show what fired and under which choice.

Mobile SDK disclosures need app-side testing; a web audit does not cover them.

Checks for your own systems

In the repository

  • Find every article, blog or CMS template that can render a video embed, not only dedicated video routes.
  • Search mobile code for FacebookSdk, AppEventsLogger or logEvent calls that pass content names.
  • Check whether article URLs contain the headline.

In the browser and network

  • Open an article with an embedded clip while logged into Facebook, play it, and save a HAR file.
  • In the facebook.com/tr request, check dl for the headline slug and the Cookie header for c_user.
  • Proxy the mobile app (for example with a man-in-the-middle proxy on a test device) and look for graph.facebook.com app events on playback.

With the people responsible

  • Ask whether your privacy policy says viewing data is shared, or only collected.
  • Confirm when ad-related policy sections were added, since plaintiffs compare versions.

Sources and limits

Source review: 17 October 2026. This page describes the cited records and procedural stage. It does not audit the NFL’s current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.