Solomon v. Flipps: in the Second Circuit, a Pixel request an ordinary person cannot read is not VPPA PII

• Tools or vendors: the Meta Pixel with its PageView event, which the opinion describes as capturing "the URL and title of each video that a user accesses ... along with that user’s FID" (Pet. App. 7a).
• Where: FITE’s website and apps.
• What data: a GET request to www.facebook.com whose query string held the video title, and a c_user cookie holding the Facebook ID. The complaint said this happened whether or not users were logged into Facebook and after they cleared their history (Pet. App. 8a).
• When: every video view, with no consent mechanism.
• How it came to light: an "exemplar screenshot" of about 29 lines of the request in the complaint, with the title boxed and the c_user value partly redacted (Pet. App. 7a–8a, 24a).

The fragments the court quoted from that request (line-break hyphens removed; the court gave "c_user=123456" as an example of an unredacted value):

Decoded, the first fragment is title":"-▷ The Roast of Ric Flair: a JSON field inside the URL.

Inth’s technical interpretation: the court judged the bytes on the wire as a person would see them, and found the title buried in percent-encoding and the ID unlabelled. For an engineer that reasoning protects nothing. Meta’s servers decode the field and read the cookie automatically, and the opinion says Facebook used the data to build profiles (Pet. App. 8a). The same request is evidence for wiretap and state-law claims that do not use the VPPA’s PII definition.

Illustrative pattern, not the defendant’s code.

The court chose between two tests. The First Circuit’s reasonable-foreseeability test in Yershov asks whether the disclosure is "reasonably and foreseeably likely to reveal" what the plaintiff watched. The Third and Ninth Circuits' ordinary-person test, from Nickelodeon and Eichenberger, asks what an ordinary recipient could do with it (Pet. App. 13a–18a).

It held: "'personally identifiable information' encompasses information that would allow an ordinary person to identify a consumer’s video-watching habits, but not information that only a sophisticated technology company could use to do so" (Pet. App. 20a; 136 F.4th at 52). Applying it, the court found it "implausible that an ordinary person would look at" the encoded title "and understand it to be a video title". It found it equally implausible that a person would read c_user as a Facebook ID without the complaint’s annotation (Pet. App. 24a–25a). The court acknowledged the statutory words "could also be read to encompass computer code and digital identifiers decipherable only by a technologically sophisticated third party" (Pet. App. 20a).

Leave to amend was properly denied because Solomon asked only in a footnote (Pet. App. 26a–28a). The decision binds federal courts in New York, Connecticut and Vermont.

• It closed Pixel VPPA claims in the Second Circuit. Seven weeks later, Hughes v. NFL said "Solomon effectively shut the door for Pixel-based VPPA claims", and Salazar v. NBA was dismissed on remand under it.
• The PII split stands. The petition described a split with the First Circuit (Pet. at 3); the Court denied review on 8 December 2025, and denied Hughes in March 2026. At the Salazar v. Paramount argument, counsel agreed with Justice Kavanaugh that PII is "a 3-1 split" against the plaintiffs' side.
• Venue drives exposure. The same Pixel request can be dismissed in Manhattan and survive elsewhere.
• Related: VPPA, IP addresses and device identifiers.

• Code audit: flags a pull request that loads the Meta Pixel on a watch or player route, and traces the video title or slug into Pixel parameters.
• Website audit: records each facebook.com/tr request from video pages with page, time, region and consent state. It does not decode what Meta does with the c_user cookie.
• Consent banner: holds the Meta Pixel until its category is granted under an opt-in policy. Inth’s default California policy is opt-out; New York is not in the listed opt-in regions, so an opt-in policy there is your configuration.
• Evidence: runtime observations and consent records that show what was sent and under which choice.

Inth reports what left the browser; whether that counts as PII depends on the circuit.

In the repository

• Search player and watch routes for fbq(, connect.facebook.net/en_US/fbevents.js and GTM tags firing on all pages.
• Check whether page titles and URLs on watch pages contain the video title.
• Check whether autoConfig is left on, which lets the Pixel send automatic events.

In the browser and network

• Play a video while logged into Facebook and open the facebook.com/tr request; decode the query string.
• Look for the title in dl or in JSON fields such as title":", and for c_user in the Cookie header.
• Repeat logged out and after clearing cookies, since the complaint alleged sending in both states.

With the people responsible

• Confirm which circuits your users and your company are in, and whether arbitration terms apply.
• Ask whether any consent flow covers sharing viewing activity with ad platforms.

• Solomon v. Flipps Media, Inc., 136 F.4th 41 (2d Cir. 1 May 2025), at Pet. App. 1a–28a
• Petition for certiorari, No. 25-228, 21 August 2025
• Supreme Court docket No. 25-228, petition denied 8 December 2025
• 18 U.S.C. § 2710

Source review: 17 October 2026. This page describes the cited records and procedural stage. It does not audit FITE’s or Triller TV’s current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.

Related: Hughes v. NFL, Salazar v. NBA, Salazar v. Paramount