U.S. District Judge Mary Rowland
CHICAGO - A federal judge won’t stop a significant portion of a class action accusing the University of Phoenix of allowing Facebook and other third parties to track the online habits of students enrolled in online classes.
Janielle Dawson’s lawsuit accuses the university of violating the Video Privacy Protection Act, the Electronic Communications Privacy Act and the Illinois Eavesdropping Act. In an opinion filed Jan. 13, U.S. District Judge Mary Rowland largely denied the school’s motion to dismiss the complaint.
According to Dawson, she enrolled in 2016 to pursue a Bachelor of Science in business. Since then she has used the university’s website to watch videos, obtain and submit assignments, communicate with teachers, take tests, view grades and make payments. She said every visit to the website subjected her to embedded, background tracking technology from Meta, Google, LinkedIn, TikTok, Microsoft and Amazon and alleged that in addition to disclosing information about how she watched videos, the third parties were able to access education records that should’ve been confidential under the Family Educational Rights and Privacy Act.
Although the complaint explained each company’s technology, Rowland said she focused on Meta as an example and noted advertisers like the university control what Meta collects and how it identifies visitors.
“When a user accesses a website hosting the Facebook Tracking Pixel, Facebook’s software script surreptitiously directs the user’s browser to send a separate message to Facebook’s servers concurrent with the communications with the host website all without the user’s knowledge,” Rowland wrote. “This separate transmission, initiated by Facebook code, contains the original GET request sent to the host website, along with additional data that the Facebook Tracking Pixel is configured to collect.”
In arguing for dismissal, the university said it isn’t a video tape service provider as the VPPA defines. Rowland said Dawson adequately alleged her “courses routinely included prerecorded videos” and rejected the school’s contention that the prevailing matter is its core business of post-secondary education, noting Dawson’s allegations “support the reasonable inference that the university provides videos as more than a peripheral part of its marketing strategy or brand awareness. … The prerecorded lecture videos are the product that the university’s business is tailored to disseminate.”
The school also said Dawson doesn’t meet the VPPA’s definition of consumer, and that a degree isn’t a good or service. Rowland said the school referenced “numerous dictionary definitions” to bolster those arguments but doesn’t explain how they are incompatible with the law or cite supporting legal authority. She further rejected the argument no personally identifiable information is at stake, explaining it isn’t difficult for an ordinary person to use a Facebook ID number to determine the identity of someone whose data is tracked on the school website.
However, she did agree the allegations are too conclusory to support Dawson’s claim against the other defendant tech companies because they use “static digital identifiers” that can be used to “identify a computer or device, not a person.” But Rowland did say it doesn’t matter whether the school knew if Dawson or other class members had Facebook accounts because the root of the allegation is the installation of the tracking technology.
Rowland also disagreed with the school’s insistence Dawson wouldn’t be entitled to VPPA damages because she didn’t allege a financial loss, saying the law doesn’t include that stipulation, and further rejected a challenge to the VPPA as improperly restricting speech.
“The law at issue here, which does not favor one type of speech over another, imposes only an incidental burden on the university’s speech,” Rowland wrote, saying the cases the school cited didn’t “displace the longstanding principle that regulations of commercial speech may be subject to intermediate scrutiny even if content-based.”
She also said Congress stated its privacy concerns when enacting the law, that its restrictions on disclosing what videos students watched materially addresses those concerns and there isn’t a “legitimate non-commercial First Amendment interest” the alleged conduct serves.
Turning to the ECPA, Rowland said the university couldn’t escape liability under the theory it was only a party to the contested communications, writing “the persons directly intercepting the communications and the persons who procured interception have violated the ECPA.” She also said the school couldn’t invoke a one-party consent exemption to win dismissal but “may test this claim through discovery and at later phases of litigation.”
The university further suggested the ECPA claims fail because they lack an allegation of information being intercepted “in transit,” finding Dawson “plausibly alleged that the third-parties at issue intercept the communications in real time directly from the website visitors, i.e., in transit.”
Finally, Rowland said Dawson could continue her Illinois Eavesdropping Act claims, rejecting the school’s arguments it wasn’t a party to the challenged actions but saying Dawson admitted she needed to prove any damages — rather than just allege she suffered harm — in order to obtain recovery under this law.
Plaintiffs are represented in the action by attorneys Scott R. Drury, of Drury Legal, of Highwood; and Joshua D. Arisohn, of Arisohn LLC, of Brooklyn, New York.
