1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 7 RICHARD LEE, Case No. 24-cv-02386-EKL

8 Plaintiff,

ORDER GRANTING MOTION TO

9 v. DISMISS IN PART

10 PLEX, INC., et al., Re: Dkt. No. 22 Defendants. 11

12 13 This action arises from Plaintiff’s use of Defendants’ online video streaming service, Plex. 14 First Am. Compl. ¶ 1, ECF No. 21 (“Compl.”). Plaintiff alleges that Defendants surreptitiously 15 tracked his viewing activities and shared them with Meta without his consent. Id. ¶ 2. Defendants 16 filed an omnibus motion to compel arbitration, to dismiss the complaint for lack of personal 17 jurisdiction and for failure to state a claim, to strike class allegations, and to transfer the case to 18 Delaware. Mot. to Dismiss, ECF No. 22 (“Mot.”). For the following reasons, the Court GRANTS 19 the motion to dismiss for lack of personal jurisdiction, but otherwise DENIES the motion. 20 I. BACKGROUND1 21 Defendants are Plex GmbH and Plex, Inc. Plex GmbH is “a Swiss corporation with its 22 principal place of business” in Berlin, Germany. Id. ¶ 8. Plex, Inc. is “a Delaware corporation 23 with its principal place of business” in Los Gatos, California. Id. ¶ 7. The complaint refers to 24 Plex GmbH and Plex, Inc. collectively as “Defendants” or “Plex,” without attributing conduct to 25 one Plex entity or the other. Compl. at 1; see also infra Section III.B. Accordingly, the Court will 26 refer to Defendants collectively as “Plex,” except when necessary to distinguish them. 27 1 Plex offers “TV, video, and movie streaming” through its streaming service, which is also 2 called “Plex.” Compl. ¶ 1. Plaintiff “subscribed to Plex’s streaming service in 2020 and 3 continued to watch videos on the service until as recently as April 2024.” Id. ¶ 6. Plaintiff claims 4 that Plex uses the Meta Tracking Pixel to “secretly and surreptitiously send[] consumers’ viewing 5 activities to third-party providers like . . . [Meta] without consent.” Id. ¶ 2. “The Meta Tracking 6 Pixel is a piece of code that businesses, like [Plex], can integrate into their website.” Id. ¶ 24. 7 The Meta Tracking Pixel works by “attach[ing] to the browser that the user uses to access their 8 Facebook account” and then “follows the user’s web activity occurring within that same browser.” 9 Id. ¶ 27. 10 Relevant here, “[w]hen a consumer watches a video on Plex on the same browser they 11 access their Facebook account,” Plex allows the Meta Tracking Pixel to share the user’s viewing 12 activity with Meta. Id. ¶ 34. Plaintiff alleges that he visits the Plex website to “watch videos 13 using the same web browser he uses to access his facebook.com account,” id. ¶ 6, thus Plex has 14 shared his viewing activity with Meta. Plex allegedly sends Meta “the name of the video” that the 15 user watched or requested along with “the user’s unique, identifying Facebook ID” and email 16 address. Id. ¶¶ 36, 43-44, 66, 82. Meta allegedly uses “video consumption habits to build profiles 17 on consumers and deliver targeted advertisements to them[.]” Id. ¶ 5. 18 Plaintiff claims that Plex’s conduct violates the Video Privacy Protection Act (“VPPA”), 19 18 U.S.C. §§ 2710 et seq., and California Civil Code § 1799.3. See Compl. ¶¶ 78-96. Plex filed a 20 multi-part motion seeking several forms of relief. Many of Plex’s arguments turn on the threshold 21 question of whether Plaintiff agreed to Plex’s terms of use and privacy policy by creating an 22 account on the Plex website. The Court addresses this question in resolving Plex’s motion to 23 compel arbitration, then addresses Plex’s other motions in turn. 24 25 26 27 1 II. MOTION TO COMPEL ARBITRATION 2 A. Legal Standard 3 In deciding whether to compel arbitration, a court must determine: “(1) whether there is an 4 agreement to arbitrate between the parties; and (2) whether the agreement covers the dispute.” 5 Brennan v. Opus Bank, 796 F.3d 1125, 1130 (9th Cir. 2015). State contract law governs the 6 contract formation question. Berman v. Freedom Fin. Network, LLC, 30 F.4th 849, 855 (9th Cir. 7 2022). The parties agree that California law applies. See Mot. at 7; Opp. at 3. The burden is on 8 Plex to demonstrate that there was mutual assent to the agreement to arbitrate. Jackson v. 9 Amazon.com, Inc., 65 F.4th 1093, 1099 (9th Cir. 2023). 10 B. Discussion 11 Here, the existence of an agreement to arbitrate depends on whether Plaintiff agreed to 12 Plex’s terms of service by signing up for a Plex account on Plex’s website in April 2020. 13 See Compl. ¶¶ 6, 64. “In California, internet contracts are classified ‘by the way in which the user 14 purportedly gives their assent to be bound by the associated terms: browsewraps, clickwraps, 15 scrollwraps, and sign-in wraps.’” Keebaugh v. Warner Bros. Ent. Co., 100 F.4th 1005, 1014 16 (9th Cir. 2024) (quoting Sellers v. JustAnswer LLC, 73 Cal. App. 5th 444, 463 (2021)). This case 17 involves a sign-in wrap agreement: “[T]he website provides a link to terms of use and indicates 18 that some action may bind the user but does not require that the user actually review those terms.” 19 Chabolla v. ClassPass Inc., 129 F.4th 1147, 1154 (9th Cir. 2025).2 Absent proof that a consumer 20 has actual knowledge of the agreement,3 a sign-in wrap agreement will be enforced only if “(1) the 21 website provides reasonably conspicuous notice of the terms to which the consumer will be 22 bound; and (2) the consumer takes some action, such as clicking a button or checking a box, that 23 unambiguously manifests his or her assent to those terms.” Berman, 30 F.4th at 856. 24 25 2 The Ninth Circuit issued its Chabolla opinion after briefing closed and after the Court heard 26 argument on Plex’s motion. The Court invited Plaintiff and Plex to file supplemental briefs addressing the significance of Chabolla to Plex’s motion. See ECF No. 44. The Court reviewed 27 and considered the parties’ supplemental briefs. See ECF Nos. 45, 46. 1 The Court begins by describing the sign-in wrap agreement on Plex’s website, and then 2 turns to the issues of notice and assent. 3 1. Plex’s sign-in wrap agreement 4 A Plex user encounters two pages when creating a Plex account: a sign-up page (“Sign-Up 5 Page”), followed by a “Userflow” page that depends on whether the user creates an account 6 directly with Plex or through a third-party application. These pages are depicted in Figures 1 and 7 2, included in the Appendix to this Order. 8 The Sign-Up Page has a white background with prominent black text at the top that 9 instructs the user to “Create your free account.” Directly beneath this text, the user encounters 10 three interactive buttons, and each button allows the user to create an account through a third-party 11 application. The first button is white and allows the user to “Continue with Google”; the second is 12 blue and allows the user to “Continue with Facebook”; the third is black and allows the user to 13 “Continue with Apple.” Each button also bears the third-party application’s logo. See Fig. 1. If a 14 user creates an account by clicking one of these buttons, the user is “automatically presented” with 15 the next page of the account creation process. See Castro Decl. ¶ 11, ECF No. 22-2. The user 16 does not need to read or interact with any other part of the Sign-Up Page. If the user chooses not 17 to use one of the third-party applications, the user can create an account by entering an email 18 address in one field and creating a password in another field. Directly beneath the email and 19 password fields, there is an orange button labeled “Create an Account.” The “Create an Account” 20 button cannot be clicked until the user enters an email address and a password. Finally, beneath 21 the “Create an Account” button, the Sign-Up Page states in gray text: “Already have an account? 22 Sign in.” See Fig. 1. 23 Below all this text, the very bottom of the Sign-Up Page states: “By creating an account or 24 continuing to use a Plex application, website, or software, you acknowledge and agree that you 25 have accepted the Terms of Service and have reviewed the Privacy Policy.” The phrases “Terms 26 of Service” and “Privacy Policy” appear in gray font like the rest of the sentence, but they are 27 bolded. The “Terms of Service” text hyperlinks to Plex’s terms of service, and the “Privacy 1 emphasize the hyperlinks with typical website design conventions, such as the use of underlined 2 text or a contrasting color font (e.g., blue).4 See Fig. 1. 3 In this case, Plaintiff clicked on the prominent blue “Continue with Facebook” button near 4 the top of the Sign-Up Page. Compl. ¶ 64. That button directed Plaintiff to a second page, the 5 “Facebook Userflow.” This page has a white background and displays the Facebook and Plex 6 logos at the top. See Fig. 2. Black text informs the user that “Plex is requesting access to: Your 7 name and profile picture and email address.” Beneath this notice, the user can click on similarly- 8 sized blue text that states: “Edit access.” Near the bottom of the page is a blue button labeled 9 “Continue as [user’s name].” Beneath the blue button is a gray button of the same size labeled 10 “Cancel.” Beneath these buttons, the smallest text on the page states: “By continuing, Plex will 11 receive ongoing access to the information you share and Facebook will record when Plex accesses 12 it. Learn more about this sharing and the settings you have.” The “Learn more” text is blue; the 13 rest of the text is gray. Beneath this language, the text at the very bottom of the Facebook 14 Userflow states: “Plex’s Privacy Policy and Terms of Service.” The text for “Privacy Policy” and 15 “Terms of Service” is blue – but not underlined or bolded – and it hyperlinks to Plex’s privacy 16 policy and terms of service, respectively. See Fig. 2. 17 2. Reasonably conspicuous notice 18 Courts consider several factors to determine whether a website provides reasonably 19 conspicuous notice of a sign-in wrap agreement. Oberstein v. Live Nation Ent., Inc., 60 F.4th 505, 20 514-15 (9th Cir. 2023) (observing that the reasonable notice inquiry is context- and fact-specific). 21 First, courts consider the “context of the transaction,” including the “nature of the service or goods 22 4 Plaintiff argues that a user visiting the Sign-Up Page would not see the links to the “Terms of 23 Service” and “Privacy Policy” on the same page as the “Continue with Facebook” button when using normal browser settings. Opp. at 1, 3-5, ECF No. 29. The complaint contains a screenshot 24 taken by Plaintiff’s counsel, Mr. Glatt, in 2024 to illustrate that a user must scroll down the Sign- Up Page to encounter the notice language. See Compl. Fig. 4; Glatt Decl. ¶¶ 5-9, ECF No. 29-1. 25 But Plaintiff does not allege how he accessed the Sign-Up Page when he created a Plex account in 2020, or that the browser settings used by Mr. Glatt are representative of the settings that Plaintiff 26 used. Plex has submitted its own version of the Sign-Up Page that displays on one page – without requiring the user to scroll down to find the notice language. Castro Decl. ¶¶ 14-15 & Ex. C. Plex 27 attests that its version reflects how a user would have encountered the Sign-Up Page in 2020. Id. 1 offered.” Chabolla, 129 F.4th at 1155. Where a transaction involves a “continuing relationship” 2 with the website operator, the user should expect to be “bound by terms, even if not explicitly 3 told.” Id. Second, courts consider visual aspects of the website. Id. The “overall design” of the 4 website is important: a cluttered design may contain “visual elements [that] draw the user’s 5 attention away” from important terms. Berman, 30 F.4th at 857. The placement of the notice on 6 the webpage is also relevant. Placing a notice “directly above or below the relevant action item in 7 a manner disrupting the natural flow of actions” is more likely to draw the user’s attention to the 8 fact that terms apply. See Chabolla, 129 F.4th at 1157. Additionally, the notice “must be 9 displayed in a font size and format such that the court can fairly assume that a reasonably prudent 10 Internet user would have seen it.” Berman, 30 F.4th at 856. When small or hard-to-read font is 11 used, the “comparatively larger font used” for other elements of the webpage may “direct[] the 12 user’s attention everywhere else.” Id. at 857. Finally, if a hyperlink is used to disclose terms and 13 conditions, “the fact that a hyperlink is present must be readily apparent.” Id. “A web designer 14 must do more than simply underscore the hyperlinked text in order to ensure that it is sufficiently 15 ‘set apart’ from the surrounding text.” Id. 16 The Court begins with the context of the transaction between Plaintiff and Plex. Plaintiff 17 alleges that Plex “offers free subscriptions” that allow users “to stream a variety of video content, 18 including television programs and full-length films.” Compl. ¶ 28. Plaintiff created an account to 19 use Plex’s streaming service, id. ¶ 6, but he did not enter into a paid membership plan that 20 involved ongoing transactions – or even a single paid transaction. Thus, although Plaintiff and 21 Plex had a “continuing relationship” in that Plaintiff was free to continue using Plex’s service, 22 Plaintiff had no “reason to look for additional terms and conditions not explicitly listed on [Plex’s] 23 website.” Chabolla, 129 F.4th at 1156. 24 Comparing the facts in this case to those in recent Ninth Circuit decisions is instructive. 25 In Chabolla, the plaintiff purchased a “plan” or “membership” to “gain access to gyms.” Id. 26 The Ninth Circuit found that this relationship did not weigh in favor or against the notice 27 requirement because users were advised that they were “never locked in,” that there were “no 1 relationship with Plex imposed no commitments on Plaintiff – he was free to use or stop using 2 Plex’s service at any time. By contrast, in Keebaugh, the Ninth Circuit found that users who 3 downloaded a mobile game to their phones that involved “potentially unlimited in-app purchases” 4 would understand that use of the app “would be governed by some terms of use.” 100 F.4th at 5 1020. Here, Plaintiff’s free subscription to Plex’s streaming service did not portend any future 6 purchases – let alone “potentially unlimited” purchases. Finally, in Oberstein, the Ninth Circuit 7 found that, in the context of a ticket purchasing website, the use of a “full registration process . . . 8 would have put users on notice” of a continuing relationship and to look for “a link to the terms of 9 that continuing relationship.” 60 F.4th at 517. Here, Plaintiff was able to sign up for Plex’s 10 service by clicking just one button and continuing through his Facebook account; he was not 11 required to provide payment information, and the relationship did not contemplate any future 12 purchases that would be bound by terms. Accordingly, the Court finds that the context of 13 Plaintiff’s relationship with Plex did not put him on notice to look for additional terms. 14 Next, the Court considers visual aspects of the website, beginning with the Sign-Up Page. 15 The Court finds that the notice on the Sign-Up Page is not reasonably conspicuous for at least 16 three reasons. First, the notice was placed at the very bottom of the visible page, far below the 17 “Continue with Facebook” button that Plaintiff clicked to create his account. Plaintiff had no 18 reason to read to the bottom of the Sign-Up Page because clicking on the prominent “Continue 19 with Facebook” button “automatically” directed him to the Facebook Userflow, where he 20 completed the account creation process. Clark Decl. ¶ 11; see Chabolla, 129 F.4th at 1157 (“A 21 reasonably prudent user would likely click ‘Continue’ and read no further[.]”). Second, the notice 22 is presented in small gray font at the bottom of the Sign-Up Page. Although it is legible, it is far 23 less prominent than the colorful buttons that the user must click to create an account. Finally, the 24 “Terms of Use” and “Privacy Policy” “appeared in the same gray font as the rest of the sentence, 25 rather than in blue, the color typically used to signify the presence of a hyperlink.” Berman, 30 26 F.4th at 854. The text is bolded, but it is not underlined or presented in a “contrasting font color” 27 to indicate that it hyperlinks to additional terms. Id. at 857. To the contrary, the same bolded gray 1 namely, the text that states “Email address” and “Create password.” Cf. Patrick v. Running 2 Warehouse, Inc., 93 F.4th 468, 477 (9th Cir. 2024) (approving of hyperlinked text designated by 3 “bright green” font that was “the same color as other clickable links on the page, suggesting 4 clearly that it is a hyperlink”). Viewed holistically, given these deficiencies, the Sign-Up Page did 5 not give Plaintiff reasonably conspicuous notice of the terms of use or privacy policy. 6 The Facebook Userflow also fails to provide reasonably conspicuous notice, though it fares 7 better than the Sign-Up Page. Again, the links to the “Terms of Use” and “Privacy Policy” are 8 located at the bottom of the page. They are closer to the blue “Continue” button that the user must 9 click to create an account, but they do not “disrupt[] the natural flow of actions” on the page. 10 Chabolla, 129 F.4th at 1157. The top of the Facebook Userflow informs the user that Plex is 11 requesting access to the user’s profile picture and email address. The user can read this 12 information and “Edit access” or click “Continue” without encountering the “Terms of Use” or 13 “Privacy Policy.” Additionally, the “Terms of Use” and “Privacy Policy” text appears in the 14 smallest font of any text on the page, and it is much less prominent than the interactive elements of 15 the page – the “Continue” and “Cancel” buttons. 16 Accordingly, the Court finds that Plex failed to provide Plaintiff reasonably conspicuous 17 notice of the terms of service and privacy policy.5 The lack of notice is dispositive, but the Court 18 proceeds to address the second issue of assent for completeness. 19 3. Unambiguous manifestation of assent 20 “Reasonable conspicuousness alone is not sufficient to bind a user – a user must agree to 21 the terms, not merely see them.” Chabolla, 129 F.4th at 1158. A sign-in wrap agreement does not 22 expressly require a website user to read the terms of use before proceeding to use the website, id. 23 at 1154, so assent is typically manifested by another action, like clicking a button. However, “[a] 24 user’s click of a button can be construed as an unambiguous manifestation of assent only if the 25 user is explicitly advised that the act of clicking will constitute assent to the terms and conditions 26 5 The Court recognizes that another court found that Plex’s sign-up page provided reasonably 27 conspicuous notice in Miller v. Plex, Inc., No. 22-cv-05015-SVK, ECF No. 32 (March 30, 2023). 1 of an agreement.” Berman, 30 F.4th at 857. A website must use clear language to indicate what 2 action will bind the user to the terms. See id. at 858 (holding that assent was lacking because the 3 webpage “did not indicate to the user what action would constitute assent”). 4 Here, the Court finds that neither the Sign-Up Page nor the Facebook Userflow clearly 5 indicated to Plaintiff what action would constitute assent to the terms of service and privacy 6 policy. Plex argues that a user assents to its terms on the Sign-Up Page by clicking the “Continue 7 with Facebook” button, Castro Decl. ¶ 10, but nothing in the notice language says this. The notice 8 language at the bottom of the Sign-Up Page states: “By creating an account or continuing to use a 9 Plex application, website, or software, you acknowledge and agree that you have accepted the 10 Terms of Service and Privacy Policy.” In context, this language is ambiguous because it 11 describes two actions that constitute assent, but neither matches the “Continue with Facebook” 12 button that Plaintiff clicked. See Berman, 30 F.4th at 857 (“[M]erely clicking on a button on a 13 webpage, viewed in the abstract, does not signify a user’s agreement to anything.”). First, 14 “creating an account” constitutes assent, but a reasonable user could assume this means clicking 15 the prominent “Create an Account” button that appears directly above the notice language. 16 Second, “continuing to use a Plex application, website, or software” constitutes assent, but the 17 button Plaintiff clicked “automatically” directed him to the Facebook website. Castro Decl. ¶ 11. 18 Plaintiff did not continue to a Plex application, website, or software.6 19 The notice language on the Facebook Userflow also fails to indicate what action 20 constitutes assent. The notice states: “By continuing, Plex will receive ongoing access to the 21 information you share and Facebook will record when Plex accesses it.” The phrase “Plex’s 22 Privacy Policy and Terms of Service” appears beneath this notice, but nothing connects these 23 terms to any action that the user takes on the Facebook UserFlow. 24 Finally, the fact that Plex provided links to the terms of service and privacy policy on both 25 the Sign-Up Page and the Facebook Userflow does not change the Court’s conclusion. The Court 26 considers “the visual aspects of every page of a multi-page transaction . . . together.” Chabolla, 27 1 129 F.4th at 1155. However, the Court will not find that a contract was formed by combining 2 independently insufficient elements of notice and assent across several webpages. See id. at 1158 3 (“We disagree that California’s contract formation test can be met with broad reference to the 4 conspicuousness of notice across three separate pages and a manifestation of assent constructed 5 from three different action buttons.”); see also Quamina v. JustAnswer LLC, 721 F. Supp. 3d 6 1026, 1040 (N.D. Cal. 2024) (“The obvious problem is that aggregating individually insufficient 7 forms of notice does not somehow add up to a positive.”), appeal docketed, Godun v. JustAnswer 8 LLC, No. 24-2095 (9th Cir. Apr. 4, 2024). 9 Here, the Sign-Up Page fails to provide reasonably conspicuous notice of terms, so a 10 typical user that creates a Plex account through Facebook never encounters the notice language at 11 the bottom of the page. Even if the user sees this language, it does not unambiguously describe 12 what action will bind the user to Plex’s terms. When the user continues to the Facebook Userflow, 13 the notice of the terms of use is more prominent, but there is no indication that, by clicking 14 “Continue,” the user will be bound by Plex’s terms. Thus, even when combined, the Sign-Up 15 Page and Facebook Userflow do not satisfy the requirements for contract formation. 16 In sum, Plex has not demonstrated that it gave Plaintiff reasonably conspicuous notice of 17 its terms of use, or that Plaintiff unambiguously manifested his assent to those terms. The Ninth 18 Circuit applies a comprehensive, fact- and context-specific inquiry when a website operator seeks 19 to bind a user to a sign-in wrap agreement. This inquiry may foster uncertainty for website 20 operators in close cases. See Chabolla, 129 F.4th at 1172 (Bybee, J., dissenting) (observing “great 21 uncertainty in this area”). Legal rules should be clear and predictably applied so that businesses 22 can order their affairs with confidence. At the same time, website users should be able to predict 23 when they will be bound by terms that may significantly alter their procedural and substantive 24 rights. Here, Plex’s terms of use, if enforced, would affect Plaintiff’s procedural right to litigate in 25 court, as well as Plaintiff’s important substantive right to privacy. 26 Ultimately, as a website operator, Plex controls its own destiny. Plex could have employed 27 several common website design elements to make its sign-in wrap agreement more enforceable. 1 more clearly emphasized; and the language explaining the consequences of creating a Plex 2 account could be clearer.7 Because these important elements are lacking, Plex has not met its 3 burden to show the existence of an agreement to arbitrate. Accordingly, Plex’s motion to compel 4 arbitration is DENIED. 5 III. 12(B)(2) MOTION TO DISMISS 6 A. Legal Standard 7 A defendant may move to dismiss a case for lack of personal jurisdiction under Federal 8 Rule of Civil Procedure 12(b)(2). In opposing a Rule 12(b)(2) motion, the plaintiff has the burden 9 of establishing that jurisdiction is proper. Ranza v. Nike, Inc., 793 F.3d 1059, 1068 (9th Cir. 10 2015). “Where, as here, the defendant’s motion is based on written materials rather than an 11 evidentiary hearing, ‘the plaintiff need only make a prima facie showing of jurisdictional facts to 12 withstand the motion to dismiss.’” Id. at 1073 (quoting Brayton Purcell v. Recordon & Recordon, 13 606 F.3d 1124, 1127 (9th Cir. 2010)). The court must take uncontroverted allegations as true and 14 resolve conflicts over statements contained in affidavits in favor of the plaintiff. Id. However, the 15 court “may not assume the truth of allegations in a pleading which are contradicted by affidavit.” 16 Apple, Inc. v. VoIP-Pal.com, Inc., 506 F. Supp. 3d 947, 957 (N.D. Cal. 2020) (quoting Mavrix 17 Photo, Inc. v. Brand Techs., Inc., 647 F.3d 1218, 1223 (9th Cir. 2011)). The court may also 18 consider “declarations and other evidence outside the pleadings to determine whether it has 19 personal jurisdiction.” Id. at 956. 20 “For the exercise of personal jurisdiction over a defendant, due process requires that the 21 defendant ‘have certain minimum contacts’ with the forum state ‘such that the maintenance of the 22 suit does not offend traditional notions of fair play and substantial justice.’” Ranza, 793 F.3d at 23 1068 (quoting Int’l Shoe Co. v. Washington, 326 U.S. 310, 316 (1945)). “The strength of contacts 24 required depends on which of the two categories of personal jurisdiction a litigant invokes: 25 specific jurisdiction or general jurisdiction.” Id. 26 7 Although not required under Ninth Circuit law, using a clickwrap agreement would provide a 27 website operator with greater assurance that the agreement will be enforced. Berman, 30 F.4th at 1 A corporate defendant is subject to general jurisdiction in its place of incorporation and its 2 principal place of business. Daimler AG v. Bauman, 571 U.S. 117, 137 (2014). A defendant may 3 also be subject to general jurisdiction if its affiliations with the forum state are “so continuous and 4 systematic as to render [it] essentially at home in” that state. Id. at 139 (quoting Goodyear Dunlop 5 Tires Operations, S.A. v. Brown, 564 U.S. 915, 919 (2011)). A defendant is subject to specific 6 jurisdiction if it (1) “purposefully availed itself of the privilege of conducting activities in” or 7 “purposefully directed its activities toward” the forum state; (2) the claim “arises out of or relates 8 to the defendant’s forum-related activities”; and (3) the exercise of jurisdiction “comport[s] with 9 fair play and substantial justice.” Schwarzenegger v. Fred Martin Motor Co., 374 F.3d 797, 802 10 (9th Cir. 2004); see also Global Commodities Trading Grp., Inc. v. Beneficio de Arroz Choloma, 11 S.A., 972 F.3d 1101, 1107 (9th Cir. 2020) (discussing the difference between purposeful availment 12 and purposeful direction). 13 B. Discussion 14 Plaintiff fails to establish that Plex GmbH is subject to either general jurisdiction or 15 specific jurisdiction in California. The only allegations that mention Plex GmbH state: 16 Together with Plex GmbH, Defendant Plex, Inc. offers the interactive Plex streaming service throughout California and the United States. 17 18 Defendant Plex GmbH is a Swiss corporation with its principal place of business . . . [in] Berlin, Germany. Plex GmbH oversees and controls the operations of Plex, Inc., 19 and relies on its subsidiary, Plex, Inc., for access into, and delivery of video content and the sales of subscriptions into the United States on the Plex streaming service. 20 As such, both Defendants acted jointly and in concert to commit the violations 21 alleged herein. 22 Compl. ¶¶ 7-8. All other allegations in the complaint reference “Defendants” or “Plex” 23 ambiguously without attributing any conduct to Plex GmbH specifically. This is improper. 24 A complaint cannot “engage[] in undifferentiated pleading that fails to make clear what allegations 25 are being made against” each defendant. Beluca Ventures LLC v. Aktiebolag, 622 F. Supp. 3d 26 806, 816 (N.D. Cal. 2022); see also McHenry v. Renne, 84 F.3d 1172, 1178 (9th Cir. 1996) 27 (explaining that a complaint must clearly indicate “which defendants are liable to plaintiffs for 1 notice requirement, and the Court will not rely on them. Resh, Inc. v. Skimlite Mfg. Inc., 2 666 F. Supp. 3d 1054, 1059 (N.D. Cal. 2023); see also id. at 1059-60 (“Defendants should not 3 have to guess amongst themselves as to whom” an allegation was intended to apply.”).8 4 As to general jurisdiction, Plaintiff alleges that Plex GmbH is a Swiss corporation with its 5 principal place of business in Germany. Compl. ¶ 8. Of course, neither Switzerland nor Germany 6 is in the State of California. Plaintiff’s other option is to allege that Plex GmbH’s affiliations with 7 California are “so continuous and systematic” that it is “essentially at home” here. Daimler AG, 8 571 U.S. at 139. In that regard, Plaintiff alleges that “Defendants . . . conduct substantial business 9 within the State of California.” Compl. ¶ 10. Even if the Court could attribute this ambiguous 10 allegation to Plex GmbH specifically, it would not establish that Plex GmbH is subject to general 11 jurisdiction in California. Exercising general jurisdiction over a corporation because it “engages 12 in a substantial, continuous, and systematic course of business” is “unacceptably grasping.” 13 Daimler AG, 571 U.S. at 137-38. 14 As to specific jurisdiction, Plaintiff does not plausibly allege any facts permitting the Court 15 to infer that Plex GmbH purposefully availed itself of the privileges of conducting activities in 16 California, or that it purposefully directed its activities to California. See Schwarzenegger, 374 17 F.3d at 802. The sole allegation connecting Plex GmbH to California is that “Plex, Inc. offers the 18 interactive Plex streaming service throughout California” “together with Plex GmbH.” Compl. 19 ¶ 7. This is another “undifferentiated pleading” that fails to attribute conduct to Plex GmbH 20 specifically. See Beluca Ventures LLC, 622 F. Supp. 3d at 816. The other allegation that 21 references Plex GmbH states that the company “oversees and controls the operations of Plex, Inc.” 22 and relies on Plex, Inc. for “delivery of video content and the sales of subscriptions into the United 23 States.” Compl. ¶ 10. This allegation, at most, establishes that Plex GmbH directs some activities 24 toward the United States generally, not toward California specifically. Because Plaintiff fails to 25 plausibly allege purposeful availment or direction, the Court does not reach the other requirements 26 for specific jurisdiction. 27 1 Plaintiff argues that a defendant’s leveraging of a state’s commercial market satisfies the 2 purposeful availment requirement. Opp. at 12. But Plaintiff does not plausibly allege that Plex 3 GmbH has leveraged California’s market. Comparing Plaintiff’s allegations to the cases Plaintiff 4 relies upon underscores this pleading deficiency. In Will Co. v. Lee, the foreign defendant “earned 5 considerable revenue” from the forum market and chose to host its website within the forum 6 market to appeal to viewers there. 47 F. 4th 917, 924 (9th Cir. 2022). And in Mavrix Photo, the 7 foreign defendant “operated a very popular website with a specific focus on the California- 8 centered celebrity and entertainment industries.” 647 F. 3d at 1230. 9 Accordingly, Plex GmbH’s motion to dismiss for lack of personal jurisdiction is 10 GRANTED. It is unclear whether Plaintiff can plausibly allege that Plex GmbH is subject to 11 personal jurisdiction in California in light of Plex’s declaration addressing jurisdictional facts. See 12 Spenillo Decl., ECF No. 22-1. However, as this is the Court’s first ruling on the legal sufficiency 13 of Plaintiff’s allegations, dismissal is with leave to amend. 14 IV. 12(B)(6) MOTION TO DISMISS 15 A. Legal Standard 16 Under Federal Rule of Civil Procedure 12(b)(6), a court must dismiss a complaint if it fails 17 to state a claim upon which relief can be granted. To avoid dismissal, the plaintiff must allege 18 “enough facts to state a claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly, 19 550 U.S. 544, 570 (2007). A claim is facially plausible when the pleaded facts allow the court 20 “to draw the reasonable inference that the defendant is liable for the misconduct 21 alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). For purposes of a Rule 12(b)(6) motion, 22 the court generally “accept[s] factual allegations in the complaint as true and construe[s] the 23 pleadings in the light most favorable to the nonmoving party.” Manzarek v. St. Paul Fire & 24 Marine Ins. Co., 519 F.3d 1025, 1031 (9th Cir. 2008). However, the court need not “assume the 25 truth of legal conclusions merely because they are cast in the form of factual allegations.” Fayer 26 v. Vaughn, 649 F.3d 1061, 1064 (9th Cir. 2011) (per curiam) (quoting W. Mining Council v. Watt, 27 643 F.2d 618, 624 (9th Cir. 1981)). 1 If the court finds that dismissal pursuant to Rule 12(b)(6) is warranted, the “court should 2 grant leave to amend even if no request to amend the pleading was made, unless it determines that 3 the pleading could not possibly be cured by the allegation of other facts.” Lopez v. Smith, 203 4 F.3d 1122, 1127 (9th Cir. 2000) (en banc) (quoting Doe v. United States, 58 F.3d 494, 497 5 (9th Cir. 1995)). 6 B. Discussion 7 1. Consent 8 Plex moves to dismiss both the VPPA and the California Civil Code § 1799.3 claims on 9 the grounds that Plaintiff consented to the disclosure of his video viewing activities. Mot. at 10 13-18. The VPPA provides that “a video tape service provide may disclose personally identifiable 11 information” “to any person with the informed, written consent . . . of the consumer” if certain 12 notice conditions are met. 18 U.S.C. § 2710(b)(2)(B). Specifically, the informed written consent 13 must be “in a form distinct and separate from any form setting forth other legal or financial 14 obligations of the consumer,” and must provide the consumer with a “clear and conspicuous 15 manner” to “withdraw on a case-by-case basis or to withdraw from ongoing disclosures, at the 16 consumer’s election.” Id. Section 1799.3(a) also requires “written consent” for disclosure of “any 17 personal information or the contents of any record, including sales or rental information, which is 18 prepared or maintained by that person.” 19 Plex argues that Plaintiff consented to disclosure of his information “by proceeding to sign 20 up with Plex.” Mot. at 18. However, as discussed above, Plex’s website did not provide 21 reasonably conspicuous notice of the terms of service or privacy policy, and Plaintiff did not 22 unambiguously manifest his assent to be bound by them. See supra Section II.B. This is fatal to 23 Plex’s argument that Plaintiff consented to disclosure of his video viewing activities.9 24

25 9 Plex’s argument as to consent under VPPA fails for the additional reason that Plex did not seek consent “with a consent form dedicated solely to informing consumers of [its] intent to share their 26 personally identifiable information with Facebook.” Cappello v. Walmart Inc., No. 18-cv-06678- RS, 2019 WL 11687705, at *2 (N.D. Cal. Apr. 5, 2019); see also id. (“[T]he plain language of the 27 VPPA does indeed require video tape service providers to [] request consumers’ consent to a 1 Plex argues that the “Facebook Userflow explicitly put Plaintiff on notice that it could 2 collect, use, and/or transmit Plaintiff’s personal information to Facebook/Meta.” Mot. at 18. 3 But the Facebook Userflow discloses only that Plex needed access to Plaintiff’s “name and profile 4 picture and email address,” and that “Plex will receive ongoing access to the information you 5 share and Facebook will record when Plex accesses it.” See Fig. 2. This notice indicates that 6 Plex will receive information that Plaintiff shared with Facebook – not that Facebook will receive 7 Plaintiff’s viewing activity from Plex. Indeed, nothing in this supposed notice reflects what 8 “information” is being shared with Plex or Facebook. 9 Accordingly, the Court denies Plex’s motion to dismiss the VPPA and Section 1799.3 10 claims on the basis that Plaintiff consented to Plex’s alleged disclosures of his viewing activity. 11 2. Disclosure of personally identifiable information 12 Plex moves to dismiss Plaintiff’s VPPA and Section 1799.3 claims for failure to allege that 13 Plex disclosed Plaintiff’s personally identifiable information. Mot. at 21 n.3; see also Mollett v. 14 Netflix, Inc., 795 F.3d 1062, 1066 (9th Cir. 2015) (stating the elements of a VPPA claim, including 15 the disclosure of personally identifiable information); Cal. Civ. Code § 1799.3(a) (prohibiting 16 disclosure of “personal information”). The Ninth Circuit has held that “‘personally identifiable 17 information’ means only that information that would ‘readily permit an ordinary person to identify 18 a specific individual’s video-watching behavior.’” Eichenberger v. ESPN, Inc., 876 F.3d 979, 985 19 (9th Cir. 2017) (quoting In re Nickelodeon Consumer Priv. Litig., 827 F.3d 262, 267 (3d Cir. 20 2016)). Personally identifiable information includes information that “standing alone, identifies a 21 person” as well as information that is “capable of” identifying a person. Id. at 984. 22 Here, Plaintiff alleges that Plex disclosed his Facebook User ID and his email address, 23 along with “event data, like the title of the videos viewed.” Compl. ¶¶ 43-44, 66, 82. Plaintiff 24 further alleges that a “Facebook ID is personally identifying” because “[a]nyone can identify a 25 Facebook profile – and all personal information publicly listed on that profile.” Id. ¶ 42. Plaintiff 26 also alleges that his Facebook profile “exists using his real name.” Id. ¶ 6. Thus, any person who 27 obtains Plaintiff’s Facebook ID could locate his Facebook profile and, thereby, learn his name. 1 See Eichenberger, 876 F.3d at 986 (recognizing that names qualify as personally identifiable 2 information under the VPPA). 3 The Ninth Circuit has acknowledged that a “Facebook link or an email address may very 4 well readily enable an ‘ordinary person’ to identify an individual,” but has not definitively ruled 5 on this issue. Id. at 986. However, “[m]ost, if not all, courts to address the question have found at 6 the pleading stage that Facebook IDs are [personally identifiable information].” Ghanaat v. 7 Numerade Labs, Inc., 689 F. Supp. 3d 714, 720 (N.D. Cal. 2023). 8 Consistent with the great weight of authority, this Court agrees that a Facebook ID is 9 personally identifiable information for purposes of the VPPA because Plaintiff alleges that anyone 10 can use it to identify a Facebook profile “and all personal information publicly listed on that 11 profile.” See Ade v. Viki, Inc., No. 23-cv-02161-RFL, 2024 WL 1880153, at *2 (N.D. Cal. Mar. 12 28, 2024) (Plaintiff plausibly alleged that a Facebook ID is personally identifiable information 13 because it “uniquely identifies an individual’s Facebook account,” “which generally contains a 14 wide range of demographic and other information[.]” (citation omitted)); see also Fan v. NBA 15 Props. Inc., No. 23-cv-05069-SI, 2024 WL 1297643, at *2 (N.D. Cal. Mar. 26, 2024) (Plaintiff 16 plausibly alleged that a Facebook ID is personally identifiable information because it “allows 17 anybody” to identify a person associated with a Facebook profile and “all personal information 18 publicly listed on that profile.” (citation omitted)); Sellers v. Bleacher Rep., Inc., No. 23-cv- 19 00368-SI, 2023 WL 4850180, at *4 (N.D. Cal. July 28, 2023) (“The [Facebook ID] is a unique 20 identifier that is enough, on its own, to identify a person.”); Jackson v. Fandom, Inc., No. 22-cv- 21 04423-JST, 2023 WL 4670285, at *4 (N.D. Cal. July 20, 2023) (similar); Stark v. Patreon, Inc., 22 635 F. Supp. 3d 841, 853 (N.D. Cal. 2022) (similar). 23 Plex argues that more is required. According to Plex, Plaintiff must also allege that his 24 Facebook profile is public and that it contains personally identifiable information (“PII”). But, as 25 noted above, most courts have not required plaintiffs asserting VPPA claims to plead such 26 granular details. Ghanaat is one exception. In that case, the court held that a Facebook ID “can 27 constitute PII where it leads to a Facebook page that discloses personal and identifying 1 allegations were “inadequate because they do not allege their Facebook pages contain any 2 personal information, such as their names or email addresses.” Id. Here, even if the Court were to 3 adopt this requirement, it would be satisfied because Plaintiff alleges that his Facebook page 4 “exists using his real name.” Compl. ¶ 6. Thus, disclosure of Plaintiff’s Facebook ID also 5 discloses his name.10 See Eichenberger, 876 F.3d at 986 (indicating that a person’s name is 6 personally identifiable information). 7 Plex asks the Court to take judicial notice of two online articles published by Facebook 8 which, according to Plex, establish that a Facebook ID does not personally identify a Facebook 9 user. Plex’s First Supp. Br. at 4 & nn.2-4, ECF No. 35. But the Court cannot take judicial notice 10 of disputed facts in online articles for the purpose of creating a defense against the well-pleaded 11 allegations in the complaint. See Khoja v. Orexigen Therapeutics, Inc., 899 F.3d 988, 1002 (9th 12 Cir. 2018). Moreover, contrary to Plex’s characterization, one of the articles explains that “Your 13 User ID is a string of numbers that doesn’t personally identify you but does connect to your 14 Facebook profile and specific chats on Messenger.” See Facebook, How usernames and user IDs 15 are used on Facebook profiles, https://www.facebook.com/help/211813265517027 (last visited 16 Mar. 26, 2025) (emphasis added). The article elaborates that a User ID allows others “to see [a 17 user’s] Facebook profile, including any public information” and serves as “the web address for 18 your profile or Page (example: Facebook.com/yourname).” Id. When viewed in full context, this 19 article bolsters the Court’s conclusion that a Facebook ID is personally identifiable information 20 because it is “capable of” identifying a Facebook user. Eichenberger, 876 F.3d at 984. 21 Accordingly, Plaintiff plausibly alleges that Plex disclosed his personally identifiable 22 information. Plex’s motion to dismiss on this basis is DENIED.11 23 24 25 10 The disclosure of Plaintiff’s name also distinguishes this case from Heerde v. Learfield 26 Communications, LLC, on which Plex relies. See 741 F. Supp. 3d 849 (C.D. Cal. 2024). In Heerde, the plaintiff alleged disclosure of his Facebook ID only, not additional information like 27 his name. Id. at 857. 1 3. Class action waiver 2 Finally, Plex argues that the Court should dismiss the case because “[a]t the time Plaintiff 3 initially entered into the Sign-In Wrap Agreement in or around April 2020, Plex’s TOS [terms of 4 service] included a Class Action Waiver which bars his claims.” Mot. at 22. However, Plaintiff 5 did not agree to Plex’s terms of service because Plex did not give reasonably conspicuous notice, 6 and Plaintiff did not unambiguously manifest his assent to be bound by them. See supra Section 7 II.B. Because Plaintiff did not agree to Plex’s terms of service, he is not bound by the class action 8 waiver contained within those terms. 9 Accordingly, Plex’s motion to dismiss on this basis is DENIED. 10 V. MOTION TO STRIKE CLASS ALLEGATIONS 11 A. Legal Standard 12 Under Rule 12(f), a party may move to strike “an insufficient defense or any redundant, 13 immaterial, impertinent, or scandalous matter.” Fed. R. Civ. P. 12(f). The purpose of a motion to 14 strike is to avoid wasteful litigation of “spurious issues.” Whittlestone, Inc. v. Handi-Craft Co., 15 618 F.3d 970, 973 (9th Cir. 2010). Therefore, a “motion to strike should only be granted if the 16 matter sought to be stricken clearly has no possible bearing on the subject matter of the litigation.” 17 Baton v. Ledger SAS, 740 F. Supp. 3d 847, 872 (N.D. Cal. 2024). 18 A decision to grant a motion to strike class allegations at the pleading stage is the 19 “functional equivalent of denying a motion to certify a case as a class action” before discovery 20 commences. Bates v. Bankers Life & Cas. Co., 848 F.3d 1236, 1238 (9th Cir. 2017) (per curiam) 21 (quoting In re Bemis Co., 279 F.3d 419, 421 (7th Cir. 2002)). The Ninth Circuit has recognized 22 that “often the pleadings alone will not resolve the question of class certification and that some 23 discovery will be warranted.” Vinole v. Countrywide Home Loans, Inc., 571 F.3d 935, 942 24 (9th Cir. 2009). Thus, in general, “the better and more advisable practice for a District Court to 25 follow is to afford the litigants an opportunity to present evidence as to whether a class action [i]s 26 maintainable.” Id. (quoting Doninger v. Pac. Nw. Bell, Inc., 564 F.2d 1304, 1313 (9th Cir. 1977)). 27 But when the problem with the class allegations is “facially evident, it makes sense to address the 1 B. Discussion 2 Plaintiff seeks to represent the following class: 3 All persons in the United States who have a Facebook account and created a Plex 4 account, or signed in to Plex, with a Google, Facebook, or Apple account and viewed videos on watch.plex.tv using the same browser they use to access their Facebook 5 account until March 2, 2024 (the “Nationwide Class”). 6 Compl. ¶ 69. Plaintiff also seeks to represent an otherwise-identical subclass of all persons in the 7 State of California. Id. ¶ 70. Plex moves to strike the class allegations on three primary grounds. 8 First, Plex argues that Plaintiff cannot represent a class because he lacks standing. Mot. at 9 19. To the extent Plex means that Plaintiff lacks standing to pursue his individual claims, this 10 argument fails given the Court’s ruling above that Plaintiff plausibly alleges claims under VPPA 11 and California Civil Code § 1799.3. See supra Section IV.B. Plex also argues that Plaintiff lacks 12 standing to represent a class that includes members who created their Plex accounts with a Google 13 or Apple account because Plaintiff created his Plex account through Facebook instead. See Mot. 14 at 19. But whether putative class members signed up using Facebook, Google, or Apple does not 15 affect Plaintiff’s standing as a class representative. Plaintiff is asserting the same essential legal 16 claims as the proposed class: that Plex violated his privacy rights by sharing his viewing activity 17 without consent. If anything, the different sign-up methods raise questions for class certification, 18 such as whether Plaintiff is typical of the class, and whether differences in sign-up methods create 19 individualized issues that will predominate over common ones. See Melendres v. Arpaio, 784 20 F.3d 1254, 1262 (9th Cir. 2015) (“[A]ny issues regarding the relationship between the class 21 representative and the passive class members – such as dissimilarity in injuries suffered – are 22 relevant only to class certification, not to standing.” (quoting Newberg on Class Actions § 2.6)). 23 It would be premature to address these issues at the pleading stage, without discovery. 24 Second, Plex argues that individualized issues may predominate because individual proof 25 will be needed to assess each class member’s claim. See Mot. at 20-21. Plex argues that each 26 class member “had different personal information allegedly compromised” and “each class 27 member will need to provide individual proof [that] their ‘Facebook profile is publicly accessible 1 857). This argument is raised prematurely. Plaintiff is entitled to discovery to determine whether 2 he can show disclosure of class members’ personally identifiable information through common 3 proof. See Vinole, 571 F.3d at 942. At this early stage, the Court has no basis to conclude that 4 Plaintiff’s task is impossible. For example, records in the possession of Plex (or Meta) may reflect 5 class members’ Facebook profile privacy settings and what information was (allegedly) shared by 6 Plex to Meta. 7 Finally, Plex argues that Plaintiff cannot certify a class under Rule 23(b)(1) or 23(b)(2). 8 Mot. at 20-21. This argument is confusing and irrelevant. A class may be certified if any one of 9 the three Rule 23(b) requirements is met. United Steel, Paper & Forestry, Rubber, Mfg. Energy, 10 Allied Indus. & Serv. Workers Int’l Union v. ConocoPhillips Co., 593 F.3d 802, 805 n.4 (9th Cir. 11 2010) (“[T]he three provisions of Rule 23(b) are disjunctive: a class can be certified where it 12 satisfies only one Rule 23(b) requirement.”). In this case, the complaint does not invoke Rule 13 23(b)(1) or (b)(2). Instead, Plaintiff alleges that the class may be certified under Rule 23(b)(3), 14 which requires Plaintiff to demonstrate that common issues will predominate over individualized 15 ones and that a class action is superior to other methods of adjudicating the controversy. Compl. 16 ¶¶ 74, 77; see also Fed. R. Civ. P. 23(b)(3). As discussed above, the Court finds that it would be 17 premature to strike Plaintiff’s class allegations on the basis of hypothetical individualized issues. 18 Accordingly, Plex’s motion to strike class allegations is DENIED. 19 VI. MOTION TO TRANSFER 20 Plex makes one final motion in the alternative – to transfer this case to the District of 21 Delaware. The premise of this motion is that if Plex’s updated terms of service from 2024 apply 22 to this case, then the forum selection clause identifying Delaware as the agreed-upon forum for 23 certain disputes would apply. This argument is confusing because all parties agree that, if the 24 Court should apply any terms of service, it should apply the 2020 terms, not the 2024 updated 25 terms. Mot. at 25 (stating that the 2020 terms of service should apply because “Plex did not notify 26 its existing users, including Plaintiff, of the April 11, 2024 update to its TOS” (citing Castro Decl. 27 ¶ 42)); Opp. at 10 (“As Defendants concede the 2024 terms do not apply[.]”). Given Plex’s 1 the Court finds that Plaintiff did not have notice of the change in contract terms. Therefore, 2 || Plaintiff cannot be bound by the forum selection clause in the 2024 updated terms.'? See Stover v. 3 Experian Holdings, Inc., 978 F.3d 1082, 1086 (9th Cir. 2020). 4 Accordingly, Plex’s motion to transfer is DENIED. 5 || VIL CONCLUSION 6 For the foregoing reasons, the Court ORDERS as follows: 7 1. Plex’s motion to compel arbitration is DENIED. 8 2. Plex’s motion to dismiss Plaintiffs claims against Plex GmbH for lack of personal 9 jurisdiction is GRANTED with leave to amend. 10 3. Plex’s motion to dismiss for failure to state a claim is DENIED. 11 4. Plex’s motion to strike class allegations is DENIED. 12 5. Plex’s motion to transfer is DENIED. 5 13 Plaintiff shall file an amended complaint within 21 days of this Order.

IT IS SO ORDERED.

3 15 Dated: March 28, 2025 16

Sind 8 umiK.Lee United States District Judge 19 20 21 22 23 24 25 26 27 With respect to the 2020 terms, as previously discussed, the Court finds that they are not 2g || binding on Plaintiff because Plex did not provide reasonably conspicuous notice of the terms, and Plaintiff did not unambiguously manifest his assent to be bound by them. See supra Section IIB.

1 APPENDIX 2 Figure 1: Sign-Up Page (Castro Decl. Ex. C, ECF No. 22-5) 3 1 Create your free account 5 No credit card required. 6 7 8 G Continue with Google 9 10 11 Se esl a 12

14 Email address 15 □□ To” — a 16 Create password 17 SS 4 18 Password Requirements 19 * WO characters = Lowercase better * Uppercase letter * Mumber 20 * Specal character 21 22 23 Already have an account? Sign in 24 25 oF software, you acknowledge and agree that you have accepted the Terms of Service ond have reviewed the Privacy Policy 27 28

1 Figure 2: Facebook Userflow (Castro Decl. Ex. D, ECF No. 22-6) 2 3 ee i etliete) 4 4 pW C-let-}s Lele] Mets) □□ erelarte adios] Sid leluieckcielet: Me byte] PCO tS Pat □□□□ 5 ‘i1QcH 4 8 9 Plex is requesting access to: 10 Your name and profile picture and email address, 11 Edit access 12

13 14

15 Sm

16

= 17

18 19 20 21 2 23 Cancel 24 By continuing, Plex will receive ongoing access to the information you share and Facebook 25 will record when Plex accesses it. Learn more about this sharing and the settings you have. 26 Plex's Privacy Policy and Terms of Service 27 28