Nancy Graf, et al v. ZYNGA Game Network, Inc.
Filing
FILED OPINION (ARTHUR L. ALARCON, RICHARD C. TALLMAN and SANDRA S. IKUTA) AFFIRMED. Judge: SSI Authoring. FILED AND ENTERED JUDGMENT. [9087564] [11-18044, 12-15619]
<(1) or (a)(2)) . . . to any person other
than a governmental entity.” Although there is no specific
statutory definition for “record,” the Stored Communications
Act provides examples of record information in a different
provision that governs the government’s power to require a
provider of electronic communications service or remote
computing service to disclose such information. Id.
§ 2703(c). According to § 2703(c), record information
includes, among other things, the “name,” “address,” and
“subscriber number or identity” of “a subscriber to or
customer of such service,” but not “the contents of
communications.” Id. § 2703(c)(2)(A), (B), (E). In other
words, the Stored Communications Act generally precludes
a covered entity from disclosing the contents of a
communication, but permits disclosure of record information
like the name, address, or client ID number of the entity’s
customers in certain circumstances.
Case: 11-18044
05/08/2014
14
ID: 9087564
DktEntry: 46-1
IN RE: ZYNGA PRIVACY LITIGATION
ECPA provides a cause of action to third parties for
violations of the Wiretap Act and the Stored Communications
Act. Under the Wiretap Act, “any person whose wire, oral,
or electronic communication is . . . disclosed . . . may in a
civil action recover from the person or entity . . . such relief
as may be appropriate,” including damages and attorney’s
fees, id. § 2520(a), and under the Stored Communications
Act, “any . . . person aggrieved by any violation of this
chapter in which the conduct constituting the violation is
engaged in with a knowing or intentional state of mind may,
in a civil action, recover from the person or entity . . . which
engaged in that violation such relief as may be appropriate,”
id. § 2707(a).
III
On appeal, the plaintiffs argue that the district court erred
in holding that Facebook, Zynga, and the third parties were
the intended recipients of the referer headers containing the
user’s Facebook IDs and the URLs. According to the
plaintiffs, because their complaints allege that Facebook and
Zynga had privacy policies which precluded them from
providing personally identifiable information to third parties,
the exceptions in §§ 2511(3) and 2702(b) for intended
recipients are inapplicable. Facebook and Zynga, in turn,
raise a number of arguments as to why we should affirm the
district court. Because the plaintiffs’ complaints suffer from
a common defect—they fail to allege that either Facebook or
Zynga divulged the contents of a communication to a third
party—we focus our analysis on this single ground.5 In doing
5
Facebook and Zynga argue that the plaintiffs lack standing because
they have not suffered any concrete or particularized injury arising from
the alleged disclosure of users’ Facebook IDs and URL information to
Page: 14 of 22
Case: 11-18044
05/08/2014
ID: 9087564
DktEntry: 46-1
IN RE: ZYNGA PRIVACY LITIGATION
Page: 15 of 22
15
so, we express no opinion on the other elements of an ECPA
claim.
A
Because the plaintiffs alleged that Facebook and Zynga
violated ECPA by disclosing the HTTP referer information to
third parties, we must determine whether such information is
the “contents” of a communication for purposes of 18 U.S.C.
§§ 2511(3)(a) and 2702(a)(2).
To answer this question, we first must determine
Congress’s intended meaning of the word “contents.” “In
ascertaining the plain meaning of the statute, the court must
look to the particular statutory language at issue, as well as
the language and design of the statute as a whole.” K-Mart
Corp. v. Cartier, Inc., 486 U.S. 281, 291 (1988). We start
with the plain language of the statutes. See Gwaltney of
Smithfield, Ltd. v. Chesapeake Bay Found., Inc., 484 U.S. 49,
56 (1987). For purposes of §§ 2511(3)(a) and 2702(a), the
word “contents” is defined as “any information concerning
the substance, purport, or meaning of [a] communication.”
18 U.S.C. §§ 2510(8), 2711(a). Because the words
“substance, purport, or meaning” are not further defined, we
consider the ordinary meaning of these terms, including their
third parties. This argument has been foreclosed by Edwards v. First
American Corp., which held that a plaintiff demonstrates an injury
sufficient to satisfy Article III when bringing a claim under a statute that
prohibits the defendant’s conduct and grants “‘persons in the plaintiff’s
position a right to judicial relief.’” 610 F.3d 514, 517 (9th Cir. 2010)
(quoting Warth v. Seldin, 422 U.S. 490, 500 (1975)). Because the
plaintiffs allege that Facebook and Zynga are violating statutes that grant
persons in the plaintiffs’ position the right to judicial relief, we conclude
they have standing to bring this claim. See 18 U.S.C. §§ 2520, 2707.
Case: 11-18044
16
05/08/2014
ID: 9087564
DktEntry: 46-1
IN RE: ZYNGA PRIVACY LITIGATION
dictionary definition. See Wilderness Soc’y v. U.S. Fish &
Wildlife Serv., 353 F.3d 1051, 1061 (9th Cir. 2003) (en banc),
amended by 360 F.3d 1374 (9th Cir. 2004) (en banc). A
dictionary in wide circulation during the relevant time frame
provides the following definitions: (1) “substance” means
“the characteristic and essential part,” Webster’s Third New
International Dictionary 2279 (1981); (2) “purport” means
the “meaning conveyed, professed or implied,” id. at 1847;
and (3) “meaning” refers to “the thing one intends to convey
. . . by language,” id. at 1399. These definitions indicate that
Congress intended the word “contents” to mean a person’s
intended message to another (i.e., the “essential part” of the
communication, the “meaning conveyed,” and the “thing one
intends to convey”).
The “language and design of the statute as a whole,” KMart Corp., 486 U.S. at 291, sheds further light on the
meaning of “contents” by indicating that “contents” does not
include “record” information. Specifically, the Stored
Communications Act provides that a covered service provider
“may divulge a record or other information pertaining to a . . .
customer” but may not divulge “the contents of
communications.” 18 U.S.C. §§ 2702(c), 2703(c)(1).
Customer record information (which can be disclosed under
certain circumstances) includes the “name,” “address,” and
“subscriber number or identity” of a subscriber or customer.
Id. § 2702(c)(2). Accordingly, we conclude that “contents”
does not include such record information.
This conclusion is confirmed by ECPA’s amendments to
the Wiretap Act enacted in 1968. Before ECPA, the Wiretap
Act defined “contents” as including “the identity of the
parties to such communication or the existence, substance,
purport, or meaning of that communication.” 18 U.S.C.
Page: 16 of 22
Case: 11-18044
05/08/2014
ID: 9087564
DktEntry: 46-1
IN RE: ZYNGA PRIVACY LITIGATION
Page: 17 of 22
17
§ 2510(8) (1982). When it enacted ECPA, Congress
amended the definition of “contents” to eliminate the words
“identity of the parties to such communication,” indicating its
intent to exclude such record information from its definition
of “contents.” See Pub. L. 99-508 § 101(a)(5).
Accordingly, we hold that under ECPA, the term
“contents” refers to the intended message conveyed by the
communication, and does not include record information
regarding the characteristics of the message that is generated
in the course of the communication. We have previously
made this distinction between contents and record
information. See United States v. Reed, 575 F.3d 900, 917
(9th Cir. 2009) (holding that information about a telephone
call’s “origination, length, and time” was not “contents” for
purposes of § 2510(8), because it contained no “information
concerning the substance, purport or meaning of [the]
communication”). And this conclusion is consistent with the
reasoning of our sister circuits. See Gilday v. Dubois,
124 F.3d 277, 296 n.27 (1st Cir. 1997) (holding that a device
that “captures electronic signals relating to the [personal
identification number] of the caller, the number called, and
the date, time and length of the call” does not capture the
contents of communications and therefore “is not within the
ambit of the Wiretap Act”); see also In re Application of U.S.
for an Order Directing a Provider of Elec. Commc’n Serv. to
Disclose Records to Gov’t, 620 F.3d 304, 305–06 (3d Cir.
2010) (holding that cell phone users’ location data is not
content information under the Stored Communications Act).
B
We must next determine whether the plaintiffs plausibly
alleged that the referer header information at issue here
Case: 11-18044
18
05/08/2014
ID: 9087564
DktEntry: 46-1
IN RE: ZYNGA PRIVACY LITIGATION
constituted the “contents of any communication,” 18 U.S.C.
§§ 2511(3)(a), 2702(a), that is, “any information concerning
the substance, purport, or meaning of a communication,” id.
§ 2510(8).
The referer header information that Facebook and Zynga
transmitted to third parties included the user’s Facebook ID
and the address of the webpage from which the user’s HTTP
request to view another webpage was sent. This information
does not meet the definition of “contents,” because these
pieces of information are not the “substance, purport, or
meaning” of a communication. A Facebook ID identifies a
Facebook user and so functions as a “name” or a “subscriber
number or identity.” Id. §§ 2702(c)(6), 2703(c)(2)(A), (E).
Similarly, the webpage address identifies the location of a
webpage a user is viewing on the internet, and therefore
functions like an “address.” Id. § 2703(c)(B). Congress
excluded this sort of record information from the definition
of “contents.” See id. §§ 2702(c)(6), 2703(c)(2)(A), (B), (E).
The plaintiffs argue that the referer header discloses
content information, because when the referer header
provides the advertiser with a Facebook ID (which, at the
election of the user, may have been changed to a user name)
along with the address of the Facebook page the user was
previously viewing, an enterprising advertiser could uncover
the user’s profile page and any personal information made
available to the public on that page. But the statutes at issue
in these cases do not preclude the disclosure of personally
identifiable information; indeed, they expressly allow it. See
id. §§ 2702(c)(6), 2703(c)(2) (allowing providers to disclose
subscribers’ names, addresses, telephone connection records,
length of service, telephone numbers, subscriber numbers,
credit card numbers, and bank account numbers under certain
Page: 18 of 22
Case: 11-18044
05/08/2014
ID: 9087564
DktEntry: 46-1
IN RE: ZYNGA PRIVACY LITIGATION
Page: 19 of 22
19
circumstances). There is no language in ECPA equating
“contents” with personally identifiable information. Thus, an
allegation that Facebook and Zynga disclosed personally
identifiable information is not equivalent to an allegation that
they disclosed the contents of a communication.
The plaintiffs also argue that record information can
become content if the record is the subject of a
communication, as in an email message saying “here’s my
Facebook ID number,” or “you have to check out this
website.” Such was the case in In re Pharmatrak, where the
First Circuit recognized an ECPA violation when an entity
intercepted the content of the sign-up information customers
provided to pharmaceutical websites, which included their
“names, addresses, telephone numbers, email addresses, dates
of birth, genders, insurance statuses, education levels,
occupations, medical conditions, medications, and reasons for
visiting the particular website,” and provided this information
to third parties. 329 F.3d 9, 15, 18–19 (1st Cir. 2003).
Because the users had communicated with the website by
entering their personal medical information into a form
provided by a website, the First Circuit correctly concluded
that the defendant was disclosing the contents of a
communication. But the complaints here do not plausibly
allege that Facebook and Zynga divulged a user’s
communications to a website; rather, they allege that
Facebook and Zynga divulged identification and address
information contained in a referer header automatically
generated by the web browser. Unlike the information
disclosed in Pharmatrak, the information allegedly disclosed
by Facebook and Zynga is record information about a user’s
communication, not the communication itself. ECPA does
not apply to such disclosures.
Case: 11-18044
20
05/08/2014
ID: 9087564
DktEntry: 46-1
IN RE: ZYNGA PRIVACY LITIGATION
Finally, the plaintiffs rely on cases analyzing when
disclosure of a URL may provide the contents of a
communication, rather than record information, for purposes
of Fourth Amendment protections. The plaintiffs rely on a
footnote in United States v. Forrester, where we noted that a
“URL, unlike an IP address, identifies the particular
document within a website that a person views,” and
therefore “might be more constitutionally problematic.”
512 F.3d 500, 510 n.6 (9th Cir. 2008). Forrester quoted a
district court case for the proposition that if a user entered a
search phrase into a search engine, “‘that search phrase would
appear in the URL after the first forward slash,’” and
disclosure of that URL “‘would reveal content.’” Id. (quoting
In re Application of U.S. for an Order Authorizing Use of a
Pen Register & Trap On (xxx) Internet Serv. Account/User
Name, (xxxxxxxx@xxx.com), 396 F. Supp. 2d 45, 49 (D.
Mass. 2005)). Based on this footnote, the plaintiffs argue that
the webpage addresses contained in the referer headers in this
case revealed the contents of a communication, because they
disclose specific information regarding a webpage that a user
previously viewed. For example, they allege that “if a
Facebook user who was gay and struggling to come out of the
closet was viewing the Facebook page of a gay support
group, and then clicked on an ad, the advertiser would know
. . . that s/he was viewing the Facebook page of a gay support
group just before navigating to their site.”
This argument fails. As a threshold matter, our task in
interpreting ECPA is to discern Congress’s intent, see
Gwaltney, 484 U.S. at 56–58, and our Fourth Amendment
jurisprudence is largely irrelevant to this enterprise of
statutory interpretation. But even assuming that Congress
considered the body of law regarding persons’ reasonable
expectation of privacy under the Fourth Amendment in
Page: 20 of 22
Case: 11-18044
05/08/2014
ID: 9087564
DktEntry: 46-1
IN RE: ZYNGA PRIVACY LITIGATION
Page: 21 of 22
21
making the statutory distinction between content and record
information at issue in ECPA, we disagree with the plaintiffs’
claims. Under the Fourth Amendment, courts have long
distinguished between the contents of a communication (in
which a person may have a reasonable expectation of
privacy) and record information about those communications
(in which a person does not have a reasonable expectation of
privacy). Forrester, 512 F.3d at 509–11. Thus the
warrantless installation of pen registers, which capture only
the telephone numbers that are dialed and not the calls
themselves, does not violate the Fourth Amendment. See
Smith v. Maryland, 442 U.S. 735, 745–46 (1979). Courts
have made a similar distinction between the outside of an
envelope and its contents in mail cases. See, e.g., United
States v. Jacobsen, 466 U.S. 109, 114 (1984); United States
v. Hernandez, 313 F.3d 1206, 1209–10 (9th Cir. 2002). And
we have allowed the warrantless collection of email and IP
addresses under the same reasoning because email and IP
addresses “constitute addressing information and do not
necessarily reveal any more about the underlying contents of
communication than do phone numbers.” Forrester,
512 F.3d at 510. So Forrester does not support the plaintiffs,
but rather reinforces the distinction between contents and
record information that we have discerned in ECPA.
Nor does Forrester’s dicta about URL information being
“content” under some circumstances help the plaintiffs.
Information about the address of the Facebook webpage the
user was viewing is distinguishable from the sort of
communication involving a search engine discussed in
Forrester. As noted in the district court opinion cited by
Forrester, a Google search URL not only shows that a user is
using the Google search engine, but also shows the specific
search terms the user had communicated to Google. In re
Case: 11-18044
22
05/08/2014
ID: 9087564
DktEntry: 46-1
IN RE: ZYNGA PRIVACY LITIGATION
Application, 396 F. Supp. 2d at 49.
Under some
circumstances, a user’s request to a search engine for specific
information could constitute a communication such that
divulging a URL containing that search term to a third party
could amount to disclosure of the contents of a
communication. But the referer header information at issue
here includes only basic identification and address
information, not a search term or similar communication
made by the user, and therefore does not constitute the
contents of a communication.
IV
In order for the plaintiffs to state a claim under the
Wiretap Act and Stored Communications Act, they must
plausibly allege that Facebook and Zynga divulged the
“contents” of a communication. Because information
disclosed in the referer headers at issue here is not the
contents of a communication as defined in ECPA, the
plaintiffs cannot state a claim under those statutes.
Accordingly, we affirm the district court’s dismissal with
prejudice.
AFFIRMED.
Page: 22 of 22
]]>
Disclaimer: Justia Dockets & Filings provides public litigation records from the federal appellate and district courts. These filings and docket sheets should not be considered findings of fact or liability, nor do they necessarily reflect the view of Justia.
Why Is My Information Online?
