"In Re: Facebook Privacy Litigation"

Filing 102

REPLY (re 96 MOTION to Dismiss FACEBOOK, INC.S MOTION TO DISMISS FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT ) filed byFacebook, Inc.. (Brown, Matthew) (Filed on 9/1/2011)

Download PDF
1 2 3 4 5 6 7 COOLEY LLP MICHAEL G. RHODES (116127) (rhodesmg@cooley.com) MATTHEW D. BROWN (196972) (brownmd@cooley.com) BENJAMIN H. KLEINE (257225) (bkleine@cooley.com) KELLY A. COOKE (258003) (kcooke@cooley.com) MEGAN L. DONOHUE (266147) (mdonohue@cooley.com) 101 California Street, 5th Floor San Francisco, CA 94111-5800 Telephone: (415) 693-2000 Facsimile: (415) 693-2222 Attorneys for Defendant FACEBOOK, INC. 8 UNITED STATES DISTRICT COURT 9 NORTHERN DISTRICT OF CALIFORNIA 10 SAN FRANCISCO DIVISION 11 12 13 14 15 16 17 IN RE: FACEBOOK PRIVACY LITIGATION Case No. 10-CV-02389-JW FACEBOOK, INC.’S REPLY IN SUPPORT OF MOTION TO DISMISS FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT Date: Time: Courtroom: Judge: Trial Date: October 17, 2011 9:00 a.m. 15 (18th Floor) Hon. James Ware Not Yet Set 18 19 20 21 22 23 24 25 26 27 28 COOLEY LLP ATTORNEYS AT LAW SAN FRANCISCO FACEBOOK’S REPLY I/S/O MOTION TO DISMISS FIRST AM. COMPL. CASE NO. 10-CV-02389-JW 1 TABLE OF CONTENTS 2 PAGE 3 I. INTRODUCTION .............................................................................................................. 1 4 II. ARGUMENT ...................................................................................................................... 2 A. Plaintiffs Do Not Oppose Facebook’s Motion to Dismiss Their Wiretap Act Claim (Count I) and Have Abandoned Their Claim That Facebook Is an ECS Provider Under the SCA (Count II). .......................................................... 2 B. 8 Plaintiffs Have Failed to State a Claim for Violation of 18 U.S.C. § 2702(a)(2), Pertaining to RCS Providers, and This Remaining Half of Their SCA Claim Should Also Be Dismissed (Count II). ................................................ 3 9 1. Under the FAC’s allegations, Facebook was not acting as an RCS provider in connection with the alleged disclosures of “communications” at issue.......................................................................... 3 2. The allegedly disclosed “communications” were not carried by or maintained on Facebook “solely for the purpose of providing storage or computer processing services” to Plaintiffs. .............................. 6 3. The alleged disclosures fall within the SCA’s “addressee or intended recipient” exceptions……………………………………...……. 7 5 6 7 10 11 12 13 14 a. To the extent the FAC alleges that the communications at issue are between Plaintiffs and Facebook, any alleged disclosure falls within section 2702(b)(3)’s “addressee or intended recipient” exception.......................................................... 7 b. 15 To the extent the FAC alleges that the communications at issue are between Plaintiffs and advertisers, any alleged disclosure falls within section 2702(b)(1)’s “addressee or intended recipient” exception.......................................................... 9 16 17 18 19 4. 20 C. 23 24 26 III. Plaintiffs Fail to Allege Actual Damages for Breach of Contract (Count VI). ........................................................................................................................ 12 E. 22 The FAC’s Allegations About a “Computer Contaminant” Are Substantively Indistinguishable From the Previously-Dismissed Complaint (Count IV). ............................................................................................................ 11 D. 21 25 The Disclosures Were Not of the “Contents” of “Communications.”……10 Plaintiffs Fail to State a Claim Under Civil Code sections 1572-1573 (Count VII)............................................................................................................ 14 CONCLUSION ................................................................................................................. 15 27 28 COOLEY LLP ATTORNEYS AT LAW SAN FRANCISCO -i- FACEBOOK’S REPLY I/S/O MOTION TO DISMISS FIRST AM. COMPL. CASE NO. 10-CV-02389-JW TABLE OF AUTHORITIES 1 PAGE(S) 2 3 CASES 4 Claridge v. RockYou, Inc., No. 09-cv-6032-PHJ (N.D. Cal. Apr. 11, 2011) ..................................................................... 14 5 6 Crispin v. Christian Audigier, Inc., 717 F. Supp. 2d 965 (C.D. Cal. 2010)....................................................................................... 9 7 Dipaola v. JPMorgan Chase Bank, No. C 11-2605 SI, 2011 WL 3501756 (N.D. Cal. Aug. 10, 2011) ........................................... 2 8 9 Dwyer v. Am. Express Co., 652 N.E.2d 1351 (Ill. App. Ct. 1995) ..................................................................................... 13 10 Dyer v. Nw. Airlines Corps., 334 F. Supp. 2d 1196 (D.N.D. 2004) ...................................................................................... 12 11 12 Engalla v. Permanente Med. Grp., 15 Cal. 4th 951 (1997) ............................................................................................................ 14 13 Flagg v. City of Detroit, 252 F.R.D. 346 (E.D. Mich. 2008) ........................................................................................... 9 14 15 Folgelstrom v. Lamps Plus, Inc., 195 Cal. App. 4th 986 (2011).................................................................................................. 13 16 Gaos v. Google, No. 10-CV-04809-JW (N.D. Cal. Apr. 7, 2011)..................................................................... 15 17 18 19 20 21 22 In re Am. Airlines Inc. Privacy Litig., 370 F. Supp. 2d 552 (N.D. Tex. 2005)...................................................................................... 8 In re Application of the United States of America for an Order Authorizing the Use of a Pen Register and Trap on [xxx] Internet Service Account/User Name [xxxxxx@xxx.com], 396 F. Supp. 2d 45 (D. Mass. 2005)....................................................... 11 In re JetBlue Airways Corp. Privacy Litig., 379 F. Supp. 2d 299 (E.D.N.Y. 2005) .................................................................................... 13 23 In re TFT-LCD (Flat Panel) Antitrust Litig., 586 F. Supp. 2d 1109 (N.D. Cal. 2008) .................................................................................... 2 24 In re Zynga Privacy Litig., No. 10-cv-04680-JW (N.D. Cal. June 15, 2011) .................................................................... 14 25 26 LaCourt v. Specific Media, Inc., No. SACV 10-1256-GW(JCGx), 2011 WL 1661532 (C.D. Cal. Apr. 28, 2011)................... 13 27 Quon v. Arch Wireless Operating Co. Inc., 445 F. Supp. 2d 1116 (C.D. Cal. 2006)..................................................................................... 8 28 COOLEY LLP ATTORNEYS AT LAW SAN FRANCISCO -ii- FACEBOOK’S REPLY I/S/O MOTION TO DISMISS FIRST AM. COMPL. CASE NO. 10-CV-02389-JW 1 TABLE OF AUTHORITIES (CONTINUED) 2 3 4 PAGE(S) Quon v. Arch Wireless Operating Co. Inc., 529 F.3d 892 (9th Cir. 2008)............................................................................................ passim 5 Ruiz v. Gap, Inc., 540 F. Supp. 2d 1121 (N.D. Cal. 2008) .................................................................................. 15 6 Theofel v. Farey-Jones, 341 F.3d 978 (9th Cir. 2003)..................................................................................................... 4 7 8 United States v. Standefer, No. 06-CR-2674-H, 2007 WL 2301760 (S.D. Cal. Aug. 8, 2007) ....................................... 4, 5 9 United States v. Forrester, 512 F.3d 500 (9th Cir. 2008)................................................................................................... 10 10 11 United States v. Johnson, 256 F.3d 895 (9th Cir. 2001)..................................................................................................... 8 12 STATUTES 13 18 U.S.C. § 2510 ......................................................................................................................... 4, 5 14 18 U.S.C. § 2511 ............................................................................................................................. 2 15 18 U.S.C. § 2702 .................................................................................................................... passim 16 18 U.S.C. § 2711 ............................................................................................................................. 4 17 Cal. Civ. Code § 1572 ............................................................................................................... 2, 14 18 Cal. Civ. Code § 1573 ............................................................................................................... 2, 14 19 Cal. Penal Code § 502............................................................................................................... 1, 11 20 OTHER AUTHORITIES 21 D.O.J., Cybercrime & Intellectual Property Division, Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations (3d ed. Sept. 2009), available at http://www.cybercrime.gov/ssmanual/index.html ................................................ 8 22 23 24 25 Orin S. Kerr, A User’s Guide to the Stored Communications Act, and a Legislator’s Guide to Amending It, 72 Geo. Wash. L. Rev. 1208 (2004) ............................................................... 5 S. Rep. No. 99-541 (1986) .......................................................................................................... 4, 5 26 27 28 COOLEY LLP ATTORNEYS AT LAW SAN FRANCISCO -iii- FACEBOOK’S REPLY I/S/O MOTION TO DISMISS FIRST AM. COMPL. CASE NO. 10-CV-02389-JW 1 2 MEMORANDUM OF POINTS AND AUTHORITIES I. INTRODUCTION 3 Plaintiffs’ Opposition only confirms their inability to adequately plead any claim. 4 Plaintiffs’ FAC fails to remedy the deficiencies of the prior Complaint, which this Court 5 dismissed, and the Opposition does nothing to further Plaintiffs’ cause. 6 Plaintiffs have elected not to oppose Facebook’s motion to dismiss the Wiretap Act claim 7 (Count I), and have abandoned their claim that Facebook, acting as an “electronic communication 8 service” provider, violated section 2702(a)(1) of the Stored Communications Act (“SCA”) (Count 9 II). Accordingly, those claims should be dismissed with prejudice. 10 Plaintiffs’ remaining claims fare no better. Plaintiffs now rest their SCA claim 11 exclusively on section 2702(a)(2), asserting that Facebook violated the SCA in its capacity as a 12 “remote computing service” provider (Count II). Even accepting the FAC’s factual allegations as 13 true, they do not plausibly suggest that Facebook was acting as a provider of “computer storage or 14 processing services” when a User clicked on an ad on Facebook and a “referrer header” was 15 transmitted to the advertiser. The FAC also does not support the contention that the allegedly 16 disclosed “communications” were carried or maintained on Facebook “solely for the purpose of 17 providing storage or computer processing services” to Plaintiffs, as required under the statute. 18 Moreover, as this Court held previously, under any reading of the FAC, the statutory “addressee 19 or intended recipient” exception precludes liability because Plaintiffs allege the communications 20 at issue were either between Plaintiffs and Facebook or between Plaintiffs and advertisers. 21 Plaintiffs insist that they have now included “detailed allegations” as to how Facebook 22 introduced computer contaminants in violation of California Penal Code section 502(c)(8) (Count 23 IV). The allegations in the FAC are substantively indistinguishable from the allegations in the 24 previously-dismissed Complaint; the closest Plaintiffs came to a substantive change was the 25 addition of a single sentence parroting the language of the statute. Further, Plaintiffs fail to 26 address Facebook’s arguments regarding various elements of section 502(c)(8), such as whether 27 Plaintiffs’ computers operated differently after the supposed contaminants were introduced. 28 COOLEY LLP ATTORNEYS AT LAW SAN FRANCISCO 1. FACEBOOK’S REPLY I/S/O MOTION TO DISMISS FIRST AM. COMPL. CASE NO. 10-CV-02389-JW 1 As to Plaintiffs’ claim for breach of contract (Count VI), Plaintiffs fail to allege any actual 2 and appreciable damages, a necessary element. Plaintiffs merely rehash the unsupported and 3 previously-rejected allegations of their prior Complaint, and still include no plausible allegation 4 that Facebook gave any personal information to an advertiser, much less that they suffered actual 5 and appreciable damages as a result. Plaintiffs’ attempt to distinguish cases holding similar 6 allegations insufficient falls flat, as does the assertion that a market for individualized data exists. 7 Finally, Plaintiffs’ fraud claim under California Civil Code sections 1572-1573 (Count 8 VII) also fails with Plaintiffs’ inability to allege actual damages. 9 Opposition does not substantively address the FAC’s failure to allege when Plaintiffs clicked on 10 any advertisement, which leaves unanswered the key question whether they did so in the time 11 period during which they allege User IDs or Usernames were sent in referrer headers. 12 II. 13 Moreover, Plaintiffs’ ARGUMENT A. 14 Plaintiffs Do Not Oppose Facebook’s Motion to Dismiss Their Wiretap Act Claim (Count I) and Have Abandoned Their Claim That Facebook Is an ECS Provider Under the SCA (Count II). 15 Facebook moved to dismiss Plaintiffs’ claim under the Wiretap Act, 18 U.S.C. 16 § 2511(3)(a), pursuant to Rule 12(b)(6). (Mot. at 9-10, 14-18.) In their Opposition, Plaintiffs 17 have not opposed this part of Facebook’s motion to dismiss, nor have they otherwise addressed 18 their Wiretap Act claim in any way. Accordingly, Count I of the FAC should be dismissed with 19 prejudice. See In re TFT-LCD (Flat Panel) Antitrust Litig., 586 F. Supp. 2d 1109, 1131 (N.D. 20 Cal. 2008) (dismissing claim without leave to amend where plaintiff’s opposition failed to 21 address the claim or defendant’s motion to dismiss); Dipaola v. JPMorgan Chase Bank, No. C 22 11-2605 SI, 2011 WL 3501756, at *5 (N.D. Cal. Aug. 10, 2011) (same). 23 Facebook also moved to dismiss in its entirety Plaintiffs’ claim under the SCA, 18 U.S.C. 24 § 2702(a)(1)-(2), pursuant to Rule 12(b)(6). (Mot. at 11-17, 18-20.) Count II of the FAC (FAC 25 ¶¶ 68-88) asserts that Facebook violated two sections of the SCA: section 2702(a)(1), which 26 pertains to “electronic communication service” (“ECS”) providers, and section 2702(a)(2), which 27 pertains to “remote computing service” (“RCS”) providers. Plaintiffs have abandoned their claim 28 that Facebook is liable as an ECS provider, and now argue that Facebook was acting as an RCS at COOLEY LLP ATTORNEYS AT LAW SAN FRANCISCO 2. FACEBOOK’S REPLY I/S/O MOTION TO DISMISS FIRST AM. COMPL. CASE NO. 10-CV-02389-JW 1 all relevant times. 2 computing service”); id. at 3 n.1 (same).) Accordingly, their claim under section 2702(a)(1) 3 (FAC ¶¶ 69-79) should be dismissed with prejudice. 4 B. (Opp’n at 3 (stating that “Plaintiffs’ claims concern Facebook’s remote 5 Plaintiffs Have Failed to State a Claim for Violation of 18 U.S.C. § 2702(a)(2), Pertaining to RCS Providers, and This Remaining Half of Their SCA Claim Should Also Be Dismissed (Count II). 6 Plaintiffs’ Opposition makes clear that their SCA claim now rests solely on the allegation 7 that Facebook was acting as an RCS provider and violated section 2702(a)(2) by purportedly 8 divulging the supposed contents of Plaintiffs’ communications.1 (Opp’n at 2-10.) Plaintiffs’ 9 argument mischaracterizes the allegations in their own complaint and misstates the law. 10 1. 11 Under the FAC’s allegations, Facebook was not acting as an RCS provider in connection with the alleged disclosures of “communications” at issue. 12 As Plaintiffs admit, whether Facebook is acting as an ECS provider or an RCS provider 13 for purposes of an SCA claim “depends on the particular service function at issue.” (Opp’n at 3.) 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 COOLEY LLP ATTORNEYS AT LAW SAN FRANCISCO 1 Section 2702(a)(2) provides: (a) Prohibitions.— Except as provided in subsection (b) or (c)— ... (2) a person or entity providing remote computing service to the public shall not knowingly divulge to any person or entity the contents of any communication which is carried or maintained on that service— (A) on behalf of, and received by means of electronic transmission from (or created by means of computer processing of communications received by means of electronic transmission from), a subscriber or customer of such service; (B) solely for the purpose of providing storage or computer processing services to such subscriber or customer, if the provider is not authorized to access the contents of any such communications for purposes of providing any services other than storage or computer processing[.] 18 U.S.C. § 2702(a)(2) (emphases added). Section 2702(b), in turn, provides in part: (b) Exceptions for disclosure of communications.— A provider described in subsection (a) may divulge the contents of a communication— (1) to an addressee or intended recipient of such communication or an agent of such addressee or intended recipient; [or] ... (3) with the lawful consent of the originator or an addressee or intended recipient of such communication, or the subscriber in the case of remote computing service[.] Id. § 2702(b)(1), (3) (emphases added). 3. FACEBOOK’S REPLY I/S/O MOTION TO DISMISS FIRST AM. COMPL. CASE NO. 10-CV-02389-JW 1 When a website “provides to users thereof the ability to send or receive wire or electronic 2 communications,” it is acting as an ECS provider (in which case the SCA prohibits disclosure of 3 the contents of any such communications while in “temporary, intermediate storage” or when 4 stored for “backup protection,” subject to statutory exceptions). 5 Operating Co. Inc., 529 F.3d 892, 900 (9th Cir. 2008) (citing 18 U.S.C. § 2510(15) & (17)), rev’d 6 on other grounds, 130 S. Ct. 2619 (2010) (reviewing Fourth Amendment holding only). In 7 contrast, for a website like Facebook to be considered an RCS provider, it must be “‘provi[ding] 8 to the public [] computer storage or processing services by means of an electronic 9 communications system.’” Id. (quoting 18 U.S.C. § 2711(2)). The FAC fails to allege facts 10 plausibly showing that the alleged disclosure took place while Facebook was acting as a provider 11 of “computer storage or processing services” as those terms are understood under the SCA. Quon v. Arch Wireless 12 The Ninth Circuit has explained that a website provides “storage” services when the 13 website “operates as a virtual filing cabinet.” Id. at 901-02 (citing S. Rep. No. 99-541, at 2-3 14 (1986)). The court noted that instances where “physicians and hospitals maintain medical files in 15 offsite data banks” were examples of “storage” considered by Congress. Id. This interpretation is 16 further supported by case law. See id. at 901 (storing text messages for back-up purposes did not 17 transform provider into “virtual filing cabinet” such that it became RCS rather than ECS); Theofel 18 v. Farey-Jones, 341 F.3d 978, 984-85 (9th Cir. 2003) (service that held e-mails for back-up 19 protection, but not long-term storage, was not an RCS); United States v. Standefer, No. 06-CR- 20 2674-H, 2007 WL 2301760, at *5 (S.D. Cal. Aug. 8, 2007) (transactions on website permitting 21 users to buy and sell gold were not for “storage,” and thus website was not an RCS). Although 22 difficult to ascertain from Plaintiffs’ Opposition, which obscures the FAC’s core factual 23 allegations, the crux of Plaintiffs’ claim is that when a User clicked on an ad on Facebook, a 24 “referrer header” (part of standard web browser functionality) was transmitted to the advertiser. 25 According to the FAC, the referrer header contained a URL that potentially contained the User’s 26 User ID or Username (nickname or alias) and basic information about the type of webpage from 27 which the User was navigating. (FAC ¶¶ 35, 41-43, 74.) Nothing in the FAC’s allegations 28 suggests that the referrer header was disclosed while being held in “storage” by Facebook, or that COOLEY LLP ATTORNEYS AT LAW SAN FRANCISCO 4. FACEBOOK’S REPLY I/S/O MOTION TO DISMISS FIRST AM. COMPL. CASE NO. 10-CV-02389-JW 1 the User could re-access this referrer header on Facebook similar to a “virtual filing cabinet.” 2 Nor do Plaintiffs adequately allege that Facebook was providing “computer processing 3 services” at any time relevant to this case. The Ninth Circuit has explained that when Congress 4 enacted the SCA in 1986, the term “computer processing services” referred to the outsourcing of 5 data to a remote third party for “sophisticated processing.” Quon, 529 F.3d at 902 (citing Orin S. 6 Kerr, A User’s Guide to the Stored Communications Act, and a Legislator’s Guide to Amending 7 It, 72 Geo. Wash. L. Rev. 1208, 1209-13 (2004)). Such services were necessary “before the 8 advent of advanced computer processing programs such as Microsoft Excel,” which now permit 9 companies such as hospitals and banks to process data in-house rather than outsourcing it. Id. 10 This type of complex outsourced processing is not performed by standard websites. In 11 Standefer, the court considered whether an “e-gold” website, which permitted users to buy and 12 sell gold, provided “computer processing services.” See Standefer, 2007 WL 2301760, at *5. 13 The court determined that “processing services” by an RCS refers to outsourcing functions for 14 complex processing, id. (citing S. Rep. 99-541), and held that users of the e-gold website did not 15 “outsource tasks,” but simply used the website to transfer ownership to other users, id. (citing 16 Kerr, 72 Geo. Wash. L. Rev. at 1213-14 (concluding that eBay is not an RCS because it is simply 17 used as a destination to buy and sell items, not to outsource data processing)). Similarly, a 18 request by a Facebook User to connect with an advertiser, by clicking on an ad, and the resulting 19 navigation to the advertiser’s webpage by the User’s browser, have nothing to do with 20 outsourcing data for complex processing. This is standard website/Internet functionality and, if 21 anything, is far more analogous to the “ability to send or receive wire or electronic 22 communications,” the service provided by an ECS provider, see 18 U.S.C. § 2510(15) (defining 23 “electronic communication service”), not an RCS provider. 24 In their Opposition, Plaintiffs now seem to be arguing that because they clicked on third- 25 party ads while they were using Facebook—and Facebook happens to allow Users to store their 26 content—then the “crux” of their SCA claim is based on Facebook’s alleged actions as a provider 27 of “computer storage services.” 28 “pictures, videos, [and] biographical information” that Users can elect to upload to their profile COOLEY LLP ATTORNEYS AT LAW SAN FRANCISCO (See Opp’n at 3-4 (referring to allegations concerning the 5. FACEBOOK’S REPLY I/S/O MOTION TO DISMISS FIRST AM. COMPL. CASE NO. 10-CV-02389-JW 1 pages).) This assertion is unsupported by the FAC.2 Plaintiffs’ theory of liability is premised on 2 Facebook’s alleged transmittal of a URL to third-party advertisers when Plaintiffs clicked on ads. 3 (FAC ¶¶ 35, 38, 41-43.) In Count II itself, Plaintiffs allege that “[w]hen a Facebook user clicks 4 on an advertisement posted on Facebook’s website, the user sends a message to Facebook 5 requesting that Facebook connect the user to the specific advertisement” and that, “[w]hile the 6 user may intend to or think s/he is communicating directly with the advertiser, technically, the 7 user is communicating with Facebook.” (FAC ¶ 74.) Plaintiffs cannot plausibly complain about 8 any alleged wrongful disclosure of information or content held in storage, and indeed have 9 previously disavowed such a claim.3 The FAC does not allege that Facebook was acting as a 10 provider of “computer storage or processing services” in connection with the alleged disclosures. 11 2. 12 The allegedly disclosed “communications” were not carried by or maintained on Facebook “solely for the purpose of providing storage or computer processing services” to Plaintiffs. 13 Plaintiffs’ effort to hold Facebook liable as an RCS also fails because they do not and 14 cannot allege that the “communications” at issue were being “carried or maintained on that 15 service [Facebook] . . . on behalf of a subscriber or customer . . . solely for the purpose of 16 providing storage or computer processing services to such subscriber or customer . . . .” 18 17 U.S.C. § 2702(a)(2) (emphasis added). According to the FAC, the alleged “communications” 18 from Plaintiffs were sent to “request[] that Facebook connect the user to the specific 19 advertisement” (FAC ¶ 74)—in other words, for the purpose of Facebook providing an 20 21 22 23 24 25 26 27 28 COOLEY LLP ATTORNEYS AT LAW SAN FRANCISCO 2 With respect to their original Complaint, Plaintiffs specifically argued that their theory of liability was “not that Facebook disclosed information voluntarily published on User profiles to advertisers.” (Opp’n to Mot. to Dismiss Consol. Class Action Compl. at 16 & n.12 (emphasis added).) 3 At most, the FAC pleads an alternative theory: that if an advertiser hypothetically were to navigate to a User’s profile page (using a User ID or Username obtained from a referrer header) and see certain information there—such as the User’s name, profile picture, or gender—such viewing by the advertiser would somehow constitute an improper disclosure by Facebook under the SCA. (See, e.g., FAC ¶ 83.) To the extent Plaintiffs are resting their SCA claim on such a theory, the claim should be dismissed for four additional reasons. (See Mot. at 18-20.) Plaintiffs have failed to address these arguments in any substantive manner in their Opposition. 6. FACEBOOK’S REPLY I/S/O MOTION TO DISMISS FIRST AM. COMPL. CASE NO. 10-CV-02389-JW 1 “electronic communication service” (e.g., FAC ¶ 69). Thus, Plaintiffs’ section 2702(a)(2) claim 2 should be dismissed with prejudice on this independent ground. 3 4 3. The alleged disclosures fall within the SCA’s “addressee or intended recipient” exceptions. 5 This Court dismissed the SCA claim in the original Complaint because the allegedly 6 disclosed communications fell within the SCA’s “addressee or intended recipient” exceptions to 7 liability. (Dismissal Order at 10.) The Court reasoned that there were two possible ways to view 8 Plaintiffs’ allegations: the communications at issue were sent either to Facebook or to advertisers. 9 The Court held that under either interpretation, Plaintiffs failed to state a claim. (Id.) If the 10 communications were to Facebook, Facebook would not be liable under 18 U.S.C. § 2702(b)(3). 11 (Id. at 10 & n.8.) Alternatively, if the communications were to advertisers, Facebook would not 12 be liable under 18 U.S.C. § 2702(b)(1). (Id. at 9-10.) Plaintiffs’ efforts to avoid the Court’s 13 ruling are unavailing; the SCA claim should again be dismissed, this time with prejudice. 14 15 16 a. To the extent the FAC alleges that the communications at issue are between Plaintiffs and Facebook, any alleged disclosure falls within section 2702(b)(3)’s “addressee or intended recipient” exception. 17 To the extent the FAC is construed as alleging that the purported communications were 18 made to Facebook (as opposed to the advertiser), the exception under section 2702(b)(3) applies, 19 and Facebook, as the “addressee or intended recipient,” cannot be liable for divulging the 20 contents of such communications. Section 2702(b)(3) provides that an RCS provider cannot be 21 liable for divulging the contents of a communication either “with the lawful consent of . . . an 22 addressee or intended recipient of such communication” (Facebook), or “with the lawful consent 23 of . . . the [RCS] subscriber” (here, Plaintiffs). 18 U.S.C. § 2702(b)(3). Plaintiffs insist that the 24 “addressee or intended recipient” exception under section 2702(b)(3) does not apply to RCS 25 providers, and that only the “subscriber” exception applies. (Opp’n at 4-6.) But the interpretation 26 urged by Plaintiffs is contrary to the text of the statute and to Ninth Circuit precedent. 27 Section 2702(b)(3)’s plain language leaves no doubt that RCS providers may invoke any 28 of three consent-based exceptions to liability, including the “addressee or intended recipient” COOLEY LLP ATTORNEYS AT LAW SAN FRANCISCO 7. FACEBOOK’S REPLY I/S/O MOTION TO DISMISS FIRST AM. COMPL. CASE NO. 10-CV-02389-JW 1 exception applicable here. Section 2702(b)(3) provides: “[a] provider described in subsection (a) 2 may divulge the contents of a communication— . . . (3) with the lawful consent of the originator 3 or an addressee or intended recipient of such communication, or the subscriber in the case of 4 remote computing service[.]” Because subsection (a) unambiguously “describe[s]” both RCS and 5 ECS providers, see 18 U.S.C. § 2702(a), section 2702(b)(3)’s “addressee or intended recipient” 6 exception is plainly available to RCS and ECS providers alike. 7 2702(b)(3)’s second clause, creating an additional exception based on consent of “the subscriber 8 in the case of remote computing service,” neither modifies nor restricts the broader preceding 9 clause, and thus leaves intact the “addressee or intended recipient” exception relevant here. Significantly, section 10 Significantly, the Ninth Circuit has already rejected Plaintiffs’ construction of section 11 2702(b)(3), confirming that “both an ECS and RCS can release private information to, or with the 12 lawful consent of, ‘an addressee or intended recipient of such communication,’ [18 U.S.C.] 13 § 2702(b)(1), (b)(3), whereas only an RCS can release such information ‘with the lawful consent 14 of . . . the subscriber.’ Id. § 2702(b)(3).” Quon, 529 F.3d at 900. In Quon, the Ninth Circuit 15 reversed a district court decision that endorsed the statutory construction advanced by Plaintiffs 16 here. See 445 F. Supp. 2d 1116, 1130 (C.D. Cal. 2006), rev’d in part and aff’d in part, 529 F.3d 17 892. In correcting the district court’s error on appeal, the Quon court undertook “a deliberate 18 decision to resolve the issue, [making] that ruling . . . the law of the circuit,” see United States v. 19 Johnson, 256 F.3d 895, 915-16 (9th Cir. 2001) (Kozinski, J., concurring), as opposed to 20 unreasoned dicta, as Plaintiffs contend (Opp’n at 5 n.5). Quon is controlling and dispositive here. 21 Other authorities also recognize that an RCS provider may invoke any of the consent 22 exceptions listed under section 2702(b)(3). See, e.g., In re Am. Airlines Inc. Privacy Litig., 370 F. 23 Supp. 2d 552, 560-61 (N.D. Tex. 2005) (applying “intended recipient” exception without regard 24 to whether the defendant was an RCS or ECS provider, implicitly recognizing irrelevance of 25 provider type to “intended recipient” exception under section 2702(b)(3)) (cited in Dismissal 26 Order at 10 n.8); D.O.J., Cybercrime & Intellectual Prop. Div., Searching and Seizing Computers 27 and Obtaining Electronic Evidence in Criminal Investigations, ch. 3, at 136 (3d ed. Sept. 2009), 28 available at http://www.cybercrime.gov/ssmanual/index.html (“The SCA allows the voluntary COOLEY LLP ATTORNEYS AT LAW SAN FRANCISCO 8. FACEBOOK’S REPLY I/S/O MOTION TO DISMISS FIRST AM. COMPL. CASE NO. 10-CV-02389-JW 1 disclosure of contents when: (1) the disclosure is made to the intended recipient of the 2 communication, with the consent of the sender or intended recipient, to a forwarding address, or 3 pursuant to specified legal process, § 2702(b)(1)-(4); (2) in the case of a remote computing 4 service, the disclosure is made with the consent of a subscriber, § 2702(b)(3) . . . .”). In fact, 5 Plaintiffs’ contention is belied by one of their own cases, which implicitly recognizes that RCS 6 providers may invoke a wider range of consent exceptions than may ECS providers, consistent 7 with Facebook’s position. See Flagg v. City of Detroit, 252 F.R.D. 346, 359 (E.D. Mich. 2008) 8 (“If this service is deemed to be an RCS, then the consent of the ‘subscriber’ is sufficient . . . . In 9 contrast, if a service is determined to be an ECS, then only the ‘lawful consent of the originator or 10 an addressee or intended recipient’ of a communication will suffice[.]” (citing 18 U.S.C. 11 § 2702(b)(3) (emphasis added)) (cited in Opp’n at 5). 12 Finally, Plaintiffs find little support in Crispin v. Christian Audigier, Inc., 717 F. Supp. 13 2d 965 (C.D. Cal. 2010), which offers only the conclusory, footnoted dictum of a court from 14 another district. See id. at 973 n.17 (cited in Opp’n at 5). That case provides no reason to depart 15 from the weight of authorities, including the Ninth Circuit’s controlling decision in Quon, or the 16 clear text of the statute, and the Court should not do so here.4 17 b. 18 19 To the extent the FAC alleges that the communications at issue are between Plaintiffs and advertisers, any alleged disclosure falls within section 2702(b)(1)’s “addressee or intended recipient” exception. 20 Consistent with this Court’s Order dismissing the SCA claim in the original Complaint, 21 Facebook again argued that to the extent the FAC is read to allege that the communications at 22 issue were sent by Plaintiffs to advertisers, rather than by Plaintiffs to Facebook, Facebook cannot 23 be liable for divulging those communications under section 2702(b)(1)’s “addressee or intended 24 4 25 26 27 28 COOLEY LLP ATTORNEYS AT LAW SAN FRANCISCO Plaintiffs argue that such an interpretation of section 2702(b)(3) would mean that “all of the SCA’s protections against unauthorized disclosure of communications would be eviscerated, and any RCS provider would be exonerated from any and all of its disclosures.” (Opp’n at 6-7.) Not so. In the course of providing computer storage or processing services, an RCS provider may come into possession of communications of which it is not the addressee or intended recipient. Just because the RCS provider had been provided with those communications by the subscriber, section 2702(b)(3) would not grant carte blanche immunity from liability for divulging them. 9. FACEBOOK’S REPLY I/S/O MOTION TO DISMISS FIRST AM. COMPL. CASE NO. 10-CV-02389-JW 1 recipient” exception. (Mot. at 9, 11-12.) Plaintiffs have not addressed this argument in their 2 Opposition, thus conceding that the SCA claim must be dismissed to the extent it is based on the 3 theory that the allegedly-disclosed communications were between Plaintiffs and advertisers. 4 4. The Disclosures Were Not of the “Contents” of “Communications.” 5 Plaintiffs do not challenge the substance of Facebook’s argument that User IDs or 6 Usernames are customer records under the SCA, not the “contents” of “communications,” thereby 7 conceding that Facebook’s position is correct. (See Opp’n at 8.) Plaintiffs instead argue that 8 when a User clicked on an ad, a “referrer URL” (or “referrer header”) was transmitted to an 9 advertiser that contained the Internet address of the webpage from which the User was navigating 10 along with the User’s User ID or Username, and that this transmitted referrer URL disclosed the 11 “contents of a communication.” (Opp’n at 8-10; see also FAC ¶¶ 35, 41-43.) As discussed in 12 Facebook’s Motion, a referrer URL is not a “communication” within the intended scope of the 13 SCA, and, even if it were a communication, the alleged disclosure is not of the “contents” of any 14 such communication. (Mot. at 14-17 (citing authorities).) 15 Plaintiffs assert that United States v. Forrester, 512 F.3d 500 (9th Cir. 2008), supports 16 their position that transmission of URLs constitutes disclosures of the contents of 17 communications. That decision did not hold that URLs are “communications” as that term is 18 defined under the SCA, but instead refers to URLs as “internet activity.” Id. at 510 n.6. The case 19 was looking not at the SCA or any other provision of the Electronic Communications Privacy Act 20 (“ECPA”), but at surveillance generally in the broader context of the Fourth Amendment. Id. 21 (analyzing the constitutionality of “surveillance techniques” employed by the government). 22 Unlike the SCA, the Fourth Amendment prohibits a variety of government surveillance 23 techniques, whether they involve communications or merely activities (like Internet usage). 24 Thus, while government surveillance of Internet activity may raise constitutional questions under 25 the Fourth Amendment, thereby inviting analysis in the Forrester opinion, Forrester does not 26 hold that URLs are the “contents” of “communications” as those terms are used in the SCA. 27 Moreover, the decision merely noted in dicta relegated to a footnote that surveillance of URLs 28 “might be more constitutionally problematic” for Fourth Amendment purposes, 512 F.3d at 504 COOLEY LLP ATTORNEYS AT LAW SAN FRANCISCO 10. FACEBOOK’S REPLY I/S/O MOTION TO DISMISS FIRST AM. COMPL. CASE NO. 10-CV-02389-JW 1 (emphasis added), not that disclosures of URLs via the standard operation of Internet browsers 2 could or would reveal the “contents” of “communications” for purposes of the SCA. The case 3 cited by the Forrester court, In re Application of the United States of America for an Order 4 Authorizing the Use of a Pen Register and Trap on [xxx] Internet Service Account/User Name 5 [xxxxxx@xxx.com], 396 F. Supp. 2d 45, 48 (D. Mass. 2005), considered portions of the ECPA but 6 did not hold that disclosure of a URL reveals the contents of communications. Rather, the court 7 remarked that URLs that contained unique search terms provided by the user would constitute 8 the contents of communications. See id. at 49. Thus, neither case supports Plaintiffs’ argument 9 that the referrer URLs alleged here disclosed the “contents” of “communications” under the SCA. 10 11 C. The FAC’s Allegations About a “Computer Contaminant” Are Substantively Indistinguishable From the Previously-Dismissed Complaint (Count IV). 12 In response to Facebook’s Motion to Dismiss (Mot. at 20-22), Plaintiffs insist that they 13 have now included “detailed allegations” as to how Facebook supposedly introduced computer 14 contaminants in violation California Penal Code section 502(c)(8), pointing to paragraphs 3, 33- 15 44, and 104 of the FAC. In fact, these paragraphs simply rehash the allegations of the previous 16 complaint—already rejected by this Court—with somewhat different syntax and synonyms, and 17 by changing the position of paragraphs and inserting the text of the statute. (Compare, e.g., 18 Plaintiffs’ Consolidated Class Action Complaint (“Compl.”) ¶ 3 with FAC ¶ 3 (changing “in 19 violation of” to “in clear contrast to”); Compl. ¶ 35 with FAC ¶ 42 (changing “site” in “company” 20 and “releasing” in “disclosing”); Compl. ¶ 32 with FAC ¶ 44 (repositioning the unaltered 21 paragraph); see also FAC ¶ 104 (parroting the statute by stating that Facebook “usurped the 22 normal operations of the relevant computers”).) 23 decreased the detail of their allegations. (Compare Compl. ¶ 28 (stating “[t]hrough the design of 24 the Facebook website, Facebook’s page addresses, and Facebook advertisement system Facebook 25 has caused users’ browsers to send Referrer Header transmissions that report the user ID or 26 username of the user who clicked an ad, as well as the page the user was viewing just prior to 27 clicking on the ad”), with FAC ¶ 35 (stating “[t]hrough the design of its system, Facebook sends 28 Referrer Headers containing UIDs and the usernames to advertisers”); Compl. ¶¶ 29, 31 with COOLEY LLP ATTORNEYS AT LAW SAN FRANCISCO 11. In some instances Plaintiffs have actually FACEBOOK’S REPLY I/S/O MOTION TO DISMISS FIRST AM. COMPL. CASE NO. 10-CV-02389-JW 1 FAC ¶¶ 36, 38 (deleting detail).) The “new” allegations are substantively indistinguishable from 2 those in the original complaint dismissed by the Court. 3 In addition, Plaintiffs do not address Facebook’s argument that the FAC fails to allege 4 how their computers operated differently or whether the alleged instructions were actually 5 introduced onto their computers, systems, or networks. (Mot. at 21; see also Dismissal Order at 6 13 n.11 (dismissing section 502(c)(8) claim because Plaintiffs failed to “allege any facts 7 suggesting that Defendant introduced computer instructions designed to ‘usurp the normal 8 operation’ of a computer . . .”).) They also fail to explain how a “standard web browser function” 9 (FAC ¶ 41), even if it has unintended consequences, is analogous to a virus or worm, or should 10 result in liability under the Penal Code. 11 D. 12 As this Court has recognized, under California law, a breach of contract claim requires a 13 showing of “appreciable and actual damage.” (Dismissal Order at 15 (citing authority).) But 14 Plaintiffs simply reiterate their prior Complaint’s unsupported—and already-rejected— 15 allegations, that they suffered damage because Facebook wrongfully shared their information 16 (which Plaintiffs term “PII”)5 with advertisers. (FAC ¶ 122.) Plaintiffs still include no plausible 17 allegation that Facebook gave any personal information to advertisers, much less that they 18 suffered actual and appreciable damages as a result of such alleged disclosures. Plaintiffs Fail to Allege Actual Damages for Breach of Contract (Count VI). 19 Multiple courts have held that conclusory allegations of injury based on disclosure of 20 personal information do not constitute actionable damages for a breach of contract claim. See, 21 e.g., Dyer v. Nw. Airlines Corps., 334 F. Supp. 2d 1196, 1200 (D.N.D. 2004) (dismissing breach 22 of contract claim premised on “conclusory statements” of damage from disclosure of personal 23 24 25 26 27 28 COOLEY LLP ATTORNEYS AT LAW SAN FRANCISCO 5 Although Plaintiffs apparently refer to all information as “PII,” the only information allegedly disclosed by Facebook was the referrer headers transmitted when Users clicked on ads (FAC ¶¶ 35, 41-43). As explained in Facebook’s Motion (Mot. at 3-4), the User ID is a generic numerical identifier that Facebook assigns to each User for internal operational purposes. And Facebook Usernames are optional terms (e.g., nicknames, initials, or other phrases or terms of the Users’ choosing) that some—but not all—Users choose to create. Neither of these pieces of information could plausibly be alleged to have “value” to Plaintiffs or to have been diminished by their alleged inclusion in referrer headers transmitted by Users’ browsers to advertisers. 12. FACEBOOK’S REPLY I/S/O MOTION TO DISMISS FIRST AM. COMPL. CASE NO. 10-CV-02389-JW 1 information). Courts also have recognized that even if certain information can be valuable in the 2 aggregate, that value implies nothing about the existence of an individualized market for that 3 information. See, e.g., Folgelstrom v. Lamps Plus, Inc., 195 Cal. App. 4th 986, 994 (2011) 4 (plaintiff failed to “allege that he suffered an economic injury” where defendant aggregated and 5 sold consumers’ address information); Dwyer v. Am. Express Co., 652 N.E.2d 1351, 1356 (Ill. 6 App. Ct. 1995) (cardholder name has little or no intrinsic value; instead, “[d]efendants create 7 value by categorizing and aggregating” these names); see also LaCourt v. Specific Media, Inc., 8 No. SACV 10-1256-GW(JCGx), 2011 WL 1661532, at *2, *4-5 (C.D. Cal. Apr. 28, 2011) (no 9 evidence of “value-for-value exchange,” and even assuming one, “Plaintiffs do not explain how 10 they were ‘deprived’ of the economic value of their personal information”). 11 Plaintiffs attempt to distinguish cases like In re JetBlue Airways Corp. Privacy Litigation, 12 379 F. Supp. 2d 299 (E.D.N.Y. 2005) (“JetBlue”), as not “involv[ing] a contract where personal 13 information itself was the benefit of the bargain sought by the defendant.” (Opp’n at 14.) But 14 Plaintiffs both confuse the pertinent facts and mischaracterize the case law. In JetBlue the 15 transfer and protection of the personal information was part of the parties’ bargain—but, as here, 16 there was no reasonable expectation that that personal information would be held to have a 17 “value” for which plaintiffs would be compensated. The JetBlue court noted plaintiffs might 18 have expected a ticket and a promise to protect their personal information “in return for providing 19 their personal information to JetBlue and paying the purchase price,” but “had no reason to 20 expect that they would be compensated for the ‘value’ of their personal information.” JetBlue, 21 379 F. Supp. 2d at 327 (emphasis added). Indeed, it “strains credulity” to believe that the buyer 22 would have purchased the information from each individual passenger. 23 Plaintiffs’ argument is less persuasive than that of the JetBlue plaintiffs, because unlike in 24 JetBlue, Plaintiffs here paid no money whatsoever to Facebook. They are instead left to argue, 25 without support, that both (1) the information they provided in order to register for Facebook, and 26 (2) the information that was allegedly disclosed, must be equivalent to currency. They are not.6 27 28 COOLEY LLP ATTORNEYS AT LAW SAN FRANCISCO Id. If anything, 6 Plaintiffs themselves were unable to locate any available market for their Facebook UIDs or Usernames, so they misrepresent four different sources in an attempt to create the illusion of such 13. FACEBOOK’S REPLY I/S/O MOTION TO DISMISS FIRST AM. COMPL. CASE NO. 10-CV-02389-JW 1 Plaintiffs lean heavily on the recent decision in Claridge v. RockYou, Inc., No. 09-cv- 2 6032-PHJ, Dkt. 47 (N.D. Cal. Apr. 11, 2011), in which plaintiff alleged that defendant failed to 3 safeguard his email addresses and passwords, which were subsequently stolen by hackers. Id. at 4 2-3. The Claridge court acknowledged that plaintiff’s damages theory was “novel” and lacked 5 supporting case law, and expressed “doubts about plaintiff’s ultimate ability to prove his damages 6 theory.” Id. at 7. The court declined, at that stage, to hold as a matter of law that plaintiff lacked 7 Article III standing, but noted that should it become apparent “that no basis exists upon which 8 plaintiff could legally demonstrate tangible harm,” plaintiff’s claims would be dismissed on a 9 later dispositive motion. Id. When it came time to analyze the damages element of plaintiff’s 10 breach of contract claim, the court apparently relied on the court’s earlier Article III reasoning, 11 stating that plaintiff “sufficiently alleged a general basis for harm by alleging . . . [loss of] some 12 ascertainable but unidentified ‘value’ and/or property right.” Id. at 13. Claridge does not provide 13 persuasive authority for allowing Plaintiffs’ contract claim to proceed here, particularly in light of 14 the FAC’s lack of any plausible factual allegations that the named Plaintiffs suffered any loss of 15 ascertainable value or property right as a result of the alleged disclosure of referrer URLs to 16 advertisers. This Court has already implicitly rejected other plaintiffs’ reliance on Claridge in 17 support of the argument Plaintiffs make here. See In re Zynga Privacy Litig., No. 10-cv-04680- 18 JW, Dkt. 64 (N.D. Cal. June 15, 2011) (plaintiffs had not properly alleged damages on their 19 breach of contract claim, despite having raised Claridge in their opposition (Dkt. 53, at 31)). 20 21 22 23 24 25 26 27 28 COOLEY LLP ATTORNEYS AT LAW SAN FRANCISCO E. Plaintiffs Fail to State a Claim Under Civil Code sections 1572-1573 (Count VII). As discussed above and in Facebook’s Motion, Plaintiffs again fail to allege that they suffered damages—a necessary element of any fraud claim. See Engalla v. Permanente Med. a market. (FAC ¶¶ 22-23 (cited in Opp’n at 15).) For instance, Plaintiffs cite a 2010 article about a start-up company trying to create an individual market for personal data as support for their allegation that “[t]his business model—providing online services to consumers and profiting from selling access to their PII to third-parties—has burgeoned into a multi-billion dollar per year industry” (Id. ¶ 22), but fail to inform the Court that the company in question did not even have a business model at the time of the article, and that, in fact, it folded less than six months later. Nor do Plaintiffs’ other articles indicate in any way that a market exists for their UIDs or Usernames. 14. FACEBOOK’S REPLY I/S/O MOTION TO DISMISS FIRST AM. COMPL. CASE NO. 10-CV-02389-JW 1 Grp., 15 Cal. 4th 951, 974 (1997). Disclosure of personal information is not a loss of property 2 under California law. See, e.g., Ruiz v. Gap, Inc., 540 F. Supp. 2d 1121, 1128 (N.D. Cal. 2008). 3 Nor have Plaintiffs articulated any other grounds supporting damages. For this reason alone, the 4 fraud claim should be dismissed. 5 Further, Plaintiffs’ allegations do not satisfy the heightened Rule 9(b) pleading standard. 6 (Mot. at 23-25.) One critical way the FAC falls short is its failure to allege any specific facts 7 about advertisements displayed on Facebook that Plaintiffs allegedly clicked on. Plaintiffs claim 8 that such facts are “irrelevant,” mischaracterizing Facebook’s argument as a “distort[ion]” of Rule 9 9(b) rather than addressing the substance of the argument. (Opp’n at 17.) The FAC’s failure to 10 allege when Plaintiffs clicked on any advertisement leaves unanswered the key question whether 11 they did so in the time period during which they allege User IDs or Usernames were sent in 12 referrer headers. Thus, the FAC offers no support for the claim that Plaintiffs relied on the 13 alleged misrepresentations to their detriment, or that they suffered any harm. For this very 14 reason, this Court recently dismissed claims against Google related to alleged disclosure of 15 personal information in referrer headers. See Gaos v. Google, No. 10-CV-04809-JW, at *5 (N.D. 16 Cal. Apr. 7, 2011) (plaintiff lacked Article III standing because she “failed to plead that she 17 clicked on a link from the Google search page during the same time period that Defendant 18 allegedly released search terms via referrer headers”). 19 III. 20 21 CONCLUSION For the foregoing reasons, Plaintiffs fail to state a claim as a matter of law, and the First Amended Consolidated Class Action Complaint should be dismissed with prejudice. 22 23 Dated: September 1, 2011 24 COOLEY LLP /s/ Matthew D. Brown ___________________________________ Matthew D. Brown (196972) Attorneys for Defendant FACEBOOK, INC. 25 26 27 722340 /SD 28 COOLEY LLP ATTORNEYS AT LAW SAN FRANCISCO 15. FACEBOOK’S REPLY I/S/O MOTION TO DISMISS FIRST AM. COMPL. CASE NO. 10-CV-02389-JW

Disclaimer: Justia Dockets & Filings provides public litigation records from the federal appellate and district courts. These filings and docket sheets should not be considered findings of fact or liability, nor do they necessarily reflect the view of Justia.


Why Is My Information Online?