In re Google Referrer Header Privacy Litigation

Filing 22

RESPONSE (re #19 MOTION to Dismiss Plaintiff's Complaint Pursuant to Rules 12(b)(1) and 12(b)(6) MOTION to Dismiss Plaintiff's Complaint Pursuant to Rules 12(b)(1) and 12(b)(6) ) filed byPaloma Gaos. (Nassiri, Kassra) (Filed on 3/21/2011)

KASSRA P. NASSIRI (215405) 1 ([e-mail]) CHARLES H. JUNG (217909) 2 ([e-mail]) NASSIRI & JUNG LLP 3 47 Kearny Street, Suite 700 San Francisco, California 94108 4 Telephone: [phone] Facsimile: [phone] 5 EDELSON MCGUIRE LLC 6 MICHAEL J. ASCHENBRENER ([e-mail]) (pro hac vice) 7 BRADLEY M. BAGLIEN ([e-mail]) (pro hac vice) 8 CHRISTOPHER L. DORE ([e-mail]) (pro hac vice) 9 350 North LaSalle Street, Suite 1300 Chicago, Illinois 60654 10 Telephone: [phone] Facsimile: [phone] 11 12 Attorneys for Plaintiff and the Putative Class 13 14 NORTHERN DISTRICT OF CALIFORNIA 15 SAN JOSE DIVISION 16 17 PALOMA GAOS, an individual, on behalf of 18 herself and all others similarly situated, 19 20 v. PLAINTIFF'S OPPOSITION TO GOOGLE'S MOTION TO DISMISS PURSUANT TO RULES 12(b)(1) AND 12(b)(6) Hearing Date: April 11, 2011 Time: 9:00 a.m. Place: Courtroom 8, 4th Floor Judge: Hon. James Ware Plaintiff, Case No. 5:10-cv-04809-JW CLASS ACTION UNITED STATES DISTRICT COURT

21 GOOGLE INC., a Delaware Corporation, 22 23 24 25 26 27 28 Defendant.

PL.'S OPP'N TO GOOGLE'S MOT. TO DISMISS 5:10-CV-04809

1 2 TABLE OF CONTENTS

3 I. INTRODUCTION ...................................................................................................................... 1 II. STATEMENT OF FACTS ........................................................................................................ 2 4 III. LEGAL STANDARD .............................................................................................................. 4 5 IV. ARGUMENT ........................................................................................................................... 5 A. Google's Motion to Dismiss Under Rule 12(b)(1) Should Be Denied Because Plaintiff has 6 Satisfied Article III Standing Requirements for Both Her Stored Communications Act Claim and Her State Law Claims. ............................................................................................................ 5 7 1. Plaintiff Has Article III Standing to Assert Her Stored Communications Act Claim 8 Because Google's Invasion of Plaintiff's Statutory Rights Creates Standing. ......................... 6 2. Plaintiff Has Alleged Actual Harm Sufficient to Satisfy the Standing Requirements for 9 Her State Law Claims. .............................................................................................................. 8 10 B. Plaintiff's State Law Claims Are Not Preempted by the Stored Communications Act. ...... 11 11 12 13 E. Plaintiff has Adequately Alleged a Claim for Unjust Enrichment. ...................................... 19 14 V. CONCLUSION ....................................................................................................................... 20 15 16 17 18 19 20 21 22 23 24 25 26 27 28
i PL.'S OPP'N TO GOOGLE'S MOT. TO DISMISS 5:10-CV-04809

C. Plaintiff Has Stated a Claim for Actual Fraud Under Cal. Civil Code § 1572. ................... 14 D. Plaintiff Has Alleged Sufficient Facts to Support Her Claim for Public Disclosure of Private Facts Because Google Disclosed Her Private Search Queries........................................ 17

1

TABLE OF AUTHORITIES

2 CASES 3 Aqua-Lung America, Inc. v. American Underwater Products, Inc., 709 F. Supp. 2d 773 (N.D. Cal. 2010).................................................................................................................................... 14 4 Ashcroft v. Iqbal, 129 S. Ct. 1937 (2009) ......................................................................................... 4 5 Baur v. Veneman, 352 F.3d 625 (2d Cir. 2003) ................................................................................ 9 6 Beneficial Nat. Bank v. Anderson, 539 U.S. 1, (2003) .................................................................... 11 7 California v. Levi Strauss & Co., 41 Cal. 3d 460 (1986) ................................................................ 20 8 Cassirer v. Kingdom of Spain, 580 F.3d 1048 (9th Cir. 2009) ......................................................... 4 9 Central Delta Water Agency v. U.S., 306 F.3d 938 (9th Cir. 2002) ................................................. 8 10 Concha v. London, 62 F.3d 1493 (9th Cir. 1995) ........................................................................... 15 11 County of San Bernardino v. Wash, 158 Cal. App. 4th 533 (2008) ................................................ 20 12 Covington v. Jefferson County, 358 F.3d 626 (9th Cir. 2004) .......................................................... 9 13 Doe 1 v. AOL, LLC, 719 F. Supp. 2d 1102 (N.D. Cal. 2010) ................................................... 10, 15 14 Doe v. Veterans Admin., 474 F. Supp. 2d 1100 (D. Minn. 2007) ..................................................... 9 15 Edwards v. First American Corp., 610 F.3d 514 (9th Cir. 2010) ..................................................... 6 16 Friends of the Earth v. Gaston Copper Recycling Corp., 204 F.3d 149 (4th Cir. 2000) .................. 9 17 Friends of the Earth v. Laidlaw Envt'l Servs., Inc., 528 U.S. 167 (2000) ........................................ 9 18 Fulfillment Services Inc. v. United Parcel Serv., Inc., 528 F.3d 614 (9th Cir. 2008) ....................... 6 19 Gerlinger v. Amazon.Com, Inc., 311 F. Supp. 2d 838 (N.D. Cal. 2004) ........................................ 19 20 Gonzales v. Google, 234 F.R.D. 674 (N.D. Cal. 2006) ................................................................. 1, 3 21 Hale v. Sharp Healthcare, 183 Cal. App. 4th 1373 (2010)............................................................. 16 22 Hepting v. AT&T Corp., 439 F. Supp. 2d 974 (N.D. Cal. 2006)................................................... 7, 8 23 Hirsch v. Bank of America, 107 Cal. App. 4th 708 (2003) ............................................................. 19 24 Hoang v. Reunion.com, Inc., No. C-08-3518 MMC, 2010 WL 1340535 (N.D. Cal. Mar. 31, 2010) 25 ............................................................................................................................................... 6 26 Ileto v. Glock Inc., 349 F.3d 1191 (9th Cir. 2003) ............................................................................ 4 27 In re American Airlines, Inc. Privacy Litig., 370 F. Supp. 2d 552 (N.D. Tex. 2005) ..................... 17 28
ii PL.'S OPP'N TO GOOGLE'S MOT. TO DISMISS 5:10-CV-04809

1 2 3

In re Carter, 553 F.3d 979 (6th Cir. 2009) ....................................................................................... 6 In re JetBlue Airways Corp. Privacy Litig., 379 F. Supp. 2d 299 (E.D.N.Y. 2005) ....................... 17 In re National Security Agency Telecommunications Records Litig., 633 F.Supp.2d 892 (N.D. Cal. 2007).................................................................................................................................... 11

4 In re Tobacco II Cases, 46 Cal. 4th 298, 327 (2009) ................................................................ 15, 16 5 Jenson v. Fiserve Trust Co., 256 Fed. Appx. 924 (9th Cir. 2007) .................................................. 16 6 Kearney v. Salomon Smith Barney, Inc., 45 Cal. Rptr. 3d 730 (2006) ........................................... 12 7 Krottner v. Starbucks Corp., 628 F.3d 1139 (9th Cir. 2010) ............................................................ 9 8 Lujan v. Defenders of Wildlife, 504 U.S. 555 (1992) .................................................................... 8, 9 9 Meyer v. Christie, No. 07-2230, 2007 WL 3120695, (D. Kan. Oct. 24, 2007)............................... 17 10 Mirkin v. Wasserman, 5 Cal. 4th 1082 (1993) ................................................................................ 16 11 Moreno v. Hanford Sentinel, Inc., 172 Cal. App. 4th 1125 (2009) ................................................. 18 12 Navarra v. Bache Halsey Stuart Shields, Inc., 510 F. Supp. 831 (E.D. Mich. 1981) ..................... 12 13 People v. Conklin, 12 Cal. 3d 259 (1974) ....................................................................................... 12 14 Peterson v. Cellco Partnership, 164 Cal. App. 4th 1583 (2008) .................................................... 19 15 Pisciotta v. Old Nat'l Bancorp, 499 F.3d 629 (7th Cir. 2007) .......................................................... 9 16 Sanders v. American Broadcasting Companies, 20 Cal. 4th 907 (1999) ........................................ 18 17 Sisley v. Sprint Communications Co., 284 Fed. Appx. 463 (9th Cir. 2008) ..................................... 6 18 Smith v. Trusted Universal Standards in Electronic Transactions, Inc., No. 09-4567, 2010 WL 1799456 (D.N.J. May 4, 2010)............................................................................................ 17 19 Summers v. Earth Island Inst., 129 S. Ct. 1142 (2009) ..................................................................... 9 20 Taus v. Loftus, 40 Cal. 4th 683 (2007) ............................................................................................ 18 21 Theofel v. Farley-Jones, 359 F.3d 1066 (9th Cir. 2004) ................................................................. 14 22 United States v. Kennedy, 81 F. Supp. 2d 1103 (D. Kan. 2000) ..................................................... 14 23 United States v. Sherr, 400 F. Supp. 2d 843 (D. Md. 2005) ........................................................... 14 24 Villager Franchise Sys. V. Dhami, Dhami & Virk, CF-F-04-6393, 2006 WL 22425 (E.D. Cal. Jan. 25 26, 2006).............................................................................................................................. 19 26 Ward v. Taggart, 51 Cal. 2d 736 (1959) ......................................................................................... 20 27 Warth v. Seldin, 422 U.S. 490 (1975) ........................................................................................... 6, 7 28
iii PL.'S OPP'N TO GOOGLE'S MOT. TO DISMISS 5:10-CV-04809

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17

Whitaker v. Garcetti, 291 F. Supp. 2d 1132 (C.D. Cal. 2003) ........................................................ 12 STATUTES AND RULES 18 United States Code § 1030 ......................................................................................................... 14 18 United States Code § 2511 ......................................................................................................... 12 18 United States Code § 2512 ......................................................................................................... 12 18 United States Code § 2515 ......................................................................................................... 12 18 United States Code § 2518 ................................................................................................... 12, 13 18 United States Code § 2520 ......................................................................................................... 12 18 United States Code § 2703 ......................................................................................................... 12 18 United States Code § 2708 ............................................................................................. 12, 13, 14 18 United States Code § 2710 ......................................................................................................... 12 47 United States Code § 222 ........................................................................................................... 14 California Civil Code § 1572 ................................................................................................ 5, 14, 17 Federal Rule of Civil Procedure 12 ................................................................................... 5, 6, 10, 20 Federal Rule of Civil Procedure 8 ..................................................................................................... 4 Federal Rule of Civil Procedure 9 ................................................................................................... 15

LEGISLATIVE HISTORY 18 House of Representatives Report No. 99-647 (1986) ............................................................... 12, 13 19 Senate Report NO 100-599 (1988).................................................................................................. 12 20 Senate Report No. 90-1097 (1968) ................................................................................................. 12 21 Senate Report No. 99-541 ................................................................................................... 12, 13, 14 22 23 24 25 26 27 28
iv PL.'S OPP'N TO GOOGLE'S MOT. TO DISMISS 5:10-CV-04809

1 I. 2

INTRODUCTION In 2006, before this very Court, defendant Google unequivocally insisted that any

3 disclosure--even anonymized--of its users' search queries would raise serious privacy concerns.1 4 Now, in a complete about-face from its previous assertions, Google argues that its systematic, 5 routine and unmitigated disclosure of billions of search queries to third parties presents no risk of 6 harm to its users' privacy. Google cannot have it both ways. If this practice raised privacy 7 concerns in 2006, then its practice raises privacy concerns today. 8 In fact, the concerns recognized by this Court (and Google) in 2006 are amplified here.

9 Google's persistent disclosure of search queries to third parties is bundled with additional 10 information that identifies individual users, including user IP addresses and cookie information. 11 And unlike in 2006, there now exists a robust market for this consumer data. Sophisticated data 12 brokers, using relatively new computer science techniques, aggregate data from various sources to 13 combine seemingly "anonymous" data and connect it with specific individuals. The resulting 14 consumer profiles are then sold and resold to countless third parties. This is the very privacy harm 15 that Google has repeatedly warned of. 16 Plaintiff alleges that Google's practices extend beyond mere privacy concerns and rise to a

17 violation of the federal Stored Communications Act ("SCA"), as well as constituting unjust 18 enrichment, California statutory fraud, and public disclosure of private facts. 19 Google attempts to defeat Plaintiff's claim under the SCA by arguing that the Court lacks

20 subject matter jurisdiction under Rule 12(b)(1) because Plaintiff lacks standing. Specifically, 21 Google argues that Plaintiff has not suffered an injury in fact. But as Plaintiff demonstrates, she 22 has suffered an injury in fact sufficient to confer standing under Article III and to defeat Google's 23 Rule 12(b)(1) motion. 24 Google also offers the same Rule 12(b)(1) argument against Plaintiff's claims for unjust

25 enrichment, statutory fraud, and public disclosure of private facts. Just as with her SCA claim, 26 27 28
1

Gonzales v. Google, 234 F.R.D. 674 (N.D. Cal. 2006)(Case No. 5:06-mc-80006-JW).
1 PL.'S OPP'N TO GOOGLE'S MOT. TO DISMISS 5:10-CV-04809

1 Google's argument fails because Plaintiff pled facts sufficient to demonstrate that she has suffered 2 an injury in fact sufficient to satisfy Article III's standing requirement. 3 Additionally, Google argues that the SCA preempts Plaintiff's state law claims. In doing

4 so, Google completely misses the mark as it relates to the SCA's preemption clause, which only 5 concerns the exclusionary rule in criminal cases. The SCA does not preempt any of Plaintiff's 6 claims. 7 Finally, Google challenges Plaintiff's state law claims only under Rule 12(b)(6) for failure

8 to state a claim upon which relief can be granted. However, Plaintiff has pled sufficient facts to 9 sustain her state law claims for relief, which Plaintiff will demonstrate herein. 10 II. 11 STATEMENT OF FACTS Google is the largest search engine in the United States, with a domestic market share of

12 over 50%. (Complaint ("Compl.") ¶¶ 1, 13.) Google earns substantial revenues from advertising 13 programs and exploits its knowledge of its users' search preferences to increase these revenues. 14 (Id. ¶¶ 15-16.) 15 Since Google launched its search service, Google has systematically transmitted user

16 search queries to third parties. (Id. ¶¶ 37-39.) Each time a user runs a search on Google's search 17 engine, Google matches the query with relevant websites and returns a search results page with 18 matching websites to the user. (Id. ¶ 12.) By deliberate design, the URL of the search results page 19 includes the entire search query that was entered by the user. (Id. ¶ 37.) In turn, when a user 20 clicks on a link on the search results page, the users' web browser reports the entire URL of the 21 search results page, including all of the search terms entered by the user, to the owner of the 22 destination website. (Id. ¶ 35.) Google has demonstrated that it could easily cease transmission of 23 user search queries to third parties, but has chosen not to do so. (Id. ¶ 41.) 24 Google discloses user search queries for one reason: to aid search engine optimization

25 ("SEO") companies in understanding Google search algorithms. (Id. ¶ 40.) SEOs help businesses 26 design and market their websites so that their businesses are more likely to appear at the top of 27 users' search result pages. (Id. ¶ 16.) To the extent that SEOs assist in getting relevant websites 28
2 PL.'S OPP'N TO GOOGLE'S MOT. TO DISMISS 5:10-CV-04809

1 to the top of Google search results pages, users are more likely to return to Google and Google is 2 able to derive more revenue from its advertising business. (Id.) 3 Google has repeatedly emphasized that search queries contain sensitive, personal

4 information. In 2006, in a case before this very Court, the DOJ sought to compel Google to 5 produce "anonymized" search query data. (Id. ¶ 25; Gonzales v. Google, 234 F.R.D. 674 (N.D. 6 Cal. 2006) (Case No. 5:06-mc-80006-JW).) Google fought the DOJ's request, arguing that 7 disclosing search queries--even anonymized--would raise serious privacy concerns. (Id. ¶¶ 268 27.) Google's opposition to the subpoena was unambiguous: 9 10 11 12 13 14 15 "Google does not publicly disclose the searches [sic] queries entered into its search engine." (Id.) "[User concern about disclosure of search queries] is no minor fear because search query content can disclose identities and personally identifiable information such as user-initiated searches for their own social security or credit card numbers, or their mistakenly pasted but revealing text." (Id. ¶ 27.) "There are ways in which a search query alone may reveal personally identifying information." (Id. ¶ 26.)

This Court shared Google's privacy concerns: "The Government contends that there are no

16 privacy issues raised by its request for the text of search queries because the mere text of the 17 queries would not yield identifiable information. Although the Government has only requested the 18 text strings entered . . . basic identifiable information may be found in the text strings . . . This 19 concern . . . gives this Court pause as to whether the search queries themselves may constitute 20 potentially sensitive information." (Id. ¶ 28; Gonzales, 234 F.R.D. at 687). This Court ultimately 21 denied the DOJ's request. (Compl. ¶ 28.) 22 Consistent with its position before this Court in 2006, Google represents to its users

23 through statements published in its Privacy Policy that Google will only share users' personal 24 information in extremely limited circumstances. (Id. ¶ 19.) Google defines "personal 25 information" as "information that [the user] provide[s] to us which personally identifies you, such 26 as your name, email address, or billing information, or other data which can be reasonably linked 27 to such information by Google." Google further represents that it "may share with third parties 28
3 PL.'S OPP'N TO GOOGLE'S MOT. TO DISMISS 5:10-CV-04809

1 certain pieces of aggregated, non-personal information," but that such information "does not 2 identify you individually." (Id. ¶ 21.) 3 Google's privacy representations, however, are false. Through deliberate design, Google's

4 search engine repeatedly transmits user search queries, which often contain highly sensitive and 5 personally identifiable information, to marketers, data brokers, and numerous other third parties. 6 (Id. ¶¶ 2, 37-39.) Notwithstanding Google's previous testimony before this Court and its public 7 statements that search queries contain sensitive personal data, Google has chosen to deliberately 8 cater to SEOs, webmasters, and other third parties by ensuring that each user's entire search query 9 is included in the Referrer Header transmitted to the owner of the website that the user clicks on. 10 (Id. ¶¶ 37-57.) To date, Google continues to represent that it shares personal information only in 11 "limited circumstances." (Id.) 12 III. 13 LEGAL STANDARD In reviewing a motion to dismiss, the court "accept[s] all well-pleaded factual allegations

14 in the complaint as true, and determines whether the factual content allows the court to draw the 15 reasonable inference that the defendant is liable for the misconduct alleged." Cassirer v. Kingdom 16 of Spain, 580 F.3d 1048, 1052 n.2 (9th Cir. 2009) (internal citations omitted). A motion to dismiss 17 must be denied if the complaint contains factual allegations that, when accepted as true, "plausibly 18 give rise to an entitlement to relief." Ashcroft v. Iqbal, 129 S. Ct. 1937, 1950 (2009). Moreover, 19 Fed. R. Civ. P. 8(a) requires a plain and short statement of a plaintiff's claim, a standard that 20 "contains a powerful presumption against rejecting pleadings for failure to state a claim." Ileto v. 21 Glock Inc., 349 F.3d 1191, 1200 (9th Cir. 2003). 22 As shown below, the Complaint puts Google on notice of the claims it must defend, and

23 amply alleges facts that, taken as true, plausibly allow the Court "to draw the reasonable inference 24 that [Google] is liable for the misconduct alleged." Ashcroft, 129 S. Ct. at 1949. 25 26 27 28
4 PL.'S OPP'N TO GOOGLE'S MOT. TO DISMISS 5:10-CV-04809

1 IV. 2

ARGUMENT The Court should deny Google's Motion to Dismiss ("MTD") in its entirety because

3 Plaintiff has standing to assert both her federal and state law claims, and because the Complaint 4 contains sufficient allegations to state claims for relief under California law. 5 Google moves to dismiss Plaintiff's Stored Communications Act ("SCA") claim under

6 Rule 12(b)(1) only, arguing that Plaintiff lacks Article III standing. But Google's attack on 7 Plaintiff's SCA claim fails because she has properly asserted a violation of her statutory rights, 8 which itself satisfies Article III's injury in fact requirement. Accordingly, Google's motion to 9 dismiss Plaintiff's SCA claim must be denied. 10 Google challenges Plaintiff's state law claims under both Rule 12(b)(1) for lack of

11 standing and under Rule 12(b)(6) for failure to state a claim. However, Google's standing 12 argument fails because Plaintiff has alleged that she suffered actual, concrete harm sufficient to 13 establish injury in fact for purposes of Article III standing. Additionally, Plaintiff's allegations, 14 which must be accepted as true for purposes of a 12(b)(6) motion, demonstrate that Google 15 unlawfully disclosed Plaintiff's and other users' personally identifiable information ("PII") in 16 violation of Google's own representations and California law. For this reason, Plaintiff's claims 17 for actual fraud under Cal. Civ. Code § 1572, public disclosure of private facts, and unjust 18 enrichment should not be dismissed for failure to state a claim.2 19 20 21 A. Google's Motion to Dismiss Under Rule 12(b)(1) Should Be Denied Because Plaintiff has Satisfied Article III Standing Requirements for Both Her Stored Communications Act Claim and Her State Law Claims.

Google moves to dismiss all of Plaintiff's claims for lack of standing. To satisfy Article

22 III's standing requirements, a plaintiff must allege injury in fact, that the injury is fairly traceable 23 to the actions of the defendant, and that the injury will be redressed by a favorable decision. 24 Friends of the Earth v. Gaston Copper Recycling Corp., 528 U.S. 167, 180-81 (2000). 25 By agreement of the parties, Plaintiff hereby withdraws her claims for relief under the Consumers Legal Remedies Act (Count II), the False Advertising Law (Count III), and the Unfair 26 Competition Law (Count IV). Accordingly, no discussion in opposition or in reply is necessary by 27 the parties, and no decision by the Court is necessary for these causes of action because Plaintiff will not pursue these claims. 28
5 PL.'S OPP'N TO GOOGLE'S MOT. TO DISMISS 5:10-CV-04809
2

1

Specifically, Google argues that Plaintiff lacks standing because she has not pled facts

2 demonstrating that she has suffered injury in fact; Google does not argue that Plaintiff has failed to 3 plead the other standing requirements. Google's argument fails for two reasons: 1) Plaintiff's 4 allegation that Google violated her statutory rights under the SCA is sufficient to establish injury 5 in fact for Count I of Plaintiff's complaint; and, 2) Plaintiff's has alleged that she has suffered 6 concrete, actual harm sufficient to satisfy the injury in fact requirement for Plaintiff's remaining 7 state law claims. 8 9 10 1. Plaintiff Has Article III Standing to Assert Her Stored Communications Act Claim Because Google's Invasion of Plaintiff's Statutory Rights Creates Standing.

The United States Supreme Court has held that the "injury required by Article III may exist

11 solely by virtue of statutes creating legal rights, the invasion of which creates standing . . ." Warth 12 v. Seldin, 422 U.S. 490, 500 (1975) (emphasis added); see, e.g., Fulfillment Services Inc. v. United 13 Parcel Serv., Inc., 528 F.3d 614, 618-19 (9th Cir. 2008) (same). 14 Where a statute creates a private right of action, even a plaintiff who cannot establish

15 actual damages has Article III standing. See Edwards v. First American Corp., 610 F.3d 514, 517 16 (9th Cir. 2010) (because the Real Estate Settlement Procedures Act of 1974 created a private right 17 of action, plaintiff had standing even though no actual damages were alleged); Sisley v. Sprint 18 Communications Co., 284 Fed. Appx. 463, 466 (9th Cir. 2008) (reversing district court's dismissal 19 of state statutory claim "for lack of a cognizable injury," because "[the plaintiff] alleged a 20 violation of her state statutory rights which can constitute a cognizable injury sufficient to 21 withstand a Rule 12(b)(1) motion"); Hoang v. Reunion.com, Inc., No. C-08-3518 MMC, 2010 WL 22 1340535, *3-4 (N.D. Cal. Mar. 31, 2010) (finding standing under a state consumer protection 23 statute even though plaintiff could not allege actual injury). 24 Therefore, the essential standing question is whether the "constitutional or statutory

25 provision on which the claim rests properly can be understood as granting persons in the plaintiff's 26 position a right to judicial relief." Warth, 422 U.S. at 500. See also Edwards, 610 F.3d at 517; In 27 re Carter, 553 F.3d 979, 988 (6th Cir. 2009) ("Congress no doubt has the power to create new 28
6 PL.'S OPP'N TO GOOGLE'S MOT. TO DISMISS 5:10-CV-04809

1 legal rights, and it generally has the authority to create a right of action whose only injury-in-fact 2 involves the violation of that statutory right."). In the case of the SCA, Section 2707(a) creates a 3 private right of action for alleged violations of the statute and thus, the right to judicial relief.3 4 Accordingly, Plaintiff need only sufficiently allege a violation of the SCA in order to satisfy the 5 injury in fact requirement of Article III standing. 6 Here, Plaintiff alleges that Google knowingly and systematically divulged its users' private

7 search queries to marketers, data brokers, and numerous other third parties in violation of the 8 SCA. (Compl. ¶¶ 86-97.) Plaintiff, who has been a user of Google search at all material times and 9 conducted numerous searches, including a number of "vanity" searches, alleges that Google 10 knowingly divulged her private search queries and thereby violated her statutory rights under §§ 11 2702(a)(1) and 2702(a)(2) of the Stored Communications Act. (Id. ¶¶ 6, 92-93.) Accordingly, 12 Plaintiff's allegations that Google violated her rights protected under the SCA are sufficient for 13 Article III standing. See Warth, 422 U.S. at 500, 502 ("For purposes of ruling on a motion to 14 dismiss for want of standing, both the trial and reviewing courts must accept as true all material 15 allegations of the complaint, and must construe the complaint in favor of the complaining 16 party . . . standing in no way depends on the merits of the plaintiff's contention that the particular 17 conduct is illegal."). 18 Moreover, Plaintiff's allegations are sufficient to establish concrete injury traceable to

19 Google's statutory violations. In Hepting v. AT&T Corp., the plaintiffs asserted claims under the 20 SCA based on allegations that AT&T provided the government with direct access to databases 21 containing information about AT&T customers. 439 F. Supp. 2d 974 (N.D. Cal. 2006). Like 22 Google, defendant AT&T claimed that plaintiffs failed to allege injury-in-fact and lacked standing, 23 arguing "all plaintiffs really have is a suggestion that AT&T provided a means by which the 24 government could have [accessed their communications] had it wished." Id. at 999; compare 25 MTD at 7 ("[the Complaint] merely asserts that a capability exists that, if exploited, may lead to 26 "[A]ny...person aggrieved by any violation of this chapter in which the conduct constituting the violation is engaged in with a knowing or intentional state of mind may, in a civil action, recover 28 from the person or entity...which engaged in that violation such relief as may be appropriate." 27
7 PL.'S OPP'N TO GOOGLE'S MOT. TO DISMISS 5:10-CV-04809
3

1 future harm to users generally"). Then Chief Judge Vaughn R. Walker disagreed, holding that "at 2 the pleading stage, general factual allegations of injury resulting from defendant's conduct may 3 suffice, for on a motion to dismiss we `presume that general allegations embrace those specific 4 facts that are necessary to support the claim.'" Id. (quoting Lujan v. Defenders of Wildlife, 504 5 U.S. 555, 561 (1992)). Judge Walker went on to rule that not only had the plaintiffs sufficiently 6 alleged injury-in-fact, but that they also established concrete injury. Id. at 1000-01 (AT&T's 7 "alleged creation of a dragnet to intercept all or substantially all of its customers' communications 8 . . . necessarily inflict[ed] a concrete injury" on each of its customers). Like the Hepting plaintiffs, 9 Plaintiff here has alleged that Google disclosed the contents of Plaintiff's communications to third 10 parties in violation of the SCA. Accordingly, Plaintiff has also established concrete, particularized 11 injury. 12 In sum, the SCA creates a set of individual rights and a private right of action by which to

13 vindicate those rights, as well as statutory damages to remedy the violation. Therefore, Plaintiff's 14 allegations that Google violated her rights protected under the SCA are sufficient to confer Article 15 III standing. Because Google does not argue that Plaintiff's substantive allegations fail to state a 16 claim under the SCA, Count I of the Complaint should not be dismissed. 17 18 19 Article III standing if she alleges injury in fact, which requires "an invasion of a legally protected 20 interest which is (a) concrete and particularized . . . and (b) actual or imminent, not conjectural or 21 hypothetical." Lujan v. Defenders of Wildlife, 504 U.S. 555, 560 (1992) (internal citations and 22 quotations omitted). Contrary to Google's arguments, Plaintiff has alleged that she has suffered 23 an injury that is both concrete and particularized and actual or imminent because Google's 24 disclosure of her search queries places her in imminent danger of harm to her privacy rights. 25 The Ninth Circuit has held that "the possibility of future injury may be sufficient to confer 26 standing on plaintiffs; threatened injury constitutes `injury in fact.'" Central Delta Water Agency 27 v. U.S., 306 F.3d 938, 947 (9th Cir. 2002). Specifically, the Ninth Circuit has held that the 28
8 PL.'S OPP'N TO GOOGLE'S MOT. TO DISMISS 5:10-CV-04809

2.

Plaintiff Has Alleged Actual Harm Sufficient to Satisfy the Standing Requirements for Her State Law Claims.

In addition to the basis for standing provided by statutes such as the SCA, a party has

1 increased risk of identity theft is sufficient to confer standing. In Krottner v. Starbucks Corp., a 2 laptop computer was stolen from Starbucks containing the unencrypted names, addresses and 3 social security numbers of approximately 97,000 Starbucks employees. 628 F.3d 1139, 1140 (9th 4 Cir. 2010). The Ninth Circuit found that although there were no allegations that the information in 5 the stolen laptop had actually been misused, the risk of future identity theft constituted an injury6 in-fact for purposes of Article III standing. Id. at 1143.4 7 Here, Plaintiff's allegations that Google's systematic disclosure of her search queries

8 places her immediately in danger of direct privacy harm are sufficient to confer Article III 9 standing, particularly at the pleading stage. E.g., Lujan, 504 U.S. at 561 ("At the pleading stage, 10 general factual allegations of injury resulting from the defendant's conduct may suffice . . . ").5 11 Plaintiff alleges that, through intentional design and in contravention of its own privacy policy, 12 Google routinely transferred Plaintiff's private search queries, which included multiple "vanity 13 searches" divulging Plaintiff's name, to marketers, data collectors, and other third parties. 14 (Compl. ¶¶ 2, 6.) Plaintiff alleges that as a result of Google's unlawful disclosures, she is at 15 16 17 18 19 20 21 22 23 24 25 26 27 28 See also Friends of the Earth v. Gaston Copper Recycling Corp., 204 F.3d 149, 160-61 (4th Cir. 2000) (en banc) ("The Supreme Court has consistently recognized that threatened rather than actual injury can satisfy Article III standing requirements"); Baur v. Veneman, 352 F.3d 625 (2d Cir. 2003) (plaintiff pleaded a sufficient "present, immediate risk" of exposure to bovine spongiform encephalopathy (BSE) to support Article III standing, even though BSE had not been detected in the United States, because injury in fact requirement is qualitative, not quantitative, and the more drastic the injury, the lesser the probability one needs to show to establish standing); Pisciotta v. Old Nat'l Bancorp, 499 F.3d 629, 634 (7th Cir. 2007) (holding that plaintiffs had standing because "the injury-in-fact requirement can be satisfied by a threat of future harm or by an act which harms the plaintiff only be increasing the risk of future harm that the plaintiff would have otherwise faced, absent the defendant's actions."); Doe v. Veterans Admin., 474 F. Supp. 2d 1100, 1103 (D. Minn. 2007) ("the systematic gathering, recording, and storage of enormous amounts of personal information that can be easily retrieved presents a threat to personal privacy on a vastly different scale than the occasional loose-lipped office gossip"). 5 In addition, Plaintiff has standing to seek injunctive relief requiring that Google cease its unlawful disclosure of users' search queries. (Compl. ¶ 97.) To have standing to seek injunctive relief, a plaintiff must show that: (1) she is under threat of suffering an "injury in fact" that is concrete, particularized, actual and imminent; (2) the injury is fairly traceable to the challenged action of the defendant; and (3) it is likely that a favorable judicial decision will prevent or redress the injury. Summers v. Earth Island Inst., 129 S. Ct. 1142, 1149 (2009); Friends of the Earth v. Laidlaw Envt'l Servs., Inc., 528 U.S. 167, 180-81 (2000); Covington v. Jefferson County, 358 F.3d 626, 637-638 (9th Cir. 2004). As demonstrated herein, the Complaint establishes that Plaintiff is under a real and imminent threat of future injury because Google continues to disclose user search queries and has taken no steps to retrieve or track the data relating to Plaintiff that was already released. (Compl. ¶¶ 40, 68, 103, 108, 119.)
9 PL.'S OPP'N TO GOOGLE'S MOT. TO DISMISS 5:10-CV-04809
4

1 immediate and increased risk of direct injury through the reidentification or deanonymization of 2 her private data (id. ¶¶ 67-73), much as the plaintiffs in Krottner were at increased risk of identity 3 theft. 4 Google itself has argued--before this very Court--that the risk of privacy harm from

5 disclosure of search queries "is no minor fear because search query content can disclose identities 6 and personally identifiable information." (Compl. ¶ 27; emphasis added.) Google's CEO publicly 7 stated that if Google "were to make a mistake to release private information that could be used 8 against somebody . . . it would be a terrible thing . . . I've always worried that the query stream 9 was a fertile ground for governments to randomly snoop on people." (Id. ¶ 33.) 10 Plaintiff's allegations are markedly similar to those in Doe 1 v. AOL, LLC, 719 F. Supp. 2d

11 1102 (N.D. Cal. 2010), which Google attempted but failed to distinguish. In determining a motion 12 for judgment on the pleadings, the court ruled that the plaintiffs had Article III standing after AOL 13 disclosed millions of its members' private search queries to third parties in violation of AOL's 14 privacy policy. The published data included vanity searches and other information that could 15 allow third parties to match anonymous search queries to specific individuals. The AOL court 16 noted that "AOL records and stores member search queries in a manner rendering it possible to 17 connect the stored search queries with a particular member." Id. at 1105. Given that the parties 18 were at an early stage of the litigation, the court determined that these allegations were "sufficient 19 to allege an ongoing injury." Id. 20 Similarly, Plaintiff here has alleged that Google's disclosures of search queries allow third

21 parties to connect those queries with specific individuals, including Plaintiff. (Compl. ¶¶ 58-73.) 22 Plaintiff's well-pleaded allegations, which this Court must assume to be true on a Rule 12(b)(1) 23 motion, establish that Plaintiff is at risk of suffering real and imminent injury. 24 Specifically, Plaintiff here alleges that Google wrongfully transferred millions of user

25 search queries to marketers, data brokers, and countless other third parties. (Compl. ¶¶ 2, 68, 79, 26 94, 134.) Indeed, while AOL involved an inadvertent disclosure of user information, Plaintiff 27 alleges that Google's release of search queries was intentional and done primarily for the purpose 28
10 PL.'S OPP'N TO GOOGLE'S MOT. TO DISMISS 5:10-CV-04809

1 of increasing advertising revenue. (Id. ¶¶ 14, 16, 94, 134.) Google itself has admitted that search 2 queries often contain sensitive information and "may reveal personally identifying information," 3 such that Google "will keep private whatever information users communicate absent a compelling 4 reason." (Id. ¶¶ 26-27.) Plaintiff demonstrates that Google could stop revealing search queries 5 within referrer headers but has chosen not to do so. (Id. ¶¶ 40-57.) Plaintiff further alleges that 6 Google has not attempted to retrieve or track search queries that it has already released, and 7 intends to continue to disclose user search queries in the future. (Id. ¶¶ 40, 67-68, 103, 108, 119.) 8 Finally, Plaintiff alleges how parties can connect specific individuals to harmful facts through a 9 combination of "anonymous" search query information and other available information with 10 surprising efficiency. (Id. ¶¶ 58-66.) In effect, AOL and the instant matter are functionally 11 identical, and this Court should find that Plaintiff has standing, just as the court found in AOL. 12 For the foregoing reasons, Plaintiff has Article III standing to assert her remaining state

13 law claims against Google. 14 15 16 premised on the same conduct alleged to have violated the SCA. But courts examining the issue 17 have found that "[s]ection 2708 of the SCA serves a limited purpose: to prevent criminal 18 defendants from suppressing evidence based on electronic communications or customer records 19 obtained in violation of [the statute's] provisions." In re National Security Agency 20 Telecommunications Records Litig., 633 F.Supp.2d 892, 905 (N.D. Cal. 2007). See also In re 21 National Security Agency Telecommunications Records Litig., 483 F. Supp. 2d 934, 939 (N.D. 22 Cal. 2007) ("the court concludes that the SCA does not completely preempt suits under state law") 23 Complete preemption by a federal statute is the exception, not the rule. The dispositive 24 question is "whether Congress intended the federal cause of action to be exclusive." Beneficial 25 Nat. Bank v. Anderson, 539 U.S. 1, 9 n.5 (2003). Here, the answer is no. Throughout the Wiretap 26 27 28
11 PL.'S OPP'N TO GOOGLE'S MOT. TO DISMISS 5:10-CV-04809

B.

Plaintiff's State Law Claims Are Not Preempted by the Stored Communications Act.

Google argues that the SCA expressly preempts any of Plaintiff's state law claims that are

1 Act and SCA there is a consistent theme: that there is room in the statutory scheme for the 2 application of state law.6 3 Google is wrong when it argues that 18 U.S.C. § 2708 provides the exclusive remedy for

4 the conduct at issue here. This section is the counterpart to 18 U.S.C. § 2518(10)(c), both of which 5 were added by the ECPA for a very specific and limited purpose: to prevent defendants in a 6 criminal prosecution from suppressing evidence based on electronic communications or customer 7 records obtained in violation of the ECPA's provisions.7 8 At the time Congress enacted the ECPA, the Wiretap Act set forth a statutory exclusionary

9 rule for unlawfully intercepted wire or oral communications. See 18 U.S.C. §§ 2515, 10 2518(10)(a),(b). The ECPA brought the Wiretap Act into the electronic age by making it 11 applicable to the interception of electronic communications, as well. S. REP. NO. 99-541, at 1-3. 12 That theme is apparent both in the original enactment of Title III and its amendment by the 13 ECPA. See, e.g., 18 U.S.C. § 2511 (see S. REP. NO. 90-1097 (1968), reprinted in 1968 U.S.C.C.A.N. 2112, 2181, commenting on subsections c and d of section 2511(1): "There is no 14 intent to preempt State law."); 18 U.S.C. § 2516(2) (allowing state officers to obtain interception orders only if authorized by and issued in conformity with state law); 18 U.S.C. § 2512 (see S. 15 REP. NO. 90 1097, 1968 U.S.C.C.A.N. at 2183: "There is no intent to preempt State law."); 18 16 U.S.C. §§ 2703(b)(1)(B), 2703(c), and 2703(d) (preserving state law requirements when state officers seek orders under section 2703; see H. R. REP. NO. 99-647 at 68-69 (1986) ("Thus, state 17 laws such as those found in . . . California . . . would remain unaffected with respect to access by state government officials."); 18 U.S.C. § 2710 ("Section 2710(f) explicitly preserves the rights of 18 consumers to seek redress under state laws that may provide a greater degree of protection than is afforded by the federal statute." S. REP. NO. 100-599 at 15 (1988), reprinted in 1988 19 U.S.C.C.A.N. 4342-1, 4342x13). 7 20 Like § 2707 of the SCA, § 2520 of the Wiretap Act provides a federal cause of action for those whose wire or electronic communications have been intercepted. 18 U.S.C. § 2520(a). The 21 legislative history of this provision could not contain a clearer statement of congressional intent that state remedies be preserved. The Senate Report explicitly states: "The scope of the [civil] 22 remedy [for wiretapping offenses] is intended to be both comprehensive and exclusive, but there is no intent to preempt parallel State law." S. REP. NO. 90-1097, 1968 U.S.C.C.A.N. at 2196 23 (emphasis added). Thus, as exemplified most recently by the California Supreme Court's decision 24 in Kearney v. Salomon Smith Barney, Inc., 45 Cal. Rptr. 3d 730 (2006), both state and federal courts hold that the federal act does not preempt state law civil remedies. Id. at 738 (noting that, in 25 the over 30 years since the Court first addressed the issue in People v. Conklin, 12 Cal. 3d 259 (1974), there have been no developments in the law that would warrant reconsideration of the 26 Court's conclusion that the Wiretap Act does not preempt state claims); see also Whitaker v. 27 Garcetti, 291 F. Supp. 2d 1132, 1142 (C.D. Cal. 2003); Navarra v. Bache Halsey Stuart Shields, Inc., 510 F. Supp. 831, 833 (E.D. Mich. 1981) (and cases cited therein). 28
12 PL.'S OPP'N TO GOOGLE'S MOT. TO DISMISS 5:10-CV-04809
6

1 However, at the urging of the Justice Department, Congress decided not to extend the statutory 2 exclusionary rule to unlawful interceptions of electronic communications. Instead, Congress added 3 subsection (c) to section 2518(10), the provision that sets out the procedures to be used in moving 4 to suppress unlawfully intercepted wire or oral communications. Thus section 2518(10)(c) 5 provides: 6 7 8 9 10 11 12 13 14 15 16 17 18 Section 2708 was intended to fulfill this same purpose with respect to the unlawful 19 accessing or disclosure of stored communications and customer records. That is made clear by the 20 House Report on § 2708, which states: "[T]he remedies and sanctions described in this chapter 21 [121] are the only remedies and sanctions available for non-constitutional violations of this 22 chapter [121]. See discussion of Section 101(e) of the bill, supra." H. R. REP. NO. 99-647, at 75 23 24 The discussion of section 101(e) in the House Report is an abbreviated version of that which appears in the Senate Report, which further expressly emphasizes that the intent to preempt is 26 directed toward criminal law: "Subsection (e) amends section 2518(10) to provide that the remedies and sanctions described in this chapter with respect to the interception of electronic 27 communications are the only judicial remedies and sanctions available for non-constitutional 28 violations of this chapter involving such communications. In the event that there is a violation of 25
13 PL.'S OPP'N TO GOOGLE'S MOT. TO DISMISS 5:10-CV-04809
8

The remedies and sanctions described in this chapter with respect to the interception of electronic communications are the only judicial remedies and sanctions for nonconstitutional violations of this chapter involving such communications. (emphasis added). The legislative history of this subsection makes clear what Congress had in mind: Subsection 101(e) of the Electronic Communications Privacy Act amends subsection 2518(10) of title 18 to add a paragraph (c) which provides that with respect to the interception of electronic communications, the remedies and sanctions described in this chapter are the only judicial remedies and sanctions available for nonconstitutional violations of this chapter involving such communications. In the event that there is a violation of law of a constitutional magnitude, the court involved in a subsequent trial will apply the existing Constitutional law with respect to the exclusionary rule. The purpose of this provision is to underscore that, as a result of discussions with the Justice Department, the Electronic Communications Privacy Act does not apply the statutory exclusionary rule contained in title III of the Omnibus Crime Control and Safe Streets Act of 1968 to the interception of electronic communications." S. REP. NO. 99-541, at 23 (emphasis added); see also H. R. REP. NO. 99-647, at 75 (1986) .

(1986) (emphasis added).8

1

Given the similarity of the language between the two provisions, and given the Report's

2 express reference back to the discussion of § 101(e), there is no doubt that the purpose and 3 meaning of the two provisions is the same: to make clear that only the limited protection of the 4 Fourth Amendment applies to efforts to suppress evidence gathered in violation of ECPA. That is 5 precisely the interpretation given to § 2708 by the Ninth Circuit and other courts. See, e.g. United 6 States v. Smith, 155 F.3d at 1056 (§ 2708 precludes suppression as a remedy for violation of 7 SCA); United States v. Sherr, 400 F. Supp. 2d 843, 848 (D. Md. 2005) (same); United States v. 8 Kennedy, 81 F. Supp. 2d 1103, 1110 (D. Kan. 2000) (same). 9 Making the SCA the exclusive remedy for any conduct that falls within its terms would not

10 only preclude state court actions; it would preclude actions under other federal laws as well, 11 including the Communications Act of 1934 (47 U.S.C. § 222) and the Computer Fraud and Abuse 12 Act, 18 U.S.C. § 1030. Congress had no such intent: "[T]he [ECPA] does not amend the 13 Communications Act of 1934. Conduct in violation of that statute, will continue to be governed by 14 that statute." S. REP. NO. 99-541, at 23;9 see also Theofel v. Farley-Jones, 359 F.3d 1066, 107215 77, 1078 (9th Cir. 2004) (holding that defendants' conduct violated both the SCA and the 16 Computer Fraud and Abuse Act, and concurrently reinstating plaintiffs' state law claims). 17 18 19 Thus, Plaintiff's state law claims are not preempted by the SCA. C. Plaintiff Has Stated a Claim for Actual Fraud Under Cal. Civil Code § 1572.

Plaintiff's detailed allegations are sufficient to state a claim for actual fraud under Cal.

20 Civil Code § 1572. Under California law, a claim for actual fraud requires (1) a false 21 representation, concealment, or nondisclosure from defendant; (2) knowledge of falsity; (3) intent 22 to induce reliance; (4) justifiable reliance; (5) resulting damage. Aqua-Lung America, Inc. v. 23 American Underwater Products, Inc., 709 F. Supp. 2d 773, 785 (N.D. Cal. 2010). 24 25 26 law of a constitutional magnitude the court involved in a subsequent criminal trial will apply the 27 existing constitutional law with respect to the exclusionary rule." Id. at 48 (emphasis added). 9 This language follows immediately after the language discussed earlier, explaining that the purpose of the exclusive remedy provisions was to prevent a nonconstitutional exclusionary rule. 28
14 PL.'S OPP'N TO GOOGLE'S MOT. TO DISMISS 5:10-CV-04809

1

As a threshold matter, Google argues that Plaintiff has failed to plead her fraud claims with

2 the particularity required by Rule 9(b). However, Plaintiff's specific, particularized allegations 3 readily satisfy the pleading requirements of Rule 9(b), which require a plaintiff to allege "the who, 4 what, when, where, and how" of the alleged fraudulent conduct and "set forth an explanation as to 5 why [a] statement or omission complained of was false or misleading." AOL, 719 F. Supp. 2d at 6 1112 (internal citations omitted). The purpose of Rule 9(b) "is to ensure that defendants accused 7 of the conduct specified have adequate notice of what they are alleged to have done, so that they 8 may defend against the accusations." Concha v. London, 62 F.3d 1493, 1502 (9th Cir. 1995). 9 Here, Plaintiff repeatedly identifies Google as the entity responsible for the actionable

10 misrepresentations and omissions. (Compl. ¶¶ 19-24.) Plaintiff has identified the substance of the 11 misrepresentations in Google's Privacy Policy by explicitly providing numerous untrue and 12 misleading statements relating to Google's handling, protection, and disclosure of its users' 13 personal information, among other things. (Id.) The complaint includes the time frame of the 14 misrepresentations, providing dates for each statement and action by Google, and consistently 15 identifies where the statements occurred. (Id.) Finally, Plaintiff alleges in detail how the 16 representations were false and misleading because Google has consistently disclosed search 17 queries to marketers, data brokers, and other third parties in violation of its own policies and 18 representations to users. (Id. ¶¶ 37-39, 101, 106, 131.) These allegations identify the "who, what, 19 when, where, and how" of Google's fraudulent conduct and are more than sufficient to put Google 20 "on notice" of the precise statements and conduct that Plaintiff has alleged to be fraudulent. 21 Google's argument that Plaintiff fails to allege any facts to demonstrate that she relied on

22 Google's misrepresentations is similarly misplaced. A plaintiff may prove reliance by showing 23 that a misrepresentation "was an immediate cause of [plaintiff's] injury-producing conduct," 24 though "the plaintiff need not demonstrate that it was the only cause." In re Tobacco II Cases, 46 25 Cal. 4th 298, 327 (2009). "It is not necessary that the plaintiff's reliance upon the truth of the 26 fraudulent misrepresentation be the sole or even the predominant or decisive factor influencing his 27 conduct." Id. Rather, it is sufficient to show that the misrepresentation played a "substantial 28
15 PL.'S OPP'N TO GOOGLE'S MOT. TO DISMISS 5:10-CV-04809

1 part," meaning that Plaintiffs "in all reasonable probability would not have engaged in the injury 2 producing conduct" but for the misrepresentation. Hale v. Sharp Healthcare, 183 Cal. App. 4th 3 1373, 1386-87 (2010). 4 In the class action context, "when the same material misrepresentations have actually been

5 communicated to each member of a class, an inference of reliance arises as to the entire class." 6 Mirkin v. Wasserman, 5 Cal. 4th 1082, 1095 (1993); Jenson v. Fiserve Trust Co., 256 Fed. Appx. 7 924, 926 (9th Cir. 2007) (same). More generally, "a presumption, or at least an inference, of 8 reliance arises wherever there is a showing that a misrepresentation was material." In re Tobacco 9 II Cases, 46 Cal. 4th 209, 327 (2009). In turn, a misrepresentation is "material" if "a reasonable 10 man would attach importance to its existence or nonexistence in determining his choice of action 11 in the transaction in question." Id. Typically, materiality is a question of fact. Id. 12 Plaintiff has alleged that Google represented that it would strictly limit access to and use of

13 users' personal information and only share such information in the aggregate or under certain 14 limited conditions. (Compl. ¶¶ 19-24.) These public misrepresentations created an expectation 15 among Plaintiff and other users that Google would comply with its own Privacy Policy and keep 16 Plaintiff's personal information and search queries private and secure. Because Google's Privacy 17 Policy applies to Plaintiff and all users, Google's misrepresentations were uniform and 18 communicated to each proposed member of the Class, thereby creating an inference of reliance. 19 Google's policies relating to the dissemination of search queries and other personal information 20 would be a material consideration to potential users in determining whether to use Google's search 21 engine. As Google has admitted, reasonable consumers such as Plaintiff would have had serious 22 reservations about using Google search if they were aware that Google, contrary to its numerous 23 public statements, routinely and intentionally shared search queries with third parties without 24 reservation. (Compl. ¶¶ 26-27.) For these reasons, Plaintiff's allegations give rise to a 25 presumption of reliance. 26 Finally, while Google is correct that Section 1572 only applies to fraud "committed by a

27 party to the contract," Plaintiff explicitly alleges that Google's Privacy Policy constitutes a valid 28
16 PL.'S OPP'N TO GOOGLE'S MOT. TO DISMISS 5:10-CV-04809

1 and enforceable agreement. (Compl. ¶ 129.) This is consistent with the findings of numerous 2 courts that have concluded that privacy policies may constitute, or become part of, valid and 3 enforceable contracts. See Smith v. Trusted Universal Standards in Electronic Transactions, Inc., 4 No. 09-4567, 2010 WL 1799456, at *9 (D.N.J. May 4, 2010) (finding that privacy policy can 5 constitute a contract); Meyer v. Christie, No. 07-2230, 2007 WL 3120695, at *4 (D. Kan. Oct. 24, 6 2007) (rejecting argument that privacy policy cannot constitute a valid contract and finding that 7 plaintiff alleged that bank's privacy policy was part of an enforceable agreement with plaintiff); In 8 re JetBlue Airways Corp. Privacy Litig., 379 F. Supp. 2d 299, 325 (E.D.N.Y. 2005) (holding that a 9 privacy policy can form a contract); In re American Airlines, Inc. Privacy Litig., 370 F. Supp. 2d 10 552, 556 (N.D. Tex. 2005) (finding that privacy policy displayed on airline's website was part of 11 the contract of carriage with passengers). 12 Google's suggestion that the representations in its Privacy Policy were mere "broad

13 statements of company policy" is without merit. (MTD at 19.) As Google has admitted, the 14 perceived privacy and anonymity of search queries "are major factors in the attraction of users." 15 (Compl. ¶ 27.) Google has publicly recognized that if "users believe that the text of their search 16 queries could become public knowledge, they may be less likely to use the search engine for fear 17 of disclosure of their sensitive or private searches for information or websites." (Id. ¶ 26.) 18 Accordingly, Google's representations were vital in attracting users to Google's search platform 19 and were relied upon by users in entering private and sensitive search queries. Such essential 20 representations of privacy go far beyond "broad statements of company policy." 21 For these reasons, Plaintiff has sufficiently stated a claim for actual fraud under Cal. Civil

22 Code § 1572. 23 24 25 D. Plaintiff Has Alleged Sufficient Facts to Support Her Claim for Public Disclosure of Private Facts Because Google Disclosed Her Private Search Queries.

Google argues that Plaintiff fails to state a claim for public disclosure of private facts

26 because: a) the disclosed facts were not private; b) Plaintiff does not allege a public disclosure; 27 and, c) the disclosures were not offensive and objectionable to a reasonable person. The requisite 28
17 PL.'S OPP'N TO GOOGLE'S MOT. TO DISMISS 5:10-CV-04809

1 elements for such a claim are: (1) a public disclosure; (2) of a private fact; (3) which would be 2 offensive and objectionable to a reasonable person; and (4) which is not of legitimate public 3 concern. Taus v. Loftus, 40 Cal. 4th 683, 717 (2007). 4 Concerning Google's argument that the disclosed facts are not private, Plaintiff has

5 repeatedly alleged that the facts were, in fact, private. In doing so, Google argues that the only 6 fact disclosed is Plaintiff's name, which Google contends is not private. However, this is not what 7 Plaintiff alleged. Assuming arguendo that the only search term revealed was Plaintiff's name, this 8 still constitutes a private fact in this context because what is being revealed is not just her name, 9 but rather the fact that she searched for it. In other words, while her name may be in the public 10 domain for purposes of this law, the fact that she searched for it is quite private. Second, Plaintiff 11 also alleges she searched for the names of her family members. (Compl. ¶ 6.) Again, names of 12 family members alone may be public, but the fact that Plaintiff searched for them is private. 13 Plaintiff's search queries, regardless of the content of the queries, are all private. Thus, Plaintiff 14 has sufficiently pled that Google disclosed private factsher search queries. 15 In addition, it is well settled that, "to be a private fact, the expectation of privacy need not

16 be absolute." Moreno v. Hanford Sentinel, Inc., 172 Cal. App. 4th 1125, 1130 (2009); Sanders v. 17 American Broadcasting Companies, 20 Cal. 4th 907, 915 (1999). "Private is not equivalent to 18 secret," and a claim to a right of privacy in information "is not so much one of total secrecy as it is 19 of the right to define one's circle of intimacy . . ." Moreno, 172 Cal. App. 4th at 1130. As 20 alleged, Plaintiff did not define her circle of intimacy to include the website purveyors whose links 21 she clicked in search results; her circle of intimacy for her search queries included Google and 22 Google alone. 23 Google's second argument is that Plaintiff does not allege a public disclosure. This

24 argument similarly fails because Plaintiff has alleged that Google disclosed her search queries to 25 countless third parties. (Compl. ¶ 2). These third parties include the owners of the websites that 26 the users click (Id. ¶ 38) and web analytics services, including Search Engine Optimization 27 companies (Id. ¶ 39). Thus, Google's argument that the Plaintiff has only pled that Google only 28
18 PL.'S OPP'N TO GOOGLE'S MOT. TO DISMISS 5:10-CV-04809

1 revealed her search queries to the website owners is demonstrably false. Accordingly, Google's 2 argument fails; Plaintiff has pled sufficient facts to demonstrate public disclosure. 3 Finally, Google's argument that Plaintiff's disclosure of her search terms would not be

4 objectionable and offensive to a reasonable person fails because Plaintiff has pled that search 5 queries can and do constitute offensive and objectionable material. (Id. ¶ 3, stating that search 6 queries often contain requests for information on medical issues, sexual issues, and more; ¶ 31.) 7 Furthermore, Google itself has acknowledged that search queries may reveal sensitive 8 information. (Id. ¶¶ 5, 26-27.) 9 Simply put, Google released private facts about Plaintiffher search queriesthat were

10 not otherwise available to any members of the public. Plaintiff is not a public figure, and her 11 queries were not newsworthy or otherwise of interest to the general public. (Compl. ¶ 123.) As a 12 result, Plaintiff's claim for public disclosure of private facts should stand. 13 14 E. Plaintiff has Adequately Alleged a Claim for Unjust Enrichment.

Google argues that Plaintiff's unjust enrichment claim fails as a matter of law because no

15 such cause of action exists under California law. Contrary to Google's blanket assertion, 16 California courts recognize an independent cause of action for unjust enrichment. See Villager 17 Franchise Sys. V. Dhami, Dhami & Virk, CF-F-04-6393, 2006 WL 22425, at *7 (E.D. Cal. Jan. 18 26, 2006) ("California law recognizes a cause of action for unjust enrichment" and requires a 19 defendant to make restitution who has unjustly retained a benefit from plaintiff); Gerlinger v. 20 Amazon.Com, Inc., 311 F. Supp. 2d 838, 856 (N.D. Cal. 2004) ("Under California law, unjust 21 enrichment is an action in quasi-contract"); Hirsch v. Bank of America, 107 Cal. App. 4th 708, 722 22 (2003) (finding that plaintiff stated a valid cause of action for unjust enrichment based on 23 defendant's unjustified retention of excessive fees). The requisite elements for an unjust 24 enrichment claim are the "receipt of a benefit and [the] unjust retention of the benefit at the 25 expense of another." Peterson v. Cellco Partnership, 164 Cal. App. 4th 1583, 1593 (2008). 26 Google also argues that Plaintiff has failed to allege any benefit that was conferred to

27 Google "at any expense" to Plaintiff. However, California law has established that an aggrieved 28
19 PL.'S OPP'N TO GOOGLE'S MOT. TO DISMISS 5:10-CV-04809

1 party may maintain a claim for unjust enrichment without suffering actual damages. In particular, 2 "the public policy of [California] does not permit one to `take advantage of his own wrong' 3 regardless of whether the other party suffers actual damage." County of San Bernardino v. Wash, 4 158 Cal. App. 4th 533, 541 (2008). As a result, where "a benefit has been received by the 5 defendant but the plaintiff has not suffered a corresponding loss or, in some cases, any loss, but 6 nevertheless the enrichment of the defendant would be unjust . . . [t]he defendant may be under a 7 duty to give to the plaintiff the amount by which [the defendant] has been enriched." Id. (citing 8 Restatement Restitution, § 1, com. e.) In other words, the "emphasis is on the wrongdoer's 9 enrichment, not the victim's loss." Id.; see also Ward v. Taggart, 51 Cal. 2d 736, 741-742 (1959); 10 California v. Levi Strauss & Co., 41 Cal. 3d 460, 472 (1986). 11 Here, Plaintiff alleges that she and the putative class have conferred a substantial benefit

12 upon Defendant because Google has shared its users' search queries with numerous third parties 13 without users' consent, causing Google to obtain substantial revenues from advertisers. (Compl. 14 ¶ 134.) Moreover, Plaintiff alleges that the information disclosed and exploited for profit by 15 Google belonged to and was valuable to Plaintiff and other Google users. (Compl. ¶ 134.) And 16 while Plaintiff's individual loss and Google's substantial benefit are certainly not equal, the 17 "principle of unjust enrichment, however, is broader than mere `restoration' of what the plaintiff 18 lost. Many instances of `liability based on unjust enrichment . . . do not involve the restoration of 19 anything the claimant previously possessed . . . includ[ing] cases involving the disgorgement of 20 profits . . . wrongfully obtained." County of San Bernardino, 158 Cal. App. 4th at 541. These 21 allegations, which must be accepted as true for purposes of a 12(b)(6) motion, are sufficient to 22 state a claim for unjust enrichment under California law. 23 V. 24 CONCLUSION For the foregoing reasons, this Court should deny Google's Motion to Dismiss under Rule

25 12(b)(1) as to Plaintiff's SCA claim, and under Rules 12(b)(1) and 12(b)(6) as to Plaintiff's public 26 disclosure of private facts claim, her statutory fraud claim, and her unjust enrichment claim. 27 28
20 PL.'S OPP'N TO GOOGLE'S MOT. TO DISMISS 5:10-CV-04809

1 Alternatively, the Court should grant Plaintiff leave to amend her complaint in order to remedy 2 any pleading deficiencies, as necessary. 3 4 5 6 7 Dated: March 21, 2011 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28
21 PL.'S OPP'N TO GOOGLE'S MOT. TO DISMISS 5:10-CV-04809

Dated: March 21, 2011

Respectfully submitted, NASSIRI & JUNG LLP /s/ Kassra P. Nassiri______ Kassra P. Nassiri Attorneys for Plaintiff and the Putative Class Respectfully submitted, EDELSON MCGUIRE, LLP /s/ Michael J. Aschenbrener_ Michael J. Aschenbrener Attorneys for Plaintiff and the Putative Class