In re Google Referrer Header Privacy Litigation

Filing 32

RESPONSE (re #29 MOTION to Dismiss First Amended Complaint Pursuant to Rules 12(b)(1) and 12(b)(6) MOTION to Dismiss First Amended Complaint Pursuant to Rules 12(b)(1) and 12(b)(6) ) filed byPaloma Gaos. (Nassiri, Kassra) (Filed on 10/7/2011)

KASSRA P. NASSIRI (215405)
1 ([e-mail])
CHARLES H. JUNG (217909)
2 ([e-mail])
NASSIRI & JUNG LLP
3 47 Kearny Street, Suite 700
San Francisco, California 94108
4 Telephone: [phone]
Facsimile: [phone]
5
MICHAEL J. ASCHENBRENER
6 ([e-mail]) (277114)
ASCHENBRENER LAW, P.C.
7 795 Folsom Street, First Floor
San Francisco, CA 94107
8 Telephone: [phone]
Facsimile: [phone]
9
10 Attorneys for Plaintiff and the Putative Class
11

UNITED STATES DISTRICT COURT

12
NORTHERN DISTRICT OF CALIFORNIA
13
SAN JOSE DIVISION
14
15
PALOMA GAOS, an individual, on behalf of
16 herself and all others similarly situated,

Case No. 5:10-cv-04809-EJD
CLASS ACTION

17

Plaintiff,

18

v.

19 GOOGLE INC., a Delaware Corporation,
20

Defendant.

21

PLAINTIFF’S OPPOSITION TO
GOOGLE’S MOTION TO
DISMISS FIRST AMENDED
COMPLAINT PURSUANT TO
RULES 12(b)(1) AND 12(b)(6)
Hearing Date: October 28, 2011
Time:
9:00 a.m.
Place:
Courtroom 1, 5th Floor
Hon. Edward J. Davila
Judge:

22
23
24
25

26
27
28
PL.’S OPP’N TO GOOGLE’S MOT. TO DISMISS FAC
5:10-CV-04809

1
TABLE OF CONTENTS

2

3 I. INTRODUCTION ................................................................................................................. 1
II. STATEMENT OF FACTS .................................................................................................... 2
4 III. LEGAL STANDARD ............................................................................................................ 3
5 IV. ARGUMENT ......................................................................................................................... 4
A.
Google’s Motion to Dismiss Under Rule 12(b)(1) Should Be Denied Because
6
Plaintiff Has Satisfied Article III Standing Requirements for Her ECPA and Her
State Law Claims. ..................................................................................................... 4
7
1. Plaintiff Has Article III Standing to Assert Her ECPA Claims Because
8
Google’s Invasion of Plaintiff’s Statutory Rights Creates Standing. .................. 4
2. Google’s Disclosure of Plaintiff’s Search Queries Violated the ECPA.............. 7
9
3. Google Should Be Judicially Estopped From Arguing that Disclosure of Search
10
Queries Was Not in Violation of the ECPA. ..................................................... 10
4. Plaintiff Has Alleged Actual Harm Sufficient to Satisfy the Standing
11
Requirements for Her State Law Claims........................................................... 12
B.
Plaintiff’s State Law Claims Are Not Preempted by the Stored Communications
12
Act. .......................................................................................................................... 14
13
C.
Plaintiff’s Allegations are Sufficient to Support Her Claim for Public Disclosure of
Private Facts. ........................................................................................................... 16
14
15
16
17

D.

18
19
20

E.

21
22
23
24
25
26
27

F.

1. Plaintiff Alleges that Google Disclosed Private Facts to the Public. ................ 16
2. Google Should Be Estopped from Arguing that Its Users’ Search Terms Are not
Private................................................................................................................ 18
Plaintiff’s Allegations Support Her Claim for Breach of Contract ......................... 18
1. Plaintiff Has Sufficiently Alleged the Existence of a Contract Between Google
and the Class...................................................................................................... 19
2. Plaintiff’s Allegations Satisfy the Remaining Elements to State a Claim for
Breach of Contract. ........................................................................................... 20
Plaintiff Has Stated Claims for Fraudulent Misrepresentation, Negligent
Misrepresentation, and Violations of Cal. Civil Code § 1572. ............................... 21
1. Plaintiff’s Allegations Identifying Google’s Fraudulent Conduct Satisfy the
Pleading Requirements of Rule 9(b). ................................................................ 21
2. Plaintiff Has Stated a Claim for Fraudulent Misrepresentation. ....................... 22
3. Plaintiff Properly States a Claim for Negligent Misrepresentation................... 22
4. Plaintiff Has Stated a Claim for Actual Fraud Pursuant to California Civil Code
Section 1572. ..................................................................................................... 23
Plaintiff has Adequately Alleged a Claim for Unjust Enrichment. ......................... 23

V. CONCLUSION ....................................................................................................................... 25

28
i

PL.’S OPP’N TO GOOGLE’S MOT. TO DISMISS FAC
5:10-CV-04809

1
2
3
4

TABLE OF AUTHORITIES
CASES
Agosta v. Astor, 120 Cal. App. 4th 596 (2004) ............................................................................... 22
Aqua-Lung America, Inc. v. American Underwater Products, Inc.,
709 F. Supp. 2d 773 (N.D. Cal. 2010) ................................................................................ 23

5 Ashcroft v. Iqbal, 129 S. Ct. 1937 (2009) ......................................................................................... 4
6 Baur v. Veneman, 352 F.3d 625 (2d Cir. 2003) .............................................................................. 12
7 Bunnell v. Mot. Picture Ass’n of Am., 567 F. Supp. 2d 1148 (C.D. Cal. 2007) ........................ 15, 16
8 California v. Levi Strauss & Co., 41 Cal. 3d 460 (1986) ................................................................ 24
9 Cassirer v. Kingdom of Spain, 580 F.3d 1048 (9th Cir. 2009) ......................................................... 3
10 Central Delta Water Agency v. U.S., 306 F.3d 938 (9th Cir. 2002) ............................................... 12
11 Concha v. London, 62 F.3d 1493 (9th Cir. 1995) ........................................................................... 21
12 County of San Bernardino v. Wash, 158 Cal. App. 4th 533 (2008) .......................................... 24, 25
13 Crabill v. Trans Union, L.L.C., 259 F.3d 662 (7th Cir. 2001) ...................................................... 5, 6
14 Doe 1 v. AOL, LLC, 719 F. Supp. 2d 1102 (N.D. Cal. 2010) ................................................... 13, 21
15 Doe v. Veterans Admin., 474 F. Supp. 2d 1100 (D. Minn. 2007) ................................................... 12
16 Friends of the Earth v. Gaston Copper Recycling Corp., 528 U.S. 167 (2000) ......................... 4, 12
17 Fulfillment Services Inc. v. United Parcel Serv., Inc., 528 F.3d 614 (9th Cir. 2008) ....................... 5
18 Gaston Copper Recycling Corp., 204 F.3d 149 (4th Cir. 2000) ................................................. 4, 12
19 Gerlinger v. Amazon.Com, Inc., 311 F. Supp. 2d 838 (N.D. Cal. 2004) ........................................ 24
20 Gonzales v. Google, 234 F.R.D. 674 (N.D. Cal. 2006) ............................................... 1, 3, 10, 11, 18
21 Hepting v. AT&T Corp., 439 F. Supp. 2d 974 (N.D. Cal. 2006)....................................................... 7
22 Hirsch v. Bank of America, 107 Cal. App. 4th 708 (2003) ............................................................. 24
23 Hoang v. Reunion.com, Inc.,
No. C-08-3518 MMC, 2010 WL 1340535 (N.D. Cal. Mar. 31, 2010) ................................. 5
24
Ileto v. Glock Inc., 349 F.3d 1191 (9th Cir. 2003) ............................................................................ 4
25
In re American Airlines, Inc. Privacy Litig., 370 F. Supp. 2d 552 (N.D. Tex. 2005) ..................... 20
26
In re Carter, 553 F.3d 979 (6th Cir. 2009) ....................................................................................... 5
27
In re Cybernetic Servs., Inc., 252 F.3d 1039 (9th Cir. 2001) .......................................................... 16
28
ii

PL.’S OPP’N TO GOOGLE’S MOT. TO DISMISS FAC
5:10-CV-04809

1

In re Facebook Privacy Litig.,
No. C-10-02389-JW, 2011 WL 2039995 (N.D. Cal. May 12, 2011) ................................... 5

2 In re Google Inc. Street View Elec. Commun. Litig.,
No. C10-MD-02184-JW (N.D. Cal. Jun. 29, 2011) ............................................................ 15
3
In re JetBlue Airways Corp. Privacy Litig., 379 F. Supp. 2d 299 (E.D.N.Y. 2005) ....................... 20
4
In re National Security Agency Telecomm. Records Litig.,
5
483 F. Supp. 2d 934 (N.D. Cal. 2007) ................................................................................ 15
6 In re National Security Agency Telecomm. Records Litig.,
633 F. Supp. 2d 892 (N.D. Cal. 2007) ................................................................................ 15
7
In re United States for an Order Authorizing the Use of a Pen Register & Trap,
8
396 F. Supp. 2d 45 (D. Mass. 2005) ..................................................................................... 9
9 Jurin v. Google Inc., --- F. Supp. 2d ----, 2011 WL 572300 (E.D. Cal. Feb. 15, 2011) ................. 20
10 Krottner v. Starbucks Corp., 628 F.3d 1139 (9th Cir. 2010) .................................................... 12, 13
11 Linda R.S. v. Richard D., 410 U.S. 614 (1973) ................................................................................. 4
12 Lujan v. Defenders of Wildlife, 504 U.S. 555 (1992) .................................................................. 7, 12
13 Mayfield v. U.S., 599 F.3d 964 (9th Cir. 2010) ................................................................................. 6
14 Meyer v. Christie, No. 07-2230, 2007 WL 3120695 (D. Kan. Oct. 24, 2007)................................ 19
15 Moreno v. Hanford Sentinel, Inc., 172 Cal. App. 4th 1125 (2009) ................................................. 17
16 National Union Fire Ins. Co. v. Cambridge Integrated Services Group, Inc.,
171 Cal. App. 4th 35 (2009) ................................................................................................ 23
17
Oasis West Realty, LLC v. Goldman, 51 Cal. 4th 811 (2011) ................................................... 19, 20
18
Peterson v. Cellco Partnership, 164 Cal. App. 4th 1583 (2008) .................................................... 24
19
Pisciotta v. Old Nat’l Bancorp, 499 F.3d 629 (7th Cir. 2007) ........................................................ 12
20
Quon v. Arch Wireless Operating Co., 445 F. Supp. 2d 1116 (C.D. Cal. 2006) ............................ 15
21
Reichert v. General Ins. Co. of Am., 68 Cal. 2d 822 (1968) ........................................................... 19
22
Samson v. NAMA Holdings, LLC, 637 F.3d 915 (9th Cir. 2011) .................................................... 11
23
Sanders v. American Broadcasting Companies, 20 Cal. 4th 907 (1999) ........................................ 17
24
Schwartz v. Thiele, 242 Cal. App. 2d 799 (1966) ........................................................................... 17
25
Sisley v. Sprint Communications Co., 284 Fed. Appx. 463 (9th Cir. 2008) ..................................... 5
26
Smith v. Trusted Universal Standards in Electronic Transactions, Inc.,
27
No. 09-4567, 2010 WL 1799456 (D.N.J. May 4, 2010) ..................................................... 19
28
iii

PL.’S OPP’N TO GOOGLE’S MOT. TO DISMISS FAC
5:10-CV-04809

1
2
3
4

Sprewell v. Golden State Warriors, 266 F.3d 979 (9th Cir. 2001).................................................... 9
Taus v. Loftus, 40 Cal. 4th 683 (2007) ............................................................................................ 16
U.S. v. Forrester, 512 F.3d 500 (9th Cir. 2008) ................................................................................ 9
Villager Franchise Sys. v. Dhami, Dhami & Virk,
CF-F-04-6393, 2006 WL 22425 (E.D. Cal. Jan. 26, 2006) ................................................. 24

5 Ward v. Taggart, 51 Cal. 2d 736 (1959) ......................................................................................... 24
6 Warth v. Seldin, 422 U.S. 490 (1975) ....................................................................................... 4, 5, 6
7
8 STATUTES
9 18 U.S.C. § 2510 ............................................................................................................................... 9
10 18 U.S.C. § 2518 ............................................................................................................................. 15
11 18 U.S.C. § 2702 ............................................................................................................................. 10
12 18 U.S.C. § 2707 ............................................................................................................................... 6
13 18 U.S.C. § 2708 ................................................................................................................. 14, 15, 16
14 Cal. Civ. Code § 1550 ..................................................................................................................... 19
15 Cal. Civ. Code § 1572 ............................................................................................................... 21, 23
16
17 RULES
Fed. R. Civ. P. 12(b)(1) ................................................................................................. 1, 4, 9, 13, 25
18
Fed. R. Civ. P. 12(b)(6) ............................................................................................................... 1, 25
19
Fed. R. Civ. P. 9(b).................................................................................................................... 21, 22
20
21
22

LEGISLATIVE HISTORY
H.R. Rep. No. 99-647 ........................................................................................................................ 8

23

Prepared Statement of P. Michael Nugent, “Electronic Communications Privacy Act,” Hearings
24 before the Subcommittee on Courts, Civil Liberties, and the Administration of Justice of the
House Committee on the Judiciary, 99th Cong., 1st and 2nd Sess., Serial No. 50 (1985-86) .......... 8
25
S. Rep. No. 99-541, reprinted in 1986 U.S. Code Cong. & Admin. News 3555 ............................. 8
26
27
28
iv

PL.’S OPP’N TO GOOGLE’S MOT. TO DISMISS FAC
5:10-CV-04809

1 I.

INTRODUCTION

2

The basis of Plaintiff’s suit is that Google systematically transmits the search queries of its

3 users to countless third parties in order to increase revenue, despite Google’s contractual promises
4 not to share search queries with any third party. Google’s actions not only violate Google’s
5 contracts with its users and the individual privacy rights of millions of people, but also federal
6 law, namely the Electronic Communications Privacy Act (the “ECPA”). In fact, Google itself has
7 previously argued that revealing search queries, as alleged here, violates the ECPA.
8

In 2006, before Judge James Ware, defendant Google asserted that any disclosure—even

9 anonymized—of its users’ search queries would violate the ECPA and that such disclosure would
10 cause concrete harm to both Google and its users.1 Now, in a complete about-face from its
11 previous assertions, Google argues that its systematic, routine and unmitigated disclosure of
12 billions of search queries to third parties presents no risk of harm to its users. This Court should
13 protect the integrity of the judicial process and prevent Google from playing fast and loose with
14 the courts in this district.
Not only is Google’s disclosure of search queries a violation of the ECPA, but the privacy

15

16 harms recognized by Judge Ware (and Google) in 2006 are amplified here. Google’s persistent
17 disclosure of search queries to third parties is bundled with additional information that identifies
18 individual users, including user IP addresses and cookie information, thus allowing the very
19 entities to which Google discloses this information to de-anonymize the data and sell it for profit.
20 This is the very privacy harm that Google has repeatedly warned of.
21

Google attempts to defeat Plaintiff’s ECPA claims solely by arguing that the Court lacks

22 subject matter jurisdiction under Rule 12(b)(1) because Plaintiff lacks standing. Specifically,
23 Google argues that Plaintiff has not suffered an injury in fact. But as Plaintiff demonstrates, and as
24 Google itself admitted in 2006, the injury suffered by Plaintiff squarely confers Article III
25 standing under the ECPA.
26

Google also seeks to dismiss Plaintiff’s state law claims for lack of standing and for failure

27
28

1

Gonzales v. Google, 234 F.R.D. 674 (N.D. Cal. 2006) (Case No. 5:06-mc-80006-JW).
1

PL.’S OPP’N TO GOOGLE’S MOT. TO DISMISS FAC
5:10-CV-04809

1 to state a claim. As Plaintiff will demonstrate, Google’s arguments fail on all grounds, and the
2 Court should fully deny Google’s motion to dismiss.
3 II.

STATEMENT OF FACTS

4

Google is the largest search engine in the United States, with a domestic market share of

5 over 50%. (First Amended Complaint (“FAC”) ¶¶ 2, 13.) Google earns substantial revenues from
6 advertising programs and exploits its knowledge of its users’ search preferences to increase these
7 revenues. (Id. ¶¶ 14-15.)
8

Google provides electronic communications services (“ECS”) and remote computing

9 services (“RCS”) to the public. (FAC ¶ 97.) When a Google user submits a search query to
10 Google, Google’s remote computers process the query using sophisticated algorithms to match the
11 query with websites likely to contain information sought by the user. (Id. ¶¶ 12-13.) Google then
12 provides the user with a list of search results and with the ability to retrieve those search results by
13 electronic transmission. (Id.)
14

Users, including Plaintiff, submit search queries to Google solely for the purpose of

15 receiving Google’s remote computer processing and electronic communications services and do
16 not authorize Google to divulge those search queries to any third party.2 (FAC ¶¶ 80, 100, 102.)
17 Yet, since Google launched its search service, Google has systematically and intentionally
18 transmitted user search queries to third parties. (Id. ¶¶ 39-41.) Each time a user runs a search on
19 Google’s search engine, Google matches the query with relevant websites and returns a search
20 results page with matching websites to the user. (Id. ¶ 12.) By deliberate design, the URL of the
21 search results page includes the entire search query that was entered by the user. (Id. ¶¶ 39, 42.) In
22 turn, when a user (including Plaintiff) clicks on a link on the search results page, the users’ web
23 browser reports the entire URL of the search results page, including all of the search terms entered
24
2

Google’s claim that it made “truthful disclosures” regarding its disclosure of search queries is
blatantly untrue. Google claims that “the Google Privacy FAQ discloses that the search results
26 page URL contains the search query.” (MTD at 5.) But the Google Privacy FAQ says no such
thing. Instead, the FAQ concerns URLs that are generated by and transmitted from third parties to
27 Google when using certain Google services (not Google Search) that are not relevant to the instant
case, Here, by contrast, Plaintiff’s claims concern URLs that are generated by and transmitted
28 from Google to third parties.
25

2

PL.’S OPP’N TO GOOGLE’S MOT. TO DISMISS FAC
5:10-CV-04809

1 by the user, to the third-party destination website. (Id. ¶ 40.) Google has demonstrated that it could
2 easily cease transmission of user search queries to third parties, but has chosen not to do so. (Id. ¶
3 43.)
4

In previous legal proceedings, Google argued that disclosure of user search queries would

5 violate the ECPA. In 2006 in the Gonzales matter, before Judge James Ware, the DOJ sought to
6 compel Google to produce “anonymized” search query data. (FAC ¶ 26.) Google fought the DOJ’s
7 request, arguing that disclosing search queries—even anonymized—would raise serious privacy
8 concerns:


“There are ways in which a search query alone may reveal personally identifying
information.” (Id. ¶ 27.)



“Google does not publicly disclose the searches [sic] queries entered into its search
engine.” (Id.)



14

“[User concern about disclosure of search queries] is no minor fear because search
query content can disclose identities and personally identifiable information such as
user-initiated searches for their own social security or credit card numbers, or their
mistakenly pasted but revealing text.” (Id. ¶ 28.)

15

Judge Ware accepted Google’s privacy concerns: “The Government contends that there are

9
10
11
12
13

16 no privacy issues raised by its request for the text of search queries because the mere text of the
17 queries would not yield identifiable information. Although the Government has only requested the
18 text strings entered . . . basic identifiable information may be found in the text strings . . . This
19 concern . . . gives this Court pause as to whether the search queries themselves may constitute
20 potentially sensitive information.” (Id. ¶ 29; Gonzales, 234 F.R.D. at 687). Although he did not
21 rule on the applicability of the ECPA, Judge Ware ruled in Google’s favor and denied the DOJ’s
22 request. (FAC ¶ 29.)
23 III.

LEGAL STANDARD

24

In reviewing a motion to dismiss, the court “accept[s] all well-pleaded factual allegations

25 in the complaint as true, and determines whether the factual content allows the court to draw the
26 reasonable inference that the defendant is liable for the misconduct alleged.” Cassirer v. Kingdom
27 of Spain, 580 F.3d 1048, 1052 n.2 (9th Cir. 2009) (internal citations omitted). A motion to dismiss
28
3

PL.’S OPP’N TO GOOGLE’S MOT. TO DISMISS FAC
5:10-CV-04809

1 must be denied if the complaint contains factual allegations that, when accepted as true, “plausibly
2 give rise to an entitlement to relief.” Ashcroft v. Iqbal, 129 S. Ct. 1937, 1950 (2009). Moreover,
3 Fed. R. Civ. P. 8(a) requires a plain and short statement of a plaintiff’s claim, a standard that
4 “contains a powerful presumption against rejecting pleadings for failure to state a claim.” Ileto v.
5 Glock Inc., 349 F.3d 1191, 1200 (9th Cir. 2003).
6

As shown below, the FAC puts Google on notice of the claims it must defend, and amply

7 alleges facts that, taken as true, plausibly allow the Court “to draw the reasonable inference that
8 [Google] is liable for the misconduct alleged.” Ashcroft, 129 S. Ct. at 1949.
9 IV.
10
11
12

ARGUMENT
A.

Google’s Motion to Dismiss Under Rule 12(b)(1) Should Be Denied Because
Plaintiff Has Satisfied Article III Standing Requirements for Her ECPA and
Her State Law Claims.

Google moves to dismiss all of Plaintiff’s claims for lack of standing. To satisfy Article

13 III’s standing requirements, a plaintiff must allege injury in fact, that the injury is fairly traceable
14 to the actions of the defendant, and that the injury will be redressed by a favorable decision.
15 Friends of the Earth v. Gaston Copper Recycling Corp., 528 U.S. 167, 180-81 (2000).
16

Specifically, Google argues that Plaintiff lacks standing only because she has not pled facts

17 demonstrating that she has suffered injury in fact. Google’s argument fails for two reasons: 1)
18 Plaintiff’s allegation that Google violated her statutory rights under the SCA is sufficient to
19 establish injury in fact for Count I of Plaintiff’s complaint; and, 2) Plaintiff has alleged that she
20 has suffered concrete, actual harm sufficient to satisfy the injury in fact requirement for Plaintiff’s
21 remaining state law claims.
22
23

1.

Plaintiff Has Article III Standing to Assert Her ECPA Claims Because
Google’s Invasion of Plaintiff’s Statutory Rights Creates Standing.

The United States Supreme Court has held that the “injury required by Article III may exist
24
solely by virtue of statutes creating legal rights, the invasion of which creates standing . . .” Warth
25
v. Seldin, 422 U.S. 490, 500 (1975) (emphasis added). See also Linda R.S. v. Richard D., 410 U.S.
26
614, 617 n.3 (1973) (“Congress may enact statutes creating legal rights, the invasion of which
27
28
4

PL.’S OPP’N TO GOOGLE’S MOT. TO DISMISS FAC
5:10-CV-04809

1 creates standing, even though no injury would exist without the statute.”); Fulfillment Services
2 Inc. v. United Parcel Serv., Inc., 528 F.3d 614, 618-19 (9th Cir. 2008) (same).
3

Where a statute creates a private right of action, even a plaintiff who cannot establish

4 actual damages has Article III standing. Thus, Google’s arguments concerning the speculative
5 nature of the harm in this case are misplaced and irrelevant as they relate to Plaintiff’s ECPA
6 claims. See, e.g., In re Facebook Privacy Litig., No. C-10-02389-JW, 2011 WL 2039995, at *4
7 (N.D. Cal. May 12, 2011) (allegations of unlawful disclosure under the ECPA sufficient to confer
8 Article III standing even in the absence of actual damages); Sisley v. Sprint Communications Co.,
9 284 Fed. Appx. 463, 466 (9th Cir. 2008) (reversing district court’s dismissal of state statutory
10 claim “for lack of a cognizable injury,” because “[the plaintiff] alleged a violation of her state
11 statutory rights which can constitute a cognizable injury sufficient to withstand a Rule 12(b)(1)
12 motion”); Hoang v. Reunion.com, Inc., No. C-08-3518 MMC, 2010 WL 1340535, *3-4 (N.D. Cal.
13 Mar. 31, 2010) (finding standing under a state consumer protection statute even though plaintiff
14 could not allege actual injury).
15

This is particularly true where, like here, the statute authorizes injunctive relief and the

16 award of statutory damages in lieu of actual damages.3 Crabill v. Trans Union, L.L.C., 259 F.3d
17 662, 665 (7th Cir. 2001) (“Many statutes, notably consumer-protection statutes, authorize the
18 award of damages (called ‘statutory damages’) for violations that cause so little measurable injury
19 that the cost of proving up damages would exceed the damages themselves, making the right to
20 sue nugatory.”). The essential standing question in this case is not whether Plaintiff can prove
21 actual damages, but whether the “constitutional or statutory provision on which the claim rests
22 properly can be understood as granting persons in the plaintiff’s position a right to judicial relief.”
23 Warth, 422 U.S. at 500; In re Carter, 553 F.3d 979, 988 (6th Cir. 2009) (“Congress . . . has the
24 authority to create a right of action whose only injury-in-fact involves the violation of that
25 statutory right.”).
26
27
28

3

18 U.S.C. § 2707(c) (authorizing statutory damages of not less than $1,000).
5

PL.’S OPP’N TO GOOGLE’S MOT. TO DISMISS FAC
5:10-CV-04809

1

Section 2707(a) of the ECPA creates a private right of action for the violations alleged here

2 and thus, the right to judicial relief. Furthermore, § 2707(c) authorizes statutory damages for
3 violations of the Act. Google’s violation of the ECPA is sufficient to confer standing, even if
4 Plaintiff’s actual damages are small or difficult to ascertain. See, e.g., Crabill, 259 F.3d at 665,
5 supra. 4 Pursuant to ample case law and the plain text of the statute, Plaintiff has met her burden to
6 allege facts sufficient to confer standing, and Google’s arguments concerning the purportedly
7 speculative nature of the harm in this case are simply misplaced.
8

Furthermore, Plaintiff’s FAC corrects the deficiency in her original complaint as identified

9 by the Court. Specifically, the Court held that Plaintiff failed to allege “that she clicked on a link
10 from the Google search page during the same time period that Defendant allegedly released search
11 terms via referrer headers.” (Order Granting Motion to Dismiss at 5, April 7, 2011, Dkt. No. 24.)
12 Plaintiff’s FAC addresses this issue directly. (FAC ¶ 77 (“During all time periods in which Google
13 was transmitting user search queries to third parties, Plaintiff conducted numerous searches . . .
14 and clicked on links on her Google search results pages.”); FAC ¶ 77 (“As a result, Google
15 transmitted Plaintiff’s full search queries to third parties by sending the URLs containing her
16 search queries to third part[ies] . . . .”.) These allegations also address the Court’s concern over
17 “conclusory allegations of disclosures,” as Plaintiff’s FAC alleges with detailed facts that
18 Google’s routine disclosure of Plaintiff’s search queries was bundled with other identifying
19 information (i.e., cookies and IP addresses) that allows third parties to identify Plaintiff. (FAC
20 ¶¶ 72-80.) Plaintiff’s allegations that Google violated her rights under the ECPA are sufficient for
21 Article III standing. See Warth, 422 U.S. at 500 (the “injury required by Article III may exist
22 solely by virtue of statutes creating legal rights, the invasion of which creates standing . . .”)
23

Moreover, Plaintiff’s allegations are sufficient to establish concrete injury traceable to

24 Google’s statutory violations. In Hepting v. AT&T Corp., the plaintiffs asserted claims under the
25 ECPA based on allegations that AT&T provided the government with direct access to databases
26
4

What’s more, because Google’s violations are ongoing and unmitigated (FAC ¶ 39), Plaintiff
faces a real and immediate threat that she will continue to be wronged. Thus, Plaintiff has standing
28 to seek injunctive relief. See, e.g., Mayfield v. U.S., 599 F.3d 964, 970 (9th Cir. 2010).
27

6

PL.’S OPP’N TO GOOGLE’S MOT. TO DISMISS FAC
5:10-CV-04809

1 containing information about AT&T customers. 439 F. Supp. 2d 974 (N.D. Cal. 2006). Like
2 Google, defendant AT&T claimed that plaintiffs failed to allege injury-in-fact and lacked standing,
3 arguing “all plaintiffs really have is a suggestion that AT&T provided a means by which the
4 government could have [accessed their communications] had it wished.” Id. at 999; compare MTD
5 at 8 (“[the FAC] merely asserts that a capability exists that, if exploited, may lead to future harm
6 to users generally”). Then Chief Judge Vaughn R. Walker disagreed, holding that “at the pleading
7 stage, general factual allegations of injury resulting from defendant’s conduct may suffice, for on a
8 motion to dismiss we ‘presume that general allegations embrace those specific facts that are
9 necessary to support the claim.’” Id. (quoting Lujan v. Defenders of Wildlife, 504 U.S. 555, 561
10 (1992)). Judge Walker went on to rule that not only had the plaintiffs sufficiently alleged injury11 in-fact, but that they also established concrete injury. Id. at 1000-01 (AT&T’s “alleged creation of
12 a dragnet to intercept all or substantially all of its customers’ communications . . . necessarily
13 inflict[ed] a concrete injury” on each of its customers). Like the Hepting plaintiffs, Plaintiff here
14 has alleged that Google disclosed the contents of Plaintiff’s communications to third parties in
15 violation of the ECPA. Accordingly, Plaintiff has also established concrete, particularized injury.
16

The ECPA creates a set of individual rights and a private right of action by which to

17 vindicate those rights, as well as statutory damages to remedy the violation. Therefore, Plaintiff’s
18 allegations that Google violated her rights protected under the ECPA are sufficient to confer
19 Article III standing. Because Google does not argue that Plaintiff’s substantive allegations fail to
20 state a claim under the ECPA, Count I of the Complaint should not be dismissed.
21
22
23

2.

Google’s Disclosure of Plaintiff’s Search Queries Violated the ECPA.
a.

Google Provides Both “Remote Computing Services” and
“Electronic Communication Services” to the Public.

The ECPA’s protections against disclosure encompass two types of entities providing
24
services related to electronic communications systems: “Remote computing services” (“RCS”)
25
providers and “electronic communication service” (“ECS”) providers. Google is both an RCS and
26
27
28
7

PL.’S OPP’N TO GOOGLE’S MOT. TO DISMISS FAC
5:10-CV-04809

1 an ECS provider.5
2

The RCS provisions of the ECPA were drafted to apply to companies that received data

3 from their customers by electronic transmission, processed that data, and then sent the results of
4 that processed and transformed data back to the customer with added value. See S. Rep. No. 995 541 at 10-11 (describing RCS as data processing “accomplished by the service provider on the
6 basis of information supplied by the subscriber or customer”), reprinted in 1986 U.S. Code Cong.
7 & Admin. News 3555, 3564-65; H.R. Rep. No. 99-647, at 23 (1986) (discussing the definition of
8 an RCS). At the hearings leading up to enactment of ECPA, Congress considered testimony
9 regarding the need to extend clear privacy protection not only to communications in transit but
10 also to data held by remote processing companies performing services like Google’s: “There are
11 other examples of remote computer services which involve electronic transmission of customer
12 data to and from the venders [sic] computer center. These include interactive data services. Such
13 interactive services includes [sic] (1) remote access to databases . . . (3) inquiry/response
14 activities between customer terminals and central computer locations . . . .” Prepared Statement
15 of P. Michael Nugent, “Electronic Communications Privacy Act,” Hearings before the
16 Subcommittee on Courts, Civil Liberties, and the Administration of Justice of the House
17 Committee on the Judiciary, 99th Cong., 1st and 2nd Sess., Serial No. 50 (1985-86) at 77-78
18 (emphasis added).
19

This is exactly what Google does: Users transmit certain data—their search terms—to

20 Google by means of electronic communications. Google takes that data and processes it with its
21 proprietary data processing techniques and database of websites and returns the results of that data
22 processing—a list of search results—to the user. Internet users could, with considerable effort,
23 maintain their own lists of URLs and send out their own robots or spiders to scour the Web
24 looking for what they want. Instead, Google has taken on that processing function for users. Thus,
25 Google literally provides “remote computing services” by computing data remotely for its users.
26

5

A “‘remote computing service’ means the provision to the public of computer storage or
processing services by means of an electronic communications system.” 18 U.S.C. § 2711(2). An
27
“‘electronic communication service’ means any service which provides to users thereof the ability
28 to send or receive wire or electronic communications.” § 2510 (15).
8

PL.’S OPP’N TO GOOGLE’S MOT. TO DISMISS FAC
5:10-CV-04809

1 Even Google agrees it is the very definition of an RCS.6 (See Declaration of Kassra P. Nassiri in
2 Support of Opposition to Motion to Dismiss (“Nassiri Decl.”), Ex. 1 at 20; Ex. 2 at ¶ 6.)7
3

b.

4

The Search Terms that a Google User Transmits to Google Are
the “Contents of a Communication” Under the ECPA.

The ECPA defines an “electronic communication” very broadly: “‘electronic
5
communication’ means any transfer of signs, signals, writing, images, sounds, data, or intelligence
6
of any nature.” 18 U.S.C. § 2510(12). It defines the “contents” of a communication equally
7
broadly: “‘contents’, when used with respect to any wire, oral, or electronic communication,
8
includes any information concerning the substance, purport, or meaning of that communication.”
9
18 U.S.C. § 2510(8).
10
Under these statutory definitions, the search terms a user transmits to Google to be
11
processed into search results are the contents of a communication. The search terms have
12
intelligible “substance,” “purport,” and “meaning,” and they are electronically communicated as a
13
transfer of “signs,” “writing,” and “data.” The user transmits those contents to Google, which
14
processes them using its proprietary techniques and databases, and returns the search terms back to
15
the user with additional valuable information whose content is determined by the search terms.
16
Indeed, in U.S. v. Forrester, 512 F.3d 500, 510 n.6 (9th Cir. 2008), the Ninth Circuit cited
17
with approval a district court that held that Google search terms are “content” within the meaning
18
of the ECPA:
19
A user may visit the Google site … [I]f the user then enters a search
phrase … [t]his would reveal content—that is, it would reveal, in the
words of the statute, ‘…information concerning the substance,
purport or meaning of that communication.’ 18 U.S.C. § 2510(8).
The ‘substance’ and ‘meaning’ of the communication is that the user
is conducting a search for information on a particular topic.

20
21
22

23 (Citing In re United States for an Order Authorizing the Use of a Pen Register & Trap, 396 F.
24 Supp. 2d 45, 49 (D. Mass. 2005).)
25

6

Google is also an ECS provider. Google provides a service to the public that gives users the
ability to send electronic communications in the form of search queries and to receive electronic
26
communications in the form of search results. (FAC ¶¶ 12, 13, 97.)
7
27 On a Rule 12 motion, the Court may consider documents whose contents are alleged in the
Complaint and whose authenticity no party questions. Sprewell v. Golden State Warriors, 266
28 F.3d 979, 988 (9th Cir. 2001).
9

PL.’S OPP’N TO GOOGLE’S MOT. TO DISMISS FAC
5:10-CV-04809

1

Accordingly, search queries constitute the contents of communications under the ECPA.

2

c.

3
4

Because Google Is an RCS Provider, It May Not Disclose
Plaintiff’s Communications to Any Third Party Without
Plaintiff’s Consent.

The ECPA restricts RCS providers (like Google) from knowingly divulging user

5 communications to third parties without user consent:
6

(2) a person or entity providing remote computing services to the
public shall not knowingly divulge to any person or entity the
contents of any communication which is carried or maintained on
that service—
(A) on behalf of, and received by means of electronic transmission
from (or created by means of computed processing of
communications received by means of electronic transmission
from), a subscriber or customer of such service;
(B) solely for the purpose of providing storage or computer
processing services to such subscriber or customer, if the provider is
not authorized to access the contents of any such communications
for purposes of providing any services other than storage or
computer processing;

7
8
9
10
11
12
13

18 U.S.C. § 2702(a). As alleged in the FAC, Google violated the ECPA by divulging the contents
14
of Plaintiff’s communications to third parties without Plaintiff’s consent.
15
3.

16
17

Google Should Be Judicially Estopped From Arguing that Disclosure of
Search Queries Was Not in Violation of the ECPA.

Google argues (incorrectly) that in order to state a violation of the ECPA, Plaintiff must

18 allege that the disclosed information was personally identifiable, sensitive, or stolen for purposes
19 of identity theft. (MTD at 8-10.) But as Google itself acknowledged in 2006 in the Gonzales case,
20 the “ECPA makes no exception for anonymous or anonymized content.” (Nassiri Decl., Ex. 1at
21 20.) Google argument in Gonzales was correct—a claim under section 2702(a) of the ECPA
22 requires nothing more than unauthorized disclosure of the “contents of any communication,”
23 which Plaintiff alleges here. In addition, Google argued all of the following in Gonzales:
24



Google is an ECS provider. (Id. at 19.)

25



Google is an RCS provider. (Id. at 19-20.)

26



Search queries constitute “contents of communications” and are subject to the

27

restrictions in the ECPA. (Id.)

28
10

PL.’S OPP’N TO GOOGLE’S MOT. TO DISMISS FAC
5:10-CV-04809

1
2
3



And by implication, Google argued that it did not have user consent to disclose
search queries to the government. (Id.)

Although Judge Ware refrained from expressing an opinion on the applicability of the

4 ECPA (Gonzales, 234 F.R.D. at 688), he adopted Google’s concerns that the disclosure of search
5 queries would raise privacy issues. Id. at 687 (expressing concern about whether “search queries
6 themselves may constitute potentially sensitive information”). Google benefitted from its stated
7 position in Gonzales (the court ruled in Google’s favor) and should not be allowed to play fast and
8 loose with the judicial system by tendering contradictory assertions here.
9

The Ninth Circuit has held that it is when “a claimant’s particular representations are so

10 inconsistent that they amount to an affront to the court [that] judicial estoppel may apply.” Samson
11 v. NAMA Holdings, LLC, 637 F.3d 915, 935 (9th Cir. 2011) (internal citations omitted). Judicial
12 estoppel “applies to a party’s stated position whether it is an expression of intention, a statement of
13 fact, or a legal assertion.” Id. The relevant factors for judicial estoppel include: “(1) whether the
14 party’s later position is clearly inconsistent with its earlier position; (2) whether the party has
15 successfully advanced the earlier position, such that judicial acceptance of an inconsistent position
16 in the later proceeding would create a perception that either the first or the second court had been
17 misled; and (3) whether the party seeking to assert an inconsistent position would derive an unfair
18 advantage or impose an unfair detriment on the opposing party if not estopped.” Id.
19

Here, each factor weighs in favor of applying judicial estoppel. Google’s present

20 contentions with respect to Plaintiff’s ECPA claims—e.g., “Plaintiff unsuccessfully attempts to
21 force-fit her contentions about Google Search into a framework of inapplicable laws” (MTD at 3),
22 and that the harm to Plaintiff resulting from Google’s disclosure of her “anonymized” serial search
23 queries is “far more remote and hypothetical than in other ‘lost data’ cases (id. at 8)—are wholly
24 inconsistent with Google’s factual and legal assertions in the Gonzales matter. And even though
25 Judge Ware did not rule on the applicability of the ECPA in the Gonzales matter, Google
26 persuaded the court that the disclosure of search queries would result in privacy harms. Permitting
27
28
11

PL.’S OPP’N TO GOOGLE’S MOT. TO DISMISS FAC
5:10-CV-04809

1 Google to switch positions now would unfairly allow it to escape liability under the ECPA and
2 harm the integrity of the judicial process.
3

4.

4

Plaintiff Has Alleged Actual Harm Sufficient to Satisfy the Standing
Requirements for Her State Law Claims.

In addition to the basis for standing provided by statutes such as the ECPA, a party has
5
Article III standing if she alleges injury in fact, which requires “an invasion of a legally protected
6
interest which is (a) concrete and particularized . . . and (b) actual or imminent, not conjectural or
7
hypothetical.” Lujan v. Defenders of Wildlife, 504 U.S. 555, 560 (1992) (internal citations and
8
quotations omitted). Contrary to Google’s arguments, Plaintiff has alleged that she has suffered an
9
injury that is both concrete and particularized and actual or imminent because Google’s disclosure
10
of her search queries places her in imminent danger of harm to her privacy rights.
11
The Ninth Circuit has held that “the possibility of future injury may be sufficient to confer
12
standing on plaintiffs; threatened injury constitutes ‘injury in fact.’” Central Delta Water Agency
13
v. U.S., 306 F.3d 938, 947 (9th Cir. 2002). In Krottner v. Starbucks Corp., 628 F.3d 1139, 1140
14
(9th Cir. 2010), a laptop computer was stolen from Starbucks containing the unencrypted names,
15
addresses and social security numbers of approximately 97,000 Starbucks employees. The Ninth
16
Circuit found that although there were no allegations that the information in the stolen laptop had
17
actually been misused, the risk of future identity theft constituted an injury-in-fact for purposes of
18

Article III standing. Id. at 1143.8

19
Here, Plaintiff’s allegations that Google’s systematic disclosure of her search queries
20
places her immediately in danger of direct privacy harm are sufficient to confer Article III
21
standing, particularly at the pleading stage. E.g., Lujan, 504 U.S. at 561 (“At the pleading stage,
22
general factual allegations of injury resulting from the defendant’s conduct may suffice . . . ”).
23
Plaintiff alleges that, through intentional design and in contravention of its own privacy policy,
24
Google routinely transferred Plaintiff’s private search queries, which included multiple “vanity
25
8

See also Friends of the Earth v. Gaston Copper Recycling Corp., 204 F.3d 149, 160-61 (4th Cir.
2000) (en banc) (“The Supreme Court has consistently recognized that threatened rather than
27 actual injury can satisfy Article III standing requirements”); Baur v. Veneman, 352 F.3d 625 (2d
Cir. 2003); Pisciotta v. Old Nat’l Bancorp, 499 F.3d 629, 634 (7th Cir. 2007); Doe v. Veterans
28 Admin., 474 F. Supp. 2d 1100, 1103 (D. Minn. 2007).
26

12

PL.’S OPP’N TO GOOGLE’S MOT. TO DISMISS FAC
5:10-CV-04809

1 searches” divulging Plaintiff’s name, to marketers, data collectors, and other third parties. (FAC ¶¶
2 77-78.) Plaintiff alleges that as a result of Google’s unlawful disclosures, she is at immediate and
3 increased risk of direct injury through the reidentification or deanonymization of her private data
4 (id. ¶¶ 69-75), much as the plaintiffs in Krottner were at increased risk of identity theft.
5

Google itself has argued—before this very Court—that the risk of privacy harm from

6 disclosure of search queries “is no minor fear because search query content can disclose identities
7 and personally identifiable information.” (FAC ¶ 28; emphasis added.) Google’s CEO publicly
8 stated that if Google “were to make a mistake to release private information that could be used
9 against somebody . . . it would be a terrible thing . . . I’ve always worried that the query stream
10 was a fertile ground for governments to randomly snoop on people.” (Id. ¶ 34.)
11

Plaintiff’s allegations are markedly similar to those in Doe 1 v. AOL, LLC, 719 F. Supp. 2d

12 1102 (N.D. Cal. 2010), which Google attempted but failed to distinguish. In determining a motion
13 for judgment on the pleadings, the court ruled that the plaintiffs had Article III standing after AOL
14 disclosed millions of its members’ private search queries to third parties in violation of AOL’s
15 privacy policy. The published data included vanity searches and other information that could allow
16 third parties to match anonymous search queries to specific individuals. The AOL court noted that
17 “AOL records and stores member search queries in a manner rendering it possible to connect the
18 stored search queries with a particular member.” Id. at 1105. Given that the parties were at an
19 early stage of the litigation, the court determined that these allegations were “sufficient to allege
20 an ongoing injury.” Id.
21

Similarly, Plaintiff here has alleged that Google’s disclosures of search queries allow third

22 parties to connect those queries with specific individuals, including Plaintiff. (FAC ¶¶ 60-68.)
23 Plaintiff’s well-pleaded allegations, which this Court must assume to be true on a Rule 12(b)(1)
24 motion, establish that Plaintiff is at risk of suffering real and imminent injury.
25

Specifically, Plaintiff here alleges that Google wrongfully transferred millions of user

26 search queries to marketers, data brokers, and countless other third parties. (FAC ¶¶ 2, 70, 78.)
27 Indeed, while AOL involved an inadvertent disclosure of user information, Plaintiff alleges that
28
13

PL.’S OPP’N TO GOOGLE’S MOT. TO DISMISS FAC
5:10-CV-04809

1 Google’s release of search queries was intentional and done primarily for the purpose of
2 increasing advertising revenue. (Id. ¶¶ 42, 101, 134.) Google itself has admitted that search queries
3 often contain sensitive information and “may reveal personally identifying information,” such that
4 Google “will keep private whatever information users communicate absent a compelling reason.”
5 (Id. ¶¶ 27-28.) Plaintiff demonstrates that Google could stop revealing search queries within
6 referrer headers but has chosen not to do so. (Id. ¶¶ 42-59.) Plaintiff further alleges that Google
7 has not attempted to retrieve or track search queries that it has already released, and intends to
8 continue to disclose user search queries in the future. (Id. ¶¶ 41, 69-70.) Plaintiff also alleges how
9 parties can connect specific individuals to harmful facts through a combination of “anonymous”
10 search query information and other available information with surprising efficiency. (Id. ¶¶ 6011 68.) Finally, Google attempts to distinguish AOL on the grounds that AOL stored “searches in a
12 manner that uniquely correlated the search query with the member who made it.” (MTD at 8.) But
13 Plaintiff in the instant matter also alleges that Google disclosed her search queries in a manner that
14 allows third parties to identify and associate her with those search queries. (FAC ¶¶ 72-75.) In
15 effect, AOL and the instant matter are functionally identical, and this Court should find that
16 Plaintiff has standing, just as the court found in AOL.
17

For the foregoing reasons, Plaintiff has Article III standing to assert her remaining state

18 law claims against Google.
19

B.

20

Plaintiff’s State Law Claims Are Not Preempted by the Stored
Communications Act.

Google argues that the § 2708 of the ECPA expressly preempts any of Plaintiff’s state law
21
claims that are premised on the same conduct alleged to have violated the ECPA. Courts
22
examining the ECPA, however, have determined that there is no express preemption language and
23
Congress did not intend for § 2708 to broadly preempt state regulation for conduct touched upon
24
by the ECPA.
25
Courts examining the supposed preemption provision of the ECPA have found that
26
“[s]ection 2708 of the SCA serves a limited purpose: to prevent criminal defendants from
27
suppressing evidence based on electronic communications or customer records obtained in
28
14

PL.’S OPP’N TO GOOGLE’S MOT. TO DISMISS FAC
5:10-CV-04809

1 violation of [the statute’s] provisions.” In re National Security Agency Telecomm. Records Litig.,
2 633 F. Supp. 2d 892, 905 (N.D. Cal. 2007) (“In re NSA II”); see also In re National Security
3 Agency Telecomm. Records Litig., 483 F. Supp. 2d 934, 939 (N.D. Cal. 2007) (“In re NSA I”)
4 (“the court concludes that the SCA does not completely preempt suits under state law”). Section
5 2708 is the counterpart to 18 U.S.C. § 2518 (10)(c), both of which were added by Congress to the
6 ECPA for a very specific and limited purpose: to prevent defendants in a criminal prosecution
7 from suppressing evidence based on electronic communications or customer records obtained in
8 violation of the ECPA’s provisions.9 This District has recognized that Congress enacted
9 § 2518(10)(c) and § 2708 for this limited purpose, and that the ECPA “contains no express
10 preemptive statement on the part of Congress.” In re Google Inc. Street View Elec. Commun.
11 Litig., No. C10-MD-02184-JW, Order at p. 23 (N.D. Cal. Jun. 29, 2011); accord In re NSA II, 483
12 F. Supp. 2d at 905 (Section 2708 does not expressly preempt state law based on its limited purpose
13 of preventing criminal defendants from suppressing evidence based on the provisions of the
14 ECPA.); In re NSA I, 483 F. Supp. 2d at 939 (Sections 2518(10)(c) and 2708 were enacted for the
15 same reason and that the SCA does not completely preempt state law.).
16

As such, Google’s reliance on Quon v. Arch Wireless Operating Co., 445 F. Supp. 2d 1116

17 (C.D. Cal. 2006) and Bunnell v. Mot. Picture Ass’n of Am., 567 F. Supp. 2d 1148 (C.D. Cal. 2007)
18 is misplaced. The district court in Quon found that § 2708 of the SCA applied to preempt certain
19 of the plaintiffs’ state law claims. 445 F. Supp. 2d at 1138. Contrary to the court’s conclusion in
20 Quon, Congress did not intend for the SCA to provide blanket preemption for every state law
21 cause of action “arising from conduct covered by the SCA,” Id. As addressed above, it was
22 Congress’ intent in drafting § 2708 to prevent criminal defendants from using the provisions of the
23 SCA as a means to suppress evidence brought against them that was obtained in violation of the
24 SCA.
25
26

The court in Bunnell found that § 2518(10)(c) preempts claims under California’s
9

See In re NSA I, 483 F. Supp 2d at 939 (discussing the legislative history of the ECPA before
determining that Congress intended for §§ 2518(10)(c) and 2708 to prevent criminal defendants
27
from using the ECPA to suppress evidence against them that was gathered in violation of
28 provisions of the ECPA.
15

PL.’S OPP’N TO GOOGLE’S MOT. TO DISMISS FAC
5:10-CV-04809

1 equivalent to the Wiretap Act, id. at 1154, but relied on the misinterpretation of § 2518(10)(c) as
2 an express preemption clause.10 Bunnell is further distinguishable from the instant case because
3 Plaintiff does not allege violations of the California equivalent to the Wiretap Act. Id. Plaintiff
4 alleges violations of state law that are independent of the alleged violations under the ECPA.
5 Because § 2708 of the ECPA does not expressly preempt Plaintiff’s state law claims, the Court
6 should reject Google’s arguments concerning preemption.
7

C.

8

Plaintiff’s Allegations are Sufficient to Support Her Claim for Public
Disclosure of Private Facts.

In her First Amended Complaint, Plaintiff adequately alleges that Google publicly
9
disclosed private facts about her when it revealed her search queries to third parties. The requisite
10
elements for a claim of public disclosure of private facts are: (1) a public disclosure; (2) of a
11
private fact; (3) which would be offensive and objectionable to a reasonable person; and (4) which
12
is not of legitimate public concern. Taus v. Loftus, 40 Cal. 4th 683, 717 (2007). Google argues that
13
Plaintiff cannot state a claim for public disclosure of public facts because: the facts disclosed by
14
Google were not private; the Plaintiff does not allege a public disclosure; and the disclosures
15
Google made were not offensive and objectionable to a reasonable person.
16
1.

17

Plaintiff Alleges that Google Disclosed Private Facts to the Public.

Although Google argues that the facts it disclosed are not private, Plaintiff nevertheless
18
alleges in the First Amended Complaint that those facts were private. (FAC ¶¶ 28, 86.) Google
19

contends that the only fact that it disclosed—the Plaintiff’s name—is not a private fact.11 Google’s

20
argument misses the point; Plaintiff’s claim arises not out of Google’s disclosure of her name, but
21
22
23
24
25
26
27
28

10

The Bunnell court also found that the Wiretap Act preempted the analogous state law claims on
the basis of “field preemption,” because the Wiretap Act’s scheme of regulation was sufficiently
comprehensive for the court to infer that Congress had intended that the Wiretap Act supersede
any analogous state regulations. 567 F. Supp. 2d at 1154 (citing In re Cybernetic Servs., Inc., 252
F.3d 1039, 1045–46 (9th Cir. 2001)). Google has made no similar argument that the SCA’s
scheme of regulation is so broad as to supersede all state regulation of the conduct complained of
by Plaintiff and the Class.
11
Plaintiff also alleges that she searched for the names of her family members. (FAC ¶ 77.)
Google argues that Plaintiff cannot pursue a privacy action on behalf of her family members, but
Plaintiff does not seek to enforce her family members’ rights to privacy. Rather, Plaintiff seeks to
recover for Google’s disclosure of information that was private to Plaintiff: her searches for her
family members’ names.
16

PL.’S OPP’N TO GOOGLE’S MOT. TO DISMISS FAC
5:10-CV-04809

1 rather out of Google’s disclosure of her search queries, some of which happened to contain her
2 name. Plaintiff’s name may be in the public domain for certain legal purposes, but the fact that the
3 Plaintiff searched for it (and the particular search terms she used) is private, and Google had no
4 right to disclose the search.
5

In addition, it is well settled that, “to be a private fact, the expectation of privacy need not

6 be absolute.” Moreno v. Hanford Sentinel, Inc., 172 Cal. App. 4th 1125, 1130 (2009); Sanders v.
7 American Broadcasting Companies, 20 Cal. 4th 907, 915 (1999). “Private is not equivalent to
8 secret,” and a claim to a right of privacy in information “is not so much one of total secrecy as it is
9 of the right to define one’s circle of intimacy . . .” Moreno, 172 Cal. App. 4th at 1130. Plaintiff’s
10 allegations show that when she used Google’s search services, she did not intend for her “circle of
11 intimacy” to include the website purveyors whose links she clicked in search results. Plaintiff has
12 thus sufficiently alleged that her search queries constitute a private fact.
13

Google’s second argument, that Plaintiff does not allege a public disclosure, is similarly

14 misguided. Google correctly articulates the rule that, in order to state a cause of action for public
15 disclosure of private facts, the private facts must be communicated to “the public in general or to a
16 large number of persons distinguished from one individual or a few,” Schwartz v. Thiele, 242 Cal.
17 App. 2d 799, 805 (1966). However, Plaintiff alleges that Google disclosed her search queries to
18 numerous third parties. (FAC ¶ 2.) These third parties include the owners of the websites that
19 Plaintiff clicked on (Id. ¶ 40), and web analytics services, including Search Engine Optimization
20 companies (Id. ¶ 41). Accordingly, Plaintiff has pled sufficient facts to demonstrate public
21 disclosure.
22

Finally, Google’s argument that disclosure of Plaintiff’s search terms would not be

23 objectionable and offensive to a reasonable person fails because Plaintiff has alleged that she did
24 not want her search queries disclosed (id. ¶ 118) and that search queries can and do constitute
25 offensive and objectionable material. (Id. ¶ 3.) (stating that search queries often contain requests
26 for information on medical issues, sexual issues, and more); Id. ¶ 32.) Furthermore, Google itself
27 has acknowledged that search queries may reveal sensitive information. (Id. ¶¶ 5, 27–28.)
28
17

PL.’S OPP’N TO GOOGLE’S MOT. TO DISMISS FAC
5:10-CV-04809

2.

1
2

Google Should Be Estopped from Arguing that Its Users’ Search Terms
Are not Private.

Not only has Google argued in the past that search queries contain sensitive information, it

3 used those arguments in Gonzales to successfully resist an attempt by the Justice Department to
4 subpoena from Google a list of its customers’ search queries. As argued above, since those prior
5 arguments are inconsistent with Google’s current position, this Court should prevent Google from
6 arguing: (1) that Plaintiff’s search terms are not private, and (2) that the disclosure of Plaintiff’s
7 search terms would not be objectionable and offensive to a reasonable person.
8

In Gonzales, Google argued that that search queries, even if anonymized, are private and

9 that providing users’ queries to the government could “disclose identities and personally
10 identifiable information such as user-initiated searches for their own social security or credit card
11 numbers, or their mistakenly pasted but revealing text.” (Nassiri Decl., Ex. 1 at 18.) Google also
12 argued that its users would object to such a disclosure by becoming less likely to use Google’s
13 search services. (Id.) This prior argument is inconsistent with Google’s current position that
14 Plaintiff’s search queries are not private facts, and that a reasonable person would not find
15 disclosure of Plaintiff’s search queries objectionable.
16

Simply put, Google released private facts about Plaintiffher search queriesthat were

17 not otherwise available to the public. Google itself acknowledged in Gonzales that search queries
18 contain private information and that its users would object to the disclosure of such information.
19 Google should not be able to now argue that search queries do not contain private information, and
20 that its users would not object to their search queries being disclosed. Accordingly, Plaintiff’s
21 claim for public disclosure of private facts should not be dismissed.
22

D.

23

Although Google claims that the Plaintiff has not stated a claim for breach of contract,

Plaintiff’s Allegations Support Her Claim for Breach of Contract

24 Plaintiff adequately alleges each of the elements necessary for a claim of breach of contract by
25 Google. Under California law, the elements for breach of contract are as follows: “(1) the
26 existence of the contract, (2) plaintiff's performance or excuse for nonperformance, (3)
27 defendant’s breach, and (4) the resulting damages to the plaintiff.” Oasis West Realty, LLC v.
28
18

PL.’S OPP’N TO GOOGLE’S MOT. TO DISMISS FAC
5:10-CV-04809

1 Goldman, 51 Cal. 4th 811 (2011) (citing Reichert v. General Ins. Co. of Am., 68 Cal. 2d 822, 830
2 (1968)).
3

1.

4

Plaintiff Has Sufficiently Alleged the Existence of a Contract Between
Google and the Class.

Google asserts that Plaintiff does not properly allege the existence of a contract because
5
her allegation that Google’s Privacy Policy constitutes a valid and enforceable contract is
6
“conclusory.” The elements required for the formation of a contract are (1) competent parties, (2)
7
mutual consent, (3) a contract objective that is not illegal, and (4) sufficient consideration. Cal.
8
Civ. Code § 1550. Plaintiff alleges that she and Google are competent parties, able to contract with
9
one another, and the provision of search services is not illegal. The parties mutually consented to
10
their contractual relationship: Google offers its search services to the public, subject to its Terms
11

of Service, into which its Privacy Policy is incorporated,12 and Plaintiff alleges that she agreed to

12
use Google’s search services, (FAC ¶ 130). Finally, Plaintiff alleges consideration: she
13
“transmit[ted] sensitive personally-identifiable information to Google in exchange for Google’s
14
promise that it would not share that personal information with third parties without users’
15
authorization.” (Id.) Plaintiff has thus sufficiently alleged each of the elements necessary for
16
contract formation.
17
This is consistent with the findings of numerous courts that have concluded that privacy
18
policies may constitute, or become part of, valid and enforceable contracts. See Smith v. Trusted
19
Universal Standards in Electronic Transactions, Inc., No. 09-4567, 2010 WL 1799456, at *9
20
(D.N.J. May 4, 2010) (finding that privacy policy can constitute a contract); Meyer v. Christie, No.
21
07-2230, 2007 WL 3120695, at *4 (D. Kan. Oct. 24, 2007) (rejecting argument that privacy policy
22
cannot constitute a valid contract and finding that plaintiff alleged that bank’s privacy policy was
23
24
25
26
27
28

12

Google Terms of Service (“TOS”) § 7 (April 16, 2007), http://google.com/accounts/tos (last
visited September 30, 2011). Google’s Terms of Service state that the “[Terms of Service] … form
a legally binding agreement between you and Google in relation to your use of [Google’s
services].” TOS § 1.4. As noted above, the Terms of Service incorporate the Privacy Policy.
Although the Plaintiff has adequately alleged that the Privacy Policy constitutes a binding
agreement between Google and the members of the Class, Plaintiff asks, in the alternative, for
leave to amend the First Amended Complaint to reflect that the operative contract between Google
and the Plaintiff is the Terms of Service, of which the Privacy Policy is an integral part.
19

PL.’S OPP’N TO GOOGLE’S MOT. TO DISMISS FAC
5:10-CV-04809

1 part of an enforceable agreement with plaintiff); In re JetBlue Airways Corp. Privacy Litig., 379 F.
2 Supp. 2d 299, 325 (E.D.N.Y. 2005) (holding that a privacy policy can form a contract); In re
3 American Airlines, Inc. Privacy Litig., 370 F. Supp. 2d 552, 556 (N.D. Tex. 2005) (finding that
4 privacy policy displayed on airline’s website was part of the contract of carriage with passengers).
5

Additionally, Google’s reliance on Jurin v. Google Inc., --- F. Supp. 2d ----, 2011 WL

6 572300 (E.D. Cal. Feb. 15, 2011), is misplaced. As Google notes, the Jurin court found that the
7 plaintiff had not sufficiently alleged that Google’s AdWords policy was more than a “general
8 policy statement on [Google’s] website.” Id. at *6. As discussed above, however, Plaintiff here
9 does allege the existence of a contract, along with the necessary elements for contract formation.
10 (FAC ¶¶ 129–130.)
11
12

2.

Plaintiff’s Allegations Satisfy the Remaining Elements to State a Claim
for Breach of Contract.

Plaintiff’s allegations not only establish the existence of a contract between Google and the
13
Class members, but also satisfy the remaining elements of a breach of contract claim. Once the
14
existence of a contract has been established, the remaining elements are performance by the
15
plaintiff, breach by the defendant, and damages. Oasis West Realty, 51 Cal. 4th at 821. Plaintiff
16
alleges that she performed her obligations under the contract by using Google to conduct searches,
17
including searches that contained her name. (FAC ¶ 77.) Plaintiff alleges in great detail how
18
Google breached its promise not to share sensitive personally identifiable information with third
19
parties. (Id. ¶¶ 39–57.) Finally, Plaintiff alleges that Google’s breach caused injury to herself and
20
the members of the Class in the form of Google’s unlawful disclosure of Plaintiff’s search queries
21
containing sensitive information. (Id. ¶¶ 80, 132.) Thus, Plaintiff has alleged facts supporting each
22
of the required elements for breach of contract. Plaintiff’s allegations plausibly give rise to an
23
entitlement to relief for Google’s breach of its agreement not to disclose Class members’
24
personally identifiable information, so Google’s Motion to Dismiss should be denied.
25
26
27
28
20

PL.’S OPP’N TO GOOGLE’S MOT. TO DISMISS FAC
5:10-CV-04809

1
2

E.

Plaintiff Has Stated Claims for Fraudulent Misrepresentation, Negligent
Misrepresentation, and Violations of Cal. Civil Code § 1572.

Plaintiff has also sufficiently alleged facts supporting her claims for fraudulent

3 misrepresentation, negligent misrepresentation, and violations of California Civil Code § 1572. In
4 addition, Plaintiff has alleged each of the elements required in each fraud cause of action with the
5 particularity required by Federal Rule of Civil Procedure 9(b). The Court should thus deny
6 Google’s Motion to Dismiss Plaintiff’s fraud claims.
7
8

1.

Plaintiff’s Allegations Identifying Google’s Fraudulent Conduct Satisfy
the Pleading Requirements of Rule 9(b).

Despite Google’s contention to the contrary, Plaintiff’s claims sounding in fraud are
9
alleged with sufficient specificity to satisfy the particularity required by Federal Rule of Civil
10
Procedure 9(b), which requires a plaintiff to allege “the who, what, when, where, and how” of the
11
alleged fraudulent conduct and “set forth an explanation as to why [a] statement or omission
12
complained of was false or misleading.” AOL, 719 F. Supp. 2d at 1112 (internal citations omitted).
13
The purpose of Rule 9(b) “is to ensure that defendants accused of the conduct specified have
14
adequate notice of what they are alleged to have done, so that they may defend against the
15
accusations.” Concha v. London, 62 F.3d 1493, 1502 (9th Cir. 1995).
16
Here, Plaintiff repeatedly identifies Google as the entity responsible for the actionable
17
misrepresentations and omissions. (FAC ¶¶ 20–25.) Plaintiff has identified the substance of the
18
misrepresentations in Google’s Privacy Policy by explicitly alleging numerous untrue and
19
misleading statements relating to Google’s handling, protection, and disclosure of its users’
20
personal information, among other things. (Id.) The complaint includes the time frame of the
21
misrepresentations, providing dates for each statement and action by Google, and consistently
22
identifies where the statements occurred. (Id.) Finally, Plaintiff alleges in detail how the
23
representations were false and misleading because Google has consistently disclosed search
24
queries to marketers, data brokers, and other third parties in violation of its own policies and
25
representations to users. (Id. ¶¶ 39–41, 108, 113, 125–26.) In short, Plaintiff’s allegations are more
26
than sufficient to put Google on notice of the precise statements and conduct that Plaintiff has
27
alleged to be fraudulent, and how the Plaintiff was damaged thereby.
28
21

PL.’S OPP’N TO GOOGLE’S MOT. TO DISMISS FAC
5:10-CV-04809

1

2.

Plaintiff Has Stated a Claim for Fraudulent Misrepresentation.

In addition to satisfying the particularity requirements of Rule 9(b), the First Amended
2
Complaint also satisfactorily states a claim for Fraudulent Misrepresentation. To show fraudulent
3
misrepresentation under California law, a Plaintiff must establish: (1) that the defendant made a
4
misrepresentation; (2) knowledge of the falsity of the misrepresentation; (3) intent to defraud or to
5
induce reliance; (4) reasonable reliance; and (5) resulting damage. Agosta v. Astor, 120 Cal. App.
6
4th 596, 603 (2004).
7
The First Amended Complaint contains detailed allegations of Google’s misrepresentations
8
with respect to its users’ personal information. (FAC ¶¶ 20–25, 106.) Plaintiff also alleges that
9
Google knew its misrepresentations were false, because Google disclosed its queries to numerous
10
third parties. (Id. ¶¶ 39–41, 108, 113, 125–26.) Plaintiff further alleges that Google intended for its
11
representations to induce reliance on the part of Class members by causing Class members to use
12
Google’s services. (Id. ¶ 28.) Plaintiff alleges that she relied on Google’s misrepresentations when
13
making her decision to use Google’s services. (Id. ¶¶ 109, 115.) Finally, the Plaintiff has alleged
14
that Google’s misrepresentations injured her by disclosing her sensitive personal information to
15
third parties. (Id. ¶¶ 110, 116.)
16
Google argues that the Plaintiff must allege actual reliance on Google’s misrepresentations,
17
and that “Plaintiff cannot rely on an inference of reliance.” (MTD at 20.) It is unclear why Google
18
argues that Plaintiff requires an inference of reliance to state a claim for fraudulent
19
misrepresentation because Plaintiff explicitly alleges that she relied on Google’s
20
misrepresentations: “Plaintiff … relied on Google’s fraudulent misrepresentations in agreeing to
21
use Google’s search services … .” (FAC ¶ 109). Plaintiff has alleged each of the necessary
22
elements to state a claim for fraudulent misrepresentation. Google’s Motion to Dismiss is thus
23
inappropriate and should be denied.
24
25

3.

Plaintiff Properly States a Claim for Negligent Misrepresentation.

Plaintiff’s allegations also satisfy the requirements for negligent misrepresentation. The
26
elements of negligent misrepresentation are similar to those for fraudulent misrepresentation: “(1)
27
the misrepresentation of a past or existing material fact, (2) without reasonable ground for
28
22

PL.’S OPP’N TO GOOGLE’S MOT. TO DISMISS FAC
5:10-CV-04809

1 believing it to be true, (3) with intent to induce another's reliance on the fact misrepresented, (4)
2 justifiable reliance on the misrepresentation, and (5) resulting damage.” National Union Fire Ins.
3 Co. v. Cambridge Integrated Services Group, Inc., 171 Cal. App. 4th 35, 50 (2009).
4

As discussed above, Plaintiff has alleged: several misrepresentations by Google; that

5 Google intended for Plaintiff to rely on its misrepresentations; that Plaintiff did rely on Google’s
6 misrepresentations; and that Plaintiff was damaged as a result. Because Plaintiff also alleges that
7 Google disclosed search results to numerous third parties, (FAC ¶¶ 39–41, 108, 113, 125–26),
8 Google had no reason to believe that its misrepresentations were true. Plaintiff has thus alleged
9 each of the elements necessary to state a claim for negligent misrepresentation.
10

4.

11

Plaintiff Has Stated a Claim for Actual Fraud Pursuant to California
Civil Code Section 1572.

Plaintiff’s First Amended Complaint contains allegations sufficient to state a claim for
12
actual fraud under California Civil Code § 1572. Under California law, a claim for actual fraud
13
requires (1) a false representation, concealment, or nondisclosure from defendant; (2) knowledge
14
of falsity; (3) intent to induce reliance; (4) justifiable reliance; (5) resulting damage. Aqua-Lung
15
America, Inc. v. American Underwater Products, Inc., 709 F. Supp. 2d 773, 785 (N.D. Cal. 2010).
16
As discussed above, Plaintiff has alleged several misrepresentations by Google; that Google
17
intended for the Plaintiff to rely on its misrepresentations; that the Plaintiff did rely on Google’s
18
misrepresentations; and that the Plaintiff was damaged as a result.
19
As Plaintiff has successfully alleged each of the above elements, she thus states a claim
20
under § 1572. While Google is correct that § 1572 only applies to fraud committed by a party to a
21
contract, as discussed above, the Plaintiff has alleged the existence of a contract between Google
22
and the Plaintiff. For these reasons, Plaintiff has sufficiently stated a claim for actual fraud under
23
California Civil Code § 1572.
24
25

F.

Plaintiff has Adequately Alleged a Claim for Unjust Enrichment.

Google states that Plaintiff’s claim for unjust enrichment must fail as a matter of law
26
because California law recognizes no such cause of action. Contrary to Google’s blanket assertion,
27
California courts have recognized an independent cause of action for unjust enrichment. See
28
23

PL.’S OPP’N TO GOOGLE’S MOT. TO DISMISS FAC
5:10-CV-04809

1 Villager Franchise Sys. v. Dhami, Dhami & Virk, CF-F-04-6393, 2006 WL 22425, at *7 (E.D.
2 Cal. Jan. 26, 2006) (“California law recognizes a cause of action for unjust enrichment” and
3 requires a defendant to make restitution who has unjustly retained a benefit from plaintiff);
4 Gerlinger v. Amazon.Com, Inc., 311 F. Supp. 2d 838, 856 (N.D. Cal. 2004) (“Under California
5 law, unjust enrichment is an action in quasi-contract”); Hirsch v. Bank of America, 107 Cal. App.
6 4th 708, 722 (2003) (finding that plaintiff stated a valid cause of action for unjust enrichment
7 based on defendant’s unjustified retention of excessive fees). The requisite elements for an unjust
8 enrichment claim are the “receipt of a benefit and [the] unjust retention of the benefit at the
9 expense of another.” Peterson v. Cellco Partnership, 164 Cal. App. 4th 1583, 1593 (2008).
10

Google also argues that Plaintiff has not alleged that any benefit was conferred to Google

11 at the Plaintiff’s expense. Despite Google’s protestations to the contrary, Plaintiff alleges that she
12 was injured by Google’s disclosure of her search queries to third parties. (FAC ¶¶ 80, 110, 116,
13 119, 132.) However, assuming arguendo that Plaintiff has not alleged that she was damaged by
14 Google’s conduct, an aggrieved party may maintain a claim for unjust enrichment without
15 suffering actual damages. See County of San Bernardino v. Wash, 158 Cal. App. 4th 533, 541
16 (2008) (“the public policy of [California] does not permit one to ‘take advantage of his own
17 wrong’ regardless of whether the other party suffers actual damage.”). As a result, where “a
18 benefit has been received by the defendant but the plaintiff has not suffered a corresponding loss
19 or, in some cases, any loss, but nevertheless the enrichment of the defendant would be unjust . . .
20 [t]he defendant may be under a duty to give to the plaintiff the amount by which [the defendant]
21 has been enriched.” Id. (citing Restatement Restitution, § 1, com. e.) In other words, the
22 “emphasis is on the wrongdoer’s enrichment, not the victim’s loss.” Id.; see also Ward v. Taggart,
23 51 Cal. 2d 736, 741-742 (1959); California v. Levi Strauss & Co., 41 Cal. 3d 460, 472 (1986).
24

Here, Plaintiff alleges that she and the putative class have conferred a substantial benefit

25 upon Defendant because Google has shared its users’ search queries with numerous third parties
26 without users’ consent, causing Google to obtain substantial revenues from advertisers. (FAC
27 ¶ 134.) Moreover, Plaintiff alleges that the information disclosed and exploited for profit by
28
24

PL.’S OPP’N TO GOOGLE’S MOT. TO DISMISS FAC
5:10-CV-04809

1 Google belonged to and was valuable to Plaintiff. (Id. ¶ 134.) And while Plaintiff’s individual loss
2 and Google’s substantial benefit may not be equal, the “principle of unjust enrichment, however,
3 is broader than mere ‘restoration’ of what the plaintiff lost. Many instances of ‘liability based on
4 unjust enrichment . . . do not involve the restoration of anything the claimant previously possessed
5 . . . includ[ing] cases involving the disgorgement of profits . . . wrongfully obtained.” County of
6 San Bernardino, 158 Cal. App. 4th at 541. These allegations, which must be accepted as true for
7 purposes of a 12(b)(6) motion, are sufficient to state a claim for unjust enrichment under
8 California law.
9 V.
10

CONCLUSION
For the foregoing reasons, this Court should deny Google’s Motion to Dismiss under Rule

11 12(b)(1) as to Plaintiff’s ECPA claims, and under Rules 12(b)(1) and 12(b)(6) as to Plaintiff’s
12 public disclosure of private facts claim, her breach of contract claim, her fraudulent
13 misrepresentation claim, her negligent misrepresentation claim, her statutory fraud claim, and her
14 unjust enrichment claim. Alternatively, the Court should grant Plaintiff leave to amend her
15 complaint in order to remedy any pleading deficiencies, as necessary.
16
17

Dated: October 7, 2011

Respectfully submitted,
NASSIRI & JUNG LLP

18

/s/ Kassra P. Nassiri______
Kassra P. Nassiri
Attorneys for Plaintiff and the Putative Class

19
20 Dated: October 7, 2011

Respectfully submitted,
ASCHENBRENER LAW, P.C.

21

/s/ Michael J. Aschenbrener_
Michael J. Aschenbrener
Attorneys for Plaintiff and the Putative Class

22
23
24
25
26
27
28
25

PL.’S OPP’N TO GOOGLE’S MOT. TO DISMISS FAC
5:10-CV-04809