In re Google Referrer Header Privacy Litigation

Filing 38

ORDER by Hon. Edward J. Davila GRANTING IN PART AND DENYING IN PART #29 Motion to Dismiss. with leave to amend as to all other claims. Gaos may file any amended complaint no later than May 1, 2012. (ejdlc3, COURT STAFF) (Filed on 3/29/2012) Modified on 3/29/2012 (cv, COURT STAFF).

1
2
3
4
5
6
7
UNITED STATES DISTRICT COURT

8

NORTHERN DISTRICT OF CALIFORNIA

9

SAN JOSE DIVISION

United States District Court
For the Northern District of California

10
11

PALOMA GAOS,
Plaintiff,

12
13
14
15

v.
GOOGLE INC.,
Defendant.

16
17

)
)
)
)
)
)
)
)
)
)
)

Case No.: 5:10-CV-4809 EJD
ORDER GRANTING-IN-PART AND
DENYING-IN-PART MOTION TO
DISMISS
(Re: Docket No. 29)

Pending before the court is Defendant Google Inc.’s (“Google”) motion to dismiss the First

18

Amended Complaint (“FAC”). On May 16, 2011, Google filed this motion to dismiss. The court

19

heard oral argument on October 28, 2011. For the reasons discussed below, Google’s motion is

20

GRANTED IN PART as to claims 2-7 and DENIED IN PART as to claim 1.

21

I. BACKGROUND

22

On October 25, 2010, Plaintiff Paloma Gaos (“Gaos”) filed the Complaint initiating this

23

action. On April 7, 2011, Chief Judge Ware granted Google’s motion to dismiss the Complaint

24

with leave to amend because Gaos had failed to allege an “injury in fact” sufficient to establish

25

Article III standing. See ECF No. 24. On May 2, 2011, Gaos filed the FAC. In the FAC, Gaos

26

makes the following allegations:

27
28
1
Case No.: 5:10-CV-4809 EJD
ORDER GRANTING-IN-PART AND DENYING-IN-PART MOTION TO DIMISS

1

Gaos is a resident of San Francisco County, California. FAC ¶ 6. Google is a Delaware

2

corporation that maintains its headquarters in Mountain View, California. Id. ¶ 7. Defendant

3

conducts business throughout California and the nation. Id.

4

Defendant’s primary business enterprise centers on its proprietary search engine. Id. ¶ 13.

5

Defendant runs millions of servers around the world and processes over one billion user-generated

6

search requests every day. Id. Defendant generates substantial profits from selling advertising. Id.

7

¶ 14. Defendant is able to operate its search engine more efficiently by analyzing user search data

8

and Defendant benefits from Search Engine Optimization (“SEO”) companies who also use this

9

data to better target their websites to particular user search terms. Id. ¶ 17.

United States District Court
For the Northern District of California

10

Since the launch of Defendant’s search service, and continuing until the present,

11

Defendant’s search engine has intentionally included the search terms in the URL of the search

12

results page. Id. ¶ 39. Neither Defendant’s search technology nor the technological architecture of

13

the Internet requires Defendant divulge these search terms. Id. ¶ 43. As a result of the search terms

14

being included in the URL, when a user of Defendant’s search service clicks on a link from

15

Defendant’s search results page, the owner of the website that the user clicks on will receive the

16

user’s search terms in the Referrer Header from Defendant. Id. ¶ 40. Several web analytics services

17

parse the search query information from web server logs, or otherwise collect the search query

18

from the Referrer Header transmitted by each visitor’s web browser. Id. ¶ 41. Defendant’s own

19

analytics products provide webmasters with this information in the aggregate. Id.

20

Search terms could be linked together with the identity of the user through the process of

21

“reidentification,” either by linking the terms with the user’s IP address, which is also sometimes

22

released with the clicked link; with any cookies stored on the user’s computer; or with “vanity

23

searches,” where the user searches for their own name. Id. ¶¶ 32, 60-63.

24

On the basis of the allegations outlined above, Plaintiff brings seven causes of action: (1)

25

Violation of the Electronic Communications Privacy Act, 18 U.S.C. § 2510, specifically of the

26

Stored Communications Act (“SCA”), 18 U.S.C. § 2701; (2) Fraudulent Misrepresentation; (3)

27

Negligent Misrepresentation; (4) Public Disclosure of Private Facts; (5) Actual and Constructive

28

Fraud; (6) Breach of Contract; and (7) Unjust Enrichment.
2
Case No.: 5:10-CV-4809 EJD
ORDER GRANTING-IN-PART AND DENYING-IN-PART MOTION TO DIMISS

1

On May 16, 2011, Google filed this motion to dismiss arguing that this court lacks subject

2

matter jurisdiction because Gaos has again failed to establish that she has standing under Article III

3

of the United States Constitution because she has not alleged she suffered an injury in fact. In the

4

alternative, Google argues that the FAC should be dismissed because Gaos has failed to state a

5

claim upon which relief can be granted as to her privacy claim, breach of contract claim, fraud-

6

based claims, and unjust enrichment claim. Additionally, Google argues that all the state-law

7

claims are preempted by the SCA.

8

II. LEGAL STANDARDS
An Article III federal court must ask whether a plaintiff has suffered sufficient injury to

10
United States District Court
For the Northern District of California

9

satisfy the “case or controversy” requirement of Article III of the U.S. Constitution. To satisfy

11

Article III standing, plaintiff must allege: (1) an injury in fact that is concrete and particularized, as

12

well as actual and imminent; (2) that the injury is fairly traceable to the challenged action of the

13

defendant; and (3) that it is likely (not merely speculative) that injury will be redressed by a

14

favorable decision. Friends of the Earth, Inc. v. Laidlaw Envtl. Servs. (TOC), Inc., 528 U.S. 167,

15

180-81 (2000); Lujan v. Defenders of Wildlife, 504 U.S. 555, 561-62 (1992). A suit brought by a

16

plaintiff without Article III standing is not a “case or controversy,” and an Article III federal court

17

there- fore lacks subject matter jurisdiction over the suit. Steel Co. v. Citizens for a Better

18

Environment, 523 U.S. 83, 101 (1998). In that event, the suit should be dismissed under Rule

19

12(b)(1). See id. at 109-110. At least one named plaintiff must have suffered an injury in fact. See

20

Lierboe v. State Farm Mut. Auto. Ins. Co., 350 F.3d 1018, 1022 (9th Cir. 2003) (“[I]f none of the

21

named plaintiffs purporting to represent a class establishes the requisite of a case or controversy

22

with the defendants, none may seek relief on behalf of himself or any other member of the class.”).

23

III. DISCUSSION

24
25

A. Claims 2-7
Google argues that Gaos has failed to allege that she has suffered an injury in fact that is

26

concrete and particularized as well as actual and imminent. As the sole named plaintiff in this

27

action, Gaos alleged she “has suffered actual harm in the form of Google’s unauthorized and

28

unlawful dissemination of Plaintiff’s search queries, which contained sensitive personal
3
Case No.: 5:10-CV-4809 EJD
ORDER GRANTING-IN-PART AND DENYING-IN-PART MOTION TO DIMISS

1

information, to third parties.” FAC ¶ 80. Gaos does not identify what injury resulted from this

2

dissemination. Additionally, the FAC states only that Gaos searched for her name and her family’s

3

names. FAC ¶ 77. Thus, the FAC does not plead facts sufficient to show that the disseminated

4

information is of a nature that places her in imminent danger of harm. Cf. Doe I v. AOL, LLC, 719

5

F. Supp. 2d 1102 (N.D. Cal. 2010) (finding injury in fact where database of search queries was

6

posted online containing AOL members’ names, social security numbers, addresses, telephone

7

numbers, user names, passwords, and bank account information which could be matched to

8

specific AOL members); Krottner v. Starbucks Corp., 628 F.3d 1139, 1140 (9th Cir. 2010) (finding

9

injury in fact where a laptop containing names, address, and social security numbers of Starbucks

United States District Court
For the Northern District of California

10

employees was stolen putting employees at risk of future identity theft). Thus, Gaos has not alleged

11

injury sufficient for Article III standing with respect to her non-statutory causes of action,

12

claims 2–7.1
Accordingly, Google’s motion to dismiss is GRANTED with leave to amend as to

13
14

claims 2–7.

15

B. Claim 1: Violation of the SCA
The injury required by Article III, however, can exist solely by virtue of “statutes creating

16
17

legal rights, the invasion of which creates standing.” Edwards v. First Am. Corp., 610 F.3d 514,

18

517 (9th Cir. 2010) (quoting Warth v. Seldin, 422 U.S. 490, 500 (1975)). In such cases, the

19

“standing question . . . is whether the constitutional or statutory provision on which the claim rests

20

properly can be understood as granting persons in the plaintiff’s position a right to judicial relief.”

21

Id. (quoting Warth, 422 U.S. at 500). Although “Congress cannot erase Article III's standing

22

requirements by statutorily granting the right to sue to a plaintiff who would not otherwise have

23

standing,” Raines v. Byrd, 521 U.S. 811, 820 n.3 (1997), a plaintiff may be able to establish

24
25
26
27

1

Because the court finds that Gaos has failed to establish Article III standing for her state-law
claims, it need not address Defendant’s alternative arguments that Plaintiff’s claims fail under Fed.
R. Civ. P. 12(b)(6) or are preempted.

28
4
Case No.: 5:10-CV-4809 EJD
ORDER GRANTING-IN-PART AND DENYING-IN-PART MOTION TO DIMISS

1

constitutional injury in fact by pleading a violation of a right conferred by statute so long as she can

2

allege that the injury she suffered was specific to her, see Warth, 422 U.S. at 501.

3

Gaos argues she has alleged an injury in fact based on a violation of her rights under the

4

SCA, which prohibits an electronic communication service from divulging the contents of a

5

communication in electronic storage, 18 U.S.C. § 2702(a)(1), and prohibits a remote computing

6

service from divulging the contents of communications carried or maintained on that service, 18

7

U.S.C. § 2702(a)(2).2 Google offers two arguments that Gaos lacks standing to bring this SCA

8

claim.
First, Google argues that Gaos has failed to allege any injury resulting from the SCA

10
United States District Court
For the Northern District of California

9

violation. Google, however, has not cited any authority supporting its argument that injury beyond

11

a violation of the SCA itself is required to allege a concrete injury. The court finds that the SCA

12

creates a right to be free from the unlawful disclosure of communications as prohibited by the

13

statute. The SCA explicitly creates a private right of action for persons aggrieved by a disclosure of

14

their communications in violation of the statute. 18 U.S.C. § 2702(a) (providing that “any . . .

15

person aggrieved by any violation of this chapter” may maintain a civil action if the violation was

16

done knowingly or intentionally). Google’s argument fails because the SCA provides a right to

17

judicial relief based only on a violation of the statute without additional injury. Thus, a violation of

18

one’s statutory rights under the SCA is a concrete injury. See Jewel v. National Sec. Agency, 2011

19

WL 6848406, at *4 (9th Cir. 2011) (finding violation of the SCA to be a concrete injury).
Gaos must also allege that the injury she suffered was particularized to her. “The critical

20
21

question is whether she ‘has alleged such a personal stake in the outcome of the controversy as to

22

warrant . . . invocation of federal court jurisdiction.’” Id. (citing Summers v. Earth Island Inst., 555

23

U.S. 488, 493 (2009)). In pertinent part, the FAC states that Gaos conducted numerous searches,

24

including searches for her name and her family members’ names, and clicked on links on her

25

2

26
27
28

On November 16, 2011, Google submitted a Statement of Recent Decision regarding the Order
Granting Defendant’s Motion To Dismiss in Low v. LinkedIn Corp., 2011 WL 5509848, Case No.
11-CV-1467-LHK (N.D. Cal. Nov. 11, 2011). This order, however, specifically states that it does
not address whether the creation of a statutory right by the SCA is sufficient to confer standing on
Plaintiff. See Low, 2011 WL 5509848, at *6 n.1. Thus, the decision is not instructive on the issue
of injury based on a statutory right.
5
Case No.: 5:10-CV-4809 EJD
ORDER GRANTING-IN-PART AND DENYING-IN-PART MOTION TO DIMISS

1

Google search results pages. The FAC further alleges that Google sent the URLs containing her

2

search queries to third party websites that appeared in the Google search results page, and that this

3

transmission was unlawful and unauthorized. FAC. ¶¶ 76-80. In sum, Gaos alleges that her search

4

queries were disclosed without her authorization, provides examples of those queries, and explains

5

how and by whom that disclosure was made. Because Gaos’s alleged injuries were to her rights

6

under the SCA, rather than some generalized right, Gaos’s injuries are sufficiently particularized—

7

even if many other people were similarly injured. See Jewel at *7 (“[T]he fact that a harm is widely

8

shared does not necessarily render it a generalized grievance.”).

9

Additionally, Google argues that Gaos failed to correct the deficiencies identified by Chief

United States District Court
For the Northern District of California

10

Judge Ware in the order dismissing the original complaint. Specifically, Google argues that the

11

FAC still includes “conclusory allegations of disclosures of communications resulting in

12

unspecified harm in violation of the ECPA, not supported by any facts, [which] are insufficient to

13

allege violation of [Gaos’s] statutory rights.” Google Inc.’s Mot. to Dismiss at 6, ECF No. 29

14

(quoting Order Granting Defs.’ Mot. To Dismiss at 5, ECF No. 24). Gaos argues the FAC

15

remedied the problems identified by Chief Judge Ware by adding allegations about the disclosure

16

of her own search queries. Google does not identify any element of an SCA claim that it argues has

17

been pleaded in a conclusory or otherwise insufficient manner in the FAC.3 Rather, Google’s

18

argument focuses on Gaos’s failure to allege facts sufficient to specify harm resulting from the

19

disclosure. As discussed above, a violation of the SCA itself is injury sufficient to allege an SCA

20

claim. It is unclear whether Google objects to the pleadings on any other basis.4

21

3

22

Google argues for the first time in its reply brief that Gaos failed to allege her own lack of
knowledge and consent to the disclosure. The court will not address this argument because it was
raised after Gaos’s opposition was filed.

23

4

24
25
26
27
28

The court notes that although Gaos has alleged sufficient injury for standing based on a violation
of the SCA, this finding does not mean Gaos has properly stated a claim for relief under the SCA.
See Fraley v. Facebook, Inc., Case No. 11-CV-01726-LHK, 2011 WL 6303898, at *12 (N.D. Cal.
Dec. 16, 2011) (“That Plaintiffs have satisfied the injury-in-fact requirement for constitutional
standing does not necessarily mean they have properly stated a claim for relief.”); In re Facebook
Privacy Litigation, 791 F. Supp. 2d 705, 712-13 (N.D. Cal. 2011) (finding that plaintiffs had
alleged the injury required for Article III standing based on a violation of their statutory rights
under the Wiretap Act while also finding that plaintiffs’ allegations did not state a claim under the
Wiretap Act). Google’s motion does not place this latter issue before the court. Thus, the court
does not address whether Gaos’s allegations state a claim for relief under the SCA in this order.
6
Case No.: 5:10-CV-4809 EJD
ORDER GRANTING-IN-PART AND DENYING-IN-PART MOTION TO DIMISS

1

The court finds that Gaos has alleged a concrete and particularized injury in fact as a result

2

of the alleged violation of her statutory rights under the SCA. Accordingly, Google’s motion to

3

dismiss is DENIED as to Gaos’s SCA claim.

4
5

IV. CONCLUSION
Google’s motion to dismiss is DENIED IN PART as to Gaos’s SCA claim and GRANTED

6

IN PART with leave to amend as to all other claims. Gaos may file any amended complaint no

7

later than May 1, 2012.

8

IT IS SO ORDERED.

9

Dated: March 29, 2012

United States District Court
For the Northern District of California

10
11

_________________________________
EDWARD J. DAVILA
United States District Judge

12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
7
Case No.: 5:10-CV-4809 EJD
ORDER GRANTING-IN-PART AND DENYING-IN-PART MOTION TO DIMISS