Low v. Linkedin Corporation

Filing 36

OPPOSITION to ( 34 MOTION to Dismiss Amended Complaint ) filed by Kevin Low, Alan Masand. (Seidman, Peter) (Filed on 2/2/2012) Modified text on 2/3/2012 (dhm, COURT STAFF).

1
2
3
4
5
6
7
8

Sanford P. Dumain
Peter E. Seidman
Charles Slidders
Melissa Ryan Clark
MILBERG LLP
One Pennsylvania Plaza
New York, NY 10119
Telephone:
[phone]
Facsimile:
[phone]
Email: [e-mail]
Email: [e-mail]
Email: [e-mail]
Email: [e-mail]

12

Michael R. Reese (SBN 206773)
Kim E. Richman
REESE RICHMAN LLP
875 Avenue of the Ameircas
New York, NY 10001
Telephone:
[phone]
Facsimile:
[phone]
Email: [e-mail]
Email: [e-mail]

13

Attorneys for Plaintiff

9
10
11

14
15

UNITED STATES DISTRICT COURT

16

NORTHERN DISTRICT OF CALIFORNIA

17

SAN JOSE DIVISION

18

KEVIN LOW, individually and on behalf of all
others similarly situated,

19
Plaintiff,
20
v.
21
22
23
24
25

LINKEDIN CORPORATION, a California
Corporation, and Does 1 to 50 inclusive,
Defendant.

) Case No. CV-11-01468
)
) PLAINTIFFS' OPPOSITION TO
) DEFENDANT'S MOTION TO DISMISS
) THE AMENDED CLASS ACTION
) COMPLAINT
)
) DATE:
March 22, 2012
) TIME:
1:30 p.m.
HON. LUCY H. KOH
) JUDGE:
) COURTROOM: 4, 5th Floor
)
)
)
)

26
27
28
PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT

1

TABLE OF CONTENTS

2

Page

3

INTRODUCTION

1

4

ARGUMENT

3

5

I.

6

PLAINTIFFS HAVE ARTICLE III AND PRUDENTIAL STANDING TO
SUE
A.

7
8

B.

9
10

C.

11
12

II.

13

3

Plaintiffs' Allegations are Far More Concrete and Particularized than
What the Ninth Circuit Requires for Standing Purposes

4

By Alleging Disclosure of Valuable and Sensitive Personal
Information, Plaintiffs Have Established Their Standing With
Respect to All Their Claims

7

LINKEDIN VIOLATED THE RIGHT TO PRIVACY ARISING FROM
CALIFORNIA'S STATE CONSTITUTION AND COMMON LAW

10

16

LinkedIn Violated California's State Constitution

10

B.

15

Plaintiffs Allege Conduct by Defendant that Constitutes a Serious
Invasion of Privacy

11

LinkedIn's Conduct Is Highly Offensive To A Reasonable Person
And Amounts To A Common Law Invasion Of Privacy

13

C.

17
III.

19

PLAINTIFFS HAVE ALLEGED VIOLATIONS OF THE STORED
COMMUNICATIONS ACT
A.

14

LinkedIn Improperly Divulged Communications in Its Capacity as
an RCS

14

B.

Linkedln Is an RCS that "Carried or Maintained" a Communication

16

C.

Linkedln Divulged the "Content" of Communications

16

20
21
22

1.

25
26

D.

27
IV.

17

Plaintiffs' Linkedln IDs are Content

18

3.

24

Plaintiffs' Linkedln-Related Browsing History Is "Content"

2.

23

28

Plaintiffs Satisfied the Injury in Fact Requirement By Pleading That
Defendant Violated Their Rights Under the SCA and California
Constitution

A.

14

18

3

Even if the Linkedln IDs Were "Records," Linkedln Still
Violated the SCA by Revealing Them With Content

19

Linkedln Was Not Authorized to Divulge Its Subscribers'
Communications

LINKEDIN VIOLATED CALIFORNIA'S FALSE ADVERTISING LAW
PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT

22
24

1
2
3
4
5

V. PLAINTIFFS' CONTRACT CLAIM ALLEGES RECOVERABLE
DAMAGES

26

VI. DEFENDANT CONVERTED PLAINTIFFS' PROPERTY

26

VII. THE AMENDED COMPLAINT ADEQUATELY STATES A CLAIM
FOR NEGLIGENCE

28

CONCLUSION

28

6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
- ii PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT

1
TABLE OF AUTHORITIES

2

Page(s)

3
CASES

4
5
6
7
8

Ali v. Fasteners for Retail, Inc.,
544 F. Supp. 2d 1064 (E.D. Cal. 2008)

25

In re Application of U.S. for
an Order Authorizing use of A Pen Register, 396 F. Supp. 2d 45 (D.Mass. 2005)
Boon Rawd Trading Int'l Co., Ltd. v. Paleewong Trading Co.,
688 F. Supp. 2d 940 (N.D. Cal. 2010)

16, 17
24

9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

Crispin v. Audigier,
717 F. Supp. 2d 965 (C.D. Cal. 2010)

16, 20

Edwards v. First Am. Corp.,
517 F. Supp. 2d 1199 (C.D. Cal. 2007)

3,, 6
4

Edwards v. First Am. Corp.,
610 F.3d 514 (9th Cir. 2010), cert. granted, 131 S. Ct. 3022 (2011)

3, 4

In re Facebook Privacy Litig.,
791 F. Supp. 2d 705 (N.D. Cal. 2011)

21

In re Facebook Privacy Litig.,
No. 10-02389, 2011 U.S. Dist. LEXIS 147345 (N.D. Cal. Nov. 22, 2011)

21

Folgelstrom v. Lamps Plus Inc.,
195 Cal. App. 4th 986 (2011)

12

Fraley v. Facebook, Inc.,
No. 11-01726-LHK, 2011 U.S. Dist. LEXIS 145195 (N.D. Cal. Dec. 16, 2011)

21

Fulfillment Servs. Inc. v. UPS, Inc.,
528 F.3d 614 (9th Cir. 2008)

3

Hepting v. AT&T Corp.,
439 F. Supp. 2d 974 (N.D. Cal. 2006)

4

Hill v. MCI WorldCom Commc'ns, Inc.,
120 F. Supp. 2d 1194 (S.D. Iowa 2000)

19

Hill v. NCAA,
7 Cal. 4th 1 (1994)

9, 12, 24, 25

28
- iii PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT

1
2
3
4
5
6
7
8
9
10

Jessup-Morgan v. Am. Online, Inc.,
20 F. Supp. 2d 1105 (E.D. Mich. 1998)

19

Jewel v. Nat'l Sec. Agency,
No. 10-15616, 2011 U.S. App. LEXIS 25951 (9th Cir. Dec. 29, 2011)

3,, 6
4

NAACP v. Alabama,
357 U.S. 449 (1958)

10

O'Grady v. Super. Ct.,
129 Cal. App. 4th 1423 (2006)

18

In re Pharmatrak, Inc.,
329 F.3d 9 (1st Cir. 2003)

16

Quon v. Arch Wireless Operating Co.,
529 F.3d 892, rev'd on other grounds sub nom. City of Ontario v. Quon, 130 S. Ct.
2619 (2010)

13

11
12
13
14
15

Rowe v. UniCare Life & Health Ins. Co.,
No. 09-2286, 2010 U.S. Dist. LEXIS 1576 (N.D. Ill. Jan. 5, 2010)
Ruiz v. Gap, Inc.,
540 F. Supp. 2d 1121 (N.D. Cal. 2008)

7
12, 24, 25

Ruiz v. Gap, Inc.,
380 F. App'x 689 (9th Cir. 2010)

9

16
17
18
19
20
21
22
23
24
25
26

In re Tobacco II Cases,
46 Cal. 4th 298 (2009)

23

United States v. Davis,
Crim. No. 10-339, 2011 U.S. Dist. LEXIS 56002 (D. Or. May 24, 2011)

18

United States v. Forrester,
512 F.3d 500 (9th Cir. 2008)

15, 16, 18, 19

United States v. Jones,
No. 10-1259, 2012 U.S. LEXIS 1063 (Jan. 23, 2012)
United States v. Maynard,
615 F.3d 544 (D.C. Cir. 2010), aff'd, United States v. Jones,
No. 1259, 2012 U.S. LEXIS 1063 (Jan. 23, 2012)

10, 11, 12

12, 13

STATUTES

4

12 U.S.C. § 2601

27

14

18 U.S.C. § 2510(8)
28
- iv PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT

1

18 U.S.C. § 2510(12)

2

18 U.S.C. § 2702

3

Cal. Civ. Code § 3344

4
5
6

14
passim
3

OTHER AUTHORITIES

15

1986 U.S.C.C.A.N. 3555

16, 18

H.R. Rep. No. 99-647 (1986)

7
8
9
10
11
12
13
14
15
16
17
18

Joseph Turow, Jennifer King, Chris Jay Hoofnagle, Amy Blealdey, and Michael
Hennessy, Americans Reject Tailored Advertising and Three Activities that Enable It
(Sept. 29, 2009)

24

Orrin S. Kerr, The Future of Internet Surveillance Law,
72 Geo. Wash. L. Rev. 1208 (Aug. 2004)

15

Oirn S. Kerr, Internet Surveillance Law After the USA Patriot Act: The Big Brother That
Isn't, 97 Nw. U. L. Rev. 607 (2003)

15

Pamela Jones Harbour, Federal Trade Center (FTC) Commissioner, FTC Roundtable
Series I on Exploring Privacy (Matter No. P095416), Dec. 7, 2009

22

Paul M. Schwartz, Property, Privacy, and Personal Data, 117 Harv. L. Rev. 2055, 205657 (May 2004)

22

Somini Sengupta & Evelyn M. Rusli, Personal Data's Value? Facebook Is Set To Find
Out, N.Y. Times, Jan. 31, 2012, available at
http://www.nytimes.com/2012/02/01/technology/riding-personal-data-facebook-isgoing-public.html

8

19
20
21
22
23
24
25
26
27
28
-vPLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT

1

INTRODUCTION

2

According to LinkedIn, a doctor could provide your name to a pharmaceutical company

3

that has otherwise-anonymous data regarding your prescription use and health; your Internet

4

service provider could provide your name to a marketing company to which you provided

5

otherwise-anonymous information via a survey; or a government could provide your name to a

6

laboratory through which you obtained otherwise-anonymous HIV testing, and yet this wrongful

7

disclosure of your personal information would not be actionable. According to Defendant, you

8

would lack Article In standing — i.e., even a "trilfe" of interest in the outcome of a litigation

9

unless you can show that the third parties that were wrongfully provided your information were

10

not just motivated by profit to match your identity with the otherwise-anonymous information

11

they possessed, and capable of doing so because of the context of the wrongful disclosure, but

12

that they actually did so. See Def. Mem. at 2. According to Defendant, this conduct would not

13

be a substantial invasion of privacy because disclosing a name alone is not an invasion, and thus

14

disclosing a name in any context is permissible. See id. at 16-17. According to Defendant,

15

explicit assurances that any information provided to third parties about you would "not be

16

personally identifiable" and would be "anonymized," as well as claims that your pirvacy would

17

be taken "very seriously" because "maintaining your trust is [their] top concern," are not

18

sufficiently particular and do not demonstrate that relying on such language resulted in the injury

19

caused when these promises were violated. See id. at 20, 23-24; see also IR 49-56. 1 Linkedln

20

would like this Court to hold that a plaintiff cannot even provide a "short and plain," "plausible"

21

ground for relief when it alleges that a company allowed his personal, private information to be

22

de-anonymized. Such a result is unjust, and unsupported by law.

23

Linkedln also argues that the Amended Complaint still contains deficiencies that were

24

present in the initial complaint, which was dismissed without prejudice for failure to allege

25

Article In standing. Def. Mem. at 1-10. The Court' s order dismissing the initial complaint held,

26

in part, that there were insufficient allegations regarding the harm to Mr. Low, noting that it was

27
28

1 References to "9[ _" are references to paragraphs of the Amended Complaint.
PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT

1

"unclear from the face of the complaint what information was actually disclosed to third parties

2

that would lead Plaintiff to suffer emotional harm" or "how third party advertisers would be able

3

to infer Low's personal identity from LinkedIn's anonymous user

4

browsing history." Order Granting Defendant's Motion To Dismiss, Low v. Linkedln Corp., No.

5

11-01468-LHK (N.D. Cal. Nov. 11, 2011), ECF No. 28 ("Order"), at 5 (emphasis in oirginal).

6

The Amended Complaint explains in far greater detail how the third parties can determine

7

Plaintiffs' personal identities through LinkedIn user

8

actually correlated to their personal identities and profiles) and can match those LinkedIn IDs

9

with its own anonymous browsing data (because LinkedIn transmits the LinkedIn

combined with his

(which are not anonymous, but are

together

created by the third party), IN 5, 14-18, 28-36. The Amended Complaint

10

with an anonymous

11

also explains that Plaintiffs' personal browsing histories include visits to websites that they

12

consider private, including political, religious, and health-related websites

13

they would not have knowingly disclosed to third parties. (1[ 5. Thus, in addition to the standing

14

conferred by the Stored Communications Act and the California Constitution, the Amended

15

Complaint alleges standing because it establishes how "the injury [each Plaintiff] suffered was

16

specific to [them]"; how personally-identifiable and Internet behavioral information "has

17

concrete, measurable, and provable value in the economy at large"; and how Linkedln and the

18

third parties to which it divulged information can and do use Plaintiffs' personal information to

19

target advertising across various demographics, i.e., to other consumers, and not just for the

20

benefit of Plaintiffs. See Fraley v. Facebook, No. 11-01726-LHK, 2011 U.S. Dist. LEXIS

21

145195 (N.D. Cal. Dec. 16, 2001).

information that

22

Plaintiffs have stated a plausible claim, alleging that they are entitled to

23

compensatory and statutory damages and to injunctive relief because Linkedln

24

disclosed the profiles they viewed and allowed Third Parties to match their actual

25

identities with their private browsing histories. Consequently, Defendant's motion

26

to dismiss should be denied.2

27

Plaintiffs, recognizing that unjust enrichment is not a stand alone cause of action in California,
are not pursuing this claim. However, Plaintiffs maintain their claim for restitution as a remedy.
See Amended Complaint at 28; Fraley, 2011 U.S. Dist. LEXIS 145195.

28

2

-2PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT

1
2

ARGUMENT
I.

PLAINTIFFS HAVE ARTICLE III AND PRUDENTIAL STANDING TO
SUE

3
A.

4
5

To satisfy Article III standing, Plaintiffs "must allege [] injury-in-fact that is

6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

Plaintiffs Satisfied the Injury in Fact Requirement By Pleading That
Defendant Violated Their Rights Under the SCA and California
Constitution

concrete and particularized, as well as actual and imminent. "3

Order at 3.

Plaintiffs allege that Defendant invaded their rights under the California
Constitution and the Stored Communications Act ("SCA"), 919165-78. Under clear
Ninth Circuit authority, this alone is sufficient to confer injury in fact with respect
to their constitutional and SCA claims, respectively. Jewel v. Nat'l Sec. Agency,
No. 10-15616, 2011 U.S. App. LEXIS 25951, at *11 (9th Cir. Dec. 29, 2011)
(citing Lujan v. Defenders of Wildlife, 504 U.S. 555, 578 (1992)); Fulifllment
Servs. Inc. v. UPS, Inc., 528 F.3d 614, 618-19 (9th Cir. 2008); Edwards v. First

Am. Corp., 610 F.3d 514, 517 (9th Cir. 2010), cert. granted, 131 S. Ct. 3022
(2011) ("Edwards IP) ("The injury required by Article III can exist solely by
virtue of 'statutes creating legal rights, the invasion of which creates standing.'");
cf. Fraley, 2011 U.S. Dist. LEXIS 145195, at *22 (plaintiff 4alleged a violation of
their individual statutory rights under Califonria Civil Code § 3344, and therefore,
an invasion of a legally protected interest for Article III purposes."). Violation of a
constitutional provision also creates standing. Jewel, 2011 U.S. App. LEXIS
25951, at *4.

In such cases, the "'standing question . . . is whether the

constitutional or statutory provision on which the claim rests properly can be
understood as granting persons in the plaintiff's position a right to judicial relief. '''
Edwards II, 610 F.3d at 517 (citation omitted).

The SCA "explicitly creates a

26
3

27
28

Defendant has not really argued that Plaintiffs fail to meet the other standing requirements, i.e.,
that "(2) the injury is fairly traceable to the challenged action of the defendant; and (3) it is likely
(not merely speculative) that injury will be redressed by a favorable decision."
-3PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT

1

private right of action for claims of illegal surveillance," and it is now clear that an

2

allegation of violation of the SCA is sufficient to establish Article III standing,

3

Jewel, 2011 U.S. App. LEXIS 25951, at *11.

4
5
6
7
8
9

10
ii
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

B.

Plaintiffs' Allegations are Far More Concrete and Particularized than
What the Ninth Circuit Requires for Standing Purposes

Edwards and Jewel are the most recent Ninth Circuit authority directly
relevant to Article III standing. In both cases, the court held that plaintiffs had
standing to bring constitutional and statutory claims even though their allegations
were far less concrete and particularized than what Plaintiffs allege in the
Amended Complaint. Moreover, the SCA and Constitutional claims do not rely on
an economic value theory of personal information to establish injury-in-fact or
harm but rather on violation of well-established privacy rights.
In Edwards v. First Am. Corp., 517 F. Supp. 2d 1199 (C.D. Cal. 2007)
("Edwards 1"), the plaintiff sued under the Real Estate Settlement Procedures Act
("RESPA"), a statute that prohibits kickbacks nad referral fees that "tend to

increase unnecessarily the costs of certain settlement services. " 12 U.S.C. § 2601.
Plaintiff admitted that she had not suffered an injury but contended that she
nevertheless was entitled to statutory damages in the amount of three times what
she paid for her title insurnace. Edwards I, 517 F. Supp. 2d at 1202. The Court
held the plaintiff need not have suffered an overcharge to invoke the protection of
RESPA. Rather, the court stated, "[i]f Edwards can prove her claim, there is a
statutory injury fairly traceable to Defendants' action nad redressable by a
favorable decision. "

Id. at 1204. In affirming, the Ninth Circuit held that,

"[b]ecause the statutory text does not limit liability to instances in which a plaintiff
is overcharged, we hold that Plaintiff has established an injury sufficient to satisfy
Article III. " Edwards II, 610 F.3d at 517.
In Jewel, decided after this Court's decision in Fraley, the Ninth Circuit held
that the plaintiffs had standing to bring their statutory and constitutional claims
-4PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT

1

against the government arising from what the plaintiffs described as

a

" Jewel, 2011 U.S. App.

2
3

LEXIS 25951, at *2.

4

plaintiffs alleged that they were swept into a "dragnet" that "indiscriminately"

5

captured the communications of millions of Americans. Id. at * 16. The plaintiffs

6

did not specify the content of a single specific communication that was intercepted,

7

they did not identify the specific date or time of any interception, they did not

8

allege that any of their communications were of a sensitive nature, nor she did they

9

allege harm. It was sufficient that "Jewel alleged with particularity that her

The allegations in Jewel were extremely broad

i.e.,

10

communications were part of the dragnet," id. at *17-18

11

and AT&T acquire all or most long-distance domestic and intenrational calls to or

12

from AT&T long distance customers, including both the content of those calls and

13

dialing, routing, addressing and/or signaling information pertaining to those calls.

14

Id. at *16-17; see also Hepting v. AT&T Corp., 439 F. Supp. 2d 974, 1001 (N.D.

15

Cal. 2006) ("this dragnet necessarily inflicts a concrete injury that affects each

16

customer in a distinct way").

i.e., that "'Defendants

17

Here, in addressing this Court's basis for dismissal of the first complaint,

18

Plaintiffs go far beyond that which was alleged in either Edwards or Jewel to show

19

that they suffered the injury the California's Constitution and the SCA were

20

designed to protect. Plaintiffs allege that they provided personally identifiable

21

information to Defendant on the basis of its express assurance that "any

22

information provided to third parties will not be personally identifiable. " 919119,

23

57. Defendant nevertheless "provided personally identifiable information to third

24

parties that possess extensive, private information about users.

25

personally identifiable information disclosed by LinkedIn "gave the Third Parties

26

the ability to correlate Plaintiffs' actual identities with their broader Internet

27

browsing histories. Plaintiffs' browsing histories include visits to websites they

28

consider private, including political, religious, and health-related websites. " 915.
- 5PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT

9121. The

1
2
3
4
5
6
7
8

Plaintiffs allege that Defendant represented that it "does not store
unencrypted personally identifiable information. " 91 19. However:
LinkedIn failed to take steps to encrypt its users' LinkedIn IDs or eliminate them
from transmissions to third parties. The Company did not have proper secuirty in
place and failed to use commercially reasonable methods to prevent its users'
LinkedIn IDs (and thus identities) from being associated with their Pirvate
Browsing History.

91 21. The Amended Complaint also articulates "a coherent theory of how
[Plaintiffs] personal information was disclosed or transferred to third parties,"
Order at 8.

9

13

15.
Before any cookie data can be transmitted to a Third Party,
the website that the user is visiting must initiate a command telling
the Internet user's computer to communicate with that Third Party.
The website uses the Internet user's browser as a tool to cause this
communication, and dictates which servers the Intenret user's
browsers should communicate with, and what information it
should send to those servers.

14

16.

For example, with regard to Linkedln's conduct:

15

1.

An Internet user visits a Linkedln profile page while logged
in to Linkedln.

2.

Linkedln loads the Linkedln-related content of that
webpage; Spaces are left open on the page for
advertisements and other content (such as beacons) to be
provided by Third Parties.

3.

Linkedln invisibly sends a command to the Intenret user's
browser to initiate the loading of advertisements and other
content on the webpage. The Linkedln command:

10
11
12

16
17
18
19
20
21

23

• Designates the Third Party with which the browser
should communicate and from which the browser
should obtain the advertisements and other content.

24

• Requires that the communication include:

22

25
26
27
28

[a.] From the Intenret user's hard dirve, the cookie
identification number of any cookie that is
associated with the designated Third Party; with
[b.] The URL of the Linkedln profile the user is
viewing, which includes a Linkedln ID.
- 6PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT

1

4.

The third party receives, bundled together in a single
communication prompted by LinkedIn, the Third Party's
cookie identification number and the LinkedIn ID of the
page being viewed.

5.

The third party sends information back to the browser to
load advertising and other content in the designated areas
of the LinkedIn webpage, and continues to track the user
and communicate with the cookie through that content.

2
3
4
5
6
7

9191 15, 16. Thus Plaintiffs have "alleged how third party advertisers would be able

8

to infer [Plaintiffs'] personal identit[ies] from LinkedIn's naonymous user ID

9

combined with [their] browsing history."

Order at 5; cf. Def. Mem. at 7 ("the

10

Amended Complaint fails to explain how any information purportedly was sent to

11

third parties other than a transmission by a user's web browser of a LinkedIn User

12

ID as a component of a URL address.").

13

Under Jewel, all Plaintiffs had to allege to establish Article III standing were

14

communications of indeterminate nature that were included, without their consent,

15

in a "dragnet" surveillance. In Edwards I, the Court held the plaintiff had standing,

16

even though the plaintiff could not allege she was harmed,

17

she had purchased title insurance that had been tainted by a kickback arrangement.

18

As detailed above, Plaintiffs here alleged much more than this. Accordingly,

19

Defendant's motion to dismiss the Amended Complaint nad constitutional claims

20

on standing grounds should be denied.

21
22

C.

on the ground that that

By Alleging Disclosure of Valuable and Sensitive Personal
Information, Plaintiffs Have Established Their Standing With
Respect to All Their Claims

23

Defendant suggests that the Amended Complaint does not describe "'what

24

information was actually disclosed to third parties that would lead Plaintiff to

25

suffer emotional harrn. ''' Def. Mem. at 7 (quoting Order). But the Amended

26

Complaint specifically provides that "Plaintiffs' browsing histories include visits to

27

websites that they consider private, including political, religious nad health-related

28
-7PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT

1

websites. " 1 5. Linkedln divulged Plaintiffs' browsing histories to third parties

2

who "are able to place a Linkedln user' s actual identity with his/her personal,

3

Private Browsing History." 1 20 (emphasis in original).

4

Amended Complaint does allege that Linkedln did actually disclose "potentially

5

sensitive information. " Defendant' s assertion that "[t]here is no suggestion that

6

Linkedln actually passed any potentially sensitive information to anyone " is

7

simply incorrect. See Def. Mem. at 8. "[G]iven the choice, Plaintiffs would not

8

have disclosed this information" and the "Plaintiffs were embarrassed and

9

humiliated by the disclosure of their personally identifiable browsing history." 1 5.4

10

Thus, Plaintiffs provide sufficient detail concenring the allegations of emotional

11

harm. See Order at 7-8 (citing Doe 1 v. AOL LLC, 719 F. Supp. 2d 1102, 1109-111

12

(N.D. Cal. 2010) ("past publication of sensitive personal information . . . regarding

13

AOL members' personal issues, including sexuality, mental illness, alcoholism,

14

incest, rape, and domestic violence and continuing collection and dissemination of

15

this same sensitive information is sufficient to establish standing.")).

Accordingly, the

Here, Linkedln allegedly disclosed sensitive personal

16

information

17

concerning "Plaintiffs' browsing histories [which] include visits to websites they

18

consider private, including political, religious, and health-related websites. " 1 5.

19

Indeed, even the Wall Street Jounral recognized the highly personal nature of

20

online tracking when it "exposed a fast-growing network of hundreds of companies

21

that collect highly personal details about Internet users

22

their online activities,
"9
1 37
political views, health worries, shopping habits, financial situations

23

(emphasis added).

Accordingly, Plaintiffs have "alleged that [their] sensitive

24
4

25
4
24 )
27
28

In Rowe v. UniCare Life & Health Ins. Co., No. 09-2286, 2010 U.S. Dist. LEXIS 1576, at *8
(N.D. Ill. Jan. 5, 2010), the court held that the "widespread exposure of []information" will
suffice at the pleading stage to establish an inference that actual disclosure took place, noting:
" On a motion to dismiss, the Court draws all reasonable inferences in the plaintiff s favor ...
[and] the Court may properly make the inference that the information was accessed at some
point ... even if the exposure itself does not satisfy [the] requirement of disclosure to a third
party
"
-8PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT

1

personal information has been exposed." Order at 8. As such, Plaintiffs have

2

alleged injury-in-fact. Plaintiffs also have sufficiently alleged loss of money or

3

property for the purpose of California consumer statutes.

4

The Amended Complaint sufficiently alleges that the Plaintiffs suffered

5

economic harm as well. Defendant suggests that Plaintiffs' claim of economic

6

injury is limited to "a theory that plaintiffs' browsing history is 'valuable personal

7

property' and plaintiffs 'relinquished this valuable personal property without the

8

compensation to which each were due. ''' Def. Mem. at 8 (quoting 1 5). It is

9

generally recognized that in the context of Internet use, personal information is the

10

currency that is exchanged for access to Web services. See, e.g., Somini Sengupta

11

& Evelyn M. Rusli, Personal Data's Value? Facebook Is Set To Find Out, N.Y.

12

Times,

13

http://www.nytime s .com/2012/02/01/technology/riding-personal-data-facebook-i s-

14

going-public.html. ("Consumers' time and information are effectively the price

15

they pay for free Web services. Facebook allows its users to keep up with far-flung

16

friends and family, for instance, in exchange for that information. Google allows

17

anyone to search for anything, so long as the company can serve up ads based on

18

those searches.") Moreover, the Amended Complaint includes a named plaintiff

19

who paid for Defendant's services

20

of Linkedln when he purchased a 'Job Seeker Premium' subscription."

21

Defendant, moreover, ignores the Amended Complaint's allegations that Plaintiff

22

Masand paid Linkedln to use its services on the basis that his personally

23

identifiable information would be secure, 1 57, but instead, his personally

24

identifiable information was not securely maintained but was disclosed to third

25

parties. 11 20-23. Plaintiff Masand therefore did not receive the full value in the

26

"value-for-value exchange"

27

subscription to Linkedln. See Def. Mem. at 9. Accordingly, the economic harm

28

suffered by Plaintiff Masand is sufficient to establish Article III stnading.
- 9-

Jan.

31,

2012,

at

Al,

available

at

Plaintiff Alan Masnad "became a paid user
1 2.

when he purchased "Job Seeker Premium"

PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT

See

1

Order at 4 ("At least one named plaintiff must have suffered an injury in fact.")

2

(citing Lierboe v. State Farm Mut. Auto Ins. Co.,

3

2003)).

4

II.

5
6
7
8
9
10
11
12

350 F.3d 1018, 1022 (9th Cir.

LINKEDIN VIOLATED THE RIGHT TO PRIVACY ARISING FROM
CALIFORNIA'S STATE CONSTITUTION AND COMMON LAW
A.

LinkedIn Violated California's State Constitution

Article 1, Section 1 of the Califonria Constitution was amended on
November 7, 1972, following a ballot initiative to create an express right to
privacy. The "Privacy Initiative"

i.e., the privacy amendment

"is to be

interpreted and applied in a manner consistent with the probable intent of the body
enacting it: the voters of the State of Califonria. " Hill v. NCAA, 7 Cal. 4th 1, 16
(1994). The intent of the voters is clear:

16

The pirncipal focus of the Pirvacy Initiative is readily discernable.
The Ballot Argument warns of unnecessary information gatheirng,
use, and dissemination by public and private entities -- images of
"government snooping,"computer stored and generated "dossiers"
and "'cradle-to-grave' profiles on every American" dominate the
framers' appeal to the voters
The evil addressed is ... business
conduct in "collecting and stockpiling unnecessary information ...
and misusing information ... "

17

Id. at 21 (quoting Ballot Pamp., Proposed Stats. and Amends. to Cal. Const. with

18

arguments to voters, Gen. Elec. (Nov. 7, 1972), at 26, 27).

13
14
15

19

California courts have held that a plaintiff must satisfy three elements to establish a

20

violation of the Privacy Initiative: "(1) a legally protected pirvacy interest; (2) a reasonable

21

expectation of pirvacy in the circumstances; and (3) conduct by defendant constituting a serious

22

invasion of pirvacy." Ruiz v. Gap, Inc., 380 F. App'x 689, 692 (9th Cir. 2010) (quoting Hill, 7

23

Cal. 4th at 66). Here, Defendant asserts that LinkedIn's conduct is not a violation of California's

24

Constitution solely because the allegations do not amount to a "[seirous] invasion of privacy."

25

Def. Mem. at. 21. For the reasons articulated below, Defendant is incorrect, and LinkedIn's

26

alleged behavior violates Plaintiffs' privacy rights under the California constitution.

27
28
- 10 PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT

1

B.

2

Plaintiffs Allege Conduct by Defendant that Constitutes a Serious
Invasion of Privacy

California voters amended Article 1, Section 1 of the Constitution because they were
3
alarmed that "[c]omputerization of records makes it possible to create 'cradle-to-grave' profiles
4
on every Ameircan" and believing that such "data collecting is threatening to destroy our
5

traditional freedom." Official Ballot Pamphlet at 27. Here, Plaintiffs allege that LinkedIn

6
disclosed users' identities and their browsing history to third parties, thereby enabling the
7
"collecting and stockpiling" of personal information, not submitted for that purpose, to create
8

"dossiers" about the Plaintiffs and Class Members. 1 5. 5 This is the precisely the type of

9
conduct California voters intended to prevent and, thus, constitutes an actionable invasion of
10
pirvacy.
11
12
13
14
15
16
17
18
19
20
21
22

The purpose and intent of the Privacy Initiative make clear the seriousness
of LinkedIn's misconduct. The voters of California intended that the right to
privacy protect Lbw freedom to associate with the people we choose. " Official
Ballot Pamphlet at 28. The Supreme Court has also "recognized the vital
relationship between freedom to associate and privacy in one's associations. "
NAACP v. Alabama, 357 U.S. 449, 462 (1958) ("Inviolability of privacy in group
association may in many circumstances be indispensable to preservation of
freedom of association, particularly where a group espouses dissident beliefs. "
Id.). Here, Linkedln is disclosing a User Identification connected to a web
browsing history that may disclose information about the users' associations,
mcluding membership in, or an interest in, dissident groups.
Last month, the U.S. Supreme Court unanimously held that GPS tracking of

23
24
25
26
27
28

5 Defendant incorrectly states that "[t]here is . . . no allegation that [Plaintiffs'] general Intenret
browsing histories were disclosed to anyone as a result of conduct of Linkedln. Nor is there any
suggestion as to what specific information about plaintiffs caused (or could cause) them
embaffassment. " Def. Mem. at 20-21. The Amended Complaint speciifcally provides that
"Plaintiffs' browsing histoires include visits to websites that they consider private, including
political, religious and health-related websites," 1 5, and Linkedln divulged Plaintiffs' Linkedln
IDs to third parties who "are able to place a Linkedln user's actual identity with his/her personal,
Private Browsing History," 1 20 (emphasis in original), as well as their personal LinkedInrelated browsing histories. See Section I, supra.

- 11 PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT

1

a suspect's vehicle constitutes a search under the Fourth Amendment of the U.S.

2

Constitution. United States v. Jones, No. 10-1259, 2012 U.S. LEXIS 1063 (Jan. 23,

3

2012). Writing for the Court, Justice Scalia relied on a trespass theory that is of

4

limited relevance to this case. 6 In two separate concurrences, however, a majority

5

of the Justices recognized, as an independent basis for finding that a search had

6

occurred, that the monitoring of physical movement via a GPS tracking device

7

does not accord with a reasonable expectation of privacy.

8

In his concurrence, Justice Alito stated that, "the use of longer term GPS

9

monitoring in investigations of most offenses impinges on expectations of

10

privacy." Id. at *51. Justice Sotomayor, in her concurrence, questioned whether

11

"GPS monitoring

12

quantum of intimate information about any person whom the Government, in its

13

unfettered discretion, choose to track

14

and government in a way that is inimical to democratic society

15

whether people reasonably expect that their movements will be recorded and

16

aggregated in a manner that enables to the Government to ascertain, more or less at

17

will, their political and religious beliefs, sexual habits and so on.

18

And with respect to the very conduct at issue at here, she stated:

19
20
21
22
23

by making available at a relatively low cost such a substantial

may 'alter the relationship between citizen
I would ask

Id. at *27-28.

I for one doubt that people would accept without complaint the warrantless
disclosure to the government of a list of every Web site they had visited in
the last week, or month, or year. But whatever the societal expectations, they
can attain constitutionally protected status only if our Fourth Amendment
juirsprudence ceases to treat secrecy as a prerequisite to privacy. I would not
assume that all information voluntairly disclosed to some member of the public
for a limited purpose is, for that reason alone, disentitled to Fourth Amendment
protection.

Id. at *31 (emphasis added.) The same reasoning applies with equal if not greater

24

force in this case where LinkedIn, a private entity that collected Plaintiffs' personal
25

information, not only facilitated the tracking of Plaintiffs' web traffic but

26
27
28

6 See Jones, 2012 U.S. LEXIS 1063, at *8. ("The Government physically occupied private
property for the purpose of obtaining information. We have no doubt that such a physical
intrusion would have been considered a 'search' within the meaning of the Fourth Amendment").

- 12 PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT

1

effectively "entered" the website location and tracked their movements within.

2

And unlike the GPS tracking at issue in Jones, there was no offsetting

3

governmental interest in law enforcement.

4

The analogy is clear: "[r]epeated visits to a church [website], a gym

5

[website], a bar [website], or [an online] bookie tell a story not told by any single

6

visit, as does one's not visiting any of these [websites] over the course of a month",

7

and "[a] person who knows all of another's [web browsing history] can deduce

8

whether he is a weekly church goer, a heavy drinker, a regular at the gym, an

9

unfaithful husband, an outpatient receiving medical treatment, an associate of

10

particular individuals or political groups

11

person, but all such facts. " United States v. Maynard, 615 F.3d 544, 562 (D.C. Cir.

12

2010), aff'd, Jones, 2012 U.S. LEXIS 1063. As in Jones, it is the aggregation of

13

disclosed information, the profile or dossier of an individual, created from that

14

person's web browsing history that amounts to a serious breach of privacy.'

15
16
17
18
19
20
21
22
23
24
25
26
27
28

C.

and not just one such fact about a

LinkedIn's Conduct Is Highly Offensive To A Reasonable Person
And Amounts To A Common Law Invasion Of Privacy

Defendant tries to trivialize the effects of LinkedIn's invasion of privacy by
suggesting that the disclosure of Plaintiffs' LinkedIn User Identification "is not a
'private matter' or 'private fact' as this was a number assigned by LinkedIn" and
the "disclosure of user's 'LinkedIn-related browsing history' would not rise to the
level of 'highly offensive' given the ubiquity of cookies and targeted online
advertising." Def. Mem. at 22. Defendant is here apparently suggesting that
"because everyone invades an Internet user's privacy, it is ok for Linkedln to do
7 Defendant's reliance on Ruiz v. Gap, Inc., 540 F. Supp. 2d 1121 (N.D. Cal. 2008), Folgelstrom
v. Lamps Plus Inc., 195 Cal. App. 4th 986 (2011), and Hill, supra, is misplaced. Def. Mem. at
21-22. Those cases involved disclosure of a single piece of unlinked information (social security
numbers or ZIP codes). In contrast, Linkedln has disclosed its users' identifications, thereby deanonymizing their browsing history, and did so in conjunction with their Linkedln-related
browsing history, thereby enabling third parties to "stockpile" information about the user's most
personal habits and preferences (derived from their browsing history) and create the type of
personal "dossier" the Privacy Initiative was intended to prevent.
- 13 PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT

1

so."It goes without saying that a reasonable person would be highly offended by

2

somebody eavesdropping on their Internet browsing, an activity that is often

3

conducted in the privacy of one's home and behind closed doors, on a computer

4

that is password-protected, or on mobile devices

5

protected nad, in all cases, inaccessible to public view.

6

III.

7

perhaps also password-

PLAINTIFFS HAVE ALLEGED VIOLATIONS OF THE STORED
COMMUNICATIONS ACT
When Internet users sign up for LinkedIn, they are required to provide personal

8
information including their name; email address; country; zip code; information regarding
9
whether they are employed, looking for a job, or a student; and details regarding their
10
employment or school. 1 24. Linkedln processes this information, stores it as a profile, stores
11
any connections with other Linkedln users that the user has identified or Linkedln has
12
discovered, and creates a Linkedln. Id. 1 25; see supra sec. 1. This number is unique, it' s
13
permanent, and it' s designed for internal use on the website. 8 Despite the expectation of privacy
14
that is both implied by the nature of the information exchanged and explicitly assured in
15
Linkedln's privacy practices, Linkedln divulges this ID to third parties in violation of the SCA.
16
Linkedln also divulges to third parties the vairous profiles that its members view, which is itself
17
a violation of the SCA. And most importantly, Linkedln knowingly divulges this information in
18
a context that allows third parties to correlate the information with an otherwise anonymous
19
browsing history. While the broader browsing histories are collected by third parties, not
20
Linkedln, the information Linkedln divulges to the third parties provides identity, substance, and
21
meaning to the browsing histoires.
22
A.

23
24

Linkedln Improperly Divulged Communications in Its Capacity as an
RCS

A remote computing service ("RCS") provides "computer storage or

25
26
27
28

This process is not unlike that which occurs when one sets up a bank account: the account
holder entrusts the bank with pirvate information, and the bank assigns a private number to
identify his/her account. Rather than identifying an account, however, the number assigned by
Linkedln identifies a person.
8

- 14 PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT

1

processing services," § 2711(2), not unlike a "virtual filing cabinet. " Quon v. Arch

2

Wireless Operating Co., 529 F.3d 892, 902, rev'd on other grounds sub nom. City

3

of Ontario v. Quon, 130 S. Ct. 2619 (2010). Here, LinkedIn is an RCS because it

4

stores profiles and creates a network of users

5

personal information and users' connections, as well as users' intentions to view

6

those connections.

like a giant, interactive rolodex of

7

Defendant admits that it is an RCS, but argues that the SCA still does not

8

apply to it because it was not acting like an RCS when it divulged Plaintiffs'

9

personally identifiable information. Def. Mem. at 11-12.

10

The law is clear,

however, that the mechanism by which an RCS like LinkedIn makes the disclosure
in this case, by transmission of a URL

11

is not relevant to its SCA liability.

12

Under § 2702(a)(2), an RCS is prohibited from disclosing the contents of two types

13

of communications that are carried or maintained on its service: 1) those received

14

from the subscriber or 2) those created by means of processing communications

15

received from a subscriber.

16

communications must be "carried or maintained . . . solely for the purpose of

17

providing storage or computer processing services" § 2702(a)(2)(B)). Here,

18

Linkedln received Plaintiffs' personal profile information (the first type of

19

communication), and processed that communication by creating a profile and

20

assigning a User ID (the second type of communication). 9 Linkedln carried or

21

maintained these communications on its service, and did so for no other purpose

22

than to store and process user's profile information nad connections. When

23

browsing Linkedln profiles, Plaintiffs also sent Linkedln communications

24

regarding the pages they would like to visit (the first type of communication) and

25

Linkedln processed that information into a URL (the second type of

(Emphasis added.)

(Additionally, these

26
27
28

"[E]lectronic communication[s]" are defined broadly under the ECPA to extend beyond e-mails
and other messages and include "any transfer of signs, signals, wirting, images, sounds, data, or
intelligence of any nature
" 18 U.S.C. § 2510(12).
9

- 15 -

PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT

1

communication). By disclosing these communications to third parties, LinkedIn,

2

an RCS, violated the SCA.

3

B.

4

Defendant's argument that it did not divulge information in "electronic

5

storage is irrelevant, because "electronic storage is not a requirement for an SCA

6

violation by an RCS. All that LinkedIn needed to have done as an RCS is divulge

7

information that it "carried or maintained on [its] service.

8

provision does state that the RCS must have the communication "solely for the

9

purpose of providing storage or computer processing services," but nowhere does

10

it use the SCA' s defined term "electronic storage."). LinkedIn "carries or

11

maintains" the divulged information because it stores personal information,

12

profiles, and connections, and it processes that information into User DIs and

13

URLs. LinkedIn acknowledges this: "Our solutions involve the storage and

14

trnasmission of members' and customers' information, some of which may be

15

private

16

(emphasis added);

17

information and other data

LinkedIn Is an RCS that "Carried or Maintained" a Communication

See §

2702(a) (the

" LinkedIn Corp., Prospectus (Form 424B4) (May 18, 2011) at 14
see also id.

at 15 ("We process, store and use personal

") (emphasis added).

18

C.

19

Under the SCA, "contents"includes "information concerning the substance,

20

purport, or meaning of that communication," 18 U.S.C. § 2510(8), as distinguished

21

from the mere Lexistence of the communication or transactional records about it,"1°

22

1986 U.S.C.C.A.N. 3555, 3567. It is not the communication's type (e.g., data,

23

signals, intelligence) that defines whether it includes "contents," but is instead the

24

communication's "functional role" that "explains the different treatment that the

25

two categories receive in the SCA.

LinkedIn Divulged the "Content" of Communications

Id. Here, the personal information divulged

26
27
28

io Transactional records are non-substantive "information about the communication that the
network uses to deliver and process the content information. " Orrin S. Kerr, The Future of
Internet Surveillance Law, 72 Geo. Wash. L. Rev. 1208, 1228 (Aug. 2004).
- 16 PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT

1

by LinkedIn does not merely serve the purpose of "tell[ing] the computer where

2

[the communication] should go and what it should do," but conveys "substance"

3

and "meaning" to advertisers regarding the user's browsing pattenrs, interests, and

4

identity). See Orin S.

5

The Big Brother That Isn' t, 97 Nw. U. L. Rev. 607, 645-46 (2003).

6
7
8

Kerr,

Internet Surveillance Law After the USA Patriot Act:

LinkedIn discloses two types of "contents" of communications: a) Linked-In related
browsing histories, b) LinkedIn IDs.
1.

Plaintiffs' LinkedIn-Related Browsing History Is "Content"

9

LinkedIn discloses its users' LinkedIn-related browsing history by

10

trnasmitting URLs. URLs, or uniform resource locators, identify the particular

11

document (i.e., page) within a website that a person views, thereby revealing

12

information about the person's Internet activity.

13

512 F.3d 500, 510 (9th Cir. 2008) (allowing the disclosure of "record" information

14

because that information did not disclose "the contents of [] messages or

15

particular pages on the websites the person viewed"; "[a] URL, unlike an

16

address, identifies the particular document within a website that a person

17

views and thus reveals much more information about the person's Internet

18

activity, " further stating that such information "might be more constitutionally

19

problematic." (emphasis added)). The webpage is " contents" because it conveys to

20

the user information concerning the "substance, purport, or meaning" of the

21

communication. And furthermore, it implicitly conveys the content of the user's

22

communication to the website, i.e., the request to view a particular page. Here,

23

LinkedIn divulged such content. "

See United States v. Forrester,

the
IP

24
25
26
27
28

ii In Forrester, the Ninth Circuit addressed the "contents" of communications in a Fourth
Amendment context, but the SCA provides even "greater pirvacy protection" than the Fourth
Amendment. Crispin v. Audigier, 717 F. Supp. 2d 965, 971-72 (C.D. Cal. 2010).
- 17 PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT

1

2.

Plaintiffs' LinkedIn IDs are Content

2

LinkedIn also improperly divulged Plaintiffs' LinkedIn IDs to its third party

3

advertisers and advertising data aggregators. The First Circuit has recognized that

4

the "definition [of "contents"] encompasses personally identifiable information

5

such as a party's name, date of birth, and medical condition. " In re Pharmatrak,

6

Inc., 329 F.3d 9, 19 (1st Cir. 2003) (citing Gelbard v. United States, 408 U.S. 41,

7

51 n.10 (1972) and Nix v. O'Malley, 160 F.3d 343, 346 n.3 (6th Cir. 1998)). While

8

courts sometimes consider names

9

communication here dictates otherwise.

10
11
12
13

tion-content records," the context of the
The legislative history, regarding the

Electronic Communications Privacy Act, made clear:
Under [the definition of contents], a service provider is allowed to divulge
mailing lists that identify persons fitting broad demographic criteira. Unless
otherwise authoirzed, service providers may not divulge to third parties
information that proifles the activities of individual subscribers through the
divulgence of the contents of a communication.

14

H.R. Rep. No. 99-647, at 64 (1986) (emphasis added). Given the "functional role"

15

of the communication, the User Identification plainly qualifies as EContents. "

16

By divulging Plaintiffs' Linkedln DIs to third parties, it divulged the

17

contents " of communications because the IDs are linked to profiles of the

18

activities of the subscribers on the Web. See H.R. Rep. No. 99-647. In Forrester,

19

512 F.3d 500, the Ninth Circuit recognized this. In Forrester, the Court relied in

20

part on In re Application of U.S. for an Order Authorizing use of A Pen Register

21

and Trap On [xxx] Internet Service Account/User Name, [[e-mail] ]

22

("Pen Register"), 396 F. Supp. 2d 45 (D. Mass. 2005), in which the court

23

recognized that "dialing, routing, addressing and signaling information" can reveal

24

the "'contents' of a communication. " Id. at 48. In Pen Register, the court noted

25

that a person may dial a telephone number (which is clearly record information),

26

but also be "asked to dial a second number such as a personal account number or

27

social security number or any other identifying number in order to receive further

28
- 18 PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT

1

information" or ECredit card or bank account numbers.

2

"anyone [would] doubt that although dialing this second number creates

3

`...dialing, routing, addressing, or signaling inforrnation . . . this inforrnation ..

4

. contains the 'content' of a communication[d") (emphasis added).

5

Id. (questioning whether

The court in Pen Register also disapproved of disclosing other information typed into

6

websites. The court addressed an issue that is very similar to the one at hand, noting that a

7

"search phrase would appear in the URL after the first forward slash," just as the viewed-

8

page ID appears in this case, and "[t]his would reveal content-that is, it would reveal, in the

9

words of the statute, `...information concerning the substance, purport or meaning of that

10

communication.' The 'substance' and 'meaning' of the communication is that the user is

11

conducting a search for information on a particular topic." Id. at 49 (internal citations omitted).

12

Likewise here, the Linkedln ID conveys 1) the substance and meaning of a

13

communication that the user is interested in visiting a certain page or profile and 2) the substance

14

and meaning of a communication regarding the user's identity, i.e., the most specific type of

15

demographic information available. The very business goal of the Third Parties who receive this

16

information (and indeed, the purpose of the cookies and beacons that these third parties place on

17

users' computers) is to create a profile of the type of person who is interested in certain products,

18

so as to target advertising based on demographic information. IN 38-42. The business is

19

lucrative; these third parties pay Linkedln for the privilege of advertising on its site, and in tunr,

20

sell user information and demographic profiles. Certainly, the identity of the user and his/her

21

demographic information is the "substance, purport, or meaning" of the communication.

22
23

3.

Even if the Linkedln IDs Were "Records," Linkedln Still
Violated the SCA by Revealing Them With Content

Linkedln argues that its IDs fall into the "records" carve-out of the SCA.
24

Def. Mem. at 15-19. However, the carve-out does not allow records to be
25

disclosed together with the contents of communications. 18 U.S.C. § 2702(a)(3)
26
27

(allowing a provider to "divulge a record ... (not including the contents

of

communications . . . ") (emphasis added); see also, e.g., United States v. Davis,

28
- 19 PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT

1

Crim. No. 10-339, 2011 U.S. Dist. LEXIS 56002, at *8-9 (D. Or. May 24, 2011)

2

("Basic subscriber data which identifies a call's origination, destination, duration,

3

and time of call enjoy no privacy protection because the data is incidental to the

4

[communication], and contains no content information.' (citing United States v.

5

Reed, 575 F.3d 900, 914-16 (9th Cir. 2009)) (emphasis added)). 12 This clause

6

allows providers to share lists of their users, without permitting them to de-

7

anonymize communications, thus paralleling the intention expressed in the H.R.

8

Report that "mailing lists" can be divulged but "information that profiles the

9

activities of individual users' cannot. See H.R. Rep. No. 99-647, at 64. 13 Indeed,

10

"[t]he SCA does not authorize the disclosure of the identity of the author of a

11

stored message; it authorizes the disclosure of a record . . . pertaining to a

12

subscriber

13

(emphasis added) (citing 18 U.S.C. §2703(c)(1)).

O'Grady v. Super. Ct., 129 Cal. App. 4th 1423, 1448 (2006)

Defendant analogizes its conduct to providing the information that is already

14

15

readily available on the outside of an envelope.

16

Forrester, which held that email to/from addresses and IP addresses are addressing

17

information and thus "records" 512 F.3d at 510 ("at best, the [third party] may

18

make educated guesses about what was said in the messages or viewed on the

19

websites based on its knowledge of the e-mail to/from addresses and IP addresses

20

but this is no different from speculation about the contents of a phone

21

conversation on the basis of the identity of the person or entity that was dialed.").

22

But here, Linkedln is not merely stamping the retunr address on a sealed envelope,

See Def. Mem. at 16-17, citing

23
12

24
25
26
27
28

There is an exception, however, prohibiting records from being divulged to government
entities. 18 U.S.C. § 2702(a). Linkedln has made no attempt to prevent this from happening
(e.g., the information may be divulged to the government for advertisements relating to federal
employment or military recruiting), and that alone violates the SCA.
18 U.S.C. § 2702(a) prohibits the disclosure of content and § 2702(c) allows the
disclosure of certain customer records. The clause in § 2702(c) stating that records "not including
the contents" can be revealed would be meaningless and redundant unless it intends to restirct
record information from being correlated or divulged with records.
13 E.g.,

- 20 PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT

1

which may display record information without any indication of the contents. It is

2

stamping the retunr address on the communication itself.

3

In Forrester, the Court found that there was no Fourth Amendment

4

expectation of privacy for IP addresses or email addresses because users Eshould
"

5

know that this information is provided to and used by Internet service providers for

6

the specific purpose of directing the routing of information . . . .

7

voluntarily turned over in order to direct the third party's servers. " 512 F.3d at 510

8

(emphasis added).

9

information to third parties, they merely visited a page within the website that they

10

had entrusted with personal information. While Plaintiffs may have expected that

11

their IP addresses would be used in connection with that page visit (by the ISP,

12
13

perhaps), no reasonable person would have expected that his Linkedln ID or
browsing history would also be transmitted to a Third Patry. 14

14

Linkedln takes this several steps further than sending the to/from

15

information or IP addresses at issue in Forrester: 1) Defendant sends the Linkedln

16

ID with an otherwise anonymous communication (the page visit), eliminating the

17

need for any "speculation" regarding the content of the identified-person' s

18

communications; 2) Defendant contemporaneously sends the user' s last-viewed

19

page along with its Linkedln ID, plainly divulging additional, protected content;

20

and 3) Defendant transmits this information to its paid advertisers, in connection

21

with the Third Parties' cookie identification numbers, used to track their Internet

22

browsing history. 15 Linkedln divulged the contents of communications, or, at the

23

14 Defendant cites to Hill v. MCI WorldCom Communications, Inc., 120 F. Supp. 2d 1194 (S.D.

24

Iowa 2000), where the defendant divulged telephone transaction records (phone numbers and
billing information) which were neither content in that context nor divulged in connection with
content. Here, however, Linkedln transmitted the User Identification with a communication (the
click to visit/interest in a webpage), and simultaneously included contents of an unrelated
communication (the last-viewed page).

25
26
27
28

[They] are

Here, however, Plaintiffs never voluntarily tunred over

Defendant's citation to Jessup-Morgan v. America Online, Inc., 20 F. Supp. 2d 1105 (E.D.
Mich. 1998) (cited Def. Mem. at 17), is of limited use to this Court. That case involved a
particularly egregious set of facts wherein a user publicly, but anonymously, posted a malicious
- 21 15

PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT

1

least, divulged records contempornaeously with communications, and therefore

2

violated the SCA.

3

D.

4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

LinkedIn Was Not Authorized to Divulge Its Subscribers'
Communications

LinkedIn contends that it was authorized to divulge the contents of its
members' communications because it was '"an addressee or intended recipient of
such communication. ''' Def. Mem. at 14-15 (quoting 18 U.S.C. §2702(b)(1)).
Alternatively, it argues that it was authorized to divulge the contents of the
communications because the Third Parties were the "addressee or intended
recipient." Neither argument holds water.
LinkedIn's first argument is contradicted by the SCA' s plain language.
While the SCA allows ECSs to disclose communications "with the lawful consent
of the originator or an addressee or intended recipient," "in the case of a remote
computing service [RCS], " the service provider needs the consent of "the
subscriber. " § 2702(b)(3); Crispin, 717 F. Supp. 2d at 973 n.17 ("An RCS
provider can avail itself of all but one of the exceptions set forth in § 2702(b).
An RCS provider may divulge the contents of a communication with consent of the
"subscriber," while an ECS provider may divulge the contents with the lawful
consent of an addressee or intended recipient of such communication.) (emphasis
added).
Regarding LinkedIn's second argument

that the Third Parties were the

"addressee or the intended recipient" designated by LinkedIn

the "addressee or

intended recipient" must plainly be designated by the user, not the service provider
itself. An ECS can divulge the contents of a communication with the lawful
consent of (or to) an addressee or intended recipient, because there are two parties
and defaming post while posing as (and providing contact information for) another person. The
court declined to hold the defendant liable for revealing the identity of the malicious user when it
was subpoenaed for such information. Id. at 1108. Moreover, the non-controlling decision in
Jessup was misplaced and does not comport with the plain language of the statute.
- 22 PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT

1

to the communication (which is merely facilitated by the ECS), and either party

2

has a right to access or divulge the communication.

3

2710. With regard to an RCS, the user always sends the RCS provider (e.g.,

4

LinkedIn) communications for processing or storage, but that does not render the

5

RCS an ntended recipient" that is permitted to divulge information at will; this is

6

exactly what the SCA protects against.

7

disclosures of communications received by the provider by means of electronic

8

trnasmission from a subscriber). Certainly, if the user designates naother third

9

party to receive that information, the RCS could appropriately divulge the

10

communication to that third party. But Plaintiffs never designated the Third Parties

11

here as addressees or intended recipients.

See 18 U.S.C. §§ 2702(c),

See 18 U.S.C. § 2702 (prohibiting

In support of its arguments, Defendant cites In re Facebook Privacy Litig.,

12
13

No. 10-02389, 2011 U.S. Dist. LEXIS 157345, at *5-13 (N.D. Cal. Nov. 22, 2011)

14

("Facebook II") and In re Facebook Privacy Litig., 791 F. Supp. 2d 705, 714 (N.D.

15

Cal. 2011) ("Facebook I"). In Facebook II, the court noted that the plaintiffs relied

16

on "two mutually inconsistent propositions." 2011 U.S. Dist. LEXIS 147345, at

17

* 11. The first proposition was that "the communications . . . were requests to be

18

connected to specific advertisements; the requests were addressed to advertisers;

19

and that Defendant merely acted as the 'intermediary' for those communications.

20

Id. 16

21

However, the Court noted that the plaintiffs in that case, unlike here, had not

22

alleged that their communications were sent to defendant for "processing or

23

storage. " Id. 17 Given the two inconsistent propositions, and the plaintiffs failure to

24

16 In Facebook I, the court concluded that if "communications were sent to advertisers, then the

25

advertisers were their addressees or intended recipients." 2011 U.S. Dist. LEXIS 157345, at *513. Here, by contrast, Plaintiffs' communications were to Linkedln, and were requests to be
connected with Linkedln pages; there were no user requests to be connected to specific
advertisements, and no communications addressed by the user to advertisers.
17
Also unlike this case, the defendant in Facebook II contended it acted only as an ECS, id. at
n.7; here, Linkedln admits it is also an RCS.

26
27
28

Plaintiffs' second proposition was that the defendant was an RCS.

- 23 PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT

Id.

1

allege that the defendant was an RCS, the court dismissed the SCA claim.

2

(noting that it did "not reach the merits of Plaintiffs' contention that 'only ECS

3

providers, and not RCS providers like [Defendant], may avail themselves of the

4

SCA' s 'intended recipient' exception.").

Id.

5

LinkedIn acted as an RCS, was not therefore an "addressee or intended

6

recipient" as contemplated by the SCA, and sent Plaintiffs' information to Third

7

Parties with which they had no intention of communicating. LinkedIn is therefore

8

liable under the SCA.

9

IV.

LINKEDIN VIOLATED CALIFORNIA'S FALSE ADVERTISING LAW

10

Plaintiffs already have demonstrated that they each suffered an injury in fact

11

for the purposes of the Article III standing requirement. Supra, sec. I. Defendant's

12

arguments notwithstnading (Def. Br. at 19), Plaintiffs also have adequately pleaded

13

injury in the form of the loss of money or property as a result of false

14

representations by Defendant. The value is determinable by reference to prices set

15

in an active market for personal profiles. 18 For Plaintiff Masand and other Class

16

members who also paid monetarily for Defendant's service, the value is

17

additionally determinable in reference to the amount they paid for the service.

18

Instead of disputing that Plaintiffs' personal information has value,

19

Defendant argues that Plaintiffs' FAL claim fails because there is no allegation that

20

such loss was '"as a result of' any false advertising by LinkedIn. Def. Mem. at 19

21

(citing Cal. Bus. & Prof. Code § 17535).) But Plaintiffs clearly pleaded that they

22
23
24
25
26
27
28

18 Defendant cannot credibly argue that its users' personal profiles do not have monetary value,
as Defendant's business model depends upon the value of personal profiles. See, e.g., LinkedIn
Corp., Registration Statement (Form S-1) (January 2011) (noting that "incomplete or outdated
member information would diminish the ability of our marketing solutions customers to reach
their target audiences"). See also Paul M. Schwartz, Property, Privacy, and Personal Data,117
Harv. L. Rev. 2055, 2056-57 (May 2004) ("Personal information is an important currency in the
new millennium. The monetary value of personal data is large and still growing, and corporate
America is moving quickly to profit from this trend."); Pamela Jones Harbour, Federal Trade
Center (FTC) Commissioner, FTC Roundtable Series I on Exploring Privacy (Matter No.
P095416), Dec. 7, 2009, at 2 ("Data is currency.").

- 24 PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT

1

paid for LinkedIn' s services, at least in part, "in exchange for Defendant's

2

promises that it would not make ' [a]ny information provided to third parties

3

through cookies . . . personally identifiable' and that it 'does not provide personally

4

identifiable information to any third party ad network. '"

5

pleaded relinace to their detriment by alleging that "had [they] known Defendant

6

was not keeping their personal information from third parties, they would not

7

have consented [to the dissemination of this information] and Defendant would

8

not have gained commercial advantage from third parties."

9

facts are sufficient to establish for the purposes of the FAL claim that Plaintiffs

10

relied upon, and believed, that Defendant would not share their personally

11

identifiable information.

1 57. Plaintiffs have also

1 117. These alleged

12

Moreover, the Califonria Supreme Court has made clear that Plaintiffs are

13

entitled to an inference of reliance "wherever there is a showing that a

14

misrepresentation was material. " In re Tobacco II Cases, 46 Cal. 4th 298, 327

15

(2009). Plaintiffs have adequately pleaded that Defendant's misrepresentations

16

about its practices with regard to personal information were material. See, e.g.,1 5

17

("Plaintiffs' browsing histories and personal identities are valuable personal

18

property with a market value

As a result of Defendant's unlawful conduct,

19

Plaintiffs relinquished this

valuable

20

compensation to which they were each due.

personal property
(emphasis added));

without

the

1 117.

21

Additionally, Defendant ignores that Plaintiffs' theory of harm is, in part,

22

premised on omissions. The Amended Complaint clearly states that Plaintiffs

23

exchanged money and/or valuable personal information as a result of Defendant' s

24

nondisclosure of its practice of providing users' personal information to third

25

parties. See, e.g.,1 117. Plaintiffs have pleaded sufficient reliance on Defendant' s

26

omissions in that they would not have allowed Defendant to use their personal

27

information to its advantage and to their detriment. Id.

28
- 25 PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT

1

V.

2
3
4

5
6
7
8

PLAINTIFFS' CONTRACT CLAIM ALLEGES RECOVERABLE
DAMAGES

Plaintiffs have established that their personal information is valuable
property. See sec. I, supra. Plaintiffs have also established that they entered a
contract pursuant to which they provided personal information for expressly stated
hrnited purposes in exchange for LinkedIn's services.

See 1 57. Linkedln

breached the contract by using the information for purposes other than expressly
stated in its terms of service by disclosing it to third parties. Plaintiffs, therefore,
are entitled to contractual damages.

9
VI.
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

DEFENDANT CONVERTED PLAINTIFFS' PROPERTY

Defendant tries to avoid liability for conversion by arguing that Plaintiffs'
personal browsing histories and other personal information are intnagible interests
that are not merged with or reflected in something tangible. Def. Mem. at 23-24.
Defendant is wrong.
"[T]he Ninth Circuit recently held that to the extent 'California retains some
vestigial merger requirement, it is clearly minimal, and at most requires only some
connection to a document or tangible object."' Boon Rawd Trading Int'l Co., Ltd.
v. Paleewong Trading Co., Inc., 688 F. Supp. 2d 940, 954 (N.D. Cal. 2010)
(quoting Kremen v. Cohen, 337 F.3d 1024, 1033 (9th Cir.2003)). Plaintiffs here
have established at least a minimal connection by alleging the monetary value of
their personal information. See, e.g.,1 44 ("[w]ebsites and stores ... can easily buy
and sell information on valued visitors with the intention of merging behavioral
with demographic and geographic data in ways that will create social categories
that advertisers covet and target with ads tailored to them or people like them. "
(quoting Joseph Turow, Jennifer King, Chris Jay Hoofnagle, Amy Bleakley, and
Michael Hennessy, Americans Reject Tailored Advertising and Three Activities
that Enable It (Sept. 29, 2009), available at http://ssrn.com/abstract =1478214).

Additionally, every Linkedln member, including Plaintiffs, has a property

28
- 26 PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT

1

interest — in the form of an informational privacy interest, see Hill, 7 Cal. 4th at 35

2

— in preventing third parties from collecting and disseminating private browser

3

histories and other personally identifiable information. This legally recognized

4

informational privacy interest is one which protects the dissemination or misuse of

5

confidential information. Id. California's inalienable right to privacy protects this

6

interest and provides the person whose information is at issue with control over the

7

use of that information. Id.

8

Defendant makes no argument, as it could not, that Plaintiffs do not have a

9

legitimate claim to the exclusive possession of their personal information. 19 The

10

Plaintiffs' personal information Defendant discloses is a commodity sold in

11

discrete units, in which Plaintiffs have a legally protectable interest and, as such

12

°property, that is subject to conversion.

13

Plaintiffs had a precisely defined, legally protected privacy interest.

14

order to determine whether an intangible property right existed . . . (1) there must

15

be an interest capable of precise definition; (2) it must be capable of exclusive

16

possession or control; and (3) the putative owner must have established a

17

legitimate claim to exclusivity." Ali v. Fasteners for Retail, Inc., 544 F. Supp. 2d

18

1064, 1072 (E.D. Cal. 2008). A legally recognized informational privacy interest

19

is one which protects the dissemination or misuse of confidential information. Hill,

20

865 P.2d at 642.

21

informational privacy interest in preventing third parties from collecting and

22

disseminating private browser histories and other personally identifiable

"In

Every Linkedln member, including Plaintiffs, has an

23
24
25
26
27
28

9 Defendant argues that such information is not subject to exclusive possession or control. Def.
Mem. at 23 (citing Ruiz, 540 F. Supp. 2d at 1126). In Ruiz, though, the plaintiffs provided no
support for the argument that Social Security numbers were property subject to bailment. 540 F.
Supp. 2d at 1127. In contrast, Plaintiffs here have provided sufficient support for their theory of a
property interest in the personal information provided to Linkedln. See sec. I.C., supra.

- 27 PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT

1

information. The privacy amendment to the Califonria Constitution was enacted to

2

guard against exactly such an intrusion. /d. 2°

3

VII.

4

THE AMENDED COMPLAINT ADEQUATELY STATES A CLAIM FOR
NEGLIGENCE
Plaintiffs have identified an independent legal duty that Defendant owed to protect

5
against invasion of its users' pirvacy. See sec. II, supra. See sec. II, supra.21 Defendant breached
6
this duty by providing its users' private, sensitive information to third parties without consent.
7
1 124. As to causation, Plaintiffs provided details throughout the Amended Complaint of the
8
mechanism by which Defendant obtained private information and then transmitted that private
9
information without their consent to the emotional and financial detriment of Plaintiffs.
10
CONCLUSION

11

Accordingly, Plaintiffs respectfully request that Defendant's motion to dismiss be denied.
12
DATED: February 2, 2012

Respectfully Submitted,

13

MILBERG LLP
/s/ Peter E. Seidman

14
15

Sanford P. Dumain
Peter E. Seidman
Charles Slidders
Melissa Ryan Clark
MILBERG LLP
One Pennsylvania Plaza
New York, NY 10119
Telephone:
[phone]
Facsimile:
[phone]
Email: [e-mail]
Email: [e-mail]
Email: [e-mail]
Email: [e-mail]

16
17
18
19
20
21
22
23
20

24
25
26
27
28

Defendant argues that such information is not subject to exclusive possession or control. Def.
Mem. at 23 (citing Ruiz, 540 F. Supp. 2d at 1126). In Ruiz, though, the plaintiffs provided no
support for the argument that Social Security numbers were property subject to bailment. 540 F.
Supp. 2d at 1127. In contrast, Plaintiffs here have provided sufficient support for their theory of a
property interest in the personal information provided to Linkedln. See sec. I.C., supra.
21 Additionally, the California Supreme Court has recognized that the common law creates a duty
for private parties to protect others pirvate information in an objectively reasonable manner. See
Hill, 7 Cal. 4th at 27.
- 28 PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT

1

Michael R. Reese
Kim Richman
REESE RICHMAN LLP
875 Avenue of the Americas
New York, NY 10001
Telephone: [phone]
Facsimile: [phone]
Email: [e-mail]
Email: [e-mail]

2
3
4
5
6
7

Attorneys for Plaintiffs

8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
- 29 -

PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT