In Re FACEBOOK INTERNET TRACKING LITIGATION

Filing 78

STATEMENT OF RECENT DECISION pursuant to Civil Local Rule 7-3.d PLAINTIFFS NOTICE OF RECENT DECIONS filed byPerrin Aikens Davis, Brian K. Lentz, Cynthia D. Quinn, Matthew J. Vickery. (Related document(s) # 54 ) (Kiesel, Paul) (Filed on 8/15/2014)

1
2
3
4
5

Paul R. Kiesel (SBN 119854)
[e-mail]
KIESEL LAW LLP
8648 Wilshire Blvd.
Beverly Hills, CA 90211-2910
Telephone: [phone]
Facsimile: [phone]
Liaison Counsel

6
7
8
9

UNITED STATES DISTRICT COURT
NORTHERN DISTRICT OF CALIFORNIA
SAN JOSE DIVISION

10
11
12
13
14

Case No.: 5:12-MD-02314-EJD
IN RE: FACEBOOK INTERNET
TRACKING LITIGATION

PLAINTIFFS’ NOTICE OF RECENT DECIONS
Judge: The Honorable Edward J. Davila
Court Room: 4

15
16
17
18
19

This notice is submitted pursuant to Local Rule 7-3(d)(2). On July 2, 2012, Defendant

20

Facebook, Inc. (“Facebook”) filed a Motion to Dismiss Plaintiffs’ Corrected First Amended

21

Consolidated Class Action Complaint (“Motion”) [Dkt. 44]. On October, 5, 2012, this Court heard

22

argument on Facebook’s Motion and took the matter under submission [Transcript, Dkt. 60]. On

23

October 10, 2013, Defendant Facebook filed a notice of new authority and requested leave to have the

24

new authority considered when ruling on the Motion [Dkt. 69]. Plaintiffs subsequently filed separate

25

notices of new authority and similarly requested leave to have the new authority considered on October

26

11, 2013 [Dkt. 70], March 21, 2014 [Dkt. 73], May 12, 2014 [Dkt. 76], and June 26, 2014 [Dkt. 77].

27

The Plaintiffs now bring two additional decisions to the Court’s attention.

28

PLAINTIFFS’ NOTICE OF RECENT DECISIONS
CASE NO.: 5:12-MD-02314-EJD

1

Exhibit A:

On August 11, 2014, the Director of National Intelligence declassified 38 documents

2

related to the recently discontinued NSA program to collect bulk electronic

3

communications metadata. One of the newly declassified documents is a 117-page

4

undated, redacted opinion by Judge John Bates of the Foreign Intelligence Surveillance

5

Court (the “FISA Court”). On pages 32-33 of the opinion, Judge Bates cites fellow FISA

6

Court Judge Colleen Kollar-Kotelly’s undated earlier ruling with approval that URLs can

7

contain “contents” within the meaning of the Wiretap Act. Judge Kollar-Kotelly’s earlier

8

opinion was provided to this Court on March 21, 2014 [Dkt. 73]. A copy of Judge Bates’

9

opinion is attached as Exhibit A. This ruling relates to Facebook’s argument that “a

10
11

URL, to the extent it is even a ‘communication,’ is not ‘content.’” Motion, p. 14.
Exhibit B:

On August 12, 2014, Judge Lucy Koh granted in part and denied in part a motion to

12

dismiss claims related to defendant Yahoo! Inc.’s practice of scanning emails for content.

13

See In re: Yahoo Mail Litig., 5:13-cv-4980-LHK (N.D. Cal.) [Yahoo Dkt. 49]. A copy of

14

the order is attached as Exhibit B. Judge Koh ruled that generalized allegations of harm

15

based on general business practice were sufficient under Twombly. See id. at 20-21. This

16

ruling relates to Facebook’s arguments related to required specificity of allegations in the

17

complaint. See, e.g., Motion at 18; see also Transcript at 4.

18

Plaintiffs provide these decisions as supplemental authority for the Court’s consideration when deciding

19

the Motion.

20

Dated: August 15, 2014

Respectfully Submitted,

21
22
23
24
25
26
27

KIESEL LAW LLP
By:
/s/ Paul R. Kiesel
Paul R. Kiesel (SBN 119854)
[e-mail]
8648 Wilshire Blvd.
Beverly Hills, CA 90211-2910
Telephone: [phone]
Facsimile: [phone]
Liaison Counsel

28

PLAINTIFFS’ NOTICE OF RECENT DECISIONS
CASE NO.: 5:12-MD-02314-EJD

1

BARTIMUS, FRICKLETON, ROBERTSON &
GOZA, P.C.

2
3
4
5
6
7
8
9
10

By:
/s/ Jim Frickleton
James P. Frickleton
[e-mail]
11150 Overbrook Road, Suite 200
Leawood, KS 66211
Telephone: [phone]
Facsimile: [phone]
Stephen G. Grygiel
[e-mail]
88 E. Bergen Place
Red Bank, NJ 07701
Telephone: [phone]
Facsimile: [phone]

11
12

Plaintiffs’ Executive Committee

13

KAPLAN, FOX & KILSHEIMER LLP

14

By:
/s/ David A. Straite
David A. Straite (admitted pro hac vice)
[e-mail]
850 Third Avenue
New York, NY 10022
Telephone: [phone]
Facsimile: [phone]

15
16
17
18
19

Plaintiffs’ Steering Committee

20
21
22
23
24
25
26
27
28
3
PLAINTIFFS’ NOTICE OF RECENT DECISIONS
CASE NO.: 5:12-MD-02314-EJD

Exhibit A

Exhibit B

Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page1 of 33

1
2
3
4
5
6
7
UNITED STATES DISTRICT COURT

9

NORTHERN DISTRICT OF CALIFORNIA

10
United States District Court
For the Northern District of California

8

SAN JOSE DIVISION

11
12
13
14
15

IN RE YAHOO MAIL LITIGATION

)
)
)
)
)
)
)
)
)

Case No.: 5:13-CV-04980
ORDER GRANTING IN PART AND
DENYING IN PART DEFENDANT’S
MOTION TO DISMISS

16
This case involves putative class action claims regarding Defendant Yahoo!, Inc.’s
17
(“Yahoo”) practice of scanning and analyzing emails of non-Yahoo Mail users in purported
18
violation of federal and California anti-wiretapping laws. Plaintiffs Cody Baker, Brian Pincus,
19
Halima Nobles, and Rebecca Abrams, individually and on behalf of those similarly situated
20
(“Plaintiffs”), allege that Yahoo’s operation of its Yahoo Mail service violates their expectation of
21
privacy under the Electronic Communications Privacy Act (ECPA), California’s Invasion of
22
Privacy Act (CIPA), and the California Constitution. Plaintiffs filed a Consolidated Class Action
23
Complaint on February 12, 2014. ECF No. 35 (“Compl.”). Before the Court is Yahoo’s Motion to
24
Dismiss. ECF No. 37 (“Mot.”). Pursuant to Civil Local Rule 7-1(b), the Court finds this matter
25
appropriate for resolution without a hearing and hereby VACATES the hearing set for August 29,
26
2014. The Case Management Conference set for August 29, 2014 at 10 a.m. remains as set. For the
27
reasons stated below, the Court DENIES in part and GRANTS in part Yahoo’s Motion to Dismiss.
28
1
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS

Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page2 of 33

1

I.

BACKGROUND

2

A.

Factual Allegations

3

Plaintiffs are four individuals representing a class of individuals who do not use Yahoo’s

4

email service (“Yahoo Mail”) but have sent emails to Yahoo Mail users from non-Yahoo email

5

addresses. Compl. ¶¶ 15-18. Plaintiffs allege Yahoo’s practices while operating Yahoo Mail

6

violate state and federal anti-wiretapping laws and invade their protected privacy interests under

7

the California Constitution. Id. ¶¶ 5-7. Plaintiffs seek injunctive and declaratory relief and

8

statutory damages on behalf of a class of non-Yahoo Mail users. Id. ¶ 7. Plaintiffs’ proposed class

9

consists of all persons in the United States who are not Yahoo Mail users and who sent emails to or

United States District Court
For the Northern District of California

10
11
12

received emails from a Yahoo Mail user between October 2, 2011 and the present. Id. ¶ 97.
1.

Yahoo Mail and Yahoo’s Use of Scanned Emails

Yahoo operates Yahoo Mail as a free web-based email service. Id. ¶¶ 20-23. More than 275

13

million users have registered for Yahoo Mail to create @yahoo.com, @ymail.com, or

14

@rocketmail.com email addresses. Id. ¶¶ 20-21. Before signing up for a Yahoo Mail account,

15

potential users must provide Yahoo with personal information such as their name, birthday,

16

telephone number, and account information. Id. ¶ 31.

17

In order to provide Yahoo Mail as a free email service to users, Yahoo charges advertisers

18

to display advertisements on Yahoo Mail webpages. Id. ¶ 23. Roughly 75% of Yahoo’s revenue in

19

2013 came from advertising. Id. ¶ 28. Plaintiffs allege Yahoo can increase its revenues by charging

20

advertisers higher rates to display targeted advertisements to Yahoo Mail users. Id. Thus, Yahoo

21

has a financial incentive to scan and store email content to allow advertisers to target individuals

22

based on certain personal characteristics. Id.

23

The instant dispute concerns Yahoo’s interception, scanning, and storage of Yahoo Mail

24

users’ incoming and outgoing emails for content, specifically the content of emails to and from

25

non-Yahoo Mail users with whom Yahoo Mail users communicate. Plaintiffs allege Yahoo

26

intercepts and scans Yahoo Mail users’ emails “during transit and before placing the emails into

27

storage.” Id. ¶ 24. Plaintiffs allege Yahoo scans, analyzes, collects, and stores user information

28

without their consent. Id. ¶¶ 1, 3, 5, 26.
2
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS

Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page3 of 33

1
2

2.

Yahoo Terms and Privacy Policy

Three relevant agreements exist between Yahoo and Yahoo Mail users: Yahoo Terms of

3

Service (ECF No. 35-1, “TOS”), Yahoo Global Communications Additional Terms of Service for

4

Yahoo Mail and Yahoo Messenger (ECF No. 35-4, “ATOS”), and Yahoo Privacy Policy (ECF No.

5

35-2). When creating a Yahoo Mail account, Yahoo directs users to view the ATOS and Privacy

6

Policy via hyperlinks. Compl. ¶ 31. The sentence “I agree to the Yahoo Terms and Privacy”

7

appears above the “Create Account” Button. ” Id.; see also Mot. at 7. The phrase “Yahoo Terms”

8

links to the ATOS. Compl. ¶ 31. The word “Privacy” is an individual hyperlink to Yahoo’s Privacy

9

Policy. Id. The Complaint does not allege whether “Yahoo Terms” links to the TOS. However,

United States District Court
For the Northern District of California

10

Plaintiff’s Opposition concedes that the TOS, ATOS, and Privacy Policy comprise the agreements

11

between Yahoo and its users. ECF No. 39 (“Opp’n”) at 11.

12

Section 1(c) of the ATOS references Yahoo’s practice of scanning and analyzing users’

13

email content. Additionally, the ATOS places responsibility on Yahoo Mail users to notify about

14

these scanning policies non-users with whom they communicate. The ATOS in relevant part

15

provides:

16
17
18
19
20
21
22

Please note that your Yahoo Messenger account is tied to your Yahoo Mail account.
Therefore, your use of Yahoo Messenger and all Yahoo Messenger services will be subject
to the TOS and laws applicable to the Applicable Yahoo Company in Section 10. Yahoo’s
automated systems scan and analyze all incoming and outgoing communications content
sent and received from your account (such as Mail and Messenger content including instant
messages and SMS messages) including those stored in your account to, without limitation,
provide personally relevant product features and content, to match and serve targeted
advertising and for spam and malware detection and abuse protection. By scanning and
analyzing such communications content, Yahoo collects and stores the data. Unless
expressly stated otherwise, you will not be allowed to opt out of this feature. If you consent
to this ATOS and communicate with non-Yahoo users using the Services, you are
responsible for notifying those users about this feature.
ATOS § 1 (c) (emphasis in original). Plaintiffs allege that Yahoo added the line “By scanning and

23
analyzing such communications content, Yahoo collects and stores the data” “at some time during”
24
the proposed class period. Compl. ¶ 42. The phrase “collects and stores” is a hyperlink that leads
25
the user to a page titled “Yahoo Mail FAQ.” ECF No. 35-7. The FAQ page explains that Yahoo’s
26
scanning technology “looks for patterns, keywords, and files” in users’ emails. Compl. ¶ 47. Yahoo
27
28
3
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS

Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page4 of 33

1

further discloses that it “may anonymously share specific objects from a message with a 3rd party

2

to provide a more relevant experience.” ECF No. 35-7; Compl. ¶ 47.

3
4
5
6
7
8

Yahoo’s TOS and Privacy Policy do not explicitly reference the content of email sent
between users and non-users. Instead, the TOS provides:
Registration Data and certain other information about you are subject to our applicable
privacy policy. For more information, see the full Yahoo Privacy Policy at
http://info.yahoo.com/privacy/us/yahoo/ … You understand that through your use of the
Yahoo Services you consent to the collection and use (as set forth in the applicable privacy
policy) of this information, including the transfer of this information to the United States
and/or other countries for storage, processing and use by Yahoo and its affiliates.
TOS § 4. Yahoo’s Privacy Policy also does not explicitly mention email content. The policy states:

9
“Yahoo collects personal information when you register with Yahoo, when you use Yahoo
United States District Court
For the Northern District of California

10
products or services, when you visit Yahoo pages or the pages of certain Yahoo partners, and when
11
you enter promotions or sweepstakes.” ECF No. 35-2 at 1. Furthermore, the Privacy Policy
12
suggests it covers only “how Yahoo treats personal information that Yahoo collects and receives,
13
including information related to your past use of Yahoo products and services.” Id. Yahoo goes on
14
to define personal information as “personally identifiable” information such as “your name
15
address, email address, or phone number, and that is not otherwise publicly available.” Id. The
16
Privacy Policy also discloses that Yahoo provides users’ personal information to “trusted partners
17
who work on behalf of or with Yahoo under confidentiality agreements.” Id. at 2; Compl. ¶ 37.
18
Yahoo also has a number of other terms and privacy documents in its Terms Center and
19
Privacy Center online. Compl. ¶¶ 43-46. Plaintiffs’ Complaint references one privacy document
20
that applies to Yahoo Mail. ECF No. 35-6. The document has a section titled “Personally Relevant
21
Experiences” that speaks to the scanning and analysis of email content:
22
23
24
25
26

Yahoo provides personally relevant product features, content, and advertising, and spam
and malware detection by scanning and analyzing Mail, Messenger, and other
communications content. Some of these features and advertising will be based on our
understanding of the content and meaning of your communications. For instance, we scan
and analyze email messages to identify key elements of meaning and then categorize this
information for immediate and future use.
ECF No. 35-6.

27
3.

Class Allegations and Relief Sought

28
4
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS

Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page5 of 33

1

Plaintiffs allege that Yahoo’s operation of Yahoo Mail violates the Electronic

2

Communications Privacy Act (ECPA), California’s Invasion of Privacy Act (CIPA), and Article I

3

Section I of the California Constitution. Compl. ¶¶ 5-6. Plaintiffs seek relief on behalf of a class of

4

persons who are not Yahoo Mail users who have either sent emails to or received emails from a

5

Yahoo Mail user. Id. ¶ 97. The proposed class period begins October 2, 2011 and extends to the

6

present. Id. Plaintiffs seek certification of a class of non-Yahoo Mail users, injunctive relief,

7

declaratory relief, statutory damages, and disgorgement of Yahoo’s revenues from unjust

8

enrichment related to Yahoo’s interception, scanning, and storage of emails from and to non-

9

Yahoo Mail users. Id. at p.18.

United States District Court
For the Northern District of California

10

B.

Procedural History

11

Beginning on October 2, 2013, Plaintiffs filed six separate class action complaints against

12

Yahoo in the Northern District of California, alleging that Yahoo scans and analyzes emails in

13

violation of privacy laws. On December 18, 2013, this Court related all six pending actions because

14

they involve the same defendant, Yahoo, and “substantially the same basic allegations” that

15

Yahoo’s “interception, storage, reading and scanning of email violates Plaintiffs’ and other

16

consumers’ rights of privacy.” ECF No. 14 at 2. On January 8, 2014, two of the Plaintiffs filed

17

stipulations to dismiss their actions, which the Court granted. See Kevranian v. Yahoo!, 13-cv-

18

04547-LHK, ECF No. 36. On January 22, 2014, this Court consolidated the remaining four cases

19

for pretrial purposes, ECF No. 27, and appointed interim class counsel, ECF No. 29. Plaintiffs filed

20

a consolidated class action complaint on February 12, 2014. ECF No. 35.

21

On March 5, 2014, Yahoo filed a Motion to Dismiss Plaintiffs’ claims. ECF No. 37. On

22

March 26, 2014, Plaintiffs filed an Opposition to Yahoo’s Motion to Dismiss. ECF No. 39. On

23

April 7, 2014, Yahoo filed a Reply. ECF No. 41 (“Reply”).

24

II.

LEGAL STANDARDS

25

A.

Request for Judicial Notice

26

The Court generally may not look beyond the four corners of a complaint in ruling on a

27

Rule 12(b)(6) motion, with the exception of documents incorporated into the complaint by

28

reference, and any relevant matters subject to judicial notice. See Swartz v. KPMG LLP, 476 F.3d
5
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS

Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page6 of 33

1

756, 763 (9th Cir. 2007); Lee v. City of L.A., 250 F.3d 668, 688-89 (9th Cir. 2001). Under the

2

doctrine of incorporation by reference, the Court may consider on a Rule 12(b)(6) motion not only

3

documents attached to the complaint, but also documents whose contents are alleged in the

4

complaint, provided the complaint “necessarily relies” on the documents or contents thereof, the

5

document’s authenticity is uncontested, and the document’s relevance is uncontested. Coto

6

Settlement v. Eisenberg, 593 F.3d 1031, 1038 (9th Cir. 2010); see Lee, 250 F.3d at 688-89. The

7

purpose of this rule is to “prevent plaintiffs from surviving a Rule 12(b)(6) motion by deliberately

8

omitting documents upon which their claims are based.” Swartz, 476 F.3d at 763.

9

The Court also may take judicial notice of matters that are either (1) generally known

United States District Court
For the Northern District of California

10

within the trial court’s territorial jurisdiction or (2) capable of accurate and ready determination by

11

resort to sources whose accuracy cannot reasonably be questioned. Fed. R. Evid. 201(b). Proper

12

subjects of judicial notice when ruling on a motion to dismiss include legislative history reports,

13

see Anderson v. Holder, 673 F.3d 1089, 1094, n.1 (9th Cir. 2012); court documents already in the

14

public record and documents filed in other courts, see Holder v. Holder, 305 F.3d 854 866 (9th Cir.

15

2002); and publicly accessible websites, see Caldwell v. Caldwell, No. C 05-4166 PJH, 2006 WL

16

618511, at *4 (N.D. Cal. Mar. 13, 2006); Wible v. Aetna Life Ins. Co., 375 F. Supp. 2d 956, 965

17

(C.D. Cal. 2005).

18

B.

19

Pursuant to Federal Rule of Civil Procedure 12(b)(6), a defendant may move to dismiss an

20

action for failure to allege “enough facts to state a claim to relief that is plausible on its face.” Bell

21

Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). “A claim has facial plausibility when the plaintiff

22

pleads factual content that allows the court to draw the reasonable inference that the defendant is

23

liable for the misconduct alleged. The plausibility standard is not akin to a ‘probability

24

requirement,’ but it asks for more than a sheer possibility that a defendant has acted unlawfully.”

25

Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (internal citations omitted). For purposes of ruling on a

26

Rule 12(b)(6) motion, the Court “accept[s] factual allegations in the complaint as true and

27

construe[s] the pleadings in the light most favorable to the non-moving party.” Manzarek v. St.

28

Paul Fire & Marine Ins. Co., 519 F.3d 1025, 1031 (9th Cir. 2008).

Motion to Dismiss

6
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS

Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page7 of 33

1

However, a court need not accept as true allegations contradicted by judicially noticeable

2

facts, Shwarz v. United States, 234 F.3d 428, 435 (9th Cir. 2000), and a “court may look beyond

3

the plaintiff’s complaint to matters of public record” without converting the Rule 12(b)(6) motion

4

into a motion for summary judgment, Shaw v. Hahn, 56 F.3d 1128, 1129 n.1 (9th Cir. 1995). A

5

court is also not required to “‘assume the truth of legal conclusions merely because they are cast in

6

the form of factual allegations.’” Fayer v. Vaughn, 649 F.3d 1061, 1064 (9th Cir. 2011) (per

7

curiam) (quoting W. Min. Council v. Watt, 643 F.2d 618, 624 (9th Cir. 1981)). Mere “conclusory

8

allegations of law and unwarranted inferences are insufficient to defeat a motion to dismiss.”

9

Adams v. Johnson, 355 F.3d 1179, 1183 (9th Cir. 2004); accord Iqbal, 556 U.S. at 678.

United States District Court
For the Northern District of California

10

Furthermore, “a plaintiff may plead herself out of court” if she “plead[s] facts which establish that

11

[s]he cannot prevail on h[er] . . . claim.” Weisbuch v. Cnty. of L.A., 119 F.3d 778, 783 n.1 (9th Cir.

12

1997) (internal quotation marks and citation omitted).

13

C.

14

If the Court determines that the complaint should be dismissed, it must then decide whether

15

to grant leave to amend. Under Rule 15(a) of the Federal Rules of Civil Procedure, leave to amend

16

“shall be freely given when justice so requires,” bearing in mind “the underlying purpose of Rule

17

15 . . . [is] to facilitate decision on the merits, rather than on the pleadings or technicalities.” Lopez

18

v. Smith, 203 F.3d 1122, 1127 (9th Cir. 2000) (en banc) (internal quotation marks and citation

19

omitted). Nonetheless, a court “may exercise its discretion to deny leave to amend due to ‘undue

20

delay, bad faith or dilatory motive on part of the movant, repeated failure to cure deficiencies by

21

amendments previously allowed, undue prejudice to the opposing party . . ., [and] futility of

22

amendment.’” Carvalho v. Equifax Info. Servs., LLC, 629 F.3d 876, 892-93 (9th Cir. 2010)

23

(quoting Foman v. Davis, 371 U.S. 178, 182 (1962)) (alterations in original).

24

III.

25

Leave to Amend

REQUESTS FOR JUDICIAL NOTICE
In support of its Motion to Dismiss, Yahoo requests the Court take judicial notice of (A) a

26

transcript of proceedings held on September 5, 2013 in In Re: Google Inc. Gmail Litigation, 13-

27

md-02430 LHK (N.D. Cal); and (B) U.S. Senate Report No. 99-541 (1986) discussing Congress’

28

intent in passing ECPA. ECF No. 38. Plaintiffs did not file any opposition to these requests, and
7
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS

Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page8 of 33

1

even cite to Exhibit B in their Opposition. Opp’n at 14. The Court takes judicial notice of both

2

Exhibit A and Exhibit B. Yahoo’s Exhibit A is a public document that is part of this Court’s own

3

records. See Jared v. Keahey (In re Keahey), 414 Fed. Appx. 919, 923 (9th Cir. 2011)

4

(unpublished) (“A trial court may take judicial notice of its own records, even in unrelated

5

cases[.]”). Exhibit B is a legislative history report, which is also a proper subject of judicial notice.

6

See Anderson, 673 F.3d at 1094 n.1.
In support of their Opposition to Yahoo’s Motion to Dismiss, Plaintiffs request judicial

8

notice of (A) an amicus brief filed by Senator Patrick J. Leahy in United States v. Councilman,

9

First Circuit Case No. 03-1383; (B) Senate Report 90-1097 discussing Congress’ intent in passing

10
United States District Court
For the Northern District of California

7

the Omnibus Crime Control and Safe Streets Act of 1968; and (C) a California state superior court

11

decision addressing violations of the California constitution, Ung v. Facebook, 1-12-cv-217244,

12

Dkt. No. 54 (July 2, 2012). ECF No. 40. Yahoo did not file any opposition to Plaintiffs’ request for

13

judicial notice. The Court also takes judicial notice of Plaintiffs’ Exhibits A, B, and C. All three are

14

matters of public record and thus judicially noticeable. Exhibit A is an amicus brief that discusses

15

the legislative history of the ECPA. Courts have taken judicial notice of amicus briefs that relate to

16

the matters at issue. See Gustavson v. Wrigley Sales Co., 961 F. Supp. 2d 1100, 1113 n.1 (N.D.

17

Cal. 2013). Exhibit B is a Senate Report discussing legislative history, which is judicial noticeable.

18

See Anderson, 673 F.3d at 1094 n.1. Exhibit C is a relevant state court decision. Bias v. Moynihan,

19

508 F.3d 1212, 1225 (9th Cir. 2007) (“[W]e ‘may take notice of proceedings in other courts, both

20

within and without the federal judicial system, if those proceedings have a direct relation to the

21

matters at issue.’” (internal citations omitted)).

22

While neither party requests judicial notice of the following items, the Court sua sponte

23

takes judicial notice of Exhibits A-G attached to Plaintiffs’ Complaint because they are aspects of a

24

publicly accessible website, Plaintiffs’ Complaint necessarily relies on the contents of these

25

webpages, and Yahoo does not contest the authenticity of the documents. See Coto Settlement, 593

26

F.3d at 1038; Caldwell, 2006 WL 618511, at *4. These include: (1) Yahoo Terms of Service (ECF

27

No. 35-1, “TOS”); (2) Yahoo Privacy Policy (ECF No. 35-2); (3) Yahoo Global Communications

28
8
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS

Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page9 of 33

1

Additional Terms of Service for Yahoo Mail and Yahoo Messenger (ECF No. 35-4, “ATOS”); and

2

(4) Yahoo Mail FAQ (ECF No. 35-7).

3

IV.

MOTION TO DISMISS

4

A.

Electronic Communications Privacy Act

5

Plaintiffs allege that Yahoo’s email scanning practices violate federal anti-wiretapping

6

laws. Plaintiffs bring causes of action under two separate titles of ECPA: the Wiretap Act, Compl.

7

¶¶ 75-83, and the Stored Communications Act (“SCA”), id. ¶¶ 84-92. The Court provides

8

background on both statutes before addressing Yahoo’s arguments in its Motion to Dismiss.

9

Congress passed ECPA in 1986 to protect the privacy of electronic communications. See

United States District Court
For the Northern District of California

10

Konop v. Hawaiian Airlines, Inc., 302 F.3d 868, 874 (9th Cir. 2002). Title I of the ECPA amended

11

the federal Wiretap Act to impose liability for the interception of certain electronic

12

communications while they are in transit. Specifically, a Wiretap Act violation exists when any

13

person “intentionally intercepts, endeavors to intercept, or procures any other person to intercept or

14

endeavor to intercept, any wire, oral, or electronic communication.” 18 U.S.C. § 2511(1)(a); see

15

also id. § 2520 (creating a private right of action for violations of id. § 2511). The Wiretap Act

16

defines “intercept” as “the aural or other acquisition of the contents of any wire, electronic, or oral

17

communication through the use of any electronic mechanical, or other device.” 18 U.S.C. §

18

2510(4). Prior to the ECPA, the Wiretap Act only imposed liability for the interception of wire and

19

oral communications such as telephone calls. However, the Wiretap Act now sweeps more broadly

20

and applies with equal force to private email communications and websites. See Konop, 302 F.3d at

21

876 (“We therefore conclude that Konop’s website fits the definition of ‘electronic

22

communication.’”).

23

The Wiretap Act includes various exemptions for such interceptions, two of which are

24

relevant to the instant case. First, the Wiretap Act provides that “[i]t shall not be unlawful . . . to

25

intercept a wire, oral, or electronic communication . . . where one of the parties to the

26

communication has given prior consent to such interception.” 18 U.S.C. § 2511(2)(d). Since the

27

Wiretap Act concerns the unauthorized interception of electronic communication, the consent of

28

one party is a complete defense to a Wiretap Act claim. Murray v. Fin. Visions, Inc., CV-07-25789
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS

Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page10 of 33

1

PHX-FJM, 2008 WL 4850328, at *4 (D. Ariz. Nov. 7, 2008). Second, in the Wiretap Act’s

2

definition of “device,” there is an explicit exclusion for “any telephone or telegraph instrument,

3

equipment or facility, or any component thereof . . . being used by a provider of wire or electronic

4

communication service in the ordinary course of its business.” 18 U.S.C. § 2510(5)(a)(ii). Without

5

use of a “device” as defined by the Act, there is no illegal interception.

6

In contrast to the interception of electronic communications, the SCA prohibits certain

7

unauthorized access to stored communications and records. Enacted as Title II of the ECPA, the

8

SCA imposes civil and criminal liability for anyone who “(1) intentionally accesses without

9

authorization a facility through which an electronic communication service is provided; or (2)

United States District Court
For the Northern District of California

10

intentionally exceeds an authorization to access that facility; and thereby obtains, alters, or prevents

11

authorized access to a wire or electronic communication while it is in electronic storage in such

12

system.” 18 U.S.C. § 2701(a) (emphasis added). 18 U.S.C. § 2510(17)(A) states that “ ‘electronic

13

storage’ means . . . any temporary, intermediate storage of a wire or electronic communication

14

incidental to the electronic transmission thereof.” The SCA grants immunity to 18 U.S.C. § 2701(a)

15

claims to electronic communication service providers (“ECS providers”) for accessing content on

16

their own servers. 18 U.S.C. § 2701(c)(1). “A provider of email services is an ECS [provider].” See

17

Low v. LinkedIn Corp., 900 F. Supp. 2d 1010, 1022 (N.D. Cal. 2012). Because Yahoo is an ECS

18

provider, the SCA permits Yahoo to access Yahoo Mail communications. 18 U.S.C. § 2701(c)(1).

19

However, ECS providers still may not “knowingly divulge . . . the contents of a communication

20

while in electronic storage by that service.” Id. § 2702(a)(1). Similar to the Wiretap Act, the SCA

21

also includes an exception to liability under 18 U.S.C. § 2701(a) for user consent, id. § 2701(c)(2),

22

and to liability under 18 U.S.C. § 2702(a) due to user consent, id. § 2702(b)(3).

23
24
25

1.

The Wiretap Act
a.

Whether the Wiretap Act Applies to Yahoo’s Conduct

Yahoo first argues Plaintiffs’ Wiretap Act claim must be dismissed because the SCA, not

26

the Wiretap Act, applies to Yahoo’s conduct. Mot. at 1. Yahoo first notes that the Ninth Circuit has

27

held that for a communication to be “intercepted” in violation of the Wiretap Act, it must be

28

accessed during transmission – i.e., while it is in transit – and not while it is in “electronic storage.”
10
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS

Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page11 of 33

1

Mot. at 4 (citing Konop, 302 F.3d at 878). Yahoo then argues that the emails Yahoo accessed and

2

scanned in this case had already reached Yahoo’s servers, and that because such emails “are

3

necessarily in temporary storage en route to the recipient,” they fall within the SCA’s definition of

4

“electronic storage.” Mot. at 1, 4 (citing 18 U.S.C. § 2510(17)(A) which states “ ‘electronic

5

storage’ means . . . any temporary, intermediate storage of a wire or electronic communication

6

incidental to the electronic transmission thereof.”). Accordingly, Yahoo argues that its access to

7

these emails is governed by the SCA because Yahoo has not made any “interception” under the

8

Wiretap Act. In support of its argument that the term “intercept” under the Wiretap Act does not

9

apply to the “en route storage of electronic communications,” Yahoo sets forth its interpretation of

United States District Court
For the Northern District of California

10

a footnote in Konop, 302 F.3d at 880 n.6. Mot. at 5. Plaintiffs respond by claiming that Konop’s

11

footnote is dicta, and that out of circuit authority makes clear that an interception can occur at any

12

point “during the transmission of an email from the sender to the recipient.” Opp’n at 8.

13

The Court does not address Yahoo’s argument by analyzing whether Ninth Circuit law

14

holds that the term “intercept” under the Wiretap Act applies to the “en route storage of electronic

15

communications” because Yahoo’s argument is premature. On a Rule 12(b)(6) motion to dismiss,

16

the Court must “accept factual allegations in the complaint as true.” Manzarek, 519 F.3d at 1031.

17

Here, Plaintiffs allege Yahoo “intercepts emails sent to and from its Yahoo Mail users while the

18

emails are in transit,” Compl. ¶ 1 (emphasis added); see also id. ¶ 24 (“Yahoo intercepts and scans

19

its users’ incoming emails for content during transit and before placing the emails into storage.”)

20

(emphasis added); id. ¶ 80 (“Yahoo knowingly and purposefully intercepts emails in transit to and

21

from Yahoo Mail accounts.” (emphasis added)); id. ¶ 87 (“Plaintiffs allege that Yahoo intercepts

22

communications while ‘in transit’ and thus in violation of the Wiretap Act.”). At this stage, the

23

Court must accept as true Plaintiffs’ allegations that the emails were in transit when Yahoo

24

accessed them. Because Yahoo’s argument rests on Yahoo’s assumption that the emails were in

25

electronic storage and no longer in transit when Yahoo accessed them, the Court cannot consider

26

Yahoo’s argument because that assumption contradicts Plaintiffs’ allegations.

27
28

In other words, until the Court can determine when and how Yahoo intercepted users’
emails, the Court must accept as true Plaintiffs’ allegation that they were accessed while “in
11
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS

Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page12 of 33

1

transit.” Yahoo does not provide the Court with any judicially noticeable information as supporting

2

evidence for its claim that the emails had already reached Yahoo’s servers when Yahoo accessed

3

them. The Court will consider Yahoo’s argument that the term “intercept” under the Wiretap Act

4

does not apply to the en route storage of electronic communications if and when Yahoo shows, at

5

the summary judgment stage after discovery, that Yahoo intercepted users’ emails after those

6

emails had already reached Yahoo’s servers. Accordingly, the Court DENIES Yahoo’s Motion to

7

Dismiss Plaintiffs’ Wiretap Act claim on the basis that the Wiretap Act does not apply to the

8

emails at issue.

9

b.

United States District Court
For the Northern District of California

10

Consent

Plaintiffs allege Yahoo’s operation of Yahoo Mail involves the knowing and purposeful

11

interception of emails “in transit to and from Yahoo Mail accounts” without consent and “for

12

[Yahoo’s] own profit.” Compl. ¶¶ 79-81. Yahoo moves to dismiss the Wiretap Act claim on the

13

ground that Yahoo obtained express consent for its interception and email scanning from all Yahoo

14

Mail users when they signed up for Yahoo Mail. Mot. at 7. Plaintiffs respond there is no consent by

15

Yahoo Mail users because none of Yahoo’s terms adequately discloses that Yahoo engages in this

16

conduct. Opp’n at 11. The Court GRANTS Yahoo’s Motion to Dismiss for the reasons stated

17

below.

18

Consent to an interception under the Wiretap Act may be either explicit or implied, but it

19

must be actual. See United States v. Poyck, 77 F.3d 285, 292 (9th Cir. 1996); United States v.

20

Amen, 831 F.3d 373, 378 (2d Cir. 1987); United States v. Corona-Chavez, 328 F.3d 974, 978 (8th

21

Cir. 2003). The Wiretap Act only requires one party to the communication to consent to an

22

interception to relieve the provider of liability. 18 U.S.C. § 2511(2)(d). Thus, Yahoo has not

23

violated the Wiretap Act if Yahoo’s agreements with Yahoo Mail users suffice to show consent.

24

However, consent under § 2511(2)(d) is “not an all-or-nothing proposition.” See In Re: Google Inc.

25

Gmail Litigation, 13-md-02430-LHK, 2013 WL 5423918, at *12 (N.D. Cal. Sept. 26, 2013)

26

(hereinafter “Gmail”); see also Watkins v. L.M. Berry & Co., 704 F.2d 577, 582 (11th Cir. 1983)

27

(“[C]onsent within the meaning of section 2511(2)(d) . . . can be limited. It is the task of the trier of

28

fact to determine the scope of the consent and to decide whether and to what extent the interception
12
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS

Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page13 of 33

1

exceeded that consent.”). In other words, “[a] party may consent to the interception of only part of

2

a communication or to the interception of only a subset of its communications.” In re Pharmatrack,

3

Inc., 329 F.3d 9, 19 (1st Cir. 2003). Furthermore, as “the party seeking the benefit of the

4

exception,” the burden is on Yahoo to prove it obtained consent. Id. This Court applies a

5

reasonable user standard to determine consent under the Wiretap Act. See Perkins v. LinkedIn

6

Corp., 13-CV-04303-LHK, 2014 WL 2751053, at *14 (N.D. Cal. June 12, 2014); Gmail, 2013 WL

7

5423918, at *14.
Yahoo argues that Yahoo Mail users explicitly consented1 to Yahoo’s conduct by agreeing

8
9

to the ATOS. Mot. at 1, 7-8. As a preliminary matter, Yahoo is correct that Yahoo Mail users

United States District Court
For the Northern District of California

10

agreed to the ATOS. When registering for Yahoo Mail, users must click a “Create Account” button

11

that appears below the sentence: “I agree to the Yahoo Terms and Privacy.” Compl. ¶ 31; Mot. at 7.

12

The “Yahoo Terms” hyperlink directs users to view the ATOS. Compl. ¶ 31. The word “Privacy”

13

is an individual hyperlink to Yahoo’s Privacy Policy. Id. Thus, it is clear based on the allegations in

14

the Complaint that Yahoo Mail users agreed to at least the ATOS and Privacy Policy when they

15

created an account. Notably, Plaintiffs do not argue that Yahoo Mail users did not read and agree to

16

these documents when creating accounts, and do not dispute that users can view these agreements

17

when they sign-up for Yahoo Mail and click “Create Account.” Compl. ¶ 31. To the contrary,

18

Plaintiffs concede that the ATOS, TOS, and Privacy Policy all “comprise the agreement between

19

Yahoo and its users.” Opp’n at 11.

20

The question thus becomes whether the ATOS sufficiently establishes user consent by

21

putting users on notice of Yahoo’s alleged conduct, and if so, to what extent. Plaintiffs allege that

22

Yahoo scanned and analyzed emails to “provide personally relevant product features and content,”

23

“to match and serve targeted advertising,” for “spam and malware detection and abuse protection,”

24

to use the information from the emails to create user profiles, to share the information from the

25

emails with third parties, and to “collect” and “store” the information for “future use.” Compl. ¶¶ 1,

26

3-4, 26-27, 29, 41, 46-49, 50, 70-71. The Court thus evaluates whether the ATOS adequately

27
1

28

Yahoo does not argue there was implied consent by either party to the communication, nor does
Yahoo contend that non-users consented to the alleged interceptions.
13

Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS

Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page14 of 33

1

notifies the reasonable Yahoo Mail user that their emails with non-Yahoo Mail users will be

2

intercepted for these various purposes.

3

The Court concludes that the ATOS establishes explicit consent by Yahoo Mail users to

4

Yahoo’s conduct. Notably, Section 1(c) of the ATOS explicitly acknowledges that Yahoo scans

5

and analyzes users’ email for various purposes: “Yahoo’s automated systems scan and analyze all

6

incoming and outgoing communications content sent and received from your account (such as Mail

7

and Messenger content including instant messages and SMS messages) including those stored in

8

your account to, without limitation, provide personally relevant product features and content, to

9

match and serve targeted advertising and for spam and malware detection and abuse protection. . .

United States District Court
For the Northern District of California

10

. Unless expressly stated otherwise, you will not be allowed to opt out of this feature. If you

11

consent to this ATOS and communicate with non-Yahoo users using the Services, you are

12

responsible for notifying those users about this feature.” Compl. ¶ 41; ECF No. 35-4 (ATOS)

13

(emphases added). In light of the clarity of the language in this disclosure, to which Yahoo Mail

14

users agreed when creating an account, the Court finds that the ATOS provides explicit and

15

sufficient notification to Yahoo Mail users that any communication sent via Yahoo Mail will be

16

scanned and analyzed for the stated purposes of providing personal product features, providing

17

targeted advertising, and detecting spam and abuse. By agreeing to the ATOS, Yahoo Mail users

18

consented to such conduct. Plaintiffs provide no convincing argument to the contrary other than to

19

say that “the ATOS does not explicitly inform Yahoo Mail users what Yahoo does with the

20

contents of its users’ email.” Opp’n at 11. This argument fails in light of the specific statements in

21

the ATOS that Yahoo scans the emails in order to “provide personally relevant product features

22

and content, to match and serve targeted advertising and for spam and malware detection and abuse

23

protection.” ECF No. 35-4 at 1. Plaintiffs’ other argument that the TOS and Privacy Policy “say

24

nothing about the scanning and analysis of email,” Opp’n at 11, is unavailing in light of how the

25

language in the ATOS itself suffices to establish explicit consent. Accordingly, the Court

26

concludes that Yahoo obtained consent from one party to the electronic communications to scan

27

and analyze emails for the purposes of providing personal product features, providing targeted

28

advertising, and detecting spam and abuse. See Mortensen v. Bresnan Commun., L.L.C., CV 10-1314
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS

Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page15 of 33

1

BLG-RFC, 2010 WL 5140454, at *5 (D. Mont. Dec. 13, 2010) (dismissing ECPA claim because

2

“through the OnLine Subscriber Agreement, the Privacy Notice and the NebuAd link on Bresnan’s

3

website, Plaintiffs did know of the interception and through their continued use of Bresnan’s

4

Internet Service, they gave or acquiesced their consent [under § 2511(2)(d)] to such interception”).

5

The Court further finds that the ATOS also established Yahoo Mail users’ consent to
Yahoo’s practice of scanning and analyzing emails for the purposes of creating user profiles for

7

both parties to the email communication and sharing content from the emails with third parties.

8

Compl. ¶ 27. Notably, Plaintiffs allege that Yahoo’s creation of user profiles serves to “enhance

9

Yahoo’s ability to target advertising” and that Yahoo’s sharing of information with third parties is

10
United States District Court
For the Northern District of California

6

for “advertising purposes.” Id.2 Plaintiffs do not allege that creation of user profiles or sharing of

11

information with third parties serves any other purpose other than targeted advertising. Thus, the

12

Court concludes that the explicit notice in the ATOS that Yahoo scans and analyzes emails in order

13

to “match and serve targeted advertising” suffices to prove that by agreeing to the ATOS, users

14

also consented to Yahoo’s conduct of scanning and analyzing emails for the purpose of creating

15

user profiles and sharing content with third parties. In light of the ATOS, the Court concludes that

16

additional allegations cannot save Plaintiff’s claim that there was no consent to scan and analyze

17

emails for the purposes of providing personal product features, providing targeted advertising,

18

detecting spam and abuse, creating user profiles, and sharing information with third parties. Thus,

19

the Court GRANTS Yahoo’s Motion to Dismiss Plaintiffs’ Wiretap Act claim with respect to

20

scanning and analyzing for these purposes with prejudice.

21

The only remaining question is whether there was consent to Yahoo’s conduct of

22

“collecting” and “storing” the content from emails for “future use.” Plaintiffs claim Yahoo

23

provided Yahoo Mail users no notice of this conduct. Opp’n at 12. Plaintiffs note that for part of

24

the class period, the ATOS did not inform users that Yahoo collects and stores email content on its

25

2

26
27
28

The Complaint also alleges that “Yahoo can increase revenues by obtaining more detailed
background information about users of the service,” and that “Yahoo benefits from gathering as
much personal information about its Yahoo Mail users, and non-users who email with its users, as
it can.” Id. ¶ 28. Plaintiffs’ allegations do not explain how Yahoo increases its revenues other than
to provide targeted advertisements. Id. (“Yahoo can charge advertisers substantially more to place
ads that are ‘targeted’ to certain demographic groups and even to specific individuals.”).
15

Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS

Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page16 of 33

1

servers. Id.; Compl. ¶ 42. Plaintiffs concede that “at some time during the proposed class period,”

2

Yahoo revised ATOS § 1(c) by adding the line: “By scanning and analyzing such communications

3

content, Yahoo collects and stores the data.” Compl. ¶¶ 41-42; Opp’n at 12. Nonetheless, Plaintiffs

4

argue that even after Yahoo added this statement, Yahoo did not provide sufficient notice of

5

collection and storage because Yahoo failed to explain to users “what it does with the data” it

6

stores or what Yahoo “plans to do with it in the future.” Opp’n at 12. The Court disagrees and finds

7

users were on notice and thus consented to how Yahoo “collects” and “stores” the content from

8

emails for “future use,” as explained below.

9

Plaintiffs concede that for at least the latter part of the class period, the ATOS explicitly

United States District Court
For the Northern District of California

10

notified users that Yahoo “collects and stores” their email communications. Compl. ¶¶ 41-42;

11

Opp’n at 12. The Court concludes that this explicit language contained in the agreement between

12

Yahoo and its users sufficed to put a reasonable user on notice of such collection and storage for

13

the latter part of the class period. The Court further concludes that even for the portion of the class

14

period during which the ATOS did not explicitly reference collection and storage, the reasonable

15

user was nonetheless similarly on notice that Yahoo engages in collection and storage of email

16

content. This is because the reasonable user would know that the ATOS’s language that Yahoo

17

“scan[s] and analyze[s]” email content necessarily means Yahoo simultaneously collects and stores

18

the email content, i.e., the reasonable user would know that “scanning and analyzing” requires

19

Yahoo to collect and store the email content. In other words, the Court finds it implausible that

20

users did not – after agreeing, based on the ATOS, to Yahoo’s scanning and analysis of emails –

21

realize that in order to engage in analysis of emails, Yahoo would have to store the emails

22

somewhere on its servers. Indeed, Plaintiffs do not provide any plausible reason why scanning and

23

analyzing email content does not require the collection and storage of that content. If anything,

24

Plaintiffs’ allegation that Yahoo “scans [email] content, storing the data it collects” suggests that

25

the very process of scanning simultaneously stores the content. Compl. ¶ 1. Furthermore, the

26

ATOS stated, at all times during the class period, that Yahoo “store[s]” emails in users’ accounts,

27

which would have put the reasonable user on notice that Yahoo already stores at least some emails

28

on its servers. ECF No. 35-4 (ATOS) (“Yahoo’s automated systems scan and analyze all incoming
16
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS

Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page17 of 33

1

and outgoing communications content sent and received from your account . . . including those

2

stored in your account[.]”) (emphasis added). Thus, the Court concludes that the reasonable user

3

was on notice and thus consented to Yahoo’s collection and storage of email content when the user

4

agreed to the ATOS.

5

The only remaining issue is whether Yahoo informed users that Yahoo was going to use the
information it was collecting and storing in the “future.” Plaintiffs claim there was no notice of

7

such future conduct because users had no notice of what specific use Yahoo would make of the

8

email content in the future. Opp’n at 12. Plaintiffs’ argument is unconvincing. Given the explicit

9

statements in the ATOS that Yahoo scans and analyzes email content to provide personal product

10
United States District Court
For the Northern District of California

6

features, provide targeted advertising, and detect spam and abuse. It is logical that Yahoo’s future

11

uses would be the same. Further, Plaintiffs do not allege what they believe Yahoo was planning to

12

do with the email content in the future separate and apart from the various uses of which this Court

13

has already found users were on notice: to provide personal product features, provide targeted

14

advertising, and detect spam and abuse. Accordingly, the Court finds that Yahoo Mail users

15

consented to Yahoo’s collection and storage of their emails for future use, and GRANTS Yahoo’s

16

Motion to Dismiss the Wiretap claim with respect to this conduct. However, the Court GRANTS

17

leave to amend in order to allow Plaintiffs to allege any other “future use” they believe Yahoo

18

would make of their email content, separate and apart from the uses of which this Court has found

19

users had notice.3

20

2.

21

The Stored Communications Act

In the alternative to a Wiretap Act violation, Plaintiffs argue that Yahoo’s scanning

22

practices violate the Stored Communications Act. Compl. ¶ 6. Plaintiffs assert this claim in the

23

alternative “in the event the Court concludes that Yahoo accesses plaintiffs’ emails after they have

24

been delivered to the recipients” and are thus in storage. Opp’n at 3; Compl. at ¶ 87 (“Plaintiffs

25
26
27
28

3

Because the Court GRANTS Yahoo’s Motion to Dismiss the Wiretap Act claim on consent
grounds, the Court need not reach Yahoo’s argument that the “ordinary course of business”
exception to Wiretap Act liability applies. The Court also need not reach Yahoo’s argument, raised
for the first time in Reply, that Plaintiffs’ “bare allegation” that Yahoo intercepts emails while they
are “in transit” fails to state a Wiretap Act claim under Twombly. Reply at 2.
17
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS

Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page18 of 33

1

assert this SCA claim in the alternative, in the event the Court finds that Yahoo intercepts the

2

emails while they are in ‘storage’ rather than ‘in transit’[.]”). Yahoo moves to dismiss Plaintiffs’

3

SCA claim.

4

Yahoo contends that if the SCA applies to Plaintiffs’ claims, Yahoo has statutory immunity

5

to any alleged 18 U.S.C. § 2701(a) violation4 pursuant to 18 U.S.C. § 2701(c)(1) and 18 U.S.C. §

6

2701(c)(2). Mot. at 11-12. Plaintiffs concede that Yahoo has immunity to any alleged § 2701(a)

7

violation pursuant to § 2701(c)(1), which grants immunity for alleged violations of § 2701(a) to

8

ECS providers like Yahoo for accessing electronic communications stored on their own servers.5

9

Opp’n at 14 (acknowledging that “the SCA immunizes electronic service providers like Yahoo

United States District Court
For the Northern District of California

10

from liability for accessing emails that are in its users’ mailboxes or in the service providers’

11

‘backup protection.’”); see also In re iPhone Application Litig., 844 F. Supp. 2d 1040, 1057 (N.D.

12

Cal. 2012).6 Accordingly, the Court GRANTS Yahoo’s Motion to Dismiss with prejudice any

13

claim that Yahoo violated § 2701(a).7

14

However, Plaintiffs also assert Yahoo is liable under 18 U.S.C. § 2702(a)(1), which

15

prohibits Yahoo from disclosing the content of users’ emails to third parties. Compl. ¶ 90 (alleging

16

Yahoo’s “sharing of the content with third parties”); Opp’n at 14-15 (stating Yahoo is “prohibited

17

from disclosing the contents of their customers’ emails to any person or entity”). Plaintiffs claim

18

Yahoo improperly disclosed to third parties the content from the scanned emails between Yahoo

19

Mail users and non-users. Id. Section 2702(a)(1) holds ECS providers liable under the SCA if they

20

“knowingly divulge to any person or entity the contents of a communication while in electronic

21
22
23
24
25
26
27
28

4

An SCA violation under 18 U.S.C. § 2701(a) occurs when someone “(1) intentionally accesses
without authorization a facility through which an electronic communication service is provided; or
(2) intentionally exceeds an authorization to access that facility; and thereby obtains, alters, or
prevents authorized access to a wire or electronic communication while it is in electronic storage in
such system.” 18 U.S.C. § 2701(a).
5
Section 2701(c)(1) provides an exception to liability for an 18 U.S.C. § 2701(a) violation when
the conduct is authorized: “(1) by the person or entity providing a wire or electronic
communications service.” 18 U.S.C. § 2701(c)(1).
6
Plaintiffs’ Complaint does not explicitly state which provision of the SCA Yahoo has violated.
7
Because the parties agree that Yahoo has immunity under 18 U.S.C. § 2701(c)(1), the Court does
not reach whether Yahoo had its users’ consent to access the communications under 18 U.S.C. §
2701(c)(2), as Yahoo claims, Mot. at 12 n.9.
18
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS

Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page19 of 33

1

storage by that service.” 18 U.S.C. § 2702(a)(1). Yahoo argues Plaintiffs’ claim for a violation of §

2

2702(a)(1) lacks the factual specificity required by Twombly because “plaintiffs have failed to

3

allege specific information about what information they contend was shared, with whom, and for

4

what purpose.” Mot. at 13 n.10. The Court finds that the Complaint adequately alleges that Yahoo

5

improperly disclosed portions of the “contents of a communication” to third parties in violation of

6

§ 2702(a)(1), as explained below. Accordingly, the Court DENIES Yahoo’s Motion to Dismiss

7

Plaintiffs’ SCA claim for improper disclosure under § 2702(a)(1).

8
9

In order to state a claim for improper disclosure under the SCA, Plaintiffs must plausibly
allege that Yahoo knowingly divulged “the contents of a communication.” See In re Zynga Privacy

United States District Court
For the Northern District of California

10

Litigation, 750 F.3d 1098, 1109 (9th Cir. 2014). The Complaint makes several references to

11

Yahoo’s alleged disclosure of email content to third parties. Compl. ¶¶ 27, 37, 47, 49, 71, 90.

12

Plaintiffs allege that after Yahoo scans and analyzes electronic communications between users and

13

non-users of Yahoo Mail, Yahoo “provides some of the information it collects from its users’

14

incoming and outgoing email to unidentified ‘trusted partners’ and other third parties for

15

advertising purposes.” Compl. ¶¶ 26-27. Plaintiffs claim their allegations lack detail in terms of

16

alleging what content was shared because discovery is at an early stage and Yahoo has not revealed

17

with whom it shares email content. Opp’n at 15. Plaintiffs claim, however, that their allegations are

18

sufficient because they are “based on Yahoo’s own statements about its practices” contained in two

19

documents: the Privacy Policy, ECF No. 35-2, and the Yahoo Mail FAQ, ECF No. 35-7. Opp’n at

20

15.

21

The Court notes, as a preliminary matter, that Plaintiffs are incorrect to argue that the

22

Privacy Policy supports Plaintiffs’ argument that their allegations sufficiently plead that Yahoo

23

divulged “the contents of a communication.” The Plaintiffs cite to one part of the Privacy Policy

24

which states that Yahoo provides “its users’ personal information ‘to trusted partners who work on

25

behalf of or with Yahoo under confidentiality agreements.’” Compl. ¶ 37. The SCA distinguishes

26

between “contents of a communication” and “record information.” The SCA incorporates the

27

definition of “contents” from the Wiretap Act. 18 U.S.C. § 2711(1). Under the Wiretap Act,

28

“contents” includes “any information concerning the substance, purport, or meaning of that
19
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS

Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page20 of 33

1

communication.” Id. § 2510(8). The Ninth Circuit has interpreted the language and statutory

2

framework of ECPA to find that “contents” means “a person’s intended message to another.”

3

Zynga, 750 F. 3d at 1106. In contrast to “contents,” customer “record information” includes

4

personally identifiable information such as the customer’s name, address, and identity. Id. at 1104.

5

The Ninth Circuit has clearly held that “contents” under the ECPA “does not include record

6

information regarding the characteristics of the message that is generated in the course of the

7

communication.” Id. at 1106. As noted above, in order to state a claim for improper disclosure,

8

Plaintiffs must plausibly allege that Yahoo knowingly divulged “the contents of a communication.”

9

Id. at 1109. Thus, Plaintiffs’ allegations must show that Yahoo disclosed “contents,” not “record

United States District Court
For the Northern District of California

10

information,” to third parties. However, the Privacy Policy appears to refer only to “record

11

information” rather than the “contents” of an electronic communication like emails, as Yahoo

12

argues. Reply at 9. The Privacy Policy states that “[Yahoo] provide[s] the information to trusted

13

partners who work on behalf of or with Yahoo under confidentiality agreements. These companies

14

may use your personal information to help Yahoo communicate with you about offers from Yahoo

15

and our marketing partners.” ECF No. 35-2 (emphasis added). The Privacy Policy, which states

16

that it “covers how Yahoo treats personal information,” defines “personal information” as

17

“information about you that is personally identifiable like your name, address, email address or

18

phone number, and that is not otherwise publicly available.” Id. Nothing in this language suggests

19

that “personal information” includes content from email exchanges. Plaintiffs themselves even

20

admit that the Privacy Policy says “nothing about the scanning and analysis of email.” Opp’n at 11.

21

Accordingly, because the Privacy Policy refers to “record information” rather than the “contents”

22

of an electronic communication, the Privacy Policy language that Yahoo shares personal

23

information with “trusted partners” does not support Plaintiffs’ allegation that Yahoo shares

24

“contents of a communication” with third parties.

25

Nonetheless, the Court still finds that Plaintiffs’ allegations suffice to plausibly allege a

26

claim under Twombly. This is because the Complaint contains sufficient factual detail to plausibly

27

allege that Yahoo shared with third parties “the contents of a communication.” Zynga, 750 F. 3d at

28

1109. As stated above, Plaintiffs allege at various points that Yahoo shared email content with third
20
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS

Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page21 of 33

1

parties. See Compl. at ¶ 71 (alleging Yahoo “distributes the content of the emails to third parties”);

2

id. at ¶ 90 (alleging Yahoo shares “the content [of emails] with third parties”). Plaintiffs further

3

allege that one question in the FAQ reads: “Does Yahoo Mail automatically share my messages

4

with anyone else?” to which Yahoo’s response states, “Yahoo may anonymously share specific

5

objects from a message with a 3rd party to provide a more relevant experience within your mail.

6

For example, Yahoo may share a package tracking number with the shipping company so that you

7

can easily see when your package will arrive, or may share your flight number with your airline to

8

enable flight notifications within your inbox.” Id. at ¶¶ 47, 49 (citing ECF No. 35-7 at 2 (emphasis

9

added)). The language “specific objects from a message” falls within the SCA’s definition of

United States District Court
For the Northern District of California

10

“contents of a communication” because the phrase “specific objects” clearly refers to the

11

“contents” of a “message,” the latter of which is an email communication. See Konop, 302 F.3d at

12

875 (“The legislative history of the ECPA suggests that Congress wanted to protect electronic

13

communications that are configured to be private, such as email and private electronic bulletin

14

boards.”); see also O'Grady v. Superior Court, 139 Cal. App. 4th 1423, 1443 (2006) (“[The SCA]

15

clearly prohibits any disclosure of stored email other than as authorized by enumerated

16

exceptions.” (emphasis added)). Thus, pursuant to Plaintiffs’ allegations, Yahoo’s own FAQ page

17

admits that Yahoo shares email content with third parties. Under these circumstances, the Court

18

concludes that Plaintiffs have plausibly alleged that Yahoo improperly disclosed “contents” of

19

email communications to third parties.

20

While Yahoo argues Plaintiffs have failed to allege what specific information was shared

21

and with what specific third parties, the FAQ, as alleged in the Complaint, does give at least one

22

example of the kind of information in emails that was shared with third parties – i.e., a package

23

tracking number. In any event, Yahoo cites no case holding that a plaintiff must allege the specific

24

information in the content that was shared or the identity of the third party in order to state a claim

25

for a violation of § 2702(a)(1). Ultimately, the Court finds that Plaintiffs’ allegations as a whole

26

sufficiently plead “factual content that allows the court to draw the reasonable inference that the

27

defendant is liable for the misconduct alleged.” Iqbal, 556 U.S. at 678 (internal citations omitted).

28
21
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS

Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page22 of 33

1

The Court notes that in its Reply, Yahoo argues in one sentence in a footnote that the

2

language in the ATOS “suffices as consent for SCA purposes.” Reply at 6 n.7. Because the Court

3

has concluded, as Plaintiffs concede, that Yahoo has not violated § 2701(a), the only consent

4

exception relevant under the SCA is the consent exception to a § 2702(a) violation, see §

5

2702(b)(3). However, Yahoo did not argue in its opening brief that there was consent for a §

6

2702(a) violation and only focused on how Yahoo had consent to a § 2701(a) violation pursuant to

7

§ 2701(c)(2). Mot. at 12 n.9. Thus, the Court does not consider Yahoo’s consent argument in its

8

Reply because arguments raised for the first time in Reply briefs are waived. Sealant Sys. Intl., Inc.

9

v. TEK Global S.R.L., 5:11-CV-00774-PSG, 2014 WL 1008183, at *14 (N.D. Cal. March 7, 2014).

United States District Court
For the Northern District of California

10

Accordingly, the Court DENIES Yahoo’s Motion to Dismiss Plaintiffs’ SCA claim for improper

11

disclosure under § 2702(a)(1).

12
13
14
15
16
17
18
19
20

3.

Good Faith Defense

Yahoo raises a good faith defense against Plaintiffs’ Wiretap Act and SCA claims. Mot. at
13. The Wiretap Act provides:
A good faith reliance on—
(1) a court warrant or order, a grand jury subpoena, a legislative authorization, or a
statutory authorization (including a request of a governmental entity under section
2703 (f) of this title);
(2) a request of an investigative or law enforcement officer under section 2518 (7)
of this title; or
(3) a good faith determination that section 2511(3) or 2511(2)(i) of this title
permitted the conduct complained of;
is a complete defense against any civil or criminal action brought under this chapter or any
other law.
18 U.S.C. § 2520(d); see also 18 U.S.C. § 2707(e) (providing a nearly identical good faith defense

21
for SCA violations). Specifically, as a defense to Plaintiffs’ § 2701(a) SCA claim, Yahoo claims it
22
relied in good faith on §§ 2701(a), (c). As a defense to Plaintiffs’ Wiretap claim, Yahoo claims it
23
relied on (1) the decisions of the Ninth Circuit in Konop and Theofel v. Farey-Jones, 359 F.3d 1066
24
(9th Cir. 2003), that hold, in Yahoo’s view, that the SCA rather than the Wiretap Act applies to
25
email scanning that occurs once emails have reached an ECS provider’s servers; (2) 18 U.S.C. §
26
2511(c), the consent exception; and (3) 18 U.S.C. § 2511(2)(a)(i), the ordinary course of business
27
exception. Mot. at 13.
28
22
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS

Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page23 of 33

1

The Court does not reach Yahoo’s good faith reliance on §§ 2701(a) and (c) because the

2

Court GRANTS, on other grounds as stated above, Yahoo’s Motion to Dismiss any claim that

3

Yahoo violated § 2701(a). See supra, Part IV.A.2. The Court also does not reach Yahoo’s alleged

4

good faith reliance on the Ninth Circuit decisions Konop and Theofel or on §§ 2511(c) and

5

2511(2)(a)(i) of the Wiretap Act because the Court GRANTS, on other grounds as set forth above,

6

Yahoo’s Motion to Dismiss the Wiretap claim, see supra, Part IV.A.1.b. Thus, the Court need not

7

reach Yahoo’s Motion to Dismiss either the SCA claim or Wiretap claim based on the good faith

8

defense.

9

B.

United States District Court
For the Northern District of California

10

California’s Invasion of Privacy Act (“CIPA”)

Plaintiffs bring a cause of action under CIPA, Cal. Penal Code § 630, et seq. CIPA is

11

California’s anti-wiretapping and anti-eavesdropping statute that prohibits unauthorized

12

interceptions of communications in order “to protect the right of privacy.” Cal. Penal Code § 630.

13

The California Legislature enacted CIPA in 1967 in response to “advances in science and

14

technology [that] have led to the development of new devices and techniques for the purpose of

15

eavesdropping upon private communications[.]” Id. Yahoo moves to dismiss the CIPA claim. The

16

Court DENIES Yahoo’s motion.

17

Section 631 of CIPA makes it unlawful to use “any machine, instrument or contrivance” to

18

intentionally intercept the content of a communication over any “telegraph or telephone wire, line,

19

cable or instrument,” or to read, attempt to read, or learn the “contents or meaning of any message,

20

report, or communication while the same is in transit or passing over any wire, line or cable”

21

without the consent of all parties to the communication. See Cal. Penal Code § 631(a). The

22

California Supreme Court has held that § 631 protects against three distinct types of harms:

23

“intentional wiretapping, willfully attempting to learn the contents or meaning of a communication

24

in transit over a wire, and attempting to use or communicate information obtained as a result of

25

engaging in either of the two previous activities.” Tavernetti v. Superior Court, 22 Cal. 3d 187, 192

26

(1978).

27
28

Plaintiffs allege Yahoo has violated § 631 of CIPA. Compl. ¶¶ 53-65. Yahoo moves to
dismiss first on the grounds that § 631 only applies to communications intercepted “in transit,” and
23
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS

Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page24 of 33

1

that here the communications at issue were not “in transit” but in “electronic storage” because the

2

emails were already on Yahoo’s servers when Yahoo accessed the emails. Mot. at 14-15. Second,

3

Yahoo similarly argues that the all-party consent provision in § 631 should not apply to “recorded

4

communications” already in the hands of and received by a provider because that would lead to

5

illogical results, id. at 16, and thus that this Court must interpret CIPA to find that “when an email

6

reaches the recipient’s provider,” the email “is no longer in transit” and CIPA does not apply.

7

Reply at 13. Finally, Yahoo argues that the SCA and Wiretap Act would preempt § 631 if CIPA

8

applied to emails “on an ECS providers’ servers” – like the emails Yahoo contends are at issue

9

here. Id. at 18-19.

United States District Court
For the Northern District of California

10

Yahoo relies on Konop to support its contention that emails an ECS provider has received

11

en route to a recipient are in electronic storage rather than “in transit,” and thus that CIPA does not

12

apply. Mot. at 14. Yet as discussed above, see supra Part IV.A.1.a, the Court must accept as true

13

Plaintiffs’ allegation that “Yahoo intercepts and scans its users’ incoming emails for content during

14

transit and before placing the emails into storage.” Compl. ¶ 24. The Court must defer resolution of

15

whether Yahoo accessed the emails only after the emails were on Yahoo’s servers until after

16

discovery makes clear where and how Yahoo’s scanning technology intercepted the emails. Thus,

17

the Court rejects Yahoo’s first argument that CIPA does not apply.

18

Yahoo’s second argument that CIPA should not apply when an email has reached Yahoo’s

19

servers – based on allegedly illogical implications that would result from applying CIPA’s all-party

20

consent provision to such emails – similarly assumes the emails were on Yahoo’s server when

21

intercepted, which this Court cannot assume at this stage. Even if the Court could make such an

22

assumption, the Court would still have to reject Yahoo’s argument that the Court should find the

23

emails at issue were not “in transit” when intercepted because that would contradict the allegations

24

in the Complaint, which the Court must accept as true. Thus, the Court rejects Yahoo’s second

25

argument why CIPA does not apply.

26

Finally, the Court rejects Yahoo’s preemption argument for similar reasons. Yahoo

27

contends that the SCA and Wiretap Act preempt Plaintiffs’ CIPA claims, relying on all three

28

theories of federal preemption. Mot. at 18; Chae v. SLM Corp., 593 F.3d 936, 941 (9th Cir. 2010)
24
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS

Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page25 of 33

1

(internal quotation marks and citations omitted) (“Federal preemption occurs when: (1) Congress

2

enacts a statute that explicitly pre-empts state law; (2) state law actually conflicts with federal law;

3

or (3) federal law occupies a legislative field to such an extent that it is reasonable to conclude that

4

Congress left no room for state regulation in that field.”). Specifically, Yahoo does not contend that

5

ECPA wholly preempts CIPA, but argues that CIPA would conflict with ECPA only if CIPA

6

applied to emails that have already reached a provider’s servers, as Yahoo argues the emails in the

7

instant case had. Mot. at 18; Reply at 13; Mot. at 19 (arguing that the ECPA “preempts parallel

8

state legislation regulating the conduct of email providers when accessing emails on their

9

servers.”). However, again here, Yahoo’s argument assumes the emails were on Yahoo’s server

United States District Court
For the Northern District of California

10

when intercepted, which this Court cannot simply assume at this stage when allegations in the

11

Complaint are to the contrary.

12

Accordingly, the Court DENIES Yahoo’s Motion to Dismiss Plaintiffs’ CIPA claim.

13

C.

14

Plaintiffs allege that Yahoo’s scanning, storage, and disclosure of Plaintiffs’ email content

California Constitution

15

violates their right to privacy under Article I, Section 1 of the California Constitution. Compl. ¶¶

16

66-74. Yahoo contends Plaintiffs fail to allege sufficient facts to state a claim. Mot. at 21. The

17

Court GRANTS Yahoo’s motion with leave to amend.

18

The California Constitution creates a privacy right that protects individuals from the

19

invasion of their privacy by private parties. Am. Acad. of Pediatrics, 16 Cal. 4th 307, 326 (1997);

20

Leonel v. Am. Airlines, Inc., 400 F.3d 702, 711-12 (9th Cir. 2005), opinion amended on denial of

21

reh’g, 03–15890, 2005 WL 976985 (9th Cir. 2005). To establish an invasion of privacy claim, a

22

plaintiff must demonstrate three elements: “(1) a legally protected privacy interest; (2) a reasonable

23

expectation of privacy in the circumstances; and (3) conduct by defendant constituting a serious

24

invasion of privacy.” Hill v. Nat’l Collegiate Athletic Ass’n, 7 Cal. 4th 1, 39-40 (1994). These

25

elements are not a categorical test, but rather serve as threshold components of a valid claim to be

26

used to “weed out claims that involve so insignificant or de minimis an intrusion on a

27

constitutionally protected privacy interest as not even to require an explanation or justification by

28

the defendant.” Loder v. City of Glendale, 14 Cal. 4th 846, 893 (1997).
25
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS

Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page26 of 33

1

“A ‘reasonable’ expectation of privacy is an objective entitlement founded on broadly
based and widely accepted community norms.” Hill, 7 Cal. 4th at 37. The decision “must take into

3

account any ‘accepted community norms,’ advance notice to [Plaintiff] . . ., and whether [Plaintiff]

4

had the opportunity to consent to or reject the very thing that constitutes the invasion.” TBG Ins.

5

Servs. Corp. v. Superior Court, 96 Cal. App. 4th 443 (2002). The plaintiff in an invasion of privacy

6

action must have conducted himself or herself in a manner consistent with an actual expectation of

7

privacy, i.e., he or she must not have manifested by his or her conduct a voluntary consent to the

8

invasive actions of defendant. Hill, 7 Cal. 4th at 26. The “community norms” aspect of the

9

“reasonable expectation of privacy” element means that “‘[t]he protection afforded to the plaintiff’s

10
United States District Court
For the Northern District of California

2

interest in his privacy must be relative to the customs of the time and place, to the occupation of the

11

plaintiff and to the habits of his neighbors and fellow citizens.’” TBG Ins. Servs. Corp., 96 Cal.

12

App. 4th at 450. Finally, “[a]ctionable invasions of privacy must be sufficiently serious in their

13

nature, scope, and actual or potential impact to constitute an egregious breach of the social norms

14

underlying the privacy right. Thus, the extent and gravity of the invasion is an indispensable

15

consideration in assessing an alleged invasion of privacy.” Hill, 7 Cal. 4th at 37.

16

In the event a plaintiff establishes the three elements, the “diverse and somewhat

17

amorphous character of the privacy right” may still be balanced with competing or countervailing

18

interests of the defendant. Id. at 37-38 (“Conduct alleged to be an invasion of privacy is to be

19

evaluated based on the extent to which it furthers legitimate and important competing interests.”).

20

“Invasion of a privacy interest is not a violation of the state constitutional right to privacy if the

21

invasion is justified by a competing interest.” Id. at 38. Furthermore, if Plaintiffs’ allegations

22

“show no reasonable expectation of privacy or an insubstantial impact on privacy interests, the

23

question of invasion may be adjudicated as a matter of law.” Pioneer Electronics, Inc. v. Sup. Ct. of

24

L.A., 40 Cal. 4th 360, 370 (2007) (citing Hill, 7 Cal. 4th at 40).

25

The California Constitution sets a “high bar” for establishing an invasion of privacy claim.

26

See Belluomini v. Citigroup, Inc., No. CV 13–01743 CRB, 2013 WL 3855589, at *6 (N.D. Cal.

27

July 24, 2013). Even disclosure of very personal information has not been deemed an “egregious

28

breach of social norms” sufficient to establish a constitutional right to privacy. Id.; see also In re
26
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS

Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page27 of 33

1

iPhone Application Litig., 844 F. Supp. 2d at 1063 (holding that the disclosure to third parties of

2

unique device identifier number, personal data, and geolocation information did not constitute an

3

egregious breach of privacy sufficient to prove a serious invasion of a privacy interest); Ruiz v.

4

Gap, Inc., 540 F. Supp. 2d 1121, 1127-28 (N.D. Cal. 2008), aff’d, 380 Fed. Appx. 689 (9th Cir.

5

2010) (unpublished) (holding that the theft of a retail store’s laptop containing personal

6

information, including the social security numbers, of job applicants did not constitute an egregious

7

breach of privacy and therefore was not sufficient to state a claim); Folgelstrom v. Lamps Plus,

8

Inc., 195 Cal. App. 4th 986, 992 (2011) (“Here, the supposed invasion of privacy essentially

9

consisted of [defendant] obtaining plaintiff’s address without his knowledge or permission, and

United States District Court
For the Northern District of California

10

using it to mail him coupons and other advertisements. This conduct is not an egregious breach of

11

social norms, but routine commercial behavior.”).

12

Finally, “[w]hether a legally recognized privacy interest is present in a given case is a

13

question of law to be decided by the court.” Hill, 7 Cal. 4th at 40. “Whether plaintiff has a

14

reasonable expectation of privacy in the circumstances and whether defendant’s conduct

15

constitutes a serious invasion of privacy are mixed questions of law and fact. If the undisputed

16

material facts show no reasonable expectation of privacy or an insubstantial impact on privacy

17

interests, the question of invasion may be adjudicated as a matter of law.” Id.

18

Here, the question is whether Plaintiffs have alleged sufficient facts to demonstrate (1) a

19

legally protected privacy interest; (2) a reasonable expectation of privacy under the circumstances;

20

and (3) conduct by Yahoo that amounts to a serious invasion of that protected privacy interest.

21

Plaintiffs allege that Yahoo scans and stores the content of emails between Yahoo Mail users and

22

non-users, and distributes that content to third parties. Compl. ¶ 71. Plaintiffs allege they have a

23

legally protected privacy interest “in the private email communications” they send to Yahoo Mail

24

users. See id. ¶ 69; Opp’n at 24.8 Plaintiffs assert that they “reasonably expect that their email

25
26
27
28

8

Plaintiffs allege in the Complaint that they have a “legally protected interest in their private email
communications with Yahoo Mail users.” Compl. ¶ 69. From the Complaint alone, it is unclear if
Plaintiffs allege that non-Yahoo Mail users have privacy interest in both the emails sent to and
received from Yahoo Mail users. However, in their Opposition, Plaintiffs assert they have a
privacy interest in the “emails they send to Yahoo Mail users.” Opp’n at 23-24. This suggests
27

Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS

Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page28 of 33

1

communications with Yahoo Mail users are private,” and do not expect Yahoo to intercept, scan,

2

and store the content of their emails without their consent. Compl. ¶ 70. Finally, Plaintiffs allege

3

Yahoo committed an egregious breach of social norms when it intercepted these emails, scanned

4

and stored their content, and distributed the content to third parties without Plaintiffs’ consent. Id. ¶

5

71. In response, Yahoo argues that Plaintiffs fail to set forth facts supporting all three elements but

6

merely recite elements of the claim. Mot. at 21. Yahoo argues Plaintiffs “allege no facts regarding

7

the content of their emails, their intent in sending those emails, the circumstances under which

8

those emails were sent, or who the recipients of those emails were[.]” Id. at 21-22. The Court

9

agrees with Yahoo that Plaintiffs have failed to allege sufficient facts to establish that Yahoo’s

United States District Court
For the Northern District of California

10
11

conduct invaded their constitutionally protected right to privacy.
As a preliminary matter, under California law there are only two classes of legally protected

12

privacy interests under the California Constitution: “interests in precluding the dissemination or

13

misuse of sensitive and confidential information (‘informational privacy’); and (2) interests in

14

making intimate personal decisions or conducting personal activities without observation,

15

intrusion, or interference (‘autonomy privacy’).” Hill, 7 Cal. 4th at 35. It is unclear from Plaintiffs’

16

briefing and allegations whether Plaintiffs assert a claim for informational privacy or autonomy

17

privacy. However, the Court construes Plaintiffs’ claim as asserting only an informational privacy

18

interest, as California courts have discussed autonomy privacy in the context of cases alleging

19

bodily autonomy. See, e.g., Comm. To Defend Reprod. Rights v. Myers, 29 Cal. 3d 252, 275 (1981)

20

(noting there is a constitutional right to privacy in a woman’s “personal bodily autonomy”); Smith

21

v. Fresno Irrigation Dist., 72 Cal. App. 4th 147, 161 (1999) (discussing autonomy privacy in the

22

context of drug testing through use of a urine sample).

23

Next, the Court notes it is unclear from Plaintiffs’ allegations and briefing whether

24

Plaintiffs claim a privacy interest in their emails generally, or in the specific content in the emails

25

they sent to Yahoo Mail users. To the extent Plaintiffs claim a legally protected privacy interest

26

and reasonable expectation of privacy in email generally based on the mere fact that Yahoo

27
28

Plaintiffs only intend to allege that they have a constitutionally protected privacy interest in their
own outgoing email content rather than the content they receive from Yahoo Mail users.
28
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS

Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page29 of 33

1

intercepted and distributed their emails, regardless of the specific content in the emails, Plaintiffs’

2

claim fails as a matter of law. Plaintiffs do not cite, nor has this Court found, any case in the

3

California or federal courts holding that individuals have a legally protected privacy interest or

4

reasonable expectation of privacy in emails generally. Rather, the cases in which courts have found

5

a protected privacy interest in the context of email communications have done so in circumstances

6

where the plaintiff alleged with specificity the material in the content of the email. See, e.g., Mintz

7

v. Mark Bartelstein & Associates Inc., 906 F. Supp. 2d 1017, 1033-34 (C.D. Cal. 2012) (finding

8

legally protected privacy interest in the personal financial and employment information contained

9

in an email account). The conclusion that there is no legally protected privacy interest and

United States District Court
For the Northern District of California

10

reasonable expectation of privacy in emails as a general matter is consistent with well-established

11

California law that in the context of informational privacy, the California Constitution protects only

12

the “dissemination or misuse of sensitive and confidential information.” Hill, 7 Cal. 4th at 35

13

(emphasis added). Hill suggests that in order to receive protection under the Constitution for an

14

email communication, Plaintiffs must allege that the email intercepted actually included content

15

that qualifies under California law as “confidential” or “sensitive.” Indeed, courts make their

16

decisions regarding whether a plaintiff has stated a legally protectable privacy interest based on the

17

nature of the information at issue. See, e.g., Tourgeman v. Collins Financial Servs. Inc., No. 08–

18

01392, 2009 WL 6527758, at *2 (S.D. Cal. Nov. 23, 2009) (holding plaintiff had legally protected

19

privacy interest by citing California case law holding that financial information is protectable); see

20

also Zbitoff v. Nationstar Mortgage, LLC, No. C 13–05221 WHA, 2014 WL 1101161, at *4 (N.D.

21

Cal. March 18, 2014) (holding plaintiff failed to state privacy claim “with the required specificity”

22

where she “merely state[d] that she had a ‘reasonable expectation that defendants would preserve

23

the privacy of [p]laintiff’s private information’” and did “not identify exactly what private

24

information defendants are alleged to have disclosed in relation to the credit checks[.]” (emphasis

25

added)); Norman–Bloodsaw v. Lawrence Berkeley Lab., 135 F.3d 1260, 1271 n.17 (9th Cir. 1998)

26

(“Under California law, a legally recognizable privacy interest arises from the sort of information

27

revealed[.]”).9 Thus, to the extent Plaintiffs claim they have a legally protected privacy interest and

28

9

The nature of the content at issue is also examined when courts assess whether the third prong of
29

Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS

Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page30 of 33

1

reasonable expectation of privacy in email generally, regardless of the specific content in the

2

emails at issue, Plaintiffs’ claim fails as a matter of law.

3

However, this Court concludes, as others have, that there can be a legally protected privacy

4

interest or reasonable expectation of privacy in any confidential and sensitive content within

5

emails. See, e.g., Mintz, 906 F. Supp. 2d at 1033-34 (finding legally protected privacy interest in

6

personal financial and employment information contained in emails).10 The problem for Plaintiffs

7

in the instant case, however, is that to the extent Plaintiffs intend to allege that they have a privacy

8

interest in the specific content of their emails, their allegations are fatally conclusory. The

9

Complaint merely alleges that Plaintiffs’ emails were “private” without alleging any facts related to

United States District Court
For the Northern District of California

10

what particular emails Yahoo intercepted, or the content within particular emails. See Compl. ¶¶

11

69-70; Zbitoff, 2014 WL 1101161, at *4 (holding allegations for constitutional privacy claim were

12

conclusory because plaintiff “merely state[d]” defendants disclosed her “private information”);

13

Scott-Codiga v. Cnty. of Monterey, 10-CV-05450-LHK, 2011 WL 4434812, at *7 (N.D. Cal. Sept.

14

23, 2011) (dismissing constitutional privacy claim on ground that plaintiff had not “specified the

15

material defendants released to the public in enough detail for the Court to determine whether it

16

might conceivably fall within a recognized privacy interest protected by the [California]

17

constitution” (internal citation omitted)). Without more, Plaintiffs’ allegations are simply a bare

18

recitation of the elements of a privacy claim, and this Court cannot assess whether Plaintiffs had a

19

legally protected privacy interest in the specific emails that Yahoo intercepted, or a reasonable

20

expectation of privacy in the content within those emails.

21
22

Plaintiffs’ arguments to the contrary are unavailing. First, they argue that they have stated a
privacy claim by emphasizing that they do not consent to Yahoo’s conduct. Opp’n at 23-24;

23
24
25
26
27
28

a privacy claim is met – i.e., whether there was a serious or egregious violation of social norms.
See Low v. LinkedIn Corp., 900 F. Supp. 2d 1010, 1025 (N.D. Cal. 2012) (declining to find that
defendant violated constitutional right to privacy in releasing digital identification information to
third parties in part because “it is not clear . . . what information, precisely, these third parties have
obtained.” (emphasis added)).
10
While Yahoo cites this Court’s holding in Gmail that the plaintiffs in that case had not shown
that the email communications were “confidential communications” under CIPA § 632, Reply at
15, Gmail did not suggest or hold that there can never be a reasonable expectation of privacy in
email content. Rather, Gmail confronted a circumstance similar to the instant motion, where
plaintiffs suggested that emails in general were confidential.
30
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS

Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page31 of 33

1

Compl. ¶¶ 70-71. However, Plaintiffs cite no authority in support of their argument that an

2

allegation of lack of consent suffices to state a privacy claim. Rather, the case law suggests that in

3

determining whether a plaintiff has satisfied the elements of the claim, a plaintiff’s lack of consent

4

does not matter so much as the nature of the information in which he or she alleges a privacy

5

interest. See, e.g., In re iPhone Application Litig., 844 F. Supp. 2d at 1063 (“Even assuming this

6

information was transmitted without Plaintiffs’ knowledge and consent, a fact disputed by

7

Defendants, such disclosure [of information including device identifier number, personal data, and

8

geolocation information] does not constitute an egregious breach of social norms.” (emphasis

9

added)).

United States District Court
For the Northern District of California

10

Plaintiffs also argue that they need not allege that each of their emails contained

11

confidential information in order to state a claim because the right to privacy was adopted to

12

protect the public from the “stockpiling of personal information.” Opp’n at 24. Plaintiffs cite to the

13

ballot argument for the initiative creating the constitutional right to privacy as evidence that the

14

people intended to prevent “government and business interests from collecting and stockpiling

15

unnecessary information about us and or misusing information gathered for one purpose in order to

16

serve other purposes or to embarrass us.” Id. at 23 (citing Hill, 7 Cal. 4th at 27). According to

17

Plaintiffs, this history demonstrates that the right to privacy protects individuals from Yahoo’s

18

unauthorized scanning and storage of private email content for their own financial gain. Id. at 23-

19

24. The Court is not convinced. Plaintiffs cite no authority holding that an allegation of

20

“stockpiling” by itself is sufficient to state a privacy claim, and somehow nullifies the need to

21

allege facts regarding the three required prongs of the Hill test.11 To the contrary, this Court has

22
23
24
25
26
27
28

11

Plaintiffs’ cited cases do not so hold. Opp’n at 25. Rather, they are inapposite, as they arise in the
Fourth Amendment context. See United States v. Forrester, 512 F.3d 500 (9th Cir. 2007); United
States v. Warshak, 631 F.3d 266 (6th Cir. 2010); Klayman v. Obama, 957 F. Supp. 2d 1 (D.D.C.
2013). In these cases, courts considered the implications of the government’s intelligence gathering
and surveillance practices, and the compelled disclosure of communications held by an internet
service provider. A person’s reasonable expectation of privacy is considerably distinct in the
context of the instant case, where an ECS provider scanned emails that were either written by
Yahoo Mail users through a service Yahoo itself provided (Yahoo Mail) or were voluntarily sent to
Yahoo’s servers. Furthermore, a claim under Article 1, Section 1 requires a plaintiff to show the
privacy invasion is serious and “egregious,” thus setting a higher threshold than for a federal claim
under the Fourth Amendment. Chevron Corp. v. Donziger, 12-MC-80237 CRB (NC), 2013 WL
31
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS

Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page32 of 33

1

noted that merely alleging stockpiling is not enough; plaintiffs must still allege facts with respect to

2

the three elements. See Low, 900 F. Supp. 2d at 1024 n.3 (holding, where plaintiffs argued that the

3

intent of the voters was to prevent “stockpiling” of information, that “[e]ven in light of this ballot

4

history, the subsequent case law regarding the Constitutional right to privacy establishes that only

5

serious invasions of privacy give rise to a private right of action.” ).12

6

In sum, because Plaintiffs do not plead sufficient facts to allege an invasion of privacy,

7

Yahoo’s Motion to Dismiss Plaintiffs’ claims for a violation of Article I, Section 1 of the

8

California Constitution is GRANTED. However, the Court grants leave to amend because

9

Plaintiffs may be able to plead specific email content in specific emails that may suffice to state the

United States District Court
For the Northern District of California

10

elements of the claim.

11

IV.

CONCLUSION

12

For the foregoing reasons, the Court GRANTS Yahoo’s Motion to Dismiss with prejudice

13

Plaintiffs’ Wiretap Act claim that Yahoo scans and analyzes emails for the purposes of providing

14

personal product features, providing targeted advertising, detecting spam and abuse, creating user

15

profiles, and sharing information with third parties. The Court GRANTS Yahoo’s Motion to

16

Dismiss without prejudice Plaintiffs’ Wiretap Act claim with respect to collecting and storing

17

emails for future use.

18
19
20
21
22
23
24
25
26
27
28

4536808, at *10 (N.D. Cal. Aug. 22, 2013) (citing Norman–Bloodsaw v. Lawrence Berkeley Lab.,
135 F.3d 1260, 1271 (9th Cir. 1998)).
12
While Plaintiffs rely on Ung v. Facebook, Inc., Santa Clara County Superior Court Case No. 112-cv-217244, Dkt. No. 54 (July 2, 2012), see ECF No. 40-1 at 230, that case did not hold that an
allegation of stockpiling information automatically suffices to state a privacy claim. Further, that
case is distinguishable. There, where it was alleged that Facebook created user profiles linked to
Facebook users’ identities by tracking the internet browsing history of users across numerous other
websites even when the user is not logged into Facebook, the court found a legally protected
privacy interest in users’ “identifiable browsing history” because Facebook could link the history
to their identities, or names. Id. The court also held that non-Facebook users did not have a
protected interest in their browsing history which Facebook tracked because the history “had not
been linked to their identities.” Id. Plaintiffs in Yahoo are more analogous to the non-Facebook
users in Ung who did not have a privacy interest because the emails Yahoo allegedly intercepts are
not linked to Plaintiffs’ identities, as Yahoo does not necessarily know who Plaintiffs are. While
Plaintiffs allege Yahoo creates “profiles” of them, Compl. ¶ 27, Plaintiffs do not allege that Yahoo
attempts to link the information it acquires to Plaintiffs’ identities (i.e., to their names) as opposed
to just creating generic profiles that describe Plaintiffs’ interests and general characteristics
(female, likes shampoo products, etc).
32
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS

Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page33 of 33

1

The Court GRANTS Yahoo’s Motion to Dismiss with prejudice with respect to Plaintiffs’

2

SCA claim for unauthorized access under § 2701(a). The Court DENIES Yahoo’s Motion to

3

Dismiss Plaintiffs’ SCA claim for improper disclosure under § 2702(a)(1). The Court GRANTS

4

Yahoo’s Motion to Dismiss without prejudice Plaintiffs’ claim under Article I, Section 1 of the

5

California Constitution. The Court DENIES Yahoo’s Motion to Dismiss Plaintiffs’ CIPA § 631

6

claim.

7

Plaintiffs shall file any amended complaint within 21 days of this order. Plaintiffs may not

8

add new causes of action or parties without a stipulation or order of the Court under Rule 15 of the

9

Federal Rules of Civil Procedure. Failure to cure the deficiencies addressed in this Order will result

United States District Court
For the Northern District of California

10

in dismissal with prejudice.

11

IT IS SO ORDERED.

12

Dated: August 12, 2014

_________________________________
LUCY H. KOH
United States District Judge

13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
33

Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS

1
2

CERTIFICATE OF SERVICE
I hereby certify that on August 15, 2014, I caused the foregoing to be electronically filed

3 with the Clerk of the Court using the CM/ECF system which will send notification of such filing
4 to the e-mail addresses denoted on the Electronic Mail Notice List, and I hereby certify that I
5 caused the foregoing document or paper to be mailed via the United States Postal Service to the
6 non-CM/ECF participants indicated on the Manual Notice List.
7

I certify under penalty of perjury under the laws of the United States of America that the

8 foregoing is true and correct. Executed on August 15, 2014.
9
10 DATED: August 15, 2014

Respectfully Submitted,

11

KIESEL LAW LLP

12
13
14
15
16

By:

/s/ Paul R. Kiesel
Paul R. Kiesel
[e-mail]
8648 Wilshire Boulevard
Beverly Hills, California 90211
Tel.: [phone]
Fax: [phone]

17
18
19
20
21
22
23
24
25
26
27
28

CERTIFICATE OF SERVICE
5:12-MD-02314-EJD