Campbell et al v. Facebook Inc.
Filing
34
NOTICE of Recent Decision by Matthew Campbell, Michael Hurley, David Shadpour. (Attachments: # 1 Exhibit A)(Gardner, Melissa) (Filed on 8/19/2014) Modified on 8/20/2014 (kcS, COURT STAFF).
EXHIBIT A
Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page1 of 33
1
2
3
4
5
6
7
UNITED STATES DISTRICT COURT
9
NORTHERN DISTRICT OF CALIFORNIA
10
United States District Court
For the Northern District of California
8
SAN JOSE DIVISION
11
12
13
14
15
IN RE YAHOO MAIL LITIGATION
)
)
)
)
)
)
)
)
)
Case No.: 5:13-CV-04980
ORDER GRANTING IN PART AND
DENYING IN PART DEFENDANT’S
MOTION TO DISMISS
16
This case involves putative class action claims regarding Defendant Yahoo!, Inc.’s
17
(“Yahoo”) practice of scanning and analyzing emails of non-Yahoo Mail users in purported
18
violation of federal and California anti-wiretapping laws. Plaintiffs Cody Baker, Brian Pincus,
19
Halima Nobles, and Rebecca Abrams, individually and on behalf of those similarly situated
20
(“Plaintiffs”), allege that Yahoo’s operation of its Yahoo Mail service violates their expectation of
21
privacy under the Electronic Communications Privacy Act (ECPA), California’s Invasion of
22
Privacy Act (CIPA), and the California Constitution. Plaintiffs filed a Consolidated Class Action
23
Complaint on February 12, 2014. ECF No. 35 (“Compl.”). Before the Court is Yahoo’s Motion to
24
Dismiss. ECF No. 37 (“Mot.”). Pursuant to Civil Local Rule 7-1(b), the Court finds this matter
25
appropriate for resolution without a hearing and hereby VACATES the hearing set for August 29,
26
2014. The Case Management Conference set for August 29, 2014 at 10 a.m. remains as set. For the
27
reasons stated below, the Court DENIES in part and GRANTS in part Yahoo’s Motion to Dismiss.
28
1
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page2 of 33
1
I.
BACKGROUND
2
A.
Factual Allegations
3
Plaintiffs are four individuals representing a class of individuals who do not use Yahoo’s
4
email service (“Yahoo Mail”) but have sent emails to Yahoo Mail users from non-Yahoo email
5
addresses. Compl. ¶¶ 15-18. Plaintiffs allege Yahoo’s practices while operating Yahoo Mail
6
violate state and federal anti-wiretapping laws and invade their protected privacy interests under
7
the California Constitution. Id. ¶¶ 5-7. Plaintiffs seek injunctive and declaratory relief and
8
statutory damages on behalf of a class of non-Yahoo Mail users. Id. ¶ 7. Plaintiffs’ proposed class
9
consists of all persons in the United States who are not Yahoo Mail users and who sent emails to or
United States District Court
For the Northern District of California
10
11
12
received emails from a Yahoo Mail user between October 2, 2011 and the present. Id. ¶ 97.
1.
Yahoo Mail and Yahoo’s Use of Scanned Emails
Yahoo operates Yahoo Mail as a free web-based email service. Id. ¶¶ 20-23. More than 275
13
million users have registered for Yahoo Mail to create @yahoo.com, @ymail.com, or
14
@rocketmail.com email addresses. Id. ¶¶ 20-21. Before signing up for a Yahoo Mail account,
15
potential users must provide Yahoo with personal information such as their name, birthday,
16
telephone number, and account information. Id. ¶ 31.
17
In order to provide Yahoo Mail as a free email service to users, Yahoo charges advertisers
18
to display advertisements on Yahoo Mail webpages. Id. ¶ 23. Roughly 75% of Yahoo’s revenue in
19
2013 came from advertising. Id. ¶ 28. Plaintiffs allege Yahoo can increase its revenues by charging
20
advertisers higher rates to display targeted advertisements to Yahoo Mail users. Id. Thus, Yahoo
21
has a financial incentive to scan and store email content to allow advertisers to target individuals
22
based on certain personal characteristics. Id.
23
The instant dispute concerns Yahoo’s interception, scanning, and storage of Yahoo Mail
24
users’ incoming and outgoing emails for content, specifically the content of emails to and from
25
non-Yahoo Mail users with whom Yahoo Mail users communicate. Plaintiffs allege Yahoo
26
intercepts and scans Yahoo Mail users’ emails “during transit and before placing the emails into
27
storage.” Id. ¶ 24. Plaintiffs allege Yahoo scans, analyzes, collects, and stores user information
28
without their consent. Id. ¶¶ 1, 3, 5, 26.
2
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page3 of 33
1
2
2.
Yahoo Terms and Privacy Policy
Three relevant agreements exist between Yahoo and Yahoo Mail users: Yahoo Terms of
3
Service (ECF No. 35-1, “TOS”), Yahoo Global Communications Additional Terms of Service for
4
Yahoo Mail and Yahoo Messenger (ECF No. 35-4, “ATOS”), and Yahoo Privacy Policy (ECF No.
5
35-2). When creating a Yahoo Mail account, Yahoo directs users to view the ATOS and Privacy
6
Policy via hyperlinks. Compl. ¶ 31. The sentence “I agree to the Yahoo Terms and Privacy”
7
appears above the “Create Account” Button. ” Id.; see also Mot. at 7. The phrase “Yahoo Terms”
8
links to the ATOS. Compl. ¶ 31. The word “Privacy” is an individual hyperlink to Yahoo’s Privacy
9
Policy. Id. The Complaint does not allege whether “Yahoo Terms” links to the TOS. However,
United States District Court
For the Northern District of California
10
Plaintiff’s Opposition concedes that the TOS, ATOS, and Privacy Policy comprise the agreements
11
between Yahoo and its users. ECF No. 39 (“Opp’n”) at 11.
12
Section 1(c) of the ATOS references Yahoo’s practice of scanning and analyzing users’
13
email content. Additionally, the ATOS places responsibility on Yahoo Mail users to notify about
14
these scanning policies non-users with whom they communicate. The ATOS in relevant part
15
provides:
16
17
18
19
20
21
22
Please note that your Yahoo Messenger account is tied to your Yahoo Mail account.
Therefore, your use of Yahoo Messenger and all Yahoo Messenger services will be subject
to the TOS and laws applicable to the Applicable Yahoo Company in Section 10. Yahoo’s
automated systems scan and analyze all incoming and outgoing communications content
sent and received from your account (such as Mail and Messenger content including instant
messages and SMS messages) including those stored in your account to, without limitation,
provide personally relevant product features and content, to match and serve targeted
advertising and for spam and malware detection and abuse protection. By scanning and
analyzing such communications content, Yahoo collects and stores the data. Unless
expressly stated otherwise, you will not be allowed to opt out of this feature. If you consent
to this ATOS and communicate with non-Yahoo users using the Services, you are
responsible for notifying those users about this feature.
ATOS § 1 (c) (emphasis in original). Plaintiffs allege that Yahoo added the line “By scanning and
23
analyzing such communications content, Yahoo collects and stores the data” “at some time during”
24
the proposed class period. Compl. ¶ 42. The phrase “collects and stores” is a hyperlink that leads
25
the user to a page titled “Yahoo Mail FAQ.” ECF No. 35-7. The FAQ page explains that Yahoo’s
26
scanning technology “looks for patterns, keywords, and files” in users’ emails. Compl. ¶ 47. Yahoo
27
28
3
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page4 of 33
1
further discloses that it “may anonymously share specific objects from a message with a 3rd party
2
to provide a more relevant experience.” ECF No. 35-7; Compl. ¶ 47.
3
4
5
6
7
8
Yahoo’s TOS and Privacy Policy do not explicitly reference the content of email sent
between users and non-users. Instead, the TOS provides:
Registration Data and certain other information about you are subject to our applicable
privacy policy. For more information, see the full Yahoo Privacy Policy at
http://info.yahoo.com/privacy/us/yahoo/ … You understand that through your use of the
Yahoo Services you consent to the collection and use (as set forth in the applicable privacy
policy) of this information, including the transfer of this information to the United States
and/or other countries for storage, processing and use by Yahoo and its affiliates.
TOS § 4. Yahoo’s Privacy Policy also does not explicitly mention email content. The policy states:
9
“Yahoo collects personal information when you register with Yahoo, when you use Yahoo
United States District Court
For the Northern District of California
10
products or services, when you visit Yahoo pages or the pages of certain Yahoo partners, and when
11
you enter promotions or sweepstakes.” ECF No. 35-2 at 1. Furthermore, the Privacy Policy
12
suggests it covers only “how Yahoo treats personal information that Yahoo collects and receives,
13
including information related to your past use of Yahoo products and services.” Id. Yahoo goes on
14
to define personal information as “personally identifiable” information such as “your name
15
address, email address, or phone number, and that is not otherwise publicly available.” Id. The
16
Privacy Policy also discloses that Yahoo provides users’ personal information to “trusted partners
17
who work on behalf of or with Yahoo under confidentiality agreements.” Id. at 2; Compl. ¶ 37.
18
Yahoo also has a number of other terms and privacy documents in its Terms Center and
19
Privacy Center online. Compl. ¶¶ 43-46. Plaintiffs’ Complaint references one privacy document
20
that applies to Yahoo Mail. ECF No. 35-6. The document has a section titled “Personally Relevant
21
Experiences” that speaks to the scanning and analysis of email content:
22
23
24
25
26
Yahoo provides personally relevant product features, content, and advertising, and spam
and malware detection by scanning and analyzing Mail, Messenger, and other
communications content. Some of these features and advertising will be based on our
understanding of the content and meaning of your communications. For instance, we scan
and analyze email messages to identify key elements of meaning and then categorize this
information for immediate and future use.
ECF No. 35-6.
27
3.
Class Allegations and Relief Sought
28
4
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page5 of 33
1
Plaintiffs allege that Yahoo’s operation of Yahoo Mail violates the Electronic
2
Communications Privacy Act (ECPA), California’s Invasion of Privacy Act (CIPA), and Article I
3
Section I of the California Constitution. Compl. ¶¶ 5-6. Plaintiffs seek relief on behalf of a class of
4
persons who are not Yahoo Mail users who have either sent emails to or received emails from a
5
Yahoo Mail user. Id. ¶ 97. The proposed class period begins October 2, 2011 and extends to the
6
present. Id. Plaintiffs seek certification of a class of non-Yahoo Mail users, injunctive relief,
7
declaratory relief, statutory damages, and disgorgement of Yahoo’s revenues from unjust
8
enrichment related to Yahoo’s interception, scanning, and storage of emails from and to non-
9
Yahoo Mail users. Id. at p.18.
United States District Court
For the Northern District of California
10
B.
Procedural History
11
Beginning on October 2, 2013, Plaintiffs filed six separate class action complaints against
12
Yahoo in the Northern District of California, alleging that Yahoo scans and analyzes emails in
13
violation of privacy laws. On December 18, 2013, this Court related all six pending actions because
14
they involve the same defendant, Yahoo, and “substantially the same basic allegations” that
15
Yahoo’s “interception, storage, reading and scanning of email violates Plaintiffs’ and other
16
consumers’ rights of privacy.” ECF No. 14 at 2. On January 8, 2014, two of the Plaintiffs filed
17
stipulations to dismiss their actions, which the Court granted. See Kevranian v. Yahoo!, 13-cv-
18
04547-LHK, ECF No. 36. On January 22, 2014, this Court consolidated the remaining four cases
19
for pretrial purposes, ECF No. 27, and appointed interim class counsel, ECF No. 29. Plaintiffs filed
20
a consolidated class action complaint on February 12, 2014. ECF No. 35.
21
On March 5, 2014, Yahoo filed a Motion to Dismiss Plaintiffs’ claims. ECF No. 37. On
22
March 26, 2014, Plaintiffs filed an Opposition to Yahoo’s Motion to Dismiss. ECF No. 39. On
23
April 7, 2014, Yahoo filed a Reply. ECF No. 41 (“Reply”).
24
II.
LEGAL STANDARDS
25
A.
Request for Judicial Notice
26
The Court generally may not look beyond the four corners of a complaint in ruling on a
27
Rule 12(b)(6) motion, with the exception of documents incorporated into the complaint by
28
reference, and any relevant matters subject to judicial notice. See Swartz v. KPMG LLP, 476 F.3d
5
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page6 of 33
1
756, 763 (9th Cir. 2007); Lee v. City of L.A., 250 F.3d 668, 688-89 (9th Cir. 2001). Under the
2
doctrine of incorporation by reference, the Court may consider on a Rule 12(b)(6) motion not only
3
documents attached to the complaint, but also documents whose contents are alleged in the
4
complaint, provided the complaint “necessarily relies” on the documents or contents thereof, the
5
document’s authenticity is uncontested, and the document’s relevance is uncontested. Coto
6
Settlement v. Eisenberg, 593 F.3d 1031, 1038 (9th Cir. 2010); see Lee, 250 F.3d at 688-89. The
7
purpose of this rule is to “prevent plaintiffs from surviving a Rule 12(b)(6) motion by deliberately
8
omitting documents upon which their claims are based.” Swartz, 476 F.3d at 763.
9
The Court also may take judicial notice of matters that are either (1) generally known
United States District Court
For the Northern District of California
10
within the trial court’s territorial jurisdiction or (2) capable of accurate and ready determination by
11
resort to sources whose accuracy cannot reasonably be questioned. Fed. R. Evid. 201(b). Proper
12
subjects of judicial notice when ruling on a motion to dismiss include legislative history reports,
13
see Anderson v. Holder, 673 F.3d 1089, 1094, n.1 (9th Cir. 2012); court documents already in the
14
public record and documents filed in other courts, see Holder v. Holder, 305 F.3d 854 866 (9th Cir.
15
2002); and publicly accessible websites, see Caldwell v. Caldwell, No. C 05-4166 PJH, 2006 WL
16
618511, at *4 (N.D. Cal. Mar. 13, 2006); Wible v. Aetna Life Ins. Co., 375 F. Supp. 2d 956, 965
17
(C.D. Cal. 2005).
18
B.
19
Pursuant to Federal Rule of Civil Procedure 12(b)(6), a defendant may move to dismiss an
20
action for failure to allege “enough facts to state a claim to relief that is plausible on its face.” Bell
21
Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). “A claim has facial plausibility when the plaintiff
22
pleads factual content that allows the court to draw the reasonable inference that the defendant is
23
liable for the misconduct alleged. The plausibility standard is not akin to a ‘probability
24
requirement,’ but it asks for more than a sheer possibility that a defendant has acted unlawfully.”
25
Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (internal citations omitted). For purposes of ruling on a
26
Rule 12(b)(6) motion, the Court “accept[s] factual allegations in the complaint as true and
27
construe[s] the pleadings in the light most favorable to the non-moving party.” Manzarek v. St.
28
Paul Fire & Marine Ins. Co., 519 F.3d 1025, 1031 (9th Cir. 2008).
Motion to Dismiss
6
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page7 of 33
1
However, a court need not accept as true allegations contradicted by judicially noticeable
2
facts, Shwarz v. United States, 234 F.3d 428, 435 (9th Cir. 2000), and a “court may look beyond
3
the plaintiff’s complaint to matters of public record” without converting the Rule 12(b)(6) motion
4
into a motion for summary judgment, Shaw v. Hahn, 56 F.3d 1128, 1129 n.1 (9th Cir. 1995). A
5
court is also not required to “‘assume the truth of legal conclusions merely because they are cast in
6
the form of factual allegations.’” Fayer v. Vaughn, 649 F.3d 1061, 1064 (9th Cir. 2011) (per
7
curiam) (quoting W. Min. Council v. Watt, 643 F.2d 618, 624 (9th Cir. 1981)). Mere “conclusory
8
allegations of law and unwarranted inferences are insufficient to defeat a motion to dismiss.”
9
Adams v. Johnson, 355 F.3d 1179, 1183 (9th Cir. 2004); accord Iqbal, 556 U.S. at 678.
United States District Court
For the Northern District of California
10
Furthermore, “a plaintiff may plead herself out of court” if she “plead[s] facts which establish that
11
[s]he cannot prevail on h[er] . . . claim.” Weisbuch v. Cnty. of L.A., 119 F.3d 778, 783 n.1 (9th Cir.
12
1997) (internal quotation marks and citation omitted).
13
C.
14
If the Court determines that the complaint should be dismissed, it must then decide whether
15
to grant leave to amend. Under Rule 15(a) of the Federal Rules of Civil Procedure, leave to amend
16
“shall be freely given when justice so requires,” bearing in mind “the underlying purpose of Rule
17
15 . . . [is] to facilitate decision on the merits, rather than on the pleadings or technicalities.” Lopez
18
v. Smith, 203 F.3d 1122, 1127 (9th Cir. 2000) (en banc) (internal quotation marks and citation
19
omitted). Nonetheless, a court “may exercise its discretion to deny leave to amend due to ‘undue
20
delay, bad faith or dilatory motive on part of the movant, repeated failure to cure deficiencies by
21
amendments previously allowed, undue prejudice to the opposing party . . ., [and] futility of
22
amendment.’” Carvalho v. Equifax Info. Servs., LLC, 629 F.3d 876, 892-93 (9th Cir. 2010)
23
(quoting Foman v. Davis, 371 U.S. 178, 182 (1962)) (alterations in original).
24
III.
25
Leave to Amend
REQUESTS FOR JUDICIAL NOTICE
In support of its Motion to Dismiss, Yahoo requests the Court take judicial notice of (A) a
26
transcript of proceedings held on September 5, 2013 in In Re: Google Inc. Gmail Litigation, 13-
27
md-02430 LHK (N.D. Cal); and (B) U.S. Senate Report No. 99-541 (1986) discussing Congress’
28
intent in passing ECPA. ECF No. 38. Plaintiffs did not file any opposition to these requests, and
7
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page8 of 33
1
even cite to Exhibit B in their Opposition. Opp’n at 14. The Court takes judicial notice of both
2
Exhibit A and Exhibit B. Yahoo’s Exhibit A is a public document that is part of this Court’s own
3
records. See Jared v. Keahey (In re Keahey), 414 Fed. Appx. 919, 923 (9th Cir. 2011)
4
(unpublished) (“A trial court may take judicial notice of its own records, even in unrelated
5
cases[.]”). Exhibit B is a legislative history report, which is also a proper subject of judicial notice.
6
See Anderson, 673 F.3d at 1094 n.1.
In support of their Opposition to Yahoo’s Motion to Dismiss, Plaintiffs request judicial
8
notice of (A) an amicus brief filed by Senator Patrick J. Leahy in United States v. Councilman,
9
First Circuit Case No. 03-1383; (B) Senate Report 90-1097 discussing Congress’ intent in passing
10
United States District Court
For the Northern District of California
7
the Omnibus Crime Control and Safe Streets Act of 1968; and (C) a California state superior court
11
decision addressing violations of the California constitution, Ung v. Facebook, 1-12-cv-217244,
12
Dkt. No. 54 (July 2, 2012). ECF No. 40. Yahoo did not file any opposition to Plaintiffs’ request for
13
judicial notice. The Court also takes judicial notice of Plaintiffs’ Exhibits A, B, and C. All three are
14
matters of public record and thus judicially noticeable. Exhibit A is an amicus brief that discusses
15
the legislative history of the ECPA. Courts have taken judicial notice of amicus briefs that relate to
16
the matters at issue. See Gustavson v. Wrigley Sales Co., 961 F. Supp. 2d 1100, 1113 n.1 (N.D.
17
Cal. 2013). Exhibit B is a Senate Report discussing legislative history, which is judicial noticeable.
18
See Anderson, 673 F.3d at 1094 n.1. Exhibit C is a relevant state court decision. Bias v. Moynihan,
19
508 F.3d 1212, 1225 (9th Cir. 2007) (“[W]e ‘may take notice of proceedings in other courts, both
20
within and without the federal judicial system, if those proceedings have a direct relation to the
21
matters at issue.’” (internal citations omitted)).
22
While neither party requests judicial notice of the following items, the Court sua sponte
23
takes judicial notice of Exhibits A-G attached to Plaintiffs’ Complaint because they are aspects of a
24
publicly accessible website, Plaintiffs’ Complaint necessarily relies on the contents of these
25
webpages, and Yahoo does not contest the authenticity of the documents. See Coto Settlement, 593
26
F.3d at 1038; Caldwell, 2006 WL 618511, at *4. These include: (1) Yahoo Terms of Service (ECF
27
No. 35-1, “TOS”); (2) Yahoo Privacy Policy (ECF No. 35-2); (3) Yahoo Global Communications
28
8
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page9 of 33
1
Additional Terms of Service for Yahoo Mail and Yahoo Messenger (ECF No. 35-4, “ATOS”); and
2
(4) Yahoo Mail FAQ (ECF No. 35-7).
3
IV.
MOTION TO DISMISS
4
A.
Electronic Communications Privacy Act
5
Plaintiffs allege that Yahoo’s email scanning practices violate federal anti-wiretapping
6
laws. Plaintiffs bring causes of action under two separate titles of ECPA: the Wiretap Act, Compl.
7
¶¶ 75-83, and the Stored Communications Act (“SCA”), id. ¶¶ 84-92. The Court provides
8
background on both statutes before addressing Yahoo’s arguments in its Motion to Dismiss.
9
Congress passed ECPA in 1986 to protect the privacy of electronic communications. See
United States District Court
For the Northern District of California
10
Konop v. Hawaiian Airlines, Inc., 302 F.3d 868, 874 (9th Cir. 2002). Title I of the ECPA amended
11
the federal Wiretap Act to impose liability for the interception of certain electronic
12
communications while they are in transit. Specifically, a Wiretap Act violation exists when any
13
person “intentionally intercepts, endeavors to intercept, or procures any other person to intercept or
14
endeavor to intercept, any wire, oral, or electronic communication.” 18 U.S.C. § 2511(1)(a); see
15
also id. § 2520 (creating a private right of action for violations of id. § 2511). The Wiretap Act
16
defines “intercept” as “the aural or other acquisition of the contents of any wire, electronic, or oral
17
communication through the use of any electronic mechanical, or other device.” 18 U.S.C. §
18
2510(4). Prior to the ECPA, the Wiretap Act only imposed liability for the interception of wire and
19
oral communications such as telephone calls. However, the Wiretap Act now sweeps more broadly
20
and applies with equal force to private email communications and websites. See Konop, 302 F.3d at
21
876 (“We therefore conclude that Konop’s website fits the definition of ‘electronic
22
communication.’”).
23
The Wiretap Act includes various exemptions for such interceptions, two of which are
24
relevant to the instant case. First, the Wiretap Act provides that “[i]t shall not be unlawful . . . to
25
intercept a wire, oral, or electronic communication . . . where one of the parties to the
26
communication has given prior consent to such interception.” 18 U.S.C. § 2511(2)(d). Since the
27
Wiretap Act concerns the unauthorized interception of electronic communication, the consent of
28
one party is a complete defense to a Wiretap Act claim. Murray v. Fin. Visions, Inc., CV-07-25789
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page10 of 33
1
PHX-FJM, 2008 WL 4850328, at *4 (D. Ariz. Nov. 7, 2008). Second, in the Wiretap Act’s
2
definition of “device,” there is an explicit exclusion for “any telephone or telegraph instrument,
3
equipment or facility, or any component thereof . . . being used by a provider of wire or electronic
4
communication service in the ordinary course of its business.” 18 U.S.C. § 2510(5)(a)(ii). Without
5
use of a “device” as defined by the Act, there is no illegal interception.
6
In contrast to the interception of electronic communications, the SCA prohibits certain
7
unauthorized access to stored communications and records. Enacted as Title II of the ECPA, the
8
SCA imposes civil and criminal liability for anyone who “(1) intentionally accesses without
9
authorization a facility through which an electronic communication service is provided; or (2)
United States District Court
For the Northern District of California
10
intentionally exceeds an authorization to access that facility; and thereby obtains, alters, or prevents
11
authorized access to a wire or electronic communication while it is in electronic storage in such
12
system.” 18 U.S.C. § 2701(a) (emphasis added). 18 U.S.C. § 2510(17)(A) states that “ ‘electronic
13
storage’ means . . . any temporary, intermediate storage of a wire or electronic communication
14
incidental to the electronic transmission thereof.” The SCA grants immunity to 18 U.S.C. § 2701(a)
15
claims to electronic communication service providers (“ECS providers”) for accessing content on
16
their own servers. 18 U.S.C. § 2701(c)(1). “A provider of email services is an ECS [provider].” See
17
Low v. LinkedIn Corp., 900 F. Supp. 2d 1010, 1022 (N.D. Cal. 2012). Because Yahoo is an ECS
18
provider, the SCA permits Yahoo to access Yahoo Mail communications. 18 U.S.C. § 2701(c)(1).
19
However, ECS providers still may not “knowingly divulge . . . the contents of a communication
20
while in electronic storage by that service.” Id. § 2702(a)(1). Similar to the Wiretap Act, the SCA
21
also includes an exception to liability under 18 U.S.C. § 2701(a) for user consent, id. § 2701(c)(2),
22
and to liability under 18 U.S.C. § 2702(a) due to user consent, id. § 2702(b)(3).
23
24
25
1.
The Wiretap Act
a.
Whether the Wiretap Act Applies to Yahoo’s Conduct
Yahoo first argues Plaintiffs’ Wiretap Act claim must be dismissed because the SCA, not
26
the Wiretap Act, applies to Yahoo’s conduct. Mot. at 1. Yahoo first notes that the Ninth Circuit has
27
held that for a communication to be “intercepted” in violation of the Wiretap Act, it must be
28
accessed during transmission – i.e., while it is in transit – and not while it is in “electronic storage.”
10
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page11 of 33
1
Mot. at 4 (citing Konop, 302 F.3d at 878). Yahoo then argues that the emails Yahoo accessed and
2
scanned in this case had already reached Yahoo’s servers, and that because such emails “are
3
necessarily in temporary storage en route to the recipient,” they fall within the SCA’s definition of
4
“electronic storage.” Mot. at 1, 4 (citing 18 U.S.C. § 2510(17)(A) which states “ ‘electronic
5
storage’ means . . . any temporary, intermediate storage of a wire or electronic communication
6
incidental to the electronic transmission thereof.”). Accordingly, Yahoo argues that its access to
7
these emails is governed by the SCA because Yahoo has not made any “interception” under the
8
Wiretap Act. In support of its argument that the term “intercept” under the Wiretap Act does not
9
apply to the “en route storage of electronic communications,” Yahoo sets forth its interpretation of
United States District Court
For the Northern District of California
10
a footnote in Konop, 302 F.3d at 880 n.6. Mot. at 5. Plaintiffs respond by claiming that Konop’s
11
footnote is dicta, and that out of circuit authority makes clear that an interception can occur at any
12
point “during the transmission of an email from the sender to the recipient.” Opp’n at 8.
13
The Court does not address Yahoo’s argument by analyzing whether Ninth Circuit law
14
holds that the term “intercept” under the Wiretap Act applies to the “en route storage of electronic
15
communications” because Yahoo’s argument is premature. On a Rule 12(b)(6) motion to dismiss,
16
the Court must “accept factual allegations in the complaint as true.” Manzarek, 519 F.3d at 1031.
17
Here, Plaintiffs allege Yahoo “intercepts emails sent to and from its Yahoo Mail users while the
18
emails are in transit,” Compl. ¶ 1 (emphasis added); see also id. ¶ 24 (“Yahoo intercepts and scans
19
its users’ incoming emails for content during transit and before placing the emails into storage.”)
20
(emphasis added); id. ¶ 80 (“Yahoo knowingly and purposefully intercepts emails in transit to and
21
from Yahoo Mail accounts.” (emphasis added)); id. ¶ 87 (“Plaintiffs allege that Yahoo intercepts
22
communications while ‘in transit’ and thus in violation of the Wiretap Act.”). At this stage, the
23
Court must accept as true Plaintiffs’ allegations that the emails were in transit when Yahoo
24
accessed them. Because Yahoo’s argument rests on Yahoo’s assumption that the emails were in
25
electronic storage and no longer in transit when Yahoo accessed them, the Court cannot consider
26
Yahoo’s argument because that assumption contradicts Plaintiffs’ allegations.
27
28
In other words, until the Court can determine when and how Yahoo intercepted users’
emails, the Court must accept as true Plaintiffs’ allegation that they were accessed while “in
11
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page12 of 33
1
transit.” Yahoo does not provide the Court with any judicially noticeable information as supporting
2
evidence for its claim that the emails had already reached Yahoo’s servers when Yahoo accessed
3
them. The Court will consider Yahoo’s argument that the term “intercept” under the Wiretap Act
4
does not apply to the en route storage of electronic communications if and when Yahoo shows, at
5
the summary judgment stage after discovery, that Yahoo intercepted users’ emails after those
6
emails had already reached Yahoo’s servers. Accordingly, the Court DENIES Yahoo’s Motion to
7
Dismiss Plaintiffs’ Wiretap Act claim on the basis that the Wiretap Act does not apply to the
8
emails at issue.
9
b.
United States District Court
For the Northern District of California
10
Consent
Plaintiffs allege Yahoo’s operation of Yahoo Mail involves the knowing and purposeful
11
interception of emails “in transit to and from Yahoo Mail accounts” without consent and “for
12
[Yahoo’s] own profit.” Compl. ¶¶ 79-81. Yahoo moves to dismiss the Wiretap Act claim on the
13
ground that Yahoo obtained express consent for its interception and email scanning from all Yahoo
14
Mail users when they signed up for Yahoo Mail. Mot. at 7. Plaintiffs respond there is no consent by
15
Yahoo Mail users because none of Yahoo’s terms adequately discloses that Yahoo engages in this
16
conduct. Opp’n at 11. The Court GRANTS Yahoo’s Motion to Dismiss for the reasons stated
17
below.
18
Consent to an interception under the Wiretap Act may be either explicit or implied, but it
19
must be actual. See United States v. Poyck, 77 F.3d 285, 292 (9th Cir. 1996); United States v.
20
Amen, 831 F.3d 373, 378 (2d Cir. 1987); United States v. Corona-Chavez, 328 F.3d 974, 978 (8th
21
Cir. 2003). The Wiretap Act only requires one party to the communication to consent to an
22
interception to relieve the provider of liability. 18 U.S.C. § 2511(2)(d). Thus, Yahoo has not
23
violated the Wiretap Act if Yahoo’s agreements with Yahoo Mail users suffice to show consent.
24
However, consent under § 2511(2)(d) is “not an all-or-nothing proposition.” See In Re: Google Inc.
25
Gmail Litigation, 13-md-02430-LHK, 2013 WL 5423918, at *12 (N.D. Cal. Sept. 26, 2013)
26
(hereinafter “Gmail”); see also Watkins v. L.M. Berry & Co., 704 F.2d 577, 582 (11th Cir. 1983)
27
(“[C]onsent within the meaning of section 2511(2)(d) . . . can be limited. It is the task of the trier of
28
fact to determine the scope of the consent and to decide whether and to what extent the interception
12
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page13 of 33
1
exceeded that consent.”). In other words, “[a] party may consent to the interception of only part of
2
a communication or to the interception of only a subset of its communications.” In re Pharmatrack,
3
Inc., 329 F.3d 9, 19 (1st Cir. 2003). Furthermore, as “the party seeking the benefit of the
4
exception,” the burden is on Yahoo to prove it obtained consent. Id. This Court applies a
5
reasonable user standard to determine consent under the Wiretap Act. See Perkins v. LinkedIn
6
Corp., 13-CV-04303-LHK, 2014 WL 2751053, at *14 (N.D. Cal. June 12, 2014); Gmail, 2013 WL
7
5423918, at *14.
Yahoo argues that Yahoo Mail users explicitly consented1 to Yahoo’s conduct by agreeing
8
9
to the ATOS. Mot. at 1, 7-8. As a preliminary matter, Yahoo is correct that Yahoo Mail users
United States District Court
For the Northern District of California
10
agreed to the ATOS. When registering for Yahoo Mail, users must click a “Create Account” button
11
that appears below the sentence: “I agree to the Yahoo Terms and Privacy.” Compl. ¶ 31; Mot. at 7.
12
The “Yahoo Terms” hyperlink directs users to view the ATOS. Compl. ¶ 31. The word “Privacy”
13
is an individual hyperlink to Yahoo’s Privacy Policy. Id. Thus, it is clear based on the allegations in
14
the Complaint that Yahoo Mail users agreed to at least the ATOS and Privacy Policy when they
15
created an account. Notably, Plaintiffs do not argue that Yahoo Mail users did not read and agree to
16
these documents when creating accounts, and do not dispute that users can view these agreements
17
when they sign-up for Yahoo Mail and click “Create Account.” Compl. ¶ 31. To the contrary,
18
Plaintiffs concede that the ATOS, TOS, and Privacy Policy all “comprise the agreement between
19
Yahoo and its users.” Opp’n at 11.
20
The question thus becomes whether the ATOS sufficiently establishes user consent by
21
putting users on notice of Yahoo’s alleged conduct, and if so, to what extent. Plaintiffs allege that
22
Yahoo scanned and analyzed emails to “provide personally relevant product features and content,”
23
“to match and serve targeted advertising,” for “spam and malware detection and abuse protection,”
24
to use the information from the emails to create user profiles, to share the information from the
25
emails with third parties, and to “collect” and “store” the information for “future use.” Compl. ¶¶ 1,
26
3-4, 26-27, 29, 41, 46-49, 50, 70-71. The Court thus evaluates whether the ATOS adequately
27
1
28
Yahoo does not argue there was implied consent by either party to the communication, nor does
Yahoo contend that non-users consented to the alleged interceptions.
13
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page14 of 33
1
notifies the reasonable Yahoo Mail user that their emails with non-Yahoo Mail users will be
2
intercepted for these various purposes.
3
The Court concludes that the ATOS establishes explicit consent by Yahoo Mail users to
4
Yahoo’s conduct. Notably, Section 1(c) of the ATOS explicitly acknowledges that Yahoo scans
5
and analyzes users’ email for various purposes: “Yahoo’s automated systems scan and analyze all
6
incoming and outgoing communications content sent and received from your account (such as Mail
7
and Messenger content including instant messages and SMS messages) including those stored in
8
your account to, without limitation, provide personally relevant product features and content, to
9
match and serve targeted advertising and for spam and malware detection and abuse protection. . .
United States District Court
For the Northern District of California
10
. Unless expressly stated otherwise, you will not be allowed to opt out of this feature. If you
11
consent to this ATOS and communicate with non-Yahoo users using the Services, you are
12
responsible for notifying those users about this feature.” Compl. ¶ 41; ECF No. 35-4 (ATOS)
13
(emphases added). In light of the clarity of the language in this disclosure, to which Yahoo Mail
14
users agreed when creating an account, the Court finds that the ATOS provides explicit and
15
sufficient notification to Yahoo Mail users that any communication sent via Yahoo Mail will be
16
scanned and analyzed for the stated purposes of providing personal product features, providing
17
targeted advertising, and detecting spam and abuse. By agreeing to the ATOS, Yahoo Mail users
18
consented to such conduct. Plaintiffs provide no convincing argument to the contrary other than to
19
say that “the ATOS does not explicitly inform Yahoo Mail users what Yahoo does with the
20
contents of its users’ email.” Opp’n at 11. This argument fails in light of the specific statements in
21
the ATOS that Yahoo scans the emails in order to “provide personally relevant product features
22
and content, to match and serve targeted advertising and for spam and malware detection and abuse
23
protection.” ECF No. 35-4 at 1. Plaintiffs’ other argument that the TOS and Privacy Policy “say
24
nothing about the scanning and analysis of email,” Opp’n at 11, is unavailing in light of how the
25
language in the ATOS itself suffices to establish explicit consent. Accordingly, the Court
26
concludes that Yahoo obtained consent from one party to the electronic communications to scan
27
and analyze emails for the purposes of providing personal product features, providing targeted
28
advertising, and detecting spam and abuse. See Mortensen v. Bresnan Commun., L.L.C., CV 10-1314
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page15 of 33
1
BLG-RFC, 2010 WL 5140454, at *5 (D. Mont. Dec. 13, 2010) (dismissing ECPA claim because
2
“through the OnLine Subscriber Agreement, the Privacy Notice and the NebuAd link on Bresnan’s
3
website, Plaintiffs did know of the interception and through their continued use of Bresnan’s
4
Internet Service, they gave or acquiesced their consent [under § 2511(2)(d)] to such interception”).
5
The Court further finds that the ATOS also established Yahoo Mail users’ consent to
Yahoo’s practice of scanning and analyzing emails for the purposes of creating user profiles for
7
both parties to the email communication and sharing content from the emails with third parties.
8
Compl. ¶ 27. Notably, Plaintiffs allege that Yahoo’s creation of user profiles serves to “enhance
9
Yahoo’s ability to target advertising” and that Yahoo’s sharing of information with third parties is
10
United States District Court
For the Northern District of California
6
for “advertising purposes.” Id.2 Plaintiffs do not allege that creation of user profiles or sharing of
11
information with third parties serves any other purpose other than targeted advertising. Thus, the
12
Court concludes that the explicit notice in the ATOS that Yahoo scans and analyzes emails in order
13
to “match and serve targeted advertising” suffices to prove that by agreeing to the ATOS, users
14
also consented to Yahoo’s conduct of scanning and analyzing emails for the purpose of creating
15
user profiles and sharing content with third parties. In light of the ATOS, the Court concludes that
16
additional allegations cannot save Plaintiff’s claim that there was no consent to scan and analyze
17
emails for the purposes of providing personal product features, providing targeted advertising,
18
detecting spam and abuse, creating user profiles, and sharing information with third parties. Thus,
19
the Court GRANTS Yahoo’s Motion to Dismiss Plaintiffs’ Wiretap Act claim with respect to
20
scanning and analyzing for these purposes with prejudice.
21
The only remaining question is whether there was consent to Yahoo’s conduct of
22
“collecting” and “storing” the content from emails for “future use.” Plaintiffs claim Yahoo
23
provided Yahoo Mail users no notice of this conduct. Opp’n at 12. Plaintiffs note that for part of
24
the class period, the ATOS did not inform users that Yahoo collects and stores email content on its
25
2
26
27
28
The Complaint also alleges that “Yahoo can increase revenues by obtaining more detailed
background information about users of the service,” and that “Yahoo benefits from gathering as
much personal information about its Yahoo Mail users, and non-users who email with its users, as
it can.” Id. ¶ 28. Plaintiffs’ allegations do not explain how Yahoo increases its revenues other than
to provide targeted advertisements. Id. (“Yahoo can charge advertisers substantially more to place
ads that are ‘targeted’ to certain demographic groups and even to specific individuals.”).
15
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page16 of 33
1
servers. Id.; Compl. ¶ 42. Plaintiffs concede that “at some time during the proposed class period,”
2
Yahoo revised ATOS § 1(c) by adding the line: “By scanning and analyzing such communications
3
content, Yahoo collects and stores the data.” Compl. ¶¶ 41-42; Opp’n at 12. Nonetheless, Plaintiffs
4
argue that even after Yahoo added this statement, Yahoo did not provide sufficient notice of
5
collection and storage because Yahoo failed to explain to users “what it does with the data” it
6
stores or what Yahoo “plans to do with it in the future.” Opp’n at 12. The Court disagrees and finds
7
users were on notice and thus consented to how Yahoo “collects” and “stores” the content from
8
emails for “future use,” as explained below.
9
Plaintiffs concede that for at least the latter part of the class period, the ATOS explicitly
United States District Court
For the Northern District of California
10
notified users that Yahoo “collects and stores” their email communications. Compl. ¶¶ 41-42;
11
Opp’n at 12. The Court concludes that this explicit language contained in the agreement between
12
Yahoo and its users sufficed to put a reasonable user on notice of such collection and storage for
13
the latter part of the class period. The Court further concludes that even for the portion of the class
14
period during which the ATOS did not explicitly reference collection and storage, the reasonable
15
user was nonetheless similarly on notice that Yahoo engages in collection and storage of email
16
content. This is because the reasonable user would know that the ATOS’s language that Yahoo
17
“scan[s] and analyze[s]” email content necessarily means Yahoo simultaneously collects and stores
18
the email content, i.e., the reasonable user would know that “scanning and analyzing” requires
19
Yahoo to collect and store the email content. In other words, the Court finds it implausible that
20
users did not – after agreeing, based on the ATOS, to Yahoo’s scanning and analysis of emails –
21
realize that in order to engage in analysis of emails, Yahoo would have to store the emails
22
somewhere on its servers. Indeed, Plaintiffs do not provide any plausible reason why scanning and
23
analyzing email content does not require the collection and storage of that content. If anything,
24
Plaintiffs’ allegation that Yahoo “scans [email] content, storing the data it collects” suggests that
25
the very process of scanning simultaneously stores the content. Compl. ¶ 1. Furthermore, the
26
ATOS stated, at all times during the class period, that Yahoo “store[s]” emails in users’ accounts,
27
which would have put the reasonable user on notice that Yahoo already stores at least some emails
28
on its servers. ECF No. 35-4 (ATOS) (“Yahoo’s automated systems scan and analyze all incoming
16
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page17 of 33
1
and outgoing communications content sent and received from your account . . . including those
2
stored in your account[.]”) (emphasis added). Thus, the Court concludes that the reasonable user
3
was on notice and thus consented to Yahoo’s collection and storage of email content when the user
4
agreed to the ATOS.
5
The only remaining issue is whether Yahoo informed users that Yahoo was going to use the
information it was collecting and storing in the “future.” Plaintiffs claim there was no notice of
7
such future conduct because users had no notice of what specific use Yahoo would make of the
8
email content in the future. Opp’n at 12. Plaintiffs’ argument is unconvincing. Given the explicit
9
statements in the ATOS that Yahoo scans and analyzes email content to provide personal product
10
United States District Court
For the Northern District of California
6
features, provide targeted advertising, and detect spam and abuse. It is logical that Yahoo’s future
11
uses would be the same. Further, Plaintiffs do not allege what they believe Yahoo was planning to
12
do with the email content in the future separate and apart from the various uses of which this Court
13
has already found users were on notice: to provide personal product features, provide targeted
14
advertising, and detect spam and abuse. Accordingly, the Court finds that Yahoo Mail users
15
consented to Yahoo’s collection and storage of their emails for future use, and GRANTS Yahoo’s
16
Motion to Dismiss the Wiretap claim with respect to this conduct. However, the Court GRANTS
17
leave to amend in order to allow Plaintiffs to allege any other “future use” they believe Yahoo
18
would make of their email content, separate and apart from the uses of which this Court has found
19
users had notice.3
20
2.
21
The Stored Communications Act
In the alternative to a Wiretap Act violation, Plaintiffs argue that Yahoo’s scanning
22
practices violate the Stored Communications Act. Compl. ¶ 6. Plaintiffs assert this claim in the
23
alternative “in the event the Court concludes that Yahoo accesses plaintiffs’ emails after they have
24
been delivered to the recipients” and are thus in storage. Opp’n at 3; Compl. at ¶ 87 (“Plaintiffs
25
26
27
28
3
Because the Court GRANTS Yahoo’s Motion to Dismiss the Wiretap Act claim on consent
grounds, the Court need not reach Yahoo’s argument that the “ordinary course of business”
exception to Wiretap Act liability applies. The Court also need not reach Yahoo’s argument, raised
for the first time in Reply, that Plaintiffs’ “bare allegation” that Yahoo intercepts emails while they
are “in transit” fails to state a Wiretap Act claim under Twombly. Reply at 2.
17
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page18 of 33
1
assert this SCA claim in the alternative, in the event the Court finds that Yahoo intercepts the
2
emails while they are in ‘storage’ rather than ‘in transit’[.]”). Yahoo moves to dismiss Plaintiffs’
3
SCA claim.
4
Yahoo contends that if the SCA applies to Plaintiffs’ claims, Yahoo has statutory immunity
5
to any alleged 18 U.S.C. § 2701(a) violation4 pursuant to 18 U.S.C. § 2701(c)(1) and 18 U.S.C. §
6
2701(c)(2). Mot. at 11-12. Plaintiffs concede that Yahoo has immunity to any alleged § 2701(a)
7
violation pursuant to § 2701(c)(1), which grants immunity for alleged violations of § 2701(a) to
8
ECS providers like Yahoo for accessing electronic communications stored on their own servers.5
9
Opp’n at 14 (acknowledging that “the SCA immunizes electronic service providers like Yahoo
United States District Court
For the Northern District of California
10
from liability for accessing emails that are in its users’ mailboxes or in the service providers’
11
‘backup protection.’”); see also In re iPhone Application Litig., 844 F. Supp. 2d 1040, 1057 (N.D.
12
Cal. 2012).6 Accordingly, the Court GRANTS Yahoo’s Motion to Dismiss with prejudice any
13
claim that Yahoo violated § 2701(a).7
14
However, Plaintiffs also assert Yahoo is liable under 18 U.S.C. § 2702(a)(1), which
15
prohibits Yahoo from disclosing the content of users’ emails to third parties. Compl. ¶ 90 (alleging
16
Yahoo’s “sharing of the content with third parties”); Opp’n at 14-15 (stating Yahoo is “prohibited
17
from disclosing the contents of their customers’ emails to any person or entity”). Plaintiffs claim
18
Yahoo improperly disclosed to third parties the content from the scanned emails between Yahoo
19
Mail users and non-users. Id. Section 2702(a)(1) holds ECS providers liable under the SCA if they
20
“knowingly divulge to any person or entity the contents of a communication while in electronic
21
22
23
24
25
26
27
28
4
An SCA violation under 18 U.S.C. § 2701(a) occurs when someone “(1) intentionally accesses
without authorization a facility through which an electronic communication service is provided; or
(2) intentionally exceeds an authorization to access that facility; and thereby obtains, alters, or
prevents authorized access to a wire or electronic communication while it is in electronic storage in
such system.” 18 U.S.C. § 2701(a).
5
Section 2701(c)(1) provides an exception to liability for an 18 U.S.C. § 2701(a) violation when
the conduct is authorized: “(1) by the person or entity providing a wire or electronic
communications service.” 18 U.S.C. § 2701(c)(1).
6
Plaintiffs’ Complaint does not explicitly state which provision of the SCA Yahoo has violated.
7
Because the parties agree that Yahoo has immunity under 18 U.S.C. § 2701(c)(1), the Court does
not reach whether Yahoo had its users’ consent to access the communications under 18 U.S.C. §
2701(c)(2), as Yahoo claims, Mot. at 12 n.9.
18
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page19 of 33
1
storage by that service.” 18 U.S.C. § 2702(a)(1). Yahoo argues Plaintiffs’ claim for a violation of §
2
2702(a)(1) lacks the factual specificity required by Twombly because “plaintiffs have failed to
3
allege specific information about what information they contend was shared, with whom, and for
4
what purpose.” Mot. at 13 n.10. The Court finds that the Complaint adequately alleges that Yahoo
5
improperly disclosed portions of the “contents of a communication” to third parties in violation of
6
§ 2702(a)(1), as explained below. Accordingly, the Court DENIES Yahoo’s Motion to Dismiss
7
Plaintiffs’ SCA claim for improper disclosure under § 2702(a)(1).
8
9
In order to state a claim for improper disclosure under the SCA, Plaintiffs must plausibly
allege that Yahoo knowingly divulged “the contents of a communication.” See In re Zynga Privacy
United States District Court
For the Northern District of California
10
Litigation, 750 F.3d 1098, 1109 (9th Cir. 2014). The Complaint makes several references to
11
Yahoo’s alleged disclosure of email content to third parties. Compl. ¶¶ 27, 37, 47, 49, 71, 90.
12
Plaintiffs allege that after Yahoo scans and analyzes electronic communications between users and
13
non-users of Yahoo Mail, Yahoo “provides some of the information it collects from its users’
14
incoming and outgoing email to unidentified ‘trusted partners’ and other third parties for
15
advertising purposes.” Compl. ¶¶ 26-27. Plaintiffs claim their allegations lack detail in terms of
16
alleging what content was shared because discovery is at an early stage and Yahoo has not revealed
17
with whom it shares email content. Opp’n at 15. Plaintiffs claim, however, that their allegations are
18
sufficient because they are “based on Yahoo’s own statements about its practices” contained in two
19
documents: the Privacy Policy, ECF No. 35-2, and the Yahoo Mail FAQ, ECF No. 35-7. Opp’n at
20
15.
21
The Court notes, as a preliminary matter, that Plaintiffs are incorrect to argue that the
22
Privacy Policy supports Plaintiffs’ argument that their allegations sufficiently plead that Yahoo
23
divulged “the contents of a communication.” The Plaintiffs cite to one part of the Privacy Policy
24
which states that Yahoo provides “its users’ personal information ‘to trusted partners who work on
25
behalf of or with Yahoo under confidentiality agreements.’” Compl. ¶ 37. The SCA distinguishes
26
between “contents of a communication” and “record information.” The SCA incorporates the
27
definition of “contents” from the Wiretap Act. 18 U.S.C. § 2711(1). Under the Wiretap Act,
28
“contents” includes “any information concerning the substance, purport, or meaning of that
19
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page20 of 33
1
communication.” Id. § 2510(8). The Ninth Circuit has interpreted the language and statutory
2
framework of ECPA to find that “contents” means “a person’s intended message to another.”
3
Zynga, 750 F. 3d at 1106. In contrast to “contents,” customer “record information” includes
4
personally identifiable information such as the customer’s name, address, and identity. Id. at 1104.
5
The Ninth Circuit has clearly held that “contents” under the ECPA “does not include record
6
information regarding the characteristics of the message that is generated in the course of the
7
communication.” Id. at 1106. As noted above, in order to state a claim for improper disclosure,
8
Plaintiffs must plausibly allege that Yahoo knowingly divulged “the contents of a communication.”
9
Id. at 1109. Thus, Plaintiffs’ allegations must show that Yahoo disclosed “contents,” not “record
United States District Court
For the Northern District of California
10
information,” to third parties. However, the Privacy Policy appears to refer only to “record
11
information” rather than the “contents” of an electronic communication like emails, as Yahoo
12
argues. Reply at 9. The Privacy Policy states that “[Yahoo] provide[s] the information to trusted
13
partners who work on behalf of or with Yahoo under confidentiality agreements. These companies
14
may use your personal information to help Yahoo communicate with you about offers from Yahoo
15
and our marketing partners.” ECF No. 35-2 (emphasis added). The Privacy Policy, which states
16
that it “covers how Yahoo treats personal information,” defines “personal information” as
17
“information about you that is personally identifiable like your name, address, email address or
18
phone number, and that is not otherwise publicly available.” Id. Nothing in this language suggests
19
that “personal information” includes content from email exchanges. Plaintiffs themselves even
20
admit that the Privacy Policy says “nothing about the scanning and analysis of email.” Opp’n at 11.
21
Accordingly, because the Privacy Policy refers to “record information” rather than the “contents”
22
of an electronic communication, the Privacy Policy language that Yahoo shares personal
23
information with “trusted partners” does not support Plaintiffs’ allegation that Yahoo shares
24
“contents of a communication” with third parties.
25
Nonetheless, the Court still finds that Plaintiffs’ allegations suffice to plausibly allege a
26
claim under Twombly. This is because the Complaint contains sufficient factual detail to plausibly
27
allege that Yahoo shared with third parties “the contents of a communication.” Zynga, 750 F. 3d at
28
1109. As stated above, Plaintiffs allege at various points that Yahoo shared email content with third
20
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page21 of 33
1
parties. See Compl. at ¶ 71 (alleging Yahoo “distributes the content of the emails to third parties”);
2
id. at ¶ 90 (alleging Yahoo shares “the content [of emails] with third parties”). Plaintiffs further
3
allege that one question in the FAQ reads: “Does Yahoo Mail automatically share my messages
4
with anyone else?” to which Yahoo’s response states, “Yahoo may anonymously share specific
5
objects from a message with a 3rd party to provide a more relevant experience within your mail.
6
For example, Yahoo may share a package tracking number with the shipping company so that you
7
can easily see when your package will arrive, or may share your flight number with your airline to
8
enable flight notifications within your inbox.” Id. at ¶¶ 47, 49 (citing ECF No. 35-7 at 2 (emphasis
9
added)). The language “specific objects from a message” falls within the SCA’s definition of
United States District Court
For the Northern District of California
10
“contents of a communication” because the phrase “specific objects” clearly refers to the
11
“contents” of a “message,” the latter of which is an email communication. See Konop, 302 F.3d at
12
875 (“The legislative history of the ECPA suggests that Congress wanted to protect electronic
13
communications that are configured to be private, such as email and private electronic bulletin
14
boards.”); see also O'Grady v. Superior Court, 139 Cal. App. 4th 1423, 1443 (2006) (“[The SCA]
15
clearly prohibits any disclosure of stored email other than as authorized by enumerated
16
exceptions.” (emphasis added)). Thus, pursuant to Plaintiffs’ allegations, Yahoo’s own FAQ page
17
admits that Yahoo shares email content with third parties. Under these circumstances, the Court
18
concludes that Plaintiffs have plausibly alleged that Yahoo improperly disclosed “contents” of
19
email communications to third parties.
20
While Yahoo argues Plaintiffs have failed to allege what specific information was shared
21
and with what specific third parties, the FAQ, as alleged in the Complaint, does give at least one
22
example of the kind of information in emails that was shared with third parties – i.e., a package
23
tracking number. In any event, Yahoo cites no case holding that a plaintiff must allege the specific
24
information in the content that was shared or the identity of the third party in order to state a claim
25
for a violation of § 2702(a)(1). Ultimately, the Court finds that Plaintiffs’ allegations as a whole
26
sufficiently plead “factual content that allows the court to draw the reasonable inference that the
27
defendant is liable for the misconduct alleged.” Iqbal, 556 U.S. at 678 (internal citations omitted).
28
21
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page22 of 33
1
The Court notes that in its Reply, Yahoo argues in one sentence in a footnote that the
2
language in the ATOS “suffices as consent for SCA purposes.” Reply at 6 n.7. Because the Court
3
has concluded, as Plaintiffs concede, that Yahoo has not violated § 2701(a), the only consent
4
exception relevant under the SCA is the consent exception to a § 2702(a) violation, see §
5
2702(b)(3). However, Yahoo did not argue in its opening brief that there was consent for a §
6
2702(a) violation and only focused on how Yahoo had consent to a § 2701(a) violation pursuant to
7
§ 2701(c)(2). Mot. at 12 n.9. Thus, the Court does not consider Yahoo’s consent argument in its
8
Reply because arguments raised for the first time in Reply briefs are waived. Sealant Sys. Intl., Inc.
9
v. TEK Global S.R.L., 5:11-CV-00774-PSG, 2014 WL 1008183, at *14 (N.D. Cal. March 7, 2014).
United States District Court
For the Northern District of California
10
Accordingly, the Court DENIES Yahoo’s Motion to Dismiss Plaintiffs’ SCA claim for improper
11
disclosure under § 2702(a)(1).
12
13
14
15
16
17
18
19
20
3.
Good Faith Defense
Yahoo raises a good faith defense against Plaintiffs’ Wiretap Act and SCA claims. Mot. at
13. The Wiretap Act provides:
A good faith reliance on—
(1) a court warrant or order, a grand jury subpoena, a legislative authorization, or a
statutory authorization (including a request of a governmental entity under section
2703 (f) of this title);
(2) a request of an investigative or law enforcement officer under section 2518 (7)
of this title; or
(3) a good faith determination that section 2511(3) or 2511(2)(i) of this title
permitted the conduct complained of;
is a complete defense against any civil or criminal action brought under this chapter or any
other law.
18 U.S.C. § 2520(d); see also 18 U.S.C. § 2707(e) (providing a nearly identical good faith defense
21
for SCA violations). Specifically, as a defense to Plaintiffs’ § 2701(a) SCA claim, Yahoo claims it
22
relied in good faith on §§ 2701(a), (c). As a defense to Plaintiffs’ Wiretap claim, Yahoo claims it
23
relied on (1) the decisions of the Ninth Circuit in Konop and Theofel v. Farey-Jones, 359 F.3d 1066
24
(9th Cir. 2003), that hold, in Yahoo’s view, that the SCA rather than the Wiretap Act applies to
25
email scanning that occurs once emails have reached an ECS provider’s servers; (2) 18 U.S.C. §
26
2511(c), the consent exception; and (3) 18 U.S.C. § 2511(2)(a)(i), the ordinary course of business
27
exception. Mot. at 13.
28
22
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page23 of 33
1
The Court does not reach Yahoo’s good faith reliance on §§ 2701(a) and (c) because the
2
Court GRANTS, on other grounds as stated above, Yahoo’s Motion to Dismiss any claim that
3
Yahoo violated § 2701(a). See supra, Part IV.A.2. The Court also does not reach Yahoo’s alleged
4
good faith reliance on the Ninth Circuit decisions Konop and Theofel or on §§ 2511(c) and
5
2511(2)(a)(i) of the Wiretap Act because the Court GRANTS, on other grounds as set forth above,
6
Yahoo’s Motion to Dismiss the Wiretap claim, see supra, Part IV.A.1.b. Thus, the Court need not
7
reach Yahoo’s Motion to Dismiss either the SCA claim or Wiretap claim based on the good faith
8
defense.
9
B.
United States District Court
For the Northern District of California
10
California’s Invasion of Privacy Act (“CIPA”)
Plaintiffs bring a cause of action under CIPA, Cal. Penal Code § 630, et seq. CIPA is
11
California’s anti-wiretapping and anti-eavesdropping statute that prohibits unauthorized
12
interceptions of communications in order “to protect the right of privacy.” Cal. Penal Code § 630.
13
The California Legislature enacted CIPA in 1967 in response to “advances in science and
14
technology [that] have led to the development of new devices and techniques for the purpose of
15
eavesdropping upon private communications[.]” Id. Yahoo moves to dismiss the CIPA claim. The
16
Court DENIES Yahoo’s motion.
17
Section 631 of CIPA makes it unlawful to use “any machine, instrument or contrivance” to
18
intentionally intercept the content of a communication over any “telegraph or telephone wire, line,
19
cable or instrument,” or to read, attempt to read, or learn the “contents or meaning of any message,
20
report, or communication while the same is in transit or passing over any wire, line or cable”
21
without the consent of all parties to the communication. See Cal. Penal Code § 631(a). The
22
California Supreme Court has held that § 631 protects against three distinct types of harms:
23
“intentional wiretapping, willfully attempting to learn the contents or meaning of a communication
24
in transit over a wire, and attempting to use or communicate information obtained as a result of
25
engaging in either of the two previous activities.” Tavernetti v. Superior Court, 22 Cal. 3d 187, 192
26
(1978).
27
28
Plaintiffs allege Yahoo has violated § 631 of CIPA. Compl. ¶¶ 53-65. Yahoo moves to
dismiss first on the grounds that § 631 only applies to communications intercepted “in transit,” and
23
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page24 of 33
1
that here the communications at issue were not “in transit” but in “electronic storage” because the
2
emails were already on Yahoo’s servers when Yahoo accessed the emails. Mot. at 14-15. Second,
3
Yahoo similarly argues that the all-party consent provision in § 631 should not apply to “recorded
4
communications” already in the hands of and received by a provider because that would lead to
5
illogical results, id. at 16, and thus that this Court must interpret CIPA to find that “when an email
6
reaches the recipient’s provider,” the email “is no longer in transit” and CIPA does not apply.
7
Reply at 13. Finally, Yahoo argues that the SCA and Wiretap Act would preempt § 631 if CIPA
8
applied to emails “on an ECS providers’ servers” – like the emails Yahoo contends are at issue
9
here. Id. at 18-19.
United States District Court
For the Northern District of California
10
Yahoo relies on Konop to support its contention that emails an ECS provider has received
11
en route to a recipient are in electronic storage rather than “in transit,” and thus that CIPA does not
12
apply. Mot. at 14. Yet as discussed above, see supra Part IV.A.1.a, the Court must accept as true
13
Plaintiffs’ allegation that “Yahoo intercepts and scans its users’ incoming emails for content during
14
transit and before placing the emails into storage.” Compl. ¶ 24. The Court must defer resolution of
15
whether Yahoo accessed the emails only after the emails were on Yahoo’s servers until after
16
discovery makes clear where and how Yahoo’s scanning technology intercepted the emails. Thus,
17
the Court rejects Yahoo’s first argument that CIPA does not apply.
18
Yahoo’s second argument that CIPA should not apply when an email has reached Yahoo’s
19
servers – based on allegedly illogical implications that would result from applying CIPA’s all-party
20
consent provision to such emails – similarly assumes the emails were on Yahoo’s server when
21
intercepted, which this Court cannot assume at this stage. Even if the Court could make such an
22
assumption, the Court would still have to reject Yahoo’s argument that the Court should find the
23
emails at issue were not “in transit” when intercepted because that would contradict the allegations
24
in the Complaint, which the Court must accept as true. Thus, the Court rejects Yahoo’s second
25
argument why CIPA does not apply.
26
Finally, the Court rejects Yahoo’s preemption argument for similar reasons. Yahoo
27
contends that the SCA and Wiretap Act preempt Plaintiffs’ CIPA claims, relying on all three
28
theories of federal preemption. Mot. at 18; Chae v. SLM Corp., 593 F.3d 936, 941 (9th Cir. 2010)
24
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page25 of 33
1
(internal quotation marks and citations omitted) (“Federal preemption occurs when: (1) Congress
2
enacts a statute that explicitly pre-empts state law; (2) state law actually conflicts with federal law;
3
or (3) federal law occupies a legislative field to such an extent that it is reasonable to conclude that
4
Congress left no room for state regulation in that field.”). Specifically, Yahoo does not contend that
5
ECPA wholly preempts CIPA, but argues that CIPA would conflict with ECPA only if CIPA
6
applied to emails that have already reached a provider’s servers, as Yahoo argues the emails in the
7
instant case had. Mot. at 18; Reply at 13; Mot. at 19 (arguing that the ECPA “preempts parallel
8
state legislation regulating the conduct of email providers when accessing emails on their
9
servers.”). However, again here, Yahoo’s argument assumes the emails were on Yahoo’s server
United States District Court
For the Northern District of California
10
when intercepted, which this Court cannot simply assume at this stage when allegations in the
11
Complaint are to the contrary.
12
Accordingly, the Court DENIES Yahoo’s Motion to Dismiss Plaintiffs’ CIPA claim.
13
C.
14
Plaintiffs allege that Yahoo’s scanning, storage, and disclosure of Plaintiffs’ email content
California Constitution
15
violates their right to privacy under Article I, Section 1 of the California Constitution. Compl. ¶¶
16
66-74. Yahoo contends Plaintiffs fail to allege sufficient facts to state a claim. Mot. at 21. The
17
Court GRANTS Yahoo’s motion with leave to amend.
18
The California Constitution creates a privacy right that protects individuals from the
19
invasion of their privacy by private parties. Am. Acad. of Pediatrics, 16 Cal. 4th 307, 326 (1997);
20
Leonel v. Am. Airlines, Inc., 400 F.3d 702, 711-12 (9th Cir. 2005), opinion amended on denial of
21
reh’g, 03–15890, 2005 WL 976985 (9th Cir. 2005). To establish an invasion of privacy claim, a
22
plaintiff must demonstrate three elements: “(1) a legally protected privacy interest; (2) a reasonable
23
expectation of privacy in the circumstances; and (3) conduct by defendant constituting a serious
24
invasion of privacy.” Hill v. Nat’l Collegiate Athletic Ass’n, 7 Cal. 4th 1, 39-40 (1994). These
25
elements are not a categorical test, but rather serve as threshold components of a valid claim to be
26
used to “weed out claims that involve so insignificant or de minimis an intrusion on a
27
constitutionally protected privacy interest as not even to require an explanation or justification by
28
the defendant.” Loder v. City of Glendale, 14 Cal. 4th 846, 893 (1997).
25
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page26 of 33
1
“A ‘reasonable’ expectation of privacy is an objective entitlement founded on broadly
based and widely accepted community norms.” Hill, 7 Cal. 4th at 37. The decision “must take into
3
account any ‘accepted community norms,’ advance notice to [Plaintiff] . . ., and whether [Plaintiff]
4
had the opportunity to consent to or reject the very thing that constitutes the invasion.” TBG Ins.
5
Servs. Corp. v. Superior Court, 96 Cal. App. 4th 443 (2002). The plaintiff in an invasion of privacy
6
action must have conducted himself or herself in a manner consistent with an actual expectation of
7
privacy, i.e., he or she must not have manifested by his or her conduct a voluntary consent to the
8
invasive actions of defendant. Hill, 7 Cal. 4th at 26. The “community norms” aspect of the
9
“reasonable expectation of privacy” element means that “‘[t]he protection afforded to the plaintiff’s
10
United States District Court
For the Northern District of California
2
interest in his privacy must be relative to the customs of the time and place, to the occupation of the
11
plaintiff and to the habits of his neighbors and fellow citizens.’” TBG Ins. Servs. Corp., 96 Cal.
12
App. 4th at 450. Finally, “[a]ctionable invasions of privacy must be sufficiently serious in their
13
nature, scope, and actual or potential impact to constitute an egregious breach of the social norms
14
underlying the privacy right. Thus, the extent and gravity of the invasion is an indispensable
15
consideration in assessing an alleged invasion of privacy.” Hill, 7 Cal. 4th at 37.
16
In the event a plaintiff establishes the three elements, the “diverse and somewhat
17
amorphous character of the privacy right” may still be balanced with competing or countervailing
18
interests of the defendant. Id. at 37-38 (“Conduct alleged to be an invasion of privacy is to be
19
evaluated based on the extent to which it furthers legitimate and important competing interests.”).
20
“Invasion of a privacy interest is not a violation of the state constitutional right to privacy if the
21
invasion is justified by a competing interest.” Id. at 38. Furthermore, if Plaintiffs’ allegations
22
“show no reasonable expectation of privacy or an insubstantial impact on privacy interests, the
23
question of invasion may be adjudicated as a matter of law.” Pioneer Electronics, Inc. v. Sup. Ct. of
24
L.A., 40 Cal. 4th 360, 370 (2007) (citing Hill, 7 Cal. 4th at 40).
25
The California Constitution sets a “high bar” for establishing an invasion of privacy claim.
26
See Belluomini v. Citigroup, Inc., No. CV 13–01743 CRB, 2013 WL 3855589, at *6 (N.D. Cal.
27
July 24, 2013). Even disclosure of very personal information has not been deemed an “egregious
28
breach of social norms” sufficient to establish a constitutional right to privacy. Id.; see also In re
26
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page27 of 33
1
iPhone Application Litig., 844 F. Supp. 2d at 1063 (holding that the disclosure to third parties of
2
unique device identifier number, personal data, and geolocation information did not constitute an
3
egregious breach of privacy sufficient to prove a serious invasion of a privacy interest); Ruiz v.
4
Gap, Inc., 540 F. Supp. 2d 1121, 1127-28 (N.D. Cal. 2008), aff’d, 380 Fed. Appx. 689 (9th Cir.
5
2010) (unpublished) (holding that the theft of a retail store’s laptop containing personal
6
information, including the social security numbers, of job applicants did not constitute an egregious
7
breach of privacy and therefore was not sufficient to state a claim); Folgelstrom v. Lamps Plus,
8
Inc., 195 Cal. App. 4th 986, 992 (2011) (“Here, the supposed invasion of privacy essentially
9
consisted of [defendant] obtaining plaintiff’s address without his knowledge or permission, and
United States District Court
For the Northern District of California
10
using it to mail him coupons and other advertisements. This conduct is not an egregious breach of
11
social norms, but routine commercial behavior.”).
12
Finally, “[w]hether a legally recognized privacy interest is present in a given case is a
13
question of law to be decided by the court.” Hill, 7 Cal. 4th at 40. “Whether plaintiff has a
14
reasonable expectation of privacy in the circumstances and whether defendant’s conduct
15
constitutes a serious invasion of privacy are mixed questions of law and fact. If the undisputed
16
material facts show no reasonable expectation of privacy or an insubstantial impact on privacy
17
interests, the question of invasion may be adjudicated as a matter of law.” Id.
18
Here, the question is whether Plaintiffs have alleged sufficient facts to demonstrate (1) a
19
legally protected privacy interest; (2) a reasonable expectation of privacy under the circumstances;
20
and (3) conduct by Yahoo that amounts to a serious invasion of that protected privacy interest.
21
Plaintiffs allege that Yahoo scans and stores the content of emails between Yahoo Mail users and
22
non-users, and distributes that content to third parties. Compl. ¶ 71. Plaintiffs allege they have a
23
legally protected privacy interest “in the private email communications” they send to Yahoo Mail
24
users. See id. ¶ 69; Opp’n at 24.8 Plaintiffs assert that they “reasonably expect that their email
25
26
27
28
8
Plaintiffs allege in the Complaint that they have a “legally protected interest in their private email
communications with Yahoo Mail users.” Compl. ¶ 69. From the Complaint alone, it is unclear if
Plaintiffs allege that non-Yahoo Mail users have privacy interest in both the emails sent to and
received from Yahoo Mail users. However, in their Opposition, Plaintiffs assert they have a
privacy interest in the “emails they send to Yahoo Mail users.” Opp’n at 23-24. This suggests
27
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page28 of 33
1
communications with Yahoo Mail users are private,” and do not expect Yahoo to intercept, scan,
2
and store the content of their emails without their consent. Compl. ¶ 70. Finally, Plaintiffs allege
3
Yahoo committed an egregious breach of social norms when it intercepted these emails, scanned
4
and stored their content, and distributed the content to third parties without Plaintiffs’ consent. Id. ¶
5
71. In response, Yahoo argues that Plaintiffs fail to set forth facts supporting all three elements but
6
merely recite elements of the claim. Mot. at 21. Yahoo argues Plaintiffs “allege no facts regarding
7
the content of their emails, their intent in sending those emails, the circumstances under which
8
those emails were sent, or who the recipients of those emails were[.]” Id. at 21-22. The Court
9
agrees with Yahoo that Plaintiffs have failed to allege sufficient facts to establish that Yahoo’s
United States District Court
For the Northern District of California
10
11
conduct invaded their constitutionally protected right to privacy.
As a preliminary matter, under California law there are only two classes of legally protected
12
privacy interests under the California Constitution: “interests in precluding the dissemination or
13
misuse of sensitive and confidential information (‘informational privacy’); and (2) interests in
14
making intimate personal decisions or conducting personal activities without observation,
15
intrusion, or interference (‘autonomy privacy’).” Hill, 7 Cal. 4th at 35. It is unclear from Plaintiffs’
16
briefing and allegations whether Plaintiffs assert a claim for informational privacy or autonomy
17
privacy. However, the Court construes Plaintiffs’ claim as asserting only an informational privacy
18
interest, as California courts have discussed autonomy privacy in the context of cases alleging
19
bodily autonomy. See, e.g., Comm. To Defend Reprod. Rights v. Myers, 29 Cal. 3d 252, 275 (1981)
20
(noting there is a constitutional right to privacy in a woman’s “personal bodily autonomy”); Smith
21
v. Fresno Irrigation Dist., 72 Cal. App. 4th 147, 161 (1999) (discussing autonomy privacy in the
22
context of drug testing through use of a urine sample).
23
Next, the Court notes it is unclear from Plaintiffs’ allegations and briefing whether
24
Plaintiffs claim a privacy interest in their emails generally, or in the specific content in the emails
25
they sent to Yahoo Mail users. To the extent Plaintiffs claim a legally protected privacy interest
26
and reasonable expectation of privacy in email generally based on the mere fact that Yahoo
27
28
Plaintiffs only intend to allege that they have a constitutionally protected privacy interest in their
own outgoing email content rather than the content they receive from Yahoo Mail users.
28
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page29 of 33
1
intercepted and distributed their emails, regardless of the specific content in the emails, Plaintiffs’
2
claim fails as a matter of law. Plaintiffs do not cite, nor has this Court found, any case in the
3
California or federal courts holding that individuals have a legally protected privacy interest or
4
reasonable expectation of privacy in emails generally. Rather, the cases in which courts have found
5
a protected privacy interest in the context of email communications have done so in circumstances
6
where the plaintiff alleged with specificity the material in the content of the email. See, e.g., Mintz
7
v. Mark Bartelstein & Associates Inc., 906 F. Supp. 2d 1017, 1033-34 (C.D. Cal. 2012) (finding
8
legally protected privacy interest in the personal financial and employment information contained
9
in an email account). The conclusion that there is no legally protected privacy interest and
United States District Court
For the Northern District of California
10
reasonable expectation of privacy in emails as a general matter is consistent with well-established
11
California law that in the context of informational privacy, the California Constitution protects only
12
the “dissemination or misuse of sensitive and confidential information.” Hill, 7 Cal. 4th at 35
13
(emphasis added). Hill suggests that in order to receive protection under the Constitution for an
14
email communication, Plaintiffs must allege that the email intercepted actually included content
15
that qualifies under California law as “confidential” or “sensitive.” Indeed, courts make their
16
decisions regarding whether a plaintiff has stated a legally protectable privacy interest based on the
17
nature of the information at issue. See, e.g., Tourgeman v. Collins Financial Servs. Inc., No. 08–
18
01392, 2009 WL 6527758, at *2 (S.D. Cal. Nov. 23, 2009) (holding plaintiff had legally protected
19
privacy interest by citing California case law holding that financial information is protectable); see
20
also Zbitoff v. Nationstar Mortgage, LLC, No. C 13–05221 WHA, 2014 WL 1101161, at *4 (N.D.
21
Cal. March 18, 2014) (holding plaintiff failed to state privacy claim “with the required specificity”
22
where she “merely state[d] that she had a ‘reasonable expectation that defendants would preserve
23
the privacy of [p]laintiff’s private information’” and did “not identify exactly what private
24
information defendants are alleged to have disclosed in relation to the credit checks[.]” (emphasis
25
added)); Norman–Bloodsaw v. Lawrence Berkeley Lab., 135 F.3d 1260, 1271 n.17 (9th Cir. 1998)
26
(“Under California law, a legally recognizable privacy interest arises from the sort of information
27
revealed[.]”).9 Thus, to the extent Plaintiffs claim they have a legally protected privacy interest and
28
9
The nature of the content at issue is also examined when courts assess whether the third prong of
29
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page30 of 33
1
reasonable expectation of privacy in email generally, regardless of the specific content in the
2
emails at issue, Plaintiffs’ claim fails as a matter of law.
3
However, this Court concludes, as others have, that there can be a legally protected privacy
4
interest or reasonable expectation of privacy in any confidential and sensitive content within
5
emails. See, e.g., Mintz, 906 F. Supp. 2d at 1033-34 (finding legally protected privacy interest in
6
personal financial and employment information contained in emails).10 The problem for Plaintiffs
7
in the instant case, however, is that to the extent Plaintiffs intend to allege that they have a privacy
8
interest in the specific content of their emails, their allegations are fatally conclusory. The
9
Complaint merely alleges that Plaintiffs’ emails were “private” without alleging any facts related to
United States District Court
For the Northern District of California
10
what particular emails Yahoo intercepted, or the content within particular emails. See Compl. ¶¶
11
69-70; Zbitoff, 2014 WL 1101161, at *4 (holding allegations for constitutional privacy claim were
12
conclusory because plaintiff “merely state[d]” defendants disclosed her “private information”);
13
Scott-Codiga v. Cnty. of Monterey, 10-CV-05450-LHK, 2011 WL 4434812, at *7 (N.D. Cal. Sept.
14
23, 2011) (dismissing constitutional privacy claim on ground that plaintiff had not “specified the
15
material defendants released to the public in enough detail for the Court to determine whether it
16
might conceivably fall within a recognized privacy interest protected by the [California]
17
constitution” (internal citation omitted)). Without more, Plaintiffs’ allegations are simply a bare
18
recitation of the elements of a privacy claim, and this Court cannot assess whether Plaintiffs had a
19
legally protected privacy interest in the specific emails that Yahoo intercepted, or a reasonable
20
expectation of privacy in the content within those emails.
21
22
Plaintiffs’ arguments to the contrary are unavailing. First, they argue that they have stated a
privacy claim by emphasizing that they do not consent to Yahoo’s conduct. Opp’n at 23-24;
23
24
25
26
27
28
a privacy claim is met – i.e., whether there was a serious or egregious violation of social norms.
See Low v. LinkedIn Corp., 900 F. Supp. 2d 1010, 1025 (N.D. Cal. 2012) (declining to find that
defendant violated constitutional right to privacy in releasing digital identification information to
third parties in part because “it is not clear . . . what information, precisely, these third parties have
obtained.” (emphasis added)).
10
While Yahoo cites this Court’s holding in Gmail that the plaintiffs in that case had not shown
that the email communications were “confidential communications” under CIPA § 632, Reply at
15, Gmail did not suggest or hold that there can never be a reasonable expectation of privacy in
email content. Rather, Gmail confronted a circumstance similar to the instant motion, where
plaintiffs suggested that emails in general were confidential.
30
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page31 of 33
1
Compl. ¶¶ 70-71. However, Plaintiffs cite no authority in support of their argument that an
2
allegation of lack of consent suffices to state a privacy claim. Rather, the case law suggests that in
3
determining whether a plaintiff has satisfied the elements of the claim, a plaintiff’s lack of consent
4
does not matter so much as the nature of the information in which he or she alleges a privacy
5
interest. See, e.g., In re iPhone Application Litig., 844 F. Supp. 2d at 1063 (“Even assuming this
6
information was transmitted without Plaintiffs’ knowledge and consent, a fact disputed by
7
Defendants, such disclosure [of information including device identifier number, personal data, and
8
geolocation information] does not constitute an egregious breach of social norms.” (emphasis
9
added)).
United States District Court
For the Northern District of California
10
Plaintiffs also argue that they need not allege that each of their emails contained
11
confidential information in order to state a claim because the right to privacy was adopted to
12
protect the public from the “stockpiling of personal information.” Opp’n at 24. Plaintiffs cite to the
13
ballot argument for the initiative creating the constitutional right to privacy as evidence that the
14
people intended to prevent “government and business interests from collecting and stockpiling
15
unnecessary information about us and or misusing information gathered for one purpose in order to
16
serve other purposes or to embarrass us.” Id. at 23 (citing Hill, 7 Cal. 4th at 27). According to
17
Plaintiffs, this history demonstrates that the right to privacy protects individuals from Yahoo’s
18
unauthorized scanning and storage of private email content for their own financial gain. Id. at 23-
19
24. The Court is not convinced. Plaintiffs cite no authority holding that an allegation of
20
“stockpiling” by itself is sufficient to state a privacy claim, and somehow nullifies the need to
21
allege facts regarding the three required prongs of the Hill test.11 To the contrary, this Court has
22
23
24
25
26
27
28
11
Plaintiffs’ cited cases do not so hold. Opp’n at 25. Rather, they are inapposite, as they arise in the
Fourth Amendment context. See United States v. Forrester, 512 F.3d 500 (9th Cir. 2007); United
States v. Warshak, 631 F.3d 266 (6th Cir. 2010); Klayman v. Obama, 957 F. Supp. 2d 1 (D.D.C.
2013). In these cases, courts considered the implications of the government’s intelligence gathering
and surveillance practices, and the compelled disclosure of communications held by an internet
service provider. A person’s reasonable expectation of privacy is considerably distinct in the
context of the instant case, where an ECS provider scanned emails that were either written by
Yahoo Mail users through a service Yahoo itself provided (Yahoo Mail) or were voluntarily sent to
Yahoo’s servers. Furthermore, a claim under Article 1, Section 1 requires a plaintiff to show the
privacy invasion is serious and “egregious,” thus setting a higher threshold than for a federal claim
under the Fourth Amendment. Chevron Corp. v. Donziger, 12-MC-80237 CRB (NC), 2013 WL
31
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page32 of 33
1
noted that merely alleging stockpiling is not enough; plaintiffs must still allege facts with respect to
2
the three elements. See Low, 900 F. Supp. 2d at 1024 n.3 (holding, where plaintiffs argued that the
3
intent of the voters was to prevent “stockpiling” of information, that “[e]ven in light of this ballot
4
history, the subsequent case law regarding the Constitutional right to privacy establishes that only
5
serious invasions of privacy give rise to a private right of action.” ).12
6
In sum, because Plaintiffs do not plead sufficient facts to allege an invasion of privacy,
7
Yahoo’s Motion to Dismiss Plaintiffs’ claims for a violation of Article I, Section 1 of the
8
California Constitution is GRANTED. However, the Court grants leave to amend because
9
Plaintiffs may be able to plead specific email content in specific emails that may suffice to state the
United States District Court
For the Northern District of California
10
elements of the claim.
11
IV.
CONCLUSION
12
For the foregoing reasons, the Court GRANTS Yahoo’s Motion to Dismiss with prejudice
13
Plaintiffs’ Wiretap Act claim that Yahoo scans and analyzes emails for the purposes of providing
14
personal product features, providing targeted advertising, detecting spam and abuse, creating user
15
profiles, and sharing information with third parties. The Court GRANTS Yahoo’s Motion to
16
Dismiss without prejudice Plaintiffs’ Wiretap Act claim with respect to collecting and storing
17
emails for future use.
18
19
20
21
22
23
24
25
26
27
28
4536808, at *10 (N.D. Cal. Aug. 22, 2013) (citing Norman–Bloodsaw v. Lawrence Berkeley Lab.,
135 F.3d 1260, 1271 (9th Cir. 1998)).
12
While Plaintiffs rely on Ung v. Facebook, Inc., Santa Clara County Superior Court Case No. 112-cv-217244, Dkt. No. 54 (July 2, 2012), see ECF No. 40-1 at 230, that case did not hold that an
allegation of stockpiling information automatically suffices to state a privacy claim. Further, that
case is distinguishable. There, where it was alleged that Facebook created user profiles linked to
Facebook users’ identities by tracking the internet browsing history of users across numerous other
websites even when the user is not logged into Facebook, the court found a legally protected
privacy interest in users’ “identifiable browsing history” because Facebook could link the history
to their identities, or names. Id. The court also held that non-Facebook users did not have a
protected interest in their browsing history which Facebook tracked because the history “had not
been linked to their identities.” Id. Plaintiffs in Yahoo are more analogous to the non-Facebook
users in Ung who did not have a privacy interest because the emails Yahoo allegedly intercepts are
not linked to Plaintiffs’ identities, as Yahoo does not necessarily know who Plaintiffs are. While
Plaintiffs allege Yahoo creates “profiles” of them, Compl. ¶ 27, Plaintiffs do not allege that Yahoo
attempts to link the information it acquires to Plaintiffs’ identities (i.e., to their names) as opposed
to just creating generic profiles that describe Plaintiffs’ interests and general characteristics
(female, likes shampoo products, etc).
32
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
Case5:13-cv-04980-LHK Document49 Filed08/12/14 Page33 of 33
1
The Court GRANTS Yahoo’s Motion to Dismiss with prejudice with respect to Plaintiffs’
2
SCA claim for unauthorized access under § 2701(a). The Court DENIES Yahoo’s Motion to
3
Dismiss Plaintiffs’ SCA claim for improper disclosure under § 2702(a)(1). The Court GRANTS
4
Yahoo’s Motion to Dismiss without prejudice Plaintiffs’ claim under Article I, Section 1 of the
5
California Constitution. The Court DENIES Yahoo’s Motion to Dismiss Plaintiffs’ CIPA § 631
6
claim.
7
Plaintiffs shall file any amended complaint within 21 days of this order. Plaintiffs may not
8
add new causes of action or parties without a stipulation or order of the Court under Rule 15 of the
9
Federal Rules of Civil Procedure. Failure to cure the deficiencies addressed in this Order will result
United States District Court
For the Northern District of California
10
in dismissal with prejudice.
11
IT IS SO ORDERED.
12
Dated: August 12, 2014
_________________________________
LUCY H. KOH
United States District Judge
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
33
Case No.: 13-CV-04980-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
Disclaimer: Justia Dockets & Filings provides public litigation records from the federal appellate and district courts. These filings and docket sheets should not be considered findings of fact or liability, nor do they necessarily reflect the view of Justia.
Why Is My Information Online?