Matera v. Google Inc.
Filing
54
ORDER granting in part and denying in part 20 Google's motion to dismiss based on lack of standing. Signed by Judge Lucy H. Koh on 9/23/2016. (lhklc3, COURT STAFF) (Filed on 9/23/2016)
1
2
3
4
5
6
7
8
UNITED STATES DISTRICT COURT
9
NORTHERN DISTRICT OF CALIFORNIA
10
SAN JOSE DIVISION
United States District Court
Northern District of California
11
12
DANIEL MATERA,
Plaintiff,
13
v.
14
15
GOOGLE INC.,
16
Defendant.
Case No. 15-CV-04062-LHK
ORDER GRANTING IN PART AND
DENYING IN PART DEFENDANT’S
MOTION TO DISMISS BASED ON
LACK OF STANDING
Re: Dkt. No. 20
17
Plaintiff Daniel Matera (“Plaintiff”), individually and on behalf of those similarly situated,
18
19
alleges that Defendant Google Inc. (“Google”) violated federal and state anti-wiretapping laws in
20
its operation of Gmail, an email service. ECF No. 1 (“Compl.”).1 Before the Court is Google’s
21
motion to dismiss based on lack of standing. ECF No. 20. Having considered the parties’
22
submissions, the relevant law, and the record in this case, the Court GRANTS IN PART AND
23
DENIES IN PART Google’s motion to dismiss based on lack of standing.
24
25
26
27
28
1
Unless otherwise noted, all ECF references are to the docket of 15-CV-04062 in the Northern
District of California.
1
Case No. 15-CV-04062-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS BASED ON
LACK OF STANDING
1
I.
BACKGROUND
A. Factual Background
2
3
4
5
6
7
8
9
10
United States District Court
Northern District of California
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
1. In re Google Inc. Gmail Litigation
Plaintiff’s factual allegations overlap significantly with those in the related action In re
Google Inc. Gmail Litigation (“Gmail”), 13-MD-02430, a consolidated multi-district litigation in
which this Court considered whether Google’s operation of Gmail violated federal and state antiwiretapping laws. As both the factual and procedural history of Gmail are relevant to the instant
motion, the Court briefly summarizes the background of that litigation.
Google provides several different but related systems of email delivery. First is a free
service for individual users, which allows any user to register for an “@gmail.com” email address.
In re Google Inc. Gmail Litig. (“Gmail”), 2013 WL 5423918, at *2 (N.D. Cal. Sept. 26, 2013); In
re Google Inc. Gmail Litig. (“Gmail Class Cert.”), 2014 WL 1102660, at *1 (N.D. Cal. Mar. 18,
2014). Second, Google offers “Google Apps” to businesses, educational organizations, and
internet service providers (“ISPs”). Gmail Class Cert., 2014 WL 1102660, at *1. The end users
of Google Apps do not receive “@gmail.com” email addresses. Rather, the email addresses
contain the domain name of the business, educational institution, or ISP that contracts with Google
to provide the email service (for example, “@cableone.com”). Id. However, Google Apps email
services are powered by Google through Gmail.
The Gmail plaintiffs alleged that Google intercepted, read, and acquired the content of
emails that were sent to or received by a Gmail user while the emails were in transit. Gmail, 2013
WL 5423918, at *1. Google allegedly intercepted the emails for the dual purposes of (1)
providing advertisements targeted to the email’s recipient or sender, and (2) creating user profiles
to advance Google’s profit interests. Id. According to the Gmail plaintiffs, Google’s interception,
scanning, and analyzing of email was done without the plaintiffs’ knowledge or consent.
As relevant to the instant case, the putative class in Gmail included a class of all United
States non-Gmail users “who have sent a message to a Gmail user and received a reply or received
an email from a Gmail user.” Id. at *4. Because non-Gmail users exchange emails with Gmail
2
Case No. 15-CV-04062-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS BASED ON
LACK OF STANDING
1
users, the Gmail plaintiffs alleged that non-Gmail users’ communications were subject to the same
2
interception, scanning, and analyzing as Gmail users. The Gmail plaintiffs also sought to
3
represent (1) end users of Cable One, an ISP that contracted with Google to provide Google Apps-
4
related services to its customers; (2) users of Google Apps for Education; and (3) Gmail users
5
under the age of majority.
6
2. Allegations in the Instant Case
7
This case involves a subset of the Gmail putative class. In the instant case, Plaintiff seeks
8
to represent non-Gmail users “who have never established an email account with Google, and who
9
sent emails to or received emails from individuals with Google email accounts.” Compl. ¶ 32. In
the complaint, Plaintiff uses “Gmail” to refer collectively to Gmail for individual users, Google
11
United States District Court
Northern District of California
10
Apps for Work, and Google Apps for Education. Id. ¶ 1 n.1.
12
Plaintiff has never had a Gmail account. Id. ¶ 8. However, Plaintiff has sent emails to and
13
received emails from Gmail users, which Google allegedly has intercepted, scanned, and analyzed.
14
Id. In particular, Plaintiff alleges that Google employs a variety of devices that intercept, scan,
15
and analyze the content of emails during the transmission of emails to and from Gmail accounts.
16
For example, Google allegedly acquires and interprets the content of emails sent or received by
17
Gmail users through “Content Onebox” and “Changeling,” which are “distinct piece[s] of
18
Google’s infrastructure.” Id. ¶ 19. Google then uses a process called “Nemo” to determine how
19
to best monetize the data extracted from the intercepted emails. Id. ¶ 20. Plaintiff contends that
20
these devices are “separate from the devices that are instrumental to sending and receiving email.”
21
Id. ¶ 2.
22
Google allegedly uses the intercepted contents of Gmail messages for the “distinct
23
purpose” of creating targeted advertisements and user profiles to be stored indefinitely. Id. ¶¶ 21,
24
28. According to Plaintiff, Google utilizes the user profiles “for purposes of selling to paying
25
customers, and sending to the profiled communicants, targeted advertising based upon analysis of
26
these profiles.” Id. ¶ 1; see also id. ¶ 17 (noting that Google “deliver[s] targeted advertisements
27
28
3
Case No. 15-CV-04062-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS BASED ON
LACK OF STANDING
1
based on these [user] profiles”).
2
3. Google’s Agreements with Users
3
The operation of Gmail implicates two sets of legal agreements: those in place during the
4
Gmail litigation and the amended agreements in place after the Gmail litigation. Plaintiff avers
5
that during the Gmail litigation, “Google’s Gmail Terms of Service and Privacy Policy made no
6
mention of the practices complained of herein, and thus Google failed to legally obtain the consent
7
of Gmail users to the practices complained of herein.” Compl. ¶ 26.
8
9
In examining Google’s Terms of Service and Privacy Policies in place from April 16, 2007
to September 26, 2013, this Court in Gmail determined that those documents did not sufficiently
disclose Google’s alleged practice of intercepting and analyzing email content for commercial
11
United States District Court
Northern District of California
10
purposes. Gmail, 2013 WL 5423918, at *12–14.
12
After the Gmail decision, Google amended both its Terms of Service and Privacy Policy.
13
Specifically, Google amended its Terms of Service on April 14, 2014, see ECF No. 20-1 (“Google
14
RJN”), Ex. A (“2014 TOS”). The 2014 TOS states that, “[b]y using our Services, you are
15
agreeing to these terms. . . . If you do not agree to the modified terms for a Service, you should
16
discontinue your use of that Service.” 2014 TOS at “About these Terms.” As relevant to
17
Plaintiff’s allegations in the instant case, the 2014 TOS provides:
18
19
20
21
22
23
24
25
26
27
28
Our automated systems analyze your content (including emails) to provide you
personally relevant product features, such as customized search results, tailored
advertising, and spam and malware detection. This analysis occurs as the content is
sent, received, and when it is stored.
Id. at “Your Content in our Services.” The 2014 TOS references Google’s Privacy Policies, and
states that, “[b]y using our Services, you agree that Google can use such [personal] data in
accordance with our privacy policies.” Id. at “Privacy and Copyright Protection.”
Google’s Privacy Policies have been amended at least eight times since January 1, 2013,
including three times in 2015 alone. Compl. ¶ 30; see also Google RJN Ex. D (February 25, 2015
Privacy Policy); Google RJN Ex. E (May 1, 2015 Privacy Policy); Google RJN Ex. F (June 5,
2015 Privacy Policy); Google RJN Ex. G (June 30, 2015 Privacy Policy); Google RJN Ex. H
4
Case No. 15-CV-04062-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS BASED ON
LACK OF STANDING
1
2
(August 19, 2015 Privacy Policy).
As relevant here, the December 19, 2014 Privacy Policy repeats the language in the 2014
3
TOS that “Our automated systems analyze your content (including emails) to provide you
4
personally relevant product features, such as customized search results, tailored advertising, and
5
spam and malware detection.” Google RJN Ex. B. In addition, the December 19, 2014 Privacy
6
Policy states that Google will “collect information about the services that you use and how you
7
use them.” When the cursor is held over the phrase “collect information,” a text box appears.
8
Google RJN ¶ 5. This text box states, “This includes information like your usage data and
9
preferences, Gmail messages, G+ profile, photos . . . or other Google-hosted content. Learn
more.” Clicking on the “Learn more” link in the “Example” box directs to a webpage entitled
11
United States District Court
Northern District of California
10
“collect information,” which states:
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
This includes information like your usage data and preferences, Gmail messages,
G+ profile, photos, videos, browsing history, map searches, docs, or other Googlehosted content. Our automated systems analyze this information as it is sent and
received and when it is stored.
This may include any content as it flows through our systems. For example, we
may use the information in your Gmail inbox to provide you with flight
notifications and check-in options, information in your Google+ profile to help you
connect with your circles by email, and information in your web history cookies to
provide you with more relevant search results.
Google RJN Ex. C.
Plaintiff contends that non-Gmail users like Plaintiff “were never subject to or on notice of
Google’s Privacy Policy.” Compl. ¶ 8. Because non-Gmail users exchange emails with Gmail
users, however, their communications are nevertheless subject to interception, scanning, and
analysis by Google.
B. Procedural History
In light of the relationship between the instant case and Gmail, the Court briefly
summarizes the relevant procedural history of Gmail in addition to the instant case.
1. Procedural History of Gmail
The first case that comprised the Gmail multi-district litigation, Dunbar v. Google, Inc.,
5
Case No. 15-CV-04062-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS BASED ON
LACK OF STANDING
1
was filed on November 17, 2010 in the Eastern District of Texas. See Dunbar v. Google, Inc., No.
2
10-CV-00194, ECF No. 1 (E.D. Tex. Nov. 17, 2010). On June 27, 2012, upon Google’s motion,
3
the case was transferred to the Northern District of California and assigned to the undersigned
4
judge. See Dunbar v. Google, Inc., No. 12-CV-03305, ECF No. 180 (N.D. Cal. July 23, 2012).
While Dunbar was pending, five other actions involving substantially similar allegations
5
against Google were filed in this District and throughout the country. See Scott v. Google, Inc.
7
(“Scott I”), No. 12-CV-03413 (N.D. Cal.); Scott v. Google, Inc. (“Scott II”), No. 12-CV-00614
8
(N.D. Fla.); A.K. v. Google, Inc., No. 12-CV-01179 (S.D. Ill.); Knowles v. Google, Inc., No. 12-
9
CV-02022 (D. Md.); Brinkman v. Google, Inc., No. 12-CV-00699 (E.D. Pa.). On April 1, 2013,
10
the Judicial Panel on Multidistrict Litigation issued a Transfer Order, centralizing Dunbar along
11
United States District Court
Northern District of California
6
with the five other actions in the Northern District of California before the undersigned judge. See
12
No. 13-MD-02430, ECF No. 1. The Court later related a seventh case to the multi-district
13
litigation, Fread v. Google, Inc., No. 13-CV-01961 (N.D. Cal.). See No. 13-MD-02430, ECF No.
14
29.
15
The Gmail plaintiffs filed a Consolidated Complaint on May 16, 2013. No. 13-MD-02430,
16
ECF No. 38. That complaint attempted to state causes of action under (1) the Electronic
17
Communications Privacy Act of 1986 (the “ECPA” or the “Wiretap Act”), 18 U.S.C. § 2510 et
18
seq.; (2) California’s Invasion of Privacy Act (“CIPA”), Cal. Penal Code § 630 et seq.; (3)
19
Maryland’s Wiretap Act, Md. Code Ann., Cts. & Jud. Proc. § 10-402; (4) Florida’s Wiretap Act,
20
Fla. Stat. Ann. § 934.01; and (5) Pennsylvania’s Wiretapping and Electronic Surveillance Control
21
Act, 18 Pa. Cons. Stat. § 5701. Google moved to dismiss the Consolidated Complaint on June 13,
22
2013. See No. 13-MD-02430, ECF No. 44.
23
The Court granted in part and denied in part Google’s motion on September 26, 2013. See
24
No. 13-MD-02430, ECF No. 69. As relevant here, the Court denied the motion to dismiss
25
plaintiffs’ Wiretap Act claim. Specifically, the Court rejected Google’s contention that any
26
alleged interceptions fell within the “ordinary course” of Google’s business and were therefore
27
28
6
Case No. 15-CV-04062-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS BASED ON
LACK OF STANDING
1
exempt from anti-wiretapping statutes. Using the tools of statutory interpretation, the Court
2
concluded that the “ordinary course of business” exception was “designed only to protect
3
electronic communication service providers against a finding of liability under the Wiretap Act
4
where the interception facilitated or was incidental to provision of the electronic communication
5
service at issue.” Id. at 13–20.
6
In addition, the Court rejected Google’s argument that Gmail users had consented to the
7
alleged interceptions based on Google’s Terms of Service and Privacy Policies. The Court
8
concluded that the Terms of Service and Privacy Policies did not provide sufficient disclosures to
9
show that Gmail users had consented to the alleged interceptions. Id. at 22–26. The Court further
rejected Google’s contention that all email users had impliedly consented to the alleged
11
United States District Court
Northern District of California
10
interceptions because all email users, including non-Gmail users, understand that such
12
interceptions are part of how emails are transmitted. Id. at 27–28.
13
The Court also held that the Gmail plaintiffs could proceed on their claims under section
14
631 of CIPA, California’s anti-wiretapping law. Id. at 28–40. The Court first found that section
15
631 applies to email, not just to communications passing over telephone and telegraph wires, lines,
16
or cables. The Court also concluded that Google was not exempt from section 631 liability as a
17
“public utility.” Accordingly, the Court denied Google’s motion to dismiss the Gmail plaintiffs’
18
section 631 claim.
19
On October 25, 2013, the Gmail plaintiffs moved for class certification of a damages class
20
under Federal Rule of Civil Procedure 23(b)(3). No. 13-MD-02430, ECF No. 87-26. On March
21
18, 2014, the Court denied class certification. No. 13-MD-02430, ECF No. 158. Specifically, the
22
Court found that the Gmail plaintiffs had failed to meet the predominance requirement, which
23
“tests whether proposed classes are sufficiently cohesive to warrant adjudication by
24
representation.” Id. at 23. The Court concluded that the question of whether the Gmail class
25
members had consented to the alleged interceptions needed to be litigated on an individual rather
26
than classwide basis. The Court further concluded that individualized inquiries into consent
27
28
7
Case No. 15-CV-04062-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS BASED ON
LACK OF STANDING
1
would predominate over questions common to the class and thus denied class certification. On
2
May 12, 2014, the Ninth Circuit denied the Gmail plaintiffs’ petition for interlocutory review of
3
the Court’s class certification order. No. 13-MD-02430, ECF No. 174.
4
Following the Court’s class certification ruling, only the individual plaintiffs’ individual
5
claims remained. Google and the individual plaintiffs settled the individual claims and filed
6
stipulations of dismissal as to all cases. No. 13-MD-02430, ECF Nos. 175, 177. The case was
7
closed on July 14, 2014.
8
2. Procedural History of the Instant Case
9
Plaintiff filed the instant complaint on September 4, 2015. ECF No. 1. Similar to the
Gmail plaintiffs, Plaintiff asserts violations of the ECPA and CIPA. Plaintiff seeks to represent
11
United States District Court
Northern District of California
10
the following classes:
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
CIPA Class (Count One): All persons in the State of California who have never
established an email account with Google, and who have sent emails to or
received emails from individuals with Google email accounts.
ECPA Class (Count Two): All persons in the United States who have never
established an email account with Google, and who sent emails to or received
emails from individuals with Google email accounts before December 19,
2014.
Id. ¶ 32. On September 23, 2015, the case was related to Gmail and reassigned to the undersigned
judge. ECF No. 13.
On October 29, 2015, Google filed a motion to dismiss, ECF No. 20 (“Mot.”), and a
request for judicial notice, ECF No. 20-1. On December 4, 2015, Plaintiff opposed the motion to
dismiss, ECF No. 29 (“Opp.”), and filed a request for judicial notice, ECF No. 31 (“Pl. RJN”).
Google replied on December 22, 2015. ECF No. 33 (“Reply”).
The same day that Google filed the motion to dismiss, Google also moved to temporarily
stay the case pending the Supreme Court’s resolution of Spokeo, Inc. v. Robins, No. 13-01339.
ECF No. 21. Because the Court concluded that Spokeo may determine whether Plaintiff has
standing to proceed in this action, the Court granted Google’s motion to stay on February 5, 2016.
ECF No. 36. On April 28, 2016, this Court set a case management conference for May 25, 2016.
8
Case No. 15-CV-04062-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS BASED ON
LACK OF STANDING
1
ECF No. 37.
2
The Supreme Court issued an opinion in Spokeo on May 16, 2016. See Spokeo, Inc. v.
3
Robins, 136 S. Ct. 1540 (2016). At the May 25, 2016 case management conference, the Court
4
lifted the stay in the instant case and ordered supplemental briefing as to the impact of Spokeo on
5
Plaintiff’s standing. ECF No. 40. The parties filed simultaneous opening briefs on the impact of
6
Spokeo on June 1, 2016. ECF No. 41 (“Pl. Supp. Br.”); ECF No. 41 (“Google Supp. Br.”). The
7
parties filed simultaneous reply briefs on June 13, 2016. ECF No. 45 (“Pl. Supp. Reply”); ECF
8
No. 46 (“Google Supp. Reply”).
On August 12, 2016, the Court denied Google’s motion to dismiss as to the merits of
9
Plaintiff’s claims. ECF No. 49. Specifically, the Court concluded that Gmail correctly analyzed
11
United States District Court
Northern District of California
10
the Wiretap Act’s “ordinary course of business” exception, which is “designed only to protect
12
electronic communication service providers against a finding of liability under the Wiretap Act
13
where the interception facilitated or was incidental to provision of the electronic communication
14
service at issue.” Applying that interpretation to the instant case, the Court rejected Google’s
15
contention that the alleged interceptions of Plaintiff’s email fell within the “ordinary course” of
16
Google’s business. Id. at 10–25. Accordingly, the Court denied Google’s motion to dismiss
17
Plaintiff’s Wiretap Act claim. The Court declined to certify the interpretation of the “ordinary
18
course of business” exception to the Ninth Circuit. Id. at 25–27.
In addition, the Court denied Google’s motion to dismiss Plaintiff’s CIPA claim. The
19
20
Court retained supplemental jurisdiction over the CIPA claim on the grounds of economy,
21
convenience, and fairness. Id. at 27–30. Moreover, the Court rejected Google’s arguments—
22
duplicative of those presented by Google during the Gmail litigation—that CIPA did not apply to
23
email. Id. at 31–37.
24
II.
25
26
27
28
LEGAL STANDARD
A. Rule 12(b)(1)
A defendant may move to dismiss an action for lack of subject matter jurisdiction pursuant
9
Case No. 15-CV-04062-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS BASED ON
LACK OF STANDING
1
to Rule 12(b)(1) of the Federal Rules of Civil Procedure. While lack of statutory standing requires
2
dismissal for failure to state a claim under Rule 12(b)(6), lack of Article III standing requires
3
dismissal for want of subject matter jurisdiction under Rule 12(b)(1). See Maya v. Centex Corp.,
4
658 F.3d 1060, 1067 (9th Cir. 2011). “A Rule 12(b)(1) jurisdictional attack may be facial or
5
factual.” Safe Air for Everyone v. Meyer, 373 F.3d 1035, 1039 (9th Cir. 2004). “In a facial
6
attack,” like the one made by Google here, “the challenger asserts that the allegations contained in
7
a complaint are insufficient on their face to invoke federal jurisdiction.” Id. The Court “resolves a
8
facial attack as it would a motion to dismiss under Rule 12(b)(6): Accepting the plaintiff’s
9
allegations as true and drawing all reasonable inferences in the plaintiff’s favor, the court
determines whether the allegations are sufficient as a legal matter to invoke the court’s
11
United States District Court
Northern District of California
10
jurisdiction.” Leite v. Crane Co., 749 F.3d 1117, 1121 (9th Cir. 2014).
12
Once a defendant has moved to dismiss for lack of subject matter jurisdiction under Rule
13
12(b)(1), the plaintiff bears the burden of establishing the Court’s jurisdiction. See Chandler v.
14
State Farm Mut. Auto. Ins. Co., 598 F.3d 1115, 1122 (9th Cir. 2010). The plaintiff carries that
15
burden by putting forth “the manner and degree of evidence required” by whatever stage of the
16
litigation the case has reached. Lujan v. Defenders of Wildlife, 504 U.S. 555, 561 (1992). At the
17
motion to dismiss stage, Article III standing is adequately demonstrated through allegations of
18
“specific facts plausibly explaining” why the standing requirements are met. Barnum Timber Co.
19
v. EPA, 633 F.3d 894, 899 (9th Cir. 2011).
20
21
B. Rule 12(b)(6) Motion to Dismiss
Rule 8(a)(2) of the Federal Rules of Civil Procedure requires a complaint to include “a
22
short and plain statement of the claim showing that the pleader is entitled to relief.” A complaint
23
that fails to meet this standard may be dismissed pursuant to Rule 12(b)(6). Rule 8(a) requires a
24
plaintiff to plead “enough facts to state a claim to relief that is plausible on its face.” Bell Atl.
25
Corp. v. Twombly, 550 U.S. 544, 570 (2007). “A claim has facial plausibility when the plaintiff
26
pleads factual content that allows the court to draw the reasonable inference that the defendant is
27
28
10
Case No. 15-CV-04062-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS BASED ON
LACK OF STANDING
1
liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). “The plausibility
2
standard is not akin to a probability requirement, but it asks for more than a sheer possibility that a
3
defendant has acted unlawfully.” Id. (internal quotation marks omitted).
For purposes of ruling on a Rule 12(b)(6) motion, the Court “accept[s] factual allegations
4
5
in the complaint as true and construe[s] the pleadings in the light most favorable to the nonmoving
6
party.” Manzarek v. St. Paul Fire & Marine Ins. Co., 519 F.3d 1025, 1031 (9th Cir. 2008). The
7
Court, however, need not accept as true allegations contradicted by judicially noticeable facts, see
8
Shwarz v. United States, 234 F.3d 428, 435 (9th Cir. 2000), and it “may look beyond the plaintiff’s
9
complaint to matters of public record” without converting the Rule 12(b)(6) motion into a motion
for summary judgment, Shaw v. Hahn, 56 F.3d 1128, 1129 n.1 (9th Cir. 1995). Nor must the
11
United States District Court
Northern District of California
10
Court “assume the truth of legal conclusions merely because they are cast in the form of factual
12
allegations.” Fayer v. Vaughn, 649 F.3d 1061, 1064 (9th Cir. 2011) (per curiam). Mere
13
“conclusory allegations of law and unwarranted inferences are insufficient to defeat a motion to
14
dismiss.” Adams v. Johnson, 355 F.3d 1179, 1183 (9th Cir. 2004).
C. Leave to Amend
15
If the Court concludes that the complaint should be dismissed, it must then decide whether
16
17
to grant leave to amend. Under Rule 15(a) of the Federal Rules of Civil Procedure, leave to
18
amend “shall be freely given when justice so requires,” bearing in mind “the underlying purpose
19
of Rule 15 . . . [is] to facilitate decision on the merits, rather than on the pleadings or
20
technicalities.” Lopez v. Smith, 203 F.3d 1122, 1127 (9th Cir. 2000) (en banc) (ellipsis in
21
original). Nonetheless, a district court may deny leave to amend a complaint due to “undue delay,
22
bad faith or dilatory motive on the part of the movant, repeated failure to cure deficiencies by
23
amendments previously allowed, undue prejudice to the opposing party by virtue of allowance of
24
the amendment, [and] futility of amendment.” See Leadsinger, Inc. v. BMG Music Publ’g, 512
25
F.3d 522, 532 (9th Cir. 2008).
26
III.
27
28
JUDICIAL NOTICE
11
Case No. 15-CV-04062-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS BASED ON
LACK OF STANDING
1
Plaintiff and Google have each filed requests for judicial notice. Under Federal Rule of
2
Evidence 201(b), the Court can take judicial notice of any fact that is “not subject to reasonable
3
dispute because it . . . can be accurately and readily determined from sources whose accuracy
4
cannot reasonably be questioned.” Fed. R. Evid. 201(b). Under the doctrine of incorporation by
5
reference, the Court also may consider documents whose contents are alleged in the complaint,
6
provided that the complaint “necessarily relies” on the documents, the documents’ authenticity is
7
uncontested, and the documents’ relevance is uncontested. Coto Settlement v. Eisenberg, 593 F.3d
8
1031, 1038 (9th Cir. 2010).
Plaintiff asks for judicial notice of the transcript of the November 2, 2015 oral argument
9
before the U.S. Supreme Court in Spokeo, as well as a U.S. Senate Report regarding the passage of
11
United States District Court
Northern District of California
10
the ECPA. See Pl. RJN. Google requests judicial notice of the 2014 TOS; various versions of
12
Google’s Privacy Policy; Google’s website entitled “Updates: Privacy Policy”; two reports from
13
California Senate Committees; and three bills introduced in the California Legislature. See
14
Google RJN. Both Plaintiff’s and Google’s requests for judicial notice are unopposed, and the
15
documents therein are the proper subject of judicial notice. See Anderson v. Holder, 673 F.3d
16
1089, 1094 n.1 (9th Cir. 2012) (“Legislative history is properly a subject of judicial notice.”); Lee
17
v. City of Los Angeles, 250 F.3d 668, 688 (9th Cir. 2001) (matters of public record), overruled in
18
part on other grounds by Galbraith v. Cty. of Santa Clara, 307 F.3d 1119, 1125–26 (9th Cir.
19
2002); Caldwell v. Caldwell, 2006 WL 618511, at *4 (N.D. Cal. Mar. 13, 2006) (publicly
20
accessible websites). Accordingly, the Court GRANTS Plaintiff’s and Google’s requests for
21
judicial notice.
22
IV.
DISCUSSION
23
Google raises two challenges to Plaintiff’s standing. First, Google contends that Plaintiff
24
has failed to plead injury in fact under the standard set forth in Spokeo, Inc. v. Robins, 136 S. Ct.
25
1540 (2016). Thus, Google argues that Plaintiff lacks standing to pursue Plaintiff’s claims under
26
either the Wiretap Act or CIPA. Second, Google argues that Plaintiff lacks standing to seek
27
28
12
Case No. 15-CV-04062-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS BASED ON
LACK OF STANDING
1
injunctive relief. Under the Wiretap Act, the consent of one party to the interception of the
2
communication is a complete defense to liability. 18 U.S.C. § 2511(2)(d). Under CIPA, a consent
3
defense is established when both parties—the sender and the recipient of the communication—
4
consent to the alleged interception. Cal. Penal Code § 631(a). In the instant case, according to
5
Google, there is no risk of Plaintiff suffering future injury because Google’s post-Gmail Terms of
6
Service and Privacy Policies establish Gmail users’ consent to the interception, scanning, and
7
analysis of their email. The Court addresses Google’s standing challenges in turn.
8
9
10
A. Injury in Fact
1. Legal Standard
Plaintiff “bear[s] the burden of establishing . . . standing to sue.” San Diego Cty. Gun
United States District Court
Northern District of California
11
Rights Comm. v. Reno, 98 F.3d 1121, 1126 (9th Cir. 1996). “To do so, [Plaintiff] must
12
demonstrate three elements which constitute the irreducible constitutional minimum of Article III
13
standing.” Id. (internal quotation marks omitted). First, Plaintiff “must have suffered an injury-
14
in-fact to a legally protected interest that is both concrete and particularized and actual or
15
imminent, as opposed to conjectural or hypothetical.” Id. (internal quotation marks omitted).
16
Second, “there must be a causal connection between the[] injury and the conduct complained of.”
17
Id. Third, “it must be likely—not merely speculative—that the[] injury will be redressed by a
18
favorable decision.” Id. (internal quotation marks omitted). In the class action context, “standing
19
is satisfied if at least one named plaintiff meets the[se] [three] requirements.” Bates v. United
20
Parcel Serv., Inc., 511 F.3d 974, 985 (9th Cir. 2007).
21
2. Application
22
Google limits its attack on Plaintiff’s standing to the first of the three standing
23
requirements: injury in fact. Plaintiff alleges that Google intercepts, scans, and analyzes the
24
content of Plaintiff’s private emails for commercial purposes and without consent, in violation of
25
the Wiretap Act and CIPA. Compl. ¶¶ 1–4, 7–8, 18–24. According to Plaintiff, these violations
26
are “egregious and illegal invasions of privacy,” and constitute injury in fact. Id. ¶ 7.
27
28
13
Case No. 15-CV-04062-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS BASED ON
LACK OF STANDING
1
In response, Google argues that Plaintiff can not rely “solely on the purported statutory
2
violations alone as the basis for Article III standing.” Google Supp. Br. at 1. According to
3
Google, in light of the U.S. Supreme Court’s Spokeo decision, Plaintiff must allege a concrete
4
harm that is “independent[] of the alleged statutory violations.” Id. at 1, 4. Because Plaintiff
5
relies only on the alleged statutory violations, without claiming any additional harm, Google
6
argues that Plaintiff has not pled a “concrete” injury in fact.
7
In addressing Google’s argument, the Court first examines the legal standard set forth in
Spokeo in more detail. The Court then analyzes whether, under Spokeo, Plaintiff sufficiently
9
alleges a concrete injury.
10
a. Spokeo
11
United States District Court
Northern District of California
8
In Spokeo, the U.S. Supreme Court reiterated two longstanding principles governing the
12
injury in fact analysis. First, the U.S. Supreme Court confirmed that for an injury to be
13
“concrete,” it must be “de facto,” meaning that it is “real,” and not “abstract.” Spokeo, 136 S. Ct.
14
at 1548. However, an injury need not be “tangible” in order to be “concrete,” and intangible
15
injuries may constitute injury in fact. Id. at 1549.
16
Second, the Spokeo Court reaffirmed that Congress may “elevat[e]” injuries “previously
17
inadequate in law” to legally cognizable “concrete” injuries. Id. at 1549 (quoting Lujan, 504 U.S.
18
at 578); see also Lujan, 504 U.S. at 580 (Kennedy, J., concurring) (“Congress has the power to
19
define injuries and articulate chains of causation that will give rise to a case or controversy where
20
none existed before.”). In other words, the violation of a right granted by statute may be sufficient
21
to constitute injury in fact, without alleging “any additional harm beyond the one Congress has
22
identified.” Spokeo, 136 S. Ct. at 1549; see also Warth v. Seldin, 422 U.S. 490, 500 (1975)
23
(stating that the “actual or threatened injury required by Art. III may exist solely by virtue of
24
statutes creating legal rights, the invasion of which creates standing” (internal quotation marks
25
omitted)). Justice Thomas, concurring in Spokeo, put the principle plainly: “Congress can create
26
new private rights and authorize private plaintiffs to sue based simply on the violation of those
27
28
14
Case No. 15-CV-04062-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS BASED ON
LACK OF STANDING
1
private rights,” such that “[a] plaintiff seeking to vindicate a statutorily created private right need
2
not allege actual harm beyond the invasion of that private right.” Spokeo, 136 S. Ct. at 1553
3
(Thomas, J., concurring).
4
Accordingly, Spokeo clearly rejects Google’s position that a plaintiff may never rely
5
“solely on the purported statutory violations alone as the basis for Article III standing.” Google
6
Supp. Br. at 1. Rather, a plaintiff may plead injury in fact by alleging the violation of a statute
7
without alleging “any additional harm beyond the one Congress has identified.” Spokeo, 136 S.
8
Ct. at 1549.
9
However, Google is correct that not every harm recognized by statute will be sufficiently
“concrete” for standing purposes. Id. (“Congress’ role in identifying and elevating intangible
11
United States District Court
Northern District of California
10
harms does not mean that a plaintiff automatically satisfies the injury-in-fact requirement
12
whenever a statute grants a person a statutory right and purports to authorize that person to sue to
13
vindicate that right.”). When evaluating whether the violation of a statute establishes concrete
14
injury, Spokeo instructs courts to consider two factors.
15
First, because the standing requirement is grounded in “historical practice,” “it is
16
instructive to consider whether an alleged intangible harm has a close relationship to a harm that
17
has traditionally been regarded as providing a basis for a lawsuit in English or American courts.”
18
Id.; see also Vt. Agency of Nat. Res. v. U.S. ex rel. Stevens, 529 U.S. 765, 774 (2000) (“Article
19
III’s restriction of the judicial power to ‘Cases’ and ‘Controversies’ is properly understood to
20
mean ‘cases and controversies of the sort traditionally amenable to, and resolved by, the judicial
21
process.’”).
22
Second, “because Congress is well positioned to identify intangible harms that meet
23
minimum Article III requirements, its judgment is also instructive and important.” Spokeo, 136 S.
24
Ct. at 1549. Relevant to this inquiry is whether Congress created a procedural or substantive right
25
in the statute at issue. By way of example, in Spokeo, the defendant allegedly violated the Fair
26
Credit Reporting Act (“FCRA”), which requires consumer reporting agencies to “follow
27
28
15
Case No. 15-CV-04062-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS BASED ON
LACK OF STANDING
1
reasonable procedures to assure maximum possible accuracy of” consumer reports. Id. at 1545
2
(quoting 15 U.S.C. § 1681e(b)). The U.S. Supreme Court expressed no opinion as to whether this
3
procedural FCRA violation constituted a “concrete injury,” instead “leav[ing] that issue for the
4
Ninth Circuit to consider on remand.” Id. at 1550 & n.8. However, the U.S. Supreme Court did
5
note that “[i]t is difficult to imagine how the dissemination of an incorrect zip code [in violation of
6
the FCRA], without more, could work any concrete harm.” Id. Thus, while “the violation of a
7
procedural right granted by statute can be sufficient in some circumstances to constitute injury in
8
fact,” a “bare procedural violation, divorced from any concrete harm” is not. Id. at 1549 (citing
9
Summers v. Earth Island Inst., 555 U.S. 488, 496 (2009) (“[D]eprivation of a procedural right
without some concrete interest that is affected by the deprivation . . . is insufficient to create
11
United States District Court
Northern District of California
10
Article III standing.”)).
12
In sum, Spokeo held that two factors may be relevant to whether the violation of statutory
13
rights constitutes injury in fact: (1) whether the statutory violation bears a “close relationship to a
14
harm that has traditionally been regarded as providing a basis for a lawsuit in English or American
15
courts,” and (2) congressional judgment in establishing the statutory right, including whether the
16
statutory right is substantive or procedural. With these principles in mind, the Court proceeds to
17
analyze whether Plaintiff has alleged injury in fact.
18
19
20
21
22
23
24
25
26
27
28
b. Relationship to a Harm that Has Traditionally Been Regarded as Providing a
Basis for a Lawsuit
A Wiretap Act violation exists when any person “intentionally intercepts, endeavors to
intercept, or procures any other person to intercept or endeavor to intercept, any wire, oral, or
electronic communication.” 18 U.S.C. § 2511(1)(a). Similarly, CIPA is violated when a person
“reads, or attempts to read, or to learn the contents or meaning of any message, report, or
communication while the same is in transit or passing over any wire, line, or cable.” Cal. Penal
Code § 631. Plaintiff asserts that the Wiretap Act and CIPA are intended to protect privacy, and
that claims under the two statutes bear a “close relationship” to the common law tort of invasion of
privacy. Because the common law recognized similar harms to those arising under the Wiretap
16
Case No. 15-CV-04062-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS BASED ON
LACK OF STANDING
1
Act and CIPA, Plaintiff argues, this factor supports finding concrete injury in fact.
The Court agrees. Invasion of privacy has been recognized as a common law tort for over
3
a century. See Restatement (Second) of Torts §§ 652A–I (noting that the right to privacy was first
4
accepted by an American court in 1905, and “a right to privacy is now recognized in the great
5
majority of the American jurisdictions that have considered the question”). One variation of
6
invasion of privacy is intrusion upon seclusion, which makes a defendant liable for intruding,
7
physically or otherwise, upon the solitude or seclusion of another’s private affairs. Id. § 652B.
8
Numerous courts have recognized both invasion of privacy and intrusion upon seclusion. See e.g.,
9
Cox Broadcasting Corp. v. Cohn, 420 U.S. 469, 493–94 (1975) (discussing the “developing law
10
surrounding the tort of invasion of privacy”); Med. Lab. Mgmt. Consultants v. Am. Broad. Cos.,
11
United States District Court
Northern District of California
2
306 F.3d 806, 812 (9th Cir. 2002) (analyzing Arizona’s tort of intrusion upon seclusion, a
12
variation on invasion of privacy); Hernandez v. Hillsides, Inc., 47 Cal. 4th 272, 286–87 (2009)
13
(discussing a privacy violation based on California’s common law tort of intrusion).
14
Of particular relevance to the instant case, the Second Restatement of Torts recognizes that
15
intrusion upon seclusion may occur through a defendant “opening [a plaintiff’s] private and
16
personal mail” or “tapping [a plaintiff’s] telephone wires.” Restatement (Second) of Torts § 652B
17
cmt. b. In line with the Restatement, courts across the country have found that the unauthorized
18
interception of an individual’s private communications may state a claim for common law
19
invasion of privacy. See, e.g., Vernars v. Young, 539 F.2d 966, 969 (3d Cir. 1976) (finding that a
20
plaintiff stated a claim for common law invasion of privacy when “the defendant is accused of
21
opening plaintiff’s private mail and reading it without authority”); Quigley v. Rosenthal, 327 F.3d
22
1044, 1073 (10th Cir. 2003) (noting that, under Colorado law, “it is clear that the interception of
23
the Quigleys’ telephone conversations would constitute an intentional intrusion on the Quigleys’
24
seclusion or solitude”); Billings v. Atkinson, 489 S.W.2d 858, 860 (Tex. 1973) (noting that
25
eavesdropping was an indictable offense at common law, and recognizing an invasion of privacy
26
cause of action based on a wiretap of plaintiff’s telephone); Arrington v. Colortyme, Inc., 972 F.
27
28
17
Case No. 15-CV-04062-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS BASED ON
LACK OF STANDING
1
Supp. 2d 733, 746–47 (W.D. Pa. 2013) (denying motion to dismiss state law invasion of privacy
2
claim based on electronic surveillance of plaintiff’s computer activity); Cruikshank v. United
3
States, 431 F. Supp. 1355, 1360 (D. Haw. 1977) (finding that plaintiff stated a claim for
4
intentional invasion of privacy based on government agents’ opening and photographing of
5
plaintiff’s mail). Similar to the above authority, the Wiretap Act and CIPA each prohibit the
6
unauthorized interception of an individual’s communications. 18 U.S.C. § 2511(1)(a); Cal. Penal
7
Code § 631.
8
9
Moreover, both the Wiretap Act and CIPA were passed to protect against the invasion of
privacy. In particular, the Wiretap Act “was intended to afford privacy protection to electronic
communications.” Konop v. Hawaiian Airlines, Inc., 302 F.3d 868, 874 (9th Cir. 2002); see also
11
United States District Court
Northern District of California
10
DirecTV, Inc. v. Webb, 545 F.3d 837, 850 (9th Cir. 2008) (stating that the Wiretap Act’s
12
“emphasis on privacy is evident in both the legislative history of the Wiretap Act and in the
13
breadth of its prohibitions”). Likewise, CIPA was intended to “accord every citizen’s privacy the
14
utmost sanctity” and “provide those who suffer an infringement of this aspect of their personal
15
liberty a means of vindicating their right.” Ribas v. Clark, 38 Cal. 3d 355, 365 (Cal. 1985).
16
Accordingly, violations of the Wiretap Act and CIPA are similar to common law invasion of
17
privacy in both their substantive prohibitions and their purpose.
18
Google recognizes that invasion of privacy claims are similar to claims under the Wiretap
19
Act and CIPA. However, Google counters that there is not a “close relationship” between the
20
claims because common law invasion of privacy usually requires a plaintiff to prove elements that
21
are not required by the Wiretap Act and CIPA, such as a reasonable expectation of privacy. See
22
Google Supp. Br. at 4–7. For example, Google points to In re Yahoo Mail Litigation, 7 F. Supp.
23
3d 1016, 1038–41 (N.D. Cal. 2014), in which this Court held that the plaintiffs failed to establish
24
an invasion of privacy claim under the California Constitution because the plaintiffs failed to
25
allege that the communications intercepted contained confidential and sensitive content. Google
26
contends that the California Constitution’s requirements are parallel to common law invasion of
27
28
18
Case No. 15-CV-04062-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS BASED ON
LACK OF STANDING
1
privacy claims, and thus Plaintiff, like the plaintiffs in Yahoo Mail, must allege the specifics of the
2
intercepted emails to show injury in fact under the Wiretap Act and CIPA.
3
The Court is not persuaded. Essentially, Google argues that the Wiretap Act and CIPA
4
must have the same elements as common law invasion of privacy in order for violations of the
5
Wiretap Act and CIPA to constitute injury in fact. However, such a requirement is inconsistent
6
with Spokeo’s holding that Congress may “elevat[e] to the status of legally cognizable injuries
7
concrete, de facto injuries that were previously inadequate in law.” Spokeo, 136 S. Ct. at 1549
8
(emphasis added). Thus, that the Wiretap Act and CIPA are not identical in every respect to
9
invasion of privacy does not preclude violations of the Wiretap Act and CIPA from constituting
injury in fact. See id. (noting that a “close relationship to a harm that has traditionally been
11
United States District Court
Northern District of California
10
regarded as providing a basis for a lawsuit” supports finding injury in fact).
12
Case law since Spokeo confirms this result. The U.S. Court of Appeals for the Third
13
Circuit found that the disclosure of information in violation of the Wiretap Act constitutes injury
14
in fact. In re Nickelodeon Consumer Privacy Litig., 827 F.3d 262, 273–74 (3d Cir. 2016). The
15
Third Circuit did not engage in a detailed comparison of the elements of the Wiretap Act and any
16
common law claims. Rather, the Third Circuit found that “Congress has long provided plaintiffs
17
with the right to seek redress for unauthorized disclosures of information that, in Congress’s
18
judgment, ought to remain private.” Id. at 274; cf. Thomas v. FTS USA, LLC, — F. Supp. 3d —,
19
2016 WL 3653878, at *10 (E.D. Va. June 30, 2016) (finding injury in fact based on allegations of
20
certain violations of the Fair Credit Reporting Act, and noting that “[t]he common law has long
21
recognized a right to personal privacy, and ‘both the common law and the literal understandings of
22
privacy encompass the individual’s control of information concerning his or her person.’” (quoting
23
U.S. Dep’t of Justice v. Reporters Comm. for Freedom of Press, 489 U.S. 749, 763 (1989))).
24
Here, Plaintiff asserts that Google intercepted, scanned, and analyzed Plaintiff’s
25
communications in violation of the Wiretap Act and CIPA. As recognized by the Third Circuit
26
and other courts, and as seen in the common law invasion of privacy tort, such unauthorized
27
28
19
Case No. 15-CV-04062-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS BASED ON
LACK OF STANDING
1
2
3
4
5
6
7
8
9
10
United States District Court
Northern District of California
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
interception of communications may give rise to a legally cognizable injury.
c. Congressional Judgment in Establishing a Statutory Right, Including Whether
the Right is Substantive or Procedural
The Court next considers Congress’s judgment in “elevat[ing] to the status of legally
cognizable injuries concrete, de facto injuries that were previously inadequate in law.” Spokeo,
136 S. Ct. at 1549. Congress is “well positioned to identify intangible harms that meet minimum
Article III requirements.” Id. “Essentially, the standing question in such cases is whether the
constitutional or statutory provision on which the claim rests properly can be understood as
granting persons in the plaintiff’s position a right to judicial relief.” Edwards v. First Am. Corp.,
610 F.3d 514, 517 (9th Cir. 2010) (quoting Warth, 422 U.S. at 500).
Since Spokeo, three factors have emerged that favor finding that a statute “grant[s] persons
in the plaintiff’s position a right to judicial relief”: (1) the provision of a private right of action; (2)
the availability of statutory damages; and (3) the substantive nature of the statutory right. For
example, in Church v. Accretive Health, Inc., — F. App’x —, 2016 WL 3611543 (11th Cir. July
6, 2016), the Eleventh Circuit found that the plaintiff sufficiently alleged injury in fact based on
violations of the Fair Debt Collections Practices Act (“FDCPA”). The Eleventh Circuit noted that
the FDCPA “creates a private right of action, which [the plaintiff] seeks to enforce.” Id. at *3.
The Eleventh Circuit further noted that “Congress provided [the plaintiff] with a substantive right
to receive certain disclosures and [the plaintiff] has alleged that [the defendant] violated that
substantive right.” Id. at *3 n.2. Thus, although the plaintiff’s injury—not receiving disclosures
to which the plaintiff was entitled under the FDCPA—“may not have resulted in tangible
economic or physical harm that courts often expect,” the injury was sufficiently “concrete” for
Article III standing. Id. at *3.
Similarly, in Thomas v. FTS USA, LLC, — F. Supp. 3d —, 2016 WL 3653878, (E.D. Va.
June 30, 2016), the Eastern District of Virginia District Court held that the plaintiff’s allegations
of Fair Credit Reporting Act (“FCRA”) violations established Article III standing. First, the court
found that “it was Congress’ judgment . . . to afford consumers rights to information and privacy,”
20
Case No. 15-CV-04062-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS BASED ON
LACK OF STANDING
1
and the FCRA provisions violated “are clearly substantive, and neither technical nor procedural.”
2
Id. at *7–8. Next, the court noted that “Congress permitted consumers to sue to redress a breach
3
of the substantive rights set forth in the foregoing subsections and, if successful, to be awarded
4
actual, statutory, and punitive damages, as applicable.” Id. Because the plaintiff received a
5
disclosure from the defendant that did not meet the substantive requirements of FCRA, and had
6
the right to sue based on that FCRA violation, the plaintiff alleged a concrete injury. Id. at *10;
7
Prindle v. Carrington Mortg. Servs., LLC, 2016 WL 4369424, *8 (M.D. Fla. Aug. 16, 2016)
8
(holding that plaintiff sufficiently alleged standing when Congress provided a statutory,
9
substantive right and a private right of action, “without regard to whether a consumer experienced
10
a more tangible ‘harm’—such as economic loss—resulting from the conduct”).
United States District Court
Northern District of California
11
Likewise, in Cour v. Life360, Inc., 2016 WL 4039279, at *2 (N.D. Cal. July 28, 2016),
12
Judge Thelton E. Henderson of this district held that the plaintiff sufficiently alleged standing
13
based on violations of the Telephone Consumer Protection Act (“TCPA”). The plaintiff alleged
14
that the plaintiff received one or more text messages from the defendant in violation of the TCPA.
15
Id. at *1. Judge Henderson noted that the plaintiff “has not simply alleged a procedural violation;
16
instead, he relies on an allegation that he was harmed because [the defendant] invaded his
17
privacy.” Id. at *2. Accordingly, Judge Henderson found that the plaintiff alleged concrete injury
18
based on the TCPA violations. Id.
19
Similar to Judge Henderson, many courts since Spokeo have placed dispositive weight on
20
whether a plaintiff alleges the violation of a substantive, rather than procedural, statutory right. If
21
the right created by statute is substantive, courts have generally found that Congress permissibly
22
“elevated [the harm recognized by the statute] to the status of legally cognizable injuries,” and
23
thus that a plaintiff alleging violation of a substantive statutory right has Article III standing. See
24
e.g., Guarisma v. Microsoft Corp., — F. Supp. 3d —, 2016 WL 4017196, at *3 (S.D. Fla. July 26,
25
2016) (“The Supreme Court recognized where Congress has endowed plaintiffs with a substantive
26
legal right, as opposed to creating a procedural requirement, the plaintiffs may sue to enforce such
27
28
21
Case No. 15-CV-04062-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS BASED ON
LACK OF STANDING
1
a right without establishing additional harm.”); Larson v. Trans Union, LLC, — F. Supp. 3d —,
2
2016 WL 4367253, at *3 (N.D. Cal. Aug. 11, 2016) (finding plaintiff adequately alleged standing
3
when plaintiff alleged an “informational” injury rather than a “bare procedural violation”); Booth
4
v. Appstack, Inc., 2016 WL 3030256, at *5 (W.D. Wash. May 25, 2016) (injury in fact satisfied
5
when the alleged injury was substantive, not procedural); see also Jamison v. Bank of Am., N.A.,
6
— F. Supp. 3d —, 2016 WL 3653456, at *4 (E.D. Cal. July 7, 2016) (plaintiff did not have
7
standing when plaintiff made only conclusory allegations of harm, and alleged a procedural
8
statutory violation).
9
In the instant case, each of the three factors weighs in favor of finding concrete injury
based on Google’s alleged violations of the Wiretap Act and CIPA. First, there is no dispute that
11
United States District Court
Northern District of California
10
both the Wiretap Act and CIPA create a private right of action for individuals in Plaintiff’s
12
position. The Wiretap Act provides that “any person” whose electronic communication is
13
“intercepted, disclosed, or intentionally used” in violation of the Act may bring suit against the
14
entity which engaged in that violation. 18 U.S.C. § 2520(a). CIPA likewise provides a private
15
cause of action. Specifically, CIPA provides that “[a]ny person who has been injured by a
16
violation of this chapter may bring an action against the person who committed the violation.”
17
Cal. Penal Code § 637.2(a).
18
Second, neither the Wiretap Act nor CIPA require a showing of actual harm. Under the
19
Wiretap Act, plaintiff may recover either actual damages, statutory damages, or injunctive relief.
20
18 U.S.C. § 2520(b), (c)(2). Likewise, CIPA provides that a plaintiff may recover statutory
21
damages or “[t]hree times the amount of actual damages, if any, sustained by the plaintiff.” Cal.
22
Penal Code § 637.2 (emphasis added). As the California Court of Appeal has stated, “Section
23
637.2 is fairly read as establishing that no violation of [CIPA] is to go unpunished. Any invasion
24
of privacy involves an affront to human dignity . . . . The right to recover this statutory minimum
25
accrue[s] at the moment the Privacy Act [CIPA] was violated.” Friddle v. Epstein, 16 Cal. App.
26
4th 1649, 1660–61 (1993).
27
28
22
Case No. 15-CV-04062-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS BASED ON
LACK OF STANDING
1
Third, both the Wiretap Act and CIPA create substantive rights to privacy in one’s
2
communications. See 18 U.S.C. § 2511(1)(a); Cal. Penal Code § 631. By contrast, in Spokeo the
3
defendant allegedly violated the FCRA, which requires credit reporting agencies to “follow
4
reasonable procedures to assure maximum possible accuracy of” consumer reports. 136 S. Ct. at
5
1545 (quoting 15 U.S.C. § 1681e(b)). The U.S. Supreme Court expressed no opinion as to
6
whether this procedural FCRA violation constituted a “concrete injury,” but did note that “[i]t is
7
difficult to imagine how the dissemination of an incorrect zip code [under the FCRA], without
8
more, could work any concrete harm.” Id. at 1550. Thus, the U.S. Supreme Court held that a
9
“bare procedural violation, divorced from any concrete harm” does not establish concrete injury.
Id. at 1549. Here, Plaintiff alleges not a “bare procedural violation.” Instead, Plaintiff alleges that
11
United States District Court
Northern District of California
10
Google unlawfully intercepted, scanned, and analyzed Plaintiff’s communications in violation of
12
the Wiretap Act and CIPA.
13
In sum, three aspects of the Wiretap Act and CIPA—the existence of a private right of
14
action, the availability of statutory damages, and the creation of a substantive private right—
15
support finding that both Congress and the California Legislature intended to “grant[] persons in
16
[Plaintiff’s] position a right to judicial relief” without additional allegations of injury. Edwards,
17
610 F.3d at 517; see also Bona Fide Conglomerate, Inc. v. SourceAmerica, 2016 WL 3543699, at
18
*7–8 (S.D. Cal. June 29, 2016) (violations of CIPA are sufficiently concrete to constitute injury in
19
fact). Thus, the judgment of Congress and the California Legislature in creating enforceable,
20
substantive legal rights through the Wiretap Act and CIPA supports finding that Plaintiff has
21
alleged concrete injury based on the violation of those rights.
22
The Court notes that, before Spokeo, courts in this district consistently reached the same
23
conclusion. See Gmail, 2013 WL 5423918, at *17 (“[T]he allegation of a violation of CIPA, like
24
an allegation of the violation of the Wiretap Act, is sufficient to confer standing without any
25
independent allegation of injury.”); In re iPhone Application Litig., 844 F. Supp. 2d 1040, 1055
26
(N.D. Cal. 2012) (“[A] violation of the Wiretap Act . . . may serve as a concrete injury for the
27
28
23
Case No. 15-CV-04062-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS BASED ON
LACK OF STANDING
1
purposes of Article III injury analysis.”); In re Google Inc. Privacy Litig., 2013 WL 6248499, at
2
*9 (N.D. Cal. Dec. 3, 2013) (“Courts have recognized that . . . alleged violations of the Wiretap
3
Act or the Stored Communications Act are sufficient to establish Article III injury. These statutes
4
grant persons in Plaintiffs’ position a right to relief and thus Plaintiffs have standing for these
5
claims.” (footnote omitted)); In re Facebook Privacy Litig., 791 F. Supp. 2d 705, 712 (N.D. Cal.
6
2011) (finding that where the plaintiffs alleged that their communications had been intercepted in
7
violation of the Wiretap Act, plaintiffs “alleged facts sufficient to establish that they have suffered
8
the injury required for standing under Article III”).
9
Google raises one additional counterargument as to CIPA. Google argues that state
statutes like CIPA can not confer Article III standing. Google Supp. Br. at 4 n.4; Google Supp.
11
United States District Court
Northern District of California
10
Reply at 3 n.2. However, Spokeo said nothing about the ability of state legislatures to create rights
12
sufficient to confer Article III standing. In the absence of governing U.S. Supreme Court
13
precedent, the Ninth Circuit has held that “state law can create interests that support standing in
14
federal courts” and “[s]tate statutes constitute state law that can create such interests.” Cantrell v.
15
City of Long Beach, 241 F.3d 674, 684 (9th Cir. 2001). As the Ninth Circuit has explained, state
16
law must be able to support Article III standing, or else “there would not be Article III standing in
17
most diversity cases, including run-of-the-mill contract and property disputes.” Id. Thus, under
18
Ninth Circuit law, violations of CIPA may confer standing even though CIPA is a state statute.
19
The two Ninth Circuit cases cited by Google do not compel a contrary finding. The
20
plaintiffs in those two cases lacked standing because they sued as private attorneys general and
21
were not claiming that they themselves had suffered a concrete injury. See Lee v. Am. Nat’l Ins.
22
Co., 260 F.3d 997, 1001–02 (9th Cir. 2001) (finding no Article III standing when the plaintiff
23
“suffered no individualized injury as a result of the defendant’s challenged conduct”); Fiedler v.
24
Clark, 714 F.2d 77, 79–80 (9th Cir. 1983) (rejecting Article III standing when the plaintiff claimed
25
to be “suing as a private Attorney General on behalf of citizens of Hawaii rather than as a private
26
citizen”). By contrast, Plaintiff seeks to recover for the alleged interception of Plaintiff’s own
27
28
24
Case No. 15-CV-04062-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS BASED ON
LACK OF STANDING
1
email in violation of Plaintiff’s substantive rights under CIPA.2 Accordingly, the Court finds that
2
Plaintiff may allege standing based on violations of CIPA. See Bona Fide Conglomerate, 2016
3
WL 3543699, at *7–8 (finding, after Spokeo, that plaintiff sufficiently alleged injury in fact based
4
on alleged violations of CIPA).
5
In sum, the Court concludes that the judgment of Congress and the California Legislature
6
indicate that the alleged violations of Plaintiff’s statutory rights under the Wiretap Act and CIPA
7
constitute concrete injury in fact. This conclusion is supported by the historical practice of courts
8
recognizing that the unauthorized interception of communication constitutes cognizable injury.
9
The Court DENIES Google’s motion to dismiss based on lack of standing under Spokeo.
10
B. Injunctive Relief
Having determined that Plaintiff sufficiently alleges concrete injury in fact, the Court turns
United States District Court
Northern District of California
11
12
to Google’s challenge to Plaintiff’s standing to seek injunctive relief. Plaintiff seeks two types of
13
injunctive relief under both the Wiretap Act and CIPA. First, Plaintiff seeks an order enjoining
14
Google from intercepting the content of Plaintiff’s and the Class members’ emails in the future in
15
violation of the Wiretap Act or CIPA. Compl. ¶¶ 54(b), 68(b). Second, Plaintiff asks the Court to
16
require Google to destroy all data created or otherwise obtained from illegally intercepted email.
17
Id. ¶¶ 54(c), 68(c). The Court addresses these two types of injunctive relief in turn.
As a preliminary matter, in the motion to dismiss Google challenges only Plaintiff’s
18
19
standing to seek injunctive relief under the Wiretap Act, not under CIPA. However, this Court
20
must “sua sponte . . . examine jurisdictional issues such as standing.” Ervine v. Desert View Reg’l
21
Med. Ctr. Holdings, LLC, 753 F.3d 862, 866 (9th Cir. 2014). Thus, the Court analyzes Plaintiff’s
22
standing to seek injunctive relief under both the Wiretap Act and CIPA.
23
24
25
26
27
28
2
Google also cites a district court from outside this circuit that held that violations of state statutes
do not confer Article III standing in the absence of a separate concrete injury. Khan v. Children’s
Nat’l Health Sys., — F. Supp. 3d —, 2016 WL 2946165, at *7 (D. Md. May 19, 2016). However,
unlike Khan, Plaintiff here has alleged concrete injury. Moreover, Khan is not binding on this
Court, which must follow the Ninth Circuit’s rule that state statutes “can create interests that
support standing in federal courts.” Cantrell, 241 F.3d at 684.
25
Case No. 15-CV-04062-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS BASED ON
LACK OF STANDING
1
1.
Legal Standard
2
A plaintiff “must show standing with respect to each form of relief sought.” Ellis v.
3
Costco Wholesale Corp., 657 F.3d 970, 978 (9th Cir. 2011). To establish standing for prospective
4
injunctive relief, a plaintiff may not rely solely on “[p]ast exposure to illegal conduct.” O’Shea v.
5
Littleton, 414 U.S. 488, 495–96 (1974). Instead, a plaintiff must demonstrate “continuing, present
6
adverse effects” from the defendant’s illegal conduct, id., or that the plaintiff has suffered or is
7
threatened with a concrete and particularized legal harm “coupled with ‘a sufficient likelihood that
8
he will again be wronged in a similar way,’” Bates, 511 F.3d at 985 (quoting City of L.A. v. Lyons,
9
461 U.S. 95, 111 (1983)); see also Chapman v. Pier 1 Imports (U.S.) Inc., 631 F.3d 939, 946 (9th
Cir. 2011) (en banc) (“[T]o establish standing to pursue injunctive relief . . . [a plaintiff] must
11
United States District Court
Northern District of California
10
demonstrate a real and immediate threat of repeated injury in the future.” (internal quotation marks
12
omitted)). Finally, in a class action, a named plaintiff must show that he himself is subject to a
13
likelihood of future injury. Allegations that a defendant’s conduct will subject unnamed class
14
members to the alleged harm is insufficient to establish standing to seek injunctive relief on behalf
15
of the class. Hodgers-Durgin v. de la Vina, 199 F.3d 1037, 1044–45 (9th Cir. 1999).
16
2. Injunction Seeking to End Future Processing of Gmail
17
First, Plaintiff requests an injunction “enjoining Google from continuing its practice of
18
intercepting the content of Plaintiff’s and Class members’ emails in violation” of the Wiretap Act
19
and CIPA. Compl. VII.D; see also ¶¶ 54(b), 68(b). To analyze whether Plaintiff has standing to
20
seek this injunction, the Court must distinguish among the three types of Gmail services discussed
21
in the complaint. As discussed in the factual background, “Gmail” encompasses a number of
22
email delivery systems. Google offers “Google Apps for Education” for educational organizations
23
and “Google Apps for Work” for businesses. Id. ¶ 1 n.1; Gmail Class Cert., 2014 WL 1102660, at
24
*1. In addition, Google provides a free Gmail service for individual users, which allows any user
25
to register for an “@gmail.com” email address. Compl. ¶ 1 n.1; Gmail Class Cert., 2014 WL
26
1102660, at *1. As discussed below, Google treats Google Apps for Education differently from
27
28
26
Case No. 15-CV-04062-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS BASED ON
LACK OF STANDING
1
Gmail for individual users and Google Apps for Work for purposes of intercepting, scanning, and
2
analyzing email content. Because of this difference in Google’s practices, the Court first
3
addresses Plaintiff’s requested injunction as it relates to Google Apps for Education, then to Gmail
4
for individual users, and finally Google Apps for Work.
5
a. Email Plaintiff May Exchange with Users of Google Apps for Education
Plaintiff seeks to enjoin Google from intercepting, scanning, and analyzing, for purposes of
6
creating targeted advertising and user profiles, emails that Plaintiff sends to or receives from
8
Google Apps for Education users. However, Plaintiff admits that “in April 2014, Google ceased
9
intercepting, scanning, and cataloging the contents of emails it provides to its educational clients
10
via its Google Apps for Education product.” Opp. at 11. Moreover, Google has confirmed that
11
United States District Court
Northern District of California
7
Google ceased intercepting and scanning, for advertising purposes, the contents of emails
12
processed via Google Apps for Education. See Corley v. Google, Inc., 16-CV-00473-LHK, ECF
13
No. 73 at 17 (N.D. Cal.) (statement of Google) (noting that April 30, 2014 is “the last date of any
14
scanning for these edu plaintiffs. So in other words, the practice at issue stopped.”).3
In light of the above circumstances, it appears that there is no “real and immediate threat of
15
16
repeated injury in the future” and thus that Plaintiff lacks standing to enjoin Google from
17
intercepting, scanning, and analyzing emails that Plaintiff may exchange with Google Apps for
18
Education users. Accordingly, the Court GRANTS with prejudice Google’s motion to dismiss
19
Plaintiff’s claim for an injunction as it relates to Google Apps for Education.
b. Email Plaintiff May Exchange with Users of Gmail for Individual Users
20
21
Next, Plaintiff seeks to enjoin Google from intercepting, scanning, and analyzing, for
22
purposes of creating targeted advertising and user profiles, emails that Plaintiff may exchange with
23
24
25
26
27
28
3
The Court takes judicial notice of the transcript of the April 20, 2016 case management
conference in Corley. In that case, also related to Gmail, the plaintiffs are users of Google Apps
for Education who allege that Google unlawfully intercepted and scanned their email for
advertising purposes and without consent. No. 16-CV-00473, ECF No. 19. Lawyers representing
Plaintiff and Google in the instant case also represent the respective parties in Corley. Moreover,
the Court may take judicial notice of public court records. See Lee, 250 F.3d at 688.
27
Case No. 15-CV-04062-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS BASED ON
LACK OF STANDING
1
users of Gmail for individual users. Google argues that Plaintiff can not seek this injunctive relief
2
because users of Gmail for individual users consent to the alleged interception, scanning, and
3
analysis of email.
4
To establish a consent defense under CIPA, both parties—the sender and the recipient of
5
the communication—must consent to the alleged interception. Cal. Penal Code § 631(a)
6
(prohibiting interceptions done “without the consent of all parties to the communication, or in any
7
unauthorized manner”); see also Gmail, 2013 WL 5423918, at *19. By contrast, under the
8
Wiretap Act, the consent of one party to the interception of the communication is a complete
9
defense to liability. 18 U.S.C. § 2511(2)(d) (“It shall not be unlawful . . . to intercept a wire, oral,
or electronic communication . . . where one of the parties to the communication has given prior
11
United States District Court
Northern District of California
10
consent to such interception.”); see also Murray v. Fin. Visions, Inc., 2008 WL 4850328, at *4 (D.
12
Ariz. Nov. 7, 2008). If Google establishes a consent defense as to one party under the Wiretap Act
13
or both parties under CIPA, Plaintiff lacks standing to enjoin Google’s future interception,
14
scanning, and analysis of email because Plaintiff would not be under “real and immediate threat of
15
repeated injury in the future.” See Chapman, 631 F.3d at 946 (internal quotation marks omitted).
16
As to consent under CIPA, Google does not contend that non-Gmail users like Plaintiff
17
consent to the alleged interception, scanning, and analysis of email for purposes of creating
18
targeted advertising and user profiles. In the complaint, Plaintiff alleges that “Google has not
19
obtained any consent from non-Gmail users” and that Plaintiff “has never consented to having his
20
emails intercepted and scanned by Google for the purpose of acquiring and cataloging their
21
message content.” Compl. ¶¶ 3, 8. Accordingly, Google does not establish a consent defense
22
under CIPA, which requires consent from both parties to a communication. See Cal. Penal Code
23
§ 631(a).
24
As to consent under the Wiretap Act, Google contends that users of Gmail consent to the
25
alleged interception, scanning, and analysis of their email for purposes of creating targeted
26
advertising and user profiles. Such one-party consent would be a complete defense to liability
27
28
28
Case No. 15-CV-04062-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS BASED ON
LACK OF STANDING
under the Wiretap Act. See 18 U.S.C. § 2511(2)(d). To demonstrate consent, Google relies on the
2
2014 TOS and Privacy Policies. As discussed above, Google altered its Terms of Service on April
3
14, 2014 and Privacy Policy on December 19, 2014, after this Court held that the earlier versions
4
of these agreements did not establish consent to the interceptions alleged in Gmail. According to
5
Google, the updated 2014 TOS and Privacy Policies sufficiently disclose Google’s interception,
6
scanning, and analysis practices to establish consent. Plaintiff counters that (i) there is no
7
evidence that users of Gmail for individual users are notified of or otherwise agree to Google’s
8
modified Terms of Service or Privacy Policies; (ii) Google’s disclosures are inadequate to
9
demonstrate consent as a matter of law; and (iii) even if Google’s 2014 TOS and Privacy Policies
10
establish consent, Plaintiff is still at risk of future injury because Google may alter its policies at
11
United States District Court
Northern District of California
1
any time. The Court addresses Plaintiff’s arguments respectively.
12
(i)
Enforceability of the 2014 TOS
13
In Gmail, this Court described the earlier versions of the Terms of Service and Privacy
14
Policies as “legal agreements.” Gmail, 2013 WL 5423918, at *2. The Court found that users of
15
the individual Gmail service “were required to agree” to the Terms of Service in order to use
16
Gmail. Id. at *2, *13–14; see also Corley v. Google, Inc., — F.R.D. —, 2016 WL 4411820, at *1
17
(N.D. Cal. Aug. 19, 2016). Additionally, the Terms of Service analyzed in Gmail provided that
18
amendments to the Terms of Service are implemented by posting to the website. Specifically, the
19
Terms of Service analyzed in Gmail stated, “You should look at the terms regularly. We’ll post
20
notice of modifications to these terms on this page. . . . If you do not agree to the modified terms
21
for a Service, you should discontinue your use of that Service.” See No. 13-MD-02439, ECF No.
22
46-6 (Terms of Service Effective March 1, 2012).
23
Applying these principles to the instant case, users of the individual Gmail service agreed
24
to the 2014 TOS upon its posting. See MySpace, Inc. v. The Globe.com, Inc., 2007 WL 1686966,
25
at *10 (C.D. Cal. Feb. 27, 2007) (holding that the plaintiff and the defendant were bound by future
26
versions of the defendant’s terms of service when the terms of service provided that modifications
27
28
29
Case No. 15-CV-04062-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS BASED ON
LACK OF STANDING
1
were effective upon posting); see also Rudgayzer v. Google, Inc., 986 F. Supp. 2d 151, 154 n.1
2
(E.D.N.Y. 2013) (noting that plaintiffs consented to Google’s terms of service because the earlier
3
terms of service provide that a user would be bound by future changes in its terms).
4
(ii)
Consent Established by the 2014 TOS
5
Because users of the individual Gmail service agree to the 2014 TOS, the Court next
addresses whether the 2014 TOS sufficiently establishes user consent by notifying Gmail users of
7
Google’s alleged conduct. In the instant case, Plaintiff alleges that Google intercepts, scans, and
8
analyzes emails that Plaintiff sends to or receives from Gmail users, so that Google may create
9
targeted advertising and user profiles for Gmail and non-Gmail users. Compl. ¶¶ 1, 8, 21. Thus,
10
the Court evaluates whether the 2014 TOS adequately notifies the reasonable user of Gmail that:
11
United States District Court
Northern District of California
6
(1) Google intercepts, scans, and analyzes, (2) a Gmail user’s incoming and outgoing email
12
communications with non-Gmail users, (3) to create targeted advertising and user profiles, (4) for
13
Gmail and non-Gmail users.
14
Under the Wiretap Act, “the question of express consent is usually a question of fact,
15
where a fact-finder needs to interpret the express terms of any agreements to determine whether
16
these agreements adequately notify individuals regarding the interceptions.” Gmail Class Cert.,
17
2014 WL 1102660, at *15 (citing Murray, 2008 WL 4850328, at *4). In addition, consent is “not
18
an all-or-nothing proposition.” Gmail, 2013 WL 5423918, at *12; see also Watkins v. L.M. Berry
19
& Co., 704 F.2d 577, 582 (11th Cir. 1983) (“[C]onsent within the meaning of section 2511(2)(d)
20
. . . can be limited. It is the task of the trier of fact to determine the scope of the consent and to
21
decide whether and to what extent the interception exceeded that consent.”). In other words, “[a]
22
party may consent to the interception of only part of a communication or to the interception of
23
only a subset of its communications.” Yahoo Mail, 7 F. Supp. 3d at 1028 (quoting In re
24
Pharmatrak, Inc., 329 F.3d 9, 19 (1st Cir. 2003)). Furthermore, as “the party seeking the benefit
25
of the exception,” it is Google’s burden to prove consent. Id. This Court applies a reasonable user
26
standard to determine consent under the Wiretap Act. See Perkins v. LinkedIn Corp., 2014 WL
27
28
30
Case No. 15-CV-04062-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS BASED ON
LACK OF STANDING
1
2751053, at *14 (N.D. Cal. June 12, 2014); Gmail, 2013 WL 5423918, at *14.
2
With these principles in mind, the Court first addresses whether Google sufficiently
3
discloses the interception, scanning, and analysis of email for purposes of creating targeted
4
advertising for non-Gmail users. The 2014 TOS provides:
5
Our automated systems analyze your content (including emails) to provide you
personally relevant product features, such as customized search results, tailored
advertising, and spam and malware detection. This analysis occurs as the content is
sent, received, and when it is stored.
6
7
8
9
10
United States District Court
Northern District of California
11
12
13
14
15
16
2014 TOS at “Your Content in our Services.” Notably, the 2014 TOS makes no mention of nonGmail users. By indicating that Google provides “you” (the Gmail user reading the 2014 TOS)
with targeted advertising, the 2014 TOS could mislead Gmail users into believing that emails are
intercepted to create targeted advertising only for the Gmail user, not for non-Gmail users.4
Specifically, the 2014 TOS states that Google analyzes “your content (including emails) to
provide you personally relevant product features, such as . . . tailored advertising.” Id. (emphases
added); see also Watkins, 704 F.2d at 582 (“[C]onsent within the meaning of section 2511(2)(d) is
not necessarily an all or nothing proposition; it can be limited.”); Backhaut v. Apple, Inc., 74 F.
Supp. 3d 1033, 1045–46 (N.D. Cal. 2014) (holding that consent to the interception of
communications for one purpose does not provide consent for other, undisclosed purposes).
17
18
19
20
Moreover, Google claims that the disclosure of Google’s targeted advertising practices
necessarily discloses Google’s creation of user profiles because Plaintiff alleges that user profiles
are used to create targeted advertising. Mot. at 7. The Court need not determine the merits of
Google’s argument.5 As discussed above, Google has not shown that Gmail users consent to the
21
22
23
24
25
26
27
28
4
Google argues that there are “no meaningful distinctions” between Google’s 2014 TOS and the
disclosures in Yahoo Mail, which this Court held established consent for Defendant Yahoo’s email
scanning practices. Reply at 5. However, Yahoo’s terms of service expressly mentioned nonYahoo users: “If you [Yahoo user] consent to this ATOS and communicate with non-Yahoo users
using the Services [Yahoo Mail], you are responsible for notifying those users about this feature.”
Yahoo Mail, 7 F. Supp. 3d at 1029.
5
The Court notes that whether “tailored advertising” in the 2014 TOS and December 19, 2014
Privacy Policy refers to advertising based solely on the content of a single email or advertising
based on data aggregated about a Gmail user or non-Gmail user over time may be relevant to this
inquiry.
31
Case No. 15-CV-04062-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS BASED ON
LACK OF STANDING
1
interception, scanning, and analysis of email for purposes of creating targeted advertising for non-
2
Gmail users. See In re Pharmatrak, Inc., 329 F.3d at 19 (noting that the burden is on the party
3
claiming consent). Consequently, the 2014 TOS can not, and does not, establish Gmail users’
4
consent to the interception, scanning, and analysis of email for purposes of creating targeted
5
advertising and user profiles for both Gmail and non-Gmail users.
Similarly, Google’s December 19, 2014 Privacy Policy, incorporated by reference into the
6
7
2014 TOS, suffers from the same defect. The December 19, 2014 Privacy Policy makes no
8
mention of non-Gmail users, and fails to disclose the fact that Google intercepts, scans, and
9
analyzes email to create targeted advertising and user profiles for non-Gmail users. Therefore, the
December 19, 2014 Privacy Policy can not, and does not establish consent to Google’s alleged
11
United States District Court
Northern District of California
10
interception, scanning, and analysis practices.
Because Google has not established a consent defense, Plaintiff has alleged “real and
12
13
immediate threat of repeated injury” from Google’s alleged interception, scanning, and analysis
14
practices.6 See Chapman, 631 F.3d at 946. Accordingly, the Court DENIES Google’s motion to
15
dismiss Plaintiff’s request for an injunction as to Gmail for individual users.
c. Email Plaintiff May Exchange with Users of Google Apps for Work
16
Lastly, the Court addresses Plaintiff’s requested injunctive relief as it applies to Google
17
18
Apps for Work. No party specifically addresses Google Apps for Work in the briefing on the
19
instant motion. See generally Mot., Opp., Reply. Accordingly, Google fails to show that Google
20
Apps for Work users consent to the alleged interception, scanning, and analysis of email, and thus
21
Google’s motion to dismiss is DENIED.
The denial, however, is without prejudice because the Court has learned that Google
22
23
publicly represents that Google no longer intercepts, scans, and analyzes for advertising purposes
24
emails transmitted via Google Apps for Work. See FAQs for Google Apps users, Google Apps for
25
26
27
28
6
Because Google fails to establish a consent defense, the Court need not reach Plaintiff’s final
argument that Plaintiff is still at risk of future injury because Google may alter its policies at any
time.
32
Case No. 15-CV-04062-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS BASED ON
LACK OF STANDING
1
Work, https://apps.google.com/faq/security/ (last visited September 22, 2016) (“Unlike Google’s
2
consumer offerings, which may show ads, we do not collect, scan or use your Google Apps data
3
for advertising purposes . . . .”); Privacy, Google for Work Help,
4
https://support.google.com/work/answer/6056650?hl=en (last visited September 22, 2016)
5
(“Google does not collect or use data in Google Apps services for advertising purposes.”).
6
Because this is a factual issue not developed on the record before the Court, the Court will discuss
7
this issue with the parties at the September 28, 2016 case management conference.
8
3. Injunction Seeking Destruction of Data
9
As to Plaintiff’s second requested injunction, Plaintiff asks the Court to require Google to
“destroy all data created or otherwise obtained” from Google’s unlawful interception of email.
11
United States District Court
Northern District of California
10
Compl. ¶¶ 54(c), 68(c).7 Under the Wiretap Act, Plaintiff limits the requested injunctive relief to
12
data created or obtained before December 19, 2014. Id. ¶ 68(c). Under CIPA, there is no time
13
limitation on the requested injunctive relief. Id. ¶ 54(c). Plaintiff alleges that Google’s retention
14
and use of unlawfully acquired data is an ongoing injury. Opp. at 5–6.
Google again challenges the requested injunction solely on the basis of standing. The
15
16
merits and scope of the injunction are not before the Court. Specifically, Google contends that the
17
consent given by Gmail users under Google’s 2014 TOS applies retroactively to all emails that
18
remain in a Gmail user’s account, even to emails sent before the 2014 TOS was posted in April
19
2014. Mot. at 7–8.
The Court is unpersuaded. First, the 2014 TOS itself provides that “[c]hanges [to the
20
21
Terms of Service] will not apply retroactively.” Thus, any consent given under the 2014 TOS
22
would not apply retroactively to the interception, scanning, and analysis of email before the 2014
23
24
25
26
27
28
7
Specifically, under CIPA, Plaintiff requests “Injunctive relief in the form of, inter alia, an order
requiring Google to destroy all data created or otherwise obtained from its illegal interception of
emails sent or received by Plaintiff or any Class member.” Compl. ¶ 54(c). Under the Wiretap
Act, Plaintiff requests “Injunctive relief in the form of, inter alia, an order requiring Google to
destroy all data created or otherwise obtained from the interceptions of emails sent or received by
Plaintiff and Class members, or any of them, before December 19, 2014.” Id. ¶ 68(c).
33
Case No. 15-CV-04062-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS BASED ON
LACK OF STANDING
1
TOS was in place. Moreover, as discussed above, neither Google’s 2014 TOS or December 19,
2
2014 Privacy Policy establish consent to Google’s alleged interception, scanning, and analysis
3
practices as to non-Gmail users. Accordingly, the Court DENIES Google’s motion to dismiss
4
Plaintiff’s second requested injunction.
5
V.
6
CONCLUSION
For the foregoing reasons, the Court GRANTS IN PART and DENIES IN PART Google’s
7
motion to dismiss based on lack of standing.
8
IT IS SO ORDERED.
9
10
United States District Court
Northern District of California
11
12
Dated: September 23, 2016
______________________________________
LUCY H. KOH
United States District Judge
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
34
Case No. 15-CV-04062-LHK
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS BASED ON
LACK OF STANDING
Disclaimer: Justia Dockets & Filings provides public litigation records from the federal appellate and district courts. These filings and docket sheets should not be considered findings of fact or liability, nor do they necessarily reflect the view of Justia.
Why Is My Information Online?