Case et al v. Google, Inc.

Filing 1

Class Action COMPLAINT against Google, Inc. ( Filing fee $ 350, Receipt Number 28420) Summons Issued, filed by John H. Case, Lauren Maytin. (Attachments: # 1 Civil Cover Sheet, # 2 Receipt)(jak, )

IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLORADO Civil Action No. 10-cvJOHN H. CASE and LAUREN MAYTIN, on behalf of themselves and all similarly situated persons Plaintiffs v. GOOGLE, INC., a Delaware corporation Defendant ________________________________________________________________________________ CLASS ACTION COMPLAINT ________________________________________________________________________________ Plaintiffs, John H. Case and Lauren Maytin by and through counsel, THOMAS | GENSHAFT
P.C.,

for their Class Action Complaint, avers and alleges as follows: I. THE PARTIES 1. Plaintiffs, John H. Case and Lauren Maytin, are adult individuals residing in the

State of Colorado. 2. Defendant Google, Inc. is a Delaware corporation with its principal place of

business located at 1600 Amphitheatre Parkway, Mountain View, California. II. JURISDICTION AND VENUE 3. This Court has original jurisdiction over this matter under 18 U.S.C. § 1332(d),

the Class Action Fairness Act ("CAFA"). The CAFA explicitly provides for the original jurisdiction of the federal court in any class action in which any member of the class is a citizen of a state different from any defendant, and where the matter in controversy exceeds the sum of 1

$5 million exclusive of interests and costs. The claims of individual class members in this action exceeds $5 million in the aggregate, exclusive of interest and costs, and that the total number of members of the proposed class is greater than 100, as required by 28 U.S.C. § 1332(d)(2), (5). 4. This Court has subject matter jurisdiction over all causes of action pursuant to

28 U.S.C. §1331 and 1332(d), and because this action arises in part under a federal statute. 5. Venue is proper in this Court pursuant to 28 U.S.C. §1391(b)-(c) in that

Defendant conducts business in this District; the actions of Defendant as set forth in this Complaint affected Plaintiffs and a substantial number of class members within this District; and Plaintiffs reside within this District. III. GENERAL ALLEGATIONS Google's Gmail Service 6. Google Mail, also known as Gmail, is a free internet-based email service offered

by Google. It is the third largest web email service in the United States with approximately 37 million users. 7. When an individual signs up for Gmail, they are required to create a user account.

Google then recommends that users create a User Profile in which they should "include details such as the name of your hometown, your job title, where you work or go to school." 8. Like most email services, Gmail allows users to maintain an electronic address

book in which users import, store and view contact information for third parties. Gmail contact lists routinely include highly personal and private information, including names, phone numbers and email addresses of individuals and businesses with whom the user regularly communicates.

2

The Embedding of Google Buzz into Gmail 9. On February 9, 2010, Google launched a new service known as Google Buzz.

Google Buzz is a social networking platform embedded directly into Gmail and linked to a user's email account. 10. Google sought to position Google Buzz as a direct competitor of Facebook,

Twitter, and Flickr. In order to compete with these well established social networking media, Google implemented a proprietary algorithm designed to automatically create pre-determined networks of people with whom users communicate. 11. Users who signed into their Gmail account were given the option to either click

"Sweet! Check out Buzz" or "Nah, go to my inbox." Google deceptively portrayed that a user could choose to bypass the initial setup of Buzz and thereby "opt out" of the service. Yet in reality, no matter which button the user selected, Google Buzz was automatically activated and embedded into the user's Gmail sidebar. 12. Once Google Buzz was activated, the tool automatically created a "following" list

consisting of the user's most frequent email contacts in Gmail and in Google Chat, the company's instant messaging program. Individuals that users emailed the most via Gmail or

chatted with the most on Google Chat automatically became people the user "followed" in the Buzz social network. 13. Google Buzz automatically "follows" everyone in a user's Gmail contact list, and

by default made that list publicly available to everyone who visits your profile, meaning that anyone could see the private contacts with whom a Gmail user had been communicating. 14. Google Buzz did not warn users that their email contacts would be used to

3

populate their "following" lists. 15. By default, "following" lists were made public to anyone who looked at a user's

profile. Users could hide their "following" and "followed by" lists only by clicking through several links to edit their public profile and then unchecking the box labeled "Display the list of people I'm following and people following me." 16. Users were not warned that their lists would be automatically visible to the public.

Instead, each user was told only that "Your profile will include your name, photo, people you follow, and people who follow you." A separate section of the notice stated that the profile was "visible on the web so friends can find and recognize you." 17. As a result, users in many instances were unwittingly linked to other users without

realizing it. Until a user knew to change the automatic settings imposed upon them by Google Buzz, anyone could access that user's profile and view the list of people a user frequently emails. 18. The activation of Buzz disclosed not only portions of users' contact lists, but more

specifically disclosed the contacts with whom users communicate most often, and making those lists publicly searchable on the internet. 19. Various media outlets report that Google Buzz goes even further by frequently

importing contacts unknown to users and publicizing them on the user's "following list" granting strangers access to private information about the user's other contacts and communications with those contacts. The result is a pre-made social network forced upon users who often didn't know where the names came from or who some of the people "following" them even were. 20. Google Buzz automatically combs affiliate websites owned by Google, such as

Picassa and YouTube, automatically importing photographs and videos into a user's profile

4

where they are publicly shared with and distributed to the pre-arranged "followers" that Google has linked with each user, all without the consent of the Gmail user. 21. Google deceptively misleads users into believing that they could deactivate

Google Buzz by selecting the "turn off buzz" option hidden in fine print at the bottom of their settings page. Yet the "turn off buzz" option does not actually turn off the Buzz service or remove a user's private information from search results. Instead, it just turns off a user's view of the service, hiding updates from the user while the user's private information remains publicly shared for anyone else to see. 22. Google Buzz is neither necessary nor incidental to the email service that Plaintiffs

and class members signed up for. Google instead has deceptively sought to capitalize upon and profit from the immense amount of private and sensitive data that is stores for its email users. By forcing a social networking platform upon Plaintiffs and members of the Class, and harvesting users' private data to create pre-established networks of so-called "friends" or followers whose information is then revealed in a public forum, Google is able to enhance revenues from targeted advertising. 23. The measure of profits generated by Google Buzz is a reasonable measure of the

damages to Plaintiffs and the Class for the invasions of privacy occasioned by Google's actions. Changes to Google Buzz 24. In response to numerous complaints, Google has implemented several changes to

Google Buzz. The changes do not alleviate the privacy concerns of the general public, however. 25. The "welcome screen" does not make clear that the user must create a profile that

would be public and indexed by search engines. The screen only states, "The first time you post

5

in Buzz you'll create a profile which includes the list of people you follow--you can choose not to display this list if you'd like." 26. The user's "following lists" are still automatically generated based on private

contact lists stored by Google, and the frequency of communications intercepted by Google. The burden remains on the user to block all unwanted followers that Google pairs with the user. 27. Google still does not notify users from the outset that Google creates the list of

"people you follow" and "people who follow you" according to the frequency of conversations between a user and contacts in the user's Gmail address book or chat list. Therefore, users remain unaware that showing this list amounts to publishing their address book and Gmail contacts list for anyone to see. 28. Google has not adequately revised the pop-up screen that appears when a user

initially posts on Google Buzz. Users are still unaware that showing the user's connection means showing connections publicly to everyone, and having them publicly indexed by search engines. The checked box only states, "Show the list of people I'm following and the list of people following me on my profile." Google's profile settings and instructions essentially trick users into generating public content. 29. Google still requires users to opt out of using the Google Buzz service, forcing all

Gmail users to unwittingly share private information across the internet unless users affirmatively take actions to limit the personal data that Google shares with the world by default. The Gmail Privacy Notice 30. Google's conduct and actions are in direct violation of Google's own privacy

policies, as well as normative rules of internet privacy protection protocols and laws.

6

31.

The Gmail Privacy Notice describes the collection and use of personal data for the

purpose of providing the Gmail email service. At the time that Google introduced Google Buzz, the Personal Information section of the Gmail Privacy Notice advised users that the company would only use contact lists and other data "in order to provide the [email] service to you." 32. In fact, however, Google Buzz uses Gmail users' contact lists and related data for

a separate and unrelated service, in violation of the Gmail Privacy Notice. 33. Google Buzz compiles a Gmail user's social networking list based on frequent

personal email and chat contacts, in violation of the Gmail Privacy Notice. Google never did and still does not obtain "explicit consent" from Gmail users regarding Google Buzz and Google's use of address book contacts in violation of Google's own privacy policy. 34. Google's privacy policy advises that "When you first enter Google Buzz, to make

the startup experience easier, we may automatically select people for you to follow based on the people you email and chat with the most. Similarly, we may also suggest to others that they follow you . . . Your name, photo, and the list of people you follow and people following you will be displayed on your Google profile, which is publicly searchable on the Web. If you are following someone who publicly displays their list of followers on their Google profile, then you will appear on that person's public list. Likewise, if someone is following you and displays the list of people they follow on their profile, then you will appear on that public list." 35. When Plaintiffs and other class members created Gmail accounts, they signed up

for e-mail services. Their expectations did not include social networking. The reasonable consumer would conclude that the creation by Google Buzz of automated social networking lists from users' private email contacts and communications constitutes a material change in their

7

relationship with Google and a prima facie invasion of their privacy. 36. Google's business practices and service terms violate user privacy expectations,

diminish user privacy, contradict Google's own privacy policy, and are illegal. FEDERAL RESPONSE 37. On March 25, 2010, eleven members of the United States Congress petitioned the

U.S. Federal Trade Commission to investigate Google and complaints that Google Buzz is breaching consumer privacy and violating the public trust. 38. The Federal Trade Commission has lambasted Google for "irresponsible conduct"

related to user privacy rights and concerns. Google CEO Eric Schmidt's position in the press has been to state: "If you have something that you don't want anyone to know, maybe you shouldn't be doing it in the first place." CLASS ALLEGATIONS 39. Plaintiffs bring this action as a class action under Fed. R. Civ. P. 23, on behalf of

themselves and on behalf of a Class for which Plaintiffs seeks certification. Pending any modifications necessitated by Class discovery, Plaintiffs have preliminarily defined this Class as follows: ALL PERSONS SUBSCRIBING TO GOOGLE'S GMAIL SERVICE AS OF FEBRUARY 9, 2010 WHOSE GMAIL ACCOUNTS WERE EMBEDDED WITH the GOOGLE BUZZ SOCIAL NETWORKING 40. Excluded from the Classes are i) any Judge or Magistrate presiding over this

action, and the court personnel supporting the Judge or Magistrate presiding over this action, and members of their respective families; ii) Defendant, Defendant's subsidiaries, parents, successors, predecessors, and any entity in which a Defendant or its parent has a controlling

8

interest and their current or former employees, officers and directors; and iii) persons who properly execute and file a timely request for exclusion from the class; and iv) the legal representatives, successors or assigns of any such excluded persons. 41. The Class is so numerous that joinder of all class members is impracticable.

Plaintiffs do not know the exact size of the Class, since that information is within the exclusive control of Google. However, due to the scale of Google's operations, Plaintiffs believe and therefore alleges that the number of class members is in the millions, exceeding the number required to establish numerosity. Thus, at this time, attempting to join and name each class member as a co-plaintiff would be unreasonable and impractical. 42. Numerous questions of law and fact regarding the liability of Google are common

to the Class and predominate over any individual issues which may exist. The types of issues, which are common to the class and which predominate over individualistic issues include: a) What is the Google Buzz service and how does it work; b) Whether Google Buzz publicly shared or disseminated private user data; c) What user date Google Buzz publicly shared and how; d) Whether there was proper notice or any notice to users of the data that the Google Buzz service would automatically mine and publicize; e) Whether Google provided users with proper opportunity or any opportunity to decline the sharing of private data through Google Buzz; f) Whether Google has engaged in an unlawful invasion of Plaintiffs' and class members' privacy interests; g) Whether, by its actions as set forth therein, Google engaged in unfair,

9

deceptive, untrue, or misleading promotion, implementation, and operation of its website; h) Whether Defendant's conduct violated one or more of the provisions of the Electronic Communications Privacy Act, 18 U.S.C. § 2511 et seq.; i) Whether Defendant's conduct violated of one or more of the provisions of the Stored Communications Act, 18 U.S.C. § 2701 et seq.; j) Whether Defendant's conduct violated of one or more of the provisions of the Computer Fraud and Abuse Act, 18 U.S.C. § 1030 et seq.; k) The appropriate amount of nominal damages to compensate Plaintiffs and the class members for Defendant's invasion of their privacy interests; l) The appropriate amount of punitive damages under Colorado law necessary punish Defendant for its conduct, and prevent further, similar conduct by Defendant and others in the future; m) The appropriate amount of statutory damages that should be awarded to Plaintiffs and the class members under 18 U.S.C. § 2520; and n) Whether Plaintiffs and the class members are entitled to injunctive relief. 43. The claims asserted by Plaintiffs are typical of the claims of class members. A

class action is superior to other available methods for the fair and efficient adjudication of this controversy. Absent class certification, class members will continue to suffer damage and Defendant's conduct will proceed without effective remedy. 44. Plaintiffs will fairly and adequately protect the interests of class members. The

interests of class members are coincident with, and not antagonistic to, those of Plaintiffs.

10

Furthermore, Plaintiffs have retained qualified and competent legal counsel to represent their and others similarly situated. 45. This class action is an appropriate method for the fair and efficient adjudication of

this controversy because: There is no special interest among class members in individually controlling the prosecution of separate actions. The damages sustained by individual class members make it impossible for most class members to redress individually the wrongs done to them. When Google's liability has been adjudicated, claims of all class members can be administered efficiently under the direction of or as determined by this Court. This action will (a) promote an orderly and expeditious administration and adjudication of the class claims; (b) foster economies of time, effort and resources; and (c) ensure uniformity of decisions. Without a class action, Plaintiffs and class members will continue to suffer damages and Google's violations of law will proceed without remedy. There will be no insurmountable difficulty in management of this lawsuit as a class action. 46. The prosecution of separate actions by individual class members would create a

risk of inconsistent or varying adjudications with respect to individual class members which would establish incompatible standards of conduct for Google. 47. The prosecution of separate actions by individual class members would create a

risk of adjudications with respect to individual class members which would, as a practical matter,

11

be dispositive of the interests of the other class members not parties to the adjudications or substantially impair or impede their ability to protect their interests. 48. Google has acted or refused to act on grounds generally applicable to the Class,

thereby making appropriate final injunctive relief with respect to the Class as a whole. IV. CAUSES OF ACTION FIRST CLAIM FOR RELIEF (Electronic Communications Privacy Act, 18 U.S.C. § 2511 et seq.) 49. Plaintiffs incorporate by reference the allegations of all the foregoing paragraphs

as if fully restated herein. 50. The Electronic Communications Privacy Act of 1986 ("ECPA") makes it unlawful

for a person to "willfully intercept[], endeavor[] to intercept, or procure[] any other person to intercept or endeavor to intercept, any wire, oral, or electronic communication." 51. 18 USC 2520(a) provides a civil cause of action to "any person whose wire, oral,

or electronic communication is intercepted, disclosed, or intentionally used in violation of the ECPA. 52. The transmission of data by Plaintiffs and the Class between their computers and

the website of Google Mail constitute "electronic communications" within the meaning of 18 U.S.C. §2510. 53. Google has intentionally obtained and/or intercepted, by device or otherwise, these

electronic communications without Plaintiffs' or class members' knowledge, consent, or authorization. 54. Google has intentionally disclosed to other persons and has otherwise used such

electronic communications, with knowledge, or having reason to know, that the electronic 12

communications were obtained through interception for an unlawful purpose. 55. Defendant's intentional interception of these electronic communications without

Plaintiffs' or class members' knowledge, consent, or authorization was undertaken without a facially valid court order or certification. 56. Google exceeded its authorization to access and control private information

concerning Plaintiffs' electronic communications, in violation of 18 U.S.C. § 2701. 57. Google unlawfully and knowingly divulged Plaintiffs' electronic communication

contents and user information, in violation of 18 U.S.C. § 2702. 58. Google intentionally acquired and/or intercepted the contents of electronic

communications sent by and/or received by Plaintiffs through the use of an electronic device. Google intentionally acquired the communications that had been sent from or directed to Plaintiffs through their use of computers and other electronic devices which were part of, and utilized in, Defendant's electronic communications system, in violation of 18 U.S.C. § 2511 and pursuant to 18 U.S.C. § 2520. 59. Defendant unlawfully accessed and used, and voluntarily disclosed, the contents

of the intercepted communications to enhance its profitability and revenue. This disclosure was not necessary for the operation of Defendant's system or to protect Defendant's rights or property. 60. Plaintiffs are "person[s] whose . . . electronic communication is intercepted . . . or

intentionally used in violation of this chapter" within the meaning of 18 U.S.C. § 2520. 61. 62. Defendant is liable directly and/or vicariously for this cause of action. Plaintiffs therefore seek remedies as provided for by 18 U.S.C. § 2520, including

13

such preliminary and other equitable or declaratory relief as may be appropriate, damages consistent with subsection (c) of that section to be proven at trial, punitive damages to be proven at trial, and a reasonable attorneys' fees and other litigation costs reasonably incurred. 63. Plaintiffs and the Class, pursuant to 18 U.S.C. § 2520, are entitled to preliminary

equitable, and declaratory relief, in addition to statutory damages of the greater of $10,000 or $100 a day for each day of violation, actual and punitive damages, reasonable attorneys' fees and Defendant's profits obtained from the above-described violations. SECOND CLAIM FOR RELIEF (Stored Communications Act, 18 U.S.C. § 2701 et seq.) 64. Plaintiffs incorporate by reference the allegations of all the foregoing paragraphs

as if fully restated herein. 65. Section 2701 of the SCA provides, in pertinent part:

Except as provided in subsection (c) of this section, whoever1) intentionally accesses without authorization a facility through which an electronic communication service is provided; or 2) intentionally exceeds an authorization to access that facility; and thereby obtains, alters or prevents authorized access to a wire or electronic communication while it is in electronic storage in such system shall be punished as provided in subsection (b) of this section. 66. Section 1030 of the CFAA defines the term "exceeds authorized access" to mean

"to access a computer with authorization and to use such access to obtain or alter information in the computer that the accessor is not entitled so to obtain or alter." 18 U.S.C. § 1030(e)(6). 67. Google's actions as detailed therein "access a computer without authorization or

exceeds authorized access" within the meaning of § 1030. 68. Section 2711 of the SCA defines "electronic communication" as "any transfer of 14

signs, signals, writing, images, sounds, data or intelligence of any nature transmitted in whole or in part by a wire, radio, electromagnetic, photo electronic or photo optical system that affects interstate or foreign commerce . . ." 18 U.S.C. §§ 2711, 2510(12). 69. Accordingly, a user's personal profile, list of contacts, electronic communications

with those contacts, and list of "followers" derived from those contacts, constitute "electronic communications" within the meaning of the SCA. 70. Section 2711 of the SCA defines "electronic storage" to include "any temporary

intermediate storage of a wire or electronic communication incidental to the electronic transmission thereof . . ." 18 U.S.C. §§ 2711, 2510(17)(A). 71. Google maintains a user's personal profile, list of contacts, electronic

communications with those contacts, and list of "followers" derived from those contacts in "electronic storage" within the meaning of the SCA. 72. Google's actions as detailed herein constitute an unauthorized acquisition of

stored electronic communications in violation of the SCA. THIRD CLAIM FOR RELIEF (Computer Fraud and Abuse Act, 18 U.S.C. § 1030 et seq.) 73. Plaintiffs incorporate by reference the allegations of all the foregoing paragraphs

as if fully restated herein. 74. Section 1030 provides in part: (a) Whoever***** (2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains-

15

(C) information from any protected computer; ***** shall be punished as provided in subsection (c) of this section. (b) Whoever conspires to commit or attempts to commit an offense under subsection (a) of this section shall be punished as provided in subsection (c) of this section. 75. Defendant has violated the Computer Fraud and Abuse Act, 18 U.S.C. §

1030(a)(2)(C), by intentionally accessing a computer used for interstate commerce or communication, without authorization or by exceeding authorized access to such a computer, and by obtaining information from such a protected computer. 76. Defendant has violated the Computer Fraud and Abuse Act, 18 U.S.C. §

1030(a)(5)(A)(i) by knowingly causing the transmission of a program, information, code, or command and as a result causing a loss to one or more persons during any one-year period aggregating at least $5,000 in value. 77. Section 1030 of the CFAA defines the term "exceeds authorized access" to mean

"to access a computer with authorization and to use such access to obtain or alter information in the computer that the accessor is not entitled so to obtain or alter." 18 U.S.C. § 1030(e)(6). By using software/hardware to automatically mine private contacts and intercept email communications, Google constitute the "access [of] a computer without authorization or exceed[ing] authorized access" within the meaning of § 1030. 78. Plaintiffs have suffered loss by reason of these violations, including, without

limitation, violation of the right of privacy, disclosure of affiliation and business relationships

16

between Plaintiffs and persons with whom they have communicated, and disclosure of specific transactional information that otherwise is private, confidential, and not of public record. 79. Google's unlawful access and publication of Plaintiffs' private communications

has also caused irreparable injury, entitling Plaintiffs to including injunctive relief as provided by 18 U.S.C. § 1030(g). FOURTH CLAIM FOR RELIEF (Invasion of Privacy ­ Colorado common law) 80. Plaintiffs incorporate by reference the allegations of all the foregoing paragraphs

as if fully restated herein. 81. Plaintiffs have a reasonable expectation in maintaining the privacy of their

confidential lists of contacts stored by Google, and in maintaining the confidences and privacy of those with whom Plaintiff electronically communicates through Google's Gmail service. 82. Google's intentional and reckless public disclosure of such private information,

without express and informed consent, would be highly offensive to the ordinary and reasonable person. 83. Plaintiffs. 84. Google's invasion of Plaintiffs' privacy is the proximate cause of damages to Google's actions were in intentional and reckless disregard for the rights of

Plaintiffs in an amount to be determined at trial. WHEREFORE, Plaintiffs and the Class request that the Court enter judgment in their favor and against Google, Inc. as follows:

17

A. Determining that the action is properly maintained as a class action, certifying an appropriate Class and, if necessary, Sub-Classes, certifying Plaintiffs as the class representative, and appointing Plaintiffs' counsel as counsel for the class members; B. Awarding Plaintiffs and class members injunctive and/or declaratory relief as permitted by law or equity; C. Compelling Google to make Google Buzz an opt-in service for Gmail users; D. Enjoining Google from using Gmail users' private contacts to compile social networking lists; E. Awarding Plaintiffs and class members their compensatory damages, attorneys' fees and costs; F. Awarding Plaintiffs and class members their pre-judgment, post-judgment and statutory interest as provided by law; G. Awarding Plaintiffs and class members such other and further relief as the Court deems just and proper under the circumstances. Dated: May 27, 2010. PLAINTIFFS AND CLASS MEMBERS DEMAND TRIAL BY JURY Respectfully submitted. THOMAS | GENSHAFT P.C. Peter W Thomas __________________________ By Peter W. Thomas, No. 27657 0039 Boomerang Road, Suite 8130 Aspen, Colorado 81611 [phone] Counsel for Plaintiffs 18