In Re FACEBOOK INTERNET TRACKING LITIGATION, No. 5:2012md02314 - Document 87 (N.D. Cal. 2015)

Court Description: ORDER granting 44 Motion to Dismiss. Any amended complaint must be filed on or before 11/30/2015. The court schedules this case for a Case Management Conference at 10:00 a.m. on 1/14/2016. The parties shall file a Joint Case Management Conference Statement on or before 1/7/2016. Signed by Judge Edward J. Davila on 10/23/2015. (ejdlc1S, COURT STAFF) (Filed on 10/23/2015) (Entered: 10/23/2015)

Download PDF

1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 SAN JOSE DIVISION 7 8 9 IN RE FACEBOOK INTERNET TRACKING LITIGATION 10 Case No. 5:12-md-02314-EJD ORDER GRANTING DEFENDANT’S MOTION TO DISMISS Re: Dkt. No. 44 United States District Court Northern District of California 11 12 13 Facebook, Inc. (“Facebook”) operates an online “social network” that permits its members 14 to interact with each other through a website - www.facebook.com. Id. at ¶ 9. This consolidated, 15 multi-district lawsuit against the social network, brought by and on behalf of individuals with 16 active Facebook accounts from May 27, 2010, through September 26, 2011 (the “Class Period”), 17 seeks “in excess of $15 billion in damages and injunctive relief” and “arises from Facebook’s 18 knowing interception of users’ internet communications and activity after logging out of their 19 Facebook accounts.” See Corrected First Am. Consolidated Class Action Compl. (“CCAC”), 20 Docket Item No. 35, at ¶ 1. Plaintiffs Perrin Davis, Cynthia Quinn, Brian Lentz, and Matthew 21 Vickery (collectively, “Plaintiffs”), each of whom had an active Facebook account during the 22 entire Class Period, allege that Facebook tracked and stored their post-logout internet usage using 23 small text files - or “cookies” - which Facebook had embedded in their computers’ browsers. Id. 24 at ¶¶ 103-106. 25 Federal jurisdiction arises pursuant to 28 U.S.C. §§ 1331 and 1332(d). Presently before 26 the court is Facebook’s Motion to Dismiss pursuant to Federal Rules of Civil Procedure 12(b)(1) 27 and 12(b)(6). See Docket Item No. 44. Plaintiffs oppose the motion. Having carefully considered 28 1 Case No.: 5:12-md-02314-EJD ORDER GRANTING DEFENDANT’S MOTION TO DISMISS 1 the parties’ arguments, the court has concluded that Facebook’s arguments are meritorious. 2 Accordingly, the motion will be granted for the reasons explained below. 3 BACKGROUND “Cookies” 4 A. 5 As noted, a “cookie” is a small text file that a server creates and sends to a browser, which 6 then stores the file in a particular directory on an individual’s computer. Id. at ¶ 38. A cookie 7 contains a limited amount of information which can relate to the browser or to a specific 8 individual. Id. at ¶¶ 38, 39. 9 United States District Court Northern District of California I. When an individual using a web browser contacts a server - often represented by a 10 particular webpage or internet address - the browser software checks to see if that server has 11 previously set any cookies on the individual’s computer. Id. at ¶ 39. If the server recognizes any 12 valid, unexpired cookies, then the computer “sends” those cookies to the server. Id. at ¶ 39. After 13 examining the information stored in the cookie, the server knows if it is interacting with a 14 computer with which it has interacted before. Id. at ¶ 41. Since servers create database records 15 that correspond to individuals, sessions and browsers, the server can locate the database record 16 that corresponds to the individual, session or browser using the information from the cookie. Id. Facebook and its Use of “Cookies” 17 B. 18 Plaintiffs allege that Facebook is the brainchild of the company’s founder, Mark 19 Zuckerberg, who wrote the first version of “The Facebook” in his Harvard University dorm room 20 and later launched Facebook as a company in 2004. Id. at ¶ 10. Since then, Facebook has become 21 the largest social networking site in the world with other 800 million users world-wide and over 22 150 million users in the United States. Id. at ¶ 11. According to Plaintiffs, the key to this success 23 “was to convince people to create unique, individualized profiles with such personal information 24 as employment history and political and religious affiliations, which then could be shared among 25 their own network of family and friends.” Id. at ¶ 10. Facebook uses this repository of personal 26 data to connect advertisers with its users. Id. at ¶ 12. Historically, 90% of Facebook’s revenue is 27 attributable to third-party advertising and “Facebook is driven to continue to find new and creative 28 2 Case No.: 5:12-md-02314-EJD ORDER GRANTING DEFENDANT’S MOTION TO DISMISS 1 2 Facebook does not charge a fee for membership. Id. at ¶ 14. However, Plaintiffs contend 3 that Facebook membership is not free. Id. at ¶ 14. Specifically, they allege that through the 4 Statement of Rights and Responsibilities and other documents and policies governing use of the 5 website, “Facebook conditions its membership upon users providing sensitive and personal 6 information . . . including name, birth date, gender and email address,” and requires that users 7 accept numerous Facebook cookies on their computers. Id. at ¶¶ 14, 16. These cookies allow 8 Facebook to intercept a user’s electronic communications and track internet browsing history. Id. 9 United States District Court Northern District of California ways to leverage its access to users’ data in order to sustain its phenomenal growth.” Id. at ¶ 13. Facebook cookies come in two flavors. The first is a “session cookie,” which is set when a 10 user logs into Facebook. Id. at ¶ 15. It is directly associated with a user’s Facebook account and 11 contains unique information, such as the user’s Facebook identification. Id. Session cookies are 12 supposed to be deleted when the user logs out of Facebook. Id. 13 The second type is a “tracking cookie,” which is also known as a persistent cookie. Id. 14 This cookie sends data back to Facebook any time an individual makes a request of 15 www.facebook.com, such as when an individual accesses a page with the Facebook “like” button. 16 Id. The tracking takes place, however, regardless of whether the individual actually interacts with 17 the “like” button; “[i]n effect, Facebook is getting details of where you go on the Internet.” Id. 18 Tracking cookies do not expire when a user logs out of Facebook. Id. In fact, Facebook sets these 19 cookies on an individual’s computer whether or not they have a Facebook account. Id. 20 When a Facebook user leaves the Facebook webpage without logging out and then 21 browses the web, both tracking cookies (such as a “datr” cookie) and session cookies (such as a 22 “c_user” cookie) are left to operate on the computer. Id. Under those circumstances, Facebook is 23 notified through the datr cookie whenever the user loads a page with embedded content from 24 Facebook, and also can easily connect that data back to the user’s individual Facebook profile 25 through the c_user cookie. Id. 26 For example, if a logged-in Facebook user accesses the news website www.cnn.com 27 through the browser on his or her computer, the CNN server responds with the file for the CNN 28 3 Case No.: 5:12-md-02314-EJD ORDER GRANTING DEFENDANT’S MOTION TO DISMISS United States District Court Northern District of California 1 homepage, which also contains embedded code from Facebook. Id. at ¶¶ 59, 60. The user’s 2 browser, triggered by the Facebook code, sends a request to the Facebook server to display certain 3 content on the CNN webpage, such as the Facebook “like” button. Id. at ¶ 61. This request also 4 includes information contained in the user’s datr and c_user cookies as well as the specific details 5 of the webpage that the user accessed. Id. at ¶ 63. When Facebook receives this information, the 6 Facebook server adds it to its database records for the browser and the user. Id. at ¶ 67. The 7 Facebook server then responds by sending the requested content to the user’s browser. Id. at ¶ 70. 8 C. 9 Aside from tracking logged-in users, Plaintiffs allege that Facebook has also intentionally Facebook Tracks Logged-Out Users 10 tracked users’ browsing activity after they logged-out of the Facebook website despite contrary 11 representations in the social network’s governing materials. Id. at ¶ 17. Facebook is able to 12 engage in such tracking though the persistent datr cookie its server embeds after the user accesses 13 www.facebook.com. Id. at ¶ 73. 14 Again using the CNN website as an example, if a user logs out of Facebook and then 15 directs his or her computer’s browser to www.cnn.com, the CNN server responds in much the 16 same way as if the user was still logged-in to Facebook: by sending to the browser a file with the 17 contents of the CNN website which contains a piece of Facebook code pertaining to the “like” 18 button. Id. at ¶¶ 72-75. The browser, triggered by the Facebook code, sends a request to the 19 Facebook server to display the “like” button on the CNN webpage. Id. at ¶ 77. This request also 20 includes any personally identifiable information contained in cookies associated with the browser, 21 such as the datr cookie. Id. at ¶ 78. The Facebook server then creates a database log entry of the 22 request, stores the cookie information it received, and responds by sending the content requested 23 for display on the CNN website. Id. at ¶¶ 78-82. 24 Plaintiffs allege the information Facebook receives through tracking logged-out users is 25 specific enough to identify the user without the need for an additional Facebook cookie containing 26 the user’s identification. Id. at ¶ 83. Indeed, they allege that “[f]rom the first time a Facebook 27 user logs into Facebook and the datr tracking cookie is set on his machine, all of that user’s 28 4 Case No.: 5:12-md-02314-EJD ORDER GRANTING DEFENDANT’S MOTION TO DISMISS 1 browsing to Facebook partner sites using that browser is linked by Facebook back to that user 2 because the datr tracking cookie contains a unique number, which is also unique to that particular 3 user’s browser and his specific computer or mobile device, that indexes into the Facebook 4 database which tracks users and browser sessions both on computers and mobile devices such as 5 Android cell phones, iPhones, iPads, and the iPod Touch.” Id. Furthermore, Plaintiffs believe that 6 Facebook implemented a P3P “compact policy”1 that circumvented privacy settings on 7 Microsoft’s Internet Explorer (“IE”) browser to allow Facebook’s cookies, thereby ensuring that 8 IE would transmit information from Facebook cookies back to the Facebook server when users 9 visited affiliated non-Facebook websites. Id. at ¶¶ 101, 102. Plaintiffs contend that the personal information Facebook receives from its users, including United States District Court Northern District of California 10 11 users’ browsing history, has “massive economic value” and that a market exists for such 12 information. Id. at ¶¶ 112, 122-124. They point out that “internet giant” Google, Inc. conducts a 13 panel called “Google Screenwise Trends,” the purpose of which is “to learn more about how 14 everyday people use the Internet.” Id. at ¶ 118. Through this program, internet users consent to 15 share with Google the websites they visit and how they use them in exchange for gift cards, 16 “mostly valued at exactly $5.” Id. at ¶¶ 119, 121. Plaintiffs further allege the value of their personal information can be quantified. Id. at ¶ 17 18 116. Based on a study published in 2011, Plaintiffs allege that the contact information users must 19 provide to Facebook when becoming a member is worth $4.20 per year. Id. In addition, 20 demographic information is worth $3.00 per year and web browsing histories are worth $52.00 per 21 year. Id. Aggregated across Facebook’s approximately 800 million users, these values translate 22 into membership “fees” of $3.36 billion, $2.4 billion and $41.6 billion, respectively, for each 23 category of information. Id. 24 25 26 27 28 1 According to the CCAC, “P3P” refers to the Platform for Privacy Preferences, which is a standard format for computer-readable privacy policies published by the World Wide Web Consortium in 2002. See CCAC, at ¶ 86. A P3P “compact policy” is a computer-readable encoded version of the portion of a privacy policy relating to cookies. Id. 5 Case No.: 5:12-md-02314-EJD ORDER GRANTING DEFENDANT’S MOTION TO DISMISS D. 1 Relevant Procedural History A number of cases challenging Facebook’s tracking practices were filed in and outside this 2 district. They were eventually transferred to the undersigned. The court consolidated the cases for 3 pretrial consideration and appointed interim class counsel. See Docket Item No. 19. Plaintiffs 4 thereafter filed the CCAC, which is the currently operative pleading. See Docket Item No. 35. 5 This motion followed. 6 7 8 II. LEGAL STANDARD A. Federal Rule of Civil Procedure 12(b)(1) A Rule 12(b)(1) motion challenges subject matter jurisdiction and may be either facial or 9 factual. Wolfe v. Strankman, 392 F.3d 358, 362 (9th Cir.2004). A facial 12(b)(1) motion involves 10 an inquiry confined to the allegations in the complaint, whereas a factual 12(b)(1) motion permits 11 United States District Court Northern District of California the court to look beyond the complaint to extrinsic evidence. Id. When, as here, a defendant 12 makes a facial challenge, all material allegations in the complaint are assumed true, and the court 13 must determine whether lack of federal jurisdiction appears from the face of the complaint itself. 14 Thornhill Publ’g Co. v. General Tel. Elec., 594 F.2d 730, 733 (9th Cir.1979). 15 Standing is properly challenged through a Rule 12(b)(1) motion. White v. Lee, 227 F.3d 16 17 1214, 1242 (9th Cir. 2000). “A plaintiff has the burden to establish that it has standing.” WildEarth Guardians v. United States Dep’t of Agric., 795 F.3d 1148, 1154 (9th Cir. 2015). 18 19 B. Federal Rule of Civil Procedure 12(b)(6) Federal Rule of Civil Procedure 8(a) requires a plaintiff to plead each claim with sufficient 20 21 22 23 specificity to “give the defendant fair notice of what the . . . claim is and the grounds upon which it rests.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007) (internal quotations omitted). Although particular detail is not generally necessary, the factual allegations “must be enough to raise a right to relief above the speculative level” such that the claim “is plausible on its face.” Id. 24 at 556-57. A complaint which falls short of the Rule 8(a) standard may be dismissed if it fails to 25 state a claim upon which relief can be granted. Fed. R. Civ. P. 12(b)(6). “Dismissal under Rule 26 12(b)(6) is appropriate only where the complaint lacks a cognizable legal theory or sufficient facts 27 28 6 Case No.: 5:12-md-02314-EJD ORDER GRANTING DEFENDANT’S MOTION TO DISMISS 1 to support a cognizable legal theory.” Mendiondo v. Centinela Hosp. Med. Ctr., 521 F.3d 1097, 2 1104 (9th Cir. 2008). 3 When deciding whether to grant a motion to dismiss, the court usually “may not consider 4 any material beyond the pleadings.” Hal Roach Studios, Inc. v. Richard Feiner & Co., 896 F.2d 5 1542, 1555 n. 19 (9th Cir.1990). However, the court may consider material submitted as part of 6 the complaint or relied upon in the complaint, and may also consider material subject to judicial 7 notice. See Lee v. City of Los Angeles, 250 F.3d 668, 688-89 (9th Cir. 2001). In addition, the court must generally accept as true all “well-pleaded factual allegations.” United States District Court Northern District of California 8 9 Ashcroft v. Iqbal, 556 U.S. 662, 664 (2009). The court also must construe the alleged facts in the 10 light most favorable to the plaintiff. Love v. United States, 915 F.2d 1242, 1245 (9th Cir.1988). 11 But “courts are not bound to accept as true a legal conclusion couched as a factual allegation.” Id. 12 Nor must the court accept as true “allegations that contradict matters properly subject to judicial 13 notice or by exhibit” or “allegations that are merely conclusory, unwarranted deductions of fact, or 14 unreasonable inferences.” In re Gilead Scis. Sec. Litig., 536 F.3d 1049, 1055 (9th Cir. 2008). 15 III. DISCUSSION Plaintiffs assert the following claims in the CCAC: (1) violation of the Federal Wiretap 16 17 Act, 18 U.S.C. § 2510 et seq.; (2) violation of the Stored Communications Act (“SCA”), 18 U.S.C. 18 § 2701 et seq.; (3) violation of the Computer Fraud and Abuse Act (“CFAA”), 18 U.S.C. § 10302; 19 (4) invasion of privacy; (5) intrusion upon seclusion; (6) conversion; (7) trespass to chattels; (8) 20 violation of California’s Unfair Competition Law (“UCL”), Business and Professions Code § 21 17200 et seq.; (9) violation of the California Computer Crime Law (“CCCL”), Penal Code § 502; 22 (10) violation of the California Invasion of Privacy Act (“CIPA”), Penal Code § 630 et seq.; and 23 (11) violation of California’s Consumer Legal Remedies Act (“CLRA”), Civil Code § 1750. Under Rule 12(b)(1), Facebook argues that all of these claims fail for lack of standing. 24 25 Under Rule 12(b)(6), Facebook further argues that the fraud-based claims lack the factual 26 27 28 2 Plaintiffs have withdrawn this claim. It will therefore be dismissed without leave to amend. 7 Case No.: 5:12-md-02314-EJD ORDER GRANTING DEFENDANT’S MOTION TO DISMISS 1 specificity required by Federal Rule of Civil Procedure 9(b), and that Plaintiffs have not stated an 2 actionable claim. These arguments are discussed below. 3 United States District Court Northern District of California 4 A. Standing i. Constitutional Standing 5 The constitutional standing doctrine “functions to ensure, among other things, that the 6 scarce resources of the federal courts are devoted to those disputes in which the parties have a 7 concrete stake.” Friends of the Earth, Inc. v. Laidlaw Envtl. Servs., Inc., 528 U.S. 167, 191 8 (2000). Generally, the inquiry critical to any standing issue is “‘whether the litigant is entitled to 9 have the court decide the merits of the dispute or of particular issues.’” Allen v. Wright, 468 U.S. 10 737, 750-51 (1984) (quoting Warth v. Seldin, 422 U.S. 490, 498 (1975)). Standing under Article 11 III of the Constitution has three basic elements: (1) an “injury in fact,” which is neither conjectural 12 or hypothetical, (2) causation, such that a causal connection between the alleged injury and 13 offensive conduct is established, and (3) redressability, or a likelihood that the injury will be 14 redressed by a favorable decision. Lujan v. Defenders of Wildlife, 504 U.S. 555, 560-61 (1992). 15 Noting the lack of allegations that anyone was willing to pay for their personal information 16 or that its purported conduct lessened the value of that information or affected its marketability, 17 Facebook argues that Plaintiffs have not established a cognizable injury in fact. To satisfy the 18 “injury in fact” element, “the plaintiff must show that he personally has suffered some actual or 19 threatened injury as a result of the putatively illegal conduct of the defendant.” Gladstone Realtors 20 v. Village of Bellwood, 441 U.S. 91, 100 (1979). Moreover, since this is a class action, at least 21 one of the named plaintiffs must have suffered an injury in fact. See Lierboe v. State Farm Mut. 22 Auto. Ins. Co., 350 F.3d 1018, 1022 (9th Cir. 2003) (“[I]f none of the named plaintiffs purporting 23 to represent a class establishes the requisite of a case or controversy with the defendants, none 24 may seek relief on behalf of himself or any other member of the class.”). 25 When confronted with data privacy claims similar to the ones brought by Plaintiffs, courts 26 have found insufficient for standing purposes generalized assertions of economic harm based 27 solely on the alleged value of personal information. In LaCourt v. Specific Media, Inc., No. 28 8 Case No.: 5:12-md-02314-EJD ORDER GRANTING DEFENDANT’S MOTION TO DISMISS 1 SACV 10-1256-GW(JCGx), 2011 U.S. Dist. LEXIS 50543, 2011 WL 1661532 (C.D. Cal. Apr. 2 28, 2011), the plaintiffs alleged that Specific Media, “an online third party ad network that earns 3 its revenue by delivering targeted advertisements,” stored cookies on their computers, which it 4 then used to collect browsing history information in order to create behavioral profiles and target 5 specific categories of ads at different users. LaCourt, 2011 U.S. Dist. LEXIS 50543, at *2. The 6 plaintiffs also claimed that Specific Media’s conduct caused them economic loss “in that their 7 personal information has discernable value” of which they were deprived, and which Specific 8 Media retained and used for its own benefit. Id. at *3-4. Specific Media moved to dismiss the 9 complaint for lack of Article III standing under Rule 12(b)(1), arguing that the plaintiffs’ theory of 10 United States District Court Northern District of California 11 economic harm did not make out an injury in fact. Id. at *7. The district court agreed with Specific Media and dismissed the complaint. The court 12 determined that, while it “probably would decline to say that it is categorically impossible for [the 13 plaintiffs] to allege some property interest that was compromised” by Specific Media’s 14 information collection practices, the plaintiffs had not alleged they were actually deprived of the 15 economic value of their browsing histories. Id. at *11. The court reasoned this was so because the 16 plaintiffs had not cited “some particularized example” of “a single individual who was foreclosed 17 from entering into a ‘value-for-value exchange’ as a result of Specific Media’s alleged conduct,” 18 or explained how they were deprived of the information’s value simply because it was collected 19 by a third party. Id. at *11-12. 20 A similar conclusion was reached in Low v. LinkedIn Corporation, No.11-CV-01468- 21 LHK, 2011 U.S. Dist. LEXIS 130840, 2011 WL 5509848 (N.D. Cal. Nov. 11, 2011). There, the 22 plaintiff alleged economic loss from LinkedIn’s practice of transmitting users’ personal 23 information, such as the name of each user and his or her profile viewing history, to third party 24 tracking cookies which allowed the recipients to aggregate the data. Low, 2011 U.S. Dist. LEXIS 25 130840, at *3-4. Relying on LaCourt, the court found the plaintiff’s allegations “too abstract and 26 hypothetical to support Article III” standing. Id. at *10. The court reasoned that the plaintiff 27 failed to demonstrate that he personally suffered some type of real economic harm due to the 28 9 Case No.: 5:12-md-02314-EJD ORDER GRANTING DEFENDANT’S MOTION TO DISMISS 1 United States District Court Northern District of California 2 transmission of his personal information. Id. at *12-15. An out-of-circuit case, In re Google Inc. Cookie Placement Consumer Privacy Litigation 3 (“Google Cookie Placement”), 988 F. Supp. 2d 434 (D. Del. Oct. 9, 2013), is also of note. The 4 plaintiffs in that case alleged that Google had employed third-party cookies to track consumer 5 internet browsing for use in targeted advertising without first obtaining consent to do so. 988 F. 6 Supp. 2d at 440. Much like the district court did in LaCourt, the Delaware district court accepted 7 the plaintiffs’ contention that their personally identifiable information had “some modicum of 8 identifiable value to an individual plaintiff.” Id. at 442. But the court found that value alone was 9 insufficient to establish Article III standing, explaining that the plaintiffs had not “sufficiently 10 alleged that the ability to monetize their [personally identifiable information had] been diminished 11 or lost by virtue of Google’s collection of it.” Id. 12 The court finds these decisions instructive mainly because Plaintiffs’ allegations are 13 virtually indistinguishable from those rejected in LaCourt, Low and Google Cookie Placement. 14 Like the plaintiffs in those cases, Plaintiffs allege that the information collected by Facebook’s 15 cookies have economic value and, if the study cited in the CCAC is accurate, that value may be 16 significant when user information is aggregated. The court accepts as true Plaintiffs’ ascription of 17 some degree of intrinsic value to their personal information for this motion. But what Plaintiffs 18 have failed to do is adequately connect this value to a realistic economic harm or loss that is 19 attributable to Facebook’s alleged conduct. In other words, Plaintiffs have not shown, for the 20 purposes of Article III standing, that they personally lost the opportunity to sell their information 21 or that the value of their information was somehow diminished after it was collected by Facebook. 22 Unlike other data privacy cases, Plaintiffs have alleged the existence of a limited market 23 for their browsing histories. That allegation, however, is still not enough to establish a qualifying 24 injury in fact. That programs may exist to compensate internet users with $5 gift cards in 25 exchange for monitoring their browsing activity is a fact of little assistance to Plaintiffs when they 26 have not also alleged an inability to participate in these programs after Facebook collected their 27 28 10 Case No.: 5:12-md-02314-EJD ORDER GRANTING DEFENDANT’S MOTION TO DISMISS 1 information.3 Nor do the allegations of consequential damages incurred by one plaintiff, Davis, provide a 2 3 persuasive basis to find a sufficiently-pled injury in fact. Other than a conclusory allegation 4 deeming it so, it is not apparent how charges for an email service which alerts users when 5 Facebook makes changes to its privacy policy or privacy settings are “fairly traceable” to the 6 conduct alleged in the complaint.4 See Lujan, 504 U.S. at 560. Moreover, the allegations related 7 to the monitoring service are too vague without a specified timeframe describing when these 8 damages accrued. As pled, the CCAC only alludes to injury that is conjectural or hypothetical. Since United States District Court Northern District of California 9 10 Plaintiffs have not demonstrated that Facebook’s conduct resulted in some concrete and 11 particularized harm, they have not articulated a cognizable basis for standing pursuant to Article 12 III. 13 ii. Statutory Standing 14 For their part, Plaintiffs do not directly address Facebook’s constitutional standing 15 argument, choosing instead to focus on statutory standing. Thus, the issue becomes whether any 16 of the statutory claims asserted in the CCAC can satisfy the federal standing requirement. Although it cannot be supplanted by a statute, an Article III injury can exist solely by 17 18 virtue of “statutes creating legal rights, the invasion of which creates standing.” Edwards v. First 19 Am. Corp., 610 F.3d 514, 517 (9th Cir. 2010); see Raines v. Byrd, 521 U.S. 811, 820 n.3 (1997) 20 (“Congress cannot erase Article III’s standing requirements by statutorily granting the right to sue 21 22 23 24 25 26 27 28 3 Notably, this reasoning is unaffected by Ninth Circuit’s 2014 limited standing discussion in In re Facebook Privacy Litigation, 572 Fed. Appx. 494 (2014). A review of the facts of that case, as illustrated in the companion opinion In re Zynga Privacy Litigation, 750 F.3d 1098 (2014), reveals that Facebook was disclosing identifying information to third-party websites in referer headers. Given that no such disclosure is alleged here, any Article III standing determination made in Facebook Privacy Litigation is inapplicable to this case. 4 In their opposition, Plaintiffs raise several new facts relating to consequential damages and other issues. Those facts have no bearing on whether the CCAC is adequate. See Schneider v. Cal. Dep’t of Corr., 151 F.3d 1194, 1197 n.1 (9th Cir. 1998) (“The ‘new’ allegations contained in the . . . opposition motion . . . are irrelevant for Rule 12(b)(6) purposes.”). 11 Case No.: 5:12-md-02314-EJD ORDER GRANTING DEFENDANT’S MOTION TO DISMISS 1 to a plaintiff who would not otherwise have standing.”). The relevant question in such 2 circumstances is “whether the constitutional or statutory provision on which the claim rests 3 properly can be understood as granting persons in the plaintiff’s position a right to judicial relief.” 4 Id. 5 So-called “statutory standing” can be established by pleading a violation of a right 6 conferred by statute so long as the plaintiff alleges “a distinct and palpable injury to himself, even 7 if it is an injury shared by a large class of other possible litigants.” Warth, 522 U.S. at 501. 8 Whether or not a plaintiff has stated a basis for statutory standing is tested under Rule 12(b)(6) 9 rather than Rule 12(b)(1). Maya v. Centex Corp., 658 F.3d 1060, 1067 (9th Cir. 2011). Here, Plaintiffs’ arguments in support of statutory standing are uncompelling for several of United States District Court Northern District of California 10 11 their claims. First, it is axiomatic that standing permitted by statute does not translate into 12 standing for common law claims. See Davis v. Fed. Election Comm’n, 554 U.S. 724, 734 (2008) 13 (holding that standing is not “dispensed in gross” and must be established for each claim and each 14 form of relief). Thus, all of the common law claims asserted in the CCAC which rely on 15 economic harm related to the loss of personal information as an element of damages, in particular 16 the claims for conversion and trespass to chattels, are subject to dismissal for lack of constitutional 17 standing under Article III.5 See Low, 2011 U.S. Dist. LEXIS 130840, at *2 (dismissing similar 18 common law claims for lack of Article III standing). Second, the court agrees with Facebook that three of Plaintiffs’ statutory claims, those for 19 20 21 22 23 24 25 26 27 28 5 In any event, the claims for invasion of privacy and intrusion upon seclusion are also subject to dismissal for failure to state a claim even if Plaintiffs rely on some other form of damage for these claims. To the extent they can be considered separate claims - a concept which is itself questionable - both require “(1) intrusion into a private place, conversation or matter, (2) in a manner highly offensive to a reasonable person.” Shulman v.Group W Prods., Inc., 18 Cal. 4th 200, 214 & n.4 (1996); Hill v. Nat’l Collegiate Athletic Ass’n, 7 Cal. 4th 1, 66 (1994). To establish the first element, the plaintiff must have had an actual, subjective expectation of seclusion that was objectively reasonable. Med Lab. Mgmt. Consultants v. ABC, Inc., 306 F.3d 806, 812-13 (9th Cir. 2002). Under the current allegations, Plaintiffs could not have held a subjective expectation of privacy in their browsing histories that was objectively reasonable because “Internet users have no expectation of privacy in the . . . IP addresses of the websites they visit . . . .” United States v. Forrester, 512 F.3d 500, 510 (9th Cir. 2007). Plaintiffs “should know that this information is provided to and used by Internet service providers for the specific purpose of directing the routing of information.” Id. 12 Case No.: 5:12-md-02314-EJD ORDER GRANTING DEFENDANT’S MOTION TO DISMISS United States District Court Northern District of California 1 violation of the UCL, CLRA and the CCCL, require a plausible economic injury for standing. 2 Reid v. Johnson & Johnson, 780 F.3d 952, 958 (9th Cir. 2015) (“To establish standing to bring a 3 claim under [the UCL and CLRA], plaintiffs must meet an economic injury-in-fact requirement, 4 which demands no more than the corresponding requirement under Article III of the U.S. 5 Constitution.”); Cal. Penal Code § 502(e) (conferring standing to bring a civil action on owners or 6 lessees of a “computer, computer system, computer network, computer program, or data who 7 suffer[] damage or loss by reason of a violation” of the CCCL). Consequently, the statutory 8 standing analysis for these claims coincides with the Article III analysis. 9 The three remaining statutory claims are different, however, because economic injury is 10 not a prerequisite for standing under their provisions. See Chapman v. Pier 1 Imps. (U.S.), Inc., 11 631 F.3d 939, 947 (2011) (“The existence of federal standing ‘often turns on the nature and source 12 of the claim asserted.’”). As to the Wiretap Act, “courts in this district have found that allegations 13 of a Wiretap Act violation are sufficient to establish standing.” In re Google Inc. Gmail Litig., No. 14 13-MD-02430-LHK, 2013 U.S. Dist. LEXIS 172784, at *63, 2013 WL 5423918 (N.D. Cal. Sept. 15 26, 2013); 18 U.S.C. § 2520(a) (“[A]ny person whose wire, oral, or electronic communication is . . 16 . disclosed . . . may in a civil action recover from the person or entity . . . such relief as may be 17 appropriate.”). The same is true of the SCA. In re iPhone Application Litig., 844 F. Supp. 2d 18 1040, 1055 (N.D. Cal. 2012) (“Other courts in this district have recognized that a violation of the 19 Wiretap Act or the Stored Communications Act may serve as a concrete injury for the purposes of 20 Article III injury analysis.”); Gaos v. Google, Inc., No. 5:10-CV-4809 EJD, 2012 U.S. Dist. 21 LEXIS 44062, at *9, 2012 WL 109446 (N.D. Cal. Mar. 29, 2012) (“Thus, a violation of one’s 22 statutory rights under the SCA is a concrete injury.”); 18 U.S.C. § 2707(a) (“[A]ny . . . person 23 aggrieved by any violation of this chapter in which the conduct constituting the violation is 24 engaged in with a knowing or intentional state of mind may, in a civil action, recover from the 25 person or entity . . . which engaged in that violation such relief as may be appropriate.”). And 26 because it specifically excludes economic damages as a precursor to liability, the court concludes 27 that allegations of a CIPA violation sufficiently establish standing under that statute as well. Cal. 28 13 Case No.: 5:12-md-02314-EJD ORDER GRANTING DEFENDANT’S MOTION TO DISMISS United States District Court Northern District of California 1 Penal Code § 637.2 (“It is not a necessary prerequisite to an action pursuant to this section that the 2 plaintiff has suffered, or be threatened with, actual damages.”); In re Google Inc. Gmail Litig., 3 2013 U.S. Dist. LEXIS 172784, at *67 (“[T]he Court finds that CIPA and the Wiretap Act are not 4 distinguishable for the purposes of standing.”). 5 Here, Plaintiffs allege that Facebook intercepted and tracked their internet activity and 6 acquired this information after they logged out of the Facebook website using the datr cookie 7 embedded on their computers. Plaintiffs also assert this conduct violated the Wiretap Act, SCA 8 and CIPA. Consistent with other district courts to have examined statutory standing to bring 9 similar claims, this court finds Plaintiffs’ allegations sufficient to make out a distinct and palpable 10 injury considering the conduct prohibited by those statutes. In re Facebook Privacy Litig., 791 F. 11 Supp. 2d 705, 712 (N.D. Cal. 2011) (“The Wiretap Act provides that any person whose electronic 12 communication is ‘intercepted, disclosed, or intentionally used’ in violation of the Act may in a 13 civil action recover from the entity which engaged in that violation.”); Gaos, 2012 U.S. Dist. 14 LEXIS 44062, at *8 (explaining that the SCA “prohibits an electronic communication service 15 from divulging the contents of a communication in electronic storage . . . and prohibits a remote 16 computing service from divulging the contents of communications carried or maintained on that 17 service”); In re Google Inc. Gmail Litig., 2013 U.S. Dist. LEXIS 172784, at *58 (observing that 18 CIPA “prohibits wiretapping or ‘any other unauthorized connection’ with a ‘wire, line, cable, or 19 instrument.’”). 20 In sum, Plaintiffs have established statutory standing for claims under the Wiretap Act, 21 SCA and CIPA. The court is mindful, however, that the issue of standing is distinct from whether 22 or not Plaintiffs have actually stated a plausible claim. In re Facebook Privacy Litig., 791 F. Supp. 23 2d at 712 n. 5 (“A plaintiff may satisfy the injury-in-fact requirements to have standing under 24 Article III, and thus may be able to ‘bring a civil action without suffering dismissal for want of 25 standing to sue,’ without being able to assert a cause of action successfully.”). All other claims, 26 however, will be dismissed with leave to amend for lack of standing. Since this dismissal will 27 encompass the UCL, CLRA and CCCL claims, the court need not address Facebook’s argument 28 14 Case No.: 5:12-md-02314-EJD ORDER GRANTING DEFENDANT’S MOTION TO DISMISS 1 under Rule 9(b). 2 B. 3 The court now turns to whether Plaintiffs have stated a plausible claim under the Wiretap 4 5 United States District Court Northern District of California 6 Sufficiency of Allegations Act, SCA or CIPA. i. The Wiretap Act and SCA The Wiretap Act and SCA represent “two chapters” within the Electronic Communications 7 Privacy Act of 1986 (“ECPA”). In re Zynga Privacy Litig., 750 F.3d 1098, 1100 (9th Cir. 2014). 8 Title I of the ECPA, which contains the Wiretap Act, “provides that (with certain exceptions), ‘a 9 person or entity’ (1) ‘providing an electronic communication service to the public’ (2) ‘shall not 10 intentionally divulge the contents of any communication (other than one to such person or entity, 11 or an agent thereof)’ (3) ‘while in transmission on that service’ (4) ‘to any person or entity other 12 than an addressee or intended recipient of such communication or an agent of such addressee or 13 intended recipient.’” Id. at 1104 (quoting 18 U.S.C. § 2511(3)(a)). Title II of ECPA is the SCA, 14 which “covers access to electronic information stored in third party computers.” Id. (citing 18 15 U.S.C. §§ 2701-12). Under the portion of the SCA relevant here, “whoever (1) intentionally 16 accesses without authorization a facility through which an electronic communication service is 17 provided; or (2) intentionally exceeds an authorization to access that facility; and thereby obtains, 18 alters, or prevents authorized access to a wire or electronic communication while it is in electronic 19 storage in such system” is subject to liability. 18 U.S.C. § 2701(a). For a civil action under the 20 SCA, the conduct constituting the violation must have been done with “a knowing or intentional 21 state of mind.” 18 U.S.C. § 2707(a). 22 Facebook argues the CCAC’s claim under the Wiretap Act is insufficient because 23 Plaintiffs did not plead that Facebook intercepted the “contents” of an electronic communication. 24 Under the Wiretap Act, the “contents” of a communication are defined as “any information 25 concerning the substance, purport, or meaning of that communication.” 18 U.S.C. § 2510(8). The 26 Ninth Circuit has held that as used in the Wiretap Act “the term ‘contents’ refers to the intended 27 message conveyed by the communication, and does not include record information regarding the 28 15 Case No.: 5:12-md-02314-EJD ORDER GRANTING DEFENDANT’S MOTION TO DISMISS 1 characteristics of the message that is generated in the course of the communication” such as a 2 name, address, or the identify of a subscriber or customer. In re Zynga Privacy Litig., 750 F.3d at 3 1106-1107. Applying this holding, the court went on to find that a “referer header” - basically the 4 portion of a webpage request message that provides the address of the webpage from which the 5 request was sent - does not meet the Wiretap Act’s definition of “contents.” Id. “[T]he webpage 6 address identifies the location of a webpage a user is viewing on the internet, and therefore 7 functions like an ‘address’ . . . . Congress excluded this sort of record information from the 8 definition of ‘contents.’” Id. United States District Court Northern District of California 9 For Plaintiffs’ Wiretap Act claim, Zynga Privacy Litigation poses a significant hurdle. 10 Although Plaintiffs do not specify just what information of theirs was intercepted by Facebook, 11 Plaintiffs generally allege that, through cookies embedded on a user’s browser, Facebook receives 12 personal information about logged-out users information as well as the identity of the webpages 13 that the users visited. But since they also allege in other portions of the CCAC that c_user and 14 datr cookies contain only a Facebook user’s unique identification information and a record of 15 browsing history, they have not alleged that Facebook intercepted anything that qualifies as 16 “content” under the Wiretap Act. In turn, Plaintiffs have not stated a claim under the statute. In 17 fact, since the intercepted information described in the CCAC is so similar to the referer headers 18 addressed in Zynga Privacy Litigation, Plaintiffs may never be able to state an action Wiretap Act 19 claim, particularly since their arguments on this issue are unpersuasive. 20 The SCA claim is also deficient. As relevant here, “electronic storage” means “any 21 temporary, intermediate storage of a wire or electronic communication incidental to the electronic 22 transmission thereof.” 18 U.S.C. § 2510(17)(A). The “language and legislative history” of the 23 definition “make evident” that “electronic storage” does include cookies stored on a user’s 24 computer; “[r]ather it appears that the section is specifically targeted at communications 25 temporarily stored by electronic communications services incident to their transmission - for 26 example, when an email service stores a message until the addressee downloads it.” In re 27 Doubleclick Privacy Litig., 154 F. Supp. 2d 497, 511-12 (S.D.N.Y. 2001); In re Toys R Us, Inc., 28 16 Case No.: 5:12-md-02314-EJD ORDER GRANTING DEFENDANT’S MOTION TO DISMISS 1 Privacy Litig., No. M-00-1381 MMC, 2001 U.S. Dist. LEXIS 16947, at *10-11, 2001 WL 2 34517252 (N.D. Cal. Oct. 9, 2001). Plaintiff’s theory under the SCA as it is currently described in 3 the CCAC - that Facebook accesses personal information through persistent cookies permanently 4 residing in users’ personal web browsers - cannot be reconciled with the temporary nature of 5 storage contemplated by the statutory definition. The case upon which Plaintiffs rely, Doe v. City 6 and County of San Francisco, No. C10-04700 TEH, 2012 U.S. Dist. LEXIS 81305, 2012 WL 7 2132398 (N.D. Cal. Jun. 12, 2012), does not hold otherwise and, in fact, is consistent with this 8 discussion because the “electronic storage” at issue there was a webmail inbox. Accordingly, 9 Plaintiffs have not stated a claim for violation of the SCA in the CCAC. 10 United States District Court Northern District of California 11 12 ii. The section of CIPA upon which Plaintiffs base their claim, Penal Code § 631, establishes liability for: 13 [a]ny person who, by means of any machine, instrument, or contrivance, or in any other manner, intentionally taps, or makes any unauthorized connection, whether physically, electrically, acoustically, inductively, or otherwise, with any telegraph or telephone wire, line, cable, or instrument, including the wire, line, cable, or instrument of any internal telephonic communication system, or who willfully and without the consent of all parties to the communication, or in any unauthorized manner, reads, or attempts to read, or to learn the contents or meaning of any message, report, or communication while the same is in transit or passing over any wire, line, or cable, or is being sent from, or received at any place within this state. 14 15 16 17 18 19 20 CIPA Cal. Penal Code § 631(a). 21 Facebook challenges the CIPA claim on multiple grounds, two of which are misplaced. It 22 first contends that this criminal statute should be narrowly construed and should not be applied to 23 electronic communications. Because that argument has been made before and squarely rejected, 24 the court rejects it again here. In re Google Inc. Gmail Litig., 2013 U.S. Dist. LEXIS 172784, at 25 *76-79. 26 Second, Facebook argues it cannot be considered an unauthorized participant in the 27 transmission of Plaintiffs’ personal information because the process of tracking their browsing 28 17 Case No.: 5:12-md-02314-EJD ORDER GRANTING DEFENDANT’S MOTION TO DISMISS United States District Court Northern District of California 1 activity involved communication with a Facebook server. This characterization of the allegations 2 is incomplete because Plaintiffs allege they were unaware that Facebook was surreptitiously 3 tracking them after they logged out of the Facebook website. Thus, while it is true that a 4 Facebook server was involved, there are no allegations in the CCAC which demonstrate that 5 Plaintiffs knew that fact while their browsing activity was being tracked and collected. The cases 6 relied on by Facebook are inapposite because each involved recording by a known participant to a 7 telephone conversation. See Warden v. Kahn, 99 Cal. App. 3d 805, 808-809 (1979); see also 8 Rogers v. Ulrich, 52 Cal. App. 3d 894, 896 (1976). 9 Facebook’s third and fourth arguments are well-taken, however. Plaintiffs have not pled 10 facts to show how Facebook used a “machine, instrument, or contrivance” to obtain the contents 11 of communications. While it is undeniable that a computer may qualify as a “machine,” Plaintiffs 12 must complete the scenario by explaining how Facebook’s cookies fall into one of the three 13 categories enumerated in the statute. To be sure, the cookie is a required piece under Plaintiffs’ 14 theory because the offensive transmission of information between two computers - the user’s 15 computer and the Facebook server - apparently does not occur without it. Thus, if a cookie is truly 16 a “contrivance” as Plaintiffs contend, a word they define as a “device, especially a mechanical 17 one” or “plan or scheme,” Plaintiffs must include facts in their pleading to show why it is so. In 18 its current form, the CCAC only defines a cookie as a small text file containing a limited amount 19 of information which sits idly on a user’s computer until contacted by a server. 20 Nor have Plaintiffs adequately alleged that Facebook obtained the contents of a 21 communication attributable to any of them. The section of the CCAC which does purport to 22 provide Plaintiffs’ “specific factual allegations” is anything but specific. In essence, it is just a list 23 of the named plaintiffs coupled with the same set generalized facts for each one. See CCAC, at ¶¶ 24 103-106. Such allegations do not suffice to “nudge” their CIPA claim “across the line from 25 conceivable to plausible.” Iqbal, 556 U.S. at 680. 26 For these reasons, Plaintiffs have not stated a CIPA claim. 27 28 18 Case No.: 5:12-md-02314-EJD ORDER GRANTING DEFENDANT’S MOTION TO DISMISS 1 IV. ORDER Based on the foregoing, Facebook’s Motion to Dismiss (Docket Item No. 44) is 2 GRANTED as follows: 3 1. The withdrawn claim for violation of the CFAA is DISMISSED WITHOUT 4 LEAVE TO AMEND. 5 2. The claims for invasion of privacy, intrusion upon seclusion, conversion, trespass 6 to chattels, and for violation of the UCL, violation of the CCCL and violation of the CLRA are 7 DISMISSED WITH LEAVE TO AMEND for lack of standing. 8 3. The claims for violation of the Wiretap Act, violation of the SCA and violation of 9 CIPA are DISMISSED WITH LEAVE TO AMEND for failure to state a claim. 10 Facebook’s request for judicial notice (Docket Item No. 45) is DENIED because this 11 United States District Court Northern District of California motion was resolved without relying on those documents. 12 Any amended complaint must be filed on or before November 30, 2015. 13 The court schedules this case for a Case Management Conference at 10:00 a.m. on 14 January 14, 2016. The parties shall file a Joint Case Management Conference Statement on or 15 before January 7, 2016. 16 17 IT IS SO ORDERED. 18 Dated: October 23, 2015 19 20 21 ______________________________________ EDWARD J. DAVILA United States District Judge 22 23 24 25 26 27 28 19 Case No.: 5:12-md-02314-EJD ORDER GRANTING DEFENDANT’S MOTION TO DISMISS

Some case metadata and case summaries were written with the help of AI, which can produce inaccuracies. You should read the full case before relying on it for legal research purposes.

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.