Oral Argument Prep

Question 1

“The SCA was enacted because the advent of the Internet presented a host of potential privacy breaches that the Fourth Amendment does not address.” Your interpretation of “facility” reaches beyond the scope of what was unprotected by the Fourth Amendment and into items, i.e. a plaintiff’s personal computing device, that already has Fourth Amendment protection. (“Data and files on Personal Devices, however, are already protected by the Fourth Amendment and thus outside the SCA’s scope.”) How is this consistent with the purpose of the SCA?

Answer 1

The SCA was clearly intended to do more than just make sure the Fourth Amendment applies to the stored communications. If that was the case then there wouldn’t be a civil cause of action and there wouldn’t be any applicability at all to private actors. In addition, it would only apply to hacks which took place over the Internet. Instead, the SCA had a broader purpose – to protect the privacy of Americans’ stored electronic communications – whether the violation of their privacy was attempted by government actors or private actors – and whether they were attempting to communicate over the Internet or over internal communications networks that aren’t the broader Internet to which people usually refer when they think of electronic communications.

Defendants are also just plain wrong when they argue that “Data and files on Personal Devices are already protected by the Fourth Amendment and thus outside the SCA’s scope.” We believe Data and files on personal devices deserve Fourth Amendment protection, but it remains an open legal question – one which the Supreme Court is set to answer in its current term in two cases, United States v. Wurie and Riley v. California, and in which the Justice Department and State of California argue that smart phones are not covered by the Fourth Amendment.

However, if you assume that Defendants’ argument is true – that the SCA was designed to protect “data and files on Personal Devices not already protected by the Fourth Amendment” – and you look at the current state of the law regarding police searches and Personal Devices, this Court then must still conclude that the Act was intended to cover personal devices.

Question 2

Plaintiffs’ Brief states that websites qualify as ‘users’ of electronic communications. Do the Defendants qualify as users?

Answer 2

They do to the extent they are part of an authorized communication. Defendants argument that they are users hinges on this Court’s acceptance of their argument that they were a party to the plaintiffs’ communications when the plaintiffs were using web-browsers designed specifically to block communications with the Defendants, but Defendants hacked their way past those blocking mechanisms – attempting to manufacture their own exception to the criminal and civil statutes at issue.

Question 3

On the SCA “facilities” issue, you’re essentially saying that almost all of the other courts to look at this have gotten it wrong. Why should we upset what looks to be a growing consensus that Personal Devices aren’t facilities?

Answer 3

There’s not a growing consensus. This is an issue that hasn’t been litigated very many times. And several courts have held that “facilities” includes Personal Devices or anything which serves as a conduit for electronic communications services. The Ninth Circuit got it right in Quon when it explained that a “facility” is anything which served as a “conduit.” The Chance v. Avenue A Court got it right on this issue. Expert Janitorial and Becker v. Toca got it right on this issue. And so did the Court in In re: Intuit Privacy Litigation. Defendant cites cases which hold otherwise, but there’s no clear consensus. And it’s worth noting that none of these decisions – either the ones cited by the Defendants or the ones cited by Plaintiffs – are binding on this Court. This is a question of first impression in this circuit.

Plaintiffs ask for a common sense reading of the statute and additional consideration of both the broad purpose of the SCA (that it was designed to create a cause-of-action against computer hackers) and even the more narrow purpose urged by the Defendants (that it was designed to protect information not protected by the Fourth Amendment at the time of the SCA’s passage). From these, it’s obvious that the Act was intended to cover Personal Devices and any other thing that fits the definition of that “through which an electronic communication service is provided” – including browser-managed files on a personal computer.

The plaintiffs’ definition doesn’t require this Court to add words to the statute that just aren’t there. The Defendant’s, however, ask this Court to add words to the statute on its own. Read closely the Defendants’ leading case for its argument on facilities. In Garcia, the Fifth Circuit said a Personal Device can’t be a provider because the SCA is not designed to protect Personal Devices “that enable the use of an ECS, but instead are facilities that are operated by ECS providers and used to store and maintain electronic storage.” Then look at the actual statute. Where does the statute say a facility only counts if its operated by an ECS? The statute doesn’t include the words “operated by” anywhere with regards to the term “device.” Instead, a device is that “through which an ECS is provided.”

The words “operated by” don’t appear anywhere in the statute. And the reason is simple. The purpose of the statute is to protect the communications of end users. The statute accomplishes this goal by limiting the circumstances in which ECS providers may share a user’s information AND by protecting all facilities through which the ECS is provided.

Question 4

It seems the plaintiffs have pled mutually exclusive facts. Under the Wiretap Act, you have to show an interception while a communication is in the course of delivery. Under the SCA, you have to show access to a communication while it is in storage. How is it possible to have both?

Answer 4

Because modern technology, specifically, packet-switching, allows a communication to be both ‘in transit’ and ‘in storage’ at the same time. The best explanation of this technology and its implications for the ECPA can be found in United States v. Szymuszkiewicz, 622 F.3d 701 (7th Cir. 2010). Either way, Plaintiff’s have the right to file pleadings in the alternative and this is a factual issue to be resolved by expert testimony, not by a Motion to Dismiss for failure to state a claim.

**It’s highly unlikely this question will be asked given that none of the Defendants’ raised it as an issue. However, just in case the Court raises it on its own, I think a quick reference to Szymuszkiewicz would be sufficient and efficient.

Question 5

The plaintiffs’ personal computers and browser-managed files don’t provide an ECS, so how can they qualify for protection under the SCA?

Answer 5

The SCA does not require that a facility be something that’s under the complete control of an ECS. Rather, it only says a facility is that “through which an ECS is provided.” If plaintiffs’ didn’t have computers, browser-managed files, or smartphones, HOW WOULD THEY ACCESS THE INTERNET TO TAKE ADVANTAGE OF AN ELECTRONIC COMMUNICATION SERVICE? They couldn’t. These facilities are vital to the provision of an ECS.

Question 6

Explain why a URL isn’t just addressing information subject to Pen Register but not Wiretap?

Answer 6

This was the issue addressed directly by the FISA Court in the recently Declassified NSA opinion plaintiff’s provided to this Court. In that case, the NSA contended that “dialing, routing, addressing, or signaling information” and “contents” are “mutually exclusive” categories. The terms “dialing, routing, addressing, or signaling information” is important because interception of this information is governed by the Pen Register Act, not the Wiretap Act.

The Defendants in this case make the same argument that the NSA did – and the FISA Court rejected it. A court, which plaintiffs’ note, was designed specifically to determine issues like this with regard to foreign intelligence practices of the United States government.

The FISA Court was right. A URL contains both “DRAS” information and content. The DRAS component comes from the fact that the URL is necessary for the browser and the server to pull up the relevant information. But it’s also “content” because it includes “any information concerning the substance, purport, or meaning of a communication.”

Consider the examples: www.oprah.com/health/Stop-Drinking-How-to-Get-on-the-Path-to-Sobriety or
http://progressivehealth.hubpages.com/How-Do-I-Reduce-Herpes-Breakouts. Clearly these URLs contain information about the substance of the communications between a person who requests such pages and the websites that send the information back.

It is beyond doubt that, with regard to emails, the to/from line of an email is “DRAS” information and the subject line is “content.” URLs essentially combine the to/from line with the subject line. In the examples mentioned today, the web address of oprah.com and hubpages.com, the parent websites present at the start of a URL is the equivalent of the to/from line and the file names of “Stop Drinking – How to Get on the Path to Sobriety” and “How Do I Reduce Herpes Outbreaks” are akin to the subject lines of an email.

Question 7

Plaintiff cites explosive or embarrassing URLs, but most of the time it’s probably boring stuff which no one really cares about. How does this rise to the level of a cause-of-action?

Answer 7

The Wiretap Act and case law are clear. It doesn’t matter whether the intercepted content is exciting or mundane. An intentional interception is enough. A plaintiff doesn’t even need to show that the information obtained is valuable. That’s because the statute is designed to protect privacy and the inherent dignity that comes along with it. We protect privacy because it’s a fundamental American value – and that protection is given teeth against intruding private parties by the Wiretap Act.

Question 8

In Zynga, the Ninth Circuit held that URLs are not content. Why is this case different?

Answer 8

The Zynga opinion supports the plaintiffs’ position in this case. The URLs involved in the Zynga case were all Facebook URLs which followed the template of: www.facebook/username or www.facebook.com/groupname. These Facebook URLs are akin to a URL like a bare www.nytimes.com or www.washingtonpost.com. The URLs at issue in this case contain content because of the detailed file names. The Zynga Court was careful to point out that “under some circumstances, a user’s requests” could contain contain – such as “a search term or similar communication made by the user.” The URLs in this case fall under the circumstances outlined by the Zynga Court.

Question 9

You said the Defendants cases were inapposite because they were Fourth Amendment cases and not Wiretap case. How does the analysis differ?

Answer 9

The Wiretap Act provides statutory protections beyond the minimums guaranteed by the Constitution. The Wiretap Act nowhere limits its protections to mere “expectations of privacy.” “Content” within the Wiretap Act’s protection is not co-extensive with expectations of privacy. Defendant Google is well aware of this distinction. In the Gmail scanning litigation in California, Google successfully argued that Gmail users have no “reasonable expectation of privacy” in emails. The court agreed, and dismissed a state eavesdropping claim. See In re: Google Inc. Gmail Litig., 2013 WL 5423918, at *22 (N.D. Cal. 2013). However, the court allowed a federal Wiretap Act claim to proceed. Id. at *24.

Question 10

There are cases clearly holding that search terms are “content” and thus, protected. But this case is about more than search terms. Why should we extend the protection beyond search terms?

Answer 10

Full-string URLs that contain information like “How to I Reduce Herpes Breakouts” are akin to a search term. In fact, if the plaintiff had typed that very information into their browser, there’d be no doubt that it would be content. Or if they had included it as the subject line of an email. Technology has sped up the process and allows plaintiffs to merely click on a link with those same particular words – but the intent of the web user is the same – they are making a communication to hubpages.com seeking information on how to avoid herpes outbreaks.

Question 11

This is normal, everyday, commonplace activity endorsed by DoubleClick. How does this fall outside that holding?

Answer 11

Double-Click, Inc. (“DoubleClick”), founded in 1995 in New York was one of the first internet ad-serving companies. It quickly became the dominant industry player, and, later, a subsidiary of Defendant Google Inc. (“Google”). DoubleClick’s third-party tracking cookies enabled the interception of users’ communications with external websites, typically without the users’ knowledge. A class action filed in New York on January 31, 2000 alleged that the tracking violated the SCA, the Wiretap Act and the CFAA, along with various state law rights. The Court dismissed the case on the theory of implied consent: “DoubleClick will not collect information from any user who takes simple steps to prevent DoubleClick’s tracking . . . [including] configuring their browsers to block any cookies from being deposited.” In re: DoubleClick Privacy Litigation, 154 F. Supp. 2d 497, 505 (S.D.N.Y. 2001); see also id. at 519 (finding that plaintiffs “consent to DoubleClick’s interceptions” under the Wiretap Act). DoubleClick turned largely on the notion that a user implicitly consents to tracking by not enabling the browser’s easily activated cookie blocking mechanism.

Plaintiffs’ case differs greatly from DoubleClick. Plaintiffs here, unlike the plaintiffs in DoubleClick, used browsers set to block tracking cookies. CAC ¶ 69 (A101). But starting in 2011 (or possibly as early as 2009), five unrelated online ad-serving companies, including the four Defendants-Appellees , developed a multi-step method to secretly hack past the already set, default cookie blocking settings on the Safari and Internet Explorer browsers of many users. Covert tracking followed.

Question 12

Explain how the alleged interceptions worked in plain English.

Answer 12

Safari
The Apple Safari web-browser was designed to block third-party cookies. However, it had an exception for cookies placed by third-party websites after a user filled out a form to that third-party. The Defendants in this case tricked the plaintiffs’ web-browsers by filling out an invisible form that the Defendants’ purported to be the action of the plaintiffs. With this fake form filled out, Safari allowed the third-party defendants to place their tracking cookies.

IE Internet Explorer was also designed to block third-party tracking cookies. However, it allowed an exception where a third-party website’s privacy policy was written in a language that IE did not understand. The defendants in this case knew their cookie privacy policies violated the terms of IE’s third-party tracking cookie rule. However, rather than honestly informing IE of their privacy policies through computer code that IE would recognize, the Defendants wrote their policies in plain English on a part of the Internet that real-world users would never read. Because IE did not understand plain English, it was tricked into permitting Defendants to place their cookies on the plaintiffs’ computers.

Question 13

Defendants argue that iPhone and plaintiffs and this case are reading an “intent” requirement into the one-party consent rule. They say the plain text of the statute does not contain the requirement.

** Vibrant’s Response claims, “When one person communicates something to another, the recipient is, in plain English, a party to that communication – regardless of what caused the communication or whether the sending party intended for the communication to happen. Here, then, it is simply irrelevant for purposes of the Wiretap Act how or why the URLs in question were communicated by Plaintiffs to (Defendants) because, as parties to those communications, (Defendants) were exempted from Wiretap Act liability by the one-party-consent rule, no matter what circumstances led to their receiving the URLs.

Answer 13

The Defendants’ logic is essentially, “We received what the Plaintiff’s sent, therefore we are a recipient.” Accepting the Defendants’ logic, there is no such thing as a Wiretap anywhere. They’ve created a wonderful tautology from their point of view: if you receive it, then you are a party to it. This, however, turns the statute on its head.

Consider a real-world Wiretap where law enforcement gets judicial permission to place a tap on a suspect’s phone. Then, unbeknownst to the subject, when the subject dials a number, the contents of their conversations go to two separate locations – once to the intended recipient of their call, and also to the law enforcement officer tapping their phone call. Under the Defendants’ logic, that law enforcement officer, because he received the communication from the plaintiffs’ phone isn’t actually conducting a wiretap at all. This is absurd logic, which, if accepted, would effectively repeal the Wiretap Act.

Or consider an example from the world of computers. What if the Defendants’ had tricked the plaintiffs’ email programs into sending a copy of every email the plaintiffs sent or received to the Defendants from the plaintiffs’ email program? Under the Defendants’ logic, because the Plaintiffs’ email program had sent the communication, the Defendants would be parties to the communications regardless of what caused that communication. And the Defendants’ would be immune from suit. Defendants’ clever argument was present in the case of United States v. Szymuszkiewicz, where the 7th Circuit found that a Defendant was liable under the Wiretap Act under these exact circumstances.

Question 14

Why aren’t the Wiretap Act and Stored Communications Act mutually exclusive?

Answer 14

Because modern technology, specifically, packet-switching, allows a communication to be both ‘in transit’ and ‘in storage’ at the same time. The best explanation of this technology and its implications for the ECPA can be found in United States v. Szymuszkiewicz, 622 F.3d 701 (7th Cir. 2010).

Question 15

Crispin v. Christian Audiger, Inc., 717 F.Supp.2d 965, 971 (C.D. Cal. 2010)

Answer 15

• Congress enacted the SCA “because the advent of the Internet presented a host of potential privacy breaches that the Fourth Amendment does not address.”

Question 16

Theofel v. Farey-Hones, 359 F.3d 1066, 1072-73 (9th Cir. 2004)

Answer 16

• For elements of claim.

Question 17

Cousineau v. Microsoft Corp., Case No C11-143B-JCC (W.D. Wash. June 22, 2012)

Answer 17

• Congress chose a broad term – facility – because it intended the statute “to cover a particular function, such as Internet access, as opposed to a particular piece of equipment providing that access.”
• SINCE ABANDONED in No. C11-1438, 2014 WL 1232593 at 7 (W.D. Wash. Mar. 25, 2014) (Holding that the plaintiff’s phone – which did not provide ‘services to other users in a server-like fashion, but instead received the relevant services from Microsoft” – was not a facility).

Question 18

Quon v. Arch Wireless Operating Co., Inc., 529 F.3d 892, 902 (9th Cir. 2008)

Answer 18

• Case law provides that under 18 U.S.C. 2701(a), any conduit for an electronic communications service is an SCA “facility.”

Question 19

Chance v. Avenue A, 165 F.Supp.2d 1153, 1161 (W.D. Wash. 2001)

Answer 19

• “[V]iewing this factual dispute in the light most favorable to the non-movant … it is possible to conclude that modern computers, which serve as a conduit for the web server’s communication to Avenue A, are facilities covered under the act.

Question 20

Expert Janitorial, LLC v. Williams, 2010 WL 908740 at 5 (E.D. Tenn. 2010); Becker v. Toca, 2008 WL 4443050 at 4 (E.D. La. 2008).

Answer 20

• “Plaintiff’s computers on which the data was stored may constitute ‘facilities’ under the SCA.”
• “[T]he language of § 2701 of the SCA does not require that a plaintiff’s computers be ‘electronic communications service provider[s],’ rather, what the statute requires is that a plaintiff’s computers or workplace be a ‘facility’ through which an ECS is provided.” Expert Janitorial.

Question 21

In re: iPhone Application Litigation, 844 F.Supp.2d 1040, 1058 (N.D. Cal. 2012)

Answer 21

• District Court conflated “facility” with an “ECS” just as the court did in the iPhone App case

Question 22

In re: Intuit Privacy Litigation, 138 F.Supp.2d 1272, 1282, n. 3 (C.D. Cal. 2001)

Answer 22

• SCA “does not require that plaintiffs’ computers be ‘communication service providers’ only that they be a facility through which an electronic communications service is provided.”

Question 23

Crowley v. Cybersource Corp., 166 F.Supp.2d 1263, 1270 (N.D. Cal. 2001)

Answer 23

• A fundamental point that the District Court overlooked is that most websites clearly qualify as “users” of electronic communication services because, in order to communicate with Internet users, web sites must use the services of some other entity. Crowley v. Cybersource Corp, 166 F.Supp.2d 1263, 1270 (N.D. Cal. 2001)(Amazon.com was a “user” of an ECS, not a provider.)

Question 24

Sherman & Co. v. Salton Maxim Housewares, Inc., 94 F.Supp.2d 817, 820 (E.D. Mich. 2000)

Answer 24

• Purpose of SCA “to create a cause of action against computer hackers.”

Question 25

Freedman v. AOL, 325 F.Supp.2d 638, 643 (E.D. Va. 2004)

Answer 25

• The SCA prohibits disclosures of subscriber information and the contents of subscriber communications by electronic communication service providers “unless the disclosure comes within one of the six exceptions set forth in § 2702(c).”

Question 26

Garcia v. City of Laredo, Tex., 702 F.3d 788, 792 (5th Cir. 2012); Quon v. Arch Wireless Operating Co., Inc., 529 F.3d 892, 901-03 (9th Cir. 2008); U.S. v. Steiger, 318 F.3d 1039, 1049 (11th Cir. 2003)

Answer 26

• Courts to consider the question have consistently held that ECS providers are third-party entities that provide a service enabling their users or subscribers to send or receive electronic communications.
• REPLY: Agree with requirements. Apple Safari and Microsoft IE fit the requirements.

Question 27

Garcia v. City of Laredo

Answer 27

• “The relevant ‘facilities’ that the SCA is designed to protect are not computers [or mobile devices] that enable the use of an ECS, but instead are the facilities that are operated by [ECS] providers and used to store and maintain electronic storage.”
• REPLY: This adds words to the statute that just aren’t there. The stature prohibits access to “a facility through which an ECS is provided.” The words “operated by” don’t appear anywhere in the statute. And the reason is simple. The purpose of the statute is to protect the communications of end users. The statute accomplishes this goal by limiting the circumstances in which ECS providers may share a user’s information AND by protecting all facilities through which the ECS is provided.

Question 28

iPhone Application Litigation

Answer 28

• Personal Devices are not “operated by” ISPs or other ECS providers. The notion that Personal Devices (or files stored on them) are “operated by” web-browsers – the purported ECS providers here – is even more preposterous.
• REPLY: Again, Defendants attempt to add a requirement to the statute that just doesn’t exist in real-life. The statute says, “a facility through which an ECS is provided.” It does not say “a facility operated by an ECS provider and through which such ECS is provided.”

Question 29

Cousineau – 2014

Answer 29

• Holding that cell phones could be facilities would “lead to the anomalous result that [the relevant ECS provider] could grant third parties access to Plaintiff’s cell phone.”
• REPLY: Wrong. ECS provider could grant access to facility only to extent to which it’s used for purpose of providing the ECS – and limited to circumstances listed in statute and business reality.

Question 30

Crowley

Answer 30

• “It would certainly seem odd that the provider of a communication service could grant access to one’s home computer to third-parties, but that would be the result of [plaintiff’s] argument.”
• Defendant Amazon had not “accessed plaintiff’s computer” at all because the plaintiff had “sent his information to Amazon electronically.” As in Crowley, the allegations here show that Defendants merely “received a voluntary transmission of information Plaintiff’s web-browsers.”
• REPLY: Wrong. ECS provider could grant access to facility only to extent to which it’s used for purpose of providing the ECS – and limited to circumstances listed in statute and business reality.

Question 31

United States v. Steiger, 318 F.3d 1039, 1049 (11th Cir. 2003)

Answer 31

• The SCA “does not appear to apply to … hacking into [a personal] computer.”
• Child porn case. SCA portion only a tiny part.

Question 32

Freedom Banc Mort. Servs., Inc. v. O’Harra, No. 11-1073, 2012 WL 3862209 at 9 (S.D. Ohio Sept. 5, 2012); Shefts v. Petrakis, No. 10-1104, 2013 WL 489610 at 4 (C.D. Ill. Feb. 8, 2013).

Answer 32

• “The relevant facilities that the SCA is designed to protect are not computers that enable the use of an ECS, but instead are facilities that are operated by ECS providers and used to store and maintain electronic storage.”

Question 33

C.A.I.R. v. Gaubatz, 793 F.Supp.2d 311, 334-35 (D.D.C. 2011)

Answer 33

• No SCA claim if access was only to plaintiffs’ computers.

Question 34

Fraser v. Nationwide Mut. Ins. Co., 135 F.Supp.2d 623, 636 (E.D. Pa. 2001)

Answer 34

• The SCA “covers a message that is stored in intermediate storage temporarily, after the message is sent by the sender, but before it is retrieved by the intended recipient.” Communications in “post-transmission storage” are “not in temporary, intermediate storage.”

Question 35

Danvers Motor Co., Inc. v. Ford, 432 F.3d 286, 291 (3d Cir. 2005)

Answer 35

“Injury-in-fact is not Mt. Everest.”

Question 36

Warth v. Seldin, 422 U.S. 490, 500 (1975)

Answer 36

• The strength or weakness of the merits have nothing to do with standing.
• Defendants’ privacy invasions, in violation of statutory prohibitions, suffice for statutory standing, with or without plaintiffs’ financial harm.
• For statutory standing, “the question” is simply whether the statutes under which plaintiffs alleged their claims “grant persons in the plaintiff’s position a right to judicial relief.” If plaintiffs are subject to those statutes’ protections, plaintiffs have standing to claim under them. Merits come later.

Question 37

Lujan v. Defenders of Wildlife, 504 U.S. 555, 561 (1992)

Answer 37

• Defendants’ privacy invasions, in violation of statutory prohibitions, suffice for statutory standing, with or without plaintiffs’ financial harm.

Question 38

United States v. SCRAP, 412 U.S. 669, 689 n. 14 (1972)

Answer 38

• Plaintiffs needs only show an “identifiable trifle” of harm for standing with specificity at least equal to requisite ‘generalized allegations of harm.’ Warth and Lujan.

Question 39

Griswold v. Connecticut, 381 U.S. 479, 486 (1965)

Answer 39

• The ‘right to privacy’ is foundational in American jurisprudence and reflected in numerous common law doctrines, the Wiretap Act, SCA, CFAA, and state statutes at issue here, and United States Supreme Court opinions.
• From Griswold, “We deal with a right of privacy older than the Bill of Rights – older than our political parties, older than our school system.”

Question 40

Kewanee Oil Co. v. Bicron Corp., 416 U.S. 470, 487 (1974)

Answer 40

• The right to privacy is a “fundamental human right” worthy of protection against “industrial espionage.”
• “A most fundamental human right, that of privacy, is threatened when industrial espionage is condoned or is made profitable; the state interest in denying profit to such illegal ventures is unchallengeable.”

Question 41

Alston v. Countrywide Financial Corp., 585 F.3d 753, 763 (3d Cir. 2009)

Answer 41

• “A plaintiff need not demonstrate that he or she suffered actual monetary damages, because ‘the actual or threatened injury required by Article III may exist solely by virtue of statutes creating legal rights, the invasion of which creates standing.”
• For statutory standing, determining injury-in-fact is fundamentally a matter of statutory interpretation, not a free-form search for and weighing of some unidentified extra-statutory injury. From Alston, “The overriding question before us is whether Congress intended to create a private right of action for a consumer who alleged a violation of RESPA section 8 in connection with his or her settlement, even if that violation does not result in a traditional monetary injury … Countrywide does not seriously dispute that, if we answer that question in the affirmative, plaintiffs … will have alleged an injury-in-fact sufficient for purposes of Article III standing.”

Question 42

Low v. LinkedIn, 900 F.Supp.2d 1010, 1021 (N.D. Cal. 2012)

Answer 42

• “Because Plaintiffs have alleged that their information has been disclosed to third parties by LinkedIn’s policies, Plaintiffs have sufficiently articulated, with particularity, injury as to themselves for the purposes of Art. III standing.”

Question 43

Fraley v. Facebook, 830 F.Supp.2d 785 (N.D. Cal. 2011)

Answer 43

• Facebook “Sponsored Stories” litigation; plaintiffs sufficiently alleged concrete injury in that stolen PII had value to the victims – they could have monetized the misappropriated data if they chose even though no out-of-pocket losses alleged.”

Question 44

Fineman v. Sony, 2012 WL 424563 at *3, n. 1 (N.D. Cal. 2012)

Answer 44

• Citing Fraley that plaintiffs “had adequately alleged a right to be paid for their endorsements .. That right was concrete and particularlized.”

Question 45

Del Vecchio v. Amazon, 2012 WL 1997697 *2 (W.D. Wash., June 1, 2012)

Answer 45

• Plaintiff’s alleged defendants’ violation of Plaintiffs’ financial interests. At this pleadings stage, those allegations must be deemed true, and they sufficiently allege economic injury from the defendant’s conduct.

Question 46

Claridge v. RockYou, 785 F.Supp.2d 855, 861-62 (N.D. Cal. 2011)

Answer 46

• Plaintiff’s alleged defendants’ violation of Plaintiffs’ financial interests. At this pleadings stage, those allegations must be deemed true, and they sufficiently allege economic injury from the defendant’s conduct.

Question 47

Rhodes v. Graham, 37 S.W.2d 46, 47 (Ky. App. 1931)

Answer 47

• Even absent economic harm, plaintiffs have standing to bring a claim for invasion of privacy alone. Though defendants characterize this case as being about “loss of PII, without more,” this case is about the defendants’ invasion of the plaintiffs’ fundamental human right to privacy.
• “It is the legal right of every man to enjoy social and business relations with his friends, neighbors, and acquaintances, and he is entitled to converse with them without molestation by intruders.”

Question 48

Fowler v. Southern Bell Telephone, 343 F.2d 150, 155 (5th Cir. 1965)

Answer 48

• Publication, commercialization, or use of information wrongfully obtained is not necessary to state a cause of action for invasion of privacy.
• “Publication or commercialization may aggravate, but the individual’s right to privacy is invaded and violated nevertheless in the original act of intrusion.”

Question 49

Pearson v. Dodd, 410 F.2d 701, 705 (D.C. 1969)

Answer 49

• What plaintiffs intended to keep private is no longer so. Alleging intrusion, itself, suffices because “the tort is completed with the obtaining of the information by improperly intrusive means.” What the eavesdropper overhears is irrelevant to liability; intrusion alone triggers liability.

Question 50

Gaos v. Google, 2012 WL 1094646 at *3 (N.D. Cal. 2012)

Answer 50

• Google argues that plaintiff has failed to allege any injury resulting from the SCA violation. Google, however, has not cited any authority supporting its argument that injury beyond a violation of the SCA itself is required to allege a concrete injury. The court finds that the SCA creates a right to be free from the unlawful disclosure of communications as prohibited by the statute. The SCA explicitly creates a private right of action for persons aggrieved by a disclosure of their communications in violation of the statute. 18 U.S.C. § 2702(a) (providing that “any … person aggrieved by any violation of this chapter” may maintain a civil action if the violation was done knowingly or intentionally). Google’s argument fails because the SCA provides a right to judicial relief based only on a violation of the statute without additional injury. Thus, a violation of one’s statutory rights under the SCA is a concrete injury.

Question 51

Jewel v. NSA, 2011 WL 6848406 at *4 (9th Cir. 2011), 673 F.3d 902 (9th Cir. 2011)

Answer 51

• Finding violation of the SCA to be a concrete injury.
• Both the ECPA and the FISA prohibit electronic interception of communications absent compliance with statutory procedures. The SCA likewise prohibits the government from obtaining certain communication records. Each statute explicitly creates a private right of action for claims of illegal surveillance. See 18 U.S.C. § 2520 (the ECPA provides a cause of action to “any person whose . . . communication is intercepted, disclosed, or intentionally used”); 50 U.S.C. § 1801(k) (the FISA provides that “[a]n aggrieved person . . . who has been subjected to an electronic surveillance or about whom information obtained by electronic surveillance of such person has been disclosed or used in violation of section 1809 of this title shall have a cause of action against any person who committed such violation”); 18 U.S.C. § 2707(a) (the SCA provides that “any provider of electronic communication service, subscriber, or other person aggrieved by any violation of this chapter” may maintain a civil action if the violation was done knowingly or intentionally).

Question 52

Danvers Motor Co. v. Ford

Answer 52

• Danvers Motor highlights the defect in Plaintiffs’ case. The Court there found injury-in-fact because the ‘complaint was replete with assertions of cognizable harm,’ such as facts showing the defendant ‘forced plaintiffs to spend money against their will,’ including a detailed ‘break down of the specific amount of money spent per plaintiff,’ amounting to tens of thousands of dollars per plaintiff. Plaintiffs here allege no such facts – nor could they.
REPLY: Invasion of privacy is a cognizable harm recognized by the United States Supreme Court.

Question 53

Storino v. Borough of Point Pleasant Beach, 322 F.3d 293, 296 (3d Cir. 2003)

Answer 53

• Plaintiffs cannot satisfy Article III merely by alleging that they ‘have suffered damages’ where there is no factual support for that in the Complaint.
REPLY: Storino is about a challenge to local zoning laws in which the plaintiffs did not allege any current injury as a result of an ordinance which made their commercial properties non-conforming uses.

Question 54

Friends of the Earth v. Laidlaw, 528 U.S. 167 (2000)

Answer 54

• Plaintiffs argue (with no support from the Complaint) that the BGI they sent to Google is a ‘tradable commodity.” This is precisely the kind of “conjectural or hypothetical” assertion that cannot support standing. Plaintiffs cannot point to any “actual or imminent” trading opportunity that was lost or diminished because they had a cookie on their browser. Instead, Plaintiffs’ theory would require the Court to improperly speculate that if each named plaintiff were in the practice of collection the same BGI that they voluntarily gave to Google in this case, and if there were a buyer willing to pay or trade with each named plaintiff directly to obtain this BGI, and if a hypothetical transaction involving this BGI occurred, then Plaintiffs would have received less value for their BGI than if they never had a Google cookie on their browser.
• But, as this Court has repeatedly held, where “one cannot describe how the plaintiffs will be injured without beginning the explanation with the word ‘if’ … the prospective damages, described by the plaintiffs as certain are, in reality, conjectural.”
• Plaintiffs theory invites an additional level of improper speculation. It turns on whether an independent third party would be willing to pay Plaintiffs for the BGI at issue. The Supreme Court has rejected such “standing theories that rest on speculation about the decisions of independent actors.” Clapper.
REPLY: Third-party standing lawsuit – association on behalf of its members. Supreme Court held that it was enough for plaintiffs to assert in sworn statements they had used the area and are persons “for whom the aesthetic and recreational values of the area” would be lessened by the activity that was the subject of the lawsuit. If natural beauty without monetary damages is enough, so too is invasion of privacy. The Supreme Court also

Question 55

Reilly v. Ceridian, 664 F.3d 38 (3d Cir. 2011)

Answer 55

• No injury-in-fact where private information was accessed without authorization because actual detriment to plaintiff was not “certainly impending.”
• In Reilly, “a hacker infiltrated defendant’s computer system and potentially gained access to plaintiffs’ personal and financial information. The Court held that there was no Article III injury. That is because plaintiff must do more than make nebulous allegations that their “privacy” was invaded; they must allege facts showing an actual ‘detriment’ to them resulting from the alleged invasion.
• But, as this Court has repeatedly held, where “one cannot describe how the plaintiffs will be injured without beginning the explanation with the word ‘if’ … the prospective damages, described by the plaintiffs as certain are, in reality, conjectural.”
REPLY: Reilly involved hacking into a third party’s computer system for information that the third-party had on the plaintiff. This case involves hacking into the plaintiff’s own realm of privacy.

Question 56

Clapper v. Amnesty Int’l USA, 133 S.Ct 1138, 1149 (2013)

Answer 56

• Plaintiffs theory invites an additional level of improper speculation. It turns on whether an independent third party would be willing to pay Plaintiffs for the BGI at issue. The Supreme Court has rejected such “standing theories that rest on speculation about the decisions of independent actors.” Clapper.
• Clapper involved a claim brought by Amnesty International which challenged provisions of the Patriot Act which the plaintiffs claimed created an objectively reasonable likelihood that their communications with non U.S. citizens would be acquired at some time in the future. The Supreme Court rejected the claim:
Respondents assert that they can establish injury in fact because there is an objectively reasonable likelihood that their communications will be acquired under § 1881a at some point in the future. But respondents’ theory of future injury is too speculative to satisfy the well-established requirement that threatened injury must be “certainly impending.” E.g., Whitmore v. Arkansas, 495 U. S. 149, 158 (1990). And even if respondents could demonstrate that the threatened injury is certainly impending, they still would not be able to establish that this injury is fairly traceable to § 1881a. As an alternative argument, respondents contend that they are suffering present injury because the risk of § 1881a-authorized surveillance already has forced them to take costly and burdensome measures to protect the confidentiality of their international communications. But respondents cannot manufacture standing by choosing to make expenditures based on hypothetical future harm that is not certainly impending. We therefore hold that respondents lack Article III standing.
REPLY: The Clapper case involved plaintiffs who did not whether their communications had been intercepted or not. This case doesn’t involve a hypothetical, but rather hacking that the Defendants have admitted publicly.

Question 57

In re: Google Inc. Privacy Policy Litigation, 2012 WL 6738343 at *5 (N.D. Cal. December 28, 2012)

Answer 57

• Courts routinely dismiss cases like this one under Article III where a plaintiff alleges nothing more than the speculative conclusion that the value of “personal information” was diminished by its collection and use.
• No standing where claims are “based on nothing more than the unauthorized disclosure of personal information; let alone an unauthorized disclosure by a defendant to itself.”
REPLY: Court found standing where plaintiffs alleged additional battery and bandwidth consumption caused by their Android devices sending their PII to app developers without authorization. “Unauthorized use of system resources can suffice to establish a cognizable injury.” Ruled against Wiretap because Google was the ECS provider and alleged “interceptions” fell under exception for “devices” used by an ECS “in the ordinary course of its business.” In other words, Google couldn’t Wiretap itself. With the SCA claim, no liability because Google shared the information with itself and authorized itself to aggregate the users’ information. Regarding the plaintiffs’ Intrusion Upon Seclusion claim, the Court explained that there was no plausible expectation of privacy “in light of Google’s earlier disclosure that it would commingle PII across products to support its advertising model.”

Question 58

Low v. LinkedIn Corp., 2011 WL 5509848 at *3-4 (N.D. Cal. Nov. 11, 2011)

Answer 58

• Courts routinely dismiss cases like this one under Article III where a plaintiff alleges nothing more than the speculative conclusion that the value of “personal information” was diminished by its collection and use.
• Dismissing for lack of standing claims that relied on general allegations that consumer information is valuable.
• Low v. LinkedIn II, 900 F.Supp.2d 1010, 1021 (N.D. Cal. 2012), held that plaintiffs had Art. III standing, but still failed to state a claim.
REPLY: In Low v. LinkedIn II, the Court held that the plaintiff had Article III standing under the SCA and for the general “invasion of a personal constitutional right – such as the … Fourth Amendment right to be free from unreasonable searches and seizures.”

Question 59

In re: JetBlue Airways Corp. Privacy Litigation, 379 F.Supp.2d 299, 327 (E.D. N.Y. 2005)

Answer 59

• Courts routinely dismiss cases like this one under Article III where a plaintiff alleges nothing more than the speculative conclusion that the value of “personal information” was diminished by its collection and use.
• Rejecting argument “that an individual airline passenger’s personal information has or had any compensable value in the economy at large.”
REPLY: This case is completely inapposite. It’s not about “content” of communications. ECPA claim dismissed because court found that airlines are not subject to SCA claims because they are not “electronic communication service” providers. The Court dismissed a state unfair business practices act claim because it was pre-empted by federal aviation law. Court also dismissed three common law claims of breach of contract, unjust enrichment, and trespass to property.

Question 60

LaCourt v. Specific Media, Inc., 2011 WL 1661532 (C.D. Cal. April 28, 2011)

Answer 60

In LaCourt, plaintiffs accused an online third-party advertising network of installing cookies on their computers to circumvent user privacy controls and to track Internet use without user consent. The Court held that plaintiffs lacked Article III standing because (1) they had not alleged that any named plaintiff was actually harmed by the defendant’s alleged conduct and (2) they had not alleged any “particularized example” of injury, but instead offered only abstract concepts, such as “opportunity costs,” “value-for-value exchanges,” “consumer choice,” and “diminished performance.” Plaintiffs do not explain how they were ‘deprived’ of the economic value of their personal information simply because their unspecified personal information was purportedly collected by a third-party.”
REPLY: LaCourt is inapposite and the result of a poorly-pled complaint and argument by plaintiffs. LaCourt involved claims under the CFAA, California Computer Crime Law, Invasion of Privacy Act, Trespass to Chattels, and Unjust Enrichment. It did not involve Wiretap, SCA, Intrusion Upon Seclusion, Invasion of Privacy, Unfair Competition, or the California Consumer Legal Remedies Act claims. As the LaCourt Court explained:

The parties … engage in a quasi-philosophical debate about the possible value of consumers’ personal information on the Internet. Ultimately, the Court probably would decline to say that it is categorically impossible for Plaintiffs to allege some property interest that was compromised by Defendant’s alleged practices. The problem is, at this point they have not done so. Plaintiffs – who have more or less completely accepted Defendant’s framing of the issue – make the problematic argument that ‘by taking and retaining Plaintiff’s personal information” i.e. their browsing history, Defendant has deprived Plaintiffs of this information’s economic value. … While the Court would recognize the viability in the abstract of such concepts as “opportunity costs,” “value-for-value exchanges,” “consumer choice,” and other concepts referred to in the Opposition, what Plaintiffs really need to do is to give some particularized example of their application in this case.”

Defendant aptly notes that the Complaint does not identify a single individual who was foreclosed from entering into a “value-for-value exchange” as a result of Specific Media’s alleged conduct. Furthermore, there are no facts in the FACC that indicate that the Plaintiffs themselves ascribed an economic value to their unspecified personal information. Finally, even assuming an opportunity to engage in a “value-for-value exchange,” Plaintiffs do not explain how they were “deprived” of the economic value of their personal information simply because their unspecified personal information was purportedly collected by a third party.”

Question 61

Del Vecchio v. Amazon, 2011 WL 6325910 (W.D. Wash. Dec. 1, 2011)

Answer 61

• In Del Vecchio I, plaintiffs accused Amazon of placing tracking cookies on their browsers “against their wishes by ‘exploiting’ a known frailty in the cookie-filtering function’ of the browsers in order to collect plaintiffs’ browsing history and other allegedly personal information. Plaintiffs alleged that Amazon’s use of cookies to obtain their information caused them “economic harms,” including “lack of proper value-for-value exchanges, undisclosed opportunity costs, devaluation of personal information, and loss of the economic value of the information as an asset.” The Court dismissed the complaint, “While it may be theoretically possible that Plaintiff’s information could lose value as a result of its collection and use by Defendant, Plaintiffs do not plead any facts from which the Court can reasonably infer that such devaluation occurred in this case.”
• Plaintiffs here make the same deficient allegations about diminished value of their personal information. Plaintiffs allege no facts to show that anyone was willing to pay them specifically for their limited, anonymous, individual browsing history allegedly obtained by Google. Nor do they allege any facts showing that they attempted to sell that information and were unable to do so because of Google’s alleged actions. While Plaintiffs make several allegations about the purported quantifiable value of other types of information related to online activities, they identify no lost opportunity to sell their history of visiting websites that display Google ads – the information at issue here. In short, as the District Court concluded, “plaintiffs have not sufficiently alleged that the ability to monetize their PII has been diminished or lost by virtue of Google’s [alleged conduct].”
REPLY: Inapposite. Del Vecchio case involved claims under the CFAA, trespass to chattels, state consumer protection, and unjust enrichment where the Defendant had notified visitors to its website of the very actions that formed the basis of plaintiffs’ complaint. In Del Vecchio II, the Court found that plaintiff had met test for Art. III standing, but failed to state a CFAA or trespass to chattels claim. Regarding the state consumer protection claim, the Court explained, “The Court finds that Plaintiffs can only allege an injury if they can demonstrate that Defendant accessed their computers or their information without authorization. And, the issue of authorization is quite complicated.” The Court gave Plaintiffs opportunity to present further material on their consumer protection and unjust enrichment claims. The case later settled on undisclosed terms.

Question 62

Reilly v. Ceridian, 664 F.3d 38 (3d Cir. 2011)

Answer 62

• No injury-in-fact where private information was accessed without authorization because actual detriment to plaintiff was not “certainly impending.”
• In Reilly, “a hacker infiltrated defendant’s computer system and potentially gained access to plaintiffs’ personal and financial information. The Court held that there was no Article III injury. That is because plaintiff must do more than make nebulous allegations that their “privacy” was invaded; they must allege facts showing an actual ‘detriment’ to them resulting from the alleged invasion.
• But, as this Court has repeatedly held, where “one cannot describe how the plaintiffs will be injured without beginning the explanation with the word ‘if’ … the prospective damages, described by the plaintiffs as certain are, in reality, conjectural.”
REPLY: Reilly involved hacking into a third party’s computer system for information that the third-party had on the plaintiff. This case involves hacking into the plaintiff’s own realm of privacy.

From our Reply: Defendants cite no circuit court that has required a showing of monetary harm when faced with state common law privacy claims. Every appellate decision Defendant cites addressed completely distinguishable threats of future harm.

Question 63

Doe v. Chao, 540 U.S. 614, 624 (2004)

Answer 63

• Plaintiff asserting violation of privacy rights under federal law must show he has suffered an “adverse effect” to satisfy Article III.

REPLY: The Doe v. Chao case involved the Privacy Act of 1974, creating a cause-of-action solely against governmental entities and contains different language than the ECPA, SCA, and CFAA. And the Supreme Court explicitly explains as much by rejecting the plaintiff’s comparison to the ECPA / SCA.

More importantly for plaintiffs, dicta from Doe v. Chao supports plaintiffs’ theory of Article III standing in common law privacy cases. “Traditionally, the common law has provided such victims with a claim for ‘general’ damages, which for privacy and defamation torts are presumed damages: a monetary award calculated without reference to specific harm.” Footnote 3 to this sentence then explains that the Restatement of Torts noted that damages for privacy torts are available “’in the same in which general damages are given for defamation,” without proof of ‘pecuniary loss [or] physical harm’.”

Question 64

Doe v. Nat’l Board of Med. Exam’rs, 199 F.3d 146, 153 (3d Cir. 1999)

Answer 64

• It is “incorrect” to “equate a violation of a statute with an injury sufficient to confer standing; the proper analysis of standing focuses no whether the plaintiff suffered an actual injury, not on whether a statute was violated.”
REPLY: From our Reply brief:
For statutory standing, determining injury-in-fact is fundamentally a matter of statutory interpretation, not a free-form search for and weighing of some unidentified extra-statutory injury. From Alston, “The overriding question before us is whether Congress intended to create a private right of action for a consumer who alleged a violation of RESPA section 8 in connection with his or her settlement, even if that violation does not result in a traditional monetary injury … Countrywide does not seriously dispute that, if we answer that question in the affirmative, plaintiffs … will have alleged an injury-in-fact sufficient for purposes of Article III standing.” Defendants essentially ignore this statutory standing rule. Defendants point to no language in the Wiretap Act, SCA, or CFAA excluding plaintiffs from the privacy protections of those statutes.
Cite Gaos v. Google – The Defendant Google lost this exact argument in Gaos v. Google, an SCA case.

Question 65

Sterk v. Best Buy Stores, L.P, 2012 WL 5197901 at *5 (N.D. Ill. Oct. 17, 2012)

Answer 65

• Plaintiff must plead both an injury and a statutory violation to meet the standing requirement of Article III for an SCA claim.
REPLY: Context matters. Defendants misstate the holding of this case. This was a VPPA case. Plaintiff sued defendant under the VPPA for (1) disclosing his video history to itself, and (2) retaining his video history longer than allowed by the VPPA. The Court found that a Defendant can’t be liable for disclosure to its corporate parent, and that the SCA’s cause-of-action provision did not apply to VPPA retention violations. The Court then later wrote, “[T]he SCA and the VPPA require a plaintiff to be ‘aggrieved,’ meaning the individual has suffered an Art. III injury-in-fact.” But, “[n]one of the Plaintiff’s theories establishes an injury-in-fact for his disclosure or retention claims under the VPPA.” This case is different because there’s an actual privacy violation at issue – that is clearly covered by the SCA’s cause-of-action provision.

Question 66

Hill v. NCAA, 7 Cal.4th 1, 15, 21 (1994)

Answer 66

• “The principal focus of the Privacy Initiative is readily discernible … unnecessary information gathering by public and private entities … computer stored and generated dossiers and cradle-to-grave profiles on every American dominate the framers’ appeal to the voters. The evil addressed is … business conduct in collecting and stockpiling unnecessary information …. The Privacy Initiative’s primary purpose is to afford individuals some measure of protection against this most modern threat to personal privacy.”
• “Legally recognized privacy interests consist generally of two classes: (1) interests in precluding the dissemination or misuse of sensitive and confidential information (‘informational privacy’); and (2) interests in making intimate personal decisions or conducting personal activities without observation, intrusion, or interference (‘autonomy privacy’).
• “A California privacy claim, thus, is “not so much one of total secrecy as it is of the right to define one’s circle of intimacy – to choose who shall see beneath the quotidian mask.”
• “Whether … a defendant’s conduct constitutes a serious invasion of privacy is a mixed question of law and fact.” Only when the undisputed material facts show insubstantial impact on privacy interests can the question of invasion be decided as a matter of law. This analysis requires discovery and a factual record because the facts about the extent and gravity of the invasion are indispensable in assessing the invasion.

Question 67

Low v. LinkedIn Corp., 900 F.Supp.2d 1010, 1025 (N.D. Cal. 2012)

Answer 67

• California law “set[s] a high bar for an invasion of privacy claim.”
• “Disclosure of personal information, including social security numbers, does not constitute an ‘egregious breach of the social norms’ to establish an invasion of privacy claim.’
REPLY: This case is about more than disclosure. It’s about interception and unauthorized access to the communications.

Question 68

Hill

Answer 68

• “Actionable invasions of privacy must be sufficiently serious in their nature, scope, and actual or potential impact to constitute an egregious breach of the social norms underlying the privacy right.”
• Whether a legally recognized privacy interest is present in a given case is a question of law to be decided by the court.
REPLY: Agree. Defendants Media Innovation Group and Vibrant Media recognized the plaintiffs’ privacy rights when they argued that the SCA does not apply because Personal Devices are covered by the Fourth Amendment. Plaintiffs also have several other sources of legally-recognized privacy interests in federal and state statutes and Supreme Court case law.

Question 69

Fogelstrom v. Lamps Plus, Inc., 125 Cal. Rptr. 3d 260 (Cal. Ct. App. 2011)

Answer 69

• Privacy claims failed because plaintiff could not show alleged conduct was “highly offensive.”
REPLY: In Lamps Plus, the defendant retail store asked for plaintiff’s zip code for purposes of sending direct mail to plaintiff. The Court found that plaintiff didn’t have a serious privacy interest in their home address. There’s a huge difference between a mere home address and the surreptitious Internet tracking at issue in this case.

Question 70

U.S. v. Forrester, 412 F.3d 500, 510 (9th Cir. 2008)

Answer 70

• Plaintiffs cannot claim that Google invaded a private matter when it was the recipient of the BGI they voluntarily sent in their requests to Google.
• Cites Forrester for holding that “the to/from addresses of [Internet users’] messages or the IP addresses of the websites they visit” are not private.
• Also citing TBG Ins. Servs. Corp. v. Superior Court, 117 Cal. Rptr.2d 155, 164 (Cal. Ct. App. 2002).
REPLY: See Wiretap and SCA argument summaries. Also, we’re not talking about to/from addresses of emails or IP addresses of websites. We’re talking about the equivalent of email subject lines and file paths. In a footnote, Forrester supports our position that this case is different.

Question 71

London v. New Albertson’s Inc., 2008 WL 4492642 at 8 (S.D. Cal. Sept. 30, 2008)

Answer 71

• Google obtained no “private” personal information by using cookies. Google only received the cookie values themselves, which were previously known to Google.
• Plaintiffs cannot demonstrate any protected privacy interest in preventing Google from ‘associating’ multiple instances of anonymous BGI voluntarily sent by Plaintiffs’ browsers.
• No protected privacy interest in preventing pharmacy from correlating consumers’ anonymous drug prescription information.
REPLY: See Wiretap and SCA argument summaries. This case is different anyway. Google is a third-party interloper to the communications the plaintiffs had with websites in question.

Question 72

Google Privacy Policy, 2012 WL 6738343 at 5

Answer 72

• Plaintiffs could not “identify a concrete harm from the alleged combination of their personal information across Google’s products.”
REPLY: See Standing argument summary.

Question 73

Defendant Citations
Plaintiffs Cannot Allege Facts Showing a “Serious” and “Highly Offensive” Invasion of Their Privacy Because the Use of Cookies is Routine

• The practice of showing interest-based ads based on anonymous, correlated BGI is well-known and ubiquitous.
• Citing Pharmatrak, Chance v. Avenue A, and DoubleClick

Answer 73

REPLY: Plaintiffs are not challenging the consensual use of tracking cookies. The behavior at issue in this case is far different in that Defendant’s tracking was non-consensual and was only achieved by the Defendants’ surreptitious hacking around the privacy controls employed by plaintiffs’ chosen web-browsers. This hacking not only tricked the plaintiffs’ browsers, it was also done in contravention to the Defendants’ public statements about their activity and without the knowledge of the websites from which Google achieved its hack. Plaintiff’s CAC includes statements made by companies of websites that did not know of Google’s activity and statements from Apple and Microsoft condemning this practice of Google and the other defendants. In addition, Defendants’ actions resulted in the largest fine in the history of the FTC and the largest privacy settlement with state Attorneys General in history. That’s not “well-known and ubiquitous” behavior.

Question 74

Hill v. NCAA, 7 Cal.4th 1, 15, 21 (1994)

Answer 74

• “The principal focus of the Privacy Initiative is readily discernible … unnecessary information gathering by public and private entities … computer stored and generated dossiers and cradle-to-grave profiles on every American dominate the framers’ appeal to the voters. The evil addressed is … business conduct in collecting and stockpiling unnecessary information …. The Privacy Initiative’s primary purpose is to afford individuals some measure of protection against this most modern threat to personal privacy.”
• “Legally recognized privacy interests consist generally of two classes: (1) interests in precluding the dissemination or misuse of sensitive and confidential information (‘informational privacy’); and (2) interests in making intimate personal decisions or conducting personal activities without observation, intrusion, or interference (‘autonomy privacy’).
• “A California privacy claim, thus, is “not so much one of total secrecy as it is of the right to define one’s circle of intimacy – to choose who shall see beneath the quotidian mask.”
• “Whether … a defendant’s conduct constitutes a serious invasion of privacy is a mixed question of law and fact.” Only when the undisputed material facts show insubstantial impact on privacy interests can the question of invasion be decided as a matter of law. This analysis requires discovery and a factual record because the facts about the extent and gravity of the invasion are indispensable in assessing the invasion.

Question 75

In re: Pharmatrak, Inc., 329 F.3d 9 (1st Cir. 2003)

Answer 75

• The paramount objective of the Wiretap Act “is to protect effectively the privacy of communications.”
• Elements: (1) intentionally (2) intercepted, endeavored to intercept or procured another person to intercept or endeavor to intercept (3) the contents of (4) an electronic communication (5) using a device.

Question 76

Declassified Opinion from the United States Foreign Intelligence Surveillance Court

Answer 76

• “The breadth of the terms used by Congress to identify categories of information subjection to collection and to define ‘contents’ reinforces the conclusion that DRAS and contents are not mutually exclusive categories.”
• “Given the breadth of the terms used in the statute, it is not surprising that courts have identified forms of information that constitute both DRAS and contents. In the context of Internet communications, a Uniform Resource Locator (URL) – “an address that can lead you to a file on any computer connected to the Internet” – constitutes a form of “addressing information” under the ordinary meaning of that term. Yet, in some circumstances a URL can also include “contents” as defined in section 2510(8). In particular, if a user runs a search using an Internet search engine, the “search phrase would appear in the URL after the first forward slash” as part of the addressing information, but would also reveal contents, i.e. the “substance” and “meaning” of the communication … that the user is conducting a search for information on a particular topic.”

Question 77

In re Application of the United States, 396 F.Supp.2d 45 (D. Mass 2005)

Answer 77

• “The ‘substance’ and ‘meaning’ of the communication is that the user is conducting a search for information on a particular topic. … [I]f the user then enters a search phrase, that search phrase would appear in the URL after the first forward slash. This would reveal content – that is it would reveal, in the words of the statute, ‘… information concerning the substance, purport, or meaning of that communication.”
• “Contents” include URL “subject lines, application commands, search queries, requested file names, and file paths.”

Question 78

United States v. Forrester, 512 F.3d 500, n.6 (9th Cir. 2008)

Answer 78

• URL, unlike IP address, “reveals much more information” about user’s Internet activity, including articles viewed.

Question 79

Brown v. Waddell, 50 F.3d 285, 87-88 (4th Cir. 1995)

Answer 79

• Numbers sent to a pager which are “more extensive … than those in telephone numbers” contain “contents.”

Question 80

United States Telecom Association v. FCC, 227 F.3d 450 (D.C. Cir. 2000)

Answer 80

• “Post-cut-through-digits” entered by a telephone caller after being connected to the recipient of their call “can also represent call content.”

Question 81

PATRIOT Act Legislative History

Answer 81

• Wiretap order required for URL which contains specific search terms or the names of requested files or articles.

Question 82

United States v. Allen, 53 M.J. 402 (C.A.A.F. 2000)

Answer 82

• “Log identifying the … detailed internet address of sites accessed by appellant over several months” not content because such information fell under Section 2703(c)(1), which regulates government access to certain records that expressly exclude the contents of communications.

Question 83

United States v. Polizzi, 549 F.Supp.2d 308, 393 (E.D. N.Y. 2008)

Answer 83

“[N]o expectation of privacy exists for … online transactional information such as a user’s Internet search history.” Plaintiff’s argue that Polizzi is inapposite because it involved unprotected ‘subscriber information’ rather than ‘communications content.’ But that is precisely the point: the court treated “a user’s Internet search history” not as “contents,” but rather as “online transactional information” that is “similar” to unprotected subscriber information

Question 84

Defendant Citations

Contents

United States v. Reed, 475 F.3d 900 (9th Cir. 2009); Gilday v. Dubois, 124 F.3d at 296 n. 27 (1st Cir. 1997); Sams v. Yahoo!, No. 10-5897, 2011 WL 1884633, at 6-7 (N.D. Cal. May 18, 2011); In re:§ 2703(d) Order, 787 F.Supp.2d 430, 435-36 (E.D. Va. 2011); Freedman v. AOL, Inc., 412 F.Supp.2d 174, 181 (D.Conn. 2005).

Answer 84

• Data about a telephone call, including time of origination, duration, source, and destination are not “contents.” Reed.
• “[T]he pin of [a] caller, the number called, and the date, time, and length of the call” are not “contents.” Gilday.
• Even if Google had been able to use cookies to identify a specific person, it is well settled that data identifying the name or other personal information of the sender of a communication simply are not “contents” under the Wiretap Act.
• REPLY: Plaintiff’s agree. Defendants are trying to confuse the issue. We’re not arguing meta-data equals contents. URLs are different.
• REPLY: Sams v. Yahoo – This case actually helps us. The District Court pointed out, regarding subscriber information, “The Ninth Circuit has determined that access to information such as ‘email to/from address and IP addresses constitute addressing information’ and that such ‘addressing information’ does not permit the government to ‘find out the contents of [] messages or know the particular pages on the websites the person viewed.” Citing United States v. Forrester, 512 F.3d 500, 510 (9th Cir. 2008).
• REPLY: In re:§ 2703(d) Order – Challenge to subpoena to Twitter to turn over subscriber information for Wikileaks suspects, not including URLs visited. Not similar to this case.
REPLY: Freedman v. AOL, Inc. – AOL disclosed identity, contents were contained in allegedly threatening email that caused lawsuit to be filed. Not similar to this case.

Question 85

Defendant Citations

Contents

In re: iPhone Application Litigation, 844 F.Supp.2d 1040, 1061 (N.D. Cal. 2012)

Answer 85

• Identities of parties to a communication and other call data, including plaintiffs’ precise geographic location, are not “contents”
• REPLY: We’re not arguing that geo-location is contents. Defendants are trying to confuse the issue. Geo-location tracking is creepy, but it’s not content.

Question 86

United States v. Reed, 575 F.3d 900, 916 (9th Cir. 2009)

Answer 86

• “Contents’ is information the user intended to communicate, such as the spoken words of a telephone call.”
• REPLY: Defendants argue out both sides of their mouth here. Here, they say something is only content if plaintiffs intend to communicate it. Later, they argue that it doesn’t matter whether plaintiffs intended to send a communication to defendants or not. In this case, the plaintiffs’ intended to send communications to the websites with which they were communicating – those communications included the “contents” contained in the URLs of the pages they visited on those websites. For example, a plaintiff who clicked on a link to the HubPages webpage for How to Reduce Herpes Outbreaks intended to have a communication with HubPages about How to Reduce Herpes Outbreaks. In some cases, the plaintiff may have typed that exact search term into the Google search bar in order to find that particular HubPages page. In other cases, the user may have just clicked on a link with that headline somewhere else. In all cases, however, the user doesn’t just get to the “How to Reduce Herpes Outbreaks” magically without an intent on their part to have such a communication. All cases involve a conscious decision by the user to seek out information about reducing herpes outbreaks.

Question 87

Yunker v. Pandora Media, Inc. No. 11-CV-3113 JSW, 2013 WL 1282980, at *7-8

Answer 87

• Dismissing Wiretap claim because there was no “interception” where plaintiff provided information to defendant.
• REPLY: Plaintiff knowingly gave PII to Defendant Pandora as part of a contract to use the Pandora web service, and pleaded as much. The plaintiffs in this case had no knowledge and did not consent to the Defendants’ scheme to surreptitiously track their communications.

Question 88

Crowley v. Cybersource Corp., 166 F.Supp.2d 1263, 1269 (N.D. Cal. 2001)

Answer 88

• Dismissing Wiretap claim because there was no “interception” where plaintiff provided information to defendant.
• Plaintiff alleged that he “went to Amazon’s web site to purchase goods, and gave Amazon his name, email address, mailing address, credit card number and expiration date, and telephone number. Amazon then transmitted this information to CyberSource, a company that verifies the identify of a person making an online purchase.”
• REPLY: Plaintiff knowingly gave PII to Amazon which then knowingly sent the information to the third-party defendant. Neither the plaintiffs nor the other websites in this case had knowledge or consent to the Defendants’ scheme to surreptitiously track their communications.

Question 89

In re: DoubleClick Inc. Privacy Litigation, 154 F.Supp.2d 497, 510, 514 (S.D. N.Y. 2001)

Answer 89

• Holding that “if cookie identification numbers [were] electronic communications at all,” they were defendant ad-serving company’s “internal … communications” and thus both “of” and “intended for” defendant ad-serving company.
• Defendants argue that since they would have received all but the cookie information anyway, that there’s no interception of “contents.”
• REPLY: Cookie Completes the Loop by Tying the Content to a Particular Person –The cookie transforms information which would have otherwise been received into information which is attached to each particular plaintiff. That’s the very point of the surreptitious code – to attach information the Defendant’s would otherwise receive unconnected to a particular user and attach it to a particular person to create a user profile. The cookie completes the “interception” by putting all of the information together connecting the “contents” of a communication with a previously unidentifiable party to a particular person.

Question 90

In re: DoubleClick Inc. Privacy Litigation, 154 F.Supp.2d 497, 510, 514 (S.D. N.Y. 2001)

Answer 90

• Holding that, where ad-serving company placed a cookie on a web-browser visiting websites, websites were “parties to the communication[s] … and ha[d] given sufficient consent” to ad-serving company.”
• REPLY: This misrepresents the facts and holding of DoubleClick. The cookies in that case were straight-forward and not designed to subvert privacy settings. The Court explained, “DoubleClick will not collect information from any user who takes simple steps to prevent DoubleClick’s tracking . . . [including] configuring their browsers to block any cookies from being deposited.” In re: DoubleClick Privacy Litigation, 154 F. Supp. 2d 497, 505 (S.D.N.Y. 2001); see also id. at 519 (finding that plaintiffs “consent to DoubleClick’s interceptions” under the Wiretap Act). DoubleClick turned largely on the notion that a user implicitly consents to tracking by not enabling the browser’s easily activated cookie blocking mechanism.
• REPLY: Regarding consent of the websites with which the plaintiffs were communicating, consent is an affirmative defense and the burden is on defendants to prove which, if any, of the websites knew and acquiesced to Defendants’ surreptitious tracking scheme.

Question 91

DoubleClick; Chance v. Ave. A, Inc., 165 F. Supp.2d 1153, 1162 (W.D. Wash. 2001); In re: Facebook Privacy Litigation, 791 F.Supp.2d 705, 713 (N.D. Cal. 2011)

Answer 91

• Courts have long recognized that third-party Internet advertising services like Google are either parties to GET request communications that include BGI or have consent to receive them.
• REPLY: DoubleClick and Chance were both cases with straight-forward cookies that weren’t designed to be placed on plaintiffs’ computers through surreptitious code. In re: Facebook Privacy Litigation involved a Wiretap claim for sharing referrer headers after clicking on advertisements on the Defendants’ own website. This case is different from DoubleClick, Chance, and In re: Facebook because the cookies at issue are placed via surreptitious code.

Question 92

Defendant Citations
Crime/Tort Exception

Caro v. Weintraub, 618 F.3d 94, 99-101 (2nd Cir. 2010)

Answer 92

• Crime or tort exception applies to criminal or tortious act “independent of the act of recording [the communication] itself,” such as “blackmailing the other party, threatening him, or publicly embarrassing him.”
• Because Plaintiffs did not allege Defendants intended to commit any crime or tort, this narrow exception is inapplicable here.

Question 93

Ideal Aerosmith, Inc. v. Acutronic, 2007 WL 4394447, at 4-5 (W.D. Pa. Dec. 13, 2007); Wesley College v. Pitts, 974 F.Supp. 375, 384 (D. Del. 1997)

Answer 93

• If a defendant acquired communications to which it was not a party, but did not use the alleged “device” to acquire those communications, there is no statutory violation.
• REPLY: Agree with rule of law. Cases are inapposite. Plaintiffs adequately alleged device. Defendants failed to challenge device in district court. In fact, Defendant Google conceded the “device” element in the trial court See Response Brief of Defendant Google dated March 29, 2013, at p. 14, fn. 4. Because Google did not challenge this element in the trial court, Google has waived it for this appeal. See Singleton v. Wulff, 428 U.S. 106, 120 (1976) (“It is the general rule, of course, that a federal appellate court does not consider an issue not passed upon below.”). This issue is also not properly before this Court because no Defendant cross-appealed on it. Nor could they have. Defendants had failed to challenge the issue in the trial court.