Antitrust Law Daily Wrap Up, PRIVACY—9th Cir.: Wiretap Act and Stored Communications Act claims against Zynga and Facebook failed, (May 9, 2014)

By Peter Reap, J.D., LL.M.

Plaintiffs in two consolidated cases failed to adequately allege claims for violations of the Wiretap Act and the Stored Communications Act, two chapters within the Electronic Communications Privacy Act (“ECPA”), when Facebook, Inc., and Zynga Game Network, Inc., allegedly disclosed confidential user information to third parties because they did not allege that either Facebook or Zynga disclosed the “contents” of a communication, a necessary element of their ECPA claims, the U.S. Court of Appeals in San Francisco has decided (In re: Zynga Privacy Litigation, May 8, 2014, Ikuta, S.). Therefore, a ruling by the federal district court in San Francisco was affirmed.

Background. Facebook operates Facebook.com, a social networking website. Zynga is an independent online game company that designs, develops, and provides social gaming applications that are accessible to users of Facebook. To understand the claims at issue, some background on Facebook and Internet communication is necessary, the court noted.

Upon registration, Facebook assigns each user a unique Facebook User ID. The User ID is a string of numbers, but a user can modify the ID to be the user’s actual name or invented screen name. Facebook considers the IDs to be personally identifiable information.

To generate revenue, Facebook sells advertising to third parties who want to market their products to Facebook users. Facebook helps advertisers target their advertising to a specific demographic group by providing them with users’ demographic information, which will make it more likely they will click on the ad and view the offer. Nevertheless, Facebook’s privacy policy states that it will not reveal a user’s specific identity and that only anonymous information is provided to advertisers.

In addition to its social networking and advertising services, Facebook offers a platform service that allows developers to design applications that run on the Facebook webpage. Zynga is one such developer. It offers free social gaming applications through Facebook’s platform that are used by millions of Facebook users. Until November 30, 2010, Zynga’s privacy policy stated that it did “not sell or rent your ‘Personally Identifiable Information’ to any third party.”

A brief review of how computers communicate on the Internet is helpful to understand what happens when a Facebook user clicks on a link or icon. The hypertext transfer protocol, or HTTP, is the language of data transfer on the Internet and facilitates the exchange of information between computers. The protocol governs how communications occur between “clients” and “servers.” A “client” is often a software application, such as a web browser, that sends requests to connect with a server. A server responds to the requests by, for instance, providing a “resource,” which is the requested information or content. Uniform Resource Locators, or URLs, both identify a resource and describe its location or address. And so when users enter URL addresses into their web browser using the “HTTP” web address format, or click on hyperlinks, they are actually telling their web browsers (the client) which resources to request and where to find them.

The basic unit of HTTP communication is the message, which can be either a request from a client to a server or a response from a server to a client. A request message has several components, including a request line, the resource identified by the request, and request header fields. The request line specifies the action to be performed on the identified resource. Often, the request line includes “GET,” which means “retrieve whatever information . . . is identified by the” indicated resource, or “POST,” which requests that the server accept a body of information enclosed in the request, such as an email message.

Other request headers follow the request line and “allow the client to pass additional information about the request, and about the client itself, to the server.” A request header known as the “referer” provides the address of the webpage from which the request was sent.

During the period at issue in this case, when a user clicked on an ad or icon that appeared on a Facebook webpage, the web browser sent an HTTP request to access the resource identified by the link. The HTTP request included a referrer header that provided both the user’s Facebook ID and the address of the Facebook webpage the user was viewing when the user clicked the link. Accordingly, if the Facebook user clicked on an ad, the web browser would send the referrer header information to the third party advertiser.

According to the plaintiffs, Zynga programmed its gaming applications to collect the information contained in the referrer header, and then transmit this information to advertisers and other third parties. As a result, both Facebook and Zynga allegedly disclosed the information provided in the referrer headers (i.e., the user’s Facebook IDs and the address of the Facebook webpage the user was viewing when the user clicked the link) to third parties.

The decision below. Here, the plaintiffs filed consolidated class action complaints against Facebook and Zynga, alleging violations of ECPA based on Facebook and Zynga’s disclosure of the information contained in referrer headers to third parties. In Robertson v. Facebook, the plaintiffs alleged that Facebook violated the Stored Communications Act, 18 U.S.C. § 2702(a)(2). In Graf v. Zynga, the plaintiffs alleged violations of both the Stored Communications Act and the Wiretap Act, 18 U.S.C. § 2511(3)(a).

Title I of ECPA amended the existing Wiretap Act. As relevant here, the amended Wiretap Act provides that (with certain exceptions), “a person or entity” (1) “providing an electronic communication service to the public” (2) “shall not intentionally divulge the contents of any communication (other than one to such person or entity, or an agent thereof)” (3) “while in transmission on that service” (4) “to any person or entity other than an addressee or intended recipient of such communication or an agent of such addressee or intended recipient.” 18 U.S.C. § 2511(3)(a). The “contents” of a communication are defined as “any information concerning the substance, purport, or meaning of that communication.”

Title II of ECPA, termed the Stored Communications Act, covers access to electronic information stored in third party computers. The relevant provision here imposes requirements on providers of remote computing services that are similar to the requirements of the Wiretap Act discussed above.

The district court read the complaints as alleging that the plaintiffs intended for Facebook, Zygna, or the third parties to receive the communications. Because both the Wiretap Act and the Stored Communications Act allow disclosures to intended recipients, 18 U.S.C. §§ 2511(3)(a), 2702(b)(1), the district court concluded that the complaints did not state a claim for violation of the Wiretap Act or Stored Communications Act. These appeals followed.

Analysis. On appeal, the plaintiffs argued that the district court erred in holding that Facebook, Zynga, and the third parties were the intended recipients of the referrer headers containing the user’s Facebook IDs and the URLs. According to the plaintiffs, because their complaints alleged that Facebook and Zynga had privacy policies which precluded them from providing personally identifiable information to third parties, the exceptions in §§ 2511(3) and 2702(b) for intended recipients are inapplicable.

Because the plaintiffs alleged that Facebook and Zynga violated ECPA by disclosing the HTTP referrer information to third parties, the appellate court was required to first determine whether such information is the “contents” of a communication for purposes of 18 U.S.C.

§§ 2511(3)(a) and 2702(a)(2), it observed.

To answer this question, Congress’s intended meaning of the word “contents” must be determined. For purposes of §§ 2511(3)(a) and 2702(a), the word “contents” is defined as “any information concerning the substance, purport, or meaning of [a] communication.” 18 U.S.C. §§ 2510(8), 2711(a). A dictionary in wide circulation during the relevant time frame provides the following definitions: (1) “substance” means “the characteristic and essential part;” (2) “purport” means the “meaning conveyed, professed or implied;” and (3) “meaning” refers to “the thing one intends to convey. . .by language.” These definitions indicated that Congress intended the word “contents” to mean a person’s intended message to another (i.e., the “essential part” of the communication, the “meaning conveyed,” and the “thing one intends to convey”), the court reasoned.

The language and design of the statute as a whole shed further light on the meaning of “contents” by indicating that “contents” does not include “record” information. Specifically, the Stored Communications Act provides that a covered service provider “may divulge a record or other information pertaining to a. . .customer” but may not divulge “the contents of communications.” 18 U.S.C. §§ 2702(c), 2703(c)(1). Customer record information (which can be disclosed under certain circumstances) includes the “name,” “address,” and “subscriber number or identity” of a subscriber or customer. Accordingly, “contents” does not include such record information, the court held.

This conclusion was confirmed by ECPA’s amendments to the Wiretap Act enacted in 1968. When it enacted ECPA, Congress amended the definition of “contents” to eliminate the words “identity of the parties to such communication,” indicating its intent to exclude such record information from its definition of “contents.” Accordingly, under ECPA, the term “contents” refers to the intended message conveyed by the communication, and does not include record information regarding the characteristics of the message that is generated in the course of the communication. The Ninth Circuit had previously made this distinction between contents and record information. And this conclusion was consistent with the reasoning of its sister circuits, the court noted.

Next, the court turned to whether the plaintiffs plausibly alleged that the referrer header information at issue here constituted the “contents of any communication,” that is, “any information concerning the substance, purport, or meaning of a communication.” The referrer header information that Facebook and Zynga transmitted to third parties included the user’s Facebook ID and the address of the webpage from which the user’s HTTP request to view another webpage was sent. This information did not meet the definition of “contents,” because these pieces of information are not the “substance, purport, or meaning” of a communication, the court ruled. A Facebook ID identifies a Facebook user and so functions as a “name” or a “subscriber number or identity.” Similarly, the webpage address identifies the location of a webpage a user is viewing on the Internet, and therefore functions like an “address.” Congress excluded this sort of record information from the definition of “contents.”

The plaintiffs argued that the referrer header discloses content information, because when the referrer header provides the advertiser with a Facebook ID (which, at the election of the user, may have been changed to a user name) along with the address of the Facebook page the user was previously viewing, an enterprising advertiser could uncover the user’s profile page and any personal information made available to the public on that page. But the statutes at issue in these cases do not preclude the disclosure of personally identifiable information; indeed, they expressly allow it, the court explained. There is no language in ECPA equating “contents” with personally identifiable information. Thus, an allegation that Facebook and Zynga disclosed personally identifiable information is not equivalent to an allegation that they disclosed the contents of a communication. Because information disclosed in the referrer headers at issue here is not the contents of a communication as defined in ECPA, the plaintiffs could not state a claim under those statutes. Accordingly, the district court’s dismissal was affirmed with prejudice.

Attorneys: Adam J. Levitt (Grant & Eisenhofer P.A.) for Nancy Walther Graf. Kassra Nassiri (Nassiri & Jung LLP) for Mike Robertson. Richard L. Seabolt (Duane Morris LLP) for Zynga Game Network, Inc. Aaron Martin Panner (Kellogg, Huber, Hansen, Todd, Evans, & Figel, P.L.L.C.) for Facebook, Inc.

Companies: Zynga Game Network, Inc.; Facebook, Inc.

Cases: Privacy ConsumerProtection AlaskaNews ArizonaNews CaliforniaNews HawaiiNews IdahoNews MontanaNews NevadaNews OregonNews WashingtonNews