Antitrust Law Daily Wrap Up, PRIVACY—D. Del.: Privacy claims fail against Google and advertisers over alleged cookie abuse, (Oct 15, 2013)

By Tobias J. Gillett, J.D., LL.M.

Users of Apple Safari and Internet Explorer web browsers failed to state claims under a variety of federal and California laws against Google and certain online advertising companies over their use of code in online advertisements that took advantage of a browser function to place cookies allowing the display of targeted advertising to the users, the federal district court in Wilmington, Delaware has ruled (In Re: Google, Inc. Cookie Placement Consumer Privacy Litigation, October 9, 2013, Robinson, S.). The court dismissed the plaintiffs’ claims under the Electronic Communications Privacy Act, the Stored Communications Act, the Computer Fraud and Abuse Act, the California Invasion of Privacy Act, the California Computer Crime Law, the California Constitution, the California Unfair Competition Law, and the California Consumers Legal Remedies Act.

According to the plaintiffs, technology company Google, Inc. and online advertising and marketing companies Vibrant Media Inc., Media Innovation Group LLC, and WPP, plc used code in online advertisements to “trick” the plaintiffs’ Apple Safari and/or Internet Explorer browsers into accepting cookies that allowed the defendants to display targeted advertising. The plaintiffs settled claims against a fifth company, PointRoll, Inc. The remaining defendants moved to dismiss.

Article III standing. The court concluded the plaintiffs lacked Article III standing to assert their claims. Although the plaintiffs cited numerous sources indicating that personally identifiable information (PII) had monetary value and was a commodity that companies bought and sold, the court noted that “[d]istrict courts have been reluctant to equate loss of PII, without more, to injury in fact.” In the present case, although the plaintiffs’ PII might have some monetary value, the court concluded that the plaintiffs had not “sufficiently alleged that the ability to monetize their PII has been diminished or lost by virtue of Google’s previous collection of it.”

Electronic Communications Privacy Act. The court concluded that the plaintiffs did not state a claim under the Electronic Communications Privacy Act (the “Wiretap Act”). The court explained that the Wiretap Act “imposes liability on a person who intentionally intercepts and discloses the contents of an electronic communication, unless such person is a party to the communication or where one of the parties to the communication has given prior consent to such interception.” The court declined to find that Google was a party to the communications, even though the plaintiffs’ browsers voluntarily sent information input by the plaintiffs to Google, because the defendants had “bypassed the browser settings to place cookies that would allow them to later associate plaintiffs’ data.” Moreover, the plaintiffs’ browsers had sent different data than they would have sent in the absence of the cookies.

However, the court concluded that Google did not intercept the “contents” of the plaintiffs’ communications. The court observed that “personally identifiable information that is automatically generated by the communication is not contents for the purposes of the Wiretap Act.” Here, the plaintiffs’ browsers would have sent a URL, which was a “location identifier” that did not concern the substance of the communication, whether or not a third party cookie had been set.

California Invasion of Privacy Act. To state a claim under the California Invasion of Privacy Act, the plaintiffs would have to demonstrate that Google had “intercepted, used, or disclosed the contents or meaning of a communication that is in transit.” As Google would still have received the information input by the plaintiffs in the absence of the third party cookies, and Google had not intercepted the “contents” of any communications, the court dismissed the Invasion of Privacy Act claim as well.

Stored Communications Act. The plaintiffs also failed to state a claim under the Stored Communications Act (SCA), in the court’s view. The SCA “renders liable whoever (1) intentionally accesses without authorization a facility through which an electronic communication service is provided; or (2) intentionally exceeds an authorization to access that facility; and thereby obtains, alters or prevents authorized access to a wire or electronic communication while it is in electronic storage in such system.” The court explained that, “[i]n enacting the SCA, Congress was concerned that the Fourth Amendment may not protect against searches and seizures of copies of electronic communications stored by third parties.” The court observed that the “technological landscape,” and related privacy concerns, has changed since the SCA’s enactment in 1986.

The court found that treating an individual’s personal computing device as a “facility” for purposes of the SCA “confounds the distinction between ‘users’ and ‘providers’ which, in turn, realigns the targeted conduct and makes the statutory exceptions found in § 2701(c) nonsensical.” Therefore, the court “decline[d] to try to fit a square peg (modern technology) into the proverbial round hole (the intent of Congress as reflected in the statutory language of the SCA,” and concluded that an individual’s personal computing device was “not a facility through which an electronic communication is provided, as required under the SCA.” However, the court did find that the plaintiffs sufficiently alleged that the communications at issue were in “electronic storage,” because they alleged that the defendants had accessed the cookies while they were in RAM, rather than on the hard drive, and the communications were thus in “temporary, intermediate storage of a wire or electronic communication incidental to the electronic transmission thereof.”

Computer Fraud and Abuse Act. The court concluded that the plaintiffs failed to allege “any impairment of the performance or functioning of their computers,” or any individual economic loss, that would meet the threshold $5,000 loss required to state a claim under the Computer Fraud and Abuse Act.

California Computer Crime Law. The California Computer Crime Law (CCL) prohibits “tampering, interference, damage, and unauthorized access” to computer data and systems “without permission,” a phrase the courts interpreted as meaning “accessing or using a computer, computer network, or website in a manner that overcomes technical or code-based barriers.” The CCL also prohibits “knowingly introducing any computer contaminant into any computer, computer system, or computer network.”

Here, the plaintiffs failed to satisfy the CCL’s loss requirement. Moreover, the plaintiffs failed to meet the “without permission” requirement because Google merely “exploited a standard Safari browser function,” rather than “overcom[ing] technical or code-based barriers” or “introducing any computer contaminant.”

California Constitution. To assert a claim for invasion of privacy in violation of the California Constitution, a plaintiff must show “(1) a legally protected privacy interest; (2) a reasonable expectation of privacy in the circumstances; and (3) conduct by defendant constituting a serious invasion of privacy.” Such an invasion must “constitute an egregious breach of the social norms underlying the privacy right.”

Here, the transfer of the plaintiffs’ information, which still would have occurred in the absence of the cookies, did not “rise to the level of a serious invasion of privacy or an egregious breach of social norms,” according to the court. “Neither is Google’s subsequent association of multiple instances of plaintiffs’ inputted information with other personal information to provide targeted advertising a sufficiently serious invasion of privacy,” the court further opined. Therefore, the court dismissed plaintiffs’ claim under the California Constitution.

California Unfair Competition Law. A claim under the California Unfair Competition Law (UCL) requires the plaintiff to “demonstrate some form of economic injury,” and the plaintiffs did not show “a loss of money or property from Google’s actions sufficient to confer standing under the UCL.”

California Consumers Legal Remedies Act. The California Consumers Legal Remedies Act (CLRA) prohibits “unfair methods of competition and unfair or deceptive acts or practices” in connection with the sale or lease of “goods and services,” with “services” defined as “work, labor, and services other than a commercial or business use, including services furnished in connection with the sale or repair of goods,” and “goods” defined as “tangible chattels.”

Here, the court found that “[t]he California case law is clear that software and software activity are not covered by the CLRA.” Moreover, the plaintiffs did not plead facts showing a transaction, because they did not pay for the advertisements, and their contention “that their personal information constitute[d] a form of payment to Google [was] unsupported by law.”

The case is MDL Civ. No. 12-2358-SLR.

Attorneys: Charles Slanina (Finger & Slanina, LLC), Stephen G. Grygiel (Keefe Bartels, LLC), James Frickleton (Bartimus, Frickleton, Robertson & Gorny, P.C.), Brian Russell Strange (Strange & Carpenter), David Straite (Kaplan, Fox & Klischeimer, L.L.P.), Jonathan Shub (Seeger Weiss LLP), Barry Eichen (Eichen, Crutchlow, Zaslow& McElroy, LLP), William Murphy (Murphy, P.A.), Mark Bryant (The Bryant Law Center, PSC), and Jay Barnes (Barnes & Associates) for Plaintiffs. Roger D. Smith (Morris, Nichols, Arsht&Tunnell LLP) for Media Innovation Group, LLC and WPP, plc. Kelly E. Farnan (Richards, Layton & Finger) for Vibrant Media Inc. Susan M. Coletti (Fish & Richardson P.C.) for PointRoll, Inc. Michael H. Rubin (Wilson Sonsini Goodrich & Rosati) for Google, Inc.

Companies: Google, Inc.; Vibrant Media Inc.; Media Innovation Group LLC; WPP, plc; PointRoll, Inc.

Cases: Privacy StateUnfairTradePractices DelawareNews