Antitrust Law Daily Wrap Up, PRIVACY—D.N.J.: Viacom, Google not liable for collection, use of information gathered from children, (Jan 22, 2015)

By John W. Arden, J.D., LL.M.

Claims that Viacom Inc. and Google Inc. violated federal and state privacy laws by gathering information from children who registered with and used Viacom’s Nick.com, Nickjr.com, and Neopets websites were dismissed by the federal district court in Newark, New Jersey a second time—this time with prejudice. The court previously found that the complaining class of children failed to adequately plead that their privacy rights were violated, but dismissed the claims without prejudice, granting leave to amend the complaint (In re Nickelodeon Consumer Privacy Litigation, January 20, 2015, Chesler, S.).

Viacom encourages children to register and establish profiles on their Nick.com, Nickjr.com, and Neopets.com websites. When registering, children are required to provide their gender, age, and birthday. Viacom allegedly sends this information to Google and places a text file or “cookie” on the children’s computers without consent. These cookies allow Viacom to gather additional information about the users, including their IP addresses, device and browser settings, and web traffic. Viacom allegedly shares this information with Google and allows Google to place its own cookies on users’ computers. This allows Google to track users’ Internet usage, according to plaintiffs. Both Viacom and Google allegedly use this gathered information to target users with advertising.

A class of children under the age of 13 asserted seven claims against Viacom and Google. These claims alleged violations of the federal Video Protection and Privacy Act (VPPA), the Federal Omnibus Crime Control and Safe Streets Act (the Wiretap Act), the federal Stored Communications Act (SCA), California Invasion of Privacy Act (CIPA), and the New Jersey Computer Related Offenses Act (CROA), in addition to invasion of privacy and unjust enrichment.

On July 2, 2014, the court dismissed the VPPA claims on the ground that Google was not a video tape service provider and that the children’s information was not considered “personally identifiable information” linked to a specific video choice. The court dismissed the Wiretap Act claim because there was no allegation that the companies intercepted “contents” of “personally identifiable information” in any electronic communication. The SCA claim was rejected because the companies were not alleged to have intentionally accessed a “facility” through which an electronic communication system is provided. The CIPA claims were dismissed because there was no allegation demonstrating the interception of “contents or meaning” in the children’s communication, while the invasion of privacy claim failed for a lack of allegations that the intrusion or collection and monetization of online information was “highly offensive.”

The plaintiffs filed a Second Amended Complaint in September 2014, alleging additional facts to cure the deficiencies of the pleading. Viacom and Google moved to dismiss the amended complaint on the ground that it still failed to allege the disclosure of any personally identifiable information, any damages, and any “highly offensive” behavior. The plaintiffs argued that new facts alleged in the complaint demonstrated that the defendants’ conduct was “highly offensive” and caused damage.

VPPA claim. The court held that the new complaint failed to identify a plaintiff and what video he or she watched. Under the VPPA, personally identifiable information must link an actual person to actual video materials. In order for Google to connect the information that Viacom provides with the identity of an individual plaintiff, one of the plaintiffs would have to have registered for one of Google’s services. However, the complaint alleged no facts that a plaintiff ever registered with Google. It appeared that Google would not allow a child under 13 to register for its services, which would rule out the entire class of plaintiffs.

CROA claims. The New Jersey CROA is an anti-computer-hacking statute that provides a civil remedy to a person or enterprise damaged in business or property as a result of enumerated actions. Because the statute targets computer hacking, it was dubious that the law covers situations like this, in which plaintiffs’ computers were not hacked and information not stolen. Even assuming the statute applied, the claim failed because the plaintiffs did not allege damage to “business or property.” They did not claim that they could have monetized the personally identifiable information collected.

Common law privacy. New Jersey recognizes a common law privacy tort, which prohibits the intentional intrusion upon the solitude or seclusion of another if such intrusion would be “highly offensive to the reasonable person.” The court found, as a matter of law, that the defendants’ alleged conduct fell short of “highly offensive” behavior, even considering that children warrant special attention and protection.

The case is No. 2443 (SRC).

Attorneys: Barry R. Eichen (Eichen Crutchlow Zaslow & McElroy, LLP), Andrew Lyskowski (Bergmanis Law Firm, LLC), and Kevin P. Green (Goldenberg Heller Antognoli & Rowland PC) for Plaintiff. Bruce P. Keller (Debevoise & Plimpton), and Seth J. Lapidow (Blank Rome, LLP) for Viacom, Inc. Jeffrey J. Greenbaum (Sills Cummis & Gross PC), and Tonia O. Klausner (Wilson Sonsini Goodrich & Rosati) for Google, Inc.

Companies: Viacom, Inc.; Google, Inc.

Cases: Advertising Privacy NewJerseyNews