Antitrust Law Daily Wrap Up, PRIVACY—N.D. Cal.: Class certification granted in privacy case against Spokeo, (Jun 4, 2024)

By Martin A. Steinberg, J.D.

Most class members would only qualify for a statutory minimum amount of damages.

The federal district court in San Francisco granted class certification to five named Plaintiffs in their lawsuit claiming that Spokeo, Inc., by publishing personal information about them, violated their statutory rights of publicity and common law rights regarding misappropriation of name and likeness. Spokeo runs a website that collects consumer and public data from various public sources and private vendors, associates that data with particular names, and publishes it online. The court granted certification for four California and Ohio classes. The court further denied the parties’ cross-motions to exclude each other’s expert witness testimony (Kellman v. Spokeo, Inc., No. 3:21-cv-08976-WHO (N.D. Cal. May 29, 2024)).

Background. Spokeo owns and operates the website spokeo.com, that collects data and information about the American adult public from public sources and data vendors. Using proprietary algorithms and systems, Spokeo collects, aggregates, and merges all that data into persons and person objects, which are then designated with a unique personal identifier (PID) for each person. That aggregated data can then be searched by users of the website, and is also used to populate “teaser profiles,” which can be viewed by the public without a subscription to the website. Any visitor to spokeo.com can search for a specific teaser profile, using a name, phone number, address, or email. Each teaser profile contains at least a name and address. The teaser profiles advertise additional personal information about the subject of the profile, including about their family, court records, sex offender registration status, marital status, and more. Visitors to spokeo.com can pay to access this additional information, including by paying for a single report or a subscription.

Plaintiffs filed their complaint in November 2021, and their second amended complaint in September 2023. Plaintiffs’ theory of the case is that Spokeo unfairly and unlawfully profited by publishing their personal information in the teaser profiles, thereby enticing consumers to pay Spokeo so they could access additional information about people. Plaintiffs claimed that they suffered emotional and mental injury from this nonconsensual loss of control of their personal information. At least one distinct consumer viewed two of the Plaintiffs’ profile prior to purchasing a subscription.

Four classes. Plaintiffs sought to certify the following four classes:

California Viewed-Prior-to-Purchase Class: All California residents who are not registered users of Spokeo.com and whose teaser profile was viewed by a user immediately prior to purchasing a Spokeo.com subscription on or after November 19, 2019, where such teaser profile includes a name and home address.

Ohio Viewed-Prior-to-Purchase Class: All Ohio residents who are not registered users of Spokeo.com and whose teaser profile was viewed by a user immediately prior to purchasing a Spokeo.com subscription on or after November 18, 2017, where such teaser profile includes a name and home address.

California Published Teaser Profile Class: All United States residents who are not registered users of Spokeo.com and whose teaser profile is searchable on www.spokeo.com, where such teaser profile includes a name and home address.

Ohio Published Teaser Profile Class: All Ohio residents who are not registered users of Spokeo.com and whose teaser profile is searchable on www.spokeo.com, where such teaser profile includes a name and home address.

Article III standing. The court found that Plaintiffs had standing to sue on all of their claims. The injuries that Plaintiffs asserted based on the publication of their information include the violation of their right to control their identities, Plaintiffs’ mental and emotional harm, and Spokeo’s unjust enrichment and profit. At this stage of the proceedings, each Purchase class Plaintiff had shown some evidence that Spokeo published teaser profiles with their names and addresses, and that they were damaged by loss of control of their identities and emotional and mental harm. Whether they can show that this harm is from that publication and is legally sufficient to prove injury and yield a remedy is a common question that will be resolved at summary judgment.

The court rejected Spokeo’s argument that one of the Plaintiffs did not have standing because his profile did not use his name or identity. The court noted, however, that there was sufficient evidence in the record to suggest that the profile was his and that both he and his father recognized it as referring to him.

Finally, Plaintiffs had standing to pursue injunctive relief. Their theory of the case is, in part, that Spokeo continues to unjustly profit from publishing teaser profile with their names and likenesses and without consent. Because this harm is ongoing, Plaintiffs have shown “continuing, present adverse effects.” Additionally, the current record suggested that opting out does not necessarily end the harm. For example, Spokeo’s co-founder and Chief Technology Officer explained that opting out is not perfect and does not necessarily catch all information, given how their data flow and systems operate.

Rule 23(a). Plaintiffs met the Rule 23 standard. This rule requires that Plaintiffs show numerosity, commonality, typicality, and adequacy. First, the class here “is so numerous that joinder of all members would be impracticable.” Courts within the Ninth Circuit generally agree that numerosity is satisfied if the class includes forty or more members. While the parties argued over how many people are in each class, Plaintiffs had shown and Spokeo did not contest that each proposed class has many thousands of members.

Second, Plaintiffs had shown that their claims or defenses are typical of the claims or defenses of the class. All class members have the same or similar injury: the violation of their statutory and common law rights. The lawsuit as a whole was also “based on conduct which is not unique to the named plaintiffs” but rather affected all individuals nationally by publishing teaser profiles without consent for commercial gain. Further, each class member’s injury resulted from the same course of conduct.

Third, the court found that Plaintiffs and their counsel are adequate to represent the classes. The named Plaintiffs are typical, and their claims are identical to those of the other class members. While Plaintiffs are pursuing the statutory minimum in penalties rather than actual damages or the full statutory damages, it appeared to the court that the vast majority of the members of all classes would only be entitled to the statutory minimum. Even for individuals who incurred actual damages, there is no evidence thus far that the relatively substantial statutory minimums—$750 for California and $2500 for Ohio, would be exceeded.

As to class counsel, they have dedicated a substantial amount of time and resources to the case as evident from the docket, and they intend to continue to do so. Additionally, they have substantial experience litigating consumer class actions, including other privacy class actions. They have no conflicts of interest with any class members, and they are competent and qualified, despite initial issues identifying their Plaintiffs.

Commonality and predominance. Plaintiffs met the commonality requirement of Rule 23(a) and the predominance requirement of Rule 23(b)(3). The predominance requirement of Rule 23(b)(3) requires that questions of law or fact common to class members predominate over any questions affecting only individual members. This requirement presupposes satisfaction of the commonality requirement of FRCP 23(a)(2), which tests the capacity of a class-wide proceeding to generate common answers apt to drive the resolution of the litigation. The commonality requirement of Rule 23(a)(2) requires Plaintiffs to show that their claims depend upon a common contention that is capable of class-wide resolution.

Plaintiffs were correct that use and appropriation of a class member’s identity are common questions of law and fact because for each potential class member, Spokeo used the same common process to collect data from vendors, associate it with PIDs, and publish it on its website. Every teaser profile featured at least a name and home address—another common fact. The resulting common issue of law is whether using and publishing this information without consent is sufficient to constitute use or appropriation of identity under California, Ohio, or common law. Based on Plaintiffs’ theory of the case and class definitions, the inquiry that will determine class membership asks whether the class member’s name and address match the teaser profile’s name and address.

Amended class definition. Identifiability turns on the legal question of whether name and residence are sufficient to make someone identifiable under the law. Because of the plaintiffs’ theory of the case, their class definitions need to be amended slightly. The definitions currently include relevant individuals who have a “teaser profile [that] includes a name and home address.” The court amended these definitions to include individuals with a teaser profile that “includes the individual’s name and home address.” This clarified that the address must be the class member’s address, it cannot be any home address. As discussed, though, it will be up to the parties at summary judgment to determine whether a prior address is sufficient for liability.

Consent. The consent element also met the commonality requirement. First, whether Spokeo received “prior consent” to use plaintiffs’ identities, as required by the California and Ohio statutes, is subject to common proof, including whether there were procedures in place to obtain and confirm consent before publication. Though Spokeo stated that the class members can use the opt-out feature on their websites, asking to remove information after publication does not address whether Plaintiffs consented prior to publication.

Second, whether Plaintiffs subsequently consented to use of their identities, an element of the common law claims, was also likely subject to common proof based on whether there were effective procedures available. Additionally, whether the availability of the opt-out process was sufficient to show implied consent was also a common question of law. Whether a Plaintiff ever consented to arbitration by signing up for Spokeo or agreeing to its terms may ultimately be an individualized inquiry, but it did not defeat the commonality of the consent element as a whole.

The injury element also presented common questions of law and fact. Whether the nonconsensual use of someone’s identity for commercial purposes is a legally sufficient injury is a common question of law, central to the claim of each plaintiff in the Published classes.

Superiority. The court found that the superiority requirement was met because they were able to show that show that the class action is superior to other available methods for fairly and efficiently adjudicating the controversy. First, the class members’ interests in pursuing and controlling their own litigation are lessened here, where the questions of law and fact are common and must be addressed whether the case is brought by an individual or a class. There appeared to be at least one prior case where plaintiffs pursued similar claims against Spokeo, but that case was brought only under Alabama right to publicity law and was recently dismissed.

Litigation in this forum is highly desirable given that Spokeo is located here, its witnesses and documents are here, and the underlying alleged violations mostly took place here. Moreover, this case does not clearly present manageability issues above and beyond those typically associated with class actions. Finally, the court rejected Spokeo’s argument that its Due Process rights would be violated by the enormity of the damages for a nationwide classes are immense because Plaintiffs were no longer seeking to certify nationwide classes.

Rule 23(b)(2). The motion to certify under Rule 23(b)(2) was granted. The “damages class is the driver of this case, and if the damages class should be certified, then necessarily at Rule 23(b)(2) should be certified as well.” Rule 23(b)(2) provides that a class may be certified under that rule if the Rule 23(a) requirements are met and “the party opposing the class has acted or refused to act on grounds that apply generally to the class, so that final injunctive relief or corresponding declaratory relief is appropriate respecting the class as a whole.” Those requirements were met here because the Rule 23(a) factors favored certification, and Plaintiffs presented sufficient evidence that Spokeo acted in a way that applied generally to the California and Ohio classes through its common policy and process for gathering consumer data and publishing it via teaser profiles on its website. Thus the court granted certification of the California and Ohio classes under 23(b)(2), with the following amendment: “such teaser profile includes a name and home address” shall be amended to read “such teaser profile includes the individual’s name and home address.”

Spokeo’s motions to exclude. First the court rejected Spokeo’s motion to exclude Plaintiffs’ expert’s declaration and testimony about class size. Spokeo argued that his calculations were unreliable and that his method to calculate damages was fundamentally flawed. Yet, Spokeo did not challenge class certification based on the numerosity element. Second, the court denied Spokeo’s motion to exclude the declaration and testimony from Plaintiffs’ expert about class notification. Though his proposed method provides notice to the nationwide classes, he explained how he would and could use the same method on a narrower target audience if smaller statewide classes were certified.

Plaintiffs’ motion to exclude. The court denied as moot Plaintiffs’ motion to exclude Spokeo’s expert’s testimony. The underlying basis for Plaintiffs’ motion was that the defense expert’s declaration cannot be used to discount Plaintiffs’ experts. But the court did not rely on the expert’s report because there were independent reasons that the court found that Plaintiffs’ experts’ declarations were reliable and so it denied Spokeo’s motions to exclude them.

The Case is No. 3:21-cv-08976-WHO.

Judge: Orrick, W.

Attorneys: Raina Challeen Borrelli (Strauss Borrelli PLLC) for Aviva Kellman, Jason Fry and Nicholas Newell. Daniel D. Queen (Mayer Brown LLP) for Spokeo, Inc.

Companies: Spokeo, Inc.

Cases: Privacy CyberPrivacyFeed DataPrivacy CaliforniaNews