Case 5:10-cv-04809-EJD Document 115 Filed 06/05/20 Page 1 of 17
`
`
`
`UNITED STATES DISTRICT COURT
`
`NORTHERN DISTRICT OF CALIFORNIA
`
`SAN JOSE DIVISION
`
`IN RE GOOGLE REFERRER HEADER
`PRIVACY LITIGATION
`
`
`
`Case No. 10-cv-04809-EJD
`
`ORDER DENYING MOTION TO
`DISMISS
`
`Re: Dkt. No. 107
`
`
`
`
`
`
`
`
`
`
`
`This is a class action concerning Defendant Google, LLC’s alleged disclosure of users’
`
`
`
`search terms to third party servers; it was originally settled in 2013. The case now returns to the
`
`Court upon remand from the U.S. Supreme Court, which vacated the settlement and instructed this
`
`Court to evaluate the plaintiffs’ Article III standing in light of its decision in Spokeo, Inc. v.
`
`Robins, 136 S. Ct. 1540 (2016). See Frank v. Gaos, 139 S. Ct. 1041, 1046 (2019). The Court has
`
`now done so, aided by the parties’ briefing and a hearing conducted on June 4, 2020. The Court
`
`finds that Plaintiffs have standing to bring their claims and DENIES Defendant’s motion to
`
`dismiss.
`
`I. BACKGROUND
`
`This suit’s path to the present motion is a long and circuitous one; accordingly, a brief
`
`review of how we got here is in order.
`
`Defendant Google, LLC (“Google”) operates an Internet search engine, which allows users
`
`to search for websites based on a query of keywords or phrases. Dkt. No. 51, Ex. A (“Consol.
`
`Compl.”) ¶¶ 15-16. Upon a search, Google displays the search results as a list of hyperlinks to the
`
`relevant websites; the user may click on a link to travel to the desired site. Id. ¶¶ 56-57. Plaintiffs
`
`Case No.: 10-cv-04809-EJD
`ORDER DENYING MOTION TO DISMISS
`
` 1
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Northern District of California
`
`United States District Court
`
`

`

`Case 5:10-cv-04809-EJD Document 115 Filed 06/05/20 Page 2 of 17
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`allege that when a user clicks on a search result, Google transmits the user’s search terms to the
`
`third-party server that hosts the website the user seeks to view. Id. That is because the “Uniform
`
`Resource Locator” (“URL”) used to direct the user to the requested website contains the URL of
`
`the last site the user visited—i.e., the page that “referred” them to the requested website; this
`
`information is known is as the “referrer header.” Id. ¶¶ 50-57; see generally In re Zynga Privacy
`
`Litig., 750 F.3d 1098, 1101 (9th Cir. 2014) (explaining URLs and referrer headers).
`
`Believing that the disclosure of search terms to third parties violates users’ statutory and
`
`contractual privacy rights, Named Plaintiff Paloma Gaos filed the original Complaint in October
`
`2010. Dkt. No. 1 (“Compl.”). The case was assigned to the undersigned judge in April 2011, Dkt.
`
`No. 25, and Plaintiff Gaos filed the First Amended Complaint (“FAC”) in May 2011, Dkt. No. 26
`
`(“FAC”). The FAC contains one federal claim for violation of the Electronic Communications
`
`Privacy Act (“ECPA”), 18 U.S.C. § 2702(a), and six state law claims for fraudulent
`
`misrepresentation, negligent misrepresentation, public disclosure of private facts, actual and
`
`constructive fraud under Cal. Civ. Code §§ 1572, 1573, breach of contract, and unjust enrichment.
`
`FAC ¶¶ 93-137. In May 2011, Defendant moved to dismiss the FAC pursuant to Federal Rules of
`
`Civil Procedure 12(b)(1) and 12(b)(6), Dkt. No. 29. As relevant to the instant dispute, Defendant
`
`argued that Plaintiff Gaos lacked standing to bring any of the claims in the FAC. Gaos v. Google
`
`Inc., No. 5:10-CV-4809 EJD, 2012 WL 1094646, at *1 (N.D. Cal. Mar. 29, 2012).
`
`This Court granted the motion in part and denied it in part. Id.; Dkt. No. 38. First, the
`
`Court found that Plaintiff Gaos had failed to adequately plead standing to bring her six state law
`
`claims and dismissed those claims with leave to amend. Gaos v. Google Inc., 2012 WL 1094646
`
`at *2. On the other hand, Gaos’s federal claim alleged a violation of her rights under Title II of the
`
`ECPA, which is the Stored Communications Act (“SCA”), 18 U.S.C. §§ 2701 et seq. This Court
`
`rejected Defendant’s contention that Plaintiff Gaos had not adequately alleged an injury in fact, as
`
`necessary for Article III standing. Gaos v. Google Inc., 2012 WL 1094646 at *3-*4; see Dkt. No.
`
`29 at 7-10. Citing Edwards v. First American Corporation, 610 F.3d 514 (9th Cir. 2010), the
`
`Court observed that “[t]he injury required by Article III . . . can exist solely by virtue of ‘statutes
`
`Case No.: 10-cv-04809-EJD
`ORDER DENYING MOTION TO DISMISS
`
` 2
`
`Northern District of California
`
`United States District Court
`
`

`

`Case 5:10-cv-04809-EJD Document 115 Filed 06/05/20 Page 3 of 17
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`creating legal rights, the invasion of which creates standing.’” 2012 WL 1094646 at *3 (quoting
`
`Edwards, 510 F. 3d at 517). The Court then recognized that “a violation of one’s statutory rights
`
`under the SCA” is, by itself, “a concrete injury” and found that Plaintiff Gaos had standing to
`
`assert the SCA claim. Id. (citing Jewel v. National Security Agency, 673 F.3d 902, 908 (9th Cir.
`
`2011)).
`
`In an effort to cure the standing deficiencies as to the state law claims, Gaos and an
`
`additional named plaintiff (Anthony Italiano) filed the Second Amended Complaint (“SAC”).
`
`Dkt. No. 39 (“SAC”). The SAC also contained new factual allegations that in October 2011,
`
`Google changed its practice regarding referrer headers. According to the SAC, Google’s new
`
`practice was to “scrub” search terms from the referrer headers on “regular, organic search results”
`
`when users are logged into a Google service; however, Google would continue to include search
`
`terms in referrer headers when users click on “paid links or advertisements.” SAC ¶¶ 6, 64-66.
`
`Thus, in Plaintiffs’ view, Google “is now effectively selling search queries to paying advertisers.”
`
`Id. ¶ 67.
`
`Defendant again moved to dismiss the SAC for lack of Article III standing. As to the state
`
`law claims, Defendant argued that Plaintiffs had not cured the deficiencies in the FAC. In
`
`addition, Defendant renewed its standing challenge to the SCA claim. Although Defendant
`
`recognized that this Court had already rejected its argument on this front, the U.S. Supreme Court
`
`had granted certiorari in Edwards, 510 F.3d 514; because this Court had relied in part on Edwards
`
`in finding standing, Defendant urged the Court to reconsider its decision in the event Edwards was
`
`reversed. Dkt. No. 44 at 3. When the Supreme Court dismissed Edwards as improvidently
`
`granted, 567 U.S. 756 (2012), however, Defendant withdrew its standing argument against the
`
`SCA claim. Dkt. No. 46 at 2 n.2.
`
`Then, before this Court made its ruling on Defendant’s motion to dismiss the SAC, the
`
`parties stipulated to the consolidation of Gaos and Italiano’s case with another class action, and
`
`Plaintiffs filed the now-operative Consolidated Complaint. Dkt. Nos. 50, 51. The motion to
`
`dismiss the SAC was therefore terminated as moot. Dkt. No. 51.
`
`Case No.: 10-cv-04809-EJD
`ORDER DENYING MOTION TO DISMISS
`
` 3
`
`Northern District of California
`
`United States District Court
`
`

`

`Case 5:10-cv-04809-EJD Document 115 Filed 06/05/20 Page 4 of 17
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Shortly thereafter, in July 2013, the parties reached a classwide settlement. The settlement
`
`agreement provided, among other things, that Defendant would pay a settlement amount of $8.5
`
`million, none of which would be distributed to absent class members; rather, any funds not used
`
`for costs, attorney’s fees, and incentive payments would be distributed to six cy pres recipients.
`
`This Court granted preliminary and then final approval of the settlement, over the objections of
`
`five class members. Dkt. Nos. 63, 85; see Frank v. Gaos, 139 S. Ct. 1041, 1045 (2019). Two of
`
`the objectors appealed the settlement to the Ninth Circuit, challenging the propriety of cy pres
`
`relief as well as the selection of the cy pres recipients. The Ninth Circuit affirmed this Court’s
`
`approval of the settlement. In re Google Referrer Header Privacy Litigation, 869 F.3d 737 (9th
`
`Cir. 2017).
`
`Undeterred, the objectors petitioned for certiorari before the U.S. Supreme Court, and their
`
`petition was granted. Frank v. Gaos, 138 S. Ct. 1697 (2018). Instead of reaching the merits of the
`
`cy pres issues, however, the Supreme Court identified a potential threshold obstacle: In 2016,
`
`while the objectors’ Ninth Circuit appeal was pending, the Supreme Court had issued its opinion
`
`in Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016). The Supreme Court explained that Spokeo
`
`“abrogated the ruling in Edwards that the violation of a statutory right automatically satisfies the
`
`injury-in-fact requirement whenever a statute authorizes a person to sue to vindicate that right.”
`
`Frank v. Gaos, 139 S. Ct. at 1046. But “[b]ecause Google withdrew its standing challenge after
`
`we dismissed Edwards as improvidently granted, neither the District Court nor the Ninth Circuit
`
`ever opined on whether any named plaintiff sufficiently alleged standing in the operative
`
`complaint.” Id. As this Court lacked power to approve the proposed class settlement if no named
`
`plaintiff had standing, the Supreme Court concluded that this Court should “address the plaintiffs’
`
`standing in light of Spokeo” in order to assure its jurisdiction. Id. The Supreme Court therefore
`
`vacated the judgment and remanded the case to the Ninth Circuit, id., which remanded the case to
`
`this Court, Dkt. No. 99.
`
`In accordance with the Supreme Court’s order, Defendant filed a motion to dismiss the
`
`operative Consolidated Complaint for lack of standing on March 20, 2020; that motion is now ripe
`
`Case No.: 10-cv-04809-EJD
`ORDER DENYING MOTION TO DISMISS
`
` 4
`
`Northern District of California
`
`United States District Court
`
`

`

`Case 5:10-cv-04809-EJD Document 115 Filed 06/05/20 Page 5 of 17
`
`
`
`for this Court’s review. Dkt. Nos. 107, 108, 109, 110.
`
`II. LEGAL STANDARD
`
`The Court begins by reviewing the basic legal standards applicable to Defendant’s motion
`
`to dismiss, which is brought under Federal Rule of Civil Procedure 12(b)(1). A Rule 12(b)(1)
`
`motion tests whether the court has subject matter jurisdiction to hear the claims alleged in the
`
`complaint. Here, Defendant contends that Plaintiffs lack Article III standing, which “is a
`
`necessary component of subject matter jurisdiction.” In re Palmdale Hills Prop., LLC, 654 F.3d
`
`868, 873 (9th Cir. 2011).
`
`The Supreme Court has repeatedly stated that the “irreducible constitutional minimum of
`
`standing” consists of three elements, Lujan v. Defs. of Wildlife, 504 U.S. 555, 560 (1992): “The
`
`plaintiff must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged
`
`conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision,”
`
`Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 1547 (2016). These elements are typically referred to as
`
`injury in fact, causation, and redressability. See, e.g., Planned Parenthood of Greater Washington
`
`& N. Idaho v. U.S. Dep’t of Health & Human Servs., 946 F.3d 1100, 1108 (9th Cir. 2020).
`
`Plaintiffs, as the parties invoking federal jurisdiction, bear the burden of establishing the existence
`
`of Article III standing and, at the pleading stage, “must clearly allege facts demonstrating each
`
`element.” Spokeo, 136 S. Ct. at 1547 (internal quotations omitted); see also Baker v. United
`
`States, 722 F.2d 517, 518 (9th Cir. 1983) (“The facts to show standing must be clearly apparent on
`
`the face of the complaint.”).
`
`“In a class action, this standing inquiry focuses on the class representatives.” NEI
`
`Contracting & Eng’g, Inc. v. Hanson Aggregates Pac. Sw., Inc., 926 F.3d 528, 532 (9th Cir.
`
`2019). The named plaintiffs “must allege and show that they personally have been injured, not
`
`that injury has been suffered by other, unidentified members of the class to which they belong and
`
`which they purport to represent.” Warth v. Seldin, 422 U.S. 490, 502 (1975). Standing for the
`
`putative class “is satisfied if at least one named plaintiff meets the requirements.” Bates v. United
`
`Parcel Serv., Inc., 511 F.3d 974, 985 (9th Cir. 2007). But if none of the named plaintiffs
`
`Case No.: 10-cv-04809-EJD
`ORDER DENYING MOTION TO DISMISS
`
` 5
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Northern District of California
`
`United States District Court
`
`

`

`Case 5:10-cv-04809-EJD Document 115 Filed 06/05/20 Page 6 of 17
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`purporting to represent a class can establish standing to sue, the class action cannot proceed. See
`
`NEI Contracting, 926 F.3d at 532 (citing O'Shea v. Littleton, 414 U.S. 488, 494 (1974)).
`
`Where, as here, the Rule 12(b)(1) motion is a facial challenge to Plaintiffs’ standing, the
`
`court considers whether the allegations contained in the complaint are sufficient on their face to
`
`invoke federal jurisdiction. See Safe Air for Everyone v. Meyer, 373 F.3d 1035, 1039 (9th Cir.
`
`2004). That is, a district court “resolves a facial attack as it would a motion to dismiss under Rule
`
`12(b)(6): Accepting the plaintiff’s allegations as true and drawing all reasonable inferences in the
`
`plaintiff's favor, the court determines whether the allegations are sufficient as a legal matter to
`
`invoke the court’s jurisdiction.” Leite v. Crane Co., 749 F.3d 1117, 1121 (9th Cir. 2014). As with
`
`a Rule 12(b)(6) motion, however, a court is not required “to accept as true allegations that are
`
`merely conclusory, unwarranted deductions of fact, or unreasonable inferences.” In re Gilead
`
`Scis. Sec. Litig., 536 F.3d 1049, 1055 (9th Cir. 2008); see also Thomas v. Mundell, 572 F.3d 756,
`
`763 (9th Cir. 2009) (finding allegations “too vague” to support standing).
`
`Finally, the Court notes that the question of standing is “distinct from the merits” of a
`
`plaintiff’s claim. Maya v. Centex Corp., 658 F.3d 1060, 1068 (9th Cir. 2011); see also Warth v.
`
`Seldin, 422 U.S. 490, 500 (1975) (“[S]tanding in no way depends on the merits of the plaintiff's
`
`contention that particular conduct is illegal . . . .”). Hence, when considering whether a plaintiff
`
`has standing, a federal court may assume arguendo the merits of the plaintiff’s legal claim.
`
`III. DISCUSSION
`
`The Court now turns to the substance of Defendant’s motion. The operative pleading is
`
`the Consolidated Complaint, which contains six claims: (1) violation of the ECPA, 18 U.S.C.
`
`§ 2702(a), Consol. Compl. ¶¶ 130-141; (2) breach of contract, id. ¶¶ 142-47; (3) breach of the
`
`covenant of good faith and fair dealing, id. ¶¶ 148-152; (4) breach of contract implied in law, id.
`
`¶¶ 153-58; (5) unjust enrichment, id. ¶¶ 159-163; (6) declaratory judgment and corresponding
`
`injunctive relief under 28 U.S.C. §§ 2201-2202, id. ¶¶ 164-171. Defendant contends that Plaintiffs
`
`lack Article III standing to bring any of these claims. Specifically, Defendant’s motion concerns
`
`the injury in fact element; it does not contest causation or redressability. See Dkt. No. 107
`
`Case No.: 10-cv-04809-EJD
`ORDER DENYING MOTION TO DISMISS
`
` 6
`
`Northern District of California
`
`United States District Court
`
`

`

`Case 5:10-cv-04809-EJD Document 115 Filed 06/05/20 Page 7 of 17
`
`
`
`(“Mot.”) at 9.
`
`As set forth below, the Court concludes that Plaintiffs have met their burden of
`
`establishing injury in fact as to each of their claims for relief, wherefore Defendant’s motion is
`
`DENIED.
`
`A. ECPA Violation
`
`First, the Court considers whether Plaintiffs have standing to assert Count 1, i.e., that
`
`Google violated Title II of the ECPA, 18 U.S.C. § 2702(a).
`
`Injury in fact is the “first and foremost element” of standing, Dutta v. State Farm Mut.
`
`Auto. Ins. Co., 895 F.3d 1166, 1173 (9th Cir. 2018); it serves “to ensure that the plaintiff has a
`
`personal stake in the litigation.” Susan B. Anthony List v. Driehaus, 573 U.S. 149, 159 (2014)
`
`(internal quotations omitted). “To establish injury in fact, a plaintiff must show that he or she
`
`suffered ‘an invasion of a legally protected interest’ that is ‘concrete and particularized’ and
`
`‘actual or imminent, not conjectural or hypothetical.’” Spokeo, 136 S. Ct. at 1548 (quoting Lujan,
`
`504 U.S. at 560). In this case, the Supreme Court has instructed the Court to focus on the
`
`concreteness of Plaintiffs’ injury in fact. Concreteness “requires an injury to be de facto, that is, to
`
`actually exist.” Spokeo, 136 S. Ct. at 1543 (internal quotations omitted). Although concrete
`
`means “real, and not abstract,” it is not “synonymous with ‘tangible’”; intangible injuries can
`
`certainly be concrete. Id. at 1549. In determining whether an intangible injury is concrete, “both
`
`history and the judgment of Congress play important roles.” Id. at 1548. “We consider history
`
`because ‘it is instructive to consider whether an alleged intangible harm has a close relationship to
`
`a harm that has traditionally been regarded as providing a basis for a lawsuit in English or
`
`American courts.’” Patel v. Facebook, Inc., 932 F.3d 1264, 1270 (9th Cir. 2019) (quoting Spokeo,
`
`136 S. Ct. at 1549). “We must also examine legislative judgment because legislatures are ‘well
`
`positioned to identify intangible harms that meet minimum Article III requirements.’” Id. (quoting
`
`Spokeo, 136 S. Ct. at 1543).
`
`In this Court’s 2012 order on Plaintiffs’ standing to assert the FAC, the Court found that
`
`Defendant’s alleged violation of the SCA is itself a concrete injury. Gaos, 2012 WL 1094646, at
`
`Case No.: 10-cv-04809-EJD
`ORDER DENYING MOTION TO DISMISS
`
` 7
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Northern District of California
`
`United States District Court
`
`

`

`Case 5:10-cv-04809-EJD Document 115 Filed 06/05/20 Page 8 of 17
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`*1. The Court based that finding on the Ninth Circuit’s statement in Edwards that “[t]he injury
`
`required by Article III can exist solely by virtue of ‘statutes creating legal rights, the invasion of
`
`which creates standing.” 610 F.3d at 517 (quoting Warth v. Seldin, 422 U.S. 490, 500 (1975)). In
`
`this case, the ECPA creates the relevant legal right, namely, a right against the disclosure of “the
`
`contents of any communication” that is “carried or maintained on,” 18 U.S.C. § 2702(a)(2), or “in
`
`electronic storage by,” id. § 2702(a)(1), an electronic communication service provider. Because
`
`those provisions of the ECPA “provide[] a right to judicial relief . . . without additional injury,”
`
`the Court held that any violation of these statutory rights is a concrete injury. Gaos, 2012 WL
`
`1094646, at *3 (citing Jewel, 673 F.3d at 908).
`
`Pursuant to the Supreme Court’s instruction, the Court now reevaluates this conclusion in
`
`light of Spokeo.
`
`As the Supreme Court emphasized, Spokeo rejected the proposition that “a plaintiff
`
`automatically satisfies the injury-in-fact requirement whenever a statute grants a person a statutory
`
`right and purports to authorize that person to sue to vindicate that right,” Frank, 139 S. Ct. at 1045
`
`(quoting Spokeo, 136 S. Ct. at 1549). By way of example, the Spokeo Court stated that a “bare
`
`procedural violation, divorced from any concrete harm,” does not “satisfy the injury-in-fact
`
`requirement of Article III.” Spokeo, 136 S. Ct. at 1549. At the same time, however, Spokeo
`
`recognized that Congress may enact statutes that “‘elevate to the status of legally cognizable
`
`injuries concrete, de facto injuries that were previously inadequate’ to confer standing.” In re
`
`Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 598 (9th Cir. 2020) (quoting Spokeo, 136 S.
`
`Ct. at 1549). “A plaintiff in such a case need not allege any additional harm beyond the one
`
`Congress has identified.” Spokeo, 136 S. Ct. at 1549.
`
`The Ninth Circuit has parsed these principles as follows: “When a legislature has enacted a
`
`‘bare procedural’ protection, a plaintiff ‘cannot satisfy the demands of Article III’ by pointing
`
`only to a violation of that provision, but also must link it to a concrete harm.” Campbell v.
`
`Facebook, Inc., 951 F.3d 1106, 1117 (9th Cir. 2020) (quoting Spokeo, 136 S. Ct. at 1550)
`
`(emphasis in original). “When, however, a statutory provision identifies a substantive right that is
`
`Case No.: 10-cv-04809-EJD
`ORDER DENYING MOTION TO DISMISS
`
` 8
`
`Northern District of California
`
`United States District Court
`
`

`

`Case 5:10-cv-04809-EJD Document 115 Filed 06/05/20 Page 9 of 17
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`infringed any time it is violated, a plaintiff bringing a claim under that provision need not allege
`
`any further harm to have standing.” Id. (internal quotations omitted) (emphasis in original). The
`
`upshot is that if the ECPA provisions alleged to be violated in Count 1 protect a substantive right
`
`as opposed to a purely procedural one, Plaintiffs have pleaded the invasion of a legally protected
`
`interest that is concrete.
`
`The Court is satisfied that, under the Ninth Circuit’s post-Spokeo case law, the answer is
`
`yes. The Ninth Circuit has identified several state and federal statutes that protect individuals’
`
`substantive privacy interests. For instance, in Eichenberger v. ESPN, Inc., the court held that the
`
`Video Privacy Protection Act of 1988 (“VPPA”), 18 U.S.C. § 2710(b)(1), “identifies a substantive
`
`right to privacy that suffers any time a video service provider discloses otherwise private
`
`information.” 876 F.3d 979, 983-84 (9th Cir. 2017) (emphasis added). Heeding the Supreme
`
`Court’s teaching to consider history, the Ninth Circuit observed that “[v]iolations of the right to
`
`privacy have long been actionable at common law” and that those “privacy torts do not always
`
`require additional consequences to be actionable.” Id. Likewise, statutes like the VPPA do not
`
`only protect against harms that come from the use of disclosed information; rather, they “protect[]
`
`privacy interests more generally by ensuring that consumers retain control over their personal
`
`information.” Id. at 983. Thus, the court found, every violation of 18 U.S.C. § 2710(b)(1)
`
`presents a concrete harm to the privacy interests Congress sought to protect in enacting the VPPA.
`
`Id. at 984.
`
`Similarly, in Van Patten v. Vertical Fitness Group, LLC, the Ninth Circuit held that the
`
`provisions in the Telephone Consumer Protection Act (“TCPA”) prohibiting a telemarketer from
`
`calling or texting a consumer without the consumer’s consent “protect the plaintiff’s substantive
`
`right to privacy, namely the right to be free from unsolicited telemarketing phone calls or text
`
`messages that ‘invade the privacy and disturb the solitude of their recipients.’” Patel, 932 F.3d at
`
`1271 (quoting Van Patten, 847 F.3d 1037, 1041–43 (9th Cir. 2017)). For that reason, the court
`
`said, “a plaintiff alleging a violation under the TCPA need not allege any additional harm.” Van
`
`Patten, 847 F.3d at 1043 (internal quotations omitted). Illinois’s Biometric Information Privacy
`
`Case No.: 10-cv-04809-EJD
`ORDER DENYING MOTION TO DISMISS
`
` 9
`
`Northern District of California
`
`United States District Court
`
`

`

`Case 5:10-cv-04809-EJD Document 115 Filed 06/05/20 Page 10 of 17
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Act (“BIPA”) is yet another example of a statute that “protect[s] an individual’s concrete interests
`
`in privacy, not merely procedural rights.” Patel, 932 F.3d at 1274 (internal quotations omitted)
`
`(holding that BIPA protects “the right not to be subject to the collection and use of . . . biometric
`
`data”).
`
`Of particular relevance here, the Ninth Circuit has recognized that the ECPA—the very
`
`statute at issue in this case—is among these statutes that “codify a context-specific extension of
`
`the substantive right to privacy,” the violation of which is a concrete harm. Campbell, 951 F.3d at
`
`1117 (internal quotation omitted) (emphasis in original); see also In re Facebook, Inc. Internet
`
`Tracking Litig., 956 F.3d 589, 598 (9th Cir. 2020).
`
`Issued in March of this year, Campbell concerned provisions of the ECPA that provide a
`
`private right of action against one who “intentionally intercepts or endeavors to intercept” any
`
`wire, oral, or electronic communication, see 18 U.S.C. § 2511(1)(a), and against one who
`
`“intentionally uses, or endeavors to use” the contents of a communication knowingly obtained
`
`through such interception, see id. § 2511(1)(d). Campbell, 951 F.3d at 1112. The case also
`
`involved analogous provisions of the California Invasion of Privacy Act (“CIPA”), see Cal. Penal
`
`Code § 631(a). Id. As the Ninth Circuit explained, the ECPA and the CIPA “are targeted at the
`
`substantive intrusion that occurs when private communications are intercepted by someone who
`
`does not have the right to access them.” Id. at 1119. The private rights of action contained
`
`therein—like those examined in the above-cited cases—“bear a ‘close relationship’” to traditional
`
`privacy torts such as unreasonable intrusion upon seclusion. Id. at 1117-18 (quoting Spokeo, 136
`
`S. Ct. at 1549). These provisions “represent statutory modernizations of the privacy protections
`
`available at common law” in light of new technology. Id. at 1118; see also In re Facebook, Inc.
`
`Internet Tracking Litig., 956 F.3d at 599 (emphasizing that “[a]dvances in technology can increase
`
`the potential for unreasonable intrusions into personal privacy”). They also reflect the
`
`“legislatures’ judgment about the importance of the privacy interests violated when
`
`communications are intercepted.” Campbell, 951 F.3d at 1118. Accordingly, the Ninth Circuit
`
`held, “every violation of the provisions of ECPA and CIPA at issue” is a clear de facto injury. Id.
`
`Case No.: 10-cv-04809-EJD
`ORDER DENYING MOTION TO DISMISS
`
` 10
`
`Northern District of California
`
`United States District Court
`
`

`

`Case 5:10-cv-04809-EJD Document 115 Filed 06/05/20 Page 11 of 17
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`One month later, in In re Facebook, Inc. Internet Tracking Litigation, the Ninth Circuit
`
`affirmed its determination that the ECPA “codif[ies] a substantive right to privacy, the violation of
`
`which gives rise to a concrete injury sufficient to confer standing.” 956 F.3d at 598. Moreover,
`
`whereas Campbell focused on the Wiretap Act portions of the ECPA (Title I), In re Facebook
`
`made clear that the SCA portions of the ECPA (Title II) likewise protect “historical privacy
`
`rights.” Id. at 598 (discussing 18 U.S.C. § 2701). Specifically, the SCA “protects individuals’
`
`privacy and proprietary interests” in communications stored with electronic communication
`
`service providers. Theofel v. Farey-Jones, 359 F.3d 1066, 1072 (9th Cir. 2004).
`
`It does so by providing a private right of action against both unlawful access to
`
`communications in electronic storage, see 18 U.S.C. § 2701, and unlawful disclosure of such
`
`communications, see 18 U.S.C. § 2702. The Ninth Circuit has analogized the unlawful access
`
`provisions of the SCA to the common law tort of trespass: “Just as trespass protects those who rent
`
`space from a commercial storage facility to hold sensitive documents, the Act protects users
`
`whose electronic communications are in electronic storage with an ISP or other electronic
`
`communications facility.” Theofel, 359 F.3d at 1072–73 (internal quotations and citations
`
`omitted). The unlawful disclosure provisions of the SCA, moreover, are closely analogous to the
`
`common law tort of breach of confidence. “A common law breach of confidence lies where a
`
`person offers private information to a third party in confidence and the third party reveals that
`
`information to another.” Jeffries v. Volume Servs. Am., Inc., 928 F.3d 1059, 1064 (D.C. Cir.
`
`2019). Though Defendant resists this analogy, the Court believes the SCA “establishes a similar
`
`relationship of trust between” user and electronic communication service provider; that
`
`relationship renders a SCA violation sufficiently similar to a breach of confidence to satisfy
`
`Spokeo. See id. (analogizing a violation of the Fair and Accurate Credit Transactions Act of 2003
`
`(“FACTA”) to a breach of confidence based on the “relationship of trust” between consumer and
`
`merchant under FACTA).
`
`Of course, the SCA also “reflects Congress’s judgment that users have a legitimate interest
`
`in the confidentiality of communications in electronic storage at a communications facility.”
`
`Case No.: 10-cv-04809-EJD
`ORDER DENYING MOTION TO DISMISS
`
` 11
`
`Northern District of California
`
`United States District Court
`
`

`

`Case 5:10-cv-04809-EJD Document 115 Filed 06/05/20 Page 12 of 17
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Theofel, 359 F.3d at 1072–73; see also In re Facebook, Inc. Internet Tracking Litig., 956 F.3d at
`
`598-99 (finding the SCA was enacted “to protect privacy interests in personal and proprietary
`
`information”). The provision pertinent to this case, 18 U.S.C. § 2702, establishes that those
`
`interests are concretely—though perhaps intangibly—harmed by the unauthorized disclosure of
`
`the communications to a third party.
`
`For all these reasons, the Court concludes that, as with the provisions of ECPA considered
`
`in Campbell and In re Facebook, 18 U.S.C. § 2702 “guard[s] against invasions of concrete privacy
`
`interests” such that every violation thereof causes concrete harm. Campbell, 951 F.3d at 1118.
`
`Plaintiffs have therefore pleaded a concrete injury by claiming that Google violated 18 U.S.C.
`
`§ 2702 when it disclosed their search terms to third parties without authorization. See id. at 1119.
`
`Defendant spends the bulk of its brief arguing that Plaintiffs cannot show the search terms
`
`can or will be linked to a searcher’s identity. Mot. at 11. In Defendant’s view, if the searcher
`
`cannot be identified, anonymized search terms could “rarely if ever could result in harm or
`
`certainly impending harm.” Mot. at 11. But that argument assumes that harm must take the form
`
`of “individuals’ discovered identities” being “exploit[ed] . . . to their detriment.” Id. at 19; see
`
`also id. at 18-21. Not so. As just explained, 18 U.S.C. § 2702 protects users’ privacy rights
`
`against the mere disclosure of their communications; the statute makes such disclosure actionable
`
`regardless whether those communications reveal the user’s identity. Congress has, in other words,
`
`identified a concrete privacy interest in communications stored with electronic communication
`
`service providers—even if those communications cannot be linked to the user. After all,
`
`information need not be personally identifying to be private. Because Plaintiffs “need not allege
`
`any additional harm beyond the one Congress has identified.” Spokeo, 136 S.Ct. at 1549, their
`
`standing in no way depends on whether the search terms may be used to discover their identities.1
`
`See Campbell, 951 F.3d at 1119.
`
`
`1 Accordingly, the Court does not reach the issue of whether the risk of future harm—i.e., the risk
`that anonymized search terms will be “reidentified” with the users—is also an injury-in-fact that is
`“actual” and not “hypothetical.” See Dkt. No. 109 (“Opp.”) at 8-9.
`Case No.: 10-cv-04809-EJD
`ORDER DENYING MOTION TO DISMISS
`
` 12
`
`Northe