Case: 17-16873, 03/03/2020, ID: 11615863, DktEntry: 76-1, Page 1 of 38
`
`FOR PUBLICATION
`
`UNITED STATES COURT OF APPEALS
`FOR THE NINTH CIRCUIT
`
`
`MATTHEW CAMPBELL; MICHAEL
`HURLEY, on behalf of themselves
`and all others similarly situated,
`Plaintiffs-Appellees,
`
` No. 17-16873
`
`D.C. No.
`4:13-cv-05996-
`PJH
`
`
`OPINION
`
`v.
`
`
`FACEBOOK, INC.,
`Defendant-Appellee,
`
`
`
`
`
`v.
`
`
`ANNA W. ST. JOHN,
`Objector-Appellant.
`
`Appeal from the United States District Court
`for the Northern District of California
`Phyllis J. Hamilton, Chief Judge, Presiding
`
`Argued and Submitted January 18, 2019
`Submission Vacated June 4, 2019
`Resubmitted March 3, 2020
`San Francisco, California
`
`Filed March 3, 2020
`
`Before: J. Clifford Wallace, Richard R. Clifton,
`and Michelle T. Friedland, Circuit Judges.
`
`
`

`

`Case: 17-16873, 03/03/2020, ID: 11615863, DktEntry: 76-1, Page 2 of 38
`
`2
`
`
`
`
`
`CAMPBELL V. ST. JOHN
`
`Opinion by Judge Friedland
`
`
`SUMMARY*
`
`Objector / Class Action Settlement
`
`In an appeal brought by an objecting class member, the
`panel affirmed the district court’s approval of a settlement
`between Facebook and a nationwide class of its users who
`alleged that Facebook routinely used website links in users’
`private messages without their consent in violation of federal
`and California privacy laws.
`
`Facebook acknowledged in the settlement agreement
`that it had already made several changes to the practices
`challenged in this action, and it agreed to add a disclosure to
`a Help Center page on its website for a year. The district
`court, over the objector’s challenge, found the settlement to
`be fair and approved it; and granted in full class counsel’s
`request for $3.89 million in fees and costs.
`
`As a threshold matter, the panel held that the plaintiff
`class had Article III standing to bring the case. First, the
`panel held that the plaintiffs identified a concrete injury.
`Specifically, the panel concluded that the plaintiffs identified
`a concrete injury by claiming that Facebook violated the
`federal Electronic Communications Privacy Act and the
`California Invasion of Privacy Act when it intercepted,
`catalogued, and used without consent URLs that users had
`shared in private messages. Second, the panel held that the
`
`* This summary constitutes no part of the opinion of the court. It
`has been prepared by court staff for the convenience of the reader.
`
`

`

`Case: 17-16873, 03/03/2020, ID: 11615863, DktEntry: 76-1, Page 3 of 38
`
`CAMPBELL V. ST. JOHN
`
`
`
`plaintiffs established standing to seek injunctive relief, and
`post-filing developments did not moot this case. The panel
`concluded that the district court had jurisdiction to approve
`the settlement, and the panel therefore had jurisdiction to
`review the merits of that decision.
`
`3
`
`The panel rejected the objector’s challenges to the
`substantive fairness of the settlement. First, the panel
`rejected the argument that the settlement was invalid because
`the class received only “worthless injunctive relief.” Koby
`v. ARS National Services, Inc., 846 F.3d 1071, 1081 (9th Cir.
`2017). The panel held that the district court did not clearly
`err in finding that the settlement’s injunctive relief had value
`to absent class members. Moreover, the class did not need
`to receive much for the settlement to be fair because the class
`gave up very little. Second, the panel rejected the objector’s
`argument that the settlement was invalid under In re
`Bluetooth Headset Products Liability Litigation, 654 F.3d
`935 (9th Cir. 2010), because it prioritized class counsel’s
`interests over those of their clients. The panel held that the
`district court looked at the Bluetooth warning signs of
`possible collusion between class counsel and Facebook, and
`the district court did not abuse its discretion in concluding
`that none of the warning signs weighed against approval of
`the settlement. The panel concluded that applying the
`Bluetooth framework did not demonstrate that the settlement
`in this case was unfair.
`
`
`
`
`
`

`

`Case: 17-16873, 03/03/2020, ID: 11615863, DktEntry: 76-1, Page 4 of 38
`
`4
`
`
`CAMPBELL V. ST. JOHN
`
`COUNSEL
`
`
`Adam Ezra Schulman (argued), Anna St. John, and
`Theodore H. Frank, Center for Class Action Fairness,
`Washington, D.C.; for Objector-Appellant.
`
`Hank Bates (argued), Allen Carney, and David Slade,
`Carney Bates & Pulliam PLLC, Little Rock, Arkansas;
`Michael W. Sobol, David T. Rudolph, and Melissa Gardner,
`Lieff Cabraser Heimann & Bernstein LLP, San Francisco,
`California; Rachel Geman and Nicholas Diamand, Lieff
`Cabraser Heimann & Bernstein LLP, New York, New York;
`for Plaintiffs-Appellees.
`
`Christopher Chorba (argued), Joshua A. Jessen, Ashley M.
`Rogers, and Ryan S. Appleby, Gibson Dunn & Crutcher
`LLP, Los Angeles, California, for Defendant-Appellee.
`
`Marc Rotenberg, Alan Butler, and Sam Lester, Electronic
`Privacy Information Center, Washington, D.C., for Amicus
`Curiae Electronic Privacy Information Center (EPIC).
`
`
`
`OPINION
`
`FRIEDLAND, Circuit Judge:
`
`Objecting class member Anna St. John (“Objector”)
`appeals from the district court’s approval of a settlement
`between Facebook and a nationwide class of its users who
`alleged that Facebook routinely captured, read, and used for
`several purposes the website links included in users’ private
`messages without their consent, and that these practices
`violated federal and California privacy laws. After years of
`litigation that included lengthy discovery, four mediation
`
`

`

`Case: 17-16873, 03/03/2020, ID: 11615863, DktEntry: 76-1, Page 5 of 38
`
`5
`
`CAMPBELL V. ST. JOHN
`
`
`
`sessions, and Facebook’s failed attempts to convince the
`district court to dismiss the case or deny class certification,
`the parties reached a settlement. Facebook acknowledged in
`the settlement agreement that it had already made several
`changes to the practices challenged in this action, and it
`agreed to add a disclosure to a Help Center page on its
`website for a year. The settlement agreement also provided
`that class counsel could apply for court approval of up to
`$3.89 million in attorney’s fees and costs, and that Facebook
`would not take any position on that application. The district
`court, over Objector’s challenge, found the settlement to be
`fair and approved it. The district court also granted in full
`class counsel’s request for $3.89 million in fees and costs.
`
`Addressing Objector’s appeal from the district court’s
`approval of the settlement, we first consider whether
`Plaintiffs had standing to bring this action and whether it
`later became moot. We conclude that the district court had
`jurisdiction, and, accordingly, that we have jurisdiction to
`evaluate the fairness of the settlement. Second, we reject on
`the merits Objector’s contentions that the district court
`abused its discretion by approving the settlement.
`
`I.
`
`A.
`
`“Facebook operates one of the largest social media
`platforms in the world, with over one billion active users.
`About seven in ten adults in the United States use
`Facebook.” Patel v. Facebook, Inc., 932 F.3d 1264, 1267
`(9th Cir. 2019) (citations omitted), cert. denied, No. 19-706
`(U.S. Jan. 21, 2020). Facebook has a messaging function on
`its platform that allows users to send electronic messages to
`one or more other users. Facebook explains on its website
`that these messages are “private” because their contents and
`
`

`

`Case: 17-16873, 03/03/2020, ID: 11615863, DktEntry: 76-1, Page 6 of 38
`
`CAMPBELL V. ST. JOHN
`
`6
`
`history are viewable only by the sender and his or her chosen
`recipients—in contrast to, for example, posts shared with a
`broader audience, such as all of the user’s Facebook friends.
`
`In December 2013, Matthew Campbell and Michael
`Hurley (“Plaintiffs”) filed a putative class action against
`Facebook. Plaintiffs alleged that Facebook scanned their
`private messages looking for links to web pages, also known
`as URLs, contained in those messages. They alleged that if
`a message contained a URL, Facebook would collect that
`information and use it in a variety of ways without the user’s
`consent.
`
`The main allegations concerned how Facebook
`integrated these private message URL shares into a feature
`that enabled third parties to show on their own websites a
`count of how many Facebook users had “Liked” the pages
`on their sites—a proxy for those pages’ popularity. Plaintiffs
`alleged that Facebook would increase a page’s “Like”
`counter not only when a Facebook user affirmatively pressed
`a “Like” button, but also when the user sent a private
`message containing a URL corresponding to the page,
`regardless of what the message said about the URL.1
`Plaintiffs also alleged that Facebook used the private
`message URL data that it was collecting to help build
`profiles of individual users that could facilitate, among other
`things, targeted advertising on Facebook.
`
`Plaintiffs contended that Facebook’s handling of their
`messages amounted to interception and use of electronic
`communications in violation of Title I of the Electronic
`
`1 Plaintiffs did not allege that it was possible for users or third parties
`to tell anything from the “Like” counter other than the total number of
`users whose activity had resulted in a “Like” counter increase.
`
`

`

`Case: 17-16873, 03/03/2020, ID: 11615863, DktEntry: 76-1, Page 7 of 38
`
`7
`
`CAMPBELL V. ST. JOHN
`
`
`
`Communications Privacy Act (“ECPA”), 18 U.S.C. § 2510
`et seq.,2 and the California Invasion of Privacy Act
`(“CIPA”), Cal. Penal Code § 630 et seq. They also alleged
`that it amounted to an unlawful, unfair, or fraudulent
`business practice under the California Unfair Competition
`Law (“UCL”), Cal. Bus. & Prof. Code § 17200 et seq.
`Plaintiffs sought damages as well as declaratory and
`injunctive relief.
`
`Facebook filed a motion to dismiss, which the district
`court granted in part and denied in part. The district court
`dismissed the UCL claim and a portion of the CIPA claim,
`but it declined to dismiss the ECPA claim and the portion of
`the CIPA claim alleging
`interception and use of
`communications in violation of California Penal Code
`section 631. The district court also rejected Facebook’s sole
`jurisdictional argument: that the prayer for injunctive relief
`should be stricken for failure to allege ongoing or future
`injury.3
`
`The parties engaged in extensive discovery, which
`included the production of tens of thousands of pages of
`documents, depositions of eighteen fact and expert
`witnesses, hundreds of hours of analysis of Facebook’s
`
`
`2 Title I of ECPA amended the federal Wiretap Act. For this reason,
`the provisions at issue in this case are often also referred to as part of the
`Wiretap Act.
`
`3 Specifically, Facebook pointed out that Plaintiffs had not alleged
`that the “Like” counting practice was still in place. The district court
`held that Plaintiffs had sufficiently alleged that, even if Facebook had
`temporarily stopped that practice, Facebook was likely enough to inflict
`future injury in a similar manner to support standing to seek injunctive
`relief.
`
`

`

`Case: 17-16873, 03/03/2020, ID: 11615863, DktEntry: 76-1, Page 8 of 38
`
`CAMPBELL V. ST. JOHN
`
`8
`
`source code, and significant briefing about discovery
`disputes.
`
`Plaintiffs moved for certification of a damages class
`under Federal Rule of Civil Procedure 23(b)(3), and in the
`alternative an injunctive and declaratory relief class under
`Rule 23(b)(2). Facebook opposed the motion, arguing that
`Plaintiffs failed to satisfy Rule 23’s requirements—but not
`arguing that the court lacked jurisdiction.4 In May 2016, the
`district court granted the motion in part and denied it in part.
`
`The court denied certification of a damages class. It
`explained that Plaintiffs had proposed two methods for
`calculating damages but that neither was acceptable. One of
`Plaintiffs’ proposals was to measure Facebook’s profits from
`intercepting and using URL data from messages. The court
`explained, however, that Plaintiffs’ proposed methodology
`had unjustifiably assumed that all interceptions resulted in
`the same profit, which made the model too inaccurate.
`Plaintiffs’ other proposal was to award statutory damages,
`which fared no better. The court reasoned that it would be
`required to either award the full statutory sum or nothing, but
`“many individual damages awards [of that full sum] would
`be disproportionate” to the small amount of harm suffered
`by many class members. It held that class treatment was
`
`
`4 Facebook included two statements in its opposition to Plaintiffs’
`class certification motion that gestured toward standing: (1) that the
`testimony of one (but not both) of the named Plaintiffs “calls into
`question his standing under Article III to seek injunctive relief”; and
`(2) that “Facebook also reserves its rights pursuant to [the Supreme
`Court’s then-pending decision in the case that would ultimately be issued
`a few months later as Spokeo, Inc. v. Robins (Spokeo I), 136 S. Ct. 1540
`(2016)].” Although Facebook has argued that these statements “raised
`[the] issue [of jurisdiction] at class certification,” neither was in fact an
`argument that jurisdiction was lacking.
`
`

`

`Case: 17-16873, 03/03/2020, ID: 11615863, DktEntry: 76-1, Page 9 of 38
`
`CAMPBELL V. ST. JOHN
`
`
`
`inappropriate because “sorting out those disproportionate
`damages awards would require individualized analyses.”
`
`9
`
`The district court granted certification of an injunctive
`and declaratory
`relief class.
` The certified class
`encompassed:
`
`All natural-person Facebook users [aside
`from
`those excluded
`through standard
`carveout provisions]
`located within
`the
`United States who have sent, or received
`from a Facebook user, private messages that
`included URLs in their content (and from
`which Facebook
`generated
`a URL
`attachment), from [December 2011] up
`through the date of the certification of the
`class.
`
`In the class certification order, the district court observed
`that Plaintiffs had focused their claims on three specific uses
`of the URL data that had been collected from private
`messages: (1) Facebook’s counting URL shares as a “Like”
`of the relevant third-party web page; (2) Facebook’s sharing
`data regarding URLs in messages with third parties, enabling
`those third parties to generate customized content and
`targeted advertising on their own websites informed by this
`data; and (3) Facebook’s use of the URL data to generate
`recommendations for other Facebook users. The district
`court concluded
`that although Plaintiffs had made
`allegations in their complaint about the first of these uses and
`“arguably” about the third, they had not specifically alleged
`the predicate for the second use, “sharing of data with third
`parties.” But the district court further concluded that
`Plaintiffs’ decision to focus on all three of these uses of URL
`data was “based on a review of discovery that was not
`
`

`

`Case: 17-16873, 03/03/2020, ID: 11615863, DktEntry: 76-1, Page 10 of 38
`
`CAMPBELL V. ST. JOHN
`
`10
`
`available at the time of the complaint’s filing.” The district
`court therefore permitted Plaintiffs to represent the class in
`challenging all three uses, and it directed them to file a
`conforming amended complaint (which they then did).
`
`The parties expended significant effort to try to settle this
`case. Several months after the motion to dismiss ruling, they
`participated in a full-day mediation session. The parties
`returned to the negotiating table after the district court’s May
`2016 order certifying an injunctive and declaratory relief
`class. During the last several months of 2016, the parties
`attended a total of three mediation sessions and continued to
`negotiate informally. About a week before the fact
`discovery period was scheduled to close, the district court
`approved the parties’ stipulation to stay discovery and vacate
`existing deadlines to facilitate their settlement efforts.
`Shortly thereafter, in December 2016—almost two years
`into the parties’ extensive discovery—the parties reached an
`agreement in principle during their fourth mediation session.
`A few months later, the parties executed a written settlement
`agreement, which they then submitted to the district court for
`approval.
`
`In the settlement agreement, Facebook acknowledged
`that it had at one point used the URL data in the three ways
`the district court had described in its class certification
`order—but it also represented that it had since stopped each
`of them. Two of the data uses had ceased before this action
`was filed in late 2013: in December 2012, Facebook stopped
`using private message URLs to increase “Like” counts, and,
`in October 2012, Facebook stopped sharing with third party
`websites “information about URL shares in Facebook
`messages . . . and attendant statistics and demographic
`information.” The third use, which the settlement agreement
`specified was related to Facebook’s using the URL data in
`
`

`

`Case: 17-16873, 03/03/2020, ID: 11615863, DktEntry: 76-1, Page 11 of 38
`
`11
`
`CAMPBELL V. ST. JOHN
`
`
`
`its Recommendations Feed, ceased in July 2014, several
`months after this action was filed. Facebook further
`represented that these three uses had relied on “anonymous,
`aggregate” information curated from the URL shares.
`Facebook separately confirmed that, as of the date of the
`settlement, it was not using any private message URL data
`for targeted advertising (as Plaintiffs had initially alleged)
`and was not sharing with third parties any personally
`identifying user information associated with the URL data.
`
`The settlement agreement further described “enhanced
`disclosures and practice changes” that Facebook had made
`after this case was filed. The agreement pointed out, for
`example, that Facebook had revised its Data Policy about a
`year after this action was filed to state that Facebook collects
`the “content and other information” that users provide when
`they “message or communicate with others,” and to further
`explain the ways in which Facebook may use that
`information.
`
`Facebook agreed as part of the settlement to display for
`one year a new twenty-two-word disclosure in the Help
`Center portion of its site, stating: “We use tools to identify
`and store links shared in messages, including a count of the
`number of times links are shared.”5 Although Facebook
`promised to display this Help Center disclosure for a year, it
`did not say that it would continue to refrain from any of the
`uses of URL data described above. Nor did Facebook
`promise to continue using the version of the Data Policy
`adopted after this action was filed. The agreement did not
`provide for monetary compensation to class members other
`
`
`5 The agreement provided “that Facebook may update the
`disclosure[] to ensure accuracy with ongoing product changes.”
`
`

`

`Case: 17-16873, 03/03/2020, ID: 11615863, DktEntry: 76-1, Page 12 of 38
`
`CAMPBELL V. ST. JOHN
`
`12
`
`than the two named Plaintiffs, each of whom was permitted
`to apply to the court for an award not to exceed $5,000.
`
`In exchange, class members were required to release
`their declaratory and injunctive relief claims. Absent class
`members did not, however, release any “claims for monetary
`relief, damages, or statutory damages.” Only the named
`Plaintiffs released their damages claims.
`
`The agreement provided that class counsel could request
`that the court award attorney’s fees and costs of up to
`$3.89 million—an amount that the parties represented had
`been negotiated after and independent of the other settlement
`terms and constituted a significant reduction from the more
`than $7 million that class counsel claimed would fully
`compensate them for their work on the case. Facebook
`agreed not to object to that request and to pay any amount
`the court approved up to this $3.89 million cap.
`
`The district court granted preliminary approval of the
`settlement. Although the parties had agreed that it was
`unnecessary to provide notice to the class beyond what was
`already publicly available
`(primarily
`through news
`coverage), the court rejected that proposition. It held that
`class counsel would be required to post information about
`the settlement on their public websites during the period
`between preliminary approval and a final fairness hearing.
`
`Objector Anna St. John, who is a member of the class
`and an attorney at the Center for Class Action Fairness, filed
`an objection to the settlement. Following a final fairness
`hearing,
`the district court approved
`the settlement.
`Evaluating the settlement using the factors outlined in
`Hanlon v. Chrysler Corp., 150 F.3d 1011, 1026 (9th Cir.
`1998), the district court reasoned that “[t]he settlement offers
`immediate, tangible benefits directed to the three uses of
`
`

`

`Case: 17-16873, 03/03/2020, ID: 11615863, DktEntry: 76-1, Page 13 of 38
`
`13
`
`CAMPBELL V. ST. JOHN
`
`
`
`URLs challenged by Plaintiffs, without requiring class
`members to release any claims for monetary damages that
`they may have against Facebook.” The court also explained
`that “the relief to the class must be viewed against the likely
`rewards of litigation,” and observed that “proceeding with
`litigation would be very risky for the class.” In addition, the
`court emphasized that the settlement was “the result of four
`in-person, arms’-length mediations before two different
`mediators,” that both sides were able “to negotiate the
`settlement on a fully-informed basis,” and that “[c]lass
`counsel [are] highly experienced.”
`
`The district court also granted the full $3.89 million in
`attorney’s fees and costs for which class counsel had applied.
`In addition to deeming the amount “reasonable” in light of
`the results obtained for the class and counsel’s substantial
`investment of time and resources on a contingency basis, the
`court determined, based on an assessment of the factors
`listed in In re Bluetooth Headset Products Liability
`Litigation, 654 F.3d 935, 947 (9th Cir. 2011), that this
`portion of the settlement agreement did not indicate
`collusion among the negotiating parties at the expense of
`absent class members.
`
`Objector timely appealed the district court’s approval of
`the settlement.
`
`B.
`
`After oral argument in this appeal, the Supreme Court
`issued Frank v. Gaos, 139 S. Ct. 1041, 1045–46 (2019) (per
`curiam), which vacated the final approval of a class action
`settlement and remanded for an assessment of Article III
`standing under Spokeo, Inc. v. Robins (Spokeo I), 136 S. Ct.
`1540 (2016). In Gaos, the plaintiffs had claimed that Google
`violated the Stored Communications Act by transmitting
`
`

`

`Case: 17-16873, 03/03/2020, ID: 11615863, DktEntry: 76-1, Page 14 of 38
`
`CAMPBELL V. ST. JOHN
`
`14
`
`information to third-party websites about the search terms
`users had entered to arrive at those websites. See 139 S. Ct.
`at 1044. Although the Supreme Court had granted certiorari
`intending to resolve a question about use of cy pres awards
`in class action settlements,6 the Court did not reach that issue
`“[b]ecause there remain[ed] substantial questions about
`whether any of the named plaintiffs ha[d] standing to sue in
`light of [Spokeo I].” Id. at 1043–44. The Court explained
`that federal courts’ “‘obligation to assure ourselves of
`litigants’ standing under Article III’ . . . extends to court
`approval of proposed class action settlements.” Id. at 1046
`(quoting DaimlerChrysler Corp. v. Cuno, 547 U.S. 332, 340
`(2006)).
`
`Because of the possibility that this case would present
`“substantial questions” about standing like the ones the
`Court identified in Gaos, id. at 1043, we requested and
`received supplemental briefing from the parties about the
`effect, if any, of Spokeo I on jurisdiction in this case.
`
`II.
`
`To establish standing, plaintiffs must show that they
`have suffered an injury in fact that is fairly traceable to the
`challenged conduct of the defendant and is likely to be
`redressed by a favorable judicial decision. Lujan v. Defs. of
`Wildlife, 504 U.S. 555, 560–61 (1992). Injury in fact is “the
`
`6 Cy pres refers to a method for distributing unclaimed settlement
`funds “to the ‘next best’ class of beneficiaries.” Nachshin v. AOL, LLC,
`663 F.3d 1034, 1036 (9th Cir. 2011). “Under the cy pres approach, ‘class
`members receive an indirect benefit (usually through defendant
`donations to a third party) rather than a direct monetary payment.’” In
`re EasySaver Rewards Litig., 906 F.3d 747, 760 (9th Cir. 2018) (quoting
`Lane v. Facebook, Inc., 696 F.3d 811, 819 (9th Cir. 2012)), cert. denied,
`139 S. Ct. 2744 (2019).
`
`

`

`Case: 17-16873, 03/03/2020, ID: 11615863, DktEntry: 76-1, Page 15 of 38
`
`15
`
`CAMPBELL V. ST. JOHN
`
`
`
`‘[f]irst and foremost’ of standing’s three elements.” Spokeo,
`Inc. v. Robins (Spokeo I), 136 S. Ct. 1540, 1547 (2016)
`(alteration in original) (quoting Steel Co. v. Citizens for a
`Better Env’t, 523 U.S. 83, 103 (1998)). Among other things,
`“an injury in fact must be both concrete and particularized.”
`Id. at 1548.
`
`“[A] plaintiff must demonstrate standing separately for
`each form of relief sought.” Friends of the Earth, Inc. v.
`Laidlaw Envtl. Servs. (TOC), Inc., 528 U.S. 167, 185 (2000).
`“[A]s the party invoking federal jurisdiction, [the plaintiff]
`bears the burden of establishing” standing. Spokeo I, 136 S.
`Ct. at 1547.
`
`Our discussion of standing proceeds in two parts. We
`first conclude that Plaintiffs identified a concrete injury.7
`Next, we hold that Plaintiffs established standing to seek
`injunctive relief and that post-filing developments did not
`moot this case. These conclusions satisfy us that there was
`and is Article III jurisdiction over this case, and that we may
`therefore consider the merits of Objector’s challenges to the
`approval of the settlement.
`
`A.
`
`An injury is concrete for purposes of standing if it
`“actually exist[s],” meaning it is “real, and not abstract”—
`but not necessarily “tangible.” Spokeo I, 136 S. Ct. at 1548–
`49 (quotation marks omitted). Where, as here, we deal with
`an “intangible harm” that is linked to a statutory violation,
`
`7 Once we conclude that this was a concrete injury, it is clear that it
`was also particularized, fairly traceable to Facebook, and likely to be
`redressed by a favorable judicial decision. The parties have not
`contested any of those other standing requirements in their supplemental
`briefs, and we do not discuss them in further detail.
`
`

`

`Case: 17-16873, 03/03/2020, ID: 11615863, DktEntry: 76-1, Page 16 of 38
`
`CAMPBELL V. ST. JOHN
`
`16
`
`we are guided in determining concreteness by “both history
`and the judgment of Congress,” or the legislature that
`enacted the statute. See id. at 1549; Patel v. Facebook, Inc.,
`932 F.3d 1264, 1273 (9th Cir. 2019) (looking to “[t]he
`judgment of the Illinois General Assembly” to inform the
`Article III standing inquiry for a claim alleging a violation
`of an Illinois privacy statute), cert. denied, No. 19-706 (U.S.
`Jan. 21, 2020). Historical practice is “instructive” as to
`“whether an alleged intangible harm has a close relationship
`to a harm that has traditionally been regarded as providing a
`basis for a lawsuit in English or American courts.” Spokeo
`I, 136 S. Ct. at 1549. We also look to legislative judgment
`because legislatures may “elevat[e] to the status of legally
`cognizable injuries concrete, de facto injuries that were
`previously inadequate in law.” Id. (alteration in original)
`(quoting Lujan, 504 U.S. at 578). But the fact that a
`legislature has “grant[ed] a person a statutory right and
`purport[ed] to authorize that person to sue to vindicate that
`right” is not by itself sufficient for standing. Id. When a
`legislature has enacted a “bare procedural” protection, a
`plaintiff “cannot satisfy the demands of Article III” by
`pointing only to a violation of that provision, but also must
`link it to a concrete harm. Id. at 1550 (emphasis added).
`When, however, a statutory provision
`identifies a
`substantive right that is infringed any time it is violated, a
`plaintiff bringing a claim under that provision “need not
`allege any further harm to have standing.” Eichenberger v.
`ESPN, Inc., 876 F.3d 979, 983–84 (9th Cir. 2017).
`
`For the reasons that follow, we conclude that the
`statutory provisions under which Plaintiffs sued protect
`concrete interests because, like the provisions examined in
`several of our recent decisions, they “codif[y] a context-
`specific extension of the substantive right to privacy.” See
`id. at 983.
`
`

`

`Case: 17-16873, 03/03/2020, ID: 11615863, DktEntry: 76-1, Page 17 of 38
`
`
`
`
`CAMPBELL V. ST. JOHN
`
`17
`
`ECPA includes a private right of action, 18 U.S.C.
`§ 2520, against anyone who “intentionally intercepts,
`endeavors to intercept, or procures any other person to
`intercept or endeavor to intercept, any wire, oral, or
`electronic communication,” 18 U.S.C. § 2511(1)(a).
`Plaintiffs sued under that provision and also alleged a
`violation of ECPA’s prohibition on the intentional use of the
`contents of information knowingly obtained through such
`interception. See id. § 2511(1)(d). Plaintiffs also sued under
`CIPA, which likewise includes a private right of action, Cal.
`Penal Code § 637.2(a), and which similarly prohibits the
`unauthorized reading, or attempting to read, of “any
`message, report, or communication while the same is in
`transit or passing over any wire, line, or cable,” as well as
`the use of “any information so obtained.” Cal. Penal Code
`§ 631(a).
`
`The harms protected by these statutes bear a “close
`relationship” to ones that have “traditionally been regarded
`as providing a basis for a lawsuit.” See Spokeo I, 136 S. Ct.
`at 1549. “Violations of the right to privacy have long been
`actionable at common law.” Eichenberger, 876 F.3d at 983.
`And one of the several privacy torts historically recognized
`was “unreasonable intrusion upon the seclusion of another,”
`which traditionally extends to, among other things, “tapping
`. . . telephone wires” as well as “opening . . . private and
`personal mail.” Restatement (Second) of Torts § 652B
`cmt. b. There is a straightforward analogue between those
`traditional torts and the statutory protections codified in
`ECPA and CIPA against viewing or using private
`communications. Moreover, under the privacy torts that
`form the backdrop for these modern statutes, “[t]he intrusion
`itself makes the defendant subject to liability.” Restatement
`(Second) of Torts § 652B cmt. b. “In other words, ‘privacy
`torts do not always require additional consequences to be
`
`

`

`Case: 17-16873, 03/03/2020, ID: 11615863, DktEntry: 76-1, Page 18 of 38
`
`CAMPBELL V. ST. JOHN
`
`18
`
`(quoting
` Patel, 932 F.3d at 1274
`actionable.’”
`Eichenberger, 876 F.3d at 983). Thus, historical practice
`provides support not only for the conclusion that wiretapping
`is actionable, but also for the conclusion that a wiretapping
`plaintiff “need not allege any further harm to have standing.”
`See Eichenberger, 876 F.3d at 984.
`
`The reasons articulated by the legislatures that enacted
`ECPA and CIPA further indicate that the provisions at issue
`in this case reflect statutory modernizations of the privacy
`protections available at common law. The purpose of ECPA
`includes creating “[f]ederal statutory standards,” analogous
`to the “protection against unauthorized opening” of mail, “to
`protect the privacy and security of communications” made
`using newer technology. S. Rep. No. 99-541, at 5 (1986), as
`reprinted in 1986 U.S.C.C.A.N. 3555, 3559. CIPA’s
`purpose similarly includes “protect[ing] the right of privacy
`of the people of [California],” because “the invasion of
`privacy” resulting from the use of new technology to
`“eavesdrop[] upon private communications” causes “a
`serious threat to the free exercise of personal liberties.” Cal.
`Penal Code § 630. Plaintiffs’ challenges here arise under the
`core provisions of those statutes regarding interception and
`use of private communications. We respect the legislatures’
`judgment about the importance of the privacy interests
`violated when communications are intercepted, as reflected
`in their decisions to enact a private right of action that is
`available when these provisions are infringed. See Spokeo I,
`136 S. Ct. at 1549.
`
`Our precedent confirms that Plaintiffs have asserted a
`concrete harm. We have, in the years since Spokeo I,
`identified several statutory provisions that guard against
`invasions of concret