465 F.Supp.3d 999
N.D. Cal.2020Background
- Plaintiffs allege that when users click Google search results, Google transmits the users’ search terms to third-party websites via the HTTP referrer header.
- Suit filed in 2010 by Paloma Gaos (consolidated later) asserting six state-law claims and a federal claim under the ECPA (18 U.S.C. § 2702).
- Parties settled in 2013; settlement approval later vacated by the U.S. Supreme Court in Frank v. Gaos, which remanded to this Court to reassess Article III standing in light of Spokeo.
- Plaintiffs further allege that, as of October 2011, Google scrubbed search terms from referrers for organic results when users are logged in but continued to transmit them for paid ads, effectively monetizing queries.
- On remand the Court considered a Rule 12(b)(1) facial challenge to standing and, applying post-Spokeo Ninth Circuit guidance, held that the named plaintiffs have standing to assert ECPA, contract, quasi-contract (unjust enrichment), and injunctive-relief claims.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Standing for ECPA claim (18 U.S.C. § 2702) | Violation of § 2702 is a concrete, de facto invasion of privacy; Congress identified the harm so no additional injury required | Disclosure of anonymized search terms is not a concrete injury absent plausible re-identification or identity-linked harm | Court: § 2702 protects substantive privacy interests; every violation inflicts concrete harm under Ninth Circuit precedent (standing satisfied) |
| Standing for breach of contract and covenant claims | Breach of Google’s Terms of Service (promises re: web history/personal info) is itself a legal injury; nominal damages suffice under California law | Plaintiffs cannot show concrete injury because disclosed search terms are not shown to be identity-linked or to have caused loss | Court: Breach of contractual rights gives rise to a concrete injury (nominal damages possible); plaintiffs adequately pleaded the contractual duty and breach (standing satisfied) |
| Standing for quasi-contract / unjust enrichment claims | Plaintiffs retained a stake in profits from their data; unjust enrichment/disgorgement is available under California law even without individual loss | Alleged profits from disclosed anonymized data are speculative and do not establish a personal injury | Court: Allegations plausibly show Google profited from users’ search terms and plaintiffs retain an entitlement to those profits; unjust enrichment standing satisfied |
| Standing to seek injunctive relief | Plaintiffs face continuing or likely future exposure to the same practices, so prospective relief is appropriate | (Defendant did not contest injunctive standing explicitly) | Court: Plaintiffs have standing to seek injunctive relief; no obstacle shown to prospective relief |
Key Cases Cited
- Spokeo v. Robins, 136 S. Ct. 1540 (2016) (sets the modern Article III concreteness test for intangible harms)
- Lujan v. Defenders of Wildlife, 504 U.S. 555 (1992) (articulates the three elements of Article III standing)
- Campbell v. Facebook, Inc., 951 F.3d 1106 (9th Cir. 2020) (ECPA provisions can protect substantive privacy rights; statutory violations can be concrete harms)
- In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589 (9th Cir. 2020) (SCA/ ECPA provisions recognize concrete privacy interests and support standing)
- Jewel v. National Security Agency, 673 F.3d 902 (9th Cir. 2012) (recognizes that SCA violations implicate privacy interests)
- Theofel v. Farey-Jones, 359 F.3d 1066 (9th Cir. 2004) (analogy of SCA unlawful access/disclosure to traditional property/confidence torts)