Carlsen v. GameStop, Inc.Carlsen v. GameStop, Inc.
MEMORANDUM OPINION AND ORDER
INTRODUCTION
This matter is before the Court , on Defendants GameStop, Inc. (“GameStop”)
BACKGROUND
Plaintiff Matthew Carlsen (“Carlsen” or “Plaintiff’), individually and on behalf of others similarly situated (collectively, “Plaintiffs”), are users of print and online materials published by Game Informer (“Game Informer Magazine”) and' other content. (Doc. No. 31, Am. Compl. ¶¶ 1, 8, 23.) Game ‘ Informer Magazine offers news, reviews, and commentary about the video game industry. (Id. ¶ 1.) Registered subscribers can access digital versions of the Game Informer Magazine through the website www.gameinformer.com and they can also' manage their subscriptions and access enhanced content and message boards. (Id. ¶¶ 1, 17.) A one-year subscription costs between $14.99 and $19.98. (Id. ¶¶ 15-16, 50.) Plaintiff paid for a one-year digital subscription to receive access to the Game Informer Magazine and other enhanced content; he paid $14.99 in January 2014. (Id. ¶¶ 2, 50.)
The Terms of Service for the online subscription include Game Informer’s Privacy Policy (the “Privacy Policy”). (Id. ¶ 3.) The Privacy Policy includes a provision that, with certain exceptions, “Game Informer does not share personal information with anyone.” (Id. ¶¶ 4, 27; Doc. No. 39 (“Privacy Policy”) § 5.)
Plaintiff alleges that Defendants shared personally identifiable information (“PII”) with Facebook, a third party, in violation of the Privacy Policy. (Am. Compl. ¶¶ 29, 43.) Plaintiff alleges that Defendants did so through Game Informer’s website, which includes features that allow users to log in to Game Informer’s website using their Facebook accounts or use Facebook’s “Like,” “Share,” or “Comment” functions through the site. (Id. ¶ 32.) In order to provide these features, Game Informer adds a Facebook Software Development Kit (“SKD”) to the source code on their website. (Id. ¶ 34.) Plaintiff alleges that the programming of this SKD on Game Informer’s website results in the transmission of a user’s unique Facebook ID to Facebook, along with information about Game Informer content viewed by the user. (Id. ¶¶ 39-43.) The information is only transmitted if the user has previously opted to remain “logged in” to Facebook, which places a “cookie” on the user’s computer. (Id. ¶¶ 37-38.)
Game Informer website’s “Privacy Policy applies to all Website(s) and Mobile Application(s) operated by Game Informer (collectively, with Game Informer Online, referred to as the ‘Site’).” (Privacy Policy § 1.1.) The Privacy Policy states:
[The] Privacy Policy applies only to information submitted and collected online through the Site____ In addition, [the] Privacy Policy does not extend to Websites that may be maintained by our international affiliates or other companies or organizations to which we link, or to websites that contain links to the Site and/or the Service.
(Id. § 1.2.) The Privacy Policy further states:
The Site provides video game related content for all visitors as well as en- . hanced content and message boards, .among other items, for registered users , (such enhanced content and message boards, among other items, are referredto as the “Service”). All visitors and registered users are referred to in this ■Policy as “Users.” This Policy (i) covers Game Informer’s treatment of personally identifiable information collected when you are on the Site and when you use the Service, and (ii) discloses Game Informer’s information gathering and dissemination practices for the Site and Service.
(Id. § 1.4.) Under the Privacy Policy, users of Game Informer’s website agree to the Privacy Policy's terms when they use the site. (Id. § 1.3 (“Please note that by using the Site, you signify your assent to this Privacy Policy. If you do not agree to this Privacy Policy, please do not use the Site.”).) Game Informer also incorporates this Privacy Policy into its subscription Terms of Service. (Id. ¶ 3.) Plaintiff alleges that the purchase of a Game Informer subscription requires registrdtion through Game Informer’s website and agreement to the Terms of Service to gain access to its subscription-only' online content. (Am. Compl. ¶¶ 17, 26, 53, 54, 68, 70.)
According to Plaintiffs, the Privacy Policy also describes the types of information collected about its users and how and with whom this information gets shared. (See generally Privacy Policy.) Game Informer collects both so-called “personal” and “aggregate information” through voluntary submission, as well as use of the website. (Id.) The Privacy Policy states: “Except as stated above or disclosed in this Policy, or otherwise as may be authorized or permitted by a User, Game Informer does not share personal information with anyone.” (Id. § 5.) “[P]ersonal information .may include: your name, home address and zip code, telephone number, email address and (for those purchasing products online) credit card or checking account information including billing and shipping addresses and zip codes.” (Id. § 2.1.) The Privacy Policy excludes operational uses, promotions sponsored by third parties, government requirements, and use of “cookr ies” and “Web beacons” by third-party advertisers that may collect “non-personally identifiable information.” (Id. §§ 2.4, 3.2, 3.3; 4.5, 8.)
Plaintiff alleges Defendants breáched a paid-for contract term by disclosing Plaintiffs Facebook ID and. information about content Plaintiff accessed on Game Informer’s website. (Am. Compl. ¶¶ 76, 79.) Plaintiff also alleges this disclosure constituted a material misrepresentation regarding Game Informer subscriptiohs. (Id. ¶ 104.) Plaintiff alleges that he believed his PU' would not be discloséd and that this belief was “confirmed” by the Privacy Policy. (Id. ¶ 56.) Plaintiff alleges “a portion of the money [members] pay for their membership goes toward the protection of their sensitive information.” (Id. ¶ 20.) Plaintiff further alleges that, had he known about the disclosures in question, he would either have not paid for the subscription or not accessed the online content for which he had paid. (Id. ¶ 58.)
Plaintiff seeks damages and injunctive relief for the alleged violation of the Privacy Policy by the disclosure of users’ content access of the Game Informer website, along with their Facebook IDs, to Facebook. (Id. ¶¶ 81, 87, 93, 107.) In his Amended Complaint, Plaintiff - seeks class certification and asserts the following claims: (1) breach of contract; (2) unjust enrichment; (3) money had and received; and (4) violation of Minnesota’s Prevention of Consumer Fraud Act, Minm.Stat. §§ 325F.68 et seq. (Id. ¶¶ 67-107.) Defendant now moves to dismiss Plaintiff’s claims in their entirety. (Doc. No. 32.)
DISCUSSION
I. Legal Standard — Rule 12(b)(1)
A motion to dismiss under Federal Rule of Civil Procedure 12(b)(1) challenges
A motion to dismiss for lack of subject matter jurisdiction may challenge a plaintiffs complaint either on its.face or on factual truthfulness of its averments. Osborn v. United States,
II. Article III Standing
Defendants seek dismissal of Plaintiffs claims, pursuant to Rule 12(b)(1), on the grounds that Plaintiffs lack Article III standing for failure to allege an injury in fact.
To establish standing under Article III of the Constitution, a plaintiff must have a “justiciable case or controversy,” which requires: (1) injury in fact; (2) a causal connection between the injury and the conduct at issue; and (3) likelihood that the remedy the plaintiff seeks will redress the alleged injury. Steel Co. v. Citizens for a Better Env’t,
To establish an injury in fact, the plaintiff must allege “an invasion of a legally protected' interest which is (a) concrete and particularized and (b) ‘actual or imminent, not conjectural or hypothetical.’ ” Lujan v. Defenders of Wildlife,
Defendants argue that Plaintiff has failed to satisfy the first, prong of the standing test—that there is an injury in fact. Defendants assert that Plaintiff has failed to allege any economic injury at all. Specifically, Defendants argue that: the disclosure of personal .information alone does not constitute a cognizable injury; Plaintiffs subscription payment, as an “overpayment,” does not constitute injury; and there is no “impending” injury.
Plaintiff, however, contends that he has sufficiently alleged injury in the form of monetary damages based on a theory of “overpayment.” Plaintiff further appears to assert that he has adequately alleged injury under a “would, .not have shopped” theory.
First, Plaintiff alleges monetary injury based on a theory of “overpayment.” Plaintiff alleges that he would not have paid as much for the Game Informer subscription if he had known how his PII would be handled and that the Privacy Policy was being violated. (Doc. No. 38 at 13-16.) Specifically, Plaintiff alleges that “because Defendants failed’ to disclose their actual practice, they delivered to Plaintiff and the Class á fundamentally less useful and less valuable service than the one they paid for,” and it is this difference in value ’ that constitutes Plaintiffs damages. (Am. Compl. ¶¶ 6, 77.)
Courts have generally found “overpayment” theories insufficient to establish injury, even in situations involving highly sensitive PII. See, e.g., In re Target Corp. Customer Data Sec. Breach Litig.,
To the extent that Plaintiffs claim that some indeterminate part of their premiums went toward paying, for security measures, such a claim is too flimsy to support standing. They do not maintain, moreover, that the money they paid could have or would have bought a better policy with a more bullet-proof information-security regime. Put another way, Plaintiffs have not alleged facts that show that the market value of their insurance coverage (plus’ security services) was somehow less than what they paid. Nothing in the Complaint makes a plausible, case that Plaintiffs were cheated out of their premiums. As a result, no injury lies.
Moreover, courts have held that to establish standing, a claim must include allegations relating to monetary losses or “any other injuries such as identity theft, identity fraud, medical fraud, or phishing.” See, e.g., In re Horizon Healthcare Servs. Inc. Data Breach Litig., Civ. No. 13-7418,
Here, Plaintiff only alleges a general. theory of overpayment. Plaintiff does not allege that he paid anything specific for the Privacy Policy. As in Horizon and SAIC, Plaintiff merely alleges an indeterminate “portion of the money [members] pay for their membership goes toward the protection of their sensitive information.” (Am. Compl. ¶ 20.) Plaintiff also does not allege any specific monetary , losses or “other injuries such as identity theft, identity fraud, [etc.].” In re Horizon Healthcare,
Similarly, Plaintiff also cannot establish that the lack of data privacy/security constituted injury because Plaintiff did not bargain for data privacy/security. In In re LinkedIn User Privacy Litig., the court held that “[t]he [complaint] does not sufficiently demonstrate that included in Plaintiffs’ bargain for premium membership was the promise of a particular (or greater) level of security that was not part of the free membership.”
Plaintiffs attempt to distinguish this case from LinkedIn by arguing that he never “upgraded” his account from an unpaid account in which he had previously agreed to the terms and conditions, but instead was solely presented with the terms “during his one and only online registration process” (Doc. No. 38 at 16), also fails. Here, the Privacy Policy unambiguously applies to all usérs arid all content and, as a result, Plaintiff was explicitly informed that the conditions applying to his use did not differ from those'of nonpaying, unregistered 'users. Additionally, because the Privacy--Policy plainly states that all users agree to the same-Privacy Policy by function of using the -site, -all users are informed that they have all agreed to the same Privacy Policy. Thus, while the Privacy Policy may be required for purchase, no purchase — or even registration — is required for the Privacy. Policy, - thus, making this case just like LinkedIn. See LinkedIn, 93
Overall, Plaintiff merely alleges that there is some difference between what he paid and what .he received — -essentially, a subscription that lets browsing information transfer ¡to Facebook and one th^t does not. This is not enough. In each of-the cases cited by Plaintiff in support of. this theory, the value that plaintiffs did not receive is clearly alleged. For .example, in Coghlan, the plaintiff alleges a clear difference in - value between-an alkfiberglass' boat and a wood-fiberglass hybrid boat, which he purchased thinking it was all-fiberglass. Coghlan,
'Thus, even accepting as true all of Plaintiffs allegations and construing all reasonable inferences in Plaintiffs favor, Plaintiff has failed to adequately plead facts relating to overpayment for Game Informer products or services or for any other injury that could establish Article III standing.
B. “Would Not Have Shopped” and Reasonable Belief
Plaintiff also appears to allege injury-in-fact based on a “would not have shopped” theory, in which he asserts that he would not have purchased the Gamer Informer subscription if he had known his data would be shared.- Plaintiff further appears to contend that this theory supports a claim for unjust enrichment. For unjust enrichment, a plaintiff must show that the defendant “knowingly received or obtained something of value for which the defendant ‘in equity and good conscience’ should pay.” ServiceMaster of St. Cloud v. Sentry Ins.,
Plaintiff points to the Target case, in which the plaintiffs argued that they “would not have shopped at Target had théy known about the [credit card] breach.” Target,
Plaintiffs’ “would not have shopped” theory ... - is plausible and supports their claim for unjust enrichment. If Plaintiffs- can establish that they shopped at ■Target after Target knew or-should have known of the breach, and that -Plaintiffs would not have shopped at Target had they known about the breach, a reasonable jury could conclude that the money Plaintiffs spent at Target is money to which Target “in equity and good conscience” should not have received.
Id. Plaintiff further asserts that his belief that Defendant would protect his PII was reasonable and that the reasonableness of that belief supports his claims.
Defendants counter that Plaintiff failed to allege “he relied on, or even read, Defendants’ Privacy Policy,” and that,
Plaintiff has also not alleged that he has stopped using the online, portion of his Game Informer subscription or that he quit staying logged in to Faeebook while browsing -the Game Informer websiteafter he allegedly found out' about Defendants’ alleged practices in his investigation of this lawsuit. - ■
(Doc. No. 44 at 12-13.) Defendants therefore assert that Plaintiff cannot establish injury through his “would -not have shopped” theory.
The Court agrees. The “would not have shopped” theory fails to establish injury for purposes of standing. Here, the Court concludes that this case is distinguishable from Target because Plaintiff suffered no actual damages and did receive the full value of his purchase, as explained above. Plaintiff has not adequately identified money which Game Informer “in equity and good conscience” should not have received. Target,
Therefore, Plaintiff does not adequately claim an unjust enrichment injury under a “would not have shopped” theory or injury based upon reasonable expectations of privacy in this case. Accordingly, Plaintiff fails to allege Article III injury on these grounds as well.
Plaintiff has failed to allege an injury in fact and as a result has not established standing under Article III of the Constitution.- Plaintiffs complaint is therefore dismissed pursuant to Rule 12(b)(1) of the Federal Rules of Civil Procedure for lack of subject matter jurisdiction. Further, on the record before Court, the Court concludes that leave to amend would be futile in this case, and, as a result, the Court dismisses the claims with prejudice.
ORDER
Based on the foregoing, and all the files, records, and proceedings hérein, IT IS HEREBY ORDERED that:
1. Defendant’s Motion to Dismiss the First Amended Complaint (Doc. No. [31]) is GRANTED.
2. The claims in this matter are DISMISSED WITH PREJUDICE.
LET JUDGMENT BE ENTERED ACCORDINGLY.
Notes
. The court may consider the complaint, matters of public record, materials necessarily embraced by the complaint, and exhibits attached to the complaint-. See Porous Media Corp. v. Pall Corp.,
. To the extent Plaintiff argues that, “where a plaintiff alleges that he paid for a good or service and did not receive the full benefit of
. Because Plaintiff asserts the same "overpayment” theory of injury for all of Plaintiffs claims, the Court considers them together.
. Plaintiff essentially claims that he "believed that Defendants would not disclose his PII,” and that "Defendants confirmed that belief based upon [the Privacy Policy].” (Am. Compl. ¶ 56 (emphasis added),) . However, without any claim that Plaintiff actually read and relied on the Privacy Policy, Plaintiff cannot allege that the Privacy Policy terms were determinative of his purchase. Plaintiff, therefore, fails to adequately plead causation and injury with regard to any alleged misrepresentations within that policy.
. The Court acknowledges that the parties have also addressed whether the claims should be dismissed pursuant to'Rule 12(b)(6) for failure to state claims for relief, In light of the Court’s analysis regarding Article III standing, the Court does not examine this issue. The Court also notes that Plaintiff’s arguments that Defendants waived their 12(b)(6) arguments would not succeed.
Similarly, the Court notes that because Plaintiff has failed to establish injury in a way that satisfies Article III standing requirements, the Court does not examine whether the terms of the Privácy-Policy itself promised the security that Plaintiff asserts it does. Whether it does or does not, does not affect this Court's standing analysis, amend would be futile in this case, and, as a result, the Court dismisses the claims -with prejudice.