Chance v. Avenue A, Inc.Chance v. Avenue A, Inc.
ORDER
This mаtter is before the Court on Defendant’s motion for summary judgment (Dkt. Nos. 23 & 33) and Plaintiffs’ motion to strike portions of declarations and the summary judgment motion (Dkt. No. 45). Plaintiffs, in their Opposition to Avenue A’s Motion for Summary Judgment (Dkt. No. 41), have requested the Court to defer consideration of the motion for summary judgment pursuant to Rule 56(f). Also pending before the Court is Plaintiffs’ motion for class certification (Dkt. No. 13). For the reasons stated below, the Court GRANTS the motion for summary judgment and DENIES as moot the remaining motions. The Court further DENIES Plaintiffs’ request for a Rule 56(f) continuance of the summary judgment motion.
I. Background
Plaintiffs are individuаls who allegedly have used the Internet, visited web sites, and had an Avenue A “cookie” placed on their computers, thus permitting Avenue A to monitor their electronic communications without their knowledge, authorization or consent. (See First Am.Consol. Class Action Compl. (“Complaint”) ¶¶ 8-14; Pis.’ Mot. for Class Certification at 1.) The seven named plaintiffs hope to bring this action on behalf of an immense class of Internet users, numbering in the tens of millions. (Compl. ¶ 35.) They claim that Avenue A has violated the Wiretap Act (Title I of the Electronic Communications Privacy Act (“ECPA”)), the Stored Communications Act (Title II of ECPA), the Computer Fraud and Abuse Act (“CFAA”), several state common law causes of action including invasion of privacy, trespass, unjust enrichment, and Washington statutes protecting against wiretapping and deceptive and unfair business practices. (Compl.W 74-127.)
The issue of Internet privacy has been attracting increased national attention, see John Schwartz,
Giving Web a Memory Cost Its Users Privacy,
N.Y. Times, Sept. 4, 2001, at Al, and has been the subject of intense regulatory and legislative debate,
see
Jessica J. Thill,
The Cookie Monster: From Sesame Street to Your Hard Drive,
52 S.C.L.Rev. 921, 928-31 (2001); John Schwartz,
Government is Wary of Tackling Online Privacy,
N.Y. Times, Sept. 6, 2001, at Cl. Not surprisingly, privacy advocates have also had their say in cоurt. Plaintiffs’ attorneys have brought nearly identical claims against other leading digital advertising and media companies such as Doubleclick and MatehLogie. In a very thorough opinion, the District Court for the Southern District of New York recently dismissed with prejudice a virtually identical claim against Doubleclick under Rule 12(b)(6).
See In re Doubleclick Inc. Privacy Litigation,
II. Facts: the Internet, Cookies, and Action Tags
Although minimal discovery has taken place in this case to date, the facts which are at the core of the three federal claims involve the general technological operation of the Internet, cookies, and action tags, and these are not disputed by the parties. Many of the intricacies of the Internet and cookies have been detailed in other judicial opinions,
see Reno v. ACLU,
A. Cookies
Cookies are data files placed on a computer’s hard drive by a web site, or more properly the web site’s server. Cookies enable much of the information exchange that occurs on the Internet by allowing the interactions between a specific computer and a web server to develop a memory of the communications between the two parties. Many web sites use cookie teсhnology to create a memory of such common activities as a user’s login or electronic shopping. (Lipsky Decl. ¶ 15.) Any cookie that is placed on a computer can only be read by the web site that created it or an affiliated site.
When a user directs his computer, through a web browser such as Internet Explorer or Netscape Communicator to a web site like nytimes.com, the user’s browser essentially sends a message to the web site’s server instructing the server to deliver that nytimes.com’s home page to the user’s computer for viewing. (Curtin Decl. ¶ 7.) Web sites often have blank spaces for “banner advertisements,” and Avenue A serves as an intermediary between the host web site and the advertising web site. Once it receives the initial communication from the user’s browser, the web server’s programming code directs it to return a communication to the user consisting of two parts: the web page requested and an IP-address link to the Avenue A server. This link then directs the user’s computer to send a communication automatically to Avenue A’s server. Per the IP-address instruction, the user’s computer sends a communication to Avenue A’s server identifying the Avenue A-specific cookie on that particular computer. (Curtin Decl. ¶ 12.) The cookie, which can only be read by the web server that placed it on the hard drive, or an affiliated server, contains information identifying the specific computer and often the computer user’s previous web viewing history. (Curtin Decl. ¶ 13.) This communication instructs Avenue A’s server to send the computer a banner advertisement to fill the blank space on the nytimes.com home page. Avenue A’s server analyzes its cookie and sends an advertisement targeted at what it believes to be the user’s preferences. (Curtin Decl. ¶ 21.) For example, a person who visits the U.S. Open tennis page might get an advertisement about Spald-ing tennis equipment. Each time the user’s computer accesses a web site affiliated with Avenue A (and subsequently the Avenue A server), the cookie on that computer is updated to incorporate this web page request. Similarly, if the user clicks on the banner advertisement, that information is also recorded in the cookie.
B. Action Tags
Closely related to cookies are action, or GIF, tags, which Plaintiffs refer to as “web
C. Rerouting through the Double-Click Server
As discussed above, the programming code on web sites affiliated with Avenue A directs a user’s computer to the Avenue A server when the user accesses the web site. This communication directed from the web site to the Avenue A server is relatively straightforward if the web site is affiliated with Avenue A. Plaintiffs in this case, in contrast to Doubleclick, allege that some web sites with no programming code related to Avenue A nonetheless communicate with and receive advertisements from Avenue A’s server. (Curtin Decl. ¶ 26.) This is accomplished by using the Doubleclick server as an intermediary to “re-route” the communication from the user’s computer to the Avenue A server. (Id.) Defendant explains this as a result of Avenue A’s purchase of advertising space on DoubleCliek-affiliated web sites. (Def.’s Reply in Supp. of Summ.J. at 4.)
III. Legal Standard: Summarg Judgment and Rule 56(f) Continuance of Summary Judgment
Rule 56 states that a party is entitled to summary judgment “if the pleadings, depositions, answers to interrogatories, and admissions on file, together with the affidavits, if any, show that there is no genuine issue as tо any material fact and that the moving party is entitled to a judgment as a matter of law.”
The party invoking
IV. Plaintiffs’ Motion to Strike
As an initial matter, Plaintiffs’ have filed a motion to strike certain portions of the Declaration and Supplemental Declaration of Tri Tran, the Director of Privacy Affairs for Avenue A. Plaintiffs argue that the statements are hearsay, the form of the certification is not correct, and that Mr. Tran is not a qualified expert to testify to these matters. Plaintiffs further move to strike specific parts of Defendant’s Motion for Summary Judgment because they are assertions made without any admissible support.
While some of the Plaintiffs’ assertions are well-founded, particularly those with respect to Mr. Tran’s statements about the poll and survey results regarding internet use, a detailed ruling on each of the objectionable statements is not necessary. None of the statements which Plaintiffs move to strike are necessary to the Court’s determination of summary judgment for the Defendant. Therefore, Plaintiffs’ motion is DENIED as moot. Further, the Court declines to take judicial notice of certain faсts in the Tran Declaration, pursuant to Defendant’s request.
V. Summary Judgment: Plaintiff’s Federal Causes of Action
A. Computer Fraud and Abuse Act
The CFAA prohibits a party from intentionally accessing a protected computer without authorization, “knowingly causing] the transmission of a program, information, code, or command,” and as a result causing] damage,
[T]he term “damage” meаns any impairment to the integrity or availability of data, a program, a system, or information, that—
(A) causes loss aggregating at least $5,000 in value during any 1-year period to one or more individuals;
(B) modifies or impairs, or potentially modifies or impairs, the medical examination, diagnosis, treatment, or care of one or more individuals;
(C) causes physical injury to any person; or
(D) threatens public health or safety....
The CFAA requires that the $5,000 threshold of damage be met in order to state a valid causе of action. Plaintiffs allege damages that exceed this threshold, but them reasoning suffers one significant flaw. The damage amount can be aggregated across both time and individual computers, but it cannot be aggregated across separate acts. By its plain language, the statute uses the singular of “impairment” to limit the damages threshold to a single act or event.
See
Doubleclick,
Although the extent of damages is a factual matter, farther discovery under a
Plaintiffs attempt to circumvent the statute’s $5,000 threshold by arguing that “loss,” as opposed to “damages,” is not subject to that threshold.
Nonetheless, the context of the statute requires an inclusion of “loss” within the $5,000 damages threshold. To read the
Because Plaintiffs have not shown any evidence that each alleged act of Defendant has caused them at least $5,000 of damage or loss, judgment as a matter of law is proper on Plaintiffs’ claim arising under the Computer Fraud and Abuse Act.
B. The Stored Communications Act
The Stored Communications Act (Title II of the ECPA),
Except as provided in subsection (c) of this section whoever—
(1) intentionally accesses without authorization a facility through which аn electronic communication service is provided; or
(2) intentionally exceeds an authorization to access that facility;
and thereby obtains, alters, or prevents authorized access to a wire or electronic communication while it is in electronic storage in such system shall be.punished as provided....
Plaintiffs raise numerous factual claims regarding whether Plaintiffs’ computers are “facilities through which an electronic communication service is provided,” whether there is “authorization,” or even if Avenue A “accessed” plaintiffs’ computers. Many of the facts regarding these elements of the cause of action are in dispute. Although the Act was intended to cover such mid-1980s technological facilities as telephone companies, email servers, and bulletin boards, modern technology has placed the personal computer at a focal point of Internet communications. While both parties agree that Internet service providers are “facilities” covered by the Act, they dispute whether a user’s individ
If a user’s computer is in fact a “facility” covered under the act, then at minimum the web site is a “user” of that communication service. It naturally follows that any communication between the individual computer and the web site is a communication “of or intended for” that user.
See DoubleClick,
Such authorization and consent between Defendant and Avenue A-affiliated web sites is without doubt. This case, however, presents a factual difference from
Double-Click,
as Plaintiffs have alleged that Avenue A accesses certain web sites that have no commercial affiliation with Avenue A. In fact, these sites have a commercial relationship with Doubleclick, which allows Avenue A to supply the sites with advertising. (Curtin Deck ¶ 26.) Even though these web pages may contain no code related to Avenue A, they do contain the basic programming required to route the communication to DoubleClick’s server, which in turn “reroutes” it to Avenue A’s server. Although this is a significant factual difference from
Doubleclick,
it leads to the identical legal conclusion. Double-Click still has the necessary authorization from the web site to escape liability under
Because the basic facts of Internet operation and web site codes which direct communications to Avenue A are undisputed
C. The Wiretap Act
The Wiretap Act (Title 1 of the ECPA),
It shall not be unlawful under this chapter for a person not acting under color of law to intercept a wire, oral, or electronic communication where such person is a party to the communication or where one of the parties to the communication has given prior consent to such interception unless such communication is intercepted for the purpose of committing any criminal or tortious act in violation of the Constitution or laws of the United States or of any State.
The exception requires a party to the communication to consent to the interception and that the interception be without any criminal or tortious purpose. The first requirement is satisfied by reasoning identical to the “authorization” issue under the exception to the Stored Communications Act.
See Doubleclick,
Whether Avenue A allegedly intercepted these communications with a tortious purpose is another matter. Under Ninth Circuit law, even a legitimate purpose does not alone sanitize an interception that was also made for an illegitimate purpose.
See Sussman v. ABC,
The fact that any such information would be exclusively in the Defendant’s possession is the strongest argument in support of Plaintiffs’ request for a
VI. State Claims and Class Certiñcation
In addition to the three federal claims discussed above, Defendant has made an argument against the state law claims based on the commerce clause. Because the Court is dismissing all three federal causes of action, it is not necessary to address the state law claims. District courts are granted broad discretiоn to exercise supplemental jurisdiction under
Plaintiffs’ Motion for Class Certification, after all claims have been dismissed, is moot.
VII. Conclusion
For the reasons stated above, Defendant’s Motion for Summary Judgment (Dkt. Nos. 23 & 33) is GRANTED. Plaintiffs Motion to Strike (Dkt. No. 45) is DENIED as moot. Finally, Plaintiffs Motion for Class Certification (Dkt. No. 13) is DENIED as moot.
The Clerk is directed to enter judgment accordingly.