In re Google Referrer Header Privacy Litigation, 465 F.Supp.3d 999

Case Information

UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF CALIFORNIA SAN JOSE DIVISION

IN RE GOOGLE REFERRER HEADER Case No. 10-cv-04809-EJD PRIVACY LITIGATION ORDER DENYING MOTION TO DISMISS Re: Dkt. No. 107

This is a class action concerning Defendant Google, LLC’s alleged disclosure of users’ search terms to third party servers; it was originally settled in 2013. The case now returns to the Court upon remand from the U.S. Supreme Court, which vacated the settlement and instructed this Court to evaluate the plaintiffs’ Article III standing in light of its decision in Spokeo, Inc. v. Robins , 136 S. Ct. 1540 (2016). See Frank v. Gaos , 139 S. Ct. 1041, 1046 (2019). The Court has now done so, aided by the parties’ briefing and a hearing conducted on June 4, 2020. The Court finds that Plaintiffs have standing to bring their claims and DENIES Defendant’s motion to dismiss.

I. BACKGROUND

This suit’s path to the present motion is a long and circuitous one; accordingly, a brief review of how we got here is in order.

Defendant Google, LLC (“Google”) operates an Internet search engine, which allows users to search for websites based on a query of keywords or phrases. Dkt. No. 51, Ex. A (“Consol. Compl.”) ¶¶ 15-16. Upon a search, Google displays the search results as a list of hyperlinks to the relevant websites; the user may click on a link to travel to the desired site. ¶¶ 56-57. Plaintiffs allege that when a user clicks on a search result, Google transmits the user’s search terms to the third-party server that hosts the website the user seeks to view. Id . That is because the “Uniform Resource Locator” (“URL”) used to direct the user to the requested website contains the URL of the last site the user visited—i.e., the page that “referred” them to the requested website; this information is known is as the “referrer header.” Id. ¶¶ 50-57; see generally In re Zynga Privacy Litig. , 750 F.3d 1098, 1101 (9th Cir. 2014) (explaining URLs and referrer headers).

Believing that the disclosure of search terms to third parties violates users’ statutory and contractual privacy rights, Named Plaintiff Paloma Gaos filed the original Complaint in October 2010. Dkt. No. 1 (“Compl.”). The case was assigned to the undersigned judge in April 2011, Dkt. No. 25, and Plaintiff Gaos filed the First Amended Complaint (“FAC”) in May 2011, Dkt. No. 26 (“FAC”). The FAC contains one federal claim for violation of the Electronic Communications Privacy Act (“ECPA”), 18 U.S.C. § 2702(a), and six state law claims for fraudulent misrepresentation, negligent misrepresentation, public disclosure of private facts, actual and constructive fraud under Cal. Civ. Code §§ 1572, 1573, breach of contract, and unjust enrichment. FAC ¶¶ 93-137. In May 2011, Defendant moved to dismiss the FAC pursuant to Federal Rules of Civil Procedure 12(b)(1) and 12(b)(6), Dkt. No. 29. As relevant to the instant dispute, Defendant argued that Plaintiff Gaos lacked standing to bring any of the claims in the FAC. Gaos v. Google Inc. , No. 5:10-CV-4809 EJD, 2012 WL 1094646, at *1 (N.D. Cal. Mar. 29, 2012).

This Court granted the motion in part and denied it in part. ; Dkt. No. 38. First, the Court found that Plaintiff Gaos had failed to adequately plead standing to bring her six state law claims and dismissed those claims with leave to amend. Gaos v. Google Inc. , 2012 WL 1094646 at *2. On the other hand, Gaos’s federal claim alleged a violation of her rights under Title II of the ECPA, which is the Stored Communications Act (“SCA”), 18 U.S.C. §§ 2701 et seq. This Court rejected Defendant’s contention that Plaintiff Gaos had not adequately alleged an injury in fact, as necessary for Article III standing. Gaos v. Google Inc. , 2012 WL 1094646 at *3-*4; see Dkt. No. 29 at 7-10. Citing Edwards v. First American Corporation , 610 F.3d 514 (9th Cir. 2010), the Court observed that “[t]he injury required by Article III . . . can exist solely by virtue of ‘statutes creating legal rights, the invasion of which creates standing.’” 2012 WL 1094646 at *3 (quoting Edwards , 510 F. 3d at 517). The Court then recognized that “a violation of one’s statutory rights under the SCA” is, by itself, “a concrete injury” and found that Plaintiff Gaos had standing to assert the SCA claim. (citing Jewel v. National Security Agency , 673 F.3d 902, 908 (9th Cir. 2011)).

In an effort to cure the standing deficiencies as to the state law claims, Gaos and an additional named plaintiff (Anthony Italiano) filed the Second Amended Complaint (“SAC”). Dkt. No. 39 (“SAC”). The SAC also contained new factual allegations that in October 2011, Google changed its practice regarding referrer headers. According to the SAC, Google’s new practice was to “scrub” search terms from the referrer headers on “regular, organic search results” when users are logged into a Google service; however, Google would continue to include search terms in referrer headers when users click on “paid links or advertisements.” SAC ¶¶ 6, 64-66. Thus, in Plaintiffs’ view, Google “is now effectively selling search queries to paying advertisers.” ¶ 67. Defendant again moved to dismiss the SAC for lack of Article III standing. As to the state law claims, Defendant argued that Plaintiffs had not cured the deficiencies in the FAC. In addition, Defendant renewed its standing challenge to the SCA claim. Although Defendant recognized that this Court had already rejected its argument on this front, the U.S. Supreme Court had granted certiorari in Edwards , 510 F.3d 514; because this Court had relied in part on Edwards in finding standing, Defendant urged the Court to reconsider its decision in the event Edwards was reversed. Dkt. No. 44 at 3. When the Supreme Court dismissed Edwards as improvidently granted, 567 U.S. 756 (2012), however, Defendant withdrew its standing argument against the SCA claim. Dkt. No. 46 at 2 n.2.

Then, before this Court made its ruling on Defendant’s motion to dismiss the SAC, the parties stipulated to the consolidation of Gaos and Italiano’s case with another class action, and Plaintiffs filed the now-operative Consolidated Complaint. Dkt. Nos. 50, 51. The motion to dismiss the SAC was therefore terminated as moot. Dkt. No. 51.

Shortly thereafter, in July 2013, the parties reached a classwide settlement. The settlement agreement provided, among other things, that Defendant would pay a settlement amount of $8.5 million, none of which would be distributed to absent class members; rather, any funds not used for costs, attorney’s fees, and incentive payments would be distributed to six cy pres recipients. This Court granted preliminary and then final approval of the settlement, over the objections of five class members. Dkt. Nos. 63, 85; see Frank v. Gaos , 139 S. Ct. 1041, 1045 (2019). Two of the objectors appealed the settlement to the Ninth Circuit, challenging the propriety of cy pres relief as well as the selection of the cy pres recipients. The Ninth Circuit affirmed this Court’s approval of the settlement. In re Google Referrer Header Privacy Litigation , 869 F.3d 737 (9th Cir. 2017).

Undeterred, the objectors petitioned for certiorari before the U.S. Supreme Court, and their petition was granted. Frank v. Gaos , 138 S. Ct. 1697 (2018). Instead of reaching the merits of the cy pres issues, however, the Supreme Court identified a potential threshold obstacle: In 2016, while the objectors’ Ninth Circuit appeal was pending, the Supreme Court had issued its opinion in Spokeo, Inc. v. Robins , 136 S. Ct. 1540 (2016). The Supreme Court explained that Spokeo “abrogated the ruling in Edwards that the violation of a statutory right automatically satisfies the injury-in-fact requirement whenever a statute authorizes a person to sue to vindicate that right.” Frank v. Gaos , 139 S. Ct. at 1046. But “[b]ecause Google withdrew its standing challenge after we dismissed Edwards as improvidently granted, neither the District Court nor the Ninth Circuit ever opined on whether any named plaintiff sufficiently alleged standing in the operative complaint.” As this Court lacked power to approve the proposed class settlement if no named plaintiff had standing, the Supreme Court concluded that this Court should “address the plaintiffs’ standing in light of ” in order to assure its jurisdiction. The Supreme Court therefore vacated the judgment and remanded the case to the Ninth Circuit, id. , which remanded the case to this Court, Dkt. No. 99.

In accordance with the Supreme Court’s order, Defendant filed a motion to dismiss the operative Consolidated Complaint for lack of standing on March 20, 2020; that motion is now ripe for this Court’s review. Dkt. Nos. 107, 108, 109, 110.

II. LEGAL STANDARD

The Court begins by reviewing the basic legal standards applicable to Defendant’s motion to dismiss, which is brought under Federal Rule of Civil Procedure 12(b)(1). A Rule 12(b)(1) motion tests whether the court has subject matter jurisdiction to hear the claims alleged in the complaint. Here, Defendant contends that Plaintiffs lack Article III standing, which “is a necessary component of subject matter jurisdiction.” In re Palmdale Hills Prop. , LLC, 654 F.3d 868, 873 (9th Cir. 2011).

The Supreme Court has repeatedly stated that the “irreducible constitutional minimum of standing” consists of three elements, Lujan v. Defs. of Wildlife , 504 U.S. 555, 560 (1992): “The plaintiff must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision,” Spokeo, Inc. v. Robins , 136 S. Ct. 1540, 1547 (2016). These elements are typically referred to as injury in fact, causation, and redressability. See, e.g. , Planned Parenthood of Greater Washington & N. Idaho v. U.S. Dep’t of Health & Human Servs. , 946 F.3d 1100, 1108 (9th Cir. 2020). Plaintiffs, as the parties invoking federal jurisdiction, bear the burden of establishing the existence of Article III standing and, at the pleading stage, “must clearly allege facts demonstrating each element.” , 136 S. Ct. at 1547 (internal quotations omitted); see also Baker v. United States , 722 F.2d 517, 518 (9th Cir. 1983) (“The facts to show standing must be clearly apparent on the face of the complaint.”).

“In a class action, this standing inquiry focuses on the class representatives .” NEI Contracting & Eng’g, Inc. v. Hanson Aggregates Pac. Sw., Inc. , 926 F.3d 528, 532 (9th Cir. 2019). The named plaintiffs “must allege and show that they personally have been injured, not that injury has been suffered by other, unidentified members of the class to which they belong and which they purport to represent.” Warth v. Seldin , 422 U.S. 490, 502 (1975). Standing for the putative class “is satisfied if at least one named plaintiff meets the requirements.” Bates v. United Parcel Serv., Inc. , 511 F.3d 974, 985 (9th Cir. 2007). But if none of the named plaintiffs purporting to represent a class can establish standing to sue, the class action cannot proceed. See NEI Contracting , 926 F.3d at 532 (citing O'Shea v. Littleton , 414 U.S. 488, 494 (1974)).

Where, as here, the Rule 12(b)(1) motion is a facial challenge to Plaintiffs’ standing, the court considers whether the allegations contained in the complaint are sufficient on their face to invoke federal jurisdiction. See Safe Air for Everyone v. Meyer , 373 F.3d 1035, 1039 (9th Cir. 2004). That is, a district court “resolves a facial attack as it would a motion to dismiss under Rule 12(b)(6): Accepting the plaintiff’s allegations as true and drawing all reasonable inferences in the plaintiff's favor, the court determines whether the allegations are sufficient as a legal matter to invoke the court’s jurisdiction.” Leite v. Crane Co. , 749 F.3d 1117, 1121 (9th Cir. 2014). As with a Rule 12(b)(6) motion, however, a court is not required “to accept as true allegations that are merely conclusory, unwarranted deductions of fact, or unreasonable inferences.” In re Gilead Scis. Sec. Litig. , 536 F.3d 1049, 1055 (9th Cir. 2008); see also Thomas v. Mundell , 572 F.3d 756, 763 (9th Cir. 2009) (finding allegations “too vague” to support standing). Finally, the Court notes that the question of standing is “distinct from the merits” of a plaintiff’s claim. Maya v. Centex Corp. , 658 F.3d 1060, 1068 (9th Cir. 2011); see also Warth v. Seldin , 422 U.S. 490, 500 (1975) (“[S]tanding in no way depends on the merits of the plaintiff's contention that particular conduct is illegal . . . .”). Hence, when considering whether a plaintiff has standing, a federal court may assume arguendo the merits of the plaintiff’s legal claim.

III. DISCUSSION

The Court now turns to the substance of Defendant’s motion. The operative pleading is the Consolidated Complaint, which contains six claims: (1) violation of the ECPA, 18 U.S.C. § 2702(a), Consol. Compl. ¶¶ 130-141; (2) breach of contract, id. ¶¶ 142-47; (3) breach of the covenant of good faith and fair dealing, id. ¶¶ 148-152; (4) breach of contract implied in law, id. ¶¶ 153-58; (5) unjust enrichment, id. ¶¶ 159-163; (6) declaratory judgment and corresponding injunctive relief under 28 U.S.C. §§ 2201-2202, id. ¶¶ 164-171. Defendant contends that Plaintiffs lack Article III standing to bring any of these claims. Specifically, Defendant’s motion concerns the injury in fact element; it does not contest causation or redressability. See Dkt. No. 107 (“Mot.”) at 9.

As set forth below, the Court concludes that Plaintiffs have met their burden of establishing injury in fact as to each of their claims for relief, wherefore Defendant’s motion is DENIED.

A. ECPA Violation

First, the Court considers whether Plaintiffs have standing to assert Count 1, i.e., that Google violated Title II of the ECPA, 18 U.S.C. § 2702(a).

Injury in fact is the “first and foremost element” of standing, Dutta v. State Farm Mut. Auto. Ins. Co. , 895 F.3d 1166, 1173 (9th Cir. 2018); it serves “to ensure that the plaintiff has a personal stake in the litigation.” Susan B. Anthony List v. Driehaus , 573 U.S. 149, 159 (2014) (internal quotations omitted). “To establish injury in fact, a plaintiff must show that he or she suffered ‘an invasion of a legally protected interest’ that is ‘concrete and particularized’ and ‘actual or imminent, not conjectural or hypothetical.’” Spokeo , 136 S. Ct. at 1548 (quoting Lujan , 504 U.S. at 560). In this case, the Supreme Court has instructed the Court to focus on the concreteness of Plaintiffs’ injury in fact. Concreteness “requires an injury to be de facto , that is, to actually exist.” Spokeo , 136 S. Ct. at 1543 (internal quotations omitted). Although concrete means “real, and not abstract,” it is not “synonymous with ‘tangible’”; intangible injuries can certainly be concrete. Id. at 1549. In determining whether an intangible injury is concrete, “both history and the judgment of Congress play important roles.” at 1548. “We consider history because ‘it is instructive to consider whether an alleged intangible harm has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts.’” Patel v. Facebook , Inc., 932 F.3d 1264, 1270 (9th Cir. 2019) (quoting Spokeo , 136 S. Ct. at 1549). “We must also examine legislative judgment because legislatures are ‘well positioned to identify intangible harms that meet minimum Article III requirements.’” (quoting , 136 S. Ct. at 1543).

In this Court’s 2012 order on Plaintiffs’ standing to assert the FAC, the Court found that Defendant’s alleged violation of the SCA is itself a concrete injury. Gaos , 2012 WL 1094646, at *1. The Court based that finding on the Ninth Circuit’s statement in Edwards that “[t]he injury required by Article III can exist solely by virtue of ‘statutes creating legal rights, the invasion of which creates standing.” 610 F.3d at 517 (quoting Warth v. Seldin , 422 U.S. 490, 500 (1975)). In this case, the ECPA creates the relevant legal right, namely, a right against the disclosure of “the contents of any communication” that is “carried or maintained on,” 18 U.S.C. § 2702(a)(2), or “in electronic storage by,” id. § 2702(a)(1), an electronic communication service provider. Because those provisions of the ECPA “provide[] a right to judicial relief . . . without additional injury,” the Court held that any violation of these statutory rights is a concrete injury. Gaos , 2012 WL 1094646, at *3 (citing Jewel , 673 F.3d at 908).

Pursuant to the Supreme Court’s instruction, the Court now reevaluates this conclusion in light of Spokeo . As the Supreme Court emphasized, Spokeo rejected the proposition that “a plaintiff

automatically satisfies the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right,” Frank , 139 S. Ct. at 1045 (quoting Spokeo , 136 S. Ct. at 1549). By way of example, the Spokeo Court stated that a “bare procedural violation, divorced from any concrete harm,” does not “satisfy the injury-in-fact requirement of Article III.” Spokeo , 136 S. Ct. at 1549. At the same time, however, Spokeo recognized that Congress may enact statutes that “‘elevate to the status of legally cognizable injuries concrete, de facto injuries that were previously inadequate’ to confer standing.” In re Facebook, Inc. Internet Tracking Litig. , 956 F.3d 589, 598 (9th Cir. 2020) (quoting Spokeo , 136 S. Ct. at 1549). “A plaintiff in such a case need not allege any additional harm beyond the one Congress has identified.” Spokeo , 136 S. Ct. at 1549.

The Ninth Circuit has parsed these principles as follows: “When a legislature has enacted a ‘bare procedural ’ protection, a plaintiff ‘cannot satisfy the demands of Article III’ by pointing only to a violation of that provision, but also must link it to a concrete harm.” Campbell v. Facebook, Inc. , 951 F.3d 1106, 1117 (9th Cir. 2020) (quoting , 136 S. Ct. at 1550) (emphasis in original). “When, however, a statutory provision identifies a substantive right that is infringed any time it is violated, a plaintiff bringing a claim under that provision need not allege any further harm to have standing.” Id. (internal quotations omitted) (emphasis in original). The upshot is that if the ECPA provisions alleged to be violated in Count 1 protect a substantive right as opposed to a purely procedural one, Plaintiffs have pleaded the invasion of a legally protected interest that is concrete.

The Court is satisfied that, under the Ninth Circuit’s post- Spokeo case law, the answer is yes. The Ninth Circuit has identified several state and federal statutes that protect individuals’ substantive privacy interests. For instance, in Eichenberger v. ESPN, Inc. , the court held that the Video Privacy Protection Act of 1988 (“VPPA”), 18 U.S.C. § 2710(b)(1), “identifies a substantive right to privacy that suffers any time a video service provider discloses otherwise private information.” 876 F.3d 979, 983-84 (9th Cir. 2017) (emphasis added). Heeding the Supreme Court’s teaching to consider history, the Ninth Circuit observed that “[v]iolations of the right to privacy have long been actionable at common law” and that those “privacy torts do not always require additional consequences to be actionable.” Id. Likewise, statutes like the VPPA do not only protect against harms that come from the use of disclosed information; rather, they “protect[] privacy interests more generally by ensuring that consumers retain control over their personal information.” at 983. Thus, the court found, every violation of 18 U.S.C. § 2710(b)(1) presents a concrete harm to the privacy interests Congress sought to protect in enacting the VPPA. at 984.

Similarly, in Van Patten v. Vertical Fitness Group, LLC , the Ninth Circuit held that the provisions in the Telephone Consumer Protection Act (“TCPA”) prohibiting a telemarketer from calling or texting a consumer without the consumer’s consent “protect the plaintiff’s substantive right to privacy, namely the right to be free from unsolicited telemarketing phone calls or text messages that ‘invade the privacy and disturb the solitude of their recipients.’” Patel , 932 F.3d at 1271 (quoting Van Patten , 847 F.3d 1037, 1041–43 (9th Cir. 2017)). For that reason, the court said, “a plaintiff alleging a violation under the TCPA need not allege any additional harm.” Van Patten , 847 F.3d at 1043 (internal quotations omitted). Illinois’s Biometric Information Privacy Act (“BIPA”) is yet another example of a statute that “protect[s] an individual’s concrete interests in privacy, not merely procedural rights.” Patel , 932 F.3d at 1274 (internal quotations omitted) (holding that BIPA protects “the right not to be subject to the collection and use of . . . biometric data”).

Of particular relevance here, the Ninth Circuit has recognized that the ECPA—the very statute at issue in this case—is among these statutes that “codify a context-specific extension of the substantive right to privacy,” the violation of which is a concrete harm. Campbell , 951 F.3d at 1117 (internal quotation omitted) (emphasis in original); see also In re Facebook, Inc. Internet Tracking Litig. , 956 F.3d 589, 598 (9th Cir. 2020).

Issued in March of this year, Campbell concerned provisions of the ECPA that provide a private right of action against one who “intentionally intercepts or endeavors to intercept” any wire, oral, or electronic communication, see 18 U.S.C. § 2511(1)(a), and against one who “intentionally uses, or endeavors to use” the contents of a communication knowingly obtained through such interception, see id. § 2511(1)(d). Campbell , 951 F.3d at 1112. The case also involved analogous provisions of the California Invasion of Privacy Act (“CIPA”), see Cal. Penal Code § 631(a). Id. As the Ninth Circuit explained, the ECPA and the CIPA “are targeted at the substantive intrusion that occurs when private communications are intercepted by someone who does not have the right to access them.” at 1119. The private rights of action contained therein—like those examined in the above-cited cases—“bear a ‘close relationship’” to traditional privacy torts such as unreasonable intrusion upon seclusion. Id. at 1117-18 (quoting , 136 S. Ct. at 1549). These provisions “represent statutory modernizations of the privacy protections available at common law” in light of new technology. Id. at 1118; see also In re Facebook, Inc. Internet Tracking Litig. , 956 F.3d at 599 (emphasizing that “[a]dvances in technology can increase the potential for unreasonable intrusions into personal privacy”). They also reflect the “legislatures’ judgment about the importance of the privacy interests violated when communications are intercepted.” Campbell , 951 F.3d at 1118. Accordingly, the Ninth Circuit held, “ every violation of the provisions of ECPA and CIPA at issue” is a clear de facto injury. One month later, in In re Facebook, Inc. Internet Tracking Litigation , the Ninth Circuit affirmed its determination that the ECPA “codif[ies] a substantive right to privacy, the violation of which gives rise to a concrete injury sufficient to confer standing.” 956 F.3d at 598. Moreover, whereas Campbell focused on the Wiretap Act portions of the ECPA (Title I), In re Facebook made clear that the SCA portions of the ECPA (Title II) likewise protect “historical privacy rights.” Id. at 598 (discussing 18 U.S.C. § 2701). Specifically, the SCA “protects individuals’ privacy and proprietary interests” in communications stored with electronic communication service providers. Theofel v. Farey-Jones , 359 F.3d 1066, 1072 (9th Cir. 2004).

It does so by providing a private right of action against both unlawful access to communications in electronic storage, see 18 U.S.C. § 2701, and unlawful disclosure of such communications, see 18 U.S.C. § 2702. The Ninth Circuit has analogized the unlawful access provisions of the SCA to the common law tort of trespass: “Just as trespass protects those who rent space from a commercial storage facility to hold sensitive documents, the Act protects users whose electronic communications are in electronic storage with an ISP or other electronic communications facility.” Theofel , 359 F.3d at 1072–73 (internal quotations and citations omitted). The unlawful disclosure provisions of the SCA, moreover, are closely analogous to the common law tort of breach of confidence. “A common law breach of confidence lies where a person offers private information to a third party in confidence and the third party reveals that information to another.” Jeffries v. Volume Servs. Am., Inc. , 928 F.3d 1059, 1064 (D.C. Cir. 2019). Though Defendant resists this analogy, the Court believes the SCA “establishes a similar relationship of trust between” user and electronic communication service provider; that relationship renders a SCA violation sufficiently similar to a breach of confidence to satisfy . See id. (analogizing a violation of the Fair and Accurate Credit Transactions Act of 2003 (“FACTA”) to a breach of confidence based on the “relationship of trust” between consumer and merchant under FACTA).

Of course, the SCA also “reflects Congress’s judgment that users have a legitimate interest in the confidentiality of communications in electronic storage at a communications facility.” Theofel , 359 F.3d at 1072–73; see also In re Facebook, Inc. Internet Tracking Litig. , 956 F.3d at 598-99 (finding the SCA was enacted “to protect privacy interests in personal and proprietary information”). The provision pertinent to this case, 18 U.S.C. § 2702, establishes that those interests are concretely—though perhaps intangibly—harmed by the unauthorized disclosure of the communications to a third party.

For all these reasons, the Court concludes that, as with the provisions of ECPA considered in Campbell and In re Facebook , 18 U.S.C. § 2702 “guard[s] against invasions of concrete privacy interests” such that every violation thereof causes concrete harm. Campbell , 951 F.3d at 1118. Plaintiffs have therefore pleaded a concrete injury by claiming that Google violated 18 U.S.C. § 2702 when it disclosed their search terms to third parties without authorization. See id. at 1119. Defendant spends the bulk of its brief arguing that Plaintiffs cannot show the search terms can or will be linked to a searcher’s identity. Mot. at 11. In Defendant’s view, if the searcher cannot be identified, anonymized search terms could “rarely if ever could result in harm or certainly impending harm.” Mot. at 11. But that argument assumes that harm must take the form of “individuals’ discovered identities” being “exploit[ed] . . . to their detriment.” at 19; see also id. at 18-21. Not so. As just explained, 18 U.S.C. § 2702 protects users’ privacy rights against the mere disclosure of their communications; the statute makes such disclosure actionable regardless whether those communications reveal the user’s identity. Congress has, in other words, identified a concrete privacy interest in communications stored with electronic communication service providers—even if those communications cannot be linked to the user. After all, information need not be personally identifying to be private. Because Plaintiffs “need not allege any additional harm beyond the one Congress has identified.” , 136 S.Ct. at 1549, their standing in no way depends on whether the search terms may be used to discover their identities. ^[1] See Campbell , 951 F.3d at 1119.

Defendant’s attempt to distinguish Campbell and In re Facebook on the ground that the information involved in those cases was personally identifying is similarly unavailing. Mot. at 13; see also Dkt. No. 110 (“Reply”) at 2. Again, the Ninth Circuit did not rest its decision in either case on the particular type of data at issue. Rather, it looked to Congress’s definition of private information as set forth in the ECPA, and the ECPA covers communications that are personally identifying and communications that are not. See 18 U.S.C. § 2510.

Finally, Defendant’s related argument that Plaintiffs are not persons “aggrieved” within the meaning of 18 U.S.C. § 2707(a) because the risk of identification is too speculative, Mot. at 17, goes to the merits of Plaintiffs’ SCA claim. See Jewel , 673 F.3d at 907 n.4. It presents no bar to Plaintiffs’ standing to assert the claim.

Having confirmed that Plaintiffs have claimed the invasion of their concrete legal rights under the ECPA, the Court finds that they have standing to pursue Count 1. Defendant’s motion to dismiss Count 1 is therefore DENIED. B. Common Law Breach of Contract Claims Next, the Court considers Counts 2 and 3, which are breach of contract claims brought under California law, see Consol. Compl. ¶¶ 11-12. Both claims allege that Google breached its Terms of Service by transmitting Plaintiffs’ search terms to third parties through referrer headers. Specifically, Count 2 alleges a breach of express terms in the Terms of Service, which allegedly included promises not to disclose users’ “web history” and other “personal information” except under specified circumstances. ¶¶ 25-40. Count 3 alleges a breach of the covenant of good faith and fair dealing, which, under California law, is implied into every contract, see Carma Developers (Cal.), Inc. v. Marathon Dev. California, Inc. , 2 Cal. 4th 342, 371 (1992). Consol. Compl. ¶¶ 148-152.

Defendant argues that Plaintiffs have not pleaded the injury in fact necessary to pursue these breach of contract claims. Defendant again focuses on the risk that the search terms could be linked to Plaintiffs’ identities, which Defendant believes is too speculative to constitute injury in fact. Mot. at 20; Reply at 10. Plaintiffs responds that actual damages are not required to establish standing for contractual claims under California law, which provides for nominal damages. Dkt. No. 109 (“Opp.”) at 10-12.

The Court agrees with Plaintiffs that under California law, “[t]he failure to perform a duty required by contract is a legal wrong, independently of actual damage sustained by the party to whom performance is due.” Kenyon v. W. Union Tel. Co. , 100 Cal. 454, 458 (1893); see also Sweet v. Johnson , 169 Cal. App. 2d 630, 632 (1959). Indeed, such is the longstanding common law rule in most states. See generally 22 Am. Jur. 2d Damages § 17 (collecting cases); see also , 136 S. Ct. at 1551 (Thomas, J., concurring) (“In a suit for the violation of a private right”—including “contract rights”—“courts historically presumed that the plaintiff suffered a de facto injury merely from having his personal, legal rights invaded.”). Pursuant to California Civil Code § 3360, moreover, “a plaintiff who proves a ‘breach of duty’ (including breach of contract) but fails to show any ‘appreciable detriment’—i.e., damages—nevertheless ‘may . . . recover’ nominal damages.” Tribeca Companies, LLC v. First Am. Title Ins. Co. , 239 Cal. App. 4th 1088, 1103 n.12 (2015) (quoting Cal. Civ. Code § 3360); see also 23 Cal. Jur. 3d Damages § 9; Avina v. Spurlock , 28 Cal. App. 3d 1086, 1088 (Ct. App. 1972) (“Nominal damages are properly awarded . . . [w]here there is no loss or injury to be compensated but where the law still recognizes a technical invasion of a plaintiff’s rights or a breach of a defendant’s duty.”). Thus, “a breach of contract claim accrues at the moment of breach” and “the injury, for standing purposes, is the breach itself.” Alston v. Flagstar Bank, FSB , 609 Fed. App’x 2, 3 (D.C. Cir. 2015). An individual to whom a contractual duty is owed may, therefore, allege a concrete legal injury by virtue of the duty’s breach, apart from any actual damages stemming from that breach. Accord Strother v. Baldwin , No. 216CV00255TLNCKD, 2017 WL 6017137, at *5 (E.D. Cal. Dec. 5, 2017), aff’d , 774 Fed. App’x 1016 (9th Cir. 2019); In re Facebook Privacy Litig. , 192 F. Supp. 3d 1053, 1061 (N.D. Cal. 2016). Nominal damages would redress that injury, “even if only to a minimal extent.” Skyline Wesleyan Church v. California Dep’t of Managed Health Care , No. 18-55451, 2020 WL 2464926, at *8 (9th Cir. May 13, 2020) (holding plaintiff had standing at least to seek nominal damages); cf. Engebretson v. Mahoney , 724 F.3d 1034, 1038 (9th Cir. 2013) (finding that plaintiffs have standing to seek nominal damages for a violation of their constitutional rights under 42 U.S.C. § 1983, “even without any actual injury for which they may seek compensatory damages”).

The Court acknowledges that other courts in this district have taken a contrary view. See Svenson v. Google Inc., No. 13-CV-04080-BLF, 2016 WL 8943301, at *10 (N.D. Cal. Dec. 21, 2016); Opperman v. Path, Inc. , 84 F. Supp. 3d 962, 990-91 (N.D. Cal. 2015). Nevertheless, for the reasons already given, the Court believes its determination that the breach of a contractual right is a concrete injury for Article III purposes is supported by Spokeo and California law.

Defendant is correct, of course, that “merely inserting a breach of contract claim into a complaint” is not enough “to generate standing.” Reply at 11. Although the merits of Plaintiffs’ contract claims are not at issue at the standing stage, Plaintiffs must identify the contractual duty that is owed to them and the manner of breach by Google. The Court finds that they have done so: Plaintiffs allege that they agreed to use Google’s search engine services in exchange for Google abiding by its Terms of Service, which incorporate its “Web History Privacy Policy” and “Privacy Policy.” Consol. Compl. ¶ 144. Pursuant to certain express promises contained in the Terms of Service and/or the implied covenant of good faith and fair dealing, Google was under a contractual duty not to share Plaintiffs’ “personal information” and “web history” except under certain specified circumstances. ¶ 25, 29, 34. Plaintiffs allege that Google breached that duty by sending Plaintiffs’ search terms to third parties via referrer headers. ¶ 36.

Now, Defendant disputes that the search terms qualify as “personal information” and that their actions amount to a breach. But that dispute goes to the merits of Plaintiffs’ contract claims, not to their standing to assert these claims. Plaintiffs have identified a concrete contractual duty that was allegedly owed to them and that was breached by Defendant; that suffices to demonstrate injury in fact at the pleading stage. Defendant’s motion to dismiss Counts 2 and 3 for lack of standing is DENIED.

C. Quasi-contract Claims

Counts 4 and 5 are quasi-contract claims: Count 4 alleges a claim for breach of implied-in- law contract and Count 5 alleges, in the alternative, a claim for unjust enrichment. Consol. Compl. ¶¶ 153-163. The gravamen of both is that Google has “increased its revenues and profits” by “sharing its users’ search queries third parties without their consent.” Id. ¶¶ 156, 160. Plaintiffs allege that Google has done this by “in effect, selling individual user search queries to advertisers,” in that, as of October 2011, Google scrubs the search terms from organic search results but not from paid listings; thus, receiving search terms in referrer headers is part of what Google’s advertisers now pay for. Id. ¶ 6. Therefore, in Plaintiffs’ view, Google has been unjustly enriched through the use of Plaintiffs’ search terms. Id. ¶¶ 158, 163.

“California law recognizes a right to disgorgement of profits resulting from unjust enrichment, even where an individual has not suffered a corresponding loss.” In re Facebook, Inc. Internet Tracking Litig. , 956 F.3d at 599–600 (citing Cty. of San Bernardino v. Walsh , 158 Cal. App. 4th 533, 542 (2007) and Ghirardo v. Antonioli , 14 Cal. 4th 39, 51 (1996)). As a result, the Ninth Circuit has explained, “an entitlement to unjustly earned profits” is “sufficient to confer Article III standing.” In re Facebook, Inc. Internet Tracking Litig. , 956 F.3d at 600. To show an entitlement to unjustly earned profits, a plaintiff must show that he or she “retain[s] a stake in the profits . . . because ‘circumstances are such that, as between the two parties, it is unjust for Facebook to retain it.’” In re Facebook, Inc. Internet Tracking Litig. , 956 F.3d at 600 (alterations omitted) (quoting McBride v. Boughton , 123 Cal. App. 4th 379, 389 (2004)). The Ninth Circuit found this test was satisfied in In re Facebook , which involved allegations of unjust enrichment that are similar to the ones in this case. There, the Ninth Circuit determined that plaintiffs’ allegations that Facebook had unjustly profited from disclosing users’ browsing histories sufficed to demonstrate standing. 956 F.3d at 600. As the court explained, the “unauthorized use of [Plaintiffs’] information for profit would entitle Plaintiffs to profits unjustly earned.” at 601. That is so, moreover, “regardless of whether an individual planned to sell his or her data or whether the individual’s data is made less valuable.” at 600.

The Plaintiffs in this case have, in like manner, adequately demonstrated their entitlement to unjustly earned profits. The Consolidated Complaint plausibly pleads that receiving search terms in referrer headers is one of the services that Google offers its advertisers, and that Google thus profits from the disclosure of Plaintiffs’ search terms. Plaintiffs have also shown that they “retain a stake in the profits garnered” from their search terms in that the search terms were disclosed without Plaintiffs’ consent and in spite of Google’s promises to the contrary. at 600. The Court therefore concludes that Plaintiffs have “sufficiently alleged a state law interest whose violation constitutes an injury sufficient to establish standing.” Id. at 601. Defendant’s motion to dismiss Counts 4 and 5 is DENIED.

D. Standing to Seek Injunctive Relief

The Consolidated Complaint seeks, in addition to damages, to enjoin Defendant’s practice of transmitting search terms in referrer headers. See Consol. Compl. ¶¶ 164-171 (Count 6). “A plaintiff must demonstrate constitutional standing separately for each form of relief requested.” Davidson v. Kimberly-Clark Corp. , 889 F.3d 956, 967 (9th Cir. 2018). For injunctive relief, which is a prospective remedy, Plaintiffs must show “either continuing, present adverse effects’ due to their exposure to [Google’s] past illegal conduct or a sufficient likelihood that they will again be wronged in a similar way.” Campbell , 951 F.3d at 1119–20 (internal quotations and alterations omitted). However, Defendant does not specifically argue that Plaintiffs lack standing for injunctive relief, nor does it suggest that it has ceased the practices giving rise to Plaintiffs’ claims. The Court therefore sees no obstacle to Plaintiffs’ standing to seek injunctive relief.

IV. CONCLUSION

For the foregoing reasons, Defendant’s motion to dismiss the Consolidated Complaint for lack of standing is DENIED.

IT IS SO ORDERED.

Dated: June 5, 2020

______________________________________ EDWARD J. DAVILA United States District Judge

Notes

[1] Accordingly, the Court does not reach the issue of whether the risk of future harm—i.e., the risk that anonymized search terms will be “reidentified” with the users—is also an injury-in-fact that is 27 “actual” and not “hypothetical.” See Dkt. No. 109 (“Opp.”) at 8-9. 28

Case Details

Case Name: In re Google Referrer Header Privacy Litigation

Court Name: District Court, N.D. California

Date Published: Jun 5, 2020

Citations: 465 F.Supp.3d 999; 5:10-cv-04809

Docket Number: 5:10-cv-04809

Court Abbreviation: N.D. Cal.