In re Google Referrer Header Privacy Litigation ( 2020 )

1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 SAN JOSE DIVISION 7 IN RE GOOGLE REFERRER HEADER Case No. 10-cv-04809-EJD 8 PRIVACY LITIGATION ORDER DENYING MOTION TO 9 DISMISS 10 Re: Dkt. No. 107 11 12 13 This is a class action concerning Defendant Google, LLC’s alleged disclosure of users’ 14 search terms to third party servers; it was originally settled in 2013. The case now returns to the 15 Court upon remand from the U.S. Supreme Court, which vacated the settlement and instructed this 16 Court to evaluate the plaintiffs’ Article III standing in light of its decision in Spokeo, Inc. v. 17 Robins, 136 S. Ct. 1540 (2016). See Frank v. Gaos, 139 S. Ct. 1041, 1046 (2019). The Court has 18 now done so, aided by the parties’ briefing and a hearing conducted on June 4, 2020. The Court 19 finds that Plaintiffs have standing to bring their claims and DENIES Defendant’s motion to 20 dismiss. 21 I. BACKGROUND 22 This suit’s path to the present motion is a long and circuitous one; accordingly, a brief 23 review of how we got here is in order. 24 Defendant Google, LLC (“Google”) operates an Internet search engine, which allows users 25 to search for websites based on a query of keywords or phrases. Dkt. No. 51, Ex. A (“Consol. 26 Compl.”) ¶¶ 15-16. Upon a search, Google displays the search results as a list of hyperlinks to the 27 relevant websites; the user may click on a link to travel to the desired site. Id. ¶¶ 56-57. Plaintiffs 1 allege that when a user clicks on a search result, Google transmits the user’s search terms to the 2 third-party server that hosts the website the user seeks to view. Id. That is because the “Uniform 3 Resource Locator” (“URL”) used to direct the user to the requested website contains the URL of 4 the last site the user visited—i.e., the page that “referred” them to the requested website; this 5 information is known is as the “referrer header.” Id. ¶¶ 50-57; see generally In re Zynga Privacy 6 Litig., 750 F.3d 1098, 1101 (9th Cir. 2014) (explaining URLs and referrer headers). 7 Believing that the disclosure of search terms to third parties violates users’ statutory and 8 contractual privacy rights, Named Plaintiff Paloma Gaos filed the original Complaint in October 9 2010. Dkt. No. 1 (“Compl.”). The case was assigned to the undersigned judge in April 2011, Dkt. 10 No. 25, and Plaintiff Gaos filed the First Amended Complaint (“FAC”) in May 2011, Dkt. No. 26 11 (“FAC”). The FAC contains one federal claim for violation of the Electronic Communications 12 Privacy Act (“ECPA”), 18 U.S.C. § 2702(a), and six state law claims for fraudulent 13 misrepresentation, negligent misrepresentation, public disclosure of private facts, actual and 14 constructive fraud under Cal. Civ. Code §§ 1572, 1573, breach of contract, and unjust enrichment. 15 FAC ¶¶ 93-137. In May 2011, Defendant moved to dismiss the FAC pursuant to Federal Rules of 16 Civil Procedure 12(b)(1) and 12(b)(6), Dkt. No. 29. As relevant to the instant dispute, Defendant 17 argued that Plaintiff Gaos lacked standing to bring any of the claims in the FAC. Gaos v. Google 18 Inc., No. 5:10-CV-4809 EJD, 2012 WL 1094646, at *1 (N.D. Cal. Mar. 29, 2012). 19 This Court granted the motion in part and denied it in part. Id.; Dkt. No. 38. First, the 20 Court found that Plaintiff Gaos had failed to adequately plead standing to bring her six state law 21 claims and dismissed those claims with leave to amend. Gaos v. Google Inc., 2012 WL 1094646 22 at *2. On the other hand, Gaos’s federal claim alleged a violation of her rights under Title II of the 23 ECPA, which is the Stored Communications Act (“SCA”), 18 U.S.C. §§ 2701 et seq. This Court 24 rejected Defendant’s contention that Plaintiff Gaos had not adequately alleged an injury in fact, as 25 necessary for Article III standing. Gaos v. Google Inc., 2012 WL 1094646 at *3-*4; see Dkt. No. 26 29 at 7-10. Citing Edwards v. First American Corporation, 610 F.3d 514 (9th Cir. 2010), the 27 Court observed that “[t]he injury required by Article III . . . can exist solely by virtue of ‘statutes 1 creating legal rights, the invasion of which creates standing.’” 2012 WL 1094646 at *3 (quoting 2 Edwards, 510 F. 3d at 517). The Court then recognized that “a violation of one’s statutory rights 3 under the SCA” is, by itself, “a concrete injury” and found that Plaintiff Gaos had standing to 4 assert the SCA claim. Id. (citing Jewel v. National Security Agency, 673 F.3d 902, 908 (9th Cir. 5 2011)). 6 In an effort to cure the standing deficiencies as to the state law claims, Gaos and an 7 additional named plaintiff (Anthony Italiano) filed the Second Amended Complaint (“SAC”). 8 Dkt. No. 39 (“SAC”). The SAC also contained new factual allegations that in October 2011, 9 Google changed its practice regarding referrer headers. According to the SAC, Google’s new 10 practice was to “scrub” search terms from the referrer headers on “regular, organic search results” 11 when users are logged into a Google service; however, Google would continue to include search 12 terms in referrer headers when users click on “paid links or advertisements.” SAC ¶¶ 6, 64-66. 13 Thus, in Plaintiffs’ view, Google “is now effectively selling search queries to paying advertisers.” 14 Id. ¶ 67. 15 Defendant again moved to dismiss the SAC for lack of Article III standing. As to the state 16 law claims, Defendant argued that Plaintiffs had not cured the deficiencies in the FAC. In 17 addition, Defendant renewed its standing challenge to the SCA claim. Although Defendant 18 recognized that this Court had already rejected its argument on this front, the U.S. Supreme Court 19 had granted certiorari in Edwards, 510 F.3d 514; because this Court had relied in part on Edwards 20 in finding standing, Defendant urged the Court to reconsider its decision in the event Edwards was 21 reversed. Dkt. No. 44 at 3. When the Supreme Court dismissed Edwards as improvidently 22 granted, 567 U.S. 756 (2012), however, Defendant withdrew its standing argument against the 23 SCA claim. Dkt. No. 46 at 2 n.2. 24 Then, before this Court made its ruling on Defendant’s motion to dismiss the SAC, the 25 parties stipulated to the consolidation of Gaos and Italiano’s case with another class action, and 26 Plaintiffs filed the now-operative Consolidated Complaint. Dkt. Nos. 50, 51. The motion to 27 dismiss the SAC was therefore terminated as moot. Dkt. No. 51. 1 Shortly thereafter, in July 2013, the parties reached a classwide settlement. The settlement 2 agreement provided, among other things, that Defendant would pay a settlement amount of $8.5 3 million, none of which would be distributed to absent class members; rather, any funds not used 4 for costs, attorney’s fees, and incentive payments would be distributed to six cy pres recipients. 5 This Court granted preliminary and then final approval of the settlement, over the objections of 6 five class members. Dkt. Nos. 63, 85; see Frank v. Gaos, 139 S. Ct. 1041, 1045 (2019). Two of 7 the objectors appealed the settlement to the Ninth Circuit, challenging the propriety of cy pres 8 relief as well as the selection of the cy pres recipients. The Ninth Circuit affirmed this Court’s 9 approval of the settlement. In re Google Referrer Header Privacy Litigation, 869 F.3d 737 (9th 10 Cir. 2017). 11 Undeterred, the objectors petitioned for certiorari before the U.S. Supreme Court, and their 12 petition was granted. Frank v. Gaos, 138 S. Ct. 1697 (2018). Instead of reaching the merits of the 13 cy pres issues, however, the Supreme Court identified a potential threshold obstacle: In 2016, 14 while the objectors’ Ninth Circuit appeal was pending, the Supreme Court had issued its opinion 15 in Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016). The Supreme Court explained that Spokeo 16 “abrogated the ruling in Edwards that the violation of a statutory right automatically satisfies the 17 injury-in-fact requirement whenever a statute authorizes a person to sue to vindicate that right.” 18 Frank v. Gaos, 139 S. Ct. at 1046. But “[b]ecause Google withdrew its standing challenge after 19 we dismissed Edwards as improvidently granted, neither the District Court nor the Ninth Circuit 20 ever opined on whether any named plaintiff sufficiently alleged standing in the operative 21 complaint.” Id. As this Court lacked power to approve the proposed class settlement if no named 22 plaintiff had standing, the Supreme Court concluded that this Court should “address the plaintiffs’ 23 standing in light of Spokeo” in order to assure its jurisdiction. Id. The Supreme Court therefore 24 vacated the judgment and remanded the case to the Ninth Circuit, id., which remanded the case to 25 this Court, Dkt. No. 99. 26 In accordance with the Supreme Court’s order, Defendant filed a motion to dismiss the 27 operative Consolidated Complaint for lack of standing on March 20, 2020; that motion is now ripe 1 for this Court’s review. Dkt. Nos. 107, 108, 109, 110. 2 II. LEGAL STANDARD 3 The Court begins by reviewing the basic legal standards applicable to Defendant’s motion 4 to dismiss, which is brought under Federal Rule of Civil Procedure 12(b)(1). A Rule 12(b)(1) 5 motion tests whether the court has subject matter jurisdiction to hear the claims alleged in the 6 complaint. Here, Defendant contends that Plaintiffs lack Article III standing, which “is a 7 necessary component of subject matter jurisdiction.” In re Palmdale Hills Prop., LLC, 654 F.3d 8 868, 873 (9th Cir. 2011). 9 The Supreme Court has repeatedly stated that the “irreducible constitutional minimum of 10 standing” consists of three elements, Lujan v. Defs. of Wildlife, 504 U.S. 555, 560 (1992): “The 11 plaintiff must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged 12 conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision,” 13 Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 1547 (2016). These elements are typically referred to as 14 injury in fact, causation, and redressability. See, e.g., Planned Parenthood of Greater Washington 15 & N. Idaho v. U.S. Dep’t of Health & Human Servs., 946 F.3d 1100, 1108 (9th Cir. 2020). 16 Plaintiffs, as the parties invoking federal jurisdiction, bear the burden of establishing the existence 17 of Article III standing and, at the pleading stage, “must clearly allege facts demonstrating each 18 element.” Spokeo, 136 S. Ct. at 1547 (internal quotations omitted); see also Baker v. United 19 States, 722 F.2d 517, 518 (9th Cir. 1983) (“The facts to show standing must be clearly apparent on 20 the face of the complaint.”). 21 “In a class action, this standing inquiry focuses on the class representatives.” NEI 22 Contracting & Eng’g, Inc. v. Hanson Aggregates Pac. Sw., Inc., 926 F.3d 528, 532 (9th Cir. 23 2019). The named plaintiffs “must allege and show that they personally have been injured, not 24 that injury has been suffered by other, unidentified members of the class to which they belong and 25 which they purport to represent.” Warth v. Seldin, 422 U.S. 490, 502 (1975). Standing for the 26 putative class “is satisfied if at least one named plaintiff meets the requirements.” Bates v. United 27 Parcel Serv., Inc., 511 F.3d 974, 985 (9th Cir. 2007). But if none of the named plaintiffs 1 purporting to represent a class can establish standing to sue, the class action cannot proceed. See 2 NEI Contracting, 926 F.3d at 532 (citing O'Shea v. Littleton, 414 U.S. 488, 494 (1974)). 3 Where, as here, the Rule 12(b)(1) motion is a facial challenge to Plaintiffs’ standing, the 4 court considers whether the allegations contained in the complaint are sufficient on their face to 5 invoke federal jurisdiction. See Safe Air for Everyone v. Meyer, 373 F.3d 1035, 1039 (9th Cir. 6 2004). That is, a district court “resolves a facial attack as it would a motion to dismiss under Rule 7 12(b)(6): Accepting the plaintiff’s allegations as true and drawing all reasonable inferences in the 8 plaintiff's favor, the court determines whether the allegations are sufficient as a legal matter to 9 invoke the court’s jurisdiction.” Leite v. Crane Co., 749 F.3d 1117, 1121 (9th Cir. 2014). As with 10 a Rule 12(b)(6) motion, however, a court is not required “to accept as true allegations that are 11 merely conclusory, unwarranted deductions of fact, or unreasonable inferences.” In re Gilead 12 Scis. Sec. Litig., 536 F.3d 1049, 1055 (9th Cir. 2008); see also Thomas v. Mundell, 572 F.3d 756, 13 763 (9th Cir. 2009) (finding allegations “too vague” to support standing). 14 Finally, the Court notes that the question of standing is “distinct from the merits” of a 15 plaintiff’s claim. Maya v. Centex Corp., 658 F.3d 1060, 1068 (9th Cir. 2011); see also Warth v. 16 Seldin, 422 U.S. 490, 500 (1975) (“[S]tanding in no way depends on the merits of the plaintiff's 17 contention that particular conduct is illegal . . . .”). Hence, when considering whether a plaintiff 18 has standing, a federal court may assume arguendo the merits of the plaintiff’s legal claim. 19 III. DISCUSSION 20 The Court now turns to the substance of Defendant’s motion. The operative pleading is 21 the Consolidated Complaint, which contains six claims: (1) violation of the ECPA, 18 U.S.C. 22 § 2702(a), Consol. Compl. ¶¶ 130-141; (2) breach of contract, id. ¶¶ 142-47; (3) breach of the 23 covenant of good faith and fair dealing, id. ¶¶ 148-152; (4) breach of contract implied in law, id. 24 ¶¶ 153-58; (5) unjust enrichment, id. ¶¶ 159-163; (6) declaratory judgment and corresponding 25 injunctive relief under 28 U.S.C. §§ 2201-2202, id. ¶¶ 164-171. Defendant contends that Plaintiffs 26 lack Article III standing to bring any of these claims. Specifically, Defendant’s motion concerns 27 the injury in fact element; it does not contest causation or redressability. See Dkt. No. 107 1 (“Mot.”) at 9. 2 As set forth below, the Court concludes that Plaintiffs have met their burden of 3 establishing injury in fact as to each of their claims for relief, wherefore Defendant’s motion is 4 DENIED. 5 A. ECPA Violation 6 First, the Court considers whether Plaintiffs have standing to assert Count 1, i.e., that 7 Google violated Title II of the ECPA, 18 U.S.C. § 2702(a). 8 Injury in fact is the “first and foremost element” of standing, Dutta v. State Farm Mut. 9 Auto. Ins. Co., 895 F.3d 1166, 1173 (9th Cir. 2018); it serves “to ensure that the plaintiff has a 10 personal stake in the litigation.” Susan B. Anthony List v. Driehaus, 573 U.S. 149, 159 (2014) 11 (internal quotations omitted). “To establish injury in fact, a plaintiff must show that he or she 12 suffered ‘an invasion of a legally protected interest’ that is ‘concrete and particularized’ and 13 ‘actual or imminent, not conjectural or hypothetical.’” Spokeo, 136 S. Ct. at 1548 (quoting Lujan, 14 504 U.S. at 560). In this case, the Supreme Court has instructed the Court to focus on the 15 concreteness of Plaintiffs’ injury in fact. Concreteness “requires an injury to be de facto, that is, to 16 actually exist.” Spokeo, 136 S. Ct. at 1543 (internal quotations omitted). Although concrete 17 means “real, and not abstract,” it is not “synonymous with ‘tangible’”; intangible injuries can 18 certainly be concrete. Id. at 1549. In determining whether an intangible injury is concrete, “both 19 history and the judgment of Congress play important roles.” Id. at 1548. “We consider history 20 because ‘it is instructive to consider whether an alleged intangible harm has a close relationship to 21 a harm that has traditionally been regarded as providing a basis for a lawsuit in English or 22 American courts.’” Patel v. Facebook, Inc., 932 F.3d 1264, 1270 (9th Cir. 2019) (quoting Spokeo, 23 136 S. Ct. at 1549). “We must also examine legislative judgment because legislatures are ‘well 24 positioned to identify intangible harms that meet minimum Article III requirements.’” Id. (quoting 25 Spokeo, 136 S. Ct. at 1543). 26 In this Court’s 2012 order on Plaintiffs’ standing to assert the FAC, the Court found that 27 Defendant’s alleged violation of the SCA is itself a concrete injury. Gaos, 2012 WL 1094646, at 1 *1. The Court based that finding on the Ninth Circuit’s statement in Edwards that “[t]he injury 2 required by Article III can exist solely by virtue of ‘statutes creating legal rights, the invasion of 3 which creates standing.” 610 F.3d at 517 (quoting Warth v. Seldin, 422 U.S. 490, 500 (1975)). In 4 this case, the ECPA creates the relevant legal right, namely, a right against the disclosure of “the 5 contents of any communication” that is “carried or maintained on,” 18 U.S.C. § 2702(a)(2), or “in 6 electronic storage by,” id. § 2702(a)(1), an electronic communication service provider. Because 7 those provisions of the ECPA “provide[] a right to judicial relief . . . without additional injury,” 8 the Court held that any violation of these statutory rights is a concrete injury. Gaos, 2012 WL 9 1094646, at *3 (citing Jewel, 673 F.3d at 908). 10 Pursuant to the Supreme Court’s instruction, the Court now reevaluates this conclusion in 11 light of Spokeo. 12 As the Supreme Court emphasized, Spokeo rejected the proposition that “a plaintiff 13 automatically satisfies the injury-in-fact requirement whenever a statute grants a person a statutory 14 right and purports to authorize that person to sue to vindicate that right,” Frank, 139 S. Ct. at 1045 15 (quoting Spokeo, 136 S. Ct. at 1549). By way of example, the Spokeo Court stated that a “bare 16 procedural violation, divorced from any concrete harm,” does not “satisfy the injury-in-fact 17 requirement of Article III.” Spokeo, 136 S. Ct. at 1549. At the same time, however, Spokeo 18 recognized that Congress may enact statutes that “‘elevate to the status of legally cognizable 19 injuries concrete, de facto injuries that were previously inadequate’ to confer standing.” In re 20 Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 598 (9th Cir. 2020) (quoting Spokeo, 136 S. 21 Ct. at 1549). “A plaintiff in such a case need not allege any additional harm beyond the one 22 Congress has identified.” Spokeo, 136 S. Ct. at 1549. 23 The Ninth Circuit has parsed these principles as follows: “When a legislature has enacted a 24 ‘bare procedural’ protection, a plaintiff ‘cannot satisfy the demands of Article III’ by pointing 25 only to a violation of that provision, but also must link it to a concrete harm.” Campbell v. 26 Facebook, Inc., 951 F.3d 1106, 1117 (9th Cir. 2020) (quoting Spokeo, 136 S. Ct. at 1550) 27 (emphasis in original). “When, however, a statutory provision identifies a substantive right that is 1 infringed any time it is violated, a plaintiff bringing a claim under that provision need not allege 2 any further harm to have standing.” Id. (internal quotations omitted) (emphasis in original). The 3 upshot is that if the ECPA provisions alleged to be violated in Count 1 protect a substantive right 4 as opposed to a purely procedural one, Plaintiffs have pleaded the invasion of a legally protected 5 interest that is concrete. 6 The Court is satisfied that, under the Ninth Circuit’s post-Spokeo case law, the answer is 7 yes. The Ninth Circuit has identified several state and federal statutes that protect individuals’ 8 substantive privacy interests. For instance, in Eichenberger v. ESPN, Inc., the court held that the 9 Video Privacy Protection Act of 1988 (“VPPA”), 18 U.S.C. § 2710(b)(1), “identifies a substantive 10 right to privacy that suffers any time a video service provider discloses otherwise private 11 information.” 876 F.3d 979, 983-84 (9th Cir. 2017) (emphasis added). Heeding the Supreme 12 Court’s teaching to consider history, the Ninth Circuit observed that “[v]iolations of the right to 13 privacy have long been actionable at common law” and that those “privacy torts do not always 14 require additional consequences to be actionable.” Id. Likewise, statutes like the VPPA do not 15 only protect against harms that come from the use of disclosed information; rather, they “protect[] 16 privacy interests more generally by ensuring that consumers retain control over their personal 17 information.” Id. at 983. Thus, the court found, every violation of 18 U.S.C. § 2710(b)(1) 18 presents a concrete harm to the privacy interests Congress sought to protect in enacting the VPPA. 19 Id. at 984. 20 Similarly, in Van Patten v. Vertical Fitness Group, LLC, the Ninth Circuit held that the 21 provisions in the Telephone Consumer Protection Act (“TCPA”) prohibiting a telemarketer from 22 calling or texting a consumer without the consumer’s consent “protect the plaintiff’s substantive 23 right to privacy, namely the right to be free from unsolicited telemarketing phone calls or text 24 messages that ‘invade the privacy and disturb the solitude of their recipients.’” Patel, 932 F.3d at 25 1271 (quoting Van Patten, 847 F.3d 1037, 1041–43 (9th Cir. 2017)). For that reason, the court 26 said, “a plaintiff alleging a violation under the TCPA need not allege any additional harm.” Van 27 Patten, 847 F.3d at 1043 (internal quotations omitted). Illinois’s Biometric Information Privacy 1 Act (“BIPA”) is yet another example of a statute that “protect[s] an individual’s concrete interests 2 in privacy, not merely procedural rights.” Patel, 932 F.3d at 1274 (internal quotations omitted) 3 (holding that BIPA protects “the right not to be subject to the collection and use of . . . biometric 4 data”). 5 Of particular relevance here, the Ninth Circuit has recognized that the ECPA—the very 6 statute at issue in this case—is among these statutes that “codify a context-specific extension of 7 the substantive right to privacy,” the violation of which is a concrete harm. Campbell, 951 F.3d at 8 1117 (internal quotation omitted) (emphasis in original); see also In re Facebook, Inc. Internet 9 Tracking Litig., 956 F.3d 589, 598 (9th Cir. 2020). 10 Issued in March of this year, Campbell concerned provisions of the ECPA that provide a 11 private right of action against one who “intentionally intercepts or endeavors to intercept” any 12 wire, oral, or electronic communication, see 18 U.S.C. § 2511(1)(a), and against one who 13 “intentionally uses, or endeavors to use” the contents of a communication knowingly obtained 14 through such interception, see id. § 2511(1)(d). Campbell, 951 F.3d at 1112. The case also 15 involved analogous provisions of the California Invasion of Privacy Act (“CIPA”), see Cal. Penal 16 Code § 631(a). Id. As the Ninth Circuit explained, the ECPA and the CIPA “are targeted at the 17 substantive intrusion that occurs when private communications are intercepted by someone who 18 does not have the right to access them.” Id. at 1119. The private rights of action contained 19 therein—like those examined in the above-cited cases—“bear a ‘close relationship’” to traditional 20 privacy torts such as unreasonable intrusion upon seclusion. Id. at 1117-18 (quoting Spokeo, 136 21 S. Ct. at 1549). These provisions “represent statutory modernizations of the privacy protections 22 available at common law” in light of new technology. Id. at 1118; see also In re Facebook, Inc. 23 Internet Tracking Litig., 956 F.3d at 599 (emphasizing that “[a]dvances in technology can increase 24 the potential for unreasonable intrusions into personal privacy”). They also reflect the 25 “legislatures’ judgment about the importance of the privacy interests violated when 26 communications are intercepted.” Campbell, 951 F.3d at 1118. Accordingly, the Ninth Circuit 27 held, “every violation of the provisions of ECPA and CIPA at issue” is a clear de facto injury. Id. 1 One month later, in In re Facebook, Inc. Internet Tracking Litigation, the Ninth Circuit 2 affirmed its determination that the ECPA “codif[ies] a substantive right to privacy, the violation of 3 which gives rise to a concrete injury sufficient to confer standing.” 956 F.3d at 598. Moreover, 4 whereas Campbell focused on the Wiretap Act portions of the ECPA (Title I), In re Facebook 5 made clear that the SCA portions of the ECPA (Title II) likewise protect “historical privacy 6 rights.” Id. at 598 (discussing 18 U.S.C. § 2701). Specifically, the SCA “protects individuals’ 7 privacy and proprietary interests” in communications stored with electronic communication 8 service providers. Theofel v. Farey-Jones, 359 F.3d 1066, 1072 (9th Cir. 2004). 9 It does so by providing a private right of action against both unlawful access to 10 communications in electronic storage, see 18 U.S.C. § 2701, and unlawful disclosure of such 11 communications, see 18 U.S.C. § 2702. The Ninth Circuit has analogized the unlawful access 12 provisions of the SCA to the common law tort of trespass: “Just as trespass protects those who rent 13 space from a commercial storage facility to hold sensitive documents, the Act protects users 14 whose electronic communications are in electronic storage with an ISP or other electronic 15 communications facility.” Theofel, 359 F.3d at 1072–73 (internal quotations and citations 16 omitted). The unlawful disclosure provisions of the SCA, moreover, are closely analogous to the 17 common law tort of breach of confidence. “A common law breach of confidence lies where a 18 person offers private information to a third party in confidence and the third party reveals that 19 information to another.” Jeffries v. Volume Servs. Am., Inc., 928 F.3d 1059, 1064 (D.C. Cir. 20 2019). Though Defendant resists this analogy, the Court believes the SCA “establishes a similar 21 relationship of trust between” user and electronic communication service provider; that 22 relationship renders a SCA violation sufficiently similar to a breach of confidence to satisfy 23 Spokeo. See id. (analogizing a violation of the Fair and Accurate Credit Transactions Act of 2003 24 (“FACTA”) to a breach of confidence based on the “relationship of trust” between consumer and 25 merchant under FACTA). 26 Of course, the SCA also “reflects Congress’s judgment that users have a legitimate interest 27 in the confidentiality of communications in electronic storage at a communications facility.” 1 Theofel, 359 F.3d at 1072–73; see also In re Facebook, Inc. Internet Tracking Litig., 956 F.3d at 2 598-99 (finding the SCA was enacted “to protect privacy interests in personal and proprietary 3 information”). The provision pertinent to this case, 18 U.S.C. § 2702, establishes that those 4 interests are concretely—though perhaps intangibly—harmed by the unauthorized disclosure of 5 the communications to a third party. 6 For all these reasons, the Court concludes that, as with the provisions of ECPA considered 7 in Campbell and In re Facebook, 18 U.S.C. § 2702 “guard[s] against invasions of concrete privacy 8 interests” such that every violation thereof causes concrete harm. Campbell, 951 F.3d at 1118. 9 Plaintiffs have therefore pleaded a concrete injury by claiming that Google violated 18 U.S.C. 10 § 2702 when it disclosed their search terms to third parties without authorization. See id. at 1119. 11 Defendant spends the bulk of its brief arguing that Plaintiffs cannot show the search terms 12 can or will be linked to a searcher’s identity. Mot. at 11. In Defendant’s view, if the searcher 13 cannot be identified, anonymized search terms could “rarely if ever could result in harm or 14 certainly impending harm.” Mot. at 11. But that argument assumes that harm must take the form 15 of “individuals’ discovered identities” being “exploit[ed] . . . to their detriment.” Id. at 19; see 16 also id. at 18-21. Not so. As just explained, 18 U.S.C. § 2702 protects users’ privacy rights 17 against the mere disclosure of their communications; the statute makes such disclosure actionable 18 regardless whether those communications reveal the user’s identity. Congress has, in other words, 19 identified a concrete privacy interest in communications stored with electronic communication 20 service providers—even if those communications cannot be linked to the user. After all, 21 information need not be personally identifying to be private. Because Plaintiffs “need not allege 22 any additional harm beyond the one Congress has identified.” Spokeo, 136 S.Ct. at 1549, their 23 standing in no way depends on whether the search terms may be used to discover their identities.1 24 See Campbell, 951 F.3d at 1119. 25 26 1 Accordingly, the Court does not reach the issue of whether the risk of future harm—i.e., the risk 27 that anonymized search terms will be “reidentified” with the users—is also an injury-in-fact that is “actual” and not “hypothetical.” See Dkt. No. 109 (“Opp.”) at 8-9. 1 Defendant’s attempt to distinguish Campbell and In re Facebook on the ground that the 2 information involved in those cases was personally identifying is similarly unavailing. Mot. at 13; 3 see also Dkt. No. 110 (“Reply”) at 2. Again, the Ninth Circuit did not rest its decision in either 4 case on the particular type of data at issue. Rather, it looked to Congress’s definition of private 5 information as set forth in the ECPA, and the ECPA covers communications that are personally 6 identifying and communications that are not. See 18 U.S.C. § 2510. 7 Finally, Defendant’s related argument that Plaintiffs are not persons “aggrieved” within the 8 meaning of 18 U.S.C. § 2707(a) because the risk of identification is too speculative, Mot. at 17, 9 goes to the merits of Plaintiffs’ SCA claim. See Jewel, 673 F.3d at 907 n.4. It presents no bar to 10 Plaintiffs’ standing to assert the claim. 11 Having confirmed that Plaintiffs have claimed the invasion of their concrete legal rights 12 under the ECPA, the Court finds that they have standing to pursue Count 1. Defendant’s motion 13 to dismiss Count 1 is therefore DENIED. 14 B. Common Law Breach of Contract Claims 15 Next, the Court considers Counts 2 and 3, which are breach of contract claims brought 16 under California law, see Consol. Compl. ¶¶ 11-12. Both claims allege that Google breached its 17 Terms of Service by transmitting Plaintiffs’ search terms to third parties through referrer headers. 18 Specifically, Count 2 alleges a breach of express terms in the Terms of Service, which allegedly 19 included promises not to disclose users’ “web history” and other “personal information” except 20 under specified circumstances. Id. ¶¶ 25-40. Count 3 alleges a breach of the covenant of good 21 faith and fair dealing, which, under California law, is implied into every contract, see Carma 22 Developers (Cal.), Inc. v. Marathon Dev. California, Inc., 2 Cal. 4th 342, 371 (1992). Consol. 23 Compl. ¶¶ 148-152. 24 Defendant argues that Plaintiffs have not pleaded the injury in fact necessary to pursue 25 these breach of contract claims. Defendant again focuses on the risk that the search terms could be 26 linked to Plaintiffs’ identities, which Defendant believes is too speculative to constitute injury in 27 fact. Mot. at 20; Reply at 10. Plaintiffs responds that actual damages are not required to establish 1 standing for contractual claims under California law, which provides for nominal damages. Dkt. 2 No. 109 (“Opp.”) at 10-12. 3 The Court agrees with Plaintiffs that under California law, “[t]he failure to perform a duty 4 required by contract is a legal wrong, independently of actual damage sustained by the party to 5 whom performance is due.” Kenyon v. W. Union Tel. Co., 100 Cal. 454, 458 (1893); see also 6 Sweet v. Johnson, 169 Cal. App. 2d 630, 632 (1959). Indeed, such is the longstanding common 7 law rule in most states. See generally 22 Am. Jur. 2d Damages § 17 (collecting cases); see also 8 Spokeo, 136 S. Ct. at 1551 (Thomas, J., concurring) (“In a suit for the violation of a private 9 right”—including “contract rights”—“courts historically presumed that the plaintiff suffered a de 10 facto injury merely from having his personal, legal rights invaded.”). Pursuant to California Civil 11 Code § 3360, moreover, “a plaintiff who proves a ‘breach of duty’ (including breach of contract) 12 but fails to show any ‘appreciable detriment’—i.e., damages—nevertheless ‘may . . . recover’ 13 nominal damages.” Tribeca Companies, LLC v. First Am. Title Ins. Co., 239 Cal. App. 4th 1088, 14 1103 n.12 (2015) (quoting Cal. Civ. Code § 3360); see also 23 Cal. Jur. 3d Damages § 9; Avina v. 15 Spurlock, 28 Cal. App. 3d 1086, 1088 (Ct. App. 1972) (“Nominal damages are properly awarded . 16 . . [w]here there is no loss or injury to be compensated but where the law still recognizes a 17 technical invasion of a plaintiff’s rights or a breach of a defendant’s duty.”). 18 Thus, “a breach of contract claim accrues at the moment of breach” and “the injury, for 19 standing purposes, is the breach itself.” Alston v. Flagstar Bank, FSB, 609 Fed. App’x 2, 3 (D.C. 20 Cir. 2015). An individual to whom a contractual duty is owed may, therefore, allege a concrete 21 legal injury by virtue of the duty’s breach, apart from any actual damages stemming from that 22 breach. Accord Strother v. Baldwin, No. 216CV00255TLNCKD, 2017 WL 6017137, at *5 (E.D. 23 Cal. Dec. 5, 2017), aff’d, 774 Fed. App’x 1016 (9th Cir. 2019); In re Facebook Privacy Litig., 192 24 F. Supp. 3d 1053, 1061 (N.D. Cal. 2016). Nominal damages would redress that injury, “even if 25 only to a minimal extent.” Skyline Wesleyan Church v. California Dep’t of Managed Health 26 Care, No. 18-55451, 2020 WL 2464926, at *8 (9th Cir. May 13, 2020) (holding plaintiff had 27 standing at least to seek nominal damages); cf. Engebretson v. Mahoney, 724 F.3d 1034, 1038 (9th 1 Cir. 2013) (finding that plaintiffs have standing to seek nominal damages for a violation of their 2 constitutional rights under 42 U.S.C. § 1983, “even without any actual injury for which they may 3 seek compensatory damages”). 4 The Court acknowledges that other courts in this district have taken a contrary view. See 5 Svenson v. Google Inc., No. 13-CV-04080-BLF, 2016 WL 8943301, at *10 (N.D. Cal. Dec. 21, 6 2016); Opperman v. Path, Inc., 84 F. Supp. 3d 962, 990-91 (N.D. Cal. 2015). Nevertheless, for 7 the reasons already given, the Court believes its determination that the breach of a contractual 8 right is a concrete injury for Article III purposes is supported by Spokeo and California law. 9 Defendant is correct, of course, that “merely inserting a breach of contract claim into a 10 complaint” is not enough “to generate standing.” Reply at 11. Although the merits of Plaintiffs’ 11 contract claims are not at issue at the standing stage, Plaintiffs must identify the contractual duty 12 that is owed to them and the manner of breach by Google. The Court finds that they have done so: 13 Plaintiffs allege that they agreed to use Google’s search engine services in exchange for Google 14 abiding by its Terms of Service, which incorporate its “Web History Privacy Policy” and “Privacy 15 Policy.” Consol. Compl. ¶ 144. Pursuant to certain express promises contained in the Terms of 16 Service and/or the implied covenant of good faith and fair dealing, Google was under a contractual 17 duty not to share Plaintiffs’ “personal information” and “web history” except under certain 18 specified circumstances. Id. ¶ 25, 29, 34. Plaintiffs allege that Google breached that duty by 19 sending Plaintiffs’ search terms to third parties via referrer headers. Id. ¶ 36. 20 Now, Defendant disputes that the search terms qualify as “personal information” and that 21 their actions amount to a breach. But that dispute goes to the merits of Plaintiffs’ contract claims, 22 not to their standing to assert these claims. Plaintiffs have identified a concrete contractual duty 23 that was allegedly owed to them and that was breached by Defendant; that suffices to demonstrate 24 injury in fact at the pleading stage. Defendant’s motion to dismiss Counts 2 and 3 for lack of 25 standing is DENIED. 26 C. Quasi-contract Claims 27 Counts 4 and 5 are quasi-contract claims: Count 4 alleges a claim for breach of implied-in- 1 law contract and Count 5 alleges, in the alternative, a claim for unjust enrichment. Consol. 2 Compl. ¶¶ 153-163. The gravamen of both is that Google has “increased its revenues and profits” 3 by “sharing its users’ search queries third parties without their consent.” Id. ¶¶ 156, 160. 4 Plaintiffs allege that Google has done this by “in effect, selling individual user search queries to 5 advertisers,” in that, as of October 2011, Google scrubs the search terms from organic search 6 results but not from paid listings; thus, receiving search terms in referrer headers is part of what 7 Google’s advertisers now pay for. Id. ¶ 6. Therefore, in Plaintiffs’ view, Google has been 8 unjustly enriched through the use of Plaintiffs’ search terms. Id. ¶¶ 158, 163. 9 “California law recognizes a right to disgorgement of profits resulting from unjust 10 enrichment, even where an individual has not suffered a corresponding loss.” In re Facebook, Inc. 11 Internet Tracking Litig., 956 F.3d at 599–600 (citing Cty. of San Bernardino v. Walsh, 158 Cal. 12 App. 4th 533, 542 (2007) and Ghirardo v. Antonioli, 14 Cal. 4th 39, 51 (1996)). As a result, the 13 Ninth Circuit has explained, “an entitlement to unjustly earned profits” is “sufficient to confer 14 Article III standing.” In re Facebook, Inc. Internet Tracking Litig., 956 F.3d at 600. 15 To show an entitlement to unjustly earned profits, a plaintiff must show that he or she 16 “retain[s] a stake in the profits . . . because ‘circumstances are such that, as between the two 17 parties, it is unjust for Facebook to retain it.’” In re Facebook, Inc. Internet Tracking Litig., 956 18 F.3d at 600 (alterations omitted) (quoting McBride v. Boughton, 123 Cal. App. 4th 379, 389 19 (2004)). The Ninth Circuit found this test was satisfied in In re Facebook, which involved 20 allegations of unjust enrichment that are similar to the ones in this case. There, the Ninth Circuit 21 determined that plaintiffs’ allegations that Facebook had unjustly profited from disclosing users’ 22 browsing histories sufficed to demonstrate standing. 956 F.3d at 600. As the court explained, the 23 “unauthorized use of [Plaintiffs’] information for profit would entitle Plaintiffs to profits unjustly 24 earned.” Id. at 601. That is so, moreover, “regardless of whether an individual planned to sell his 25 or her data or whether the individual’s data is made less valuable.” Id. at 600. 26 The Plaintiffs in this case have, in like manner, adequately demonstrated their entitlement 27 to unjustly earned profits. The Consolidated Complaint plausibly pleads that receiving search 1 terms in referrer headers is one of the services that Google offers its advertisers, and that Google 2 || thus profits from the disclosure of Plaintiffs’ search terms. Plaintiffs have also shown that they 3 “retain a stake in the profits garnered” from their search terms in that the search terms were 4 || disclosed without Plaintiffs’ consent and in spite of Google’s promises to the contrary. Id. at 600. 5 The Court therefore concludes that Plaintiffs have “sufficiently alleged a state law interest whose 6 || violation constitutes an injury sufficient to establish standing.” Jd. at 601. Defendant’s motion to 7 dismiss Counts 4 and 5 is DENIED. 8 D. Standing to Seek Injunctive Relief 9 The Consolidated Complaint seeks, in addition to damages, to enjoin Defendant’s practice 10 || of transmitting search terms in referrer headers. See Consol. Compl. {| 164-171 (Count 6). “A 11 plaintiff must demonstrate constitutional standing separately for each form of relief requested.” 12 Davidson vy. Kimberly-Clark Corp., 889 F.3d 956, 967 (9th Cir. 2018). For injunctive relief, 5 13 || which is a prospective remedy, Plaintiffs must show “either continuing, present adverse effects’ 14 || due to their exposure to [Google’s] past illegal conduct or a sufficient likelihood that they will 15 again be wronged in a similar way.” Campbell, 951 F.3d at 1119-20 (internal quotations and 16 alterations omitted). However, Defendant does not specifically argue that Plaintiffs lack standing 3 17 || for injunctive relief, nor does it suggest that it has ceased the practices giving rise to Plaintiffs’ S 18 || claims. The Court therefore sees no obstacle to Plaintiffs’ standing to seek injunctive relief. 19 IV. CONCLUSION 20 For the foregoing reasons, Defendant’s motion to dismiss the Consolidated Complaint for 21 lack of standing is DENIED. 22 23 IT IS SO ORDERED. 24 25 Dated: June 5, 2020 aD 26 EDWARD J. DAVILA 27 United States District Judge 28 || Case No.: 10-cv-04809-EJD ORDER DENYING MOTION TO DISMISS