In re: Google Inc. Cookie Placement Consumer Privacy Litigation, involves 24 consolidated lawsuits that were initially brought against several internet advertisers alleging violations of various state and federal privacy statutes, including the Computer Fraud and Abuse Act, the Wiretap Act and the Electronic Communications Privacy Act. In October of 2013, the District of Delaware dismissed the consolidated case, finding that “that plaintiffs have not alleged injury-in-fact sufficient to confer Article III standing” and that they had failed to “[plead] sufficient facts to establish a plausible invasion of the rights” under various statutes asserted in the complaints. However, on November 10, 2015, the Third Circuit Court of Appeals issued an order restoring some of the plaintiffs’ claims alleging that Google’s internet tracking practices violate California’s Constitution and state privacy laws.
Addressing the standing argument presented by Google and adopted by the District Court, the Third Circuit stated that the argument that “the plaintiffs fail[ed] to demonstrate injury in fact because they [made] insufficient allegations of pecuniary harm,” was misplaced. The court explained that “the actual or threatened injury required by Art. III may exist solely by virtue of statutes creating legal rights, the invasion of which creates standing” and, therefore, standing may exist “for violations of federal privacy law absent any indication of pecuniary harm.”
The Third Circuit panel stated that to prevail with respect to privacy claims under California law, the court “consider[s] (1) the nature of any intrusion upon reasonable expectations of privacy, and (2) the offensiveness or seriousness of the intrusion, including any justification and other relevant interests. In evaluating the offensiveness of an invasion, the court is to consider ‘pragmatic policy concerns’ such that ‘no cause of action will lie for accidental, misguided, or excusable acts of overstepping upon legitimate privacy rights.’”
Google argued that the privacy claims must fail because “the plaintiffs voluntarily sent Google all the internet usage information at issue,” and that the use of “tracking cookies [is] routine,” citing cases that describe cookies as “more or less, innocuous.” Google further contended that courts “‘routinely’ find no actionable privacy invasion in cases involving tracking, collation, and disclosure of internet usage information.”
To subscribe for updates from our Data Protection Report blog, visit the email sign-up page.