On January 3, 2019, the federal trial court in Manhattan issued a preliminary injunction, temporarily halting a new local law aimed at required disclosures by home-sharing platforms, such as Airbnb and HomeAway, to the city. The court granted the preliminary injunction on the basis that the city’s broad requirement that the services turn over detailed customer information on a monthly basis likely violated the Fourth Amendment to the U.S. Constitution—infringing the privacy rights of the companies, rather than the users. In contrast, the court ruled that the companies’ Stored Communications Act claim did not meet the standard for a preliminary injunction. (Airbnb, Inc. v. City of New York, Case 1:18-cv-07712-PAE (S.D.N.Y. Jan. 3, 2019)).
Background
The case began in July of 2018, when the New York City Council passed, and the Mayor signed, a local law that focused on “booking services” that advertised or offered short-term rentals. The local law derived from a 2010 New York State law that prohibited rental of most apartments for less than 30 days unless a permanent resident remained on the premises. The New York City local law would require each booking service to file every month for each and every short-term rental all of the following information:
(1) The physical address of the short-term rental associated with such transaction, including the street name, street number, apartment or unit number, borough or county, and zip code;
(2) The full legal name, physical address, phone number and email address of the host of such short term rental and the uniform resource locator (URL) and the individualized name and number of such host on such booking service’s platform;
(3) The individualized name and number and the URL of such advertisement or listing;
(4) A statement as to whether such short-term rental transaction involved (i) short-term rental of the entirety of a dwelling unit of housing accommodations in a building or (ii) short term rental of part of such unit or housing accommodations;
(5) The total number of days that the swelling unit, part thereof, or housing accommodations in a building were rented as a short-term rental through such booking service’s platform;
(6) The total amount of fees received by such booking service for short-term rental; and
(7) If such booking service collects rent for short-term rentals on behalf of such host, (i) the total amount of such rent received by such booking service and transmitted to such host and (ii) the account name and consistently anonymized identifier for the account number for the account used by such host to receive payments from such booking service or, if such booking service provides an explanation why such anonymized identifiers are unavailable, the account name and account number of such account.
(NYC Admin. Code § 26-2102(a).)
The local law also required that the booking service obtain user consent to provide this information, and expressly permitted the booking service to obtain user consent from residential hosts by “advising or providing notice to a user of the booking service that new or continuing use of such booking service as a host constitutes consent to such disclosure.” Note that Airbnb’s and HomeAway’s privacy policies—even prior to the enactment of the local law—required users to accept its terms of use and privacy policy, which included the statement that the company could turn over the information where required or permitted by law. (Such clauses are very common, and can be found in almost every posted privacy policy.)
If a booking service failed to provide the information listed above, the penalty was the greater of $1500 or the total fees for the previous year that the booking service collected for the transactions related to the listing.
The lawsuit
Home-sharing platforms Airbnb and HomeAway challenged the local law on four grounds:
- that it violated the Fourth Amendment to the U.S. Constitution;
- that it violated the similar provision of the New York Constitution;
- that it violated the First Amendment to the U.S. Constitution; and
- that it violated the federal Stored Communications Act.
The plaintiffs sought a preliminary injunction, to halt application of the local law until a trial on the merits could occur. In short, the court, at this pre-trial stage, ruled in favor of the plaintiffs’ Fourth Amendment claim, did not reach either the New York Constitution or First Amendment claims, and expressed doubt about the Stored Communications Act claim.
In order to obtain a preliminary injunction, the plaintiffs had to show:
- Irreparable harm absent the injunctive relief;
- A likelihood of success on the merits, or serious questions about the merits with a balance of hardships tipping decided in the plaintiffs’ favor; and
- That the public’s interest weighs in favor of granting an injunction.
(Slip op. at 15 (citations omitted).)
Fourth Amendment claim
The plaintiffs claimed that the local law violated the Fourth Amendment as an unlawful search and seizure of their records, without any opportunity for pre-compliance review before a neutral decision-maker. Although the local law did not authorize physical entry into the booking services’ premises, the court found that a search or seizure occurs when the government “invades a constitutionally protected privacy interest to gather information.” (Id. at 18 (citations omitted).) Note that, in 2015, the U.S. Supreme Court had ruled in City of Los Angeles v. Patel (135 S. Ct. 2443 (2015)) that the Fourth Amendment applied to hotel owners’ business records of guests’ names, addresses, and vehicles.
In this case, the trial court found that the booking services—not the users–had two privacy interests: “One is competitive: Keeping such data confidential keeps such information from rivals (whether competing platforms or hotels) who might exploit it. The other involves customer relations: Keeping such data private assuredly promotes better relations with, and retention of, a platform’s users.” (Slip op. at 22.) The court also noted that no user of the platforms had sought to participate in the lawsuit (Id. at 21 n.7.) The city argued that the users had relinquished any privacy claim because they agreed to the booking services’ terms and privacy policies, but the court found that argument inapplicable because the policies did not waive the companies’ right to claim a reasonable expectation of privacy in their records.
In order to be valid under the Fourth Amendment, an agency subpoena must have “a limited scope, a relevant purpose, and specificity in its demands.” (Id. at 28 (citation omitted).) In this case, the court found the local law to be “the antithesis of a targeted administrative subpoena for business records” on a “breathtaking” scale. (Id. at 33.) “Existing Fourth Amendment law does not afford a charter for such a wholesale regulatory appropriation of a company’s user database.” (Id. at 40.)
The Fourth Amendment also requires that there be some form of pre-compliance review to ensure that a neutral decisionmaker has evaluated questions such as those raised here. The court found that the local law did not provide a neutral forum for review of any penalty. Therefore, the court concluded, the plaintiffs showed a likelihood of success on the merits because:
(1) the Ordinance lack a mechanism for pre-compliance review by a neutral of its monthly command that booking services produce their New York City user records; and
(2) even if this facial injunctive action were treated as pre-compliance review, the City has not justified its sweeping capture of constitutionally protected records.
(Id. at 41.)
Because the New York Constitution typically provides for broader coverage than the U.S. Constitution, the court did not reach the plaintiffs’ argument that the local law violated a similar provision under the New York Constitution. The court also decided not to rule on the First Amendment claim, but did address the Stored Communications Act claim.
Stored Communications Act claim
The Stored Communications Act is part of a federal law known as the Electronic Communications Privacy Act, 18 U.S.C. §§ 2702-13. The Stored Communications Act generally prohibits the disclosure of the contents of user communications or any records containing information about users by providers of remote computing services or electronic communications services. The focus of this case is on the records portion of the Stored Communications Act. The Act has an exception if the government “has the consent of the subscriber or customer to such disclosure” of the subscriber records. 18 USC 2703(c)(1)(C).
In this case, the plaintiffs claimed that the local law violated the Stored Communications Act by requiring the home-sharing platforms to share private consumer information with the government agency without adhering to the legal processes required by the Stored Communications Act. The court rejected this argument: “In light of the clear languages of these privacy policies, plaintiffs’ terms of service appear themselves to establish effective user consent to the possibility that information will be disclosed to governmental entities.” (Slip op. at 44 (citations omitted).)
The plaintiffs also claimed that the local violated the Stored Communications Act because the home-sharing platform, rather than the government, “has the consent of the subscriber or customer to such disclosure” of subscriber records. The court likewise rejected this argument:
When prospective hosts consent to privacy policies providing that their information may be disclosed to “law enforcement or government authorities,” Airbnb Privacy Policy § 3.5, or “in response to a request by law enforcement or governmental authority,” HomeAway Privacy Policy at 3, the governmental authority can be said to “have” the user’s consent to seek such information.
(Slip op. at 44-45 n.14.)
Preliminary injunction
Because the plaintiffs showed a likelihood of success on the Fourth Amendment claim, that showing met the requirement of irreparable harm. The court also found that the balance of equities ”strongly” tipped in favor of the plaintiffs. Therefore the court granted the preliminary injunction, halting application of the local law.
