In re Google Referrer Header Privacy Litigation

Background

This class action concerns allegations that Google, LLC disclosed users’ search terms to third-party servers. The case had been settled in 2013, but the Supreme Court vacated the settlement and directed the district court to evaluate whether the plaintiffs had Article III standing—meaning a sufficient personal injury to invoke federal jurisdiction—under the Supreme Court’s decision in Spokeo, Inc. v. Robins. The Ninth Circuit then remanded the case to the district court.

The operative consolidated complaint asserted six claims: a claim under Title II of the Electronic Communications Privacy Act, also known as the Stored Communications Act; breach of contract; breach of the implied covenant of good faith and fair dealing; breach of a contract implied in law; unjust enrichment; and declaratory and injunctive relief. Google moved under Federal Rule of Civil Procedure 12(b)(1), which permits dismissal for lack of subject-matter jurisdiction, arguing that plaintiffs lacked standing because they had not shown an injury in fact. Google did not challenge causation or redressability.

Court’s Analysis

Electronic Communications Privacy Act claim. The court held that the Stored Communications Act provisions at issue protect a substantive privacy interest, not merely a procedural right. Drawing on post-Spokeo Ninth Circuit decisions, the court concluded that an unauthorized disclosure covered by 18 U.S.C. § 2702 causes a concrete injury to the protected privacy interest. Plaintiffs therefore did not need to allege additional harm beyond the alleged disclosure of their search terms.

The court rejected Google’s argument that the search terms had to be linked to the users’ identities to create an injury. Information can be private even when it is not personally identifying, and the statute makes the disclosure actionable regardless of whether the disclosure reveals the user’s identity. The court did not decide whether the possible future reidentification of anonymized search terms was itself an injury in fact, because that issue was unnecessary to its ruling. The court also stated that Google’s argument that plaintiffs were not persons “aggrieved” under the statute concerned the merits of the claim, not standing.

Contract claims. For the express-contract and implied-covenant claims, plaintiffs alleged that Google’s Terms of Service and related privacy policies promised not to disclose users’ personal information and web history except in specified circumstances. They alleged that Google breached those duties by transmitting search terms through referrer headers.

The court held that, under California law, the breach of a contractual duty is a legal injury even without actual damages. California law allows nominal damages for a proven breach without appreciable loss. The court found that plaintiffs had identified specific contractual duties and alleged how Google breached them. Whether the search terms qualified as personal information and whether Google’s conduct actually breached the agreement were merits questions, not standing questions. The court denied the motion as to Counts 2 and 3.

Quasi-contract claims. Counts 4 and 5 alleged breach of contract implied in law and unjust enrichment. Plaintiffs alleged that Google profited by sharing their search queries with advertisers without their consent and contrary to Google’s promises. The court found that California law allows recovery of profits from unjust enrichment even when an individual has not suffered a corresponding financial loss. Because plaintiffs plausibly alleged that Google profited from using their search terms and that plaintiffs retained an interest in those profits, the court found sufficient injury for standing and denied the motion as to Counts 4 and 5.

Injunctive relief. The complaint also sought an order stopping Google’s practice of transmitting search terms in referrer headers. The court noted that standing must be shown separately for each type of relief and that prospective injunctive relief generally requires a continuing effect or a sufficient likelihood of future harm. Google did not specifically argue that plaintiffs lacked standing to seek an injunction, and it did not suggest that it had stopped the challenged practices. The court therefore found no obstacle to plaintiffs’ standing to seek injunctive relief.

Disposition

The court found that plaintiffs had alleged an injury in fact for each claim and DENIED Google’s motion to dismiss the consolidated complaint for lack of standing. This was a jurisdictional ruling at the pleading stage, not a final decision on whether Google was liable for the alleged disclosures, contract breaches, or unjust enrichment.