In re Google Referrer Header Privacy Litigation

Background

This consumer class action concerns allegations that Google transmitted users’ search terms to third-party website owners without consent. The plaintiffs alleged that Google included search terms in the web address generated for each search result. When a user clicked a search result, the search terms allegedly appeared in the “referrer header,” a field identifying the webpage from which the user came, and were transmitted to the destination website owner.

The consolidated complaint asserted six claims: a claim under the Electronic Communications Privacy Act, breach of contract, breach of the duty of good faith and fair dealing, breach of contract implied in law, unjust enrichment, and declaratory and injunctive relief. The case had previously reached the Supreme Court in connection with a proposed class settlement. The Supreme Court sent the case back for consideration of whether the plaintiffs had standing—meaning a sufficient legally recognized injury to bring the claims—under later Supreme Court precedent.

On June 5, 2020, this court denied Google’s motion to dismiss after finding that the plaintiffs had sufficiently established standing for all six claims. The court concluded that the alleged disclosure of search terms implicated concrete privacy interests. Google then sought certification under 28 U.S.C. § 1292(b) for an interlocutory appeal, meaning an appeal before the district court enters a final judgment.

Legal standard

The court explained that certification under Section 1292(b) requires all three of the following: a controlling legal question, substantial grounds for disagreement about that question, and a determination that an immediate appeal may materially advance the end of the litigation. The court also emphasized that interlocutory appeals are allowed sparingly and only in exceptional cases, and that the party seeking certification bears a heavy burden.

Court’s reasoning

The court found that Google had not shown substantial grounds for disagreement about the controlling law. It stated that Supreme Court and Ninth Circuit precedent made clear that, when a statute protects a substantive right, violating that right can establish an injury without requiring additional harm. Applying that rule, the court had previously concluded that the Electronic Communications Privacy Act protects concrete privacy interests and that the alleged disclosure of the plaintiffs’ search terms pleaded real harm.

The court rejected Google’s argument that Ninth Circuit cases used materially conflicting one-step and two-step approaches to standing. It concluded that the cases ultimately asked whether the specific statutory violation caused harm or created a material risk of harm. The court also rejected Google’s argument that the Supreme Court’s decision in Thole v. U.S. Bank, N.A. undermined the earlier ruling, explaining that Thole involved different alleged injuries in an employee-benefit plan case and did not materially address the privacy injuries alleged here.

The court stated that Google’s arguments about the contract, quasi-contract, and injunctive-relief claims repeated arguments already rejected in the June 5 order. It also concluded that an immediate appeal would not materially advance the litigation. Even if the Ninth Circuit reversed the standing ruling, the court said that the plaintiffs would likely receive permission to amend their complaint, potentially leading to another round of motions to dismiss. The court noted that the plaintiffs’ theory that third parties might reidentify users from their search terms had not yet been evaluated and could potentially be supported by additional facts.

Disposition

Judge Edward J. Davila denied Google’s motion for certification of an interlocutory appeal. The court vacated the motion hearing scheduled for September 24, 2020, continued the status conference to October 8, 2020, and ordered the parties to propose a case schedule in an updated joint status report. The order did not decide whether Google’s conduct ultimately violated the Electronic Communications Privacy Act.