California Federal District Court Dismisses Privacy Class Action for Lack of Injury

Privacy/Cyber Risk & Data Security

On December 28, the U.S. District Court for the Northern District of California dismissed a putative class action alleging that Google Inc.’s privacy policy violates the federal Wiretap Act and state consumer protection statutes. In re Google, Inc. Privacy Policy Litig., No. 12-01382, 2012 WL 6738343 (N.D. Cal. Dec. 28, 2012). The plaintiffs allege that Google’s universal privacy policy, which applies across its various products and allows Google to aggregate, store, and cross-reference certain personal information collected across those products, violates consumer privacy rights by allowing the company to collect information from one product where the consumer has an expectation of privacy, and use that information to, for example, target advertising to the consumer in other products. The court held that no precedent exists in the Ninth Circuit or any other appellate court to allow claims to proceed based on only the alleged unauthorized disclosure of personal information, let alone such disclosure of information by the defendant to itself, as is the case here. The court also held that the plaintiffs failed to support their claims under the federal Wiretap Act that a provider can intercept information when such information already is in its possession, particularly given that the Act excludes the provider’s own equipment from the definition of device. The court found that the plaintiffs had failed to plead sufficient injury to establish standing, and dismissed the plaintiffs’ claims with leave to amend.