Skip to main content
Menu Icon
Close

InfoBytes Blog

Financial Services Law Insights and Observations

District court: Plaintiffs whose search terms were disclosed to third parties have standing under Spokeo

Courts Privacy/Cyber Risk & Data Security Spokeo

Courts

On June 5, the U.S. District Court for the Northern District of California issued an order denying a global search engine’s (defendant) motion to dismiss class action claims, ruling that the plaintiffs’ claims met the standing requirement under Spokeo, Inc. v. Robins. The court determined that the plaintiffs pled a concrete injury by claiming that the defendant violated the Electronic Stored Communications Act (ESCA) and their contractual privacy rights by disclosing their search terms to third party servers without their authorization. The court rejected the defendant’s arguments that (i) the “plaintiffs cannot show the search terms can or will be linked to a searcher’s identity,” and (ii) “anonymized search terms could ‘rarely if ever result in harm or certainly impending harm.’” According to the court, this argument assumes that harm must take the form of “‘individuals’ discovered identities’ being ‘exploit[ed]. . .to their detriment,” which is “[n]ot so.” The court stressed that the ESCA “protects users’ privacy rights against the mere disclosure of their communications,” and that “the statute makes such disclosure actionable regardless whether those communications reveal the user’s identity.” Among other things, the court also noted that Congress has “identified a concrete privacy interest in communications stored with electronic communication service providers—even if those communications cannot be linked to the user.” “Because plaintiffs ‘need not allege any additional harm beyond the one Congress has identified,’ their standing in no way depends on whether the search terms may be used to discover their identities,” the court wrote.