Opinion ID: 3153537
Heading Depth: 2
Heading Rank: 1

Heading: Freestanding Privacy Claims

Text: We first consider, in tandem, the plaintiffs’ freestanding privacy claims under the California Constitution110 and California tort law. 109 Id. at 43-45. 110 Article I, Section 1 of the California Constitution states: “All people are by nature free and independent and have inalienable rights. Among these are enjoying and defending 50 “A privacy violation based on the common law tort of intrusion has two elements.”111 “First, the defendant must intentionally intrude into a place, conversation, or matter as to which the plaintiff has a reasonable expectation of privacy.”112 This means “the defendant must have ‘penetrated some zone of physical or sensory privacy . . . or obtained unwanted access to data’ by electronic or other covert means, in violation of the law or social norms.”113 Second, “the intrusion must occur in a manner highly offensive to a reasonable person.”114 “The right to privacy in the California Constitution sets standards similar to the common law tort of intrusion.”115 “First, [the plaintiff] must possess a legally protected privacy interest. . . . Second, the plaintiff’s expectations of privacy must be reasonable. . . . Third, the plaintiff must show that the life and liberty, acquiring, possessing, and protecting property, and pursuing and obtaining safety, happiness, and privacy.” 111 Hernandez v. Hillsides, Inc., 211 P.3d 1063, 1072 (Cal. 2009). 112 Id. 113 Id. (quoting Shulman v. Group W Prods., Inc., 955 P.2d 469, 490 (Cal. 1998)). 114 Id. 115 Id. at 1073. 51 intrusion is so serious ‘in nature, scope, and actual or potential impact as to constitute an egregious breach of the social norms.’”116 When presented with parallel privacy claims under tort law and the California Constitution, the California Supreme Court has performed a dual inquiry “under the rubric of both . . . tests.”117 This “consider[s] (1) the nature of any intrusion upon reasonable expectations of privacy, and (2) the offensiveness or seriousness of the intrusion, including any justification and other relevant interests.”118 In evaluating the offensiveness of an invasion, the court is to consider “pragmatic policy concerns” such that “no cause of action will lie for accidental, misguided, or excusable acts of overstepping upon legitimate privacy rights.”119 In dismissing the freestanding privacy claims, the District Court concluded that Google’s alleged practices “did not rise to the level of a serious invasion of privacy or an egregious breach of social norms.”120 Contending the District 116 Id. (quoting Hill v. Nat’l Collegiate Athletic Assn., 865 P.2d 633, 655 (Cal. 1994)). 117 Id. at 1073-74. 118 Id. at 1074. 119 Id. at 1079; Hill, 865 P.2d at 675 (“Whether [a] plaintiff has a reasonable expectation of privacy in the circumstances and whether [a] defendant’s conduct constitutes a serious invasion of privacy are mixed questions of law and fact.”). 120 In re Google, 988 F. Supp. 2d at 449. 52 Court got it right, Google says the plaintiffs voluntarily sent Google all the internet usage information at issue.121 Moreover, Google argues, tracking cookies are routine.122 Pointing to cases describing cookies as, more or less, innocuous,123 Google offers that courts “routinely” find no actionable privacy invasion in cases involving tracking, collation, and disclosure of internet usage information.124 Google gives particular attention to Low v. LinkedIn, where the Northern District of California explained that “[e]ven disclosure of personal information, including social security numbers, does not constitute an ‘egregious breach of the social norms’ to establish an invasion of privacy claim.”125 For purposes of California privacy law, Google’s emphasis on tracking and disclosure amounts to a smokescreen. What is notable about this case is how Google accomplished its tracking. Allegedly, this was by overriding the plaintiffs’ cookie blockers, while concurrently announcing in its Privacy Policy that internet users could 121 Google Br. at 59 (emphasis in original). 122 Id. 123 Id. at 61 (citing, e.g., Pharmatrak, 329 F.3d at 14 (“Cookies are widely used on the internet by reputable websites to promote convenience and customization.”)). 124 Id. at 62 (citing Stern v. Weinstein, 512 Fed. App’x 701, 702 (9th Cir. 2013)). 125 Low v. LinkedIn Corp., 900 F. Supp. 2d 1010, 1025 (N.D. Cal. 2012). 53 “reset your browser to refuse all cookies.”126 Google further assured Safari users specifically that their cookie blockers meant that using Google’s in-house prophylactic would be extraneous. Characterized by deceit and disregard, the alleged conduct raises different issues than tracking or disclosure alone.127 Directly pertinent to whether Google’s alleged practices implicated a protected privacy interest, California tort law treats as actionable an “unwanted access to data by electronic or other covert means, in violation of the law or social norms.”128 Moreover, the California Constitution protects an interest in “conducting personal activities without observation,” with the reasonableness of any given expectation “rest[ing] on an examination of customs . . . as well as the opportunity to be notified in advance and consent to the intrusion.”129 To Google’s point, a sophisticated 126 Compl. ¶ 80. 127 See Kristen Lovin, SafariGate: Benign Behavior or Malignant Breach?, Colum. Sci. & Tech. L. Rev. (Feb. 22, 2012), http://stlr.org/2012/02/22/safarigate-benign-behavioror-malignant-breach/ (“[O]ne could say that Google ignored the express desires of its users, elevating its own commercial interests over the user’s personal privacy interests. This kind of disregard may be particularly troubling given the relative bargaining power that an individual consumer has against a monolith like Google.”). 128 Hernandez, 211 P.3d at 1072 (internal quotation marks omitted). 129 Id. at 1073 (internal quotation marks omitted). 54 internet user may well have known that, in browsing the internet, her URL information was sent to Google. But such a user would also reasonably expect that her activated cookie blocker meant her URL queries would not be associated with each other due to cookies.130 As the activated cookie blocker equates, in our view, to an express, clearly communicated denial of consent for installation of cookies, we find Google “intru[ded] upon reasonable expectations of privacy.”131 As for whether the alleged conduct is “so serious in nature[] [and] scope . . . as to constitute an egregious breach of the social norms,”132 Google not only contravened the cookie blockers—it held itself out as respecting the cookie blockers. Whether or not data-based targeting is the internet’s pole star, users are entitled to deny consent, and they are entitled to rely on the public promises of the companies they deal with. Furthermore, Google’s alleged conduct was broad, touching untold millions of internet users; it was surreptitious, surfacing only because of the independent 130 It is no matter whether or not a given plaintiff had actual, subjective knowledge of her browser settings and the impact of those settings on the defendants’ tracking practices. Like a principal’s agent, a personal computing device acts as an extension of oneself for purposes of engaging with the internet. The decision to use one or another technology is the decision to choose its features, even if the lay user may not actually know what all those features are in their specifics. 131 Hernandez, 211 P.3d at 1074. 132 Id. at 1073 (internal quotation marks omitted). 55 research of Mayer and the Wall Street Journal; and it was of indefinite duration, with Google’s counsel conceding at argument that their tracking cookies have no natural lifespan. Particularly as concerns Google’s public statements regarding the Safari cookie blocker, we see no justification. Neither, apparently, do the elected branches, as California and federal executive agencies have themselves sought to penalize Google for the events alleged in the complaint.133 Based on the pled facts, a reasonable factfinder could indeed deem Google’s conduct “highly offensive” or “an egregious breach of social norms.”134 A reasonable jury could conclude that Google’s alleged practices constitute the serious invasion of privacy contemplated by California law. We will vacate the dismissal of the plaintiffs’ claims under the California Constitution and California tort law.