Opinion
Case No. C11-366-RSL
11-30-2011
NICOLE DEL VECCHIO, et al., Plaintiffs, v. AMAZON.COM INC., Defendant.
ORDER GRANTING DEFENDANT'S
MOTION TO DISMISS
This matter comes before the Court on Defendant's "Motion to Dismiss [Plaintiffs'] Consolidated Amended Supplemental Complaint" ("CASC"). Dkt. # 49. Defendant contends that Plaintiffs' complaint (Dkt. # 45) fails to allege any plausible harm to Plaintiffs and that Plaintiffs' consent to Defendant's actions negates each of their claims. For the reasons set forth below, the Court GRANTS Defendant's motion without prejudice. Plaintiffs may file an amended complaint that addresses the concerns set forth below within 30 days of the date of this order.
Because the matter can be decided based on the parties' memoranda, the complaint, and the balance of the record, Defendants' request for oral argument is DENIED.
I. BACKGROUND
This is a case of cookies. Not the kind made with sugar and flour, but those alphanumeric identifiers that are transferred from a web site to a visitor's hard drive through the visitor's web browser. Royalty Declaration (Dkt. # 50-2) at 1; accord Bose v. Interclick, Inc., No. 10-cv-9183, 2011 WL 4343517, at *1 (S.D.N.Y. Aug. 17, 2011) (discussing cookies). Web sites use these internet cookies to "gather information about a computer user's internet habits" and "associate 'browsing history information' with particular computers." Bose, 2011 WL 4343517, at *1. Typically, the transfer of cookies is automatic. Web site visitors who do not desire cookies and their consequences must either delete them as they are received or use software to block their acceptance. E.g., id.
As Plaintiffs allege, however, ridding themselves of Defendant's cookies was not so easy. They first complain that Defendant placed standard browser cookies on Plaintiffs' computers against their wishes by "exploiting" a known frailty in the cookie-filtering function of Microsoft's Internet Explorer browser software. CASC (Dkt. # 45) at ¶¶ 2-3 (describing browser cookies); id. at ¶¶ 29-50. Specifically, they allege that Defendant intentionally published a "gibberish" web site Compact Policy that fooled their browser into accepting Defendant's cookies despite their filter settings. Id. at ¶¶ 29-50.
According to Plaintiffs, a Compact Policy permits a visitor's browser to automatically determine a web site's privacy settings and adjust its security settings, including its level of cookie-filtering protection, accordingly. CASC (Dkt. # 45) at ¶¶ 29-37.
Second, Plaintiffs contend that Defendant retooled Adobe Flash Local Stored Objects ("Flash cookies") to behave as traditional browser cookies knowing that Plaintiffs' browser software would not recognize them as "cookies" and thus not preclude them from being placed on Plaintiffs' computers. Id. at ¶¶ 51-74. And finally, Plaintiffs assert that Defendant both used the information it gathered for its own benefit and also shared that information with third parties despite the terms of its Privacy Notice. Id. at ¶¶ 75-79.
As a result of these alleged wrongs, Plaintiffs' allege two categories of injury: "(i) misappropriation of Plaintiffs' and Class Members confidential personal information and [personally identifiable information] in which they have economic and property interests and (ii) damage to and consumption of their Computer Assets." Opposition (Dkt. # 52) at 16 (summarizing the alleged harms). Plaintiffs contend that these injuries led to "economic harms," including "lack of proper value-for-value exchanges, undisclosed opportunity costs, devaluation of personal information, [and] loss of the economic value of the information as an asset." Id. at 15. They also contend that the alleged damage to and consumption of the computer resources, i.e., that the transfer of cookies required computer resources, diminished the performance and value of their computer resources. Id.
In light of these allegations, Plaintiffs seek relief on behalf of themselves and a proposed class under the Computer Fraud and Abuse Act ("CFAA"), 18 U.S.C. § 1030, and Washington's Consumer Protection Act ("CPA"). They also assert claims for common law trespass to chattels and unjust enrichment.
II. DISCUSSION
Defendant raises two broad arguments as for why Plaintiffs' complaint (Dkt. # 45) should be dismissed. First, it contends that Plaintiffs have failed to allege any injury-in-fact, and thus lack Article III standing. Fed. R. Civ. Pro. 12(b)(1). Second, it argues that Plaintiffs have failed to allege sufficient facts to support any of their four claimed bases for relief. Fed. R. Civ. Pro. 12(b)(6). The Court addresses the effect of Defendant's arguments on a claim-by-claim basis.
A. Governing Principles
1. Article III Standing
"[T]o satisfy Article III's standing requirements, a plaintiff must show (1) it has suffered an "injury in fact" that is (a) concrete and particularized and (b) actual or imminent, not conjectural or hypothetical; (2) the injury is fairly traceable to the challenged action of the defendant; and (3) it is likely, as opposed to merely speculative, that the injury will be redressed by a favorable decision." Friends of the Earth, Inc. v. Laidlaw Envtl. Servs (TOC), Inc., 528 U.S. 167, 180-81 (2000).
2. 12(b)(6) Dismissal Standard
"To survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to 'state a claim to relief that is plausible on its face.'" Ashcroft v. Iqbal, 129 S. Ct. 1937, 1949 (2009) (quoting Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 570 (2007). This standard "asks for more than a sheer possibility that a defendant has acted unlawfully." Id. If "a complaint pleads facts that are 'merely consistent with' a defendant's liability, it 'stops short of the line between possibility and plausibility of "entitlement to relief."'" Id. (quoting Twombly, 550 U.S. at 557).
"We accept as true all well-pleaded allegations of material fact, and construe them in the light most favorable to the non-moving party." Daniels-Hall, 629 F.3d at 998. "We are not, however, required to accept as true allegations that contradict exhibits attached to the Complaint or matters properly subject to judicial notice . . . ." Id.
Accordingly, "[a] pleading that offers 'labels and conclusions' or 'a formulaic recitation of the elements of a cause of action will not do.' Nor does a complaint suffice if it tenders 'naked assertion[s]' devoid of 'further factual enhancement.'" Id. (quoting Twombly, 550 U.S. at 555, 557). Rather, a plaintiff must plead sufficient "factual content [to] allow[] the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Id.
B. Plaintiffs' Claims
1. Computer Fraud and Abuse Act
The CFAA is predominately a criminal statute. It provides, in pertinent part, that "[w]hoever knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value . . . shall be punished." 18 U.S.C. § 1030(a)(4); see also § 1030(a)(2)(C), (a)(5)(A)-(C). The statute also provides a civil remedy, however. "Any person who suffers damage or loss by reason of a violation of [§ 1030] may maintain a civil action against the violator to obtain compensatory damages and injunctive relief or other equitable relief" provided "the conduct involves 1 of the factors set forth in clause (I), (II), (III), (IV), or (V) of subsection (c)(4)(A)(i)." 18 U.S.C. § 1030(g).
Defendant asserts, and Plaintiffs do not dispute, that only one of the enumerated clauses is implicated in this case: "loss to 1 or more persons during any 1-year period . . . aggregating at least $5,000 in value." 18 U.S.C. § 1030(c)(4)(A)(i)(I); see generally § 1030(g) ("Damages for a violation involving only conduct described in subsection (c)(4)(A)(i)(I) are limited to economic damages."). Moreover, Plaintiff does not dispute that each of Plaintiffs' claimed bases for relief requires that Defendant caused such losses by accessing Plaintiffs' computers "without authorization" or in a manner that "exceed[ed] authorized access." Cf. § 1030(a)(2)(C), (a)(4), (a)(5)(A)-(C).
Accordingly, only two questions are presently at issue. First, whether Plaintiffs have set forth sufficient "factual content" to allow the Court to reasonably infer that Plaintiffs suffered a loss of at least $5,000. See LVRC Holdings LLC v. Brekka, 581 F.3d 1127, 1132 (9th Cir. 2009). And, second, whether Plaintiffs have alleged facts that, taken as true, demonstrate that Defendant caused that harm by accessing Plaintiffs' computers without authorization. See id.
i. Loss of $5,000
"Loss" is defined at § 1030(e)(11) as "any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service."
Defendant contends that Plaintiffs failed to allege sufficient facts that, taken as true, would demonstrate satisfaction of the necessary threshold figure. Plaintiffs disagree. They reiterate the allegations set forth in their complaint: that Defendant's actions "raise[d] the cost of admission to Amazon's website," "charge[d] an undisclosed toll for the use of its website," "imposed opportunity costs on Plaintiffs," and "constituted a taking and use of their computer assets without compensation." Opposition (Dkt. # 52) at 22-23. They also contend, sans support, that they need not allege quantifiable losses at the pleading stage.
The Court agrees with Defendant. Even assuming that any of Plaintiffs' alleged costs could qualify as CFAA losses, Plaintiffs have not alleged any facts that would allow the Court to reasonably infer that those losses plausibly occurred in this case, let alone that they totaled $5,000. For example, Plaintiffs' first broad assertion—that Defendant's actions allowed it to "acquire more user information than it [wa]s entitled to acquire" and thus "deprived [Plaintiffs] of the opportunity to exchange their valuable information"—is entirely speculative. While it may be theoretically possible that Plaintiffs' information could lose value as a result of its collection and use by Defendant, Plaintiffs do not plead any facts from which the Court can reasonably infer that such devaluation occurred in this case. Iqbal, 129 S. Ct. at 1949; cf La Court v. Specific Media, Inc., No. SACV 10-1256-GW, 2011 WL 2473399, at *4 (C.D. Cal. April 28, 2011) ("While the Court would recognize the viability in the abstract of such concepts as 'opportunity costs,' 'value-for-value exchanges,' 'consumer choice,' and other concepts referred to in the Opposition, what Plaintiffs really need to do is to give some particularized example of their application in this case.").
The parties dispute whether the asserted loss in value of Plaintiffs' "personally identifiable information" could constitute a CFAA losses. They also disagree whether the $5,000 loss amount can be reached by aggregating the "losses" of multiple Plaintiffs.
The same is true of Plaintiffs' second category of alleged loss—their assertion that Defendant's transfer of cookies to Plaintiffs' computers diminished the performance of Plaintiffs' computers and constituted an interruption in service. Again, even assuming that Plaintiffs state a possible claim, their naked assertions fall far short of stating a plausible one. As Defendant asserts, not one of the Plaintiffs alleges that he or she discerned any difference whatsoever in the performance of his or her computer while visiting Defendant's site, let alone any diminution from which the Court could plausibly infer the necessary damages. AtPac, Inc. v. Aptitude Solutions, Inc., 730 F. Supp. 2d 1174, 1185 (E.D. Cal. 2010) (granting defendant's motion to dismiss because plaintiff did "not allege any facts that indicate that it incurred costs to update its server security protocols or otherwise analyze the circumstances of the unauthorized server access"); see Bose, 2011 WL 4343517, at *4.
Chance v. Ave. A, Inc., 165 F. Supp. 2d 1153, 1159 (W.D. Wash. 2001) (Coughenour, J.) ("Unlike a computer hacker's illegal destruction of computer files or transmission of a widespread virus which might cause substantial damage to many computers as the result of a single act, here the transmission of an internet cookie is virtually without economic harm." (emphasis added)), abrogated on other grounds by Creative Computing v. Getloaded.com LLC, 386 F.3d 930, 934-35 (9th Cir. 2004) (holding that "the $5,000 [CFAA] floor applies to how much damage or loss there is to the victim over a one-year period, not from a particular intrusion").
In sum, the Court finds that Plaintiffs have failed to allege facts necessary to satisfy the threshold loss amount necessary to maintain a civil CFAA claim.
ii. Authorization
Plaintiffs' failure to plead plausible losses is dispositive and requires dismissal. Nevertheless, as the Court intends to grant Plaintiffs leave to amend, the Court would note some concerns with Plaintiffs' assertion that Defendant acted without authorization or exceeded its authorization. See generally Brekka, 581 F.3d 1132-35 (discussing CFAA "authorization").
As Defendant argues, its "Conditions of Use and Privacy Notice" appear to notify visitors that it will take the very actions about which Plaintiffs now complain: place browser and Flash cookies on their computers and use those cookies to monitor and collect information about their navigation and shopping habits. Motion (Dkt. # 49) at 25 (citing Royalty Declaration (Dkt. # 50) (Exhibit A: Conditions of Use; Exhibit B: Privacy Notice)). They inform visitors that their use of Defendant's web site is conditioned on their acceptance of its terms and that visitors who do not desire cookies should consult with their browser's manufacturer. Dkt. # 50-2 at 1-2. And, perhaps most importantly, they inform visitors that failure to accept cookies will effectively preclude their use of Defendant's site. Id. The fact that Plaintiffs concede that they did not read Defendant's terms does not preclude their application. See Minnick v. Clearwire, US, LLC, 683 F. Supp. 2d 1179, 1188 (W.D. Wash. 2010). Accordingly, Plaintiffs' use of Defendant's site to make purchases would appear to serve both as an acknowledgment that cookies were being received and an implied acceptance of that fact.
When evaluating a motion to dismiss, a court may consider documents on which a "complaint 'necessarily relies' if: (1) the complaint refers to the document; (2) the document is central to the plaintiff's claim; and (3) no party questions the authenticity of the copy attached to the 12(b)(6) motion." Daniels-Hall v. Nat'l Educ. Ass'n, 629 F.3d 992, 998 (9th Cir. 2010) (citations and internal quotation marks omitted). In this case, Plaintiffs refer to Defendant's terms in paragraphs 22, 75, and 85-97 of their Amended Complaint (Dkt. # 45), and the terms are clearly central to Plaintiffs' claim. Moreover, Plaintiffs raised no objection to the copy of the terms attached to Defendant's motion. Accordingly, the Court will treat those terms and conditions "as 'part of the complaint, and . . . assume that its contents are true for purposes of [the] motion to dismiss.'" Id. (same).
For example, the Privacy Notice provides in part:
Dkt. # 50-2 at 1 (some emphasis added).
Last updated: October 1, 2008. To see what has changed, click here. Amazon.com knows that you care how information about you is used and shared, and we appreciate your trust that we will do so carefully and sensibly. This notice describes our privacy policy. By visiting Amazon.com, you are accepting the practices described in this Privacy Notice. * * *
The information we learn from customers helps us personalize and continually improve your shopping experience at Amazon.com. Here are the types of information we gather.
• Information You Give Us: We receive and store any information you enter on our Web site or give us in any other way. Click here to see examples of what we collect. You can choose not to provide certain information, but then you might not be able to take advantage of many of our features. We use the information that you provide for such purposes as responding to your requests, customizing future shopping for you, improving our stores, and communicating with you.
• Automatic Information: We receive and store certain types of information whenever you interact with us. For example, like many Web sites, we use "cookies," and we obtain certain types of information when your Web browser accesses Amazon.com or advertisements and other content served by or on behalf of Amazon.com on other Web sites. Click here to see examples of the information we receive.
Under the heading "What About Cookies?," the Notice goes on to explain:
• Cookies are alphanumeric identifiers that we transfer to your computer's hard drive through your Web browser to enable our systems to recognize your browser and to provide features such as 1-Click purchasing, Recommended for You, personalized advertisements on other Web sites (e.g., Amazon Associates with content served by Amazon.com and Web sites using Checkout by Amazon payment service), and storage of items in your Shopping Cart between visits."
• The Help portion of the toolbar on most browsers will tell you how to prevent your browser from accepting new cookies, how to have the browser notify you when you receive a new cookie, or how to disable cookies altogether. Additionally, you can disable or delete similar data used by browser add-ons, such as Flash cookies, by changing the add-on's settings or visiting the Web site of its manufacturer. However, because cookies allow you to take advantage of some of Amazon.com's essential features, we recommend that you leave them turned on. For instance, if you block or otherwise reject our cookies, you will not be able to add items to your Shopping Cart, proceed to Checkout, or use any Amazon.com products and services that require you to Sign in.
Moreover, Plaintiffs' attempt to avoid Defendant's terms by arguing that they were injured before they were able to view and therefore consent to them—i.e., that their injury occurred as soon as they navigated to Defendant's site and cookies were transferred to their computer, see Opposition (Dkt. # 52) at 28—appears flawed. To plead a CFAA claim, Plaintiffs need to allege facts demonstrating losses of at least $5,000 from this initial contact. § 1030(c)(4)(A)(i)(I). And the personally identifying information about which Plaintiffs complain was generated only as a result of Plaintiffs' use of Defendant's site. Thus, even if Plaintiffs provide facts from which a plausible information-related "loss" could be inferred, the Court would be presented with a serious question as to whether that loss would be "fairly traceable" to Plaintiffs' initial contact alone. See Laidlaw, 528 U.S. at 180.
2. Washington's Consumer Protection Act
To state a claim under Washington's CPA, chapter 19.86 RCW, Plaintiffs must allege "(1) an unfair or deceptive act or practice, (2) that occurs in trade or commerce, (3) a public interest, (4) injury to the plaintiff in his or her business or property, and (5) a causal link between the unfair or deceptive act and the injury suffered." Indoor Billboard/Wash., Inc. v. Integra Telecom of Wash., Inc., 162 Wn.2d 59, 73 (2007). Defendant asserts that Plaintiffs' claim should be dismissed for two reasons: failure to adequately allege "(1) an unfair or deceptive act or practice" and "(4) injury to the plaintiff in his or her business or property."
i. Injury to Business or Property
The CPA requires "a specific showing of injury." Hangman Ridge Training Stables, Inc. v. Safeco Title Ins. Co., 105 Wn.2d 778, 792 (1986)). "While [t]he injury involved need not be great, or even quantifiable, it must be an injury to 'business or property.'" Ambach v. French, 167 Wn.2d 167, 171-72 (2009) (alteration in original) (internal quotation marks and citations omitted).
As discussed, Plaintiffs have failed to allege any non-speculative cookie-related injury . In addition, the Court agrees with Defendant that the facts alleged by Plaintiff in support of its claim that Defendant shared their information with third parties "stop[] short of the line between possibility and plausibility of entitlement to relief." Compare CASC (Dkt. # 45) at ¶¶ 75-79 ("[I]in or about 2008, Plaintiff Ariana Del Vecchio decided to begin purchasing pet supplies and other pet-related products through Amazon.com. . . . Shortly after she purchased these products on Amazon.com, she began to receive numerous advertisements and promotional materials in the postal mail, all from pet products companies with whom she had not previously done business."), with Iqbal, 129 S. Ct. at 1949. Even construed in a light most favorable to Plaintiffs, the allegation that one Plaintiff began to receive unsolicited mail from pet product companies after purchasing pet products "through" Defendant's site "pleads facts that are 'merely consistent with'" Defendant's liability. Compare CASC (Dkt. # 45) at ¶ 77, with Iqbal, 129 S. Ct. at 1949. More is required.
Notably, Plaintiffs allege that Arianna Del Vecchio purchased products "through" rather than "from" Defendant. This word choice is important because Defendant's terms note that "when a third party is involved in [the] transactions, . . . we share customer information related to those transactions with that third party." Dkt. # 50-2 at 2. The terms also note that "the information practices" of some parties with whom visitors interact through Defendant's site "are not covered by this Privacy Notice" and that those third parties may seek to obtain visitors' personally identifying information. Id. at 3.
Because Plaintiffs have failed to plead a necessary element of a claim for relief under the CPA, their claim must be dismissed.
ii. Unfair or Deceptive Act or Practice
As was the case with Plaintiffs' CFAA claim, the failure to allege plausible injury is dispositive. Again, however, the Court thinks it worthwhile to note that it has substantial questions regarding Plaintiffs' claim that Defendants actions were unfair or deceptive. As noted, Plaintiffs' attempt to cabin its argument in a manner that avoids Defendant's termsraises questions of causation that Plaintiffs do not address.
"Where there is no factual dispute as to what each party did, 'whether the conduct constitutes an unfair or deceptive act can be decided . . . as a question of law." Indoor Billboard, 162 Wn.2d at 73; accord Panag v. Farmers Ins. Co. of Wash., 166 Wn.2d 27, 27 2009) ("Whether a particular act or practice is 'unfair or deceptive' is a question of law.").
Plaintiffs concede that they "do not assert false advertising claims and do not allege that misstatements [or] omissions in Amazon's Privacy Notice and Terms of Use caused them injury." Opposition (Dkt. # 52) at 28. "Instead, Plaintiffs allege that Amazon's deceptive conduct occurred before plaintiffs could ever read Amazon's Privacy Notice and its Terms of Use." Id. at 28-29 (emphasis in original).
--------
3. Trespass to Chattels
Trespass to chattels "is the intentional interference with a party's personal property without justification that deprives the owner of possession or use." Sexton v. Brown, 147 Wn. App. 1005, 2008 WL 4616705, at *5 (2008) (unpublished opinion) (citing Restatement (Second) of Torts § 217 (1965)). It "may be committed by intentionally (a) dispossessing another of the chattel, or (b) using or intermeddling with a chattel in the possession of another." Restatement (Second) of Torts § 217.
Notably, however, "[t]he interest of a possessor of a chattel in its inviolability, unlike the similar interest of a possessor of land, is not given legal protection by an action for nominal damages for harmless intermeddlings with the chattel." Id. at § 218, cmt. e. "Therefore, one who intentionally intermeddles with another's chattel is subject to liability only if his intermeddling is harmful to the possessor's materially valuable interest in the physical condition, quality, or value of the chattel, or if the possessor is deprived of the use of the chattel for a substantial time, or some other legally protected interest of the possessor is affected . . . ." Id.
As previously discussed, Plaintiffs have failed to plead any facts that would permit the Court to infer that they sustained any plausible harm to a materially valuable interest in the condition, quality, or value of their computers. Thus, even were the court to assume that Defendant interfered with Plaintiffs' personal property without justification, there is no basis from which the Court could conclude that Defendant's interference caused any plausible harm to that property. Cf Specific Media, 2011 WL 2473399, at *7 (C.D. Cal. 2011) ("Here, Plaintiffs have not alleged that the functioning of their computers was impaired (except in the trivial sene of being unable to permanently delete cookies) or would be imminently impaired to the degree that would enable them to plead the elements of the tort.").
4. Unjust Enrichment
"To establish unjust enrichment, the claimant must meet three elements: (1) one party must have conferred a benefit to the other; (2) the party receiving the benefit must have knowledge of that benefit; and (3) the party receiving the benefit must accept or retain the benefit under circumstances that make it inequitable for the receiving party to retain the benefit without paying its value." Cox v. O'Brien, 150 Wn. App. 24, 37 (2009). Defendant contends that Plaintiffs have failed to allege that they conferred any legally cognizable benefit upon Defendant and, at the very least, the circumstances under which any benefit was conferred would not render it inequitable for it to retain that benefit. On the facts plead, the Court agrees.
The crux of an unjust enrichment claim is "that a person who is unjustly enriched at the expense of another is liable in restitution to the other." Dragt v. Dragt/DeTray, LLC, 139 Wn. App. 560, 576 (2007). For the reasons previously expressed, Plaintiffs have not plead any facts from which the Court might infer that Defendant's decision to record, collect, and use its account of Plaintiffs' interactions with Defendant came at Plaintiffs' expense. Cf In re DoubleClick Inc. Privacy Litig., 154 F. Supp. 2d 497, 525 (S.D.N.Y. 2001) ("[A]lthough demographic information is valued highly . . . the value of its collection has never been considered a economic loss to the subject. Demographic information is constantly collected on all consumers by marketers, mail-order catalogues and retailers. However, we are unaware of any court that has held the value of this collected information constitutes damage to consumers or unjust enrichment to collectors." (footnote omitted)). Nor have Plaintiffs plead facts from which it could be inferred that there would be anything inequitable about Defendant's use of that information. See id.
III. CONCLUSION
For all of the foregoing reasons, the Court GRANTS Defendant's motion to dismiss. Plaintiffs have simply not plead adequate facts to establish any plausible harm. The Court recognizes that Plaintiffs have already been afforded an opportunity to amend their complaint in order to address deficiencies identified by Defendant in a motion to dismiss. See Plaintiffs' Motion for Leave to File a Consolidated Amended Complaint (Dkt. # 40) at 2. Nevertheless, the Court GRANTS Plaintiffs one more opportunity to cure the identified deficiencies. Plaintiffs may file an amended complaint no later than 30 days of the date of this order.
Robert S. Lasnik
United States District Judge
Id. at 1-2 (emphasis added).