Google Email-Scanning Settlement Rejected as ‘Unclear’ and ‘Inadequate’

Plaintiffs Daniel Matera and Susan Rashkis (“Plaintiffs”) sue Defendant Google Inc. (“Google” or “Defendant”) for violations of the California Invasion of Privacy Act (“CIPA”), Cal. Pen. Code § 630, et seq., and violations of the Electronic Communications Privacy Act (“Wiretap Act” or “ECPA”), 18 U.S.C. §§ 2510, et seq. Before the Court is Plaintiffs’ motion for preliminary approval of class action settlement. ECF No. 62 (“Mot.”). The Court held a hearing on this motion on March 9, 2017. Having considered Plaintiffs’ motion, the arguments of counsel at the March 9, 2017 hearing, and the record in this Case, the Court DENIES Plaintiffs’ motion for preliminary approval of class action settlement.

I. LEGAL STANDARD

Federal Rule of Civil Procedure 23(e) provides that “[t]he claims, issues, or defenses of a certified class may be settled . . . only with the court’s approval.” Fed. R. Civ. P. 23(e). “The purpose of Rule 23(e) is to protect the unnamed members of the class from unjust or unfair settlements affecting their rights.” In re Syncor ERISA Litig., 516 F.3d 1095, 1100 (9th Cir. 2008). Accordingly, in order to approve a class action settlement under Rule 23, a district court must conclude that the settlement is “fundamentally fair, adequate, and reasonable.” Hanlon v. Chrysler Corp., 150 F.3d 1011, 1026 (9th Cir. 1998).

II. DISCUSSION

Google intercepts, scans, and analyzes the content of emails sent by non-Gmail users for the purpose of creating user profiles of Gmail users to create targeted advertising for Gmail users.1 This fact is not disclosed in Google’s operative Privacy Policy or Terms of Service.2 In fact, neither document mentions non-Gmail users at all. Matera v. Google, Inc., 2016 WL 5339806, at *18 (N.D. Cal. Sept. 23, 2016) (noting Google’s operative Terms of Service and Privacy Policy “make[] no mention of non-Gmail users”). Moreover, the parties’ class action settlement for which they seek preliminary approval from the Court fails to require Google to disclose this information. See ECF No. 62-1 (“Settlement Agreement”). The settlement provides for only an injunction, a release of the class’s claims, and a request for $2.2 million in attorney’s fees. See id. at ¶¶ 34, 58.

In support of the settlement, Plaintiffs contend that the injunction will bring Google into compliance with the Wiretap Act and the CIPA. Mot. at 4. Further, Plaintiffs state that the settlement will provide a notice to the class that provides sufficient disclosures to the class of Google’s email scanning practices. See ECF No. 70 (“H’rg Tr.”), at 3. The notice to which Plaintiffs refer is notice that Plaintiffs are required to provide the class in order to obtain final approval of the class action settlement. See Fed. R. Civ. P. 23(e)(1) (“The court must direct notice in a reasonable manner to all class members who would be bound by the proposal”); ECF No. 62- 1 (“Notice”). This proposed class settlement notice states the following:

In the settlement, Google has agreed to insure that all incoming email to Gmail users and all outgoing email from Gmail users is processed in a manner that plaintiffs and Class Counsel agree does not violate CIPA or the Wiretap Act. Specifically, (1) for incoming email, Google will eliminate any processing of email content that it applies prior to the point when the Gmail user can retrieve the email in his or her mailbox using the Gmail interface (currently, this occurs when the email is stored in the “Tingle” server) that is used for the distinct purpose of advertising and creating advertising user models; (2) with regard to any information generated by other processing of email content that Google applies before the Gmail user can retrieve the email in his or her mailbox using the Gmail interface, Google will not use or access such information for the purpose of serving targeted advertisements or creating advertising user models until after the Gmail user can retrieve the email in his or her mailbox using the Gmail interface; (3) for outgoing email, Google will refrain from any processing of email content that it applies prior to the point when the Gmail user can retrieve the outgoing email in his or her mailbox using the Gmail interface (currently, this occurs when the email is stored in the “Tingle” sever) that is used for the distinct purpose of advertising and creating advertising user models; and (4) with regard to any information generated by other processing of email content that Google applies before the Gmail user can retrieve the outgoing email in his or her mailbox using the Gmail interface, Google will not use or access such information for the purpose of serving targeted advertisements or creating advertising user models until after the Gmail user can retrieve the email in his or her mailbox using the Gmail interface.

Notice, at 2.

This notice is difficult to understand and does not clearly disclose the fact that Google intercepts, scans, and analyzes the content of emails sent by non-Gmail users to Gmail users for the purpose of creating user profiles of the Gmail users to create targeted advertising for the Gmail users. Moreover, the notice does not clearly disclose what technical changes the settlement requires. At the preliminary approval hearing, the parties explained that the injunction would prohibit Google from scanning in transit email for the sole purpose of collecting advertising data, but would allow Google to scan incoming in transit email for the “dual purpose” of (1) detecting spam and malware and (2) obtaining information that would be “later used for advertising purposes.” H’rg Tr. at 26 (emphasis added). Specifically, once the email is in storage, the injunction allows Google to access the “metadata generated during the spam scanning process”— which was collected while the email was in transit—and use that metadata “for advertising purposes.” Id. at 27 (emphasis added). The “dual purpose” to which Plaintiff refers is not clearly disclosed in the notice to Class Members. See Notice, at 2.

Further, it is not clear that the “dual purpose” will bring Google into compliance with the Wiretap Act and CIPA. See Backhaut v. Apple, Inc., 74 F. Supp. 3d 1033, 1042 (N.D. Cal. Nov. 19, 2014) (noting that the “Wiretap Act protects communications in transit” and “generally prohibits the ‘interception’ of ‘wire, oral, or electronic communications’”); NovelPoster v. Javictch Canfield Grp., 140 F. Supp. 3d 938, 954 (N.D. Cal. 2014) (“The analysis for a violation of CIPA is the same as that under the federal Wiretap Act.”). Plaintiffs’ motion for preliminary approval provides no authority as to whether or why the injunction’s “dual purpose” interception, scanning, and analysis of in transit emails brings Google into compliance with the Wiretap Act or CIPA. See generally Mot.

Accordingly, the Court DENIES Plaintiffs’ motion for preliminary approval. The notice to Class Members, which is the only form of disclosure that Class Members will receive under the settlement, is inadequate. The notice does not clearly disclose that Google intercepts, scans, and analyzes the content of emails sent by non-Gmail users to Gmail users for the purpose of creating user profiles of the Gmail users to create targeted advertising for the Gmail user. It does not disclose that Google will scan the email of non-Gmail users while the emails are in transit for the “dual purpose” of creating user profiles and targeted advertising and for detecting spam and malware. Moreover, because Plaintiffs’ motion cites no case law and provides no argument as to whether the “dual purpose” scanning permitted under the settlement is lawful under the Wiretap Act and CIPA, it is not clear to the Court at this time that the technical changes that the settlement provides brings Google into compliance with the Wiretap Act and CIPA, as Plaintiffs assert.

Plaintiffs continue to argue that this settlement is no different than the settlement in In re Yahoo Mail Litigation, 2016 WL 4474612 (N.D. Cal. Aug. 25, 2016). However, every case andevery settlement are different. The Yahoo settlement took place after more than two years of litigation and a mere six days before the hearing on the parties’ fully briefed cross-motions for summary judgment. At the time of settlement, the Court had spent considerable time analyzing the parties’ summary judgment issues. Moreover, the parties and the Court had much more information to assess the risks of litigation and determine whether the class action settlement was fair and reasonable under the circumstances. Specifically, in Yahoo, the Court denied Yahoo’s motion to dismiss on August 12, 2014. In re Yahoo Mail Litig., 7 F. Supp. 3d 1016 (N.D. Cal. 2014). The parties completed fact discovery on May 1, 2015, and the Court certified an injunctive class and denied class certification of a damages class on May 26, 2015. In re Yahoo Mail Litig., 308 F.R.D. 577 (N.D. Cal. 2016). The parties completed expert discovery on August 28, 2015, and the parties briefed cross-motions for summary judgment from September 19, 2015 through November 16, 2015. See In re Yahoo Mail Litig., Case No. 13-CV-04980-LHK, ECF Nos. 131 & 135. Furthermore, as the Court found in its order on Yahoo’s motion to dismiss, Yahoo disclosed in its Privacy Policy even before the Yahoo lawsuit was filed that Yahoo scanned non-Yahoo users’ email to Yahoo users. See In re Yahoo Mail Litig., 7 F. Supp. 3d at 1022. Moreover, the settlement in Yahoo included additional important disclosures regarding scanning of incoming and outgoing emails and the sharing of information with third parties. See In re Yahoo Mail Litig., 2016 WL 4474612, at *4 (N.D. Cal. Aug. 25, 2016).

In the instant case, by contrast, the parties litigated only a motion to dismiss and a motion to stay before settlement. The parties have not taken any depositions in this case, and Google has only produced documents from prior litigation.3 Specifically, the discovery in this case has consisted of 11 interrogatories and Plaintiffs’ review of documents from the In re Google Inc. Gmail Litigation, Case No. 13-MD-02430-LHK. The lead case in Gmail, Dunbar v. Google, was filed on November 17, 2010. See Case No. 10-CV-194-LHK. Fact discovery was scheduled to conclude in Gmail on May 23, 2014, which was also the date that a majority of the individual plaintiffs in Gmail stipulated to dismissal because this Court denied class certification on March 18, 2014. See Case No. 13-MD-02430-LHK, ECF No. 176. Accordingly, discovery in Gmail was conducted between three and six years ago. Plaintiffs’ use of discovery produced between three to six years ago is particularly questionable in this case given that the instant settlement requires Google to maintain the injunction’s technical changes for only three years because “the architecture and technical requirements for providing email services on a large scale evolve and change dynamically.” Settlement Agreement ¶ 34.d.

Indeed, the discovery in Gmail illustrates how important depositions are in a case such as this. In Gmail, it was not until the July 15, 2011 deposition of Thompson Alexander Ivor Gawley, Google’s senior product manager for the Gmail system, that Plaintiff Dunbar learned for the first time that Google was scanning and extracting information from non-Gmail users in the same way that Google was scanning and extracting emails received by Gmail users. See Dunbar v. Google, 2012 WL 6202797, at *3 (N.D. Cal. Dec. 12, 2012).

In sum, based on the parties’ current filings, the Court cannot conclude that the settlement is “fundamentally fair, adequate, and reasonable.” Hanlon, 150 F.3d at 1026. Accordingly, for the foregoing reasons, Plaintiffs’ motion for preliminary approval of class action settlement is DENIED.

IT IS SO ORDERED.

1 Currently, the record is not entirely clear on whether and when Google intercepts, scans, or analyzes outgoing emails sent from Gmail users to non-Gmail users. See ECF No. 62-1 (“Settlement Agreement”), at ¶ 34.c (noting that “Google will refrain,” rather than “eliminate” any processing of outgoing email sent by Gmail users (emphasis added)).

2 The Court’s September 23, 2016 order granting in part and denying in part Defendant’s motion to dismiss based on lack of standing analyzed Google’s April 14, 2014 Terms of Service and December 19, 2014 Privacy Policy. At the March 9, 2017 hearing, the parties confirmed that those are the operative documents on this issue. H’rg Tr. at 3.

3 Class Counsel represents that their current lodestar is $1.25 million for this work. H’rg Tr. at 52.