Judge Clears Path for Privacy Suits Over Gmail
A federal judge has rejected Google's main lines of defense to accusations the company illegally mined personal data from Gmail messages without users' consent.
In an order issued Thursday, U.S. District Judge Lucy Koh in San Jose allowed plaintiffs to move forward with claims that Google's practice of automatically scanning emails to target advertisements violates the federal Electronic Communications Privacy Act and a handful of state privacy laws.
"The statutory scheme suggests that Congress did not intend to allow electronic communication service providers unlimited leeway to engage in any interception that would benefit their business models, as Google contends," Koh wrote in a 43-page order.
Moreover, Koh held Google's email scanning may have violated its own privacy policies. The decision is among the first to conclude that California's Invasion of Privacy Act, passed in 1967, applies to email.
The decision marks the second time in recent weeks that Google has been tripped up by wiretap laws and could ring alarm bells for other email providers which scan message content to sell targeted advertising. Earlier this month, the U.S. Court of Appeals for the Ninth Circuit ruled that the company can be sued for scooping up private Wi-Fi transmissions during its Street View mapping project.
During a hearing on Google's motion to dismiss earlier this month, the company's lawyers at Cooley contended that automatic processing — which enables basic features such as sorting messages or searching inboxes — has become an inescapable part of the email business. The practice is so prevalent, the lawyers argued in briefs, that even non-Gmail users should have realized their messages were likely to be scanned when sent to Gmail accounts.
For Koh, the critical question for both Gmail and non-Gmail users was whether they had adequate notice their communications might be intercepted — and for what purpose. For instance, users might agree to some forms of email processing without giving their email providers free rein. "Consent is not an all-or-nothing proposition," she wrote.
Cooley partner Whitty Somvichian, who is representing Google in the Gmail litigation along with partner Michael Rhodes, deferred to the company for comment.
"We're disappointed in this decision and are considering our options," a Google spokesman said in a statement.
The multidistrict litigation over Google's email scanning landed in the Northern District in April, when seven privacy suits were clustered as In re Google Inc. Gmail Litigation, 13-2430. In its bid to dismiss the litigation, Google argued that scanning messages to help sell ads falls under its "ordinary course of business," for which communications service providers are exempt under federal and state wiretap laws.
Plaintiffs lawyer Sean Rommel of Texas-based Wyly Rommel insisted at the hearing earlier this month that the company's "ordinary course of business" as an email provider must be defined narrowly. Koh agreed, finding that the scanning would only be exempt if it helped the company transmit emails.
"There is no dispute that Google's interception of plaintiffs' emails … advanced Google's business interests," Koh wrote. "But this does not end the inquiry."
She added: "The presence of the modifier 'ordinary' must mean that not everything Google does in the course of its business would fall within the exception."
The plaintiffs accuse Google of perpetrating a scheme that reaches far beyond email transmission. They allege in a response brief that Google uses Gmail as "its own secret data mining machine," constructing secret profiles for its legion of users.
Koh rejected Google's claim that users allowed their messages to be scanned when they accepted the company's terms of service. Although Google reserved the right to screen content, the company suggested that its aim was to block explicit sexual material — not to target advertisements or create user profiles, Koh noted.
"Because the two processes were allegedly separate, consent to one does not equate to consent to the other," she wrote.
The terms of service might alert users that Google is capable of intercepting messages. However, the wording does not suggest that the company actually engages in the practice, Koh continued.
"These privacy policies do not demonstrate explicit consent, and in fact suggest the opposite," Koh wrote.
Widening the potential class considerably, Koh found that people with other email providers who correspond with Gmail users do not give Google implicit consent to intercept their messages.
Koh waded into new territory when considering Google's motion to dismiss the plaintiffs' claims under CIPA, California's wiretap law. Few courts have considered the question of whether the statute can be applied to email and there is no binding authority. Concluding that California lawmakers wanted to afford citizens broad protections under the statute, Koh allowed the claims.
In one consolation prize for Google, Koh dismissed with leave to amend the plaintiffs' claims under Section 632 of CIPA, which applies to confidential communications. Koh also dismissed with leave to amend the plaintiffs' Pennsylvania state law claims but let stand claims filed under Florida and Maryland laws.