Apple’s Collection of iPhone Data Could Violate California Law

This posting was written by Thomas A. Long, Editor of CCH Privacy Law in Marketing.

Users of mobile applications (“apps”) on Apple’s “iOS” devices (iPhone, iPad, and iPod Touch, etc., or “iDevices”) could go forward with claims under California’s Consumers Legal Remedies Act and Unfair Competition Law against Apple for violating their privacy rights by unlawfully allowing third-party apps that run on the devices to collect and make use of personal information, for commercial purposes and without users’ knowledge or consent, the federal district court in San Jose, California has ruled.

The court dismissed the users’ claims against Apple and mobile app developers for violations of the Stored Communications Act, the Wiretap Act, the Computer Fraud and Abuse Act, and California’s constitutional right to privacy.

Two Putative Classes

The users’ amended consolidated complaint asserted claims with respect to two putative classes of individuals. The first class, referred to as “the iDevice Class,” contended that Apple-approved apps created by third-party companies (Admob, Inc., Flurry, Inc., AdMarval, Inc., Google, Inc., and Medialets, Inc., collectively, “Mobile Industry Defendants”) unlawfully collected information about the users, including their addresses and current whereabouts, gender, age, zip code, time zone, and information about which functions the users performed on the app. They alleged that Apple violated its express privacy policy by allowing the Mobile Industry Defendants to design apps with the capability to track and collect data about their app use or other personal information.

The second class, referred to as the “Geolocation Class,” consisted of iDevice purchasers who alleged that they “unwittingly, and without notice or consent transmitted location data to Apple servers.” They alleged that, starting in July 2010, Apple began intentionally collecting data on their precise geographic location and storing that information on the iDevice in order to develop a database about the geographic location of cellular towers and wireless networks. They asserted that Apple continued collecting geolocation information about them even after they switched off the location services settings on their iDevices, despite the fact that Apple had represented that they could prevent the collection of such data in that way.

Article III Standing

Both the iDevice Class and the Geolocation Class users alleged sufficient injury to have standing to sue under Article III of the U.S. Constitution, the court decided. In their initial complaint, the users had relied on a theory that collection of personal information itself created a particularized issue for purposes of standing, which the court rejected (CCH Privacy Law in Marketing ¶60,676).

In their amended complaint, the users’ allegations had been significantly developed to allege particularized injury, in the court’s view. The users articulated additional theories of harm beyond their theoretical allegations that personal information has independent economic value. In particular, they alleged actual injury, including diminished and consumed iDevice resources, such as storage, battery life, and bandwidth; increased, unexpected, and unreasonable risk to the security of sensitive personal information; and detrimental reliance on Apple’s representations regarding the privacy protection given to users of iDevice apps.

In addition, the users described the specific iDevices used, the specific defendants that allegedly accessed or tracked their personal information; which apps they downloaded that accessed their personal information; and what harm resulted from the access or tracking of their information. They also identified the types of information collected, such as their home and workplace locations, gender, age, zip code, terms searched, and ID and password for specific app accounts.

The users also identified an additional basis for Article III standing, the court said. The injury required by Article III may exist by virtue of statutes creating legal rights, the violation of which creates standing. The users alleged violations of their statutory rights under the Wiretap Act and the Stored Communications Act. The alleged injuries were fairly traceable to the actions of the defendants. The Geolocation Class asserted that Apple intentionally designed its software to retrieve and transmit geolocation information located on its customers’ iPhones to Apple’s servers.

The iDevice Class alleged that Apple designed its products and App Store to allow individuals to download third-party apps and that Apple represented to users that it took precautions to safeguard their personal information. The app developers were accused of accessing personal information without users’ knowledge or consent. These allegations were sufficient to establish standing, the court concluded.

Stored Communications Act

The users’ claims under the Stored Communications Act (SCA) failed because the SCA was not applicable to the alleged conduct by Apple and the Mobile Industry Defendants, the court determined. Stating an SCA claim requires an allegation that the defendants accessed without authorization a “facility through which electronic communication service is provided.” The users’ mobile devices did not meet the SCA’s definition of “facility.” The users’ iDevices did not provide an electronic communications service simply by virtue of enabling use of electronic communication services.

In addition, the storage of real-time location information and other data on the iDevices did not qualify under the SCA as “electronic storage,” the court said. The iDevices stored location data for up a year; such storage did not constitute the type of temporary, intermediate storage of data incidental to the transmission of the data.

Wiretap Act

The users asserted that Apple’s collection of precise geographic location data from WiFi towers, cell phone towers, and GPS data on users’ devices constituted “interceptions” of data prohibited by the Wiretap Act. However, such data was not “content” covered by the Wiretap Act, the court said. Data automatically generated about a telephone call did not constitute “content” because it contained no information about the substance of the communication. The geolocation data was generated automatically and was not part of the information intentionally communicated by the users.

Computer Fraud and Abuse Act

The court also rejected the users’ Computer Fraud and Abuse Act (CFAA) claims. Apple had the authority to access iDevices and to collect geolocation data as a result of the voluntary installation of software by the users and, therefore, could not have violated the CFAA. In addition, the users failed to allege damage or “impairment” to their devices or an interruption of service.

California Constitutional Right to Privacy

Collection of the users’ data by Apple and the Mobile Industry Defendants did not violate the users’ right to privacy under the California Constitution, the court found. The alleged disclosure of device identifier numbers, personal data, and geolocation information from the users’ iDevices—even if transmitted without their knowledge or consent—was not an egregious breach of social norms, as required to state a claim for invasion of privacy. Rather, it was routine commercial behavior, according to the court.

California Consumer Legal Remedies Act

Apple could be liable for violating California’s Consumer Legal Remedies Act (CLRA), the court determined. The users sufficiently alleged that they sustained harm as a result of the alleged data collection practices. With respect to geolocation data, the users alleged that Apple had stored such data on the users’ iDevices for Apple’s own benefit, at a cost to the users, and the that if Apple had disclosed the true cost of the geolocation features, the value of the iDevices would have been materially less than what the users paid.

In addition, the users contended that because of Apple’s failure to disclose its practices with regard to collection of personal data via apps, the users overpaid for their iDevices. At the pleadings stage, the users sufficiently alleged that they were consumers under the CLRA, and their allegations related to the purchase of goods, the court said.

California Unfair Competition Law

The court also decided that the users could go forward with their claims under the California Unfair Competition Law (UCL). The users had standing under the UCL because they alleged that they paid more for their iDevices than they would have if Apple had disclosed its privacy practices. Apple’s conduct could be illegal under the Consumers Legal Remedies Act and therefore covered by the UCL. In addition, the conduct could be “unfair,” for purposes of the UCL. The users met their burden of pleading fraud with particularity, according to the court.

The decision is In re iPhone Application Litig., CCH Privacy Law in Marketing ¶60,775.

Further details regarding CCH Privacy Law in Marketing appears here.

Court Requests Limited Discovery in Amazon Online Tracking Case

This posting was written by William Zale, Editor of CCH Advertising Law Guide.

Although it was very likely that Amazon’s “Conditions of Use and Privacy Notice” disclosed sufficient information to negate computer users’ Washington Consumer Protection Act (CPA) claims, limited discovery would be appropriate on the issue of whether Amazon accessed the users’ computers without authorization, the federal district court in Seattle has ruled. The computer users’ Computer Fraud and Abuse Act (CFAA) claim was dismissed with prejudice.

The computer users challenged Amazon.com’s alleged use of standard browser cookies and Adobe Flash cookies to gather personally identifiable information about the users’ Internet habits and browsing history. To support a CPA claim, injury need not be great, or even quantifiable, but it must be an injury to “business or property.”

Computer Access Authorization

The users would satisfy the injury element only if they could demonstrate that Amazon accessed their computers or their information without authorization, the court observed. The issue of authorization was “quite complicated.” Amazon’s Conditions of Use and Privacy Notice appeared to notify visitors that it would take the very actions complained of: place browser and Flash cookies on their computers and use those cookies to monitor and collect information about their navigation and shopping habits.

Amazon’s motion to dismiss, to the extent that it relied on exhibits including Amazon’s Conditions of Use and Privacy Notice, was construed as a motion for summary judgment, and the computer users would be provided a reasonable opportunity to present all pertinent material. Limited discovery concerning Amazon’s conditions and notice, their location on the website, and each plaintiff’s use of the site would likely be both beneficial and appropriate, according to the court.

Computer Fraud and Abuse Act

The users failed to plausibly allege a loss during a one-year period aggregating at least $5,000 in value under the CFAA from Amazon.com’s alleged gathering of personally identifiable information about the users’ Internet habits and browsing history, the court determined. The CFAA defined “loss” as “any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service.”

Non-monetary detriments could not constitute loss, contrary to the computer users’ contention, and they alleged nothing from which a calculable loss could be inferred, the court concluded.

The June 1 opinion in Del Vecchio v. Amazon.com, Inc. will be reported at CCH Advertising Law Guide ¶64,728.

Computer Fraud and Abuse Should Be RICO Predicate Act: Department of Justice

This posting was written by Mark Engstrom, Editor of CCH RICO Business Disputes Guide.

In a statement before a House Judiciary subcommittee on November 15, a U.S. Department of Justice official proposed amending the federal RICO statute to make violations of the Computer Fraud and Abuse Act (CFAA) a RICO predicate act.

Richard Downing, Deputy Section Chief for Computer Crime and Intellectual Property, testified before the House Judiciary Subcommittee on Crime, Terrorism and Homeland Security. In his prepared statement, Downing emphasized the importance of addressing more targeted, sophisticated, and serious cyber crime and cyber intrusions.

According to Downing, computer technology has become a key tool of organized crime, which now:

(1) Hacks into public and private computer systems, including systems key to national security and defense;

(2) Hijacks computers for the purpose of stealing identity and financial information;

(3) Extorts lawful businesses with threats to disrupt computers; and

(4) Commits a range of other cyber crimes.

The Obama administration has taken significant steps to ensure that the American people, businesses, and governments build better protections against cyber threats, he said.

“Through this ongoing work, it has become clear that our Nation cannot improve its ability to defend against cyber threats unless certain laws that govern cybersecurity activities are updated, including the Computer Fraud and Abuse Act.”

RICO Predicate Act

Among the changes proposed by the Department of Justice is making CFAA offenses subject to the Racketeering Influenced and Corrupt Organizations Act.
Downing urged Congress to update the RICO statute because RICO could be an effective tool to fight criminal organizations that use the Internet to commit their crimes.

“The Administration’s proposal would simply make clear that malicious activities directed at the confidentiality, integrity and availability of computers should be considered criminal activities under the RICO statute,” the official noted.

Downing’s statements were issued as part of a broader proposal to update the CFAA, including amendments to ramp up sentencing and other penalties, furnish better tools for investigators and prosecutors, and provide enhanced deterrence for malicious activity directed at critical infrastructure.

The full text of Downing’s statements is available here on the Department of Justice website.

Ad Network’s Online Behavioral Profiling Could Violate New York Law

This posting was written by Thomas A. Long, Editor of CCH Privacy Law in Marketing.

An individual could not go forward with purported class-action claims that an advertising network violated the Computer Fraud and Abuse Act (CFAA) by monitoring her web browsing habits, but she could pursue claims under New York’s deceptive business practices statute and New York common law, the federal district court in New York City has determined.

The network purchased advertisement display space from websites and displayed ads of interest to a computer user. The network’s clients were advertising companies and agencies.

The network allegedly used “browser cookies”—text files that gather information about a computer user’s Internet habits—to create “behavioral profiles.” The network also allegedly used “flash cookies” to “respawn” the browser cookies when they were deleted by users, without users’ consent.

The individual also accused the network of using “history sniffing” code that was invisible to computer users. This code contained a list of hyperlinks, examined the user’s computer’s browser information to determine whether the computer had previously visited those hyperlinks, and transmitted the results to the network’s servers for the purpose of selecting ads to display on the user’s computer.

Computer Fraud and Abuse Act

The individual could not satisfy the $5,000 minimum damages threshold for civil actions under the CFAA, the court said. She failed to quantify any damage that the network caused to her computers, systems, or data that could require economic remedy. Although she alleged that the network impaired the functioning of her computer, diminishing its value, she did not make specific allegations as to the cost of repairing or investigating this alleged damage.

The collection of her personal information, and any associated invasion of her privacy, would not be compensable under the CFAA, which redressed only economic damages or loss. The collection of demographic information did not constitute damage to consumers or unjust enrichment to the collectors.

The individual’s inability to delete or control the network’s cookies might constitute a de minimis injury, but not an injury sufficient to meet the $5,000 CFAA threshold, according to the court. Even if losses could be aggregated for purposes of the CFAA before a class was certified, damages resulting from the placement of cookies on multiple computers of prospective class members could not be aggregated because these losses would not result from the “same act” by the network.

In addition, even if the individual represented a class of consumers, she would have to show that she had been personally injured.

New York State Law Claims

The advertising network’s behavioral profiling conduct could constitute a deceptive business act or practice under New York law, in the court’s view. The network’s use of flash cookies and history sniffing code could constitute deceptive conduct that misled consumers into believing their digital information was private, when in reality it was being tracked by the network.

The individual and similarly-situated consumers allegedly were harmed in that they suffered the loss of privacy through the exposure of their personal and private information. The individual was not required to allege reliance to plead a claim under the New York statute.

Although collection of personal information did not cause an economic injury, such nonpecuniary harm to privacy had been recognized as an actionable injury for purposes of the New York statute, the court said. The network’s conduct also could constitute a trespass to chattels under New York common law.

Advertiser Liability

The individual failed to allege facts demonstrating that any of the companies whose products were advertised by the network (the “advertisers”) had engaged in any deceptive conduct or trespass. Claims against the advertisers were dismissed with prejudice.

The decision is Bose v. Interclick, Inc., CCH Privacy Law in Marketing ¶60,665.

Further information regarding CCH Privacy Law in Marketing appears here.

Web Users Fail to Allege Injury in Fact from Installation of “Flash Cookies”

This posting was written by Thomas A. Long, Editor of CCH Privacy Law in Marketing.

A purported class of web users bringing claims against online third-party advertising network Specific Media for installing “Flash cookies” on their computers without their knowledge or consent failed to allege an “injury in fact” resulting from Specific Media’s conduct, the federal district court in Los Angeles has ruled.

The users brought claims under the federal Computer Fraud and Abuse Act and California’s Computer Crimes law, invasion of privacy statute, Unfair Competition Law, and Consumer Legal Remedies Act.

The term “Flash cookies” refers to data called “local shared objects,” which are stored on a user’s computer and used by Adobe Flash Player media software. Such data files allegedly circumvent the privacy and security controls of users who had set their web browsers to block or to periodically delete conventional cookie files.

Economic Loss?

The complaining users asserted that Specific Media’s placement of Flash cookies on their computers caused them to sustain economic loss, in that their personal information had “discernible value.”

However, the users did not allege that Specific Media actually tracked their online activity, the court said. They asserted only that they believed the Flash cookies could be used as substitutes for previously deleted standard cookies and to “re-spawn” previously deleted cookies. Therefore, the users did not allege that they were specifically injured by Specific Media’s practices.

Even if they could allege that they were affected by Specific Media’s installation of Flash cookies, the users made only conclusory allegations of harm, according to the court. The argument that Specific Media’s practices caused the users to sustain damage to the economic value of their personal information was potentially valid in the abstract. However, the users would have to provide particularized details of the harm suffered.

For example, the users would have to explain how Specific Media’s conduct deprived them of the opportunity to engage in a “value-for-value exchange” for their information and how that deprivation caused the economic value of the information to be diminished.

Harm to Computers

To the extent that the users alleged that the Flash cookies caused harm to their computers, such harm would be de minimis and insufficient to confer Article III standing, the court said.

The court also expressed skepticism that the users could allege an injury involving the requisite $5,000 minimum in economic damages to support a Computer Fraud and Abuse Act claim, even in the aggregate.

Specific Media’s motion to dismiss the complaint was granted, with leave to amend.

The April 28 decision in La Court v. Specific Media Inc. will appear in CCH Privacy Law in Marketing.

Facebook Obtains Order Barring Phishing, Spamming Scheme

This posting was written by Cheryl Beise, Editor of CCH Guide to Computer Law, and Thomas A. Long, Editor of CCH Privacy Law in Marketing.

Social networking website operator Facebook, Inc. was entitled to an ex parte temporary restraining order against Internet marketers that allegedly used Facebook's website to engage in a phishing and spamming scheme, in violation of the CAN-SPAM Act, the Computer Fraud and Abuse Act, and California law, the federal district court in San Jose has determined. Facebook asserted that the scheme compromised the accounts of a substantial number of Facebook users.

The marketers allegedly sent out seemingly legitimate e-mails to multiple Facebook users, asking them to click on a link, which led to a phishing site designed to trick users into divulging their Facebook login information. The marketers then allegedly used the information to send spam to the users' "friends." As the cycle was repeated, the number of compromised Facebook accounts increased exponentially.

A TRO was warranted because of the strong possibility of irreparable injury to Facebook's reputation and to the personal privacy of Facebook users, the court said.

The balance of hardships clearly favored Facebook because it was required to expend significant time and resources to combat the marketer's activities. The marketers would suffer little or no hardship if enjoined from conducting their allegedly illegal scheme.

The order granting a temporary restraining order is Facebook, Inc. v. Wallace, CCH Guide to Computer Law ¶49,699 and CCH Privacy Law in Marketing ¶60,308.