Nationwide Privacy Class Action Dismissed in In re iPhone Application Litigation Based on Lack of Article III Standing

September 27, 2011

On September 20, 2011, Judge Lucy H. Koh of the United States District Court for the Northern District of California issued an order in In re iPhone Application Litigation, Case No. 11-MD-02250-LHK, dismissing a putative nationwide class action against Apple Inc. and eight mobile advertising and analytics companies on the ground that the Plaintiffs had failed to allege an injury in fact sufficient to establish Article III standing.  The decision is significant because it is the first to address claims targeting the disclosure of users’ mobile device data to mobile applications (“apps”) and other third parties, an issue that received significant attention following a Wall Street Journal article last year purporting to document widespread privacy abuses by mobile applications (“Your Apps Are Watching You,” Dec. 18, 2010).  The decision is also significant because it is the second to dismiss a privacy class action for lack of Article III standing; the first decision was also obtained by Gibson Dunn in In re Specific Media Flash Cookies Litigation, Case No. SACV 10-1256-GW, 2011 U.S. Dist. LEXIS 50543 (C.D. Cal. Apr. 28, 2011), a case involving the alleged use of “Flash cookies” by an online advertising network to track Internet users without their knowledge or consent.

Factual Background

In re iPhone Application Litigation consisted of several consolidated class actions filed throughout the country on behalf of all users of apps on Apple iPhones, iPads and other iOS devices.  Plaintiffs asserted claims against Apple and eight different companies that provide advertising and analytics services to application developers that provide apps on those devices (the “Mobile Industry Defendants”).  (Although Plaintiffs originally asserted claims against a number of application developers, they subsequently dismissed those companies, without prejudice).  Plaintiffs alleged that the Mobile Industry Defendants collected and disclosed users’ personal information located on their mobile Apple devices without their knowledge or permission, allegedly in violation of several federal and state laws, including the Computer Fraud and Abuse Act, California’s Comprehensive Computer Data Access and Fraud Act, and California’s Unfair Competition Law.  Plaintiffs also sought to hold Apple liable for these alleged violations on the grounds that (i) its design of the iOS system allowed apps to access users’ personal information despite Apple’s alleged representations to the contrary, and (ii) Apple exercised control over the apps that could be sold in the Apple App Store but failed to adequately police their collection and disclosure of users’ personal information.  Plaintiffs also sought to hold Apple liable for allegedly enabling iOS devices to maintain, synchronize, and retain detailed, unencrypted location history files, an issue that also has received significant media attention (see e.g., Wall St. J., “iPhone Stored Location in Test Even if Disabled,” Apr. 25, 2011).

Although the operative complaint contained no details about what apps the Plaintiffs had used, what specific personal information had been collected, and which defendant (if any) had collected it, the Plaintiffs alleged they had been harmed by the collection of their personal information in three ways:  (1) misappropriation or misuse of personal information; (2) diminution in value of the personal information, which Plaintiffs alleged to be an “asset of economic value”; and (3) “lost opportunity costs” in having installed the apps, as well as diminution in value of their Apple devices because they allegedly were “less secure” and “less valuable” in light of the privacy concerns.  Opinion at 6.

Opinion

A.  Plaintiffs Lacked Article III Standing

Judge Koh held that Plaintiffs lacked Article III standing because they (1) had failed to plead “an ‘injury in fact’ that [was] (a) concrete and particularized and (b) actual or imminent, not conjectural or hypothetical,” and (2) had failed to plead that any alleged injury was “fairly traceable to the challenged action of the defendant[s],” both of which are required to establish standing under Supreme Court precedent.  Id. at 5.  Judge Koh made clear that “[t]he Court does not take lightly Plaintiffs’ allegations of privacy violations.”  Id. at 6.  But “for purposes of the standing analysis under Article III, Plaintiffs’ current allegations are clearly insufficient.”  Id.

Judge Koh’s holding that Plaintiffs had failed to plead an injury in fact rested on two grounds.  First, citing well-settled law that the named plaintiffs in a putative class action must personally establish standing to maintain suit on behalf of the putative class, the Court held that Plaintiffs had failed to “allege injury in fact to themselves.”  Id. (emphasis in original).  As the Court explained, “[i]n the Consolidated Complaint, Plaintiffs do not identify what [Apple devices] they used, do not identify which Defendant (if any) accessed or tracked their personal information, do not identify which apps they downloaded that access/track their personal information, and do not identify what harm (if any) resulted from the access or tracking of their personal information.”  Id.

Second, agreeing with the holding in Specific Media, the Court held that “Plaintiffs [had] not identified a concrete harm from the alleged collection and tracking of their personal information sufficient to create injury in fact.”  Id. at 7.  The Court observed that in Specific Media, the named plaintiffs “had not alleged any ‘particularized example’ of economic injury or harm to their computers, but instead offered only abstract concepts, such as ‘opportunity costs,’ ‘value-for-value exchanges,’ ‘consumer choice,’ and ‘diminished performance.'”  Id.  The same was true of the Plaintiffs in In re iPhone Application Litigation:  they “have stated general allegations about the Mobile Industry Defendants, the market for apps, and similar abstract concepts (e.g., lost opportunity costs, value-for-value exchanges), but Plaintiffs have not identified an actual injury to themselves sufficient for Article III standing.”  Id.

Finally, in addition to holding that the Plaintiffs had failed to plead an injury in fact, the Court also held that the Plaintiffs lacked standing because they had failed to allege that any injury was “fairly traceable to Apple or to the Mobile Industry Defendants.”  Id. at 9.  “In fact,” the Court explained, “Plaintiffs fail to differentiate among the eight Mobile Industry Defendants making it impossible to decipher, based on the current allegations, any causal chain.”  Id.  The Court put Plaintiffs “on notice . . . that any amended complaint must provide specific allegations with respect to the causal connection between the exact harm alleged (whatever it is) and each Defendants’ conduct or role in that harm.”  Id.

B.  Additional Infirmities In The Complaint

In light of its decision to dismiss the complaint for lack of Article III standing, the Court found unnecessary “a lengthy analysis of Defendants’ other arguments,” but nonetheless “note[d] additional deficiencies in the allegations in the event that Plaintiffs choose to file an amended complaint.”  Id. at 9.  Among those additional — and significant — deficiencies were:

• Apple argued that its terms of service and other agreements with the users of Apple mobile devices disclaimed any liability for the acts of third parties, including application developers.  Plaintiffs contended that these agreements were unconscionable, but the Court expressed skepticism of this argument, noting that “Plaintiffs have difficulties both with respect to the procedural and substantive element of unconscionability.”  Id. at 11.  The Court explained that “when the challenged term is in a contract concerning a nonessential recreational activity, the consumer always has the option of simply forgoing the activity.” Id. (quoting Belton v. Comcast Cable Holdings, LLC, 151 Cal. App. 4th 1224, 1245 (2007)).  The Court noted that “Plaintiffs have alternatives to” Apple devices and pointedly observed that “apps such as ‘Angry Birds’ or ‘Plants versus Zombies’ are nonessential recreational activities.”  Id.  The Court stated that in any amended pleading “Plaintiffs must explain why Apple should be held responsible for privacy violations despite Apple’s apparent privacy agreements with its customers, including Plaintiffs.”  Id.
• The Court also held that Plaintiffs could not, consistent with Bell Atl. Corp. v. Twombly, 550 U.S. 544 (2007) and its progeny, lump the eight Mobile Industry Defendants together in the complaint by making undifferentiated, en masse allegations against them.  Id. at 11-12.  The Court explained that “Plaintiffs’ failure to allege what role each Defendant played in the alleged harm makes it exceedingly difficult, if not impossible, for individual Defendants to respond to Plaintiffs’ allegations.  In any amended complaint, Plaintiffs must identify what action each Defendant took that caused Plaintiffs’ harm, without resort to generalized allegations against Defendants as a whole.”  Id.
• The Court found significant problems with each of Plaintiffs’ substantive claims.  For example, due to the lack of any cognizable injury articulated by Plaintiffs, Plaintiffs could not state claims for negligence (asserted against Apple only), the Computer Fraud and Abuse Act, California’s Unfair Competition Law, and trespass to chattels, among other claims.  In a particularly important finding for purposes of claims directed to application access to data, the Court also held that Plaintiffs’ claims faced significant hurdles since many of the claims required that Plaintiffs establish unauthorized access to their mobile devices, but here the iOS and third-party apps “were all installed or updated voluntarily by Plaintiffs.”  Id. at 18 (emphasis in original).  The Court made clear throughout the Order that Plaintiffs “must remedy [the complaint’s myriad] deficiencies” in any amended complaint.  Id. at 21.

Conclusion

Judge Koh’s decision in In re iPhone Application Litigation underscores the importance of closely examining plaintiffs’ allegations of harm when defending against a putative class action, especially a class action involving alleged privacy invasions directed to new and developing technologies — an area in which the plaintiffs’ class action bar has become especially active.  Oftentimes, these suits — spurred by sensational media reports — allege widespread privacy violations that may be challenging to parse at the pleadings stage, but which are lacking in any specific or credible allegation of harm.  Under such circumstances, a strong standing challenge has the potential to get the entire case dismissed at the outset and avoids the potential challenges involved in seeking to dismiss individual claims under Federal Rule of Civil Procedure 12(b)(6), which may require the Court to address confusing and technical allegations at the outset (although those challenges should be made in the alternative).  An attack based on plaintiffs’ failure to allege injury or harm can also be important in obtaining a dismissal of privacy class actions filed in state court, where Article III standing challenges are unavailable to defendants, as oftentimes injury will be an element of the state law claims at issue.  For example, earlier this year, Gibson Dunn obtained dismissal of a putative privacy class action complaint filed in Arkansas state court against Mattel, Inc. on grounds that the plaintiffs — who argued that Mattel had used “Flash cookies” to track their online activities without their knowledge or consent — had failed to plead injury as required to state a claim under the Arkansas statutes at issue.

The In re iPhone Application Litigation decision is also significant because it expressed skepticism of Plaintiffs’ attempts to (1) disregard agreements for nonessential recreational activities on the basis of unconscionability, (2) make undifferentiated allegations against eight separate companies, and (3) plead substantive claims requiring actual injury and unauthorized access relating to applications that were voluntarily downloaded by Plaintiffs.

*  *  *

This alert was prepared by Gail E. Lees, S. Ashlie Beringer, Joshua A. Jessen, and Daniel Y. Li, who represented two of the Mobile Industry Defendants, Flurry, Inc. and Pinch Media, Inc., and led the briefing and oral argument on behalf of the Mobile Industry Defendants.  Ms. Beringer and Mr. Jessen also represented Specific Media, Inc. earlier this year in the successful motion to dismiss for lack of Article III standing in In re Specific Media Flash Cookies Litigation.  Ms. Lees and Ms. Beringer also represented Mattel in the Pinkleton v. Mattel, Inc. Flash cookies action filed in Arkansas state court.

Gibson, Dunn & Crutcher lawyers are available to assist in addressing any questions you may have about these developments.  Please contact the Gibson Dunn lawyer with whom you work, the litigation team representing Flurry, Inc. and Pinch Media, Inc., or any of the following practice group co-chairs:

Gail E. Lees – Los Angeles (213-229-7163, [email protected])
S. Ashlie Beringer – Palo Alto (650-849-5219, [email protected])
Joshua A. Jessen – Orange County (949-451-4114, [email protected])
Daniel Y. Li – Palo Alto (650-849-5334, [email protected])

Class Actions Practice Group Co-Chairs:
Gail E. Lees – Chair, Los Angeles (213-229-7163, [email protected])
Andrew S. Tulumello – Vice-Chair, Washington, D.C. (202-955-8657, [email protected])
G. Charles Nierlich – Vice-Chair, San Francisco (415-393-8239, [email protected]) 

Information Technology and Data Privacy Practice Group Co-Chairs:
S. Ashlie Beringer – Palo Alto (650-849-5219, [email protected])
M. Sean Royall – Dallas (214-698-3256, [email protected])
Debra Wong Yang – Los Angeles (213-229-7472, [email protected])
Alexander H. Southwell – New York (212-351-3981, [email protected])

© 2011 Gibson, Dunn & Crutcher LLP

Attorney Advertising:  The enclosed materials have been prepared for general informational purposes only and are not intended as legal advice.