September 27, 2011
On September 20, 2011, Judge Lucy H. Koh of the United States District Court for the Northern District of California issued an order in In re iPhone Application Litigation, Case No. 11-MD-02250-LHK, dismissing a putative nationwide class action against Apple Inc. and eight mobile advertising and analytics companies on the ground that the Plaintiffs had failed to allege an injury in fact sufficient to establish Article III standing. The decision is significant because it is the first to address claims targeting the disclosure of users’ mobile device data to mobile applications (“apps”) and other third parties, an issue that received significant attention following a Wall Street Journal article last year purporting to document widespread privacy abuses by mobile applications (“Your Apps Are Watching You,” Dec. 18, 2010). The decision is also significant because it is the second to dismiss a privacy class action for lack of Article III standing; the first decision was also obtained by Gibson Dunn in In re Specific Media Flash Cookies Litigation, Case No. SACV 10-1256-GW, 2011 U.S. Dist. LEXIS 50543 (C.D. Cal. Apr. 28, 2011), a case involving the alleged use of “Flash cookies” by an online advertising network to track Internet users without their knowledge or consent.
In re iPhone Application Litigation consisted of several consolidated class actions filed throughout the country on behalf of all users of apps on Apple iPhones, iPads and other iOS devices. Plaintiffs asserted claims against Apple and eight different companies that provide advertising and analytics services to application developers that provide apps on those devices (the “Mobile Industry Defendants”). (Although Plaintiffs originally asserted claims against a number of application developers, they subsequently dismissed those companies, without prejudice). Plaintiffs alleged that the Mobile Industry Defendants collected and disclosed users’ personal information located on their mobile Apple devices without their knowledge or permission, allegedly in violation of several federal and state laws, including the Computer Fraud and Abuse Act, California’s Comprehensive Computer Data Access and Fraud Act, and California’s Unfair Competition Law. Plaintiffs also sought to hold Apple liable for these alleged violations on the grounds that (i) its design of the iOS system allowed apps to access users’ personal information despite Apple’s alleged representations to the contrary, and (ii) Apple exercised control over the apps that could be sold in the Apple App Store but failed to adequately police their collection and disclosure of users’ personal information. Plaintiffs also sought to hold Apple liable for allegedly enabling iOS devices to maintain, synchronize, and retain detailed, unencrypted location history files, an issue that also has received significant media attention (see e.g., Wall St. J., “iPhone Stored Location in Test Even if Disabled,” Apr. 25, 2011).
Although the operative complaint contained no details about what apps the Plaintiffs had used, what specific personal information had been collected, and which defendant (if any) had collected it, the Plaintiffs alleged they had been harmed by the collection of their personal information in three ways: (1) misappropriation or misuse of personal information; (2) diminution in value of the personal information, which Plaintiffs alleged to be an “asset of economic value”; and (3) “lost opportunity costs” in having installed the apps, as well as diminution in value of their Apple devices because they allegedly were “less secure” and “less valuable” in light of the privacy concerns. Opinion at 6.
A. Plaintiffs Lacked Article III Standing
Judge Koh held that Plaintiffs lacked Article III standing because they (1) had failed to plead “an ‘injury in fact’ that [was] (a) concrete and particularized and (b) actual or imminent, not conjectural or hypothetical,” and (2) had failed to plead that any alleged injury was “fairly traceable to the challenged action of the defendant[s],” both of which are required to establish standing under Supreme Court precedent. Id. at 5. Judge Koh made clear that “[t]he Court does not take lightly Plaintiffs’ allegations of privacy violations.” Id. at 6. But “for purposes of the standing analysis under Article III, Plaintiffs’ current allegations are clearly insufficient.” Id.
Judge Koh’s holding that Plaintiffs had failed to plead an injury in fact rested on two grounds. First, citing well-settled law that the named plaintiffs in a putative class action must personally establish standing to maintain suit on behalf of the putative class, the Court held that Plaintiffs had failed to “allege injury in fact to themselves.” Id. (emphasis in original). As the Court explained, “[i]n the Consolidated Complaint, Plaintiffs do not identify what [Apple devices] they used, do not identify which Defendant (if any) accessed or tracked their personal information, do not identify which apps they downloaded that access/track their personal information, and do not identify what harm (if any) resulted from the access or tracking of their personal information.” Id.
Second, agreeing with the holding in Specific Media, the Court held that “Plaintiffs [had] not identified a concrete harm from the alleged collection and tracking of their personal information sufficient to create injury in fact.” Id. at 7. The Court observed that in Specific Media, the named plaintiffs “had not alleged any ‘particularized example’ of economic injury or harm to their computers, but instead offered only abstract concepts, such as ‘opportunity costs,’ ‘value-for-value exchanges,’ ‘consumer choice,’ and ‘diminished performance.'” Id. The same was true of the Plaintiffs in In re iPhone Application Litigation: they “have stated general allegations about the Mobile Industry Defendants, the market for apps, and similar abstract concepts (e.g., lost opportunity costs, value-for-value exchanges), but Plaintiffs have not identified an actual injury to themselves sufficient for Article III standing.” Id.
Finally, in addition to holding that the Plaintiffs had failed to plead an injury in fact, the Court also held that the Plaintiffs lacked standing because they had failed to allege that any injury was “fairly traceable to Apple or to the Mobile Industry Defendants.” Id. at 9. “In fact,” the Court explained, “Plaintiffs fail to differentiate among the eight Mobile Industry Defendants making it impossible to decipher, based on the current allegations, any causal chain.” Id. The Court put Plaintiffs “on notice . . . that any amended complaint must provide specific allegations with respect to the causal connection between the exact harm alleged (whatever it is) and each Defendants’ conduct or role in that harm.” Id.
B. Additional Infirmities In The Complaint
In light of its decision to dismiss the complaint for lack of Article III standing, the Court found unnecessary “a lengthy analysis of Defendants’ other arguments,” but nonetheless “note[d] additional deficiencies in the allegations in the event that Plaintiffs choose to file an amended complaint.” Id. at 9. Among those additional — and significant — deficiencies were:
Judge Koh’s decision in In re iPhone Application Litigation underscores the importance of closely examining plaintiffs’ allegations of harm when defending against a putative class action, especially a class action involving alleged privacy invasions directed to new and developing technologies — an area in which the plaintiffs’ class action bar has become especially active. Oftentimes, these suits — spurred by sensational media reports — allege widespread privacy violations that may be challenging to parse at the pleadings stage, but which are lacking in any specific or credible allegation of harm. Under such circumstances, a strong standing challenge has the potential to get the entire case dismissed at the outset and avoids the potential challenges involved in seeking to dismiss individual claims under Federal Rule of Civil Procedure 12(b)(6), which may require the Court to address confusing and technical allegations at the outset (although those challenges should be made in the alternative). An attack based on plaintiffs’ failure to allege injury or harm can also be important in obtaining a dismissal of privacy class actions filed in state court, where Article III standing challenges are unavailable to defendants, as oftentimes injury will be an element of the state law claims at issue. For example, earlier this year, Gibson Dunn obtained dismissal of a putative privacy class action complaint filed in Arkansas state court against Mattel, Inc. on grounds that the plaintiffs — who argued that Mattel had used “Flash cookies” to track their online activities without their knowledge or consent — had failed to plead injury as required to state a claim under the Arkansas statutes at issue.
The In re iPhone Application Litigation decision is also significant because it expressed skepticism of Plaintiffs’ attempts to (1) disregard agreements for nonessential recreational activities on the basis of unconscionability, (2) make undifferentiated allegations against eight separate companies, and (3) plead substantive claims requiring actual injury and unauthorized access relating to applications that were voluntarily downloaded by Plaintiffs.
* * *
This alert was prepared by Gail E. Lees, S. Ashlie Beringer, Joshua A. Jessen, and Daniel Y. Li, who represented two of the Mobile Industry Defendants, Flurry, Inc. and Pinch Media, Inc., and led the briefing and oral argument on behalf of the Mobile Industry Defendants. Ms. Beringer and Mr. Jessen also represented Specific Media, Inc. earlier this year in the successful motion to dismiss for lack of Article III standing in In re Specific Media Flash Cookies Litigation. Ms. Lees and Ms. Beringer also represented Mattel in the Pinkleton v. Mattel, Inc. Flash cookies action filed in Arkansas state court.
Gibson, Dunn & Crutcher lawyers are available to assist in addressing any questions you may have about these developments. Please contact the Gibson Dunn lawyer with whom you work, the litigation team representing Flurry, Inc. and Pinch Media, Inc., or any of the following practice group co-chairs:
Gail E. Lees – Los Angeles (213-229-7163, email@example.com)
S. Ashlie Beringer – Palo Alto (650-849-5219, firstname.lastname@example.org)
Joshua A. Jessen – Orange County (949-451-4114, email@example.com)
Daniel Y. Li – Palo Alto (650-849-5334, firstname.lastname@example.org)
Class Actions Practice Group Co-Chairs:
Gail E. Lees – Chair, Los Angeles (213-229-7163, email@example.com)
Andrew S. Tulumello – Vice-Chair, Washington, D.C. (202-955-8657, firstname.lastname@example.org)
G. Charles Nierlich – Vice-Chair, San Francisco (415-393-8239, email@example.com)
Information Technology and Data Privacy Practice Group Co-Chairs:
S. Ashlie Beringer – Palo Alto (650-849-5219, firstname.lastname@example.org)
M. Sean Royall – Dallas (214-698-3256, email@example.com)
Debra Wong Yang – Los Angeles (213-229-7472, firstname.lastname@example.org)
Alexander H. Southwell – New York (212-351-3981, email@example.com)
© 2011 Gibson, Dunn & Crutcher LLP
Attorney Advertising: The enclosed materials have been prepared for general informational purposes only and are not intended as legal advice.