OPINION

M. SMITH, Circuit Judge:

Fayelynn Sams appeals the district court's order dismissing her putative class claims against Yahoo! Inc. with prejudice. Sams alleges that Yahoo! violated the Stored Communications Act (SCA), 18 U.S.C. §§ 2701-2712, when it disclosed some of Sams' noncontent subscriber information to the government pursuant to allegedly invalid subpoenas. Sams further argues that even if the subpoenas were valid, Yahoo! failed to comply with their terms when it produced the requested documents prior to the deadline set in the subpoenas. Because the SCA provides a "complete defense to any civil or criminal action" where the defendant can demonstrate that it produced documents in "good faith reliance on ... a grand jury subpoena," we affirm the district court's order dismissing Sams' claims.

BACKGROUND

Yahoo! styles itself as a "premier digital media company," whose product offerings include Internet search and email. Yahoo! is a Delaware corporation, and its principal place of business is located in Sunnyvale, California. While Yahoo! maintains an office in Georgia, its legal compliance team is located in Sunnyvale.

On December 2, 2008, Yahoo!'s legal compliance team received a facsimile of a grand jury subpoena from the District Attorney's Office for the Southern Judicial Circuit of Georgia. The District Attorney requested that Yahoo! disclose "any and all records regarding the identification" of one of its users.1 The user in question was later determined to be Sams. The subpoena was signed by both a judge and the clerk of the Superior Court of Lowndes County, Georgia, and demanded that Yahoo! produce the requested records at 8:30 a.m. on January 28, 2009. A substantially similar subpoena was faxed to Yahoo!'s legal compliance team on December 15, 2008, demanding the production of additional documents by the January 28 deadline.2

Both subpoenas were accompanied by nearly identical cover letters that purported to explain Yahoo!'s obligations under the subpoenas. Those letters read, in relevant part:

Yahoo! produced the requested information sometime before January 28, 2009. Consequently, the prosecutor determined that the attendance of a witness was not needed, and no Yahoo! witness testified before the grand jury pursuant to the subpoenas.

Based on the above conduct, Sams filed a putative class action in the Superior Court of Fulton County, Georgia, purporting to represent a class of plaintiffs whose information Yahoo! had allegedly disclosed to law enforcement in violation of the SCA. Sams claimed that Yahoo!'s disclosures were unlawful because the subpoenas failed to comply with the requirements of Georgia law, and specifically the Uniform Act to Secure the Attendance of Witnesses from Without the State in Criminal Proceedings (Uniform Act). Ga.Code Ann. §§ 24-13-90-24-13-97.3 Sams further claimed that Yahoo!'s disclosures were unlawful because they were "voluntarily" made before the deadline for compliance set forth in the subpoenas.

Yahoo! successfully removed the action to the United States District Court for the Northern District of Georgia. Sams then filed a motion to transfer the case to the Northern District of California. Yahoo! agreed "that transfer to the Northern District of California was the appropriate remedy in light of Yahoo!'s terms of service," and the case was transferred.

On January 10, 2011, Yahoo! moved to dismiss Sams' complaint. The district court granted Yahoo!'s motion after finding Yahoo! was statutorily immune from suit under 18 U.S.C. § 2703(e). The district court also granted Sams leave to amend her complaint to allege that Yahoo! impermissibly over-produced Sams' content-based information. When Sams did not amend her complaint within the allotted 30 days, the district court dismissed her complaint with prejudice. Sams timely appealed.

JURISDICTION AND STANDARD OF REVIEW

We have jurisdiction to review the district court's order of dismissal under 28 U.S.C. § 1291. We review the district court's order de novo, Cousins v. Lockyer, 568 F.3d 1063, 1067 (9th Cir.2009), and may affirm on any ground supported in the record, Islamic Republic of Iran v. Boeing Co., 771 F.2d 1279, 1288 (9th Cir.1985).

DISCUSSION

I. Consideration of Extrinsic Evidence and Affirmative Defenses

This case comes to us on a motion to dismiss under Federal Rule of Civil Procedure 12(b)(6). At this stage of the litigation, we would usually be confined to reviewing the body of Sams' complaint, which did not include copies of the two subpoenas. See Lee v. City of Los Angeles, 250 F.3d 668, 688 (9th Cir.2001) (citation omitted). However, we are permitted to consider documents that were not physically attached to the complaint where the documents' authenticity is not contested, and the plaintiff's complaint necessarily relies on them. Id. at 688-89 (citing Parrino v. FHP, Inc., 146 F.3d 699, 705-06 (9th Cir.1998)).4 Because the subpoenas are critical to Sams' lawsuit, and there is no factual dispute as to their contents, we may properly consider the appearance and content of the subpoenas at this stage in the litigation.

Similarly, the assertion of an affirmative defense may be considered properly on a motion to dismiss where the "allegations in the complaint suffice to establish" the defense. Jones v. Bock, 549 U.S. 199, 215, 127 S.Ct. 910, 166 L.Ed.2d 798 (2007); see also Goddard v. Google Inc., 640 F.Supp.2d 1193, 1199 n. 5 (N.D.Cal.2009) (noting that "affirmative defenses routinely serve as a basis for granting Rule 12(b)(6) motions where the defense is apparent from the face of the [c]omplaint") (internal quotation and citation omitted).

II. The Stored Communications Act Claims

Congress passed the SCA in 1986 as part of the Electronic Communications Privacy Act. "The SCA was enacted because the advent of the Internet presented a host of potential privacy breaches that the Fourth Amendment does not address." Quon v. Arch Wireless Operating Co., 529 F.3d 892, 900 (9th Cir.2008), rev'd on other grounds, ___ U.S. ___, 130 S.Ct. 2619, 177 L.Ed.2d 216 (2010) (citation omitted). To address these potential privacy breaches, the SCA "creates a set of Fourth Amendment-like privacy protections by statute, regulating the relationship between government investigators and service providers in possession of users' private information." Orin S. Kerr, A User's Guide to the Stored Communications Act, and a Legislator's Guide to Amending It, 72 Geo. Wash. L.Rev. 1208, 1212 (2004). Specifically, the statute protects the privacy of electronic communications by (1) placing limits on the government's ability to compel network service providers to disclose information they possess about their customers and subscribers, 18 U.S.C. § 2703, and (2) restricting the ability of network service providers to voluntarily disclose information about their customers and subscribers to the government, 18 U.S.C. § 2702. Violation of these provisions may result in criminal or civil liability, unless one or both of the SCA's statutory immunity provisions applies. 18 U.S.C. §§ 2703(e), 2707(e).

A.

§ 2703(c)(2) of the SCA provides the rules for compelling the production of a subset of noncontent records (sometimes known as "basic subscriber information") that Congress has deemed less private than other records.5 Under § 2703(c)(2), the government can obtain basic subscriber information — such as the information Yahoo! produced here — with a mere subpoena.6 And where a provider, like Yahoo!, discloses basic subscriber information to the government "in accordance with the terms of a ... subpoena," 18 U.S.C. § 2703(e), or in "good faith reliance on ... a grand jury subpoena," 18 U.S.C. § 2707(e), the provider is immune from suit.

Sams argues that Yahoo! is not entitled to benefit from either immunity provision because her basic subscriber information was produced pursuant to allegedly invalid subpoenas.7 Specifically, Sams contends that because Yahoo! is not a citizen of Georgia, it may only be lawfully subpoenaed in a criminal case pursuant to the provisions of the Uniform Act. Ga.Code Ann. §§ 24-13-90-24-13-97. Yahoo! admits that the subpoenas here did not comply with the requirements of the Uniform Act, but argues that the Uniform Act does not apply where a foreign corporation maintains a presence in the state.

To our knowledge, no Georgia court has determined whether Georgia law requires the government to comply with the Uniform Act in order to obtain the testimony of a foreign corporation that maintains a physical presence within the State of Georgia. See generally Yeary v. State, 289 Ga. 394, 711 S.E.2d 694 (2011). However, we see no reason to be the first appellate court to address this unsettled aspect of Georgia law because, regardless of the outcome of that issue, we conclude that Yahoo! is immune from suit under the SCA's good-faith immunity provision. 18 U.S.C. § 2707(e).

§ 2707(e) provides that "good faith reliance on ... a grand jury subpoena" is "a complete defense" to any action brought under the SCA. 18 U.S.C. § 2707(e). The legal definition of "good faith reliance" under § 2707(e) is a matter of first impression in this circuit, and few other courts have interpreted this provision. See, e.g., McCready v. eBay, Inc., 453 F.3d 882, 892 (7th Cir.2006) (adopting objective test of good faith); Freedman v. America Online, Inc., 325 F.Supp.2d 638, 647-48 (E.D.Va. 2004) (adopting test of good faith with both an objective and subjective component); Fox v. CoxCom Inc., No. CV-11-594, 2012 WL 6019016, at *3 (D.Ariz. Dec. 3, 2012) (same). Although we reject the Freedman court's specific formulation of the good faith test, we agree that the test of good faith reliance under § 2707(e) should contain both an objective and subjective element. Accordingly, we now hold that the good faith defense under 18 U.S.C. § 2707(e) is met when the defendant complies with a subpoena (or other process detailed in § 2707(e) of the SCA) that appears valid on its face, in the absence of any indication of irregularity sufficient to put the defendant on notice that the subpoena may be invalid or contrary to applicable law. A defendant may not benefit from the good faith defense, however, if the defendant actually knew that the subpoena (or other process) was invalid under the applicable law.

Thus, whether a particular defendant satisfies the requirements to establish "good faith reliance" is a mixed question of law and fact. See, e.g., Sinaloa Lake Owners Ass'n v. City of Simi Valley, 70 F.3d 1095, 1099 (9th Cir.1995). Whether the defendant actually knew that a subpoena was invalid is a question of fact. Whether the defendant's belief in the subpoena's validity was objectively reasonable is itself a mixed question of law and fact. If there are disputed issues of material fact as to the "historical facts of what the [defendant] knew or what he did, it is clear that these are questions of fact for the jury to determine." Id.; see also Act Up!/Portland v. Bagley, 988 F.2d 868, 873 (9th Cir.1993). Whether those "historical facts" support an objective belief that the defendant acted reasonably, however, is a question of law to be decided by the court. Act Up!/Portland, 988 F.2d at 873; see also Hunter v. Bryant, 502 U.S. 224, 228-29, 112 S.Ct. 534, 116 L.Ed.2d 589 (1991).

Applying these principles to Yahoo!'s conduct here, we find that Yahoo! is statutorily immune from suit. First, Sams pled no facts sufficient to lead to a plausible inference that Yahoo! actually knew that these subpoenas were invalid. Sams' sole allegation that Yahoo! did not act in good faith is no more than a threadbare recital of the language of § 2707(e), precisely the kind that we decline to credit.8 See Ashcroft v. Iqbal, 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009). Under Iqbal, such bald legal conclusions are not entitled to be accepted as true and thus "do not suffice" to prevail over a motion to dismiss. Id.; see also Faulkner v. ADT Sec. Servs., Inc., 706 F.3d 1017, 1020 (9th Cir.2013).

Second, Yahoo!'s production in response to these subpoenas was objectively reasonable as a matter of law.9 For even assuming, arguendo, that these subpoenas were ultimately invalid, they bore all of the indicia of lawful authority. See United States v. Crews, 502 F.3d 1130, 1136-38 (9th Cir. 2007) (finding good faith reliance as a matter of law where search warrant affidavit contained sufficient indicia of probable cause on its face); McCready, 453 F.3d at 892 (good faith reliance under SCA established as a matter of law where "nothing" about subpoena would have put defendant "on notice that the subpoena was `phony'"). For instance, the subpoenas were faxed from the District Attorney's Office, stated the name of the court and the title of the action, and bore the signature of both the court clerk and a superior court judge. See Ga.Code Ann. § 24-10-20 (2012) (repealed 2013) ("Every subpoena shall be issued by the clerk under the seal of the court, shall state the name of the court and the title of the action, and shall command each person to whom it is directed to attend and give testimony at a time and place therein specified.") Moreover, Yahoo!'s response to the first subpoena was received by the proper office, and that response prompted the District Attorney to seek additional information by way of a second subpoena. Simply put, nothing about these subpoenas would place a reasonable person on notice that they might be invalid.

Sams relies on Freedman to argue that dismissal of her claims was nevertheless inappropriate. 325 F.Supp.2d 638 (E.D.Va.2004). But even if we were bound by Freedman, it does not support Sams' position. In Freedman, the district court refused to grant a defendant's summary judgment motion regarding good faith reliance. Id. at 650. The court reasoned that a jury could find the defendant's conduct unreasonable where it produced the plaintiff's records in response to a search warrant that was not signed by a judge and that had been only partially completed. Id.

In contrast to Freedman, there is simply no reason to suspect that Yahoo! acted in bad faith here, where the subpoenas displayed no "indication of irregularity sufficient to put [Yahoo!] on notice that the subpoena[s] w[ere] phony." McCready, 453 F.3d at 892.

B.

Sams argues in the alternative that Yahoo! remains liable because it failed to comply with the terms of the subpoenas when it produced the requested documents before the specified deadline. Essentially, Sams contends that Yahoo! was obligated to send a corporate representative to Lowndes County on January 28, 2009, to hand-deliver the requested documents to the grand jury. We reject Sams' contention.

Sams cites no authority in support of her claim that a person or entity responding to a subpoena may not provide the demanded documents earlier than the time specified in the subpoena in order to avoid legal sanction. This lack of supporting precedent is unsurprising since Sams' proposed rule would defy common sense, and wreak havoc on courts and litigants alike. The principle Sams would apparently have us adopt would, among other things, outlaw the negotiated resolution of discovery disputes, and related cooperation among counsel to minimize inconvenience and cost to the parties. The legal profession is often criticized for its rancor and inefficiency, and we decline to adopt a rule that would make the situation worse by discouraging common sense cooperation among parties and counsel.

Nor do we credit Sams' final contention that Yahoo!'s early production of documents constituted an unlawful "voluntary" disclosure under the SCA. For while we acknowledge that the letters accompanying the subpoenas suggested that Yahoo! might "voluntarily provide copies of the evidence," in order to "expedite [its] appearance before the Grand Jury," nothing in the record indicates that Yahoo! did not feel itself legally bound to produce the subpoenaed documents. Yahoo! did not produce documents to the Lowndes County grand jury spontaneously or in response to an informal request by an investigator — it did so only after receiving apparently valid subpoenas from the District Attorney's Office. Yahoo!'s acquiescence "to a claim of lawful authority" did not render its compliance "voluntary," regardless of the language employed by the District Attorney in his cover letter. See Bumper v. North Carolina, 391 U.S. 543, 549, 88 S.Ct. 1788, 20 L.Ed.2d 797 (1968) (holding that acquiescence to a claim of lawful authority "cannot be consent").

CONCLUSION

The district court properly dismissed Sams' SCA claims because Yahoo! is statutorily immune from suit. Yahoo!'s early compliance with the subpoenas did not vitiate Yahoo!'s immunity.

AFFIRMED.