EDWARD J. DAVILA, District Judge.
The Parties in both Gaos v. Google Inc., 5:10-cv-4809-EJD, and Priyev v. Google Inc., 5:13-cv-0093-LHK, hereby submit the following stipulation and proposed order to consolidate the two actions. The Gaos and Priyev actions are both class actions brought against Google, alleging, inter alia, similar claims and overlapping proposed classes. The Parties agree that consolidation of the actions is appropriate, and the Parties move for an order consolidating the cases on the following terms:
1. Pursuant to Fed. R. Civ. P. 42(a), these cases are hereby consolidated into Civil Action No. 5:10-cv-4809-EJD for pretrial proceedings before this Court. The consolidated action shall be captioned: "
2. All related actions that are subsequently filed in, or transferred to, this District shall be consolidated into this action for pretrial purposes. This Order shall apply to every such related action, absent order of the Court. A party that objects to such consolidation, or to any other provision of this Order, must file an application for relief from this Order within thirty (30) days after the date on which a copy of the order is mailed to the party's counsel, pursuant to Paragraph 7,
3. This Order is entered without prejudice to the rights of any party to apply for severance of any claim or action, for good cause shown.
4. The docket in Civil Action No. 5:10-cv-4809-EJD shall constitute the Master Docket for this Action.
5. Every pleading filed in the consolidated action shall bear the following caption:
6. The file in Civil Action No. 5:10-cv-4809-EJD shall constitute a Master File for every action in the consolidated action. When the document being filed pertains to all actions, the phrase "All Actions" shall appear immediately after the phrase "This Documents Relates To:". When a pleading applies only to some, not all, of the actions, the document shall list, immediately after the phrase "This Documents Relates To:", the docket number for each individual action to which the document applies, along with the last name of the first-listed plaintiff in said action (
7. The parties shall file a Notice of Related Cases pursuant to Civil L.R. 3-12 whenever a case that should be consolidated into this action is filed in, or transferred to, this District. If the Court determines that the case is related, the clerk shall:
8. Any counsel of record for a party in this action who is not a member of the Bar of this District is hereby admitted to practice
9. Defendant is not required to respond to the complaint in any action consolidated into this action, other than a consolidated complaint or a complaint designated as the operative complaint.
10. Plaintiffs shall file a consolidated complaint as an exhibit to this Stipulation, which shall become the operative complaint when the Court orders these matters consolidated. The consolidated complaint shall be the operative complaint and shall supersede all complaints filed in any of the actions consolidated herein.
11. Defendant shall respond to the consolidated complaint within sixty (60) days after service, unless otherwise agreed upon by the parties. If defendant files any motions directed at the consolidated complaint, the opposition and reply briefs shall be filed within thirty days and forty-five days, respectively, of that response, unless otherwise agreed upon by the parties.
12. The parties shall serve all papers on each other by email, unless otherwise agreed upon by the parties.
THE FOREGOING STIPULATION IS APPROVED AND IS SO ORDERED.AS FOLLOWS:
Before consolidation, the clerk shall relate case numbers 5:10-cv-04809 EJD and 5:13-cv-00093 LHK and reassign the latter to the undersigned. The clerk shall then administratively close case number 5:13-cv-00093 once reassigned. The pending motion to dismiss filed in case number 5:10-cv-04809 HON.EJD EDWARD (Docket Item No. 44) is TERMINATED AS MOOT in light of the forthcoming consolidated complaint.
KASSRA P. NASSIRI (215405), knassiri@nassiri-jung.com, NASSIRI & JUNG LLP, 47 Kearny Street, Suite 700, San Francisco, California 94108, Telephone: (415) 762-3100, Facsimile: (415) 534-3200.
MICHAEL J. ASCHENBRENER (277114), mja@aschenbrenerlaw.com, ASCHENBRENER LAW, P.C., 795 Folsom Street, First Floor, San Francisco, California 94107, Telephone: (415) 813-6245, Fax: (415) 813-6246, ATTORNEYS FOR PLAINTIFFS AND THE PUTATIVE CLASS, Additional Counsel listed on Signature Page.
Plaintiffs Paloma Gaos, Anthony Italiano, and Gabriel Priyev (collectively "Plaintiffs") bring this suit on behalf of themselves and all others similarly situated, and make the following allegations on information and belief, except as to allegations pertaining to Plaintiffs, which are based on their personal knowledge:
1. Plaintiffs bring this class action complaint against Google Inc. ("Google") for storing and intentionally, systematically and repeatedly divulging its users' search queries and histories to third parties via "Referrer Headers." This practice adversely impacts billions of searches conducted by millions of consumers.
2. Google, the largest search engine in the United States, has repeatedly touted the numerous ways in which it protects user privacy, particularly with regard to the terms that consumers search for using the company's search engine. Over protests from privacy advocates, however, Google has consistently and intentionally designed its services to ensure that user search queries, which often contain highly-sensitive and personally-identifiable information ("PII"), are routinely transferred to marketers, data brokers, and sold and resold to countless other third parties.
3. The user search queries disclosed to third parties contain, without limitation, users' real names, street addresses, phone numbers, credit card numbers, social security numbers, financial account numbers and more, all of which increases the risk of identity theft. User search queries also contain highly-personal and sensitive issues, such as confidential medical information, racial or ethnic origins, political or religious beliefs or sexuality, which are often tied to the user's personal information.
4. In many instances, the information contained in disclosed search queries does not directly identify the Google user. Through the reidentification (explained below) or deanonymizing of data, however, the information contained in search queries can and, on information and belief, are associated with the actual names of Google users. Computer science academics and privacy experts are calling for the reexamination of privacy concerns in light of the growing practice and power of reidentification.
5. Google has acknowledged that search query information alone may reveal sensitive PII. And Google has demonstrated that it could easily stop disclosing search query information to third parties, without disrupting the effectiveness of its service to its users, if it wished to do so. But because the real-time transmission of user search queries increases Google's profitability, it chooses not to utilize the demonstrated technology that would prevent the disclosure of its users' PII.
6. Moreover, in October 2011, Google confirmed that it is, in effect, selling individual user search queries to advertisers. In October 2011, Google started proactively scrubbing user search queries from the information it passes on to third parties when some users click on regular, organic search results, but would continue sending search queries to third parties when all users click on paid listings. While this is, in a way, a small win for privacy advocates, it also demonstrates just how valuable the search queries are to Google and others: Google no longer gives away this precious data for free, but will do so when it gets paid for it.
7. Plaintiff Paloma Gaos is a resident of San Francisco County, California. Plaintiff has at all material times been a user of Google's search engine services.
8. Plaintiff Anthony Italiano is a resident of Pasco County, Florida. Plaintiff has at all material times been a registered Google Accounts user and a user of Google's search engine services.
9. Plaintiff Gabriel Priyev is an individual and a citizen of the State of Illinois. Plaintiff has at all material times been a registered Google Accounts user and a user of Google's search engine services, at different times in California and Illinois.
10. Defendant Google Inc. ("Google") is a Delaware corporation that maintains its headquarters in Mountain View, Santa Clara County, California. Google conducts business throughout California and the nation from California. Google makes and implements all relevant decisions, including those at issue in this case, in California. Its Terms of Service and Privacy Policy were decided on and implemented in California.
11. This Court has personal jurisdiction over Google because (a) a substantial portion of the wrongdoing alleged in this complaint took place in this state, (b) Google is authorized to do business here, has sufficient minimum contacts with this state, and/or otherwise intentionally avails itself of the markets in this state through the promotion, marketing and sale of products and services in this state, and (c) in its Terms of Service, to which all Google Account holders who use Google Search, including Plaintiffs, must purportedly assent, Google consents to the personal jurisdiction of this Court:
12. This Court has subject matter jurisdiction pursuant to 28 U.S.C. § 1331, 18 U.S.C. § 2702 and 18 U.S.C. § 2707. This Court has supplemental jurisdiction over the California state law claims pursuant to 28 U.S.C. § 1367.
13. Venue is proper in this District under 28 U.S.C. § 1391(b) and (c). A substantial portion of the events and conduct giving rise to the violations of law complained of herein occurred in this District.
14. Pursuant to Civil Local Rule 3-2(e), this case shall be assigned to the San Jose Division.
15. "Searching" is one of the most basic activities performed in the Internet. Most everyone with access to the Internet uses search engines to find information on the Internet. When using a search engine, users formulate a search query using keywords and phrases reflecting the information sought by the user. The search engine then matches the search query with websites matching the query and provides a list of those matching websites to the user. The user clicks on the link in the resulting list and is redirected to the website containing the sought-after information.
16. Google's core service centers on its proprietary search engine. Google runs millions of servers in data centers around the world and processes over one billions user-generated search requests every day. On information and belief, Google is the most-used search engine in the world and enjoys a market share of over 50% in the United States.
17. Google generates substantial profits from selling advertising. The revenue it generates is derived from offering search technology and from the related sale of advertising displayed on its site and on other sites across the web. On information and belief, nearly 95% of Google's revenue is derived from its advertising programs, with total advertising revenues estimated at $28 billion in 2010, $36.5 billion in 2011, and $43.7 billion in 2012. Google has implemented various innovations in the online advertising market that helped make it one of the biggest advertising platforms in the world.
18. Google AdWords is Google's main advertising product and source of advertising revenue. The AdWords program allows advertisers to select a list of words that, when entered by users in a search query, trigger their targeted ads. When a user includes words that match an advertiser's selections within a search query, paid advertisements are shown as "sponsored links" on the right side of the search results screen. Accordingly, much of Google's advertising revenue depends directly on the search queries that its users run on Google search.
19. Using technology from its wholly-owned subsidiary DoubleClick, Google can also determine user interests and target advertisements so they are relevant to their context and the user that is viewing them. Google's Analytics product allows website owners to track where and how people use their website, allowing in-depth research to get users to go where you want them to go.
20. Third-party search engine optimization ("SEO") companies help businesses design their websites so that users conducting internet search using search engines like Google get search results containing their business at or near the top of the search results page. SEOs accomplish this task by ensuring that a business's relevant pages are designed to work with Google's search algorithms. Google has a symbiotic relationship with SEOs. Google wants relevant results at the top of their search results page, and SEOs want their customers' relevant webpages to appear at the top of Google's search results. To the extent that SEOs are successful in getting their clients' relevant pages to appear at or near the top of Google's search results page, users are more likely to return to Google next time they want to search for information on the internet. And the more people use Google for search, the more revenue Google derives from its advertising business.
21. Google Web History is a free service Google provides to users of Google Search. A user's search queries, search results and/or Referrer Headers form a substantial part of what Google's Terms of Service identify or define as the user's "Web History," which Google stores for users by default.
22. Google Analytics is a free service Google provides to those who manage websites. Analytics allows website managers to see detailed search query and search results reports including user Web History information or search terms. Such information provides valuable business intelligence to third-party website owners, particularly those who buy advertising on Google.com or with Google Adwords.
23. Leading thinkers in the privacy community have long argued that consumers "treat the search [engine] box like their most trusted advisors. They tell the Google search box what they wouldn't tell their own mother, spouse, shrink or priest."
24. Google has always recognized that user trust is paramount to its search business success. To that end, Google adopted "Don't be evil" as its motto, and Google states that its Code of Conduct is one of the ways it puts that motto into practice.
25. Because Google's success depends on gaining the trust of its users, Google's Privacy Policy sets forth representations intended to foster the safety and privacy protection offered by Google's search services. As of October 14, 2005, Google's Privacy Policy
26. In October 2010, Google defined in its Privacy Center FAQ "Personal information" as "information that [the user] provide[s] to us which personally identifies you, such as your name, email address or billing information, or other data which can be reasonably linked to such information by Google" and "Sensitive Information" as "information we know to be related to confidential medical information, racial or ethnic origins, political or religious beliefs or sexuality and tied to personal information. As of April 2012, Google no longer defines "Personal Information" at all in its Privacy Center FAQ.
27. Google also stated in its October 14, 2005 Privacy Policy that "We may share with third parties certain pieces of aggregated, non-personal information, such as the number of users who searched for a particular term, for example, or how many users clicked on a particular advertisement. Such information does not identify you individually."
28. Google's privacy policy was unchanged until October 3, 2010, when it was revised to exclude any statement about how Google shares search queries with third parties. The representations that Google shares information only in "limited circumstances" remained unchanged.
29. On March 1, 2012, Google implemented a new, singular privacy policy for all Google products.
30. Google makes similar representations about the privacy of its users' search queries on its video "Privacy Channel" on YouTube. In October 2010, Google showcased a video on its Privacy Channel that starts with the statement "at Google, we make privacy a priority in everything we do."
31. In 2010, Google reiterated its commitment to user privacy to the Federal Trade Commission. In a letter to the FTC, Google wrote that it "supports the passage of a comprehensive federal privacy law that ... build[s] consumer trust ... enact[s] penalties to deter bad behavior ... include[s] uniform data safeguarding standards, data breach notification procedures, and stronger procedural protections relating to third party access to individuals' information."
32. At all relevant times, Google has maintained a separate privacy policy for Web History (the "Web History Privacy Policy").
33. Google defines "Web History" and "Personal Information" as follows:
34. Google has promised that it will use Web History solely for the benefit of the user or with the user's consent. Google promised to Plaintiffs and the Class at relevant times:
35. At relevant times Google's Terms of Service expressly provided that information entered by a user on Google.com, including Plaintiffs' and other Class members' search terms, remain the property of the user: "Google acknowledges and agrees that it obtains no right, title or interest from you (or your licensors) under these Terms in or to any Content that you submit, post, transmit or display on, or through, the Services"
36. Google's conduct has breached the above-described privacy promises. Contrary to these terms, Google has provided individual search queries, non-aggregated search queries, search queries and results containing personal information, Web History including "search queries" or search terms and "results," and Referrer Headers, to third-parties and advertisers, including via Google Analytics, and not for the benefit of the user experience (i.e., not "to provide you with a seamless experience and to improve the quality of our services" as Google's terms have promised). Rather, Google's conduct was designed to enhance Google's profit and position by peddling user Web History and search queries to third-party website owners via Google Analytics reports, in order to market and expand its Google AdWords advertising services for Google's financial gain.
37. In addition, because Web History and search queries or results constitute and/or contain "personal information," Google's provision of such information through Google Analytics breaches its Privacy Policy. Google agreed to share personal information only in the following limited circumstances, none of which applies here: (1) with user consent — opt-in consent is required; (2) to Google "subsidiaries, affiliated companies or other trusted businesses or persons for the purpose of processing personal information on [Google's] behalf"; and (3) as reasonably necessary to follow applicable law and the like.
38. Additionally, though Google compiles Web History by default, Google has represented that users can "choose to stop storing [their] web activity in Web History either temporarily or permanently" and delete or turn off their Web History:
39. Such terms convey that when Web History is deleted, Google no longer holds onto it or uses it, but rather, "erases," "deletes" and "removes" it from its records.
40. Upon information and belief, in violation of these promises, Google continues to store in its files, and transmit to third-parties via Referrer Headers or Google Analytics, Web Histories even after a user has deleted or turned it off.
41. In 2006, the Department of Justice sought to compel Google to produce thousands of users' individual search queries.
42. To its credit, Google fought the government's request. In a declaration submitted to the court describing the kind of personal information that can end up in the company's search query logs, Matt Cutts, a Senior Staff Engineer who specializes in search optimization issues at Google, stated as follows:
43. Similarly, in its Opposition to the Government's Motion to Compel the disclosure of Google users' search queries, the company argued that:
44. In its order
45. Google's awareness of the privacy concerns surrounding search queries was also demonstrated in response to a massive disclosure of user search queries by AOL. In August 2006, AOL released an "anonymized" dataset of 20 million search queries conducted by 658,000 AOL users over a three-month period.
46. In an article about the incident, the New York Times wrote that the AOL dataset "underscored how much people unintentionally reveal about themselves when they use search engines," and referred to search queries about "depression and medical leave," "fear that spouse contemplates cheating," "child porno," and "how to kill oneself by natural gas."
47. Even more surprising, however, was that the New York Times journalists were able to reidentify individual "anonymized" AOL search users due to the vanity searches they had conducted, and then link other, non-vanity search queries in the dataset to those individuals through the crosssession identifiers (cookies) included in the dataset.
48. An AOL spokesman, Andrew Weinstein, apologized on behalf of AOL and said he wasn't surprised that the New York Times was able to connect the dots and reidentify "anonymous" users in the dataset: "We acknowledged that there was information that could potentially lead to people being identified..."
49. Soon after the release of the search query data by AOL, Google CEO Eric Schmidt spoke about the AOL privacy breach. He called AOL's release of user search data "a terrible thing" and reassured Google users that their search queries were safe and private:
50. Software engineers are generally familiar with the risk of Referrer Header "leakage" of information companies intended to keep confidential and/or are obliged to keep confidential.
51. The HTTP Referrer function is a standard web browser function, provided by standard web browsers since the HTTP 1.0 specification in May 1996.
Internet Explorer, Firefox, Chrome, Safari) by default reports the last page that the user viewed before clicking on a link and visiting the current page — that is, the page that "referred" them to the current page. This information is transmitted in the HTTP Referrer Header.
52. The current version of the publicly-available HTTP specification, RFC 2616,
53. While the HTTP Referrer function is a standard web browser function, Google ultimately determines whether to send referrer header information to third parties and exercises control over the content of the URL that is referred by this function to the owner of the destination web page.
54. Google's use and provision of Referrer Headers for third-party advertising (and without filtering or deleting user information) appears to go well beyond the intended use of this function pursuant to the internet community Hypertext Transfer Protocol. See internet community Hypertext Transfer Protocol—HTTP /1.1, http://tools.ietf.org/html/rfc2616.
55. The Protocol indicates that Referrer information is for the server's benefit to provide service: in the words of the Hypertext Transfer Protocol for internet functions, "The Referrer request-header allows a server to generate lists of back-links to resources for interest, logging, optimized caching, etc. It also allows obsolete or mistyped links to be traced for maintenance." Id. at 14.36. Referrer headers have also been used to provide browsing security. According to the industry Protocol, contrary to Google's practice, "Because the source of a link might be private information or might reveal an otherwise private information source, it is strongly recommended that the user be able to select whether or not the Referrer field is sent." Id. at 15.1.3.
56. Since the service's launch, and continuing to this day, Google's search engine has included its users' search terms in the URL of the search results page. Thus, for example, a search for "abortion clinics in Indianapolis" would return a page with a URL similar to
57. Because the search terms are included in the search results URL, when a Google user clicks on a link from Google's search results page, the owner of the website that the user clicks on will receive from Google the user's search terms in the Referrer Header.
58. Several web analytics services, including SEOs, include and use functionality to automatically parse the search query information from web server logs, or to otherwise collect the search query from the referrer header transmitted by each visitor's web browser. Google's own analytics products provide webmasters with this information at an aggregate level (e.g., revealing how many visitors were drawn by particular search terms).
59. By transmitting user search queries to third parties, Google is also violating its Web History-specific privacy promises as described above.
60. Because Google's financial success depends on, among other things, the symbiotic relationship it shares with SEOs and the ability for third parties to engage in web analytics, Google has placed a high priority on revealing individual user search queries to third parties. Notwithstanding its repeated representations to the contrary in its Privacy Policy and to privacy regulators, Google continues to this day to transmit user search queries.
61. Neither Google's search technology nor the nature of the Internet compels Google to divulge user search queries. Google could easily cease transmission of user search queries to third parties, but chooses not to.
62. On September 6, 2010, a former FTC employee, Christopher Soghoian, filed a complaint with the FTC accusing Google of not adequately protecting the privacy of consumers' search queries. Much of the following information comes from Mr. Soghoian's complaint.
63. Starting approximately in November 2008, Google began to test a new method of delivering search results that uses advanced AJAX (Asynchronous JavaScript and XML) technologies.
64. One of the side effects of the AJAX search page is that the URL of the search results page includes the search query terms after a # symbol in the URL. Thus, on an AJAX enabled search page, the URL listed at the top of the page will be similar to: http://www.google.com/#hl=en&source=hp&q=drug+addiction
65. The addition of the # symbol had a significantly positive, albeit unintentional impact upon Google user privacy. This is because web browsers do not pass on any information after the # symbol in the referrer header. Thus, using the previous example of a search for the query "drug addiction," if a user clicked on the first result, the owner of that web site would only receive "http://www.google.com/" in the referrer header, rather than the search terms that follow the # symbol.
66. This change was immediately noticed by the webmaster and SEO community, who complained to Google:
67. Responding to complaints from the webmaster community, Google quickly issued a public statement:
68. Google soon ended the test of the AJAX search results page, a fact confirmed by Google Senior Engineer Matt Cutts, who specializes in search optimization issues at Google:
69. In March 2009, Google again began to test technology that unintentionally caused the users' search terms to be stripped from the referrer header transmitted to web sites. The following is an example of the format of the new URL that was being tested in March 2009:
70. Michael VanDeMar, a prominent member of the SEO community noticed that he was again seeing AJAX based search results in addition to redirected URLs for every link in the search results page:
71. Google's Matt Cutts soon responded to VanDeMar by leaving a comment on his blog:
72. On April 14, 2009, Google announced that it would be deploying the URL redirection tool for all links in the search results. The company described the details in a blog post to the webmaster community:
73. The redirection tool that Michael VanDeMar described in March 2009 did not include the search terms in its URL (and thus, these terms were not subsequently transmitted to webmasters via the browser's referrer header). However, one month later when Google announced that it would be using the redirection tool for all links, the redirection script was changed to include the search terms in the redirection URL (via a new "q" parameter), thus guaranteeing that webmasters would not lose access to user search query data.
74. The new redirection tool also leaks data to web site administrators that had never before been available to anyone but Google: The item number of the search result that was clicked non (e.g., the 3rd link or 5th link from the search results page).
75. A May 2009 video featuring Matt Cutts, posted to the official GoogleWebmasterHelp YouTube channel, describes the change in the search query information leaked via the referrer header:
76. In or around July 2010, Google again began stripping the search terms from the Referrer Headers transmitted by a small percentage of browsers. On July 13, 2010, individuals in the SEO community noticed the change made by Google. One commentator in a web forum wrote that:
77. On July 13 2010, Matt Cutts posted a message to the same SEO forum:
78. On or about May 21, 2010, Google introduced an encrypted search service at
79. Later, on or about October 18, 2011, Google announced a change in policy for how it handled search queries embedded in Referrer Headers.
80. For users not logged in, Google would still transmit search queries via Referrer Headers to the results sites on which users would click, unless those users entered the search at https://encrypted.google.com.
81. Moreover, the new policy only applies to organic sites. For clicks on paid links or advertisements, Google would still pass on the search queries.
82. If nothing else, Google's new policy regarding search queries demonstrates two things: 1) Google is fully capable of determining independently whether to transmit search queries to third parties—transmitting search queries embedded within Referrer Headers is not just how the Internet works; and, 2) Google is now effectively selling search queries to paying advertisers. Stated differently, part of what paying advertisers pay for when they buy AdWords are the search queries users enter.
83. "Reidentification" is a relatively new area of study in the computer science field. Paul Ohm, a professor of law and telecommunications at the University of Colorado Law School, is a leading scholar on how reidentification impacts internet privacy. Much of the following information comes from Professor Ohm's article entitled "Broken Promises of Privacy: Responding to the Surprising Failure of Anonymizaton" published in the UCLA Law Review in August of 2010.
84. In a nutshell, reidentification creates and amplifies privacy harms by connecting the dots of "anonymous" data and tracing it back to a specific individual. Professor Ohm describes it as follows:
85. Reidentification techniques, like those used in the AOL debacle, can be used as links in chains of inference connecting individuals to harmful facts. Reidentification works by discovery pockets of surprising uniqueness in aggregated data sets. Just as human fingerprints can uniquely identify a single person and link that person with "anonymous" information—a print left at a crime scene—so too do data subjects generate "data fingerprints"—combinations of values of data shared by nobody else. What has surprised researchers is that data fingerprints can be found in pools of non-PII data, such as the uniqueness of a person's search queries in the AOL debacle.
86. Once a person finds a unique data fingerprint, he can link that data to outside information, sometimes called auxiliary information. "Anonymous" search query information would protect privacy, if only the adversary knew nothing else about people in the world. In reality, however, the world is awash in data about people, with new databases created, bought and sold every day. "Adversaries" (as defined above) combine anonymized data with outside information to pry out obscured identities.
87. And the amount of information contained in new databases has grown exponentially. What's more, the type of available data is increasingly personal and specific. Take, for example, the phenomenon of Facebook's growth. The data created by Facebook users is highly personal, and includes actual names, religious, sexual and political preferences, identification of friends, pictures, messages intended to be shared with friends, and more. With the exploding popularity of social network sites like Facebook, and personal blogs, the information available to adversaries is not only highly-specific to individuals, it is often user-created, increasing accuracy and veracity of available data. Never before in human history has it been so easy to peer into the private diaries of so many people. Some researchers call this the "age of self-revelation."
88. Reidentification is characterized by accretion, or the growing together of separate parts into a single whole. As Professor Ohm explains:
89. The accretive reidentification problem is exacerbated by the growing prevalence of internet "data brokers." The buying and selling of consumer data is a multibillion-dollar, unregulated business that's growing larger by the day.
90. On October 25, 2010, the Wall Street Journal reported that a highly-sophisticated data broker, RapLeaf Inc. is accomplishing accretive reidentification of "anonymous" data with astonishing success.
91. Data gathered and sold by data brokers like RapLeaf can be very specific. RapLeaf deanonymizes and connects to real names a wide variety of data types, including data regarding demographics, interests, politics, lifestyle, finances, donations, social networks, site memberships, purchases, and shopping habits. RapLeaf's segments recently included a person's household income range, age range, political leaning, and gender and age of children in the household, as well as interests in topics including religion, the Bible, gambling, tobacco, adult entertainment and "get rich quick" offers. In all, RapLeaf segmented people into more than 400 categories. This aggregated and deeply personal information is then sold to or used by tracking companies or advertisers to rack users across the Internet.
92. One type of anonymization practice is called "release-and-forget," in which the data administrator will release records, and then forgets, meaning she makes no attempt to track what happens to the records after release.
93. Google's transmission of search queries is a type of piecemeal "release-andforget" anonymization.
94. Google itself has taken the position that even seemingly benign, "anonymous" information presents serious privacy concerns. For example, in Gonzales v. Google, supra, n.12, even though the Government was requesting search queries stripped of any "identifying information" (such as the user's IP address), Google argued that releasing such data would nonetheless risk disclosure of user identities.
95. In fact, when a Google user clicks on a link in Google's search results page, the user's search query is not the only information revealed. For the vast majority of Google users, the user's IP address is concurrently transmitted along with the search query. An IP address is similar to a phone number in that it identifies the exact computer being used by the user to search and navigate the internet.
96. In response to an inquiry from Congressman Joe Barton about privacy issues surrounding Google's acquisition of DoubleClick, Google admitted that "information that can be combined with readily available information to identify a specific individual is also generally considered personal information."
97. Similarly, an independent European advisory body on data protection and privacy found that "The correlation of customer behaviour across different personalised services of a search engine provider ... can also be accomplished by other means, based on cookies or other distinguishing characteristics, such as individual IP addresses."
98. Congressman Barton's inquiry in connection with the DoubleClick acquisition also focused on cookies and privacy. Cookies are small data files that store user preferences and other information, and allow websites to recognize the user or computer visiting their site. In its response to Congressman Barton, Google wrote that "online ad-serving technology can be used by advertisers to serve and manage ads across the web ... the ad server sets a cookie on the user's computer browser when the user views an ad served through the ad server. That cookie may be read in the future when the ad server serves other ads to the same browser."
99. In addition to search, Google operates many services that require users to register for Google Accounts. Google Accounts grant access to services such as Gmail, Google Docs, and Google+, among others.
100. Plaintiff Paloma Gaos has a Google Account and has at all material times been a user of Google's search engine services, including the period prior to November 2008 when Google first began to test advanced AJAX technologies that temporarily eliminated user search queries from referrer headers coming from Google search results pages, and for all periods thereafter when Google was disseminating search queries to third party websites.
101. During all time periods in which Google was transmitting user search queries to third parties, Plaintiff Gaos conducted numerous searches, including "vanity searches" for her actual name and the names of her family members, and clicked on links on her Google search results pages.
102. As a result, Google transmitted Plaintiff Gaos's full search queries to third parties by sending the URLs containing her search queries to third party websites that appeared in Plaintiff Gaos's Google search results page and which Plaintiff Gaos clicked on a link.
103. In other words, when Plaintiff Gaos clicked on each link on her Google search results pages, the owner of the destination website that Plaintiff clicked on received from Google Plaintiff Gaos's search terms through the Referral Header function.
104. As a result, Plaintiff Gaos has suffered actual harm in the form of Google's unauthorized and unlawful dissemination of Plaintiff Gaos's search queries, which sometimes contained sensitive personal information, to third parties.
105. Plaintiff Anthony Italiano has at all material times been a user of Google's search engine services, including the period prior to November 2008 when Google first began to test advanced AJAX technologies that temporarily eliminated user search queries from referrer headers coming from Google search results pages, and for all periods thereafter when Google was disseminating search queries to third party websites.
107. During all time periods in which Google was transmitting user search queries to third parties, including the time period from July 2010 to August 2011, Plaintiff Italiano conducted numerous searches on Google's unencrypted search service, including:
108. These searches and the timeframe during which he conducted them are particularly memorable to Plaintiff Italiano because it was during this time that he was going through formal divorce proceedings. Moreover, many of his searches related directly or indirectly to his divorce proceedings—exactly the sort of personal, confidential searches that he did not want disclosed to third parties without his knowledge or consent, and exactly the sort of personal, confidential searches Google described to the federal government in the Gonzales matter.
109. As a result, Google transmitted Plaintiff Italiano's full search queries to third parties by sending the URLs containing his search queries to third party websites that appeared in Plaintiff Italiano's Google search results page and which Plaintiff Italiano clicked on a link.
110. In other words, when Plaintiff Italiano clicked on each link on his Google search results pages, the owner of the destination website that Plaintiff clicked on received from Google Plaintiff Italiano's search terms through the Referral Header function.
111. As a result, Plaintiff Italiano has suffered actual harm in the form of Google's unauthorized and unlawful dissemination of Plaintiff Italiano's search queries, which sometimes contained sensitive personal information, to third parties.
112. Plaintiff Gabriel Priyev has at all material times been a user of Google's search engine services, including the period prior to November 2008 when Google first began to test advanced AJAX technologies that temporarily eliminated user search queries from referrer headers coming from Google search results pages, and for all periods thereafter when Google was disseminating search queries to third party websites.
113. Plaintiff Priyev began using Google search in the fall of 2005, while living in California. Plaintiff Priyev's Web History, kept by Google, reinforces this fact, stretching all the way back to September 2006. Plaintiff Priyev has continued to search using Google in both California, from the Fall of 2005 through the Spring of 2008, and then in Illinois from the Spring of 2008 until the present.
114. Priyev has also had a Google Account at all relevant times.
115. During all time periods in which Google was transmitting user search queries to third parties, Plaintiff Priyev conducted numerous searches, including searches for financial and health information, and clicked on links on his Google search results pages.
116. As a result, Google transmitted Plaintiff Priyev's full search queries to third parties by sending the URLs containing his search queries to third party websites that appeared in Plaintiff Priyev's Google search results page and which Plaintiff Priyev clicked on a link.
117. In other words, when Plaintiff Priyev clicked on each link on his Google search results pages, the owner of the destination website that Plaintiff clicked on received from Google Plaintiff Priyev's search terms through the Referral Header function.
118. As a result, Plaintiff Priyev has suffered actual harm in the form of Google's unauthorized and unlawful dissemination of Plaintiff Priyev's search queries, which sometimes contained sensitive personal information, to third parties.
119. Pursuant to Rule 23 of the Federal Rules of Civil Procedure, Plaintiffs bring these claims on behalf of themselves as individuals and all other similarly situated persons in the following class:
120. The Class is composed of numerous people, whose joinder in this action would be impracticable. The disposition of their claims through this class action will benefit Class members, the parties and the courts. Upon information and belief, Google's search engine has been used by hundreds of millions of users during the relevant time period.
121. There is a well-defined community of interest in questions of law and fact affecting the Class. These questions of law and fact predominate over individual questions affecting individual Class members, including, but not limited to, the following:
122. Google has engaged, and continues to engage, in a common course of conduct giving rise to the legal rights sought to be enforced by Plaintiffs and the Class. Similar or identical statutory and common law violations, business practices and injuries are involved. Individual questions, if any, pale by comparison to the numerous common questions that dominate.
123. The injuries, actual and imminent, sustained by Plaintiffs and the Class flow, in each instance, from a common nucleus of operative facts. In each case, Google caused or permitted unauthorized communications of private and personally-identifying information to be delivered to third parties without adequate or any notice, consent or opportunity to opt out.
124. Given the similar nature of the Class members' claims and the absence of material differences in the statutes and common laws upon which the Class members' claims are based, a nationwide class action will be easily managed by the Court and the parties.
125. Because of the relatively small size of the individual Class members' claims, no Class user could afford to seek legal redress on an individual basis.
126. Plaintiffs' claims are typical of those of the Class as all members of the Class are similarly affected by Google's uniform and actionable conduct as alleged herein.
127. Google has acted and failed to act on grounds generally applicable to Plaintiffs and members of the Class, requiring the Court's imposition of uniform relief to ensure compatible standards of conduct toward the members of the Class.
128. Plaintiffs will fairly and adequately protect the interests of the Class, and have retained counsel competent and experienced in class action litigation. Plaintiffs have no interests antagonistic to, or in conflict with, the Class that Plaintiffs seek to represent.
129. Plaintiffs reserve the right to revise the above class definition as appropriate or based on facts learned in discovery.
130. Plaintiffs incorporate the foregoing allegations as if fully set forth herein.
131. The Electronic Communications Privacy Act (the "ECPA") broadly defines an "electronic communication" as "any transfer of signs, signals, writing, images, sounds, data, or intelligence of any nature transmitted in whole or in party by a wire, radio, electromagnetic, photoelectronic or photooptical system that affects interstate or foreign commerce..." 18 U.S.C. § 2510(12).
132. The ECPA also broadly defines the contents of a communication. Pursuant to the ECPA, "contents" of a communication, when used with respect to any wire, oral, or electronic communications, include any information concerning the substance, purport, or meaning of that communication. 18 U.S.C. § 2510(8). "Contents," when used with respect to any wire or oral communication, includes any information concerning the identity of the parties to such communication or the existence, substance, purport, or meaning of that communication. The definition thus includes all aspects of the communication itself. No aspect, including the identity of the parties, the substance of the communication between them, or the fact of the communication itself, is excluded. The privacy of the communication to be protected is intended to be comprehensive.
133. Pursuant to the ECPA, "electronic storage" means any "temporary storage of a wire or electronic communication incidental to the electronic transmission thereof." 18 U.S.C. § 2510(17)(A).
134. Pursuant to the ECPA, Google operates an "electronic communications service" as defined in 18 U.S.C. § 2510(15). Pursuant to the Stored Communications Act of 1986 (the "SCA"), Google also provides a "remote computing service" to the public. 18 U.S.C. § 2711(2).
135. In relevant part, 18 U.S.C. § 2702(a) of the ECPA provides as follows:
136. As alleged herein, by disclosing the private search queries and Web History information of Plaintiffs and members of the Class without authorization, Google has knowingly divulged the contents of communications of Plaintiffs and members of the Class while those communications were in electronic storage on its service, in violation of 18 U.S.C. § 2702(a)(1).
137. As alleged herein, by disclosing the private search queries and Web History information of Plaintiffs and members of the Class without authorization, Google has knowingly divulged the contents of communications of Plaintiffs and members of the Class carried or maintained on its systems, in violation of 18 U.S.C. § 2702(a)(2).
138. Google intentionally disclosed its users' communications to third parties to enhance its profitability and revenue. The disclosures were not necessary for the operation of Google's systems or to protect Google's rights or property.
139. As a result of Google's unauthorized and unlawful disclosure of Plaintiffs' and the Class members' private search queries and Web History information, Plaintiffs and members of the Class have suffered damages from Google's violations of 18 U.S.C. § 2702 in an amount to be determined at trial.
140. Plaintiffs and Class members are "person[s] aggrieved by [a] violation of [the SCA] in which the conduct constituting the violation is engaged in with a knowing or intentional state or mind..." within the meaning of 18 U.S.C. § 2707(a).
141. Plaintiff and members of the Class therefore seek remedy as provided for by 18 U.S.C. § 2707(b) and (c), including such preliminary and other equitable or declaratory relief as may be appropriate, damages consistent with subsection (c) of that section to be proven at trial, punitive damages to be proven at trial, and attorneys' fees and other litigation costs reasonably incurred.
142. Plaintiffs incorporate by reference the foregoing allegations.
143. The provisions of Google's Terms of Service, which expressly incorporate its Privacy Policy, and Web History Privacy Policy constitute a valid and enforceable contract between Plaintiffs and the Class on the one hand, and Google on the other.
144. Under the Terms of Service, Web History Privacy Policy and Privacy Policy, Plaintiffs and the Class agreed to use Defendant's services and transmit sensitive personally-identifiable information to Google in exchange for Google's promise that it would not share that personal information with third parties without users' authorization.
145. Google materially breached the terms of its Terms of Service, Web History Privacy Policy and Privacy Policy through its unlawful conduct alleged herein, including the disclosure of Plaintiffs and the Class's private search queries and Web History information to third parties, as more fully set forth above.
146. Google's conduct also violates principles of equity and justice, which prohibit Google from retaining the above-described benefits.
147. As a result of Google's misconduct and breaches of Google's Terms of Service, Web History Privacy Policy and Privacy Policy described herein, Plaintiffs and the Class suffered injury. Plaintiffs, on behalf of themselves and the Class, seek damages and/or restitution from Google in an amount to be determined at trial.
148. Plaintiffs incorporate by reference the foregoing allegations.
149. At all times, Google owed Plaintiffs and the Class a duty of good faith and fair dealing.
150. Google delivered search services, and maintained Web History, pursuant to contract, whereby Plaintiffs and other Class members' Web History, Personal Information, search queries, and Referrer Headers were to be stored and used only according to Google's published terms, which promise that their information is private, and is their property, as set forth more fully above.
151. Google abused its discretion as described above for its own benefit, and to the detriment of the property rights and expectations of Plaintiffs and the Class. Google's conduct breached its duty of good faith and fair dealing to Plaintiffs and the Class and damaged Plaintiffs and the Class.
152. Google was unjustly enriched by its aforementioned conduct and Plaintiffs and the Class are entitled to restitution. Google should account for revenues and profits it improperly collected from its transmission of Referrer Headers and Web History information, including from increased Google AdWords business, and should have a constructive trust imposed with respect to such monies until further order of the Court.
153. Plaintiffs incorporate by reference the foregoing allegations.
154. Google has knowingly, voluntarily and willfully received and retained benefits by sharing Plaintiffs' and other Class members' Web History, Personal Information and search queries or results via Referrer Headers and/or Google Analytics, as set forth above, under circumstances that would render it unjust to allow Google to retain such benefits.
155. The benefits received by Google from sharing Plaintiffs and other Class members' Web History, Personal Information and search queries via Referrer Headers and/or Google Analytics were related to the obligation and duty of Google to use such information only as outlined in the Google's Web History Privacy Policy which does not include dissemination to third parties and in Google's other above-described terms of use, and/or as prescribed by applicable law.
156. Google has increased its revenues and profits by peddling Plaintiffs' and the Class members' Personal Information, Web History, Referral Headers, or search terms or results without notice or their consent.
157. Google's above-described conduct violates principles of equity and justice, which prohibits Google from retaining these above-described benefits and constitutes a breach of contract implied in law.
158. As a result, Plaintiffs and other Class members are entitled to disgorgement and restitution of Google's revenues, profits and/or monies received by Google due to Google's use of Plaintiffs' and other Class members' property i.e., their search terms and results.
159. Plaintiffs incorporate by reference the foregoing allegations.
160. Plaintiffs and members of the Class have conferred a benefit upon Google. Google has received and retained valuable information belonging to Plaintiffs and members of the Class, and as a result of sharing its users' search queries with third parties without their consent, Google has improved the quality of its search engine and enjoyed increased revenues from advertisers.
161. Google appreciates or has knowledge of said benefit.
162. Under principles of equity and good conscience, Google should not be permitted to retain the benefits that it unjustly received as a result of its actions.
163. Plaintiffs, on their own behalf and on behalf of the Class, seek the imposition of a constructive trust on and restitution of the proceeds of Google received as a result of its conduct described herein, as well as attorney's fees and costs pursuant to Cal. Civ. Proc. Code § 1021.5.
166. Plaintiffs and the Class are entitled to a declaration of their rights in connection with what Google can and cannot do with their Web History and search queries.
167. Plaintiffs and the Class and Google have adverse legal interests, and there is a substantial controversy between Plaintiffs and the Class, and Google, to warrant the issuance of a declaratory judgment as to whether Google violated applicable law by its above-described practice of sharing Plaintiffs' and other Class members' Referrer Headers, and whether Google is entitled to share the Web Histories of Plaintiffs and the Class with third-parties for its commercial gain, in violation of its preexisting contract and terms of use.
168. Absent injunctive relief, Google is likely to continue its above-described practices, as Google is endowed with all of the discretion to do as it wishes with Plaintiffs' and the Class members' information.
169. As a result of Google's above-described conduct in violation of applicable law, Plaintiffs and the Class are entitled to corresponding injunctive relief, and an order establishing a constructive trust, for the benefit of Plaintiffs and the Class, consisting of monies received by Google from its unlawful sharing of Plaintiffs' and the Class's search queries with third-party persons and entities.
170. Google's new Terms of Use do not directly address preexisting Web History, changes to Web History, or the issues described above leaving Plaintiffs and the Class without any indication of what Google intends to do with the Web Histories belonging to Plaintiffs and the Class creating a need for injunctive relief holding Google to the terms of previous contract with and terms of use for Plaintiffs and the Class described in detail above.
171. As a result of Google's above-described conduct in violation of applicable law, Plaintiffs and the Class are also entitled to an order requiring Google not to use or store preexisting Web History for purposes of profiting by transmitting their information to third-parties.
WHEREFORE, Plaintiffs, on behalf of themselves and the Class, pray that the Court provide the following relief:
B. Declare that Google's actions, as described herein, violate the Stored Communications Act (18 U.S.C. § 2702 et seq.), constitute Breach of Express and Implied Contracts, and unjust enrichment;
C. Award injunctive and other equitable relief as is necessary to protect the interests of Plaintiffs and the Class, including, inter alia, an order declaring the rights of the parties as stated above and prohibiting Google from engaging in the wrongful and unlawful acts described herein;
D. Award damages, including statutory damages where applicable, to Plaintiffs and the Class, in an amount to be determined at trial;
E. Award all economic, monetary, actual, consequential, and compensatory damages caused by Google's conduct, and if its conduct is proved willful, awarding Plaintiffs and the Class exemplary damages;
F. Award restitution against Google for all money to which Plaintiffs and the Class are entitled in equity;
G. Establish a constructive trust, until further order of the Court, consisting of monies Google improperly collected or received from its above-described illicit conduct;
H. Order Google to disgorge revenues and profits wrongfully obtained;
I. Award Plaintiffs and the Class their reasonable expenses and attorneys' fees;
J. Award Plaintiffs and the Class inerest, to the extent allowable; and,
K. Award such other and further relief as equity and justice may require.
Plaintiffs demand a trial by jury for all issues so triable.
