KETANJI BROWN JACKSON, United States District Judge.
Plaintiff Ethel Austin-Spearman is an internet savvy woman. According to her complaint, she became a member of Facebook's social network in 2007, and she frequently accesses that website and others through the web browser on her computer. (See Am. Compl., ECF No. 23, ¶¶ 71-72.) Moreover, whenever Austin-Spearman registers for a new online service, she diligently reads the website's
Before this Court at present is Defendants' motion to dismiss the complaint for lack of Article III standing and for failure to state a claim upon which relief can be granted. For the reasons explained below, this Court finds that the complaint's allegations are insufficient to establish that Defendants' practices regarding user data violate the AARP's internet Privacy Policy, and in any event, it is entirely implausible that Austin-Spearman has suffered the injury she relies upon for standing (an economic injury) as a result of the AARP's purported violation of its internet-usage Privacy Policy. Therefore, the Court concludes that Austin-Spearman does not have Article III standing to sue, and as a result, Defendants' motion to dismiss the complaint will be
In late 2010, longtime Facebook member and an experienced internet user Austin-Spearman navigated to www.aarp.org to learn about AARP membership. (See Am. Compl. ¶¶ 72-73.)
Austin-Spearman purchased a three-year AARP membership for $43 through AARP's website (see id. ¶ 74); then, she proceeded to create an online AARP account (see id. ¶ 77). To establish her account, Austin-Spearman entered the requisite registration information, and she also viewed, and agreed to, AARP's Privacy Policy. (See id. ¶ 77)
The terms of AARP's online Privacy Policy are central to the parties' dispute, and they are recited in detail in Plaintiffs' complaint.
AARP, Your Privacy Rights — Privacy Policy ("AARP Privacy Policy") at Sec. 3, Information We Collect From You, ¶ 2.
AARP Privacy Policy at Sec. 4, Information Collected by Third Parties, ¶ 1. Notably, the third paragraph of Section 4 also specifically cautions that "[i]f you stay logged into your social media accounts ... while visiting our website[,] those social media companies may collect information about you." Id. ¶ 3. Furthermore, in Section 5, the Privacy Policy states that AARP itself "may share your information[,] including your personally identifiable information[,] with companies we hire to provide certain [] services such as ... improving advertising services ... and managing databases or other technology." AARP Privacy Policy at Sec. 5, With Whom Your Information May be Shared, ¶ 7.
Despite these disclosures, Austin-Spearman's complaint alleges that the AARP website violates the express terms of the AARP online Privacy Policy because the AARP website is configured to permit Facebook and Adobe to collect members' PII. (See Am. Compl. ¶¶ 35-55.) Specifically, according to the complaint, "[t]he first sentence [of Section 4, paragraph 1] assures members that AARP only allows certain third parties to collect `nonpersonally identifiable information' from its website[.]" (Id. ¶ 29 (emphasis added).) The complaint also emphasizes that "the last sentence [of the first paragraph of Section 4] presents a hyperlink to another page that, among other things, lists "the specific third party companies that collect data from the site[,]" and that "[n]either Facebook nor Adobe is found on this list." (Id. ¶ 31.)
The technical particulars of how AARP allegedly permits Facebook to collect website users' PII are detailed at length in the Plaintiff's complaint and are not disputed. Suffice it to say here that Facebook's software places "cookies" on a user's computer when a Facebook user opts to remain logged in, and that these cookies interact with certain codes in AARP's website to permit "data about the user's browsing" to "be silently transmitted back to Facebook." (Id. ¶¶ 38-41.)
Austin-Spearman also alleges that Defendants permitted Adobe to collect PII data related to people who visit the AARP website, and that this practice, too, breaches AARP's Privacy Policy. (See id. ¶¶ 46-55.) According to Plaintiff, Adobe collects PII "using a code developed by Adobe that AARP has integrated into its website." (Id. ¶ 46; see also id. ¶¶ 47-48 (explaining that "[t]he process starts with AARP placing a cookie onto the website visitor's computer," and "[i]f the visitor is a registered member, the cookie ... will be populated with PII retrieved from AARP's database.").) "As a member navigates through the AARP website, the special Adobe code forces the member's web browser to extract information from the cookie and transmit it, along with data revealing the online materials being accessed and viewed by the member (i.e., on the AARP website), to Adobe's analytics servers." (Id. ¶ 48.) Plaintiff asserts that, in this way, AARP has provided Adobe with "free rein [sic] to collect information from the cookies stored on members' computers while using the AARP website[,]" and that such information ultimately is used to "display targeted advertisements to members[.]" (Id. ¶ 50.)
The problem with all this, according to Plaintiff, is that "Austin-Spearman did not consent, agree, or otherwise permit AARP to release her PII to any third party company (i.e., outside of those disclosures expressly provided for in AARP's Privacy Policy)," and yet "when she used AARP's website[,] AARP routinely permitted third parties Facebook and Adobe to collect her PII, along with the precise materials that she viewed, the titles of articles read and videos watched on AARP's website[.]" (Id. ¶ 81.) Moreover, "[h]ad AARP informed Austin-Spearman that it allows third parties to collect member PII through the AARP website at the time that she purchased her membership, she either (i) would not have paid for an AARP membership in the first place or (ii) would not have used the AARP website at all (and thus, would give up her paid-for membership benefits only accessible through the website)." (Id. ¶ 82.) The complaint also suggests that Defendants have an ulterior motive for this allegedly intentional and harmful violation of the constraints in their own Privacy Policy: "upon information and belief" AARP "directly profits" from these practices (id. ¶ 53) in at least two ways: (1) "AARP receives royalty payments when members sign up for life insurance plans through... targeted advertisements" that can be generated as a result of the PII collection methods described (id. ¶ 53), and (2) "AARP is able to sell advertising space on its website at a premium price" because its "usage of Adobe's collection methodologies and analytics services ... allows it to serve targeted advertising to its members" (id. ¶ 54).
On July 29, 2014, Austin-Spearman filed the instant lawsuit against AARP and its wholly owned subsidiary, AARP Services Inc. ("collectively, AARP"). (See generally Compl., ECF No. 1.)
On November 10, 2014, Defendants filed the instant motion to dismiss Austin-Spearman's amended complaint. (See Mot. to Dismiss Am. Compl. with Prejudice ("Defs.' Mot."), ECF No. 24.)
Article III of the United States Constitution limits judicial power to "cases" and "controversies." U.S. Const. art. III § 2, cl. 1. "The concept of standing is part of this limitation[,]" Simon v. E. Kentucky Welfare Rights Organization, 426 U.S. 26, 37, 96 S.Ct. 1917, 48 L.Ed.2d 450 (1976); therefore, "[a] showing of standing `is an essential and unchanging' predicate to any exercise of [federal court] jurisdiction[,]" Florida Audubon Soc. v. Bentsen, 94 F.3d 658, 663 (D.C.Cir.1996) (citing Lujan v. Defenders of Wildlife, 504 U.S. 555, 560, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992)). See also Allen v. Wright, 468 U.S. 737, 752, 104 S.Ct. 3315, 82 L.Ed.2d 556 (1984) ("[T]he law of Art. III standing
It is well established that an injury-in-fact is "an invasion of a legally protected interest that is both (a) concrete and particularized and (b) actual or imminent, as opposed to merely conjectural or hypothetical." Humane Soc'y of United States v. Vilsack, 19 F.Supp.3d 24, 34 (D.D.C.2013). Although "[e]conomic harm... is a canonical example of injury[-]in[-]fact sufficient to establish standing[,]" N. Carolina Fisheries Ass'n, Inc. v. Gutierrez, 518 F.Supp.2d 62, 82 (D.D.C. 2007), "[m]erely asking for money does not establish an injury[-]in[-]fact[,]" Rivera v. Wyeth-Ayerst Labs., 283 F.3d 315, 319 (5th Cir.2002). Rather, a cognizable overpayment injury ordinarily relates to the harm that results from there being a "difference between what [plaintiff] contracted for and what she actually received[,]" Sanchez v. Wal-Mart Stores, Inc., No. 06-cv-2573, 2008 WL 3272101, at *3 (E.D.Cal. Aug. 6, 2008); see also Tae Hee Lee v. Toyota Motor Sales, U.S.A., Inc., 992 F.Supp.2d 962, 972 (C.D.Cal.2014) ("There can be no serious dispute that a purchaser of a product who receives the benefit of his bargain has not suffered an Article III injury-in-fact traceable to the defendant's conduct.").
"In reviewing the standing question" in the context of a motion to dismiss under Rule 12(b)(1), a court "must be `careful not to decide the questions on the merits for or against the plaintiff, and must therefore assume that on the merits the plaintiffs would be successful in their claims.'" In re Navy Chaplaincy, 534 F.3d 756, 760 (D.C.Cir.2008) (quoting City of Waukesha v. EPA, 320 F.3d 228, 235 (D.C.Cir.2003)). The court must also accept as true all factual allegations in the complaint, and must "construe the complaint liberally, granting plaintiff the benefit of all inferences that can be derived from the facts alleged." Thomas v. Principi, 394 F.3d 970, 972 (D.C.Cir.2005). However, "the court need not accept factual inferences drawn by plaintiffs if those inferences are not supported by facts alleged in the complaint, nor must the Court accept plaintiff's legal conclusions." Disner v. United States, 888 F.Supp.2d 83, 87 (D.D.C.2012) (internal quotation marks and citation omitted). Moreover, and importantly, "[u]nder Rule 12(b)(1), the Court may dispose of the motion on the basis of the complaint alone, or it may consider materials beyond the pleadings `as it deems appropriate to resolve the question whether it has jurisdiction to hear the case.'" Neighborhood Assistance Corp. of Am. v. Consumer Fin. Prot. Bureau, 907 F.Supp.2d 112, 121 (D.D.C.2012) (quoting Scolaro v. D.C. Bd. of Elections & Ethics, 104 F.Supp.2d 18, 22 (D.D.C.2000)).
When evaluating a motion to dismiss for failure to state a claim upon which relief can be granted under Rule 12(b)(6), a court looks for sufficient facts alleged in the complaint "to raise a right to relief above the speculative level[.]" Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007) (internal quotation marks and citation omitted). "[D]etailed factual allegations" are not necessary
Defendants argue that, for all of Austin-Spearman's alleged surprise and outrage regarding the collection of her PII by Facebook and Adobe through AARP's website, Austin-Spearman has failed to assert any plausible way in which Defendants' information sharing practices have injured her, and thus she lacks Article III standing to pursue this lawsuit. (See Defs.' Mot. at 24-30.)
For the two reasons explained fully below, this Court rejects Austin-Spearman's "economic injury" contention as entirely implausible, even after crediting the allegations in Austin-Spearman's complaint. In short, the Court first concludes that Defendants' alleged violation of their own Privacy Policy could not have injured Austin-Spearman because the complaint fails to establish that any such violation occurred. Moreover, and in any event, the Court finds that compliance with the Privacy Policy was not a term of Austin-Spearman's membership contract with AARP on the facts alleged in the complaint (so its alleged breach could not have given rise to any economic injury), and
Austin-Spearman's first hurdle in making a plausible case that she has suffered economic injury due to the Defendants' violation of the online AARP Privacy Policy is to present allegations that permit an inference that Defendants have, in fact, violated the Privacy Policy. To this end, the complaint quotes parts of the Privacy Policy at length (see Am. Compl. ¶¶ 27-28), and it also describes in extraordinary detail the technical aspects of the manner in which the website permits third parties to gather information using cookies and codes (see id. ¶¶ 34-65). What the complaint does not do, however, is substantiate Plaintiff's repeated bald assertions that AARP's Privacy Policy promises its members that the organization "would not allow third parties to collect their PII." (Id. ¶ 101; see also id. ¶¶ 29, 32, 79, 81-85).
Stated simply, such a promise is not even close to what the actual Privacy Policy says, no matter how many times Plaintiff makes this assertion. (See, e.g., Am. Compl. ¶ 107 (characterizing the Policy as promising that "its members' PII will be kept private").) The purported basis for Plaintiff's fervent belief that the Privacy Policy promises not to release the PII of AARP members is the first paragraph of Section 4, and in particular, the statement that "[w]e may allow third-party analytics companies, research companies, or ad networks to collect nonpersonally identifiable information on our website[.]" (Am. Compl.¶ 28.) According to Plaintiff, this statement "assures members that AARP only allows certain third parties to collect `non personally identifiable information' from its website" (Am. Compl. ¶ 29 (emphasis added); see also Mot. to Dismiss Hr'g Tr. ("Hr'g Tr."), at 8:22-8:24, May 28, 2015)). But that is plainly not what the first sentence of the first paragraph of Section 4 says; indeed, that language does not address the collection or distribution of PII at all.
What is more, when Sections 4 and 5 are read together, and when the document is viewed as a whole, the AARP Privacy Policy tells a completely different story about what happens to member data than the narrative that appears in the allegations of Plaintiff's complaint. This Court agrees with Defendants that, as relevant here, the AARP's Privacy Policy clearly notifies website users of certain things regarding what the organization permits with respect to user data, to wit: (1) that the website collects users' PII, see AARP Privacy Policy at Sec. 3, Information We Collect From You, ¶ 2; (2) that AARP permits certain third parties to collect non-PII data, see id. at Sec. 4, Information Collected By Third Parties, ¶ 1; (3) that if a person stays logged into social media accounts while visiting AARP's website, the social media companies may collect data and information about that person, see id. at Sec. 4, Information Collected by Third Parties, ¶¶ 2-3; and (4) that AARP may share data and information about its members with companies that help AARP with advertising, see id. at Sec. 5, With Whom Your Information May be Shared, ¶ 8.
The bottom line is this: the facts that Austin-Spearman says support a finding that Defendants have violated the AARP's Privacy Policy do not permit any reasonable inference that a violation actually occurred, given the plain and express terms of the Privacy Policy. And because there was no violation on the facts as alleged, Plaintiff cannot have been injured as a result of this purported breach. Cf., e.g., In re Fruit Juice Products Marketing and Sales Practices Litig., 831 F.Supp.2d 507, 512 (D.Mass.2011) (rejecting the plaintiffs' benefit of the bargain theory of standing because "[p]laintiffs received the benefit of the bargain, as a matter of law" where "[p]laintiff[s] paid for fruit juice and they received fruit juice"). For this reason alone, Austin-Spearman's contention that she has Article III standing to sue fails.
Even if one assumes arguendo that AARP violated its own Privacy Policy, this Court finds it entirely implausible that any economic injury to Austin-Spearman resulted from that breach for two reasons.
First of all, the complaint's allegations simply do not establish that AARP's online Privacy Policy was part of the AARP membership agreement. Although Austin-Spearman asserts that her $43 membership fee was partly paid in consideration for the organization's enforceable promise that her PII would be kept private (see Pl.'s Opp'n at 18-19), the complaint lays out a chronology that establishes that Austin Spearman did not even see the AARP Privacy Policy until after she had already become a paid member of AARP — i.e., she first purchased her membership, then signed up for an online account, and then reviewed the Privacy Policy for the first time (see Am. Compl. ¶¶ 72-80). This means that, as Defendants forcefully argue, "the terms of the Privacy Policy could not possibly have factored into the value of her AARP membership (even her subjective belief of the value) when she purchased it." (Defs.' Mot. at 29.)
Moreover, it is well established that not all promises rise to the level of binding contractual obligations. For example, a promise that is offered freely and equally
Second, it is clear on the facts as alleged in Austin-Spearman's complaint that Austin-Spearman actually received the benefit of her bargain with AARP. See Sanchez v. Wal-Mart Stores, Inc., 2008 WL 3272101, at *3 (explaining that a plaintiff only has standing to bring a breach of contract action based on alleged economic injury where she can plausibly allege that she did not receive the benefit of her bargain with the defendant). The complaint explains that the AARP is a membership organization that advocates for people over the age of 50, and that website usage — including the discounts that are only available online — is but one part of the benefits that accrue to members. (See Am. Compl. ¶¶ 1-2.) The complaint does not (and apparently cannot) contend that website usage is the primary benefit of an AARP membership, nor that it is even an essential part of the bundle of rights that are conferred to AARP members, and this flaw is fatal to Austin-Spearman's economic injury theory of standing. See, e.g., Birdsong v. Apple, Inc., 590 F.3d 955, 961 (9th Cir.2009) (dismissing complaint partly on standing grounds because "[t]he plaintiffs' alleged injury in fact is premised on the loss of a `safety' benefit that was not part of the bargain to begin with"); Williams v. Purdue Pharma Co., 297 F.Supp.2d 171, 176 (D.D.C.2003) (dismissing complaint on standing grounds because "[a]lthough the plaintiffs allege a benefit of the bargain theory of injury, they do not allege that [defendant's pain relief drug] failed to provide them effective pain relief" and therefore "it must be assumed that [defendant's pain relief drug] worked for plaintiffs and that consequently they got what they paid for" (internal quotation marks and citations omitted)).
To be sure, the instant complaint struggles valiantly to convey that AARP-website usage was subjectively important to Austin-Spearman herself. (See Am. Compl. ¶ 76 ("[A]t the time [Austin-Spearman] paid for her membership, Austin-Spearman valued her personal privacy
The analysis and holding of In re Science Applications International Corp. Backup Tape Data Theft Litigation ("S.A.I.C."), 45 F.Supp.3d 14 (D.D.C.2014), make clear that Austin-Spearman has failed to mount this standing hurdle. After an unknown thief stole the plaintiffs' personal information and medical records from a technology company that handles data for the federal government, the plaintiffs in S.A.I.C. (who were members of the U.S. military enrolled in certain health care plans) filed a complaint against their health insurance company, the Department of Defense, and several others. See id. at 19. The complaint asserted approximately 20 causes of action, including breach of contract, and with respect to Article III standing, the plaintiffs claimed that the theft had caused them to suffer an economic injury-in-fact due to the diminution in the value of their insurance premiums — in plaintiffs' view, the premiums were tendered in part as consideration for the defendant's promise of keeping their personal health information secure, and thus plaintiffs had paid for a service they did not receive. See id. at 30. The Court rejected plaintiffs' economic injury argument, reasoning that the plaintiffs had "allege[d] that they were paying for `health and dental insurance[,]'" and did not "claim that they were denied coverage or services in any way whatsoever[,]" id. at 30, and they also "ha[d] not alleged facts that show that the market value of their
So it is here. Much like the plaintiffs in S.A.I.C., Austin-Spearman alleges that she paid for an AARP membership — and also that she got one. (See Def.'s Mot. at 28 ("Plaintiff does not allege that she was denied any membership benefit or service for which she paid when purchasing her AARP membership.").) AARP members purchase a set of benefits that includes supporting the AARP's advocacy efforts (see Am. Compl. ¶ 1; Hr'g Tr. at 19:15-16); getting a subscription to the AARP magazine (see Hr'g Tr. at 19:19-20); and accessing "discounts on shopping, dining, and travel as well as financial and insurance-related products and services" (Am. Compl. ¶ 1). Austin-Spearman does not allege that she was denied any of these things; instead, she merely alleges that AARP's privacy protections were not as stringent as she believed they would be. (See, e.g., Am.Compl.¶¶ 83, 108, 123, 135, 138, 156.) This Court finds that, having not established that she actually lost any of the value of her membership, Austin-Spearman has not plausibly claimed that she overpaid for the AARP membership agreement such that she was injured economically and now has standing to sue.
In this Court's analysis, Austin-Spearman's "overpayment" theory of economic injury does not add up. The complaint's allegations do not establish that Defendants' practices regarding PII violate the organization's online Privacy Policy; thus, no cognizable injury possibly could have resulted. Moreover, and in any event, it is entirely implausible that Austin-Spearman overpaid for the membership as a result of the AARP's purported violation of their privacy promises for two reasons. First, the terms of the Privacy Policy — which were not even known to Austin-Spearman at the time she joined the organization — are not a part of the AARP membership contract. And second, even if adherence to the Privacy Policy was a contract term that Defendants breached, the complaint's allegations do not establish that the privacy promises are so essential to the organization's membership agreement that AARP did not render substantial performance such that Austin-Spearman was deprived of the benefit of her bargain. Thus, whatever the merits of Austin-Spearman's case, she has not sufficiently alleged that she overpaid for the AARP membership and thereby suffered an injury-in-fact that gives her Article III standing to sue.