Ninth Circuit Affirms Dismissal of ECPA Claims Against Facebook and Zynga | Practical Law

Ninth Circuit Affirms Dismissal of ECPA Claims Against Facebook and Zynga | Practical Law

In In re: Zynga Privacy Litigation, the US Court of Appeals for the Ninth Circuit held that the plaintiffs failed to state a claim under the Electronic Communications Privacy Act (ECPA) based on the defendants' alleged disclosure to third parties of HTTP referer headers containing only basic identification and address information.

Ninth Circuit Affirms Dismissal of ECPA Claims Against Facebook and Zynga

Practical Law Legal Update 2-567-8546 (Approx. 3 pages)

Ninth Circuit Affirms Dismissal of ECPA Claims Against Facebook and Zynga

by Practical Law Intellectual Property & Technology
Published on 12 May 2014USA (National/Federal)
In In re: Zynga Privacy Litigation, the US Court of Appeals for the Ninth Circuit held that the plaintiffs failed to state a claim under the Electronic Communications Privacy Act (ECPA) based on the defendants' alleged disclosure to third parties of HTTP referer headers containing only basic identification and address information.
On May 8, 2014, in In re: Zynga Privacy Litigation, the US Court of Appeals for the Ninth Circuit affirmed the district court's dismissal of claims against Facebook, Inc. and Zynga Game Network, Inc. in consolidated cases for alleged violations of the Wiretap Act and the Stored Communications Act, two chapters of the Electronic Communications Privacy Act (ECPA) (No. 11-18044, (9th Cir. 2014)). The court held that the plaintiffs in both cases failed to state a claim under the ECPA because neither Facebook nor Zynga disclosed the "contents" of a communication, as required by the ECPA, in disclosing HTTP referer information to third-party advertisers.
Zynga develops game applications that run on Facebook. Until November 2010, Zynga's privacy policy promised not to sell or rent personally identifiable information to any third parties. Facebook sells advertising to third parties who market to specific Facebook users. Facebook's privacy policy states it will not reveal a user's specific identity and that it provides only anonymous information to advertisers. When Facebook or Zynga users click on ads, the website sends the unique user number to the advertising third party.
Plaintiffs alleged that Zynga and Facebook violated the ECPA by disclosing information contained in the referer header. The referer header is a request header that provides the address of the webpage from which the request was sent. It included the user's Facebook IDs and the address of the Facebook page the user was viewing when the user clicked the link to third-party advertisers. The US District Court for the District of Northern California granted Facebook's and Zynga's motions to dismiss under both the Wiretap Act and the Stored Communications Act because both acts allow disclosures to intended recipients and the court read the complaints as alleging that the plaintiffs intended Facebook, Zynga or the third parties to receive the communications. The plaintiffs appealed.
On appeal, the Ninth Circuit affirmed the district court's dismissal but on a different ground. The Ninth Circuit held that in order for plaintiffs to state a claim under the ECPA, they must allege that Facebook and Zynga divulged the "contents" of a communication as required by statute (18 U.S.C. § 2511(3)(a)). The statute defines the "contents" of a communication as "any information concerning the substance, purport, or meaning of that communication" (18 U.S.C. § 2510(8)). The court held that the information disclosed to third-party advertisers in the referer headers were not contents of a communication because:
  • The meaning of the term “contents” under the ECPA refers to the intended message conveyed by the communication and does not include record information regarding the characteristics of the message that is generated in the course of the communication.
  • The referer header information included only basic identification and address information, not a search term or similar communication made by the user which would constitute the “substance, purport or meaning” of a communication and therefore does not constitute the “contents” of a communication.
The court noted that:
  • The statutes at issue expressly allow disclosure of personally identifiable information.
  • Disclosure of personally identifiable information is not the equivalent to an allegation of disclosure of the contents of a communication.
In a separate decision, the court reinstated a state claim against Facebook for alleged breach of its user agreement.