Apple Inc. (“Apple”) made headlines most recently for its $1.05 billion victory over Samsung in patent litigation in the U.S. District Court for the Northern District of California. That victory has overshadowed, for now, another lawsuit against Apple in the Northern District of California alleging that Apple violated consumers’ privacy rights by allowing application developers to collect “personal information” from their “iDevices” (e.g., iPhones, iPads) without the users’ consent.
“In re iPhone Application Litigation,” the lawsuit is notable because it concerns an emerging consumer privacy issue that is working its way through the courts: Do consumers suffer any actual injury when information regarding how their smartphones, tablets and computers are used and where they are located is collected or accessed by third parties?
Plaintiffs in the iPhone Application Litigation allege that Apple violated state and federal laws on behalf of two putative nationwide classes – an “iDevice Class” and “GeoLocation Class.” The iDevice Class consists of all persons in the U.S. who purchased an iPhone and downloaded free applications (commonly known as “Apps”) in the last three years. Plaintiffs allege that class members were damaged because Apple failed to safeguard their personal information as represented in Apple’s privacy policy and without the users’ consent. The personal information includes users’ addresses and current location; the unique device identifier assigned to the iDevice; the users’ gender, age, zip code and time zone; and app-specific information such as which functions on an App were used. Plaintiffs also allege that Apple stored information about cell phone towers and WiFi hotspots on users’ phones that could be used to track their whereabouts. Apple asserts that all of this information is anonymized such that it could not be linked to any individual user. Plaintiffs disagree.
The GeoLocation Class is made up of only those iPhone purchasers who switched off the “Location Services” setting on their iPhones, which they believed would prevent their iPhones from storing information about their physical location and transmitting that information to Apple. Plaintiffs allege that, despite turning off this setting, the iPhones continued to store and send this “geolocation” information to Apple.
In July 2010, about a year before this lawsuit was filed, Apple’s General Counsel sent a letter to Congress explaining its collection and tracking of location data practices in response to a request from Congressmen Joe Barton and Edward Markey. Apple’s letter stated that, to address privacy concerns, users could disable the iPhone’s location collection and tracking features. In 2011, it was widely publicized that, contrary to the representations in Apple’s letter, Apple continued to collect geolocation data even when users disabled these features. Apple claimed that the collection was inadvertent. Some expressed disbelief. Others, like Plaintiffs in the iPhone Application Litigation, sought damages.
Apple Obtains Dismissal of Plaintiffs’ Initial Complaint for Lack of Article III Standing
Apple successfully moved to dismiss Plaintiffs’ first consolidated complaint (filed April 2011) on the ground that Plaintiffs did not have Article III standing because Apple’s allegedly unlawful conduct did not cause any actual injury to Plaintiffs. (For the Court’s order, go to http://scholar.google.com/scholar_case?case=11552215207215157219.) Article III limits the jurisdiction of federal courts to cases where the plaintiff has alleged an actual “case or controversy.” A plaintiff satisfies this requirement by alleging: (1) an “injury in fact” that is “concrete and particularized” and “actual and imminent”, (2) that the injury is “fairly traceable” to the action of the defendant, and (3) that it is likely that the injury will be redressed by a favorable decision on plaintiff’s claim. Friends of the Earth, Inc. v. Laidlaw Envt’l Servs. (TOC), Inc., 528 U.S. 167, 180-81 (2000). Dismissing Plaintiffs’ claims, the Court found that “[d]espite a lengthy Consolidated Complaint, Plaintiffs do not allege injury in fact to themselves.” The Court granted Plaintiffs leave to file an amended complaint to remedy this deficiency.
Plaintiffs File an Amended Complaint; Apple Moves to Dismiss Claiming that Plaintiffs Still Fail to Plead Any Actual Injury
In November 2011, Plaintiffs filed their amended complaint, and Apple again moved to dismiss for lack of Article III standing (among other grounds). Apple made several arguments in support of its standing argument. First, it argued that the Apps developers, not Apple, were responsible for the collection of personal information from users’ iDevices. Thus, Plaintiffs’ injuries, if any, were not fairly traceable to Apple’s conduct. Second, Apple argued that the cell tower and WiFi data stored on iPhones did not cause any injury because the information was used solely to create a nationwide map of cell towers and WiFi hotspots. Third, Apple argued that the collection and transmittal of location information was only a theoretical harm because Plaintiffs did not allege that anyone misappropriated or used the location information to their detriment. Fourth, Apple argued that users agreed to Apple’s privacy policy, which stated that it could collect “non-personal information” from iPhones “to improve products, services and advertising.” Finally, Apple argued that no user could have been harmed because all of the information at issue was anonymous and therefore could not be linked to any specific user.
The Court held that Plaintiffs had Article III standing to assert all of their claims. (For other reasons, principally Plaintiffs’ failure to state a claim, the Court dismissed with prejudice all but two of the ten claims that Plaintiffs brought against Apple. Review the Court’s order at http://scholar.google.com/scholar_case?case=17290609987961065746&q=IN+RE+IPHONE+APPLICATION+LITIG&hl=en&as_sdt=2,36.) This reversed the Court’s position in dismissing Plaintiffs’ initial complaint, and meant that Plaintiffs alleged a “concrete and particularized” injury fairly traceable to Apple’s conduct. The Court noted that Plaintiffs’ initial complaint was deficient because it “relied heavily upon a theory that collection of personal information itself created a particularized injury for the purposes of Article III standing.” Like other courts, it was not persuaded that the “personal information” at issue had “independent economic value,” such that Plaintiffs could have sold it to the highest bidder but for Apple’s or Apps developers’ actions. Plaintiffs’ amended complaint alleged standing because they “articulated additional theories of harm beyond their theoretical allegations.”
Plaintiffs’ additional theories of harm were that the collection, storage and transmittal of personal and geolocation information consumed their iDevices’ resources (such as storage space, battery life and bandwidth) and created an increased risk to the security of “sensitive personal information.” Plaintiffs also alleged that they detrimentally relied on Apple’s representations regarding the privacy protections in place to protect them. As an alternative basis for its decision, the Court held that Apple’s alleged violation of certain statutes, such as the Wiretap Act and the Stored Communications Act, conferred Article III standing to Plaintiffs. This latter holding is based on the premise that in passing a statute like the Wiretap Act, for example, Congress created a personal right to be free from unauthorized interception of electronic communications. The invasion of that right constitutes a concrete injury, regardless of whether or not there are any other consequences of the interception.
Courts, like the Court in the iPhone Application Litigation, Require Concrete Allegations of Actual Harm to Plead Article III Standing
The Court’s holding on the standing issue shows how the law is evolving concerning the collection and use of information, including “anonymized” information, regarding consumers’ use of smartphones and other devices. In separate cases involving JetBlue, Specific Media and Linkedin, courts have declined to find Article III standing where plaintiffs have alleged merely a conjectural harm – e.g., someone could have taken the information at issue and stolen my identity – or some harm based on a diminution of the theoretical value of the information itself, despite attorneys’ citations to expert opinions and scholarly articles expounding on the economic value of such information in the marketplace.
Courts have found Article III standing where plaintiffs allege that the collection or use of the information at issue had a physical impact on the performance of their device. In the Apple case, the Court was not deterred by the fact that the physical impact might be extremely small – Apple asserted that location information occupied at most ¼ of 1% of an iPhone’s storage capacity. Other courts might challenge the plausibility of such allegations. The same judge who ruled on Apple’s motion to dismiss also found Article III standing in a lawsuit against Facebook where Plaintiffs specifically articulated how the information collected and used by Facebook had actual, not merely theoretical, value. In that case, Facebook converted information regarding users’ “likes” of certain products into commercial endorsements ostensibly by those users, which Facebook posted on their friends’ pages as paid advertising. It was not difficult for the court to reason, for pleading purposes, that Facebook had converted its users’ statutory right of publicity for its own financial gain. (For information regarding Facebook’s attempts to settle this lawsuit, see Ron Raether’s blog entry at http://businesslitigationinfo.com/business-litigation/archives/court-rejects-preliminary-approval-of-facebook-settlement-%e2%80%93-is-there-way-to-navigate-mega-sized-class-actions/#more-977.)
The nature of the information at issue and the defendant’s representations regarding that information are also key in assessing whether or not an injury has occurred. In the Apple case, the Court found that Plaintiffs alleged that the security of “sensitive personal information” was at stake, not merely anonymous location information about cell towers and WiFi hotspots. Apple was also caught by its representations regarding users’ ability to switch off the location services on their iPhones, despite the broad disclaimer contained in its privacy policy. If they have not learned this lesson already, technology companies should have engineering vet all representations regarding the privacy features of any product, especially one as complex as a smartphone or tablet computer.
In sum, courts have found that the collection of information about consumers’ use of their smartphones can cause them to suffer a “concrete and particularized” injury under Article III. As in the iPhone Application Litigation, however, courts demand specific, factual allegations that are grounded in real world economics to find Article III standing and will not accept naked assertions that plaintiffs suffered some conjectural or theoretical harm.
