Summary
finding that Plaintiff's "claims therefore fail because she does not quantify the repair cost or cost associated with investigating the alleged damage."
Summary of this case from Law Firm of Omar T. Mohammedi, LLC v. Comput. Assisted Practice Elec. Mgmt. Sols.Opinion
No. 10 Civ. 9183 (DAB)
08-17-2011
SONAL BOSE, Individually, on Behalf of Herself and All Others Similarly Situated, Plaintiffs, v. INTERCLICK, INC.; MCDONALD's USA, LLC; MCDONALD's CORPORATION; CBS CORPORATION; MAZDA MOTOR OF AMERICA, INC.; MICROSOFT CORPORATION; and DOES 1-50, Defendants.
MEMORANDUM AND ORDER
Plaintiff Sonal Bose ("Bose"), individually and on behalf of all others similarly situated, brings suit against Defendant Interclick, Inc. ("Interclick"), an Advertising Network company, and McDonald's USA LLC, McDonald's Corp., CBS Corp., Mazda Motor Corp. of America, Inc., Microsoft Corp., and Does 1-50 (collectively, the "Advertiser Defendants") under the Computer Fraud and Abuse Act ("CFAA"), New York General Business Law Section 349, and New York State common law. All Defendants move to dismiss on the grounds that Plaintiff fails to allege cognizable injury or meet the $5,000.00 threshold to state a claim under the CFAA, and that Plaintiff's state law claims fail as a matter of law. For the reasons below, Defendants' Motions to Dismiss are GRANTED in part and DENIED in part.
I. BACKGROUND
The facts and allegations are set forth in Bose's Amended Complaint ("Am. Compl."). Bose's factual assertions are assumed true for the purposes of this motion.
Bose is a resident of the city, county, and state of New York. (Am. Compl. ¶ 7.) Bose is a consumer who frequently uses the Internet. (Id. ¶ 76.)
Interclick is an "Advertising Network" company. (Id. ¶¶ 8, 24.) Interclick purchases advertisement display space from websites, and displays advertisements of interest to a computer user. (Id. ¶ 30.) Websites on the Internet frequently display third-party advertisements. (Id. ¶ 30.) These websites sell advertising display space either directly to advertisers or to Advertising Network companies like Interclick. (Id. ¶¶ 24-25.) Interclick's clients are advertising companies and agencies that pay fees to Interclick to display their advertisements on websites within Interclick's advertising network. (Id. ¶¶ 21, 24.)
Many Advertising Network companies use "browser cookies," which are text files that gather information about a computer user's internet habits. (Am. Compl. ¶ 30.) Browser cookies contain unique identifiers and associate "browsing history information" with particular computers. (Id. ¶ 30.) Advertising Networks use this browsing history information to create "behavioral profiles." When a computer user visits a web page on which the Advertising Network provides advertisements, the Advertising Network company uses a behavioral profile to select particular advertisements to display on that computer. (Id. ¶ 30.) Computer users can delete these browser cookies to prevent third parties from associating the user's browsing history information with their subsequent web activity. (Id. ¶¶ 32, 82.)
Bose, however, alleges that Interclick used "flash cookies" (or Local Shared Objects ("LSOs")) to back up browser cookies. (Am. Compl. ¶ 39.) When a computer user deletes a browser cookie, the flash cookie "respawns" the browser cookie without notice to or consent of the user. (Id. ¶ 39.) The flash cookie "may be" larger than a browser cookie. (Id. ¶ 88.) In October 2010, Bose examined her computer and found a flash cookie placed there from Interclick. (Id. ¶ 77.)
Bose also alleges that Interclick used "history sniffing" code invisible to the computer user. (Am. Compl. ¶ 47.) This code, which contained a list of Web page hyperlinks, used the computer's browser to determine whether the computer had previously visited those hyperlinks, and transmitted the results to Interclick's servers. (Id. ¶ 47.) Interclick used data on the computer's browsing history to select particular advertisements to display on that computer. (Id. ¶ 47.)
On December 8, 2010, Bose filed suit against Interclick. A suit against the Advertiser Defendants followed on December 23, 2010, and those cases were consolidated with the filing of the First Amended Complaint on March 21, 2011. Plaintiff alleges that Interclick violated the CFAA by monitoring Plaintiff's web browsing. (Id. ¶ 1.) Bose alleges that the Defendants invaded her privacy, misappropriated personal information, and interfered with the operation of her computer. (Id. ¶ 3.) On April 18, 2011, all Defendants moved to dismiss for failure to state a claim under Federal Rule of Civil Procedure 12(b)(6).
II. DISCUSSION
A. Legal Standard for Motion to Dismiss
For a complaint to survive dismissal under Rule 12(b)(6), iff must plead "enough facts to state a claim to relief that is plausible on its face." Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). "A claim has facial plausibility," the Supreme Court has explained,
[W]hen the Plaintiff pleads factual content that allows the court to draw the reasonable inference that the Defendant is liable for the misconduct alleged. The
plausibility standard is not akin to a "probability requirement,' but it asks for more than a sheer possibility that a Defendant has acted unlawfully. Where a complaint pleads facts that are 'merely consistent with' a Defendant's liability, it "stops short of the line between possibility and plausibility of "entitlement to relief.'"Ashcroft v. Iqbal, 129 S. Ct. 1937, 1949 (2009) (quoting Twombly, 550 U.S. at 556-57). "[A] Plaintiff's obligation to provide the grounds of his entitlement to relief requires more than labels and conclusions, and a formulaic recitation of the elements of a cause of action will not do." Twombly, 550 U.S. at 555 (internal quotation marks omitted). "In keeping with these principles," the Supreme Court has stated,
"a court considering a motion to dismiss can choose to begin by identifying pleadings that, because they are no more than conclusions, are not entitled to the assumption of truth. While legal conclusions can provide the framework of a complaint, they must be supported by factual allegations. When there are well-pleaded factual allegations, a court should assume their veracity and then determine whether they plausibly give rise to an entitlement to relief."Iqbal, 129 S. Ct. at 1950.
In ruling on a 12(b)(6) motion, a court may consider the complaint as well as "any written instrument attached to the complaint as an exhibit or any statements or documents incorporated in it by reference." Zdenek Marek v. Old Navy (Apparel) Inc., 348 F. Supp. 2d 275, 279 (S.D.N.Y. 2004) (citing Yak v. Bank Brussels Lambert, 252 F.3d 127, 130 (2d Cir. 2001) (internal quotations omitted)), B. The Computer Fraud and Abuse Act
The CFAA provides, in pertinent part, "[w]hoever intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains information from any protected computer . . . shall be punished." 18 U.S.C. § 1030(a)(2)(C). Under § 1030(a)(5)(C), the CFAA also subjects to criminal liability someone who "intentionally accesses a protected computer without authorization, and as a result of such conduct, causes damage."
Although the CFAA is a criminal statute, it also provides a civil remedy. Under the civil enforcement provision of the CFAA, "[a]ny person who suffers damage or loss by reason of a violation of this section may maintain a civil action against the violator to obtain compensatory damages and injunctive relief or other equitable relief." 18 U.S.C. § 1030(g); see also Nexans Wires S.A. v. Sark-USA, Inc., 166 Fed. App'x 559, 562 (2d Cir. Feb. 13, 2006) (recognizing that a Plaintiff can only bring a civil action if the Plaintiff satisfies one of five factors set forth in § 1030(c)(4)(A)(i) ). The relevant factor in this case is whether Defendants' conduct caused "loss to 1 or more persons during any 1-year period . . . aggregating at least $5,000 in value." § 1030(c)(4)(A)(i)(I).
The five factors set forth in 18 U.S.C. § 1030(c)(4)(A)(i) are:
(I) loss to 1 or more persons during any 1-year period (and, for purposes of an investigation, prosecution, or other proceeding brought by the United States only, loss resulting from a related course of conduct affecting 1 or more other protected computers) aggregating at least $5,000.00 in value;
(II) the modification or impairment, or potential modification or impairment, of the medical examination, diagnosis, treatment, or care of 1 or more individuals;
(III) physical injury to any person;
(IV) a threat to public health or safety; and
(V) damage affecting a computer used by or for an entity of the United States Government in furtherance of the administration of justice, national defense, or national security.
1. Damage or Loss under the CFAA
The CFAA defines "damage" as "any impairment to the integrity or availability of data, a program, a system, or information." § 1030(e)(8). "Loss," in turn, includes "any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service." § 1030(e)(11). In addition, any damage or loss must meet the $5,000.00 minimum statutory threshold specified in § 1030(c)(4)(A)(i)(I). Reaister.com, Inc. v. Verio, 356 F.3d 393, 439 (2d Cir. 2004) (citing In re Doubleclick Inc. Privacy Litig., 154 F. Supp. 2d 497, 520-23 (S.D.N.Y. 2001)).
Here, Bose pleads three types of damage or loss: (1) damage due to impairment of Bose's computer and computer-related services and resources; (2) loss due to Interclick's collection of personal information from Bose; and (3) loss due to an interruption of Bose's Internet service. (Am. Compl. ¶¶ 94-116.)
a. Damage to Computer-Related Resources
With regard to damage or impairment of a computer system, physical damage to a computer is not necessary to allege damage or loss. EF Cultural Travel BV v. Explorica, Inc., 274 F.3d 577, 585 (1st Cir. 2001) (noting that instances of physical damage to computers are likely to become less common while the value and cost of maintaining computer security are increasing); see also Tyco Int'l (US) Inc. v. John Does 1-3, No. 01 Civ. 3856, 2003 WL 21638205, at *1 (S.D.N.Y. July 11, 2003). Any loss incurred from "securing or remedying" a computer system after an alleged CFAA violation still constitutes loss. In re Doubleclick Inc. Privacy Litig., 154 F. Supp. 2d 497, 524 (S.D.N.Y. 2001) ("S. Rep. No. 104-357 seems to make clear that Congress intended the term 'loss' to target remedial expenses borne by victims that could not properly be considered direct damage caused by a computer hacker."). Accordingly, Courts have sustained claims where a Defendant accessed a Plaintiff's computer system in order to copy the Plaintiff's system for the Defendant's own competitor computer system. I.M.S. Inquiry Mqmt. Sys., Ltd. v. Berkshire Info., 307 F. Supp. 2d 521, 525 (S.D.N.Y. 2004) (finding that harm to the integrity of plaintiff's data system constitutes loss).
Courts have found that losses include the costs of seeking to "identify evidence of the breach, assess any damage it may have caused, and determine whether any remedial measures were needed to rescue the network." Univ. Sports Pub. Co. v. Playmakers Media Co., 725 F. Supp. 2d 378, 388 (S.D.N.Y. 2010); see also Ipreo Holdings LLC v. Thomson Reuters Corp., No. 09 CV 8099(BSJ), 2011 WL 855872, *7 (S.D.N.Y. Mar. 8, 2011) (holding that a Plaintiff can meet the loss requirement through "damage assessment and/or remedial measures, even without pleading actual damage"); Kaufman v. Nest Seekers, LLC, No. 05 CV 6782(GBD), 2006 WL 2807177, at *8 (S.D.N.Y. Sept. 26, 2006) (denying motion to dismiss because "costs involved in investigating the damage to [a] computer system may constitute . . . loss"); see also I.M.S. Inguiry Mgmt. Sys., Ltd., 307 F. Supp. 2d 521 at 526 (holding that a Plaintiff sufficiently alleged loss where Defendant's unauthorized activity "forced Plaintiff to incur costs of more than $5,000 in damage assessment and remedial measures").
Here, Bose fails to quantify any damage that Interclick caused to her "computers, systems or data that could require economic remedy." See In re Doubleclick Inc. Privacy Litig., 154 F. Supp. 2d at 521. Bose alleges that Interclick impaired the functioning and diminished the value of Bose's computer in a general fashion (See Am. Compl. ¶ 115), but fails to make any specific allegation as to the cost of repairing or investigating the alleged damage to her computer. See Fink v. Time Warner Cable, No. 08 Civ. 9628(LTS)(KNF), 2009 WL 2207920, *4 (S.D.N.Y. July 23, 2009) (dismissing a CFAA claim because Plaintiff only alleged that Defendant caused damage by "impairing the integrity or availability of data and information," which was "insufficiently factual to frame plausibly the damages element of Plaintiff's CFAA claim"); see also Czech v. Wall St. on Demand, Inc., 674 F. Supp. 2d 1102, 1118 (D. Minn. 2009) (holding that a Plaintiff's claim that unwanted text messages "caused the wireless devices of [Plaintiff] to slow and/or lag in operation" and "impair[] the availability of and interrupt[] the wireless-device service," was conclusory). Bose's claims therefore fail because she does not quantify the repair cost or cost associated with investigating the alleged damage.
b. Collection of Personal Information
Bose's allegations concerning "invasion of [her] privacy," "trespass," and "misappropriation of confidential data" are also not cognizable economic losses. See In re Doubleclick Inc. Privacy Litig., 154 F. Supp. 2d at 524 n.33; see also S. Rep No. 101-544 (1990) (noting that the CFAA is limited to "economic damages," except for violations related to medical records).
Only economic damages or loss can be used to meet the $5,000.00 threshold. In re Doubleclick Inc. Privacy Litig., 154 F. Supp. 2d at 519 (holding that computer users' demographic information were not compensable "economic damages"); see also Civic Ctr. Motors, Ltd. v. Mason St. Imp. Cars, Ltd., 387 F. Supp. 2d 378, 382 (S.D.N.Y. 2005) (holding that lost profits from defendant's unfair competitive edge were not economic damages under the CFAA). The limit based on economic damages under the CFAA "precludes damages for death, personal injury, mental distress, and the like." Creative Computing v. Getloaded.com LLC, 386 F.3d 930, 935 (9th Cir. 2004).
Here, Bose alleges loss from Interclick's collection of her personal information without her permission through flash cookies and history sniffing code. (Am. Compl. ¶¶ 94-109.) Unlike in Doubleclick, where Plaintiffs could "easily and at no cost prevent [the Defendant] from collecting information by simply selecting options on their browsers or downloading an 'opt out' cookie," Bose alleges that Interclick circumvented "browser privacy controls" without her consent. (Am. Compl. ¶ 79); see 154 F. Supp. 2d at 521.
This Court is not persuaded by Plaintiff's attempt to distinguish Doubleclick. In LaCourt v. Specific Media, Inc., a court in the Central District of California dismissed a CFAA claim by plaintiffs who alleged that they set "privacy and security controls" on their computers to block and delete third party cookies, and that the defendant had a "Flash cookie" installed on plaintiffs' computers without notice or consent. See LaCourt v. Specific Media, Inc., No. SACV 10-1256-GW(JCGx), 2011 WL 1661532, at *1 (C.D. Cal. Apr. 28, 2011). Finding that plaintiffs had failed to allege economic injury, the court noted,
the Complaint does not identify a single individual who was foreclosed from entering into a 'value-for-value exchange' as a result of [defendant's] alleged conduct. Furthermore, there are no facts in the [complaint] that indicate that the Plaintiffs themselves ascribed an economic value to their unspecified personal information. Finally, even assuming an opportunity to engage in a 'value-for-value exchange,' Plaintiffs do not explain how they were 'deprived' of the economic value of their personal information simply because their unspecified personal information was purportedly collected by a third party.
LaCourt, 2011 WL 1661532, at *5.
The deficiencies noted by the court in LaCourt are also present here.
Furthermore, as noted by the court in Doubleclick, personal data and demographic information concerning consumers are constantly collected by marketers, mail-order catalogues and retailers. In re Doubleclick Inc. Privacy Litig., 154 F. Supp. 2d at 525. The collection of demographic information does not "constitute[] damage to consumers or unjust enrichment to collectors." Id. Advertising on the Internet is no different from advertising on television or in newspapers. Id. Even if Bose took steps to prevent the data collection, her injury is still insufficient to meet the statutory threshold. See LaCourt, 2011 WL 1661532, at *5 (holding that a Plaintiff's inability to delete or control cookies may constitute de minimis injury, but such injury was still insufficient to meet the $5,000.00 threshold).
The court's reasoning in Doubleclick is still persuasive, as the court concluded in LaCourt:
While Plaintiffs attempt to distinguish Doubleclick on the ground they have alleged that they were deprived not of "mere demographic information," but "of the value of their personal data," it is not clear what they mean by this. Defendant observes that, if anything, the Plaintiffs in Doubleclick alleged that the Defendant collected much more information than Specific Media supposedly collected in this case, including "names, e-mail addresses, home and business addresses, telephone numbers, searches performed on the Internet, Web pages or sites visited on the Internet and other communications and information that users
would not ordinarily expect advertisers to be able to collect."
Id. (citing In re Doubleclick Inc. Privacy Litig., 154 F. Supp. 2d at 503).
Bose's claim that Interclick collected her personal information therefore does not constitute cognizable loss sufficient to meet the $5,000.00 statutory threshold.
c. Interruption of Service.
Bose also fails to allege specific damage or loss incurred due to alleged interruption of service, or costs incurred to remedy the alleged interruption of service. (Am. Compl. ¶ 111-116.) Even if a flash cookie may reach up to 100 kilobytes in size and may occupy space on Bose's hard drive, Bose fails to demonstrate that the flash cookie caused damage, a slowdown, or a shutdown to her computer. See Czech, 674 F. Supp. 2d at 1117 (holding that damage caused by an "impairment of performance" of a cell phone occurs only when the "cumulative impact of all calls or messages at any given time exceeds the device's finite capacity so as to result in a slowdown, if not an outright 'shutdown,' of service"). Thus, Bose's claim of interruption of service is insufficient to meet the $5,000.00 statutory threshold for loss.
2. Aggregation
Bose alleges that when her claims and other class members' claims are aggregated, the $5,000.00 threshold is met. (Am. Compl. ¶¶ 120, 150.)
The Second Circuit has not yet addressed whether losses can be aggregated for purposes of the CFAA before a class is certified, but it has indicated approval of Doubleclick's thorough exploration of the CFAA. Register.com, Inc., 35 6 F.3d at 439-440 (noting in Doubleclick "excellent statutory construction analysis and thorough exploration of legislative history"). In Doubleclick, the court concluded that damage and loss may only be "aggregated across victims and over time" for a "single act." 154 F. Supp. 2d at 523 (declining to aggregate claims that defendant placed cookies on multiple computers and noting that the CFAA defines damage in § 1030(e)(8) in the singular form, "any impairment to the integrity or availability of data, a program, a system, or information," rather than the plural form, "any impairments to the integrity or availability of data, programs, systems, or information"); see also S. Rep. No. 99-132, at 5 (1986) (explaining that loss caused by the "same act" can be aggregated to meet the $5,000.00 threshold). Plaintiff's claims that Interclick placed cookies on multiple computers could not be aggregated to reach the $5,000.00 threshold under the reasoning in Doubleclick.
Moreover, even if a plaintiff represents a class, she must still demonstrate that she herself has been personally injured. Lewis v. Casey, 518 U.S. 343, 357 (1996); see also In re America Online, Inc., 168 F. Supp. 2d 1359, 1374-75 (S.D. Fla. 2001) (dismissing a CFAA claim even if damages can be aggregated across multiple computers because Plaintiff failed to specify individuals who suffered the loss, whether they were individuals within the class, outside the class or named representatives).
Some courts in the Ninth Circuit have concluded that damages can be aggregated across multiple computers. The court in In re Toys R Us, Inc., Privacy Litig., explained aggregation: "Certain types of malicious mischief may cause smaller amounts of damage to numerous individuals, and thereby collectively create a loss of more than $1,000." No. 00 Civ. 2746, 2001 WL 34517252, at *11 n.20 (N.D. Cal. Oct. 9, 2001) (quoting Sen. Rep. No. 99-132). The court concluded that because the committee referred to "numerous individuals," damages across multiple computers could be aggregated. Id. (holding that when "Defendants caused an identical file to be implanted in each of the Plaintiffs' computers, resulting in damages of a uniform nature," Plaintiffs could aggregate "damages exceeding $5,000 during any one-year period to one or more individuals"). Under this reasoning, multiple intrusions across a one-year period can cause a single impairment to data, and the statute does not limit impairment to the result of a single intrusion or a single corrupted byte. Creative Computing, 386 F.3d at 934-35.
Nevertheless, courts within the Ninth Circuit to have considered the question subsequently have raised doubts concerning whether even after aggregation, Plaintiffs can meet the $5,000.00 threshold when they allege damages similar to those alleged in this case. See LaCourt, 2011 WL 1661532, *6 (finding that Plaintiffs "failed to plausibly allege that they and the putative class--even in the aggregate--have suffered $5,000 in economic damages in a one year period as a result of [the Defendant's] actions"). As in LaCourt, Plaintiff here has failed to allege facts that would allow this Court to conclude that damages meet the $5,000.00 threshold, even when aggregated across the putative class.
Accordingly, Bose's Amended Complaint must be dismissed because she failed to assert personal economic loss under the CFAA.
C. State Law Claims
Plaintiff claims that this Court has jurisdiction over the remaining state law claims under the Class Action Fairness Act of 2005, 28 U.S.C. § 1332 (hereinafter, "CAFA"), because the aggregate claims of Plaintiff and the proposed Class exceed $5,000,000.00, there is minimal diversity of citizenship between Defendants and the proposed Class, and the Classes each consist of more than one hundred members. (Am. Compl. ¶ 16.) Defendants move to dismiss the state law claims on the grounds that Plaintiff has failed to meet the $5,000,000.00 threshold, and that Plaintiff has failed to state a claim under the relevant state laws.
As an initial matter, this Court notes that Plaintiff's failure to meet the $5,000.00 threshold under the CFAA is not, as Defendants argue, necessarily fatal to Bose's attempt to assert CAFA jurisdiction over her state law claims. Damages under the CFAA are narrowly defined, and Plaintiff and the Class Members may be entitled to damages under state law that are not cognizable under the CFAA. This Court must therefore address Plaintiff's state law claims.
i. New York General Business Law § 349
Plaintiff alleges that Defendants' information collecting activities constitute a deceptive business act or practice under Section 349 of the New York General Business law. (Am. Compl. ¶ 155.) Section 349 was originally enacted as a broad consumer protection measure. See Stutman v. Chemical Bank, 95 N.Y.2d 24, 28 (N.Y. 2000); N.Y. Gen. Bus. Law. § 349 (McKinney 2011). To state a claim under Section 349, a plaintiff must demonstrate three elements: "first, that the challenged act or practice was consumer-oriented; second, that it was misleading in a material way; and third, that the plaintiff suffered injury as a result of the deceptive act." Id. at 29; see also Oswego Laborers' Local 214 Pension Fund v. Marine Midland Bank, 85 N.Y.2d 20, 25 (N.Y. 1995). The deceptive practice must be "likely to mislead a reasonable consumer acting reasonably under the circumstances." Oswego, 85 N.Y.2d at 26. "The phrase deceptive acts or practices" under the statute is not the mere invention of a scheme or marketing strategy, but the actual misrepresentation or omission to a consumer." Goshen v. Mutual Life Ins. Co. of N.Y., 98 N.Y.2d 314, 325 (N.Y. 2002). In addition, a plaintiff must prove "actual" injury to recover under the statute, though not necessarily pecuniary harm. Oswego, 85 N.Y.2d at 26.
Plaintiff alleges that Defendant Interclick used LSOs and browser history sniffing code to circumvent consumers' ordinary browser privacy and security settings on their computers. (Am. Compl. ¶ 156.) This conduct misled consumers into believing their digital information was private when in reality it was being tracked without their knowledge, (Am. Compl. ¶ 157.) Plaintiff alleges that consumers were harmed in that they suffered "the loss of privacy through the exposure of the [sic] personal and private information and evasion of privacy controls on their computers." (Am. Compl. ¶ 160.)
Interclick first argues that Plaintiff cannot meet the second element of a claim under Section 349 because Plaintiff has failed to allege misleading conduct on the part of Interclick. Interclick argues that as Plaintiff was unaware of Interclick's actions while they were occurring. Plaintiff could not have been misled into entering into any consumer transaction. (Interclick Mem. L., p. 18.) Interclick would thus have this Court interpose a reliance element into the Section 349 analysis. The New York Court of Appeals has specifically rejected that proposition. See Stutman, 95 N.Y.2d at 30 ("Plaintiffs need not additionally allege that they would not otherwise have entered into the transaction.")
In its reply papers, Interclick modifies its argument slightly, contending that Plaintiff fails to allege any misrepresentation or omission by Interclick to Plaintiff. (Interclick Rep. Mem. L., at 8.) Although the paradigmatic case under Section 349 involves a business making a false or misleading statement in advertising aimed at consumers, see, e.g., Waldman v. New Chapter, Inc., 714 F. Supp. 2d 398, 405 (E.D.N.Y. 2010), courts have allowed claims under Section 349 where misleading statements are made to third parties resulting in harm to consumers. See Securitron Maqnalock Corp. v. Schnabolk, 65 F.3d 256, 264 (2d Cir. 1995) (finding false statements by a competitor to a regulatory agency actionable under Section 349), Kuklachev v. Gelfman, 600 F. Supp. 2d 437, 476 (E.D.N.Y. 2009) ("The relevant question 'is whether the matter affects the public interest in New York, not whether the suit is brought by a consumer.'") (quoting Securitron, 65 F.3d at 257). A claim under Section 349 need not, as Interclick argues, involve an allegation of a deceptive statement made by Interclick to Plaintiff. It need only allege that Interclick engaged in a deceptive practice that affected the consuming public. Plaintiff has alleged as much.
Interclick next claims that Plaintiff has failed to allege any injury as a result of any misleading act or omission. To state a claim under Section 349, a plaintiff must allege "actual" injury, though not necessarily pecuniary injury. Stutman, 95 N.Y.2d at 29. Although collection of personal information does not constitute "economic" injury for purposes of the CFAA, courts have recognized similar privacy violations as injuries for purposes of Section 349. See Meyerson v. Prime Realty Services, LLC, 7 Misc.3d 911, 920 (N.Y.Sup.Ct. 2005) ("[I]t cannot be doubted that a privacy invasion claim—and an accompanying request for attorney's fees-may be stated under [Section] 349 based on nonpecuniary injury . . ."); Anonymous v. CVS Corp., 728 N.Y..2d 333, 340 (N.Y.Sup.Ct. 2001) (allowing Section 349 claim for violation of privacy when local pharmacy transferred prescription records to a national chain without advance notice to consumers).
Plaintiff has therefore adequately pled a claim under Section 349 with respect to Defendant Interclick. Nevertheless, Plaintiff has not alleged any facts demonstrating that the Advertiser Defendants were involved in any of the allegedly deceptive conduct. Therefore, Defendant Interclick's Motion to Dismiss as to Plaintiff's Section 349 claim is DENIED, and the Advertiser Defendants' Motion to Dismiss the Section 349 claim is GRANTED.
ii. Trespass to Chattels
Plaintiff appears to allege two potential grounds for a trespass to chattels claim: first, that Defendants' have dispossessed Plaintiff and the other Class Members of the economic value of their personal information, and second, that Defendants' impaired the value of Plaintiff's and the other Class Members' computers by installing Flash LSOs and browser history sniffing code on those computers. (Am. Compl. ¶¶ 168-170.)
A trespass to chattels occurs when a party intentionally, and without justification or consent, physically interferes with the use and enjoyment of personal property in another's possession, and thereby harms that personal property. In re JetBlue Airways Corp. Litig., 379 F. Supp. 2d 299, 327 (E.D.N.Y. 2005); see also Register.com, Inc. v. Verio, Inc., 356 F.3d 393, 404 (2d Cir. 2004). Nevertheless, "one who intentionally interferes with another's chattel is liable only if the interference results in harm to 'the [owner's] materially valuable interest in the physical condition, quality, or value of the chattel, or if the [owner] is deprived of the use of the chattel for a substantial time.'" School of Visual Arts v. Kuprewicz, 771 N.Y.S.2d 804, 807-08 (N.Y.Sup.Ct. 2003) (citing Restatement 2d of Torts § 218, Comment e.)
Although Plaintiff's claim that she was dispossessed of the economic value of her personal information is of dubious merit, see discussion of CFAA claim, supra; JetBlue, 379 F. Supp. 2d at 328-329, Plaintiff's trespass to chattels claim regarding Interclick's placement of unauthorized Flash LSOs and history-sniffing code, considering there is no allegation that the devices materially affected the condition, quality, or value of the computer, is arguably sufficient to survive a motion to dismiss. School of Visual Arts v. Kuprewicz, 771 N.Y.S.2d 804, 808 (N.Y.Sup.Ct. 2003) (sustaining trespass to chattels claim where plaintiff alleged that unsolicited emails "deplete hard disk space, drained processing power, and adversely affected other system resources").
Plaintiff's claim with respect to Interclick thus survives. Again, however, Plaintiff has not alleged any facts indicating that the Advertiser Defendants committed a trespass. Accordingly, Defendant Interclick's Motion to Dismiss as to Plaintiff's trespass to chattels claim is DENIED, and the Advertiser Defendants' Motion to Dismiss the trespass to chattels claim is GRANTED.
iii. Breach of Implied Contract
In order to recover for breach of implied contract or quasi-contract under New York law, a plaintiff must establish; "(1) the performance of services in good faith, (2) the acceptance of the services by the person to whom they are rendered, (3) an expectation of compensation therefore, and (4) the reasonable value of the services." Mid-Hudson Catskill Rural Migrant Ministry, Inc. v. Fine Host Corp., 418 F.3d 168, 175 (2d Cir. 2005) (internal quotations and citations omitted).
Plaintiff describes the implied contractual relationship as follows: "Plaintiff and Class Members provided their personal information in good faith to websites (publishers), reasonably expected that such information would be exchanged with the advertisers and that Plaintiff and Class Members would in turn receive the goods and services offered by such websites" [sic]. (Am. Compl. ¶ 183.) Under this theory of implied contract, Plaintiff fails to allege that this bargain was unfulfilled in any way. She does not allege that she or the Class Members were denied the benefit for which they had "bargained," i.e., receiving the goods and services offered by the websites to whom they offered their personal information.
Therefore, Defendants' 12(b)(6) Motions to Dismiss Plaintiff's breach of implied contract claim are GRANTED.
iv. Tortious Interference with Contract
Plaintiff further alleges that when she visited websites on which Interclick operated, she entered into agreements with the operators of those websites, including privacy policies and terms of service. Plaintiff alleges that Defendants' activities were in conflict with the privacy policies and caused the websites to breach those policies, therefore constituting a tortious interference with contract.
The elements of a tortious interference claim are: (1) that a valid contract exists; (2) that a "third party" had knowledge of the contract; (3) that the third party intentionally and improperly procured the breach of the contract; and (4) that the breach resulted in damage to the plaintiff. See TVT Records v. Island Def Jam Music Group, 412 F.3d 82, 88 (2d Cir. 2005); Finley v. Giacobbe, 79 F.3d 1285, 1294 (2d Cir. 1996).
Plaintiff has not stated a claim for tortious interference with contract because she has not alleged any facts regarding the nature of the privacy agreements that she had with any of the websites. Furthermore, Plaintiff does not specify any individual contract that was breached, but just claims generally that Plaintiff had contracts with various website operators which were all breached. (Am. Compl. ¶ 194.) Plaintiff's allegations are far too general to state a claim for tortious interference with contract, because without facts regarding the terms of the contracts or the specific parties to the contracts, it cannot be determined if a contract indeed existed or if Defendants' activities procured a breach of those contracts.
Therefore, Defendants' 12(b)(6) Motions to Dismiss as to Plaintiff's tortious interference with contract claim are GRANTED.
D. Leave to Replead
When a complaint has been dismissed, permission to amend it "shall be freely given when justice so requires." Fed. R. Civ. P. 15(a). However, a court may dismiss without leave to amend when amendment would be "futile," or would not survive a motion to dismiss. Gatt Communications, Inc. v. PMC Associates, 10-CV-8, 2011 WL 1044898 at *7 (S.D.N.Y. Mar. 10, 2011) (citing Oneida Indian Nation of NY v. City of Sherrill, 337 F.3d 139, 168 (2d Cir. 2003).
Here, Plaintiff has alleged no specific interaction with any of the Advertiser Defendants, nor has she alleged any knowledge or active participation by the Advertiser Defendants in Interclick's alleged unauthorized access to the computers of Plaintiff and the Class Members. Plaintiff's claims against the Advertiser Defendant are futile and would not survive a motion to dismiss. Those claims are therefore dismissed, with prejudice.
Furthermore, as Plaintiff cannot meet the requisite statutory threshold under CFAA or state the necessary contractual relationships for a Breach of Implied Contract or Tortious Interference with Contract claim, those claims are dismissed, with prejudice.
III. CONCLUSION
For the above reasons, the Advertiser Defendants' Motion to Dismiss is GRANTED and Plaintiff's claims against McDonald's Corporation, CBS Corporation, Mazda Motor of America, Inc., Microsoft Corporation, and McDonald's USA, LLC, are dismissed with prejudice;
Interclick's Motion to Dismiss is GRANTED with respect to Plaintiff's CFAA claim, Plaintiff's Breach of Implied Contract Claim, and Plaintiff's Tortious Interference with Contract claim, and those claims are dismissed with prejudice;
Interclick's Motion to Dismiss is DENIED with respect to Plaintiff's claim under New York General Business Law Section 349, and Plaintiff's Trespass to Chattels claim; and
Defendant Interclick shall answer the remaining claims within 30 days of the date of this Order. SO ORDERED. Dated: New York, New York
August 17, 2011
/s/_________
DEBORAH A. BATTS
United States District Judge