Callahan v. Ancestry.com Inc.

Opinion

San Francisco Division MEREDITH CALLAHAN, et al., Case No. 20-cv-08437-LB

Plaintiffs, ORDER DISMISSING FIRST v. AMENDED COMPLAINT

ANCESTRY.COM INC., et al., Re: ECF No. 33 Defendants. The plaintiffs are California residents who sued Ancestry.com — individually and on behalf of a putative California class — for using their decades-old yearbook records to solicit paying subscribers. The plaintiffs claim (1) misappropriation of their likenesses, in violation of California’s Right of Publicity Law, Cal. Civ. Code § 3344, (2) unlawful and unfair business practices, in violation of California’s Unfair Competition Law, Cal. Bus. & Prof. Code § 17200, (3) intrusion upon seclusion, in violation of California common law, and (4) unjust enrichment resulting from Ancestry’s selling their personal information. The court dismissed the first complaint for lack of Article III standing because use of data to solicit customers — without something more, such as an inference that the profiled persons personally endorsed Ancestry’s product — is not injury in fact. Also, Ancestry did not create the plaintiffs amended their complaint, raising the same claims and adding allegations of harm that they suffered: emotional harm from Ancestry’s profiting from their records, lost time spent investigating Ancestry’s use of their records, and theft of their intellectual property. Ancestry moved to dismiss, again for lack of standing and under the Communications Decency Act. The plaintiffs’ new allegations do not change the analysis in the court’s earlier order: the plaintiffs do not have Article III standing, and Ancestry is immune from liability under the Communications Decency Act. The court dismisses the amended complaint. Ancestry makes money by selling subscription plans to its databases of personal and historical information, including its Yearbook database, which has yearbook records. Ancestry solicits new subscribers by sending promotional emails. For example, to solicit paying subscribers to the Yearbook database, Ancestry might send a user an email that has yearbook information of someone that Ancestry identifies as a potential former classmate.1 The amended complaint adds new allegations of the plaintiffs’ injuries: anger and distress from Ancestry’s profiting from the records, their lost time investigating Ancestry’s use (such as the five hours that named plaintiff Geoffrey Abraham spent), and theft of their intellectual property.2 The court held a hearing on Ancestry’s renewed motion to dismiss on June 10, 2021. All parties consented to magistrate-judge jurisdiction under 28 U.S.C. § 636. The court has subject-matter jurisdiction under the Class Action Fairness Act, 28 U.S.C. § 1332(d). 3

1 Order – ECF No. 30 at 2–4 (summarizing Ancestry’s business model). This order incorporates the summary by this reference because many allegations in the initial and amended complaints are the same. See Blackline – ECF No. 32-1. Citations refer to material in the Electronic Case File (ECF); pinpoint citations are to the ECF-generated page numbers at the top of documents. 2 First Am. Compl. (FAC) – ECF No. 32 at 8 (¶¶ 24–25), 18 (¶ 37), 19 (¶ 45), 27 (¶¶ 57, 59), 32 (¶ 76). 1. Rule 12(b)(1) A complaint must contain a short and plain statement of the ground for the court’s jurisdiction. Fed. R. Civ. P. 8(a)(1). The plaintiffs have the burden of establishing jurisdiction. Kokkonen v. Guardian Life Ins. Co. of Am., 511 U.S. 375, 377 (1994); Farmers Ins. Exch. v. Portage La Prairie Mut. Ins. Co., 907 F.2d 911, 912 (9th Cir. 1990). A defendant’s Rule 12(b)(1) jurisdictional attack can be facial or factual. White v. Lee, 227 F.3d 1214, 1242 (9th Cir. 2000). “A ‘facial’ attack asserts that a complaint’s allegations are themselves insufficient to invoke jurisdiction, while a ‘factual’ attack asserts that the complaint’s allegations, though adequate on their face to invoke jurisdiction, are untrue.” Courthouse News Serv. v. Planet, 750 F.3d 776, 780 n.3 (9th Cir. 2014). This is a facial attack. The court thus “accept[s] all allegations of fact in the complaint as true and construe[s] them in the light most favorable to the plaintiff[].” Warren v. Fox Family Worldwide, Inc., 328 F.3d 1136, 1139 (9th Cir. 2003). Ancestry contends that the plaintiffs lack standing. Standing pertains to the court’s subject- matter jurisdiction and thus is properly raised in a Rule 12(b)(1) motion to dismiss. Chandler v. State Farm Mut. Auto. Ins. Co., 598 F.3d 1115, 1121–22 (9th Cir. 2010). Dismissal of a complaint without leave to amend should be granted only if the jurisdictional defect cannot be cured by amendment. Eminence Capital, LLC v. Aspeon, Inc., 316 F.3d 1048, 1052 (9th Cir. 2003). 2. Rule 12(b)(6) A complaint must contain a “short and plain statement of the claim showing that the pleader is entitled to relief” to give the defendant “fair notice” of what the claims are and the grounds upon which they rest. Fed. R. Civ. P. 8(a)(2); Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007). A complaint does not need detailed factual allegations, but “a plaintiff’s obligation to provide the grounds of his entitlement to relief requires more than labels and conclusions, and a formulaic recitation of the elements of a cause of action will not do. Factual allegations must be enough to To survive a motion to dismiss, a complaint must contain sufficient factual allegations, which when accepted as true, “state a claim to relief that is plausible on its face.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Id. “The plausibility standard is not akin to a ‘probability requirement,’ but it asks for more than a sheer possibility that a defendant has acted unlawfully.” Id. “Where a complaint pleads facts that are merely consistent with a defendant’s liability, it stops short of the line between possibility and plausibility of ‘entitlement to relief.’” Id. (cleaned up). If a court dismisses a complaint, it should give leave to amend unless the “pleading could not possibly be cured by the allegation of other facts.” United States v. United Healthcare Ins. Co., 848 F.3d 1161, 1182 (9th Cir. 2016) (cleaned up). The court dismisses the claims for lack of Article III standing and, alternatively, because Ancestry is immune from liability under § 230(c)(1) of the Communications Decency Act. 1. Article III Standing “The ‘irreducible constitutional minimum’ of standing consists of three elements.” Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 1547 (2016) (citing Lujan v. Defenders of Wildlife, 504 U.S. 555, 560 (1992)). “The plaintiff must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.” Id. “The plaintiff, as the party invoking federal jurisdiction, bears the burden of establishing these elements.” Id. (citing FW/PBS, Inc. v. City of Dallas, 493 U.S. 215, 231 (1990)). “Where, as here, a case is at the pleading stage, the plaintiff must clearly allege facts demonstrating’ each element.” Id. (cleaned up). “[S]tanding in federal court is a question of federal law, not state law.” Hollingsworth v. Perry, 570 U.S. 693, 715 (2013). Ancestry contends that the plaintiffs have not established injury in fact. “To establish injury in is ‘concrete and particularized’ and ‘actual or imminent, not conjectural or hypothetical.’” Spokeo, 136 S. Ct. at 1548 (quoting Lujan, 504 U.S. at 560). “For an injury to be ‘particularized,’ it ‘must affect the plaintiff in a personal and individual way.’” Id. (quoting Lujan, 504 U.S. at 560 n.1). For an injury to be concrete, it “must be ‘de facto’; that is, it must actually exist . . . [and be] ‘real,’ and not ‘abstract.’” Id. (citing dictionaries). “‘Concrete’ is not . . . necessarily synonymous with ‘tangible.’ Although tangible injuries are perhaps easier to recognize, . . . intangible injuries can nevertheless be concrete.” Id. at 1549 (cleaned up). The plaintiffs allege the following injuries: (1) Ancestry’s use of their records violated their right to privacy under California Civil Code § 3344, which prohibits use of their names, photographs, and likenesses without their written permission; (2) Ancestry harmed them by using their records to obtain paid subscribers, which is more than mere disclosure and has provable commercial value; and (3) their emotional distress from Ancestry’s profiting from the records, their lost time investigating Ancestry’s use, and theft of their intellectual property.4 The court previously held that Ancestry’s use of the records for profit was not injury that conveyed Article III standing. The new grounds do not establish injury either. 1.1 Use of Records First, the court previously rejected the plaintiffs’ argument that Ancestry’s use of the public profiles to solicit paying subscribers establishes injury. This use — standing alone — does not establish injury, even though Ancestry profits from the use.5 There needs to be more than the statutory injury. In Fraley and C.M.D., for example, Facebook marketed products by suggesting that users who “liked” a product were endorsing it. Fraley v. Facebook, Inc., 830 F. Supp. 2d 785, 791–92, 797–99 (N.D. Cal. 2011); C.M.D. v. Facebook, Inc., No. C 12-1216 RS, 2014 WL 1266291, at *1–*2 (N.D. Cal. Mar. 26, 2014). Nothing here approximates the Fraley plaintiffs’ property interest in the value of their endorsement. And as the court held previously, the plaintiffs

4 FAC – ECF No. 32 at 8 (¶¶ 24–25), 17–18 (¶¶ 36–38), 19 (¶ 45), 26–27 (¶¶ 56–59), 32 (¶ 76). do not show a commercial interest in their images that precluded the platform’s use of them to market the platform’s features.6 Analogizing to other privacy statutes, the plaintiffs nonetheless contend that a violation of § 3344 establishes standing without any additional injury.7 Violations of some statutes can establish standing. Examples are the California Invasion of Privacy Act, the Wiretap Act, and the Stored Communications Act. In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 598–99 (9th Cir. 2020). The privacy rights protected by those statutes are fundamental, and intrusion on those rights is enough to subject a defendant to liability. Campbell v. Facebook, Inc., 951 F. 3d 1106, 1117 (9th Cir. 2020). The statutes protect interests that are like those protected by the Fourth Amendment, which affords “the right of a man to retreat into his own home and there be free from unreasonable government intrusion.” Kyllo v. United States, 533 U.S. 27, 31 (2001) (quotation omitted). “Congress and the California legislature intended to protect these historical privacy rights when they passed the” acts. In re Facebook, 956 F.3d at 598. In contrast to those statutes, § 3344(a) imposes liability only where “persons [are] injured as a result” and thus requires injury.8 Even if § 3344 did not require injury beyond the statutory violation, the rights protected by § 3344 are not analogous to the fundamental and historical privacy rights in the California Invasion of Privacy Act, the Wiretap Act, and the Stored Communications Act. Thus, “Article III standing requires a concrete injury even in the context of a statutory violation.” Spokeo, 136 S. Ct. at 1549. To support their argument that they alleged injury sufficiently, the plaintiffs also cite a case from the Northern District of Illinois involving a similar privacy statute and a similar challenge to a website’s use of information to solicit customers.9 The case does not compel a different outcome because it did not address standing and in any event involved an allegation of financial harm. Lukis v. Whitepages, Inc., 454 F. Supp. 3d 746, 759 (N.D. Ill. 2020). 6 Id. at 8 (analyzing Cohen v. Facebook, Inc., 798 F. Supp. 2d 1090, 1092 (N.D. Cal. 2011)). 7 Opp’n – ECF No. 38 at 11–13. 8 Order – ECF No. 30 at 8. The defendant in Lukis was a website that sold background reports compiled from private and public records. Id. at 751. To solicit paying customers, it provided a free preview of a limited report that contained enough information — middle initial, age range, phone number, current and previous addresses, and other information — to identify the person. Id. The plaintiffs, on behalf of a putative class, challenged — as a violation of the Illinois Right to Privacy Act — the website’s use of their information in free previews to solicit paying subscribers. Id. at 750, 756. The Act prohibits use of an individual’s identity for commercial purposes without the individual’s written consent. Id. at 760 (citing 765 Ill. Comp. Stat. § 1075/30(a)). The website moved to dismiss, in part on the ground that its free previews merely amalgamated public information about the named plaintiff. Id. at 761. The court denied the motion on the ground that the statute covered “all aspects of a person’s identity, whether the information is derived from public or private sources.” Id. (citation omitted). The issue in Lukis was whether the plaintiff stated a claim, not whether she had standing. Also, unlike the plaintiffs in this case, the Lukis plaintiff alleged that she suffered financial harm from the disclosures, id. at 759, which can establish standing. Accord Kolebuck-Utz v. Whitepages, Inc., No. C21-0053-JCC, 2021 WL 1575219, at *2 (W.D. Wash. Apr. 22, 2021) (in case involving similar facts, the plaintiff stated a claim for a violation of Ohio’s right-of-privacy statute; court did not consider standing).10 1.2 Emotional Distress, Investigation, and Theft of Intellectual Property Second, the plaintiffs’ emotional distress, time spent investigating Ancestry’s use, and theft of their intellectual property do not establish injury in fact either. The plaintiffs contend that they suffered mental anguish from Ancestry’s use of their likenesses to promote a product they knew nothing about, quoting Miller v. Collectors Universe: “A plaintiff’s knowledge of commercial loss and/or defamation may be a component of mental harm, disturbing one’s peace of mind.”11 159 Cal. App. 4th 988, 1006 n.12 (2008). There is no commercial loss or defamation here. If there were, then there would be injury that established Article III standing. 10 Statement of Recent Decision – ECF No. 41 (submitting Kolebuck-Utz, 2021 WL 1575219). 11 Opp’n – ECF No. 38 at 20–21 (quoting Miller v. Collectors Univ., Inc., 159 Cal. App. 4th 988, 1006 There is no other harm either. In data-breach cases, for example, anxiety and stress about a credible threat of future identity theft is injury in fact conveying Article III standing. Krottner v. Starbucks Corp., 628 F.3d 1139, 1142–43 (9th Cir. 2010).12 The cases recognizing mental anguish all involve other injury. There is only mental anguish here, and alone, it is not injury in fact. Mr. Abraham’s five hours of investigation — researching Ancestry’s use of the records, checking how easily he could find them with a web browser, and warning his friends about the use of their records — is not concrete injury either. In data-breach cases, spending substantial time monitoring one’s accounts — in the context of a credible threat of future identity theft — can be a component of injury in fact. Id. at 1141; Adkins v. Facebook, Inc., 424 F. Supp. 3d 686, 691–92 (N.D. Cal. 2019). But no case establishes that investigation untethered to harm reduction is injury in fact. Mr. Abraham’s exploration of Ancestry’s use of his records was perhaps for his peace of mind. But like his mental anguish, it is not related to other injury, and it thus does not create Article III standing. Cf. La Asociacion de Trabajadores de Lake Forest v. City of Lake Forest, 624 F.3d 1083, 1088 (9th Cir. 2010) (a plaintiff “cannot manufacture the injury by incurring litigation costs or simply choosing to spend money fixing a problem that otherwise would not affect the [plaintiff] at all.”). The plaintiffs also contend that misappropriating their likenesses without their permission is theft of their intellectual property. Some cases characterize the right of publicity as an intellectual- property claim. But the cases that the plaintiffs cite all involve misappropriation of celebrities’ images that had commercial value.13 See, e.g., Aroa Mktg., Inc. v. Hartford Ins. Co., 198 Cal. App. 4th 781, 785 (2011) (model’s image used to sell products). Again, there is no corresponding commercial value here or other separate injury, and thus, there is no injury in fact. * * * In sum, for injury in fact, there must be a concrete injury in additional to a statutory violation. Spokeo, 136 S. Ct. at 1549. The endorsement theory in Fraley is one way to prove an injury. A 12 Accord Maddox v. Bank of N.Y. Mellon Tr., 997 F.3d 436, 448–49 (2d Cir. 2021) (material risk of concrete and particularized harm in the form of an unfavorable credit rating and reduced borrowing capacity); Calhoun v. Google LLC, No. 20-cv-5146-LHK, 2021 WL 1056532, at *21–22 (N.D. Cal. Mar. 17, 2021) (loss of personal information can be concrete injury). celebrity’s loss of commercial value in her name is another. Other examples include defamation or a credible risk of future harm. Here, there is no injury except for the statutory violation. The court dismisses the claims because the plaintiffs do not have Article III standing. 2. The Communications Decency Act The court held previously that Ancestry was immune from liability under the Communications Decency Act, 47 U.S.C. § 230(c)(1), because it did not create content or contribute materially to the content. Instead, Ancestry — by taking information and photos from the yearbooks and republishing them on its website in an altered format — engaged in “a publisher’s traditional editorial functions [that] [] do not transform an individual into a content provider within the meaning of § 230.” Fraley, 830 F. Supp. 2d at 802 (cleaned up); cf. Fair Hous. Council v. Roommates.com, LLC, 521 F.3d 1157, 1167–68, 1173–742 (9th Cir. 2008) (website is immune under § 230(c)(1) where it “publishes [] comments as written” that “come[] entirely from subscribers and [are] passively displayed” by the website operator).14 In the first complaint, the plaintiffs alleged that Ancestry “does not disclose how it created” the Yearbook database, but a section of its website “encourag[es] visitors to donate their old yearbooks” and asks the donor to sign a disclaimer about copyright restrictions.15 In the new complaint, the plaintiffs allege that they do not know how Ancestry acquired the records, reference the website’s solicitation of donations of yearbooks, and say that “it is possible [that] some of the Yearbook Database was built via such donations.”16 Based on the new allegations, the plaintiffs contend that Ancestry did not identify who provided the yearbooks. They intimate that Ancestry could have obtained the information by scraping it from websites or copying it from libraries. They conclude that Ancestry has not identified “any [third-party] information content provider”

14 Order – ECF No. 30 at 9–11. This order does not repeat the earlier order’s analysis and instead incorporates it by this reference. 15 Compl. – ECF No. 1 at 2 (¶ 3), 23–24 (¶¶ 46–50). and thus cannot be immune under § 230(c)(1).17 47 U.S.C. § 230(c)(1). This argument does not change the court’s conclusion that Ancestry is not a content provider. Ancestry obviously did not create the yearbooks. Instead, it necessarily used information provided by another information- content provider and is immune under § 230(c)(1).18 The plaintiffs also contend that Ancestry “has no indication that yearbook authors intended the yearbooks” to be published online.19 As the court held previously, no case supports the conclusion that § 230(a)(1) immunity applies only if the website operator obtained the third-party content from the original author. To the contrary, the Act “immunizes an interactive computer service provider that ‘passively displays content that is created entirely by third parties.’” Sikhs for Justice “SFJ”, Inc. v. Facebook, Inc., 144 F. Supp. 3d 1088, 1094 (N.D. Cal. 2015) (quoting Roommates.com, 521 F.3d at 1162), aff’d, 697 F. App’x 526, 526–27 (9th Cir. 2017).20 Citing Batzel v. Smith, the plaintiffs nonetheless contend that Ancestry has § 230(c)(1) immunity only if the yearbook creator intended the content to be published online.21 333 F.3d 1018, 1034 (9th Cir. 2003). Batzel does not require the creator’s permission. In Batzel, a handyman allegedly suspected that paintings in a client’s home were looted during World War II based in part on the client’s statements to him that she was a descendent of Heinrich Himmler and inherited some of the art. After looking on the internet about reporting stolen art, he emailed the Museum Security Network about his suspicions. Id. at 1020–22. The sole operator of the network (also the director of security at Amsterdam’s Rijksmuseum) posted the email on the network and sent it by a listserv to subscribers (including museum security investors, insurance investigators, and law-enforcement investigators, who use the network to track down stolen art). Id. at 1021–22. The client discovered the message some months later and complained to the network operator. As part of his investigation, the operator contacted the handyman, who said that he would

17 Opp’n – ECF No. 38 at 22–24. 18 Order – ECF No. 30 at 9–10 (addressing a similar argument). 19 Opp’n – ECF No. 38 at 24–27. 20 Order – ECF No. 30 at 9–10. not have sent the message if he thought it would be posted on an international message board. Id. at 1022. Ultimately, the client — “to redress her claimed reputational injuries” — sued the handyman, the network operator, the museum, and a security firm that advertised on the network. Id. The network operator moved to strike the lawsuit under California’s anti-SLAPP statute, alleging that the client’s lawsuit was meritless and violated the First Amendment. Id. at 1023. The district court denied the motion, holding that the client demonstrated a probability that she would succeed on the merits of her complaint. Id. at 1026 (citing Cal. Civ. Proc. Code § 425.16, California’s anti-SLAPP statute, which requires this showing). The Ninth Circuit reversed, in part because the handyman said that he did not intend for his email to be published. Id. at 1032–35. Immunity under § 230(c)(1) applies only for “third-party information provided for use on the Internet or another interactive computer service.” Id. at 1033 (emphasis omitted). The issue was whether the handyman provided the email for publication. Id. at 1034. The court enunciated a standard for evaluating the issue: “a service provider is immune from liability under § 230(c)(1) when a third person or entity that created or developed the information in question furnished it to the provider or user under circumstances in which a reasonable person in the position of the service provider or user would conclude that the information was provided for publication on the Internet or other ‘interactive computer service.’” Id. at 1034. The record did not establish that the handyman provided the email for publication. The court thus remanded for development of the record, holding that if the operator should have reasonably concluded that the email was not provided for posting, then he was not immune under § 230(c)(1). Id. at 1035. This in turn affected whether the client demonstrated probability of success on her claim: if the operator was immune, then there presumably was no probability of success against him for defamation. See id. Batzel involved the publication of an email that (potentially) the sender never intended for publication. Ancestry of course cannot publish private information that the provider did not intend to be posted online. But here, the information was not private and, whether the yearbooks were donated by other former students or obtained from other sources, Ancestry is demonstrably not the content creator and instead is publishing third-party content provided to it for publication. Unlike 1 the information was provided for publication. /d. at 1034. Nothing in Batzel requires the original 2 creator’s permission for publication. 3 Finally, the plaintiffs contend that Ancestry created content by taking the records and putting 4 them in popup ads and emails to promote website subscriptions.”” The court rejected that 5 contention previously. In Fraley, for example, Facebook transformed the user’s content (liking a 6 product) into an advertisement that — without the user’s consent — transformed the personal likes 7 into an endorsement (resulting in a profit to Facebook from selling the ads). 830 F. Supp. 2d at 8 791-92, 797. Ancestry did not transform the content and just offered it in a different form.” 9 Anthony v. Yahoo! Inc. does not change this conclusion.”* 421 F. Supp. 2d 1257 (N.D. Cal. 2006). 10 Yahoo! created false user profiles for its dating app to lure subscribers to renew their 11 subscriptions. Thus, there was no immunity for its tortious conduct. Jd. at 1262-63. 12 In sum, Ancestry has immunity under § 230(c)(1).

CONCLUSION 15 The court grants the motion to dismiss the first amended complaint. The previous dismissal 16 was with leave to amend, and the plaintiffs did not cure the complaint’s deficiencies. The 17 dismissal thus is with prejudice. 18 This disposes of ECF No. 33. 20 Dated: June 15, 2021 LAE 21 LAUREL BEELER United States Magistrate Judge 23 24 25 26 ** Opp’n- ECF No. 38 at 27-28. 27 ?3 Order — ECF No. 30 at 10-11. 08 ee ’n — ECF No. 38 at 28 (citing Anthony v. Yahoo! Inc., 421 F. Supp. 2d 1257, 1262-63 (N.D. Cal.