IN RE GOOGLE RTB CONSUMER Case No. 21-cv-02155-YGR (VKD) PRIVACY LITIGATION ORDER RE FEBRUARY 1, 2022 PLAINTIFFS’ DOCUMENT Re: Dkt. Nos. 141, 143
Plaintiffs and Google LLC ask the Court to resolve numerous disputes concerning plaintiffs’ document requests to Google. Dkt. Nos. 141, 143. The Court held a lengthy hearing on these disputes on February 8, 2022. See Dkt. No. 151 (transcript). The Court will require Google to produce documents responsive to the following requests, but the scope of the required production is limited as described below: RFPs 1, 2, 3 and 4 (Texas AG only), 7-11, 22(i) and (j), 28, and 30. Google need not produce documents responsive to RFP 3 and 4 (other actions), 22(q)(i), 33, and 35. Plaintiffs are Google account holders who allege that Google improperly sells or otherwise discloses to third party companies personal and private information about them through Google’s advertising auction process, which the parties refer to as “real-time bidding” or “RTB.” Google denies that RTB operates in the manner plaintiffs allege and denies that Google sells or otherwise shares Google account holders’ personal information with third parties utilizing RTB without the account holders’ consent. The parties presently are litigating the following eight claims: (1) breach of contract (Count 1); (2) breach of covenant of good faith and fair dealing (Count 2); (3) intrusion upon seclusion (Count 5); (5) publication of private information (Count 6); (6) breach of confidence (Count 7); (7) violation of the California Information Privacy Act, Cal. Penal Code §§ 630-638 (Count 8); and (8) violation of the Electronic Communications Privacy Act, 18 U.S.C. § 2511—unauthorized interception, use and disclosure by an Electronic Communications Service (ECS) (Count 10). In addition to declaratory and injunctive relief, plaintiffs seek damages, restitution, and disgorgement. See Dkt. Nos. 80, 146. A. Legal Standard A party may obtain discovery of any matter that is relevant to a claim or defense and that is “proportional to the needs of case, considering the importance of the issues at stake in the action, the amount in controversy, the parties’ relative access to relevant information, the parties’ resources, the importance of the discovery in resolving the issues, and whether the burden or expense of the proposed discovery outweighs its likely benefit.” Fed. R. Civ. P. 26(b)(1). B. Disputed Document Requests 1. RFP 1: Google’s internal investigations Plaintiffs have narrowed the scope of their demand with respect to RFP 1 and now seek non-privileged documents concerning Google’s internal investigations into the allegations of the complaint. Dkt. No. 141 at 1. As narrowed the request asks for relevant documents and is not unduly burdensome. This request requires Google to: (1) determine whether, after it received notice of the complaint, it conducted any investigations of plaintiffs’ factual allegations, and if so (2) identify the relevant custodians, and (3) produce any non-privileged documents reflecting those investigations. 2. RFP 2: Responses to external criticism Plaintiffs ask Google to produce documents created in response to external criticism of RTB, including documents reflecting Google’s consideration of whether to modify RTB, even if no modification was made. Google objects to the breadth of this request to the extent it encompasses changes to RTB that were merely contemplated, but never implemented, and The Court agrees with Google that its obligation to produce documents responsive to RFP 2 should be limited to changes actually made to RTB that concern or impact, in any way, the sale or disclosure to third parties of personal and private information about the account holders. The Court is not persuaded that the broader scope of discovery plaintiffs seek will yield relevant information. Plaintiffs have not shown that discovery concerning changes to RTB that Google contemplated but chose not to make is likely to have any bearing on questions of liability or plaintiffs’ damages. 3. RFPs 3 and 4: Regulator requests and Google responses Plaintiffs ask Google to produce documents and testimony that Google has previously provided to government regulators and other government agencies relating to data privacy, RTB, or any other matter alleged in the complaint. Specifically, plaintiffs request production of all Civil Investigative Demands (“CIDs”) or equivalent demands, and potentially all responses thereto, in Arizona’s and Australia’s pending actions against Google.1 Plaintiffs also request production of certain categories of documents Google has produced in response to CIDs issued in an action initiated by the Texas Attorney General.2 Google objects to the scope of RFPs 3 and 4 and, in particular, to production of materials relating to the Arizona and Australia actions on the ground that those actions have nothing to do with RTB or with the disclosure of Google account holders’ information to third parties. Google says it has agreed to re-produce to plaintiffs the documents it produced in response to 18 of the Texas AG’s CIDs, but it objects to providing the remaining categories of documents plaintiffs demand. In addition, Google says it has already produced (or agreed to produce) documents from investigation in the United Kingdom that relate to RTB. While plaintiffs are correct that, as a general matter, parties may obtain access to discovery materials gathered or obtained by parties in another litigation, plaintiffs must first demonstrate that the discovery in the other litigation is relevant to the matters at issue. See Foltz v. State Farm Mut. 1 State of Arizona ex rel. Mark Brnovich, Attorney General v. Google LLC, No. 2020-006219 (Ariz. Superior Ct. 2020); Australia Competition and Consumer Commission v. Google LLC, No. NSD816/2020 (Fed. Ct. of Australia 2020). Auto. Ins. Co., 331 F.3d 1122, 1131-32 (9th Cir. 2003). Plaintiffs say that the Arizona action concerns deceptive collection of users’ geolocation data, and that the Australia action concerns misleading promises Google made in its privacy policy regarding account holders’ consent to Google associating their personal information with their activity on third party websites for purposes of targeted advertising. They acknowledge, however, that neither action concerns the sale or disclosure of account holders’ information through RTB, although they contend that there are important and relevant similarities between the conduct being investigated by Arizona and Australia and the conduct at issue here. Plaintiffs say that the Texas AG action concerns Google’s deceptive use of individuals’ personal information to engage in targeted advertising. Google says that the Texas AG action is an antitrust lawsuit that implicates Google’s online advertising business but not the disclosure of personal information to third parties. The claims and defenses in this case may require discovery of: (1) what information about account holders’ is collected by Google and potentially available to third parties through the RTB auction process; (2) how Google obtains consent of account holders to disclose that information to third parties; and (3) what information Google discloses to third parties through RTB and under what circumstances that disclosure is made. While there may be some limited overlap between the relevant discovery in this action and documents and information produced by Google in the Arizona and Australia actions, the Court is not persuaded that the overlap is sufficient to warrant the scope of production plaintiffs demand in RFPs 3 and 4. For example, the fact that Google has made
Free access — add to your briefcase to read the full text and ask questions with AI
IN RE GOOGLE RTB CONSUMER Case No. 21-cv-02155-YGR (VKD) PRIVACY LITIGATION ORDER RE FEBRUARY 1, 2022 PLAINTIFFS’ DOCUMENT Re: Dkt. Nos. 141, 143
Plaintiffs and Google LLC ask the Court to resolve numerous disputes concerning plaintiffs’ document requests to Google. Dkt. Nos. 141, 143. The Court held a lengthy hearing on these disputes on February 8, 2022. See Dkt. No. 151 (transcript). The Court will require Google to produce documents responsive to the following requests, but the scope of the required production is limited as described below: RFPs 1, 2, 3 and 4 (Texas AG only), 7-11, 22(i) and (j), 28, and 30. Google need not produce documents responsive to RFP 3 and 4 (other actions), 22(q)(i), 33, and 35. Plaintiffs are Google account holders who allege that Google improperly sells or otherwise discloses to third party companies personal and private information about them through Google’s advertising auction process, which the parties refer to as “real-time bidding” or “RTB.” Google denies that RTB operates in the manner plaintiffs allege and denies that Google sells or otherwise shares Google account holders’ personal information with third parties utilizing RTB without the account holders’ consent. The parties presently are litigating the following eight claims: (1) breach of contract (Count 1); (2) breach of covenant of good faith and fair dealing (Count 2); (3) intrusion upon seclusion (Count 5); (5) publication of private information (Count 6); (6) breach of confidence (Count 7); (7) violation of the California Information Privacy Act, Cal. Penal Code §§ 630-638 (Count 8); and (8) violation of the Electronic Communications Privacy Act, 18 U.S.C. § 2511—unauthorized interception, use and disclosure by an Electronic Communications Service (ECS) (Count 10). In addition to declaratory and injunctive relief, plaintiffs seek damages, restitution, and disgorgement. See Dkt. Nos. 80, 146. A. Legal Standard A party may obtain discovery of any matter that is relevant to a claim or defense and that is “proportional to the needs of case, considering the importance of the issues at stake in the action, the amount in controversy, the parties’ relative access to relevant information, the parties’ resources, the importance of the discovery in resolving the issues, and whether the burden or expense of the proposed discovery outweighs its likely benefit.” Fed. R. Civ. P. 26(b)(1). B. Disputed Document Requests 1. RFP 1: Google’s internal investigations Plaintiffs have narrowed the scope of their demand with respect to RFP 1 and now seek non-privileged documents concerning Google’s internal investigations into the allegations of the complaint. Dkt. No. 141 at 1. As narrowed the request asks for relevant documents and is not unduly burdensome. This request requires Google to: (1) determine whether, after it received notice of the complaint, it conducted any investigations of plaintiffs’ factual allegations, and if so (2) identify the relevant custodians, and (3) produce any non-privileged documents reflecting those investigations. 2. RFP 2: Responses to external criticism Plaintiffs ask Google to produce documents created in response to external criticism of RTB, including documents reflecting Google’s consideration of whether to modify RTB, even if no modification was made. Google objects to the breadth of this request to the extent it encompasses changes to RTB that were merely contemplated, but never implemented, and The Court agrees with Google that its obligation to produce documents responsive to RFP 2 should be limited to changes actually made to RTB that concern or impact, in any way, the sale or disclosure to third parties of personal and private information about the account holders. The Court is not persuaded that the broader scope of discovery plaintiffs seek will yield relevant information. Plaintiffs have not shown that discovery concerning changes to RTB that Google contemplated but chose not to make is likely to have any bearing on questions of liability or plaintiffs’ damages. 3. RFPs 3 and 4: Regulator requests and Google responses Plaintiffs ask Google to produce documents and testimony that Google has previously provided to government regulators and other government agencies relating to data privacy, RTB, or any other matter alleged in the complaint. Specifically, plaintiffs request production of all Civil Investigative Demands (“CIDs”) or equivalent demands, and potentially all responses thereto, in Arizona’s and Australia’s pending actions against Google.1 Plaintiffs also request production of certain categories of documents Google has produced in response to CIDs issued in an action initiated by the Texas Attorney General.2 Google objects to the scope of RFPs 3 and 4 and, in particular, to production of materials relating to the Arizona and Australia actions on the ground that those actions have nothing to do with RTB or with the disclosure of Google account holders’ information to third parties. Google says it has agreed to re-produce to plaintiffs the documents it produced in response to 18 of the Texas AG’s CIDs, but it objects to providing the remaining categories of documents plaintiffs demand. In addition, Google says it has already produced (or agreed to produce) documents from investigation in the United Kingdom that relate to RTB. While plaintiffs are correct that, as a general matter, parties may obtain access to discovery materials gathered or obtained by parties in another litigation, plaintiffs must first demonstrate that the discovery in the other litigation is relevant to the matters at issue. See Foltz v. State Farm Mut. 1 State of Arizona ex rel. Mark Brnovich, Attorney General v. Google LLC, No. 2020-006219 (Ariz. Superior Ct. 2020); Australia Competition and Consumer Commission v. Google LLC, No. NSD816/2020 (Fed. Ct. of Australia 2020). Auto. Ins. Co., 331 F.3d 1122, 1131-32 (9th Cir. 2003). Plaintiffs say that the Arizona action concerns deceptive collection of users’ geolocation data, and that the Australia action concerns misleading promises Google made in its privacy policy regarding account holders’ consent to Google associating their personal information with their activity on third party websites for purposes of targeted advertising. They acknowledge, however, that neither action concerns the sale or disclosure of account holders’ information through RTB, although they contend that there are important and relevant similarities between the conduct being investigated by Arizona and Australia and the conduct at issue here. Plaintiffs say that the Texas AG action concerns Google’s deceptive use of individuals’ personal information to engage in targeted advertising. Google says that the Texas AG action is an antitrust lawsuit that implicates Google’s online advertising business but not the disclosure of personal information to third parties. The claims and defenses in this case may require discovery of: (1) what information about account holders’ is collected by Google and potentially available to third parties through the RTB auction process; (2) how Google obtains consent of account holders to disclose that information to third parties; and (3) what information Google discloses to third parties through RTB and under what circumstances that disclosure is made. While there may be some limited overlap between the relevant discovery in this action and documents and information produced by Google in the Arizona and Australia actions, the Court is not persuaded that the overlap is sufficient to warrant the scope of production plaintiffs demand in RFPs 3 and 4. For example, the fact that Google has made similar promises with respect to its own targeted advertising or has used similar vehicles to obtain consent in contexts other than RTB is too slim a reed to support an order requiring Google to produce all CIDs and responses thereto from the Arizona and Australia actions. Such a production obligation is not proportional to the needs of this case, particularly where plaintiffs may use much more targeted requests for production of documents to obtain the discovery they require. With respect to the Texas AG action, plaintiffs have not shown that the additional categories of documents they have requested are likely to include material relevant to the claims submission (Dkt. No. 143 at 3, 5) do not appear to have anything to do with the sale or disclosure of account holders’ information to third parties generally, or through RTB specifically. Google must specifically identify for plaintiffs the CID categories for which Google will provide responsive documents to plaintiffs from the Texas AG action and must promptly produce those documents, but Google need not produce the additional categories of documents plaintiffs identify in Dkt. 143, Exhibit 2.3 4. RFPs 7-11: Interviews, testimony, and op ed In RFPs 7 and 8, plaintiffs ask Google to produce transcripts and recordings of interviews and testimony given to regulators, government bodies, or in court proceedings relating to data privacy, RTB, or any other matter alleged in the complaint, as well as documents compiled by Google in preparation for any such interviews or testimony. In RFP 9, plaintiffs ask Google to produce documents regarding Google’s discussion or analysis of any interview or testimony by a Google employee relating to data privacy, RTB, or any other matter alleged in the complaint. In RFPs 10 and 11, plaintiffs ask Google to produce documents compiled in preparation for Google CEO Sundar Pinchai’s May 7, 2019 opinion editorial in the New York Times (Dkt. No. 92-1, Ex. 25), including drafts of the op ed, or comments or discussions about it. Plaintiffs argue that documents concerning prior testimony and statements may contain relevant admissions and other relevant evidence. Google objects that these requests seek broad discovery that encompasses data privacy generally, are not specific to RTB-related matters, and because they include undefined “informal” interviews, it will be difficult for Google to identify or define the scope of responsive documents. Google also objects that these requests target privileged communications. RFPs 7-9: As a general matter, to the extent Google has provided statements or testimony to regulators, government bodies, or in court proceedings that discuss RTB, it must produce non- privileged documents response to RFPs 7-9. Google need not search for or produce responsive documents relating to “informal” interviews, such as statements to the media, because the burden 3 The Court is not in a position to resolve the parties’ dispute regarding whether Judge Koh previously ordered Google to produce the entirety of the materials from the Texas AG action. See of identifying and reviewing such materials is not proportional to the needs of the case. The Court also is not persuaded that all interviews or testimony, or documents compiled in preparation therefor, that concern the subject of data privacy generally are likely to yield information relevant to any claim or defense; Google need not search for or produce responsive documents that concern only data privacy generally. RFPs 10-11: The Court has reviewed the Pinchai op ed. While the op ed concerns Google products generally, plaintiffs focus on Mr. Pinchai’s statement that “Google will never sell any personal information to third parties” as a categorical statement that encompasses RTB. See Dkt. No. 141 at 3. It is not clear to the Court from the text of the op ed that Mr. Pinchai meant to encompass RTB when he made this statement. However, to the extent that he or others assisting him with the op ed relied on, referenced, or otherwise compiled documents discussing the operation of RTB, those documents must be produced. Similarly, to the extent drafts of the op ed, or comments or discussions about it, referenced RTB, those documents also must be produced. Given the nature of this op ed, the Court is not persuaded that all materials concerning its preparation or discussion are likely to yield documents relevant to any claim or defense, and so Google need not produce documents concerning only data privacy generally. 5. RFP 22: Technical details re use and operation of RTB RFP 22 has multiple subparts, but the parties’ dispute concerns only subparts (i), (j), and (q)(i). Google has agreed to produce documents sufficient to show the information described in all other subparts of RFP 22. Dkt. No. 151 at 58:9-22, 59:8-16. Subparts (i) and (j) are directed to “the location and manner in which Google stores Bid Requests” and “the location and manner in which Google stores user information that is used or may be used in a Bid Request.” While the specific items of user information that may be used or disclosed in the RTB process are relevant to plaintiffs’ claims, Google has already agreed to produce documents sufficient to show this information in response to subpart (e). During the hearing, plaintiffs seemed to suggest that the information sought in subparts (i) and (j) would provide a record of user information actually disclosed to third parties in the RTB process. third parties through the RTB process, it must produce documents sufficient to show what information is shared and how it tracks what information is shared. Otherwise, the Court is not persuaded that the location and manner in which Google stores Bid Requests or the user information that is used or may be used in a Bid Request is relevant to any issue in the case, and Google need not produce these documents. Subpart (q)(i) is directed to documents relating to “the factors, analysis, considerations, and methodologies for selecting the winning bid” in the RTB process. Plaintiffs do not explain why they seek this information, except to say that “these documents go to the market exchange between Google and RTB participants.” Dkt. No. 141 at 3. As it is not clear how Google’s methodology for selecting a winning bid is relevant to any claim or defense, including plaintiffs’ calculation of damages, the Court will not require Google to produce documents responsive to subpart (q)(i). 6. RFP 28: Drafts of exhibits attached to complaint Plaintiffs ask Google to produce all documents related to Google’s terms of service, help center pages, and privacy policies, including all drafts and all discussions of drafts and revisions to these materials. Google has agreed to produce earlier versions of these documents and non- privileged drafts. The Court agrees with Google that plaintiffs’ request is too broad. As Google’s proposed scope of production is consistent with the relevance and proportionality requirements of Rule 26, Google shall produce responsive documents consistent with its proposal. 7. RFP 30: Analysis and decision-making re RTB-related policies Plaintiffs ask Google to produce “documents regarding Google’s analyses and decision- making practices in the drafting and finalizing of any policy, material, or disclosure made to Account Holders or RTB participants regarding Google’s collection, storage, use and sale of user information, Google’s engagement in targeted advertising and Google’s [RTB],” including specific categories of documents. Google objects to producing documents relating analysis and decision-making for policies, materials, or disclosures regarding collection and storage. Google also objects to producing responsive documents concerning non-U.S. account holders. tells others about collection and storage of user information is not relevant to the claims and defenses in this case, and Google need not produce responsive documents relating to such collection and storage. However, Google’s analysis and decision-making regarding what it tells account holders and RTB participants about the use and sale of user information, Google’s own engagement in targeted advertising, and the RTB process is relevant, and Google must produce documents responsive to this portion of RFP 30. Because the proposed class is limited to U.S. account holders, Google need not produce responsive documents relating to non-U.S. account holders. 8. RFP 33: Studies on user engagement and privacy breaches Plaintiffs have narrowed this request and ask Google to produce (1) documents Google prepares on a periodic basis regarding user engagement, either specific to RTB or encompassing RTB, and (2) studies or analyses of how data privacy breaches impact user engagement generally, or specifically with respect to RTB. See Dkt. No. 141 at 4; Dkt. No. 151 at 71:14-75:2. Google objects to this request on several grounds. Having considered the parties’ joint submission and the discussion of RFP 33 during the hearing, the Court finds that plaintiffs’ concept of “user engagement” is not sufficiently well- defined for purposes of this request. For this reason, the Court will not require Google to produce responsive documents regarding period reporting on “user engagement,” or to produce responsive documents regarding studies of how privacy breaches impact “user engagement.” However, the Court will not bar plaintiffs from exploring further whether Google tracks any metrics regarding what RTB participants value when placing a bid request, and if appropriate, seeking discovery of those metrics and whether privacy breaches have some impact on those metrics. 9. RFP 35: Google’s market share for all digital advertising Plaintiffs ask Google to produce documents relating to its market share for all digital advertising, including any estimates for the market share derived from RTB. Google objects that this request is unreasonably broad given that RTB is merely one portion of digital advertising. As discussed at the hearing, the Court agrees that the scope of this request is too broad and 1 damages theories, but a request that seeks documents “relating to” market share for “all digital 2 advertising” encompasses information that is not relevant or proportional to the needs of the case. 3 The parties are directed to confer further regarding whether Google has documents sufficient to 4 show the relevant market sector (e.g., advertiser side) that encompasses RTB, and if possible, 5 RTB’s share of that market sector. With this guidance, the Court expects the parties to be able to 6 reach agreement on this RFP. 7 I. CONCLUSION 8 The parties shall confer, as appropriate, regarding a schedule for Google’s production of 9 the documents responsive to RFPs 1, 2, 3 and 4 (Texas AG only), 7-11, 22) and (), 28, and 30. 10 The parties also shall confer regarding the scope of RFP 35. 12 Dated: April 25, 2022
5 VIRG IA K. DEMARCH nited States Magistrate Judge 16
18 19 20 21 22 23 24 25 26 27 28