In re Google RTB Consumer Privacy Litigation

Opinion

IN RE GOOGLE RTB CONSUMER Case No. 21-cv-02155-YGR (VKD) PRIVACY LITIGATION ORDER RE MAY 26, 2022 DISCOVERY DISPUTE RE PLAINTIFFS' RULE 30(B)(6) DEPOSITION NOTICE TO GOOGLE; ORDER RE FURTHER SUBMISSION

Re: Dkt. No. 209 Plaintiffs and defendant Google LLC (“Google”) ask the Court to resolve their disputes concerning all but one of the topics in plaintiffs’ Rule 30(b)(6) deposition notice to Google. Dkt. No. 209. Plaintiffs ask the Court to order Google to produce a corporate representative to testify regarding all noticed topics no later than June 15, 2022. Id. at 4. Google asks the Court to issue a protective order to protect it from having to produce a corporate representative as to any disputed topic, id., and it objects to producing any corporate representative by June 15, id. at 8. The Court held a lengthy hearing on this dispute on June 7, 2022. Dkt. No. 228. Below, the Court resolves the parties’ disputes about each topic and about the timing of the deposition. In addition, the Court provides instructions regarding the filing of proposals for a further submission on the scope of relevant discovery. Plaintiffs are Google account holders who allege that Google improperly sells or otherwise discloses to third party companies personal and private information about them through Google’s advertising auction process, which the parties refer to as “real-time bidding” or “RTB.” Google shares Google account holders’ personal information with third parties utilizing RTB without the account holders’ consent. The parties presently are litigating the following eight claims: (1) breach of contract (Count 1); (2) breach of covenant of good faith and fair dealing (Count 2); (3) violation of Article 1, § 1 of the California Constitution (invasion of privacy) (Count 4); (4) intrusion upon seclusion (Count 5); (5) publication of private information (Count 6); (6) breach of confidence (Count 7); (7) violation of the California Information Privacy Act (“CIPA”), Cal. Penal Code §§ 630-638 (Count 8); and (8) violation of the Electronic Communications Privacy Act, 18 U.S.C. § 2511—unauthorized interception, use and disclosure by an Electronic Communications Service (ECS) (Count 10). In addition to declaratory and injunctive relief, plaintiffs seek damages, restitution, and disgorgement. See Dkt. Nos. 92, 146. A party may obtain discovery of any matter that is relevant to a claim or defense and that is “proportional to the needs of case, considering the importance of the issues at stake in the action, the amount in controversy, the parties’ relative access to relevant information, the parties’ resources, the importance of the discovery in resolving the issues, and whether the burden or expense of the proposed discovery outweighs its likely benefit.” Fed. R. Civ. P. 26(b)(1). A party may obtain discovery of a corporation or other entity by serving a notice that “describe[s] with reasonable particularity the matters for examination.” Fed. R. Civ. P. 30(b)(6). Before or promptly after service of the notice, the parties must “confer in good faith about the matters for examination,” and the corporation must designate a person or persons to testify about “information known or reasonably available to” the corporation. Id. Of the 15 topics included in plaintiffs’ notice, the parties have disputes about all but one. Many of the disputes track those the Court previously heard and resolved in connection with plaintiffs’ document requests to Google. See Dkt. Nos. 184, 189. For the reasons explained during the hearing, the Court is not inclined to revisit its prior decisions on relevance and proportionality in the absence of new or different arguments. The Court refers to those prior A. Topic 1 Plaintiffs ask Google to designate a corporate representative to testify about: [T]he identity of Google employees, teams, team leads, divisions, and organizational structure of teams responsible for the planning, designing, engineering, implementing, authorizing, and managing of the below products, including the names of individuals, their titles and responsibilities, the methods of communication and coordination among them, and the chain of command with decision- making authority on matters related to Real Time Bidding, including data flow through ad systems which are involved in RTB advertising, including DoubleClick for Publishers; DoubleClick Ad Exchange; Google Ads; Google Ad Exchange; Google Ad Manager; and Google Display & Video 360; all of which are pipelines for advertising sold through the RTB process. Dkt. No. 209-1 at 5. The parties disagree about whether the topic seeks relevant information and about whether the information requested is proportional to the needs of the case. To the extent plaintiffs seek to identify witnesses with relevant knowledge about the operation of RTB and “strategic decision-making” about the RTB auction process during the class period, see Dkt. No. 209 at 2, Topic 1 encompasses relevant subject matter. However, the Court has two concerns about this topic: First, a Rule 30(b)(6) deposition seems an inefficient and burdensome vehicle for identifying relevant witnesses. This discovery is usually obtained by means of an interrogatory and/or a request for production of organizational charts. Second, and more importantly, Topic 1 encompasses vastly more information than the identity of witnesses with knowledge relevant to the claims and defenses in this action. The Court agrees with Google that the topic is overbroad and that it would be impossible for Google to designate and prepare a representative or representatives to testify about its full scope. The Court will not require Google to designate a representative to testify regarding Topic 1 as presently drafted. B. Topic 2 Plaintiffs ask Google to designate a corporate representative to testify about: The location and sources of data streams sufficient to identify data related to Google RTB, including the following: a. Location and sources of data concerning Google RTB participants, bids, advertisers, and ads; b. Location and sources of data concerning the targets of concerning Google RTB; d. Location and sources of data concerning the technology of Google RTB; and, e. Location and sources of data concerning reports and studies concerning Google RTB. Dkt. No. 209-1 at 6. The Court struggles to understand what information plaintiffs hope to obtain via this multi- part topic. Portions of this topic appear to seek information about Google’s efforts to identify relevant documents for production—e.g., “[l]ocation and sources of data related to complaints concerning Google RTB,” “[l]ocation and sources of data concerning the technology of Google RTB,” and “[l]ocation and sources of data concerning reports and studies concerning Google RTB.” But during the hearing, plaintiffs disavowed this purpose and explained that their principal concern is obtaining deposition testimony about the location and sources of data about account holders that is disclosed or used in RTB and the location and sources of data about third-party RTB participants, bids, advertisers, and their ads. Also, during the hearing, plaintiffs’ counsel asserted that information identifying the location of the server where Google stores personal information of account holders is critical to plaintiffs’ ability to establish a necessary element of their CIPA claim. None of this discussion appears in plaintiffs’ portion of the discovery dispute submission, and it appears plaintiffs did not discuss these matters with Google either. Topic 2 is poorly crafted and not well-considered. Furthermore, the Court expects the parties to present their positions in writing in advance of the hearing, after discussing their disagreements and before asking the Court to resolve their dispute. That did not happen here. The Court will not require Google to designate a representative to testify regarding Topic 2 as presently drafted. C. Topic 3 Plaintiffs ask Google to designate a corporate representative to testify about: How RTB operates, including but not limited to: a. What Google Account Holder information flows through RTB and how that information is collected and stored within Google, and how it is shared, distributed and sold through RTB; b. How Google determines who can participate in RTB, ii How agreements between Google and participants are typically structured, paid for, and memorialized; and, iii. A general description of agreements between Google and any RTB participant (for example, the agreement between Google and Facebook codenamed “Jedi Blue”) that do not follow the way agreements are typically structured; c. How Google determines pricing within RTB; d. How Google determines who wins a bid in RTB including any providing preferential or different treatment from other participants; e. How Google and participants associate, map, or link information shared in RTB with information already compiled about RTB targets, including whether Google and participants coordinate such association, mapping or linking; f. How and where Google stores information disclosed through RTB, the bids received, and the winning bid; and, g. Identification of Google owned or operated entities and properties that participate in RTB. Dkt. No. 209-1 at 7-8. The parties disagree about whether all subparts of this topic seek relevant information, particularly given this Court’s prior order regarding plaintiffs’ RFP 22. See Dkt. No. 184. Google specifically objects to subparts (d), (f), and (g). Dkt. No. 209 at 6. Plaintiffs do not explain why Google should be required to provide a corporate representative to testify regarding how it determines who wins a bid in RTB, how it stores information about the bids themselves, and which “Google-owned properties” participate in RTB. During the hearing, plaintiffs explained that they suspect RTB participants who share account holder information with Google, or who have some special contractual arrangement with Google, may obtain preferential treatment in the RTB auction. Plaintiffs did not make this argument in their portion of the discovery dispute letter and it appears they also did not raise it with Google. For the reasons discussed above in connection with Topic 2, the Court will not entertain this justification now. Google must identify a corporate representative to testify regarding Topic 3(a), (b), (c), and (e), except that Google need not provide a representative to testify regarding how information is “collected and stored” (as opposed to “used or disclosed”) for purposes of RTB. Google need not identify a corporate representative to testify regarding subparts (d), (f), and (g). D. Topic 4 Plaintiffs ask Google to designate a corporate representative to testify about: [C]hanges to the operation of RTB and why those changes were or were not implemented, including changes contemplated as a result of: a. Any investigation or court case; b. Privacy laws; c. Google Account Holder’s privacy expectations; d. Google’s Terms of Service; and, e. Google’s Privacy Policy. Dkt. No. 209-1 at 9. The parties disagree about whether Google should be required to provide testimony about changes to RTB that Google contemplated but did not make and regarding changes unrelated to the disclosure of account holder information. As an example, plaintiffs argue that they should be permitted to obtain testimony regarding whether Google “was aware that disclosure of [account holder] information through RTB violated privacy expectations and Google’s own Terms [of Service]” and “contemplated ceasing such disclosure but did not implement such a change because of the profits derived from it.” Dkt. No. 209 at 3. Plaintiffs do not explain how this testimony is relevant to a claim or defense, but the Court assumes they believe it supports their damages claims. As drafted, Topic 4 would require Google to prepare a witness to testify regarding any change to the operation of RTB during the class period that was contemplated (but never made) “as a result of” any investigation or court case, unspecified privacy laws, unidentified account holder privacy expectations, or any aspect of Google’s Terms of Service or Privacy Policy, regardless of whether the change concerned the disclosure of account holder information to third parties in the RTB auction. The scope of this topic is far broader than any conceivably relevant information about changes to RTB that Google could have made but did not. While it is possible there is some relevant testimony beyond what Google has agreed to provide that plaintiffs may be entitled to obtain, plaintiffs have not provided an adequate justification for a broader scope of discovery, nor have they had a meaningful discussion about such broader scope with Google. The Court will not attempt to re-draft this topic for the parties. Google must identify a corporate representative to testify regarding Topic 4 with respect to changes made to the operation of RTB to the extent those changes impact the disclosure of account holder information to third parties or the use made of account holder information for made. Google need not identify a corporate representative to testify regarding the remainder of this topic as drafted. E. Topic 5 Plaintiffs ask Google to designate a corporate representative to testify about: The creation, maintenance and use of user Profiles and Verticals, user lists or methods of categorizing Google Account Holders disclosed through RTB or used to target users through RTB. Dkt. No. 209-1 at 10. Google objects to providing testimony about “creation” and “maintenance” and about “user lists” and “methods of categorization.” For the reasons discussed at the hearing, the Court concludes that Google must identify a corporate representative to testify regarding Google account holder profiles, verticals, or other methods of categorizing account holders that are shared with third-party RTB participants or used to target account holders for advertising through the RTB process. Google need not identify a corporate representative to testify regarding the remainder of this topic. F. Topic 6 Plaintiffs ask Google to designate a corporate representative to testify about: Identifiers and cookies that can be mapped, associated, or linked to Google Account Holders to create or derive information used to target them with advertising arising out of RTB, including how they are created or maintained. Dkt. No. 209-1 at 11. Google objects to providing testimony about identifiers and cookies that “can be” mapped and about how they are “created” or “maintained.” For the reasons discussed at the hearing, the Court concludes that Google must identify a corporate representative to testify about identifiers and cookies that are mapped, associated, or linked to Google account holders or that allow third-party RTB participants to target account holders for advertising through the RTB process. Google need not identify a corporate representative to testify regarding the remainder of this topic. G. Topic 7 Plaintiffs ask Google to designate a corporate representative to testify about: maintained. Dkt. No. 209-1 at 12. Google objects to providing testimony about how location information is “collected” or “maintained.” For the reasons discussed at the hearing, the Court concludes that Google must identify a corporate representative to testify about location information related to Google account holders that is disclosed to third-party RTB participants through the RTB process. Google need not identify a corporate representative to testify regarding the remainder of this topic. H. Topic 8 Plaintiffs ask Google to designate a corporate representative to testify about: Google Account Holder information that is disclosed through RTB that is linked to: a. Revenue or pricing information; and, b. Advertising information, for example conversion tracking or attribution pipelines. Dkt. No. 209-1 at 12-13. The parties disagree about whether this topic adequately describes the subject matter of the examination requested. Google objects that several terms used in this topic are vague. Plaintiffs insists they are not. As discussed during the hearing, this is the kind of dispute that should have been resolved, or at least narrowed, once the parties had a candid discussion about what plaintiffs wish to discover, why it is relevant, and how the subject matter should be described so that a representative can be prepared to address it. This did not happen, or if it did, the parties’ submission and oral argument do not reflect any useful outcome of that discussion. As drafted, Topic 8 is vague and confusing. Plaintiffs can do better. Until they do, the Court will not require Google to identify a corporate representative to testify about this topic. I. Topics 9, 10, and 13 In Topic 9, plaintiffs ask Google to designate a corporate representative to testify about: Google’s policies and disclosures related to the use of Google Account Holder information in RTB or for advertising purposes, including but not limited Google’s Terms of Service, Google’s Privacy Policy, and the following statements: a. “you get to decide how your information is used” (CAC ¶ 11); parties” (id.); d. “Advertisers do not pay us for personal information” (id.); e. “We don’t share information that personally identifies you with advertisers” (id.); f. “We also never use…sensitive information like [race], religion, or sexual orientation, to personalize ads to you” (id.); and, g. “We don’t show you personalized ads based on sensitive categories, such as race, religion, sexual orientation, or health[]” (id.). Dkt. No. 209-1 at 13-14. In Topic 10, for each listed policy, disclosure, or statement, plaintiffs ask a corporate representative to testify about: a. the identity of Google employees, teams, team leaders, divisions, and organizational structure responsible for the drafting, revising, approving and finalizing of the language used; b. The purpose of policies, disclosures, or language used for each of those six promises, including the basis for proposed changes or modifications and why such changes or modifications were or were not implemented; c. Studies, analyses, panels, research, customer service initiatives regarding the six statements above; and, d. Inquiries or investigations by regulators, governmental agencies, or other individuals or entities relating to those six statements. Id. at 14-15. In Topic 13, plaintiffs ask a corporate representative to testify about: Policies, disclosures or statements on which Google claims it obtained consent for the disclosure and sale of Google Account Holder information through RTB. Id. at 18. The parties disagree about whether these topics seek relevant testimony and whether they are overbroad. Plaintiffs rely on the statements listed in Topic 9 for their complaint. See Dkt. No. 92 ¶¶ 11, 339-352; see also Dkt. No. 93 at 9-13. However, it is not clear from the parties’ written submission what information about these statements plaintiffs wish to obtain from a corporate fact witness. During the hearing, plaintiffs explained that they are interested in testimony about the “operation” of Google’s policies and disclosures, when the specific statements appeared, and how they are displayed to account holders. Also, during the hearing, plaintiffs explained that Topic 13 seeks testimony about the “consent flow,” or how Google obtains consent to use or disclose account holders’ information. plaintiffs improperly seek testimony about the legal significance of the statements or about Google’s legal contentions. Dkt. No. 209 at 7 (citing 3M Co. v. Kanbar, No. C 06-01255 JW (HRL), 2007 WL 1794936, at *2 (N.D. Cal. June 19, 2007) (inquiries seeking “legal conclusions . . . should not form the basis for 30(b)(6) deposition topics”) and Lenz v. Universal Music Corp., No. C 07-03783 JF (PVT), 2010 WL 1610074, at *3 (N.D. Cal. Apr. 20, 2010) (same)). The Court agrees with Google that it is improper for plaintiffs to use Topics 9, 10, and 13 to obtain Google’s legal contentions or legal conclusions. However, to the extent plaintiffs wish to obtain testimony about facts concerning the policies, disclosures, and statements at issue—e.g., when a statement was posted and how it is displayed to an account holder—they may do so, provided they give Google fair notice about what information they seek so that Google can adequately prepare a corporate representative. In addition, Topic 9 should be limited to policies, disclosures, and statements related to the disclosure of account holder information to third-party RTB participants or the use of such information to target account holders for advertising through the RTB process. Topic 10 is overbroad to the extent it asks for the identities of all “employees, teams, team leaders, divisions, and organizational structure responsible for” any aspect of the Google’s terms of service, privacy policy, or specific statements. Plaintiffs may ask about changes to these materials that impact (i) the disclosure of account holder information to third parties or (ii) the use made of account holder information for purposes of targeting an account holder for advertisements via RTB, and why those changes were made, as well as studies, analyses, and research conducted by Google or on its behalf concerning the specific statements identified in Topic 9. Google need not identify a corporate representative to testify about “inquiries” or “investigations” relating to the specific statements because plaintiffs have not described this portion of Topic 10 with reasonable particularity. As for Topic 13, to the extent plaintiffs intend to use Topic 13 to discover Google’s contentions about which statements or disclosures support Google’s position that disclosure or use of account holder personal information in the RTB process does not occur without the account holders’ consent, a corporate deposition is not the appropriate vehicle for such discovery in the first instance. To the extent they seek with reasonable particularity. Until they do, the Court will not require Google to identify a corporate representative to testify about Topic 13. J. Topic 11 Plaintiffs ask Google to designate a corporate representative to testify about: Studies, research or projects conducted or relied on by Google, of users’ experiences, expectations, understanding, or user flow relating to: a. Google RTB; b. Privacy issues relating to expectations of users concerning how their information is collected and used in auction; c. Confusion regarding Google’s Terms of Services, Google’s Privacy Policy, or any other Google disclosure or statement related to collection and use of Google Account Holder information used to target users as a result of the RTB process; and, d. Features, tools, or settings that would preclude Google from using Google Account Holder information through RTB. Dkt. No. 209-1 at 16. The parties disagree about the proper scope of this topic. Plaintiffs focus on the part of the topic that concerns Google’s “study and testing of tools to preclude Google’s use of [account holder] information,” which plaintiffs say is relevant to the question of account holders’ informed consent to the use or disclosure of their personal information. Dkt. No. 209 at 3-4. Google argues that Topic 11 uses vague terms, like “user expectations” and “understandings,” and is overbroad because it covers matters that are not tied to RTB. It agrees to provide testimony about “formal studies and analyses concerning user expectations, knowledge, and awareness of RTB.” Id. at 7. As with a number of other topics in the notice, plaintiffs have not adequately justified the scope of this topic or described the matters for examination with reasonable particularity. Based on the information presented, the Court will require Google to identify a corporate representative to testify about studies and analyses conducted by Google or on its behalf concerning user expectations, knowledge, and awareness of (i) RTB, (ii) the information disclosed to third-party RTB participants, and (iii) the information used to target account holders for advertising through the RTB process. Google need not identify a corporate representative to testify regarding the remainder of this topic, particularly if Google will provide testimony within the scope of Topic 12 K. Topic 14 In Topic 14, plaintiffs ask Google to designate a corporate representative to testify about several discrete subtopics that appear to concern to the value of account holder information and the financial benefit Google obtains from RTB, all relating to plaintiffs’ damages claims. Dkt. No. 209-1 at 18-19. The parties have a pending dispute regarding document discovery on many of these same matters, which is the subject of prior Court orders and on-going discussions. See Dkt. No. 189 at 4-6; Dkt. No. 217 (RFPs 46-49, 51, 54-56). The resolution of the dispute concerning Topic 14 likely will be informed by the outcome of the parties’ discussions about document discovery on the same matters. The Court will defer its decision on this dispute until the document discovery dispute is resolved. L. Topic 15 Plaintiffs ask Google to designate a corporate representative to testify about: Google’s use of information collected from Google Account Holders which is used in way[sic] to target them for advertising tied to the RTB auction including: a. User profiles, user verticals, user demographics, taxonomies, user lists or other categorizations of users, and the teams and team leaders at Google responsible for their creation and calibration; and, b. Data flow for the above-referenced data used for advertising purposes through RTB. Dkt. No. 209-1 at 19. The parties disagree about the scope of this topic and whether it is overbroad. Topic 15 appears intended as a catch-all for anything that other topics might have missed. When pressed at the hearing, plaintiffs were unable to explain what relevant information Topic 15 encompasses that is not covered by another topic. Because the scope of this topic duplicates or substantially overlaps with other topics the Court has discussed above, the Court will not address it separately here, and Google need not identify a corporate representative to testify specifically regarding this topic. M. Timing of Rule 30(b)(6) Deposition Plaintiffs ask the Court to order Google to provide a corporate representative to testify no later than June 15, 2022. Dkt. No. 209 at 4. During the hearing, plaintiffs cited the need to obtain this discovery in preparation for filing their motion for class certification, due September 26, 2022. Google argues that it should not be required to prepare its representatives and provide testimony until the parties’ disputes about the scope of the deposition are resolved and Google has substantially completed its document production, which must be done by July 11, 2022. Id. at 8; Dkt. No. 228. The Court is not persuaded that plaintiffs must take a Rule 30(b)(6) deposition by June 15 in order to have adequate time to prepare for class certification. Moreover, the scope of the deposition likely will not be finally resolved by June 15. Google should make its corporate representatives available for deposition promptly after the July 11, 2022 deadline for substantial completion of document production. A. Discovery Dispute Resolution Procedures The Court was not well-served by parties’ written submission in this matter. Plaintiffs’ portion of the submission was particularly unhelpful in showing why they should be permitted to obtain the disputed testimony. The Court’s discovery dispute resolution procedures are intended to provide an expeditious means for presenting and resolving discovery disputes. See Standing Order for Civil Cases (Section 4). Those procedures require each side to present its arguments in no more than 1500 words. The procedures also include the following guidance: A single joint discovery dispute letter should address only one discrete issue or a few issues that are inextricably related. Multiple joint discovery dispute letters may be filed following a single conference of lead counsel if multiple discrete disputes remain unresolved, but parties should not use multiple letters to avoid the word limits set forth above. The Court is skeptical of claims that parties need more words or pages to describe their respective positions. By eliminating unnecessary background information and unnecessary discussion of undisputed matters (e.g., the legal standard for discovery), parties generally can streamline their submission so that it focuses on the critical issues in dispute. However, if in the future a party believes that a dispute cannot be adequately presented within the limitations set forth in the Standing Order, it may ask the Court for relief from those 1 limitations by filing a stipulated request or by filing a motion for administrative relief (see Civil 2 L.R. 7-11). Any such request or motion must explain why the party requires relief from the 3 Standing Order. 4 B. Creation, Source, and Storage of Account Holder Information 5 In resolving this and the parties’ other discovery disputes, the Court has permitted 6 discovery about Google’s alleged disclosure of account holder information to third-party RTB 7 participants, but has not permitted discovery about the creation, source, or storage of such 8 information. During the hearing on this matter, plaintiffs advised the Court that they believe 9 discovery of the creation and/or source of account holder information is relevant to the disputed 10 issue of whether the information is or is not “personal information” as that term is defined by ll California law. Dkt. No. 228 (audio recording at 11:22 a.m. — 11:26 a.m.). In addition, as noted 12 above, plaintiffs argued that where the information is stored is relevant to their CIPA claim. This 13 is the first time plaintiffs have offered these justifications for discovery of information and 14 documents about the creation, source, and storage of Google account holder information. These 3 15 arguments do not appear in any of plaintiffs’ prior discovery dispute submissions, and Google has 16 not had an opportunity to fully address plaintiffs’ arguments. 3 17 The Court is not inclined to entertain arguments that should have been presented earlier 18 and in writing. However, because the scope of relevant discovery—and, in particular, whether it 19 should encompass not only disclosure of information, but also its creation, source, and storage—is 20 a persistent feature of the parties’ many discovery disputes, the Court would benefit from the 21 parties’ views on this subject in the form of a further, brief written submission. Accordingly, the 22 parties shall confer about how to provide this further submission to the Court and shall file their 23 agreed proposal or their respective proposals by June 14, 2022 for the Court’s consideration. 25 Dated: June 8, 2022 26

28 VIRGINIA K. DEMARCHI United States Magistrate Judge