ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS PURSUANT TO FED.R.CIV.P. 12(b)(6)
TIMLIN, District Judge.
The court, Judge Robert J. Timlin, has read and considered defendant Intuit, Inc. (“Defendant”)’s motion (the “Motion”) pursuant to Fed.R.Civ.P. 12(b)(6) (“Rule 12(b)(6)”), plaintiffs Theresa Bruce and Joel Newby, on behalf of themselves and all others similarly situated (“PIaintiffs”)’s ' opposition, and Defendant’s reply. Based on such consideration, the court concludes as follows:
I.
BACKGROUND
Plaintiffs filed their first consolidated amended class action complaint (the “FAC”) in this court on July 28, 2000. Plaintiffs allege three federal statutory-based claims for violations of 18 U.S.C. § 2701, et seq. (“Section 2701”), 18 U.S.C. § 2511, et seq. (“Section 2511”), 18 U.S.C. § 1030, et seq. (“Section 1030”) and two supplemental state claims: one based upon alleged violations of Article I, Section 7 of the California Constitution and a second for unjust enrichment (the “Supplemental State Claims”).
Plaintiffs are computer-users who have visited Defendant’s website: “www.quicken.com.” Plaintiffs allege that Defendant violated their privacy rights during these visits primarily through implantation of “cookies.”
Plaintiffs allege that:
A “cookie” is an electronic file that online companies, including Intuit, implant upon computer users’ hard drives when those users visit Internet Web sites such as Quicken.com.... Cookies are generally created by Web servers and implanted on users’ computers when they first establish their connection to the Web site or particular Web pages therein.
Cookies, which Internet companies can differentiate between by assigning unique identification numbers to each computer user, can contain virtually any kind of information. Cookies generally perform many convenient and innocuous functions, such as keeping track of items Web site visitors may purchase. Cookies are also commonly used to keep track of usernames and passwords to make it easier for people to access Web sites that require authentication to view certain Web pages.
The original purpose of the cookie, however, has been subverted by advertising entities like Doubleclick, and the companies that use such firms, as a method to track and record a particular user’s movements across the Web and to gather, via rampant and undisclosed cookie implantation, among other things, personal and confidential information about computer users — -information that computer users are unaware is being perpetually harvested for others’ commercial benefit and enrichment. Information contained in implanted cookie files is sent back to the implanting company or entity each subsequent time that the user visits that Web site or particular Web page so that the information viewed by the Web user can be “linked” to the computer containing the cookie.
Plaintiffs allege that Defendant placed cookies on their computers.
II.
ANALYSIS
A Rule 12(b)(6) motion to dismiss for failure to state a claim is a disfavored one,
see Hall v. City of Santa Barbara,
833 F.2d 1270, 1274 (9th Cir.1986), which may only be granted in extraordinary circumstances.
See United States v. City of Redwood City,
640 F.2d 963, 966 (9th Cir.1981). Essentially, a motion to dismiss for failure to state a claim tests plaintiffs compliance with the liberal requirements of Rule 8(a)(2) of the Federal Rules of
Civil Procedure (“Rule 8(a)(2)”).
See
5A Charles Alan Wright
&
Arthur R. Miller,
Federal Practice and Procedure
§ 1356, at 294-96 (1990).
The burden imposed by Rule 8(a)(2) is a minimal one. Rule 8(a)(2) requires parties seeking relief in federal court by way of complaint, counterclaim, cross-claim, or third party complaint, to include “a short and plain statement of the claim showing that the pleader is entitled to relief.” In meeting this requirement, a plaintiff need not set forth the legal basis for his claim, only the facts underlying it.
See McCalden v. California Library Assoc.,
955 F.2d 1214, 1223 (9th Cir.1990).
It is the burden of the party bringing a motion to dismiss for failure to state a claim to demonstrate that the requirements of Rule 8(a)(2) have not been met.
See Kehr Packages, Inc. v. Fidelcor, Inc.,
926 F.2d 1406, 1409 (3d Cir.1991) (“[U]n-der Rule 12(b)(6) the defendant has the burden of showing no claim has been stated.”)
A. Section 2701
Section 2707 permits a civil action by a person aggrieved by a violation of Section 2701. Section 2701 is violated where a person or entity:
(1) intentionally accesses without authorization a facility through which an electronic communication service is provided; or
(2) intentionally exceeds an authorization to access that facility; and thereby obtains, alters, or prevents authorized access to a wire or electronic communication while it is in electronic storage in such system.
Defendant contends that Plaintiffs have failed to state sufficient facts to allege a violation of Section 2701 in two respects: (1) Plaintiffs did not allege that Defendant was a “third party to the communications at issue” and (2) Plaintiffs did not sufficiently allege that Defendant “accessed an ‘electronic communication while it [was] in electronic storage in’ an electronic communication system.”
1. Third-party ’
The court has difficulty understanding the basis of Defendant’s contention that it could not have violated Section 2701 because it was in “communication” with Plaintiffs when the violation allegedly occurred. It is this court’s view that Section 2701 does not require, nor has any court ever interpreted it to require, that a defendant accused of violating Section 2701 be a third-party to an electronic com
munication which eventually may be in electronic storage in a facility. More specifically, Section 2701 does not require that there be a “communication” at all, i.e. the existence or absence of communication is irrelevant. The primary act required for violation of Section 2701 is the act of accessing electronically stored data.
For example a hypothetical “hacker”
who accesses data in a computer without the owner’s knowledge would be guilty of violating Section 2701 even though the hacker had no “communication” with the storing agency, i.e. the hacker is not a “third-party” to a communication.
In support of its contention that Section 2701 requires a defendant to be a “third-party to the communications at issue,” Defendant cites Section 2701(c) which excepts from liability “conduct authorized ... (2) by a user of that service
with respect to a communication of or intended for that user....” It is unclear to the court how this exception buttresses Defendant’s contention. Although it is true that a “communication” would need to exist for this exception to apply, this exception does not mean that a “communication” must be taking place at the time the violation of Section 2701 occurs or that the violator must be a third-party to that conversation.
Defendant relies primarily on two cases in support of its position. Neither is on point as both deal with the issue of authorization to access a facility. In
State Wide Photocopy Corp. v. Tokai Fin. Serv., Inc.,
909 F.Supp. 137 (S.D.N.Y.1995), the plaintiff, State Wide, alleged that the defendant, Tokai, “intentionally exceeded State Wide’s authorization to use the proprietary information contained in the lease applications electronically submitted to Tokai by State Wide, which information was stored by Tokai and/or Tokai Bank on its computer facilities, and obtained and provided such proprietary information to Atlantic in violation of 18 U.S.C. § 2701.”
Id.
at 145. The court reasoned that Tokai could not have violated Section 2701 because one has authorization to access one’s own computers.
See id.
Unlike the plaintiff in
State Wide,
Plaintiffs are not alleging that Defendant accessed Defendant’s computers; Plaintiffs are alleging that Defendant accessed Plaintiffs’ computers.
In
Sherman & Co. v. Salton Maxim Housewares,
94 F.Supp.2d 817 (E.D.Mich. 2000), the defendant/counter-plaintiff, Salton, alleged that plaintiff/counter-defendant, Sherman, “accessed certain of [Salton’s] sales information located in the Kmart network after his dismissal.”
Id.
at 821. The court reasoned that Saltón had failed to allege a violation of Section 2701 because:
Saltón admits that Kmart provided Sherman with authorization to log on to the computer network to access information about vendors and products that Sherman was representing. Further, Kmart continued to provide James Sherman access to Salton’s information after his dismissal by Saltón. Saltón has not pled nor offered to show that Kmart instructed Sherman that he no longer
had authorization to access Salton’s sales information. Nor has Saltón pled or offered to show that there was an agreement between the parties that limited plaintiffs access on the Kmart network.
Id.
Unlike the plaintiff in
Saltón,
Plaintiffs here allege that they did not authorize Defendant to access data contained in the cookies it implanted on Plaintiffs’ computers. If the thrust of Defendant’s “third party” contention is that it was authorized to access data in Plaintiffs’ computer, the court must reject it as it directly conflicts with Plaintiffs’ allegations that Defendant was not so authorized, which allegations the court must accept as true for the purposes of a Rule 12(b)(6) motion to dismiss.
2. Electronic Storage
Defendant contends that (1) “[w]hile the complaint contains a concluso-ry allegation that [Defendant] accessed information while in electronic storage in plaintiffs’ own computers (Complaint ¶ 52), there are no facts alleged to support the conclusion” and (2) “the facts that are alleged are entirely inconsistent with that conclusion,” i.e. because the Plaintiffs allege that their personal information was “intercepted” they cannot also allege that it was “accessed.”
a. Conclusory Allegations
As to Defendant’s first contention, Plaintiffs have alleged that Defendant accessed data contained in “cookies” that it placed in Plaintiffs’ computers’ electronic storage. The court concludes that this allegation satisfies the liberal requirements of Rule 8(a)(2).
b. Inconsistent Allegations
As to Defendant’s second contention, the court concludes that Plaintiffs’ allegations are not impermissibly factually inconsistent. The contention appears to be premised on the proposition that one act cannot constitute both “accessing” electronic communications for the purposes of Section 2701 and “interception” of electronic communications for the purposes of Section 2511. The court need not reach the issue whether Defendant’s proposition is an accurate statement of the law.
The fact that Plaintiffs have alleged that certain electronic communications were intercepted in transit at one time does not preclude it from also alleging that other electronic communications were accessed while in electronic storage at another time.
B. Section 2511
Section 2520 authorizes a civil action by “any person whose wire, oral, or electronic communication is intercepted, disclosed, or intentionally used in violation of this chapter.” It appears that Plaintiffs allege that Defendant violated Section 251(l)(a) which provides:
(1) Except as otherwise specifically provided in this chapter any person who—
(a) intentionally intercepts, endeavors to intercept, or procures any other person to intercept or endeavor to intercept, any wire, oral, or electronic communication;
shall be punished as provided in subsection (4) or shall be subject to suit as provided in subsection (5).
Defendant contends that Plaintiffs have failed to properly plead a violation of Section 2511 because Plaintiffs did not allege that Defendant was a third-party-interceptor of, in contrast to a participant in, an electronic communication. Plaintiffs do not deny that Defendant was a participant to the electronic communications at issue, but contend that Defendant has violated Section 2511 because it intercepted the electronic communications with a criminal or tortuous purpose.
Plaintiffs have failed to state any facts in their complaint which support the allegation that Defendant intercepted electronic communications for the purpose of committing a tortious or criminal act. Plaintiffs contend that the following acts (the “Acts”), committed by Intuit, satisfy the tortious purpose requirement:
Intuit and/or third-parties assisted by Infuit intercepted Class members’ electronic communications for the purposes of implanting unauthorized cookies on Class members’ computers; repeatedly accessing electronic communications, without Class members’ knowledge and consent so as to profile such persons’ Web browsing habits; secretly tracking Class members’ activities on the Internet and collecting personal information about consumers; and profiting from the use of the illegally obtained information, all to Intuit’s benefit and Class members’ detriment.
But Plaintiffs have not alleged that Defendant engaged in acts of interception for the purpose of facilitating the aforementioned Acts, and such a purpose cannot be reasonably inferred from the FAC.
For example, based upon the allegations in the complaint respecting how “cookies” are implanted, it is unclear to the court how intercepting Plaintiffs’ electronic communications could have conceivably facilitated the placement of cookies on Plaintiffs’ computers.
Plaintiffs do allege in the FAC that Defendant had a “tortious purpose or a purpose that violates the constitutional rights of plaintiffs and class members,” but this bare allegation mirroring the statutory language is insufficient to survive a Rule 12(b)(6) motion to dismiss.
See
Schwarzer, Tashima
&
Wagstaffe, Federal Civil Procedure Before Trial § 9:211 (“The court need not accept as true conclusionary allegations or legal characterizations.”);
Halkin v. VeriFone, Inc.,
11 F.3d 865, 868 (9th Cir.1993) (“Conclusory allegations of law and unwarranted inferences are insufficient to defeat a motion to dismiss for failure to state a claim.”).
Plaintiffs also contend that Defendant’s “purpose” is a question of fact which cannot be addressed in a motion to dismiss. Although the court must accept Plaintiffs’ well-pled allegations as true in the context of a motion to dismiss under Rule 12(b)(6), the court has concluded that Plaintiffs have failed to sufficiently allege a tortious purpose — not that Plaintiffs’ allegations are false.
Finally Plaintiffs contend that the criminal or tortious purpose requirement was satisfied because they alleged that Defendant violated Section 2511, Section 2701,
and Section 1030
and that Defendant violated their California Constitutional right to privacy and was unjustly enriched. Again Plaintiffs have not alleged that Defendant intercepted their electronic communications with the purpose of facilitating these violations nor can the court reasonably infer that Defendant did so.
See Sussman v. Am. Broad. Companies,
186 F.3d 1200, 1202-03 (9th Cir.1999) (affirming summary judgment granted in favor of defendant journalists who eavesdropped on telephone conversations; the court reasoned: “Under section 2511, the focus is not upon whether the interception itself violated another law; it is upon whether the purpose for the interception — its intended use — was criminal or tortious.... Where the tapping is legal, but is done for the purpose of facilitating some further impropriety, such as blackmail, section 2511 applies. Where the purpose is not illegal or tortious, but the means are, the victims must seek redress elsewhere.”) (citations omitted).
Because Plaintiffs have failed to sufficiently allege a tortious or criminal purpose, dismissal of Plaintiffs’ Section 2520 claim without prejudice is appropriate.
C. Section 1030
Section 1030(g)
authorizes any person who suffers damage or loss by reason of a violation of Section 1030 to maintain a civil action. Section 1030, entitled “Fraud and Related Activity in Connection with Computers,” prohibits a wide-range of conduct. Plaintiffs do not specify in either the FAC or their opposition to the Motion which portions of Section 1030 were violated by Defendant. It appears that Plaintiffs are invoking both Section 1030(a)(2)(C)
and
Section
1030(a)(5)(A)
.
Defendant contends that Plaintiffs have failed to satisfy Section 1030(a)(2)(C) and (a)(5)(A) scienter elements. It further contends that Plaintiffs have failed to allege economic damages as required by the statute.
1. Scienter
A person violates Section 1030(a)(2)(C) where that person “intentionally accesses a computer without authorization or exceeds authorized access.” Section 1030(a)(5)(A) requires that a defendant “knowingly cause the transmission of a program, information, code, or command.” Plaintiffs have alleged that Defendant intentionally placed cookies on Plaintiffs’ computers; the cookies allegedly allowed Defendant to retrieve data from Plaintiffs’ computers. Plaintiffs allege that Defendant placed the cookies on the computers and retrieved the data for the purpose of monitoring Plaintiffs’ web activity. The court concludes that these allegations are sufficient to satisfy scienter elements of Section 1030(a)(2)(C) and Section 1030(a)(5)(A).
2. Damage or Loss
The question presented by the parties is whether a plaintiff must suffer economic damages in order to bring a claim under Section 1030(g). The statute is not an example of clarity, and by reason of its ambiguity requires interpretation. Based on its interpretation, as discussed below, the court concludes that although a plaintiff need not always suffer economic damages to bring a valid Section 1030(g) claim, economic damages are a necessary element based on the facts alleged in this case.
This issue appears to be one of first impression in this circuit and to some extent, the federal courts.
Section 1030(g) provides that a person must suffer “damage or loss.” The term “damage” is defined by the statute — while the term “loss,” is not.
The parties proffer two possible statutory constructions. Under one construction, the term “loss” is construed as a subset of the term “damage,” i.e. “loss” is “damage” so complete as to constitute destruction of whatever thing suffered the damage. Defendant advocates this construction. Under the alternative construction, “loss” is
construed as meaning both economic and non-economic damages. Plaintiffs advocate this construction.
“[I]n interpreting a statute a court should always turn first to one, cardinal canon before all others. We have stated time and again that courts must presume that a legislature says in a statute what it means and means in a statute what it says there. When the words of a statute are unambiguous, then, this first canon is also the last: judicial inquiry is complete,”
Connecticut Nat’l Bank v. Germain,
503 U.S. 249, 253-54, 112 S.Ct. 1146, 117 L.Ed.2d 391 (1992) (citations omitted), keeping in mind, of course, that “the meaning of words depends on their context.”
Shell Oil Co. v. Iowa Dept. of Revenue,
488 U.S. 19, 25 n. 6, 109 S.Ct. 278,102 L.Ed.2d 186 (1988) (citing
NLRB v. Federbush Co.,
121 F.2d 954, 957 (2nd Cir.1941) (“Words are not pebbles in alien juxtaposition; they have only a communal existence; and not only does the meaning of each interpenetrate the other, but all in their aggregate take their purport from the setting in which they are used.... ”)). Furthermore, “unless otherwise defined, words will be interpreted as taking their ordinary, contemporary, common meaning.”
United States v. Smith,
155 F.3d 1051, 1057 (9th Cir.1998). Finally, “[w]e may not interpret a statute so as to render some of its language superfluous; at any rate, we may not do so lightly.”
Hearn v. W. Conference of Teamsters Pension Trust Fund,
68 F.3d 301, 304 (9th Cir.1995);
see also Beisler v. Commissioner of Internal Revenue,
814 F.2d 1304, 1307 (9th Cir.1987) (en banc) (“We should avoid an interpretation of a statute that renders any part of it superfluous and does not give effect to all of the words used by Congress.”).
Applying these canons, it is clear to the court that “loss” as it is used in Section 1030(g) means irreparable damage. Any broader interpretation of the term “loss” would render the term “damage” superfluous. As a consequence, the court concludes that in order to bring a civil action under Section 1030(g) a plaintiff must suffer “damage” as defined in Section 1030(e)(8). This determination does not mean, however, that an entity or individual must suffer economic damages to bring suit under Section 1030(g). Section 1030(g) limits plaintiffs to economic damages only if the violation involved “damage” as defined in Section 1030(e)(8)(A), which implicates damages due to a loss. Therefore, if a plaintiff suffers “damage” as defined in Section 1030(e)(8)(B)(C) or (D), non-economic damages would be available. This common-sense interpretation renders operative each term in Section 1030(g) and is consistent with the general scheme of Section 1030 which seeks to prevent computer fraud that causes loss or injury
Applying Section 1030(g) as interpreted above, the Plaintiffs’ Section 1030 claim will be dismissed without prejudice. Plaintiffs do not contend that they have suffered “damage” as defined by Section 1030(e)(8)(B)(C) or (D), and the FAC does not include sufficient facts constituting an allegation or reasonable inference therefrom that Plaintiffs suffered at least $5,000 in economic damages.
D. Supplemental Jurisdiction
The Motion as it relates to dismissal of the supplemental state claims is dependent upon dismissal of all the federal claims. Because the court will not dismiss Plain
tiffs’ Section 2707 federal claim, it will not dismiss the supplemental state claims.
III.
DISPOSITION
ACCORDINGLY, IT IS ORDERED THAT:
(1) Defendant’s motion to dismiss as it relates to Plaintiffs’ Section 2707 claim and the supplemental state claims is DENIED;
(2) Defendant’s motion to dismiss as it relates to Plaintiffs’ Section 1030 and Section 2520 claims is GRANTED without prejudice;
(3) Plaintiff shall have 23 days from the date of this order in which to file a Second Amended Complaint consistent with the analysis part of this order.