MEMORANDUM
TAURO, District Judge.
Plaintiffs Rob Barring, Noah Blumofe, Jim Darby, Karen Gassman, Robin McClary, Harris Perlman, and Marcus Schroers (“Plaintiffs”) bring this consolidated action against Pharmatrak, Inc. (“Defendant Pharmatrak”)
and several pharmaceutical companies: Pfizer, Inc., Pharmacia Corporation, SmithKline Beec-ham Corporation, Glaxo Welcome, Inc., and American Home Products Corporation (the “Pharmaceutical Defendants”). The Consolidated Amended Class Action Complaint alleges that Defendants secretly intercepted and accessed Plaintiffs’ personal information and Web browsing habits
through the use of “cookies” and other devices, in violation of state and federal law.
The Parties’ cross-motions for summary-judgment are now before the court.
PROCEDURAL BACKGROUND
Plaintiffs Blumofe and Gassman filed suit in this court on August 18, 2000. The remaining Plaintiffs filed complaints in the Southern District of New York. On April 18, 2001, the Judicial Panel on Multi-Dis-trict Litigation issued an order transferring the six New York actions to the District of Massachusetts.
Plaintiffs filed the Amended Consolidated Class Action Complaint (“Complaint”) on June 28, 2001. In December 2001, the court held a scheduling conference and authorized the Plaintiffs to examine Defendant Pharmatrak’s computer servers. This limited discovery took place during December 2001 and January 2002 at Phar-matrak’s former corporate headquarters in Boston, Massachusetts.
Pursuant to the court’s March 26, 2002 Order, the Parties refiled motions for summary judgment. The court held a hearing on Defendants’ and Plaintiffs’ motions for summary judgment on July 24, 2002.
FACTUAL BACKGROUND
Plaintiffs allege that Defendants “secretly intercepted and accessed Internet users’ electronic communications with various health-related and medical-related Internet Web sites and secretly accessed their computer hard drives in order to collect private information about their Web browsing habits [and] confidential health information without their knowledge, authorization, or consent.”
Plaintiffs contend that the Pharmaceutical Defendants conspired with Plaintiff Pharmatrak to “collect and share this wrongfully obtained personal and sensitive information.”
This activity was allegedly accomplished through the use of “web bugs,” “persistent cookies,” and other devices.
The general principles of computers, the Internet, and the Web have been detailed elsewhere,
and because such facts are undisputed in this case, further elaboration is unnecessary. Analysis of the Parties’ relationships in this case, however, requires a brief discussion of the specific methods by which the Parties communicated with each other, and the manner in which Defendants allegedly accessed and intercepted private information.
As stated in the Complaint, the Plaintiffs “access the Internet and communicate with other computers through use of commercial ISPs ... or through computers known as ‘servers’ that are operated by the entity which provides their computer access, such as their employer. In each case, the ISP or the server provides the electronic communication service that allows the user’s computer to connect with other computers on the Internet.”
Plaintiffs assert that personal computers “can and sometimes do act as servers,”
but do
not allege that any of the named Plaintiffs’ computers were used in such a capacity.
The Pharmaceutical Defendants hired Defendant Pharmatrak to monitor their corporate web sites and provide monthly analysis of web site traffic.
Pharmatrak offered its clients two relevant products: NETcompare, which was designed to monitor activity across clients’ web pages, and DRUGcompare, which was designed to monitor activity across disease categories and drug product pages.
All of the Pharmaceutical Defendants purchased NET-compare, and Defendant Pharmacia may have licensed DRUGcompare during testing phases.
Pharmatrak specifically represented to the Pharmaceutical Defendants that these products did not collect “personally identifiable information.”
Even though the Pharmaceutical Defendants may not have known precisely how Pharmatrak’s software worked, Plaintiffs readily admit that “the Pharmaceutical Defendants did authorize Pharmatrak’s presence upon their Web sites ....”
Pharmatrak’s system operated through the use of HTML programming,
JavaScript programming,
cookies,
and “web bugs.”
Each of the Pharmaceutical Defendants’ web pages were programmed with Pharmatrak code, which allowed Pharmatrak to monitor web site activity.
When a computer browser requested information from a Pharmaceutical Defendant’s web page, the web page would send the requested information to the user, and the site’s programming code would instruct the user’s browser to contact Pharmatrak’s web server and retrieve a “clear GIF” from it.
A clear GIF is a one pixel-by-one pixel or two pixels-by-two pixels graphic image, and is sometimes called a web bug or a “pixel tag.”
The purpose of a clear GIF was to cause the user’s computer browser to communicate directly with Pharmatrak’s web server.
Some communications may have also included code referencing JavaApplet, a software program that runs in a user’s browser, or JavaScript, an Internet programming language.
Having caused the user’s Internet browser to contact Pharmatrak, Pharmatrak then sent a cookie back to the browser.
A cookie is an electronic file “attached” to a user’s computer by a computer server. Plaintiffs concede that “[c]ookies generally perform many convenient and innocuous functions.”
Commonly, cookies are used
to store users’ preferences and other information, which allows users to easily access and utilize personalized services on the web or to maintain an online “shopping cart.”
Cookies also allow web sites to differentiate between users as they visit by assigning each individual browser a unique, randomly generated numeric or alphanumeric identifier.
If an individual browser had already visited the “Pharmat-rak-enabled” website, Pharmatrak would recognize the previously placed cookie and could therefore differentiate between a repeat visit and an initial visit.
Pharmat-rak programmed its cookies to expire after 90 days.
It is possible that many individual users were unaware that, in addition to their browser communicating with a Pharmaceutical Defendant’s web site, it was also communicating with Pharmatrak.
Plaintiffs allege that the JavaApplet used by Pharmatrak allowed Pharmatrak to monitor the length of time that a particular user viewed one of the Pharmaceutical Defendants’ web pages.
Plaintiffs also allege that the JavaScript programming allowed Pharmatrak to “intercept the full
URL
of
the tracked Web page visited by the user,” as well as “the full URL of the Web page visited by the Internet user
immediately prior
to the user’s visit to the Pharmatrak-coded Web page. This prior Web page address is know as a ‘referrer URL.’”
According to Plaintiffs, Phar-matrak used JavaScript “to extract referring URLs from the client’s history, thereby bypassing any security or privacy mechanisms put in place to control the flow of potentially sensitive data.”
The JavaScript and JavaApplet, therefore, also caused users’ computer browsers to communicate with Pharmatrak’s server while they intentionally communicated with the Pharmaceutical Defendants’ servers.
In a subheading on page 21 of the Complaint, Plaintiffs also assert that Pharmat-rak was able to “Capture [ ] Personal Information Submitted by Internet Users to the Pharmaceutical Defendants’ Web Sites.”
Users submitted this information in two ways. First, an individual could use the “POST” method, and voluntarily fill out an online form in order to register with the site, or to receive mailings, a rebate, or other information. For example, an individual wishing to view the full text of articles on
nytimes.com
must first register with the site, a process which requires the individual to volunteer certain information.
Second, an individual using the “GET” method could perform an online search, resulting in a URL with search terms appended to it. The appended information is known as the “query string.”
For example, a person interested in Cornell Law School could perform a search resulting in the following URL:
http://search.ya-hoo. com/bin/search ?p=Cornell + law + school.
All of the material following the question mark
(i.e.p=cor-
nell+law
+
school)
is known as the query string, and is “rich in useful content.”
Plaintiffs allege that Pharmatrak was able to intercept and collect detailed, specific information about individual users from the full URLs, and place the information into relational databases.
Plaintiffs’ computer scientist, C. Matthew Curtin, and his company, Interhack, examined Pharmatrak’s servers between December 17, 2001 and January 18, 2002, pursuant to the court’s Order. The examination of Pharmatrak’s logs “identified hundreds of people by name.”
Based on Curtin’s analysis, Plaintiffs claim that Pharmatrak collected information which included: names, addresses, telephone numbers, dates of birth, sex, insurance status, medical conditions, education levels, and occupations.
Pharmatrak also collected data about email communications, including user names, email addresses, and subject lines from emails.
Although Plaintiffs submit no evidence that Phar-matrak collected, sorted, or assembled this information into detailed “profiles,” other than the aggregate information it submitted to the Pharmaceutical Defendants, Curtin did build such profiles.
Curtin also asserts that it would be possible to build detailed profiles of individuals using the data collected by Pharmatrak and matching it to “another data source, such as a telephone book.”
Again, however, there is no evidence that Pharmatrak ever attempted to do so.
In sum, Plaintiffs argue that “Pharmat-rak’s technology permits defendants to collect extensive, detailed information about plaintiffs and Class members.”
In addition to the personal information discussed above, the information collected allegedly included “Web sites the Internet users were at prior to the time they went to the Pharmaceutical Defendants’ Web sites, questions they asked and typed in at those prior sites, information they entered while at the Pharmaceutical Defendants’ web sites, and the types of computers they were using.”
DISCUSSION
Under Federal Rule of Civil Procedure 56, summary judgment is appropriate “if the pleadings, depositions, answers to interrogatories, and admissions on file, together with the affidavits, if any, show that there is no genuine issue as to any material fact and that the moving party is entitled to a judgment as a matter of law.”
Rule 56 mandates summary judgment “after adequate time for discovery and upon motion, against a party who fails to make a showing sufficient to establish the existence of an element essential to that party’s case, and on which that party will bear the burden of proof at trial.”
The “party seeking summary judgment [must] make a preliminary showing that no genuine issue of material fact exists. Once the movant has made this showing, the nonmovant must contradict the showing by
pointing to specific facts demonstrating that there is, instead, a trialworthy issue.”
The party opposing summary judgment must produce specific evidence of a material factual dispute. The First Circuit has noted that “[a] genuine issue of material fact does not spring into being simply because a litigant claims that one exists. Neither wishful thinking nor ‘mere promise[s] to produce admissible evidence at trial’ ... nor conclusory responses unsupported by evidence ... will serve to defeat a properly focused Rule 56 motion.”
The Parties file cross-motions for summary judgment. “The happenstance that all parties seek summary judgment neither alters the yardstick nor empowers the trial court to resolve authentic disputes anent material facts.”
A court considering cross-motions for summary judgment must consider “each motion separately, being careful to draw inferences against each movant in turn.”
Plaintiffs seek summary judgment against Defendants Pharmatrak and Glocal, and Defendants each seek summary judgment against Plaintiffs.
A. Count I
— The
Wiretap Act
Title I of the Electronic Communication Privacy Act of 1986 (“ECPA”), Interception of Electronic Communications (“The Wiretap Act”), provides that:
Except as otherwise specifically provided in this chapter!,] any person who — (a) intentionally intercepts, endeavors to intercept, or procures any other person to intercept, any wire, oral, or electronic communication ... shall be punished as provided in subsection (4) or shall be subject to suit as provided in subsection (5).
This criminal statute provides for a private right of action, and is subject the following statutory exception:
(d) It shall not be unlawful under this chapter for a person not acting under color of law to intercept a wire, oral, or electronic communication where such person is a party to the communication or where one of the parties to the communication has given prior consent to such interception unless such communication is intercepted for the purpose of committing any criminal or tortious act ....
Plaintiffs argue that Defendants intentionally “intercepted plaintiffs’ or Class members’ electronic communications with the Web sites they visited without plaintiffs’ or the Class’ [sic] knowledge, authorization, or consent....”
1. Pharmaceutical Defendants
After Defendants had fully briefed the issue, Plaintiffs’ counsel orally informed the court at the summary judgment hearing that Plaintiffs would withdraw the Wiretap Act claim as it relates to the Pharmaceutical Defendants.
Count I is
therefore DISMISSED with regard to these defendants.
2. Pharmatrak
Plaintiffs claim that “Pharmatrak intercepted plaintiffs’ transmission of their personal information to the Pharmaceutical Defendants’ Web sites without the express or implied consent of either plaintiffs or the Pharmaceutical Defendants.”
Despite the fact that the Pharmaceutical Defendants may have consented to Pharmatrak’s assembly of anonymous, aggregate information, Plaintiffs insist that the web sites never consented to Pharmatrak’s collection of personally identifiable information.
Absent this specific consent, Plaintiffs argue, the Wiretap Act’s statutory exception simply does not apply.
Pharmatrak concedes that the Pharmaceutical Defendants did not consent to the collection of personally identifiable information.
According to Pharmatrak, however, the relevant inquiry is whether the Pharmaceutical Defendants consented to Pharmatrak’s NETcompare
service,
i.e. the collection of data from the Pharmaceutical Defendants’ web sites, regardless of how the service eventually operated.
It is undisputed that the Pharmaceutical Defendants contracted with Defendant Phar-matrak to obtain data regarding their web sites, and that they proceeded to have the Pharmatrak code placed on the web sites. Pharmatrak, therefore, asserts that the statutory exception for consent has been met, and that it is entitled to summary judgment on the Wiretap Act claim.
In
In re DoubleClick Inc. Privacy Litigation (“DoubleClick
”),
the Southern District of New York disposed of a multi-district consolidated class action case pursuant to Rule 12(b)(6). There, the plaintiffs alleged that Doubleclick, an Internet advertising firm, placed cookies on their computers, thereby collecting “information that Web users, including plaintiffs and the Class, consider to be personal and private, such as names, e-mail addresses, home and business addresses, telephone numbers, searches performed on the Internet, Web pages or sites visited on the Internet, and other communications and information that users would not ordinarily expect advertisers to be able to collect.”
The
DoubleClick
court found that the web sites affiliated with Doubleclick were “ ‘parties to the eommunication[s]’ from plaintiffs and have given sufficient consent to DoubleClick to intercept them,”
despite the possibility that the plaintiffs may not have known that their computers were communicating with Doubleclick, and that the affiliated Web sites may not have fully understood the mechanisms of the DoubleClick service.
Having found consent, the
DoubleClick
court proceeded to analyze Section 2511(2)(d)’s “criminal” or “tortious” purpose requirement, which “is to be construed narrowly.”
The court noted that the evidence in the case suggested that DoubleClick’s actions were motivated by legitimate business goals, and found an “utter lack of evidence that [DoubleClick’s] intent was tortious ....”
Because it
found that DoubleClick acted with consent and without a tortious or criminal purpose, the court dismissed the plaintiffs’ Wiretap Act claim.
In
Chance v. Avenue A.
Inc.,
the plaintiffs alleged that Avenue A had placed cookies on then" computers, thus permitting the company to surreptitiously monitor plaintiffs’ electronic communications. First, addressing consent, the court held that “[i]t is implicit in the web pages’ code instructing the user’s computer to contact Avenue A, either directly or via Double-Click’s server, that the web pages have consented to Avenue A’s interception of the communication between them and the individual user.”
The court also found that the plaintiffs had presented no evidence that the defendants acted with a tortious or illegal purpose and, therefore, granted summary judgment on the claim to Avenue A.
In the present case, Plaintiffs concede that the Pharmaceutical Defendants consented to the placement of code for Phar-matrak’s NETcompare service on their web sites.
As was the case in
DoubleClick
and
Avenue A,
the web site Defendants (here, the Pharmaceutical Defendants) consented to the service of a web-monitoring company (Pharmatrak), and such consent precludes a claim under the Wiretap Act. The Pharmaceutical companies contracted with Pharmatrak, and authorized Pharmatrak to communicate with any users who contacted the Pharmaceutical Web sites. Despite Plaintiffs’ valiant attempts to shift the inquiry, it is irrelevant for the purposes of the Wiretap Act whether the Pharmaceutical Defendants knew the precise mechanisms of Pharmat-rak’s service or not. It is sufficient that the Pharmaceutical Defendants were parties to communications with Plaintiffs and consented to the monitoring service provided by Defendant Pharmatrak.
Plaintiffs are also unable to demonstrate that Defendants acted with a tortious purpose. Plaintiffs have produced no evidence “ ‘either (1) that the primary motivation, or (2) that a determinative factor in the actor [Pharmatrak’s] motivation for intercepting the conversation was to commit a criminal [or] tortious ... act.’ ”
Without a showing of the requisite
mens rea,
Plaintiffs cannot succeed on their claim under the Wiretap Act.
Because the Pharmaceutical Defendants consented to Pharmatrak’s NETcompare service, and because Plaintiffs are unable to present any evidence whatsoever of a tortious intent, Defendants are entitled to summary judgment on Count I of the Complaint.
B. Count II
— Stored
Communications
Act
Title II of the ECPA, also known as the “Stored Wire and Electronic Communications and Transactional Records Act,” “aims to prevent hackers from obtaining, altering, or destroying certain stored electronic communications.”
The statute provides:
[W]hoever — (1) intentionally accesses without authorization a facility through which an electronic communication service is provided; or (2) intentionally ex
ceeds an authorization to access that facility; and thereby obtains, alters, or prevents authorized access to a wire or electronic communication while it is in electronic storage in such system shall be punished as provided by subsection (b) of this section.
Plaintiffs acknowledge that § 2701 was primarily designed to provide a cause of action against computer hackers,
and argue that “Defendants’ conduct of accessing data in plaintiffs’ computers, including the content of plaintiffs’ e-mails, constitutes electronic trespassing and falls squarely within the ambit of Section 2701.”
Defendants disagree, and claim that they are entitled to summary judgment on at least two separate grounds: (1) Plaintiffs’ computers are not facilities which provide electronic communications services, an essential element of § 2701; and (2) any alleged access to “communications” was authorized.
Defendants are correct that an individual Plaintiffs personal computer is not a “facility through which an electronic communication service is provided” for the purposes of § 2701. Plaintiffs find it noteworthy that “[p]ersonal computers provide consumers with the opportunity to access the Internet and send or receive electronic communications,” and that “[w]ithout personal computers, most consumers would not be able to access the Internet or electronic communications.” Fair enough, but without a telephone, most consumers would not be able to access telephone lines, and without televisions, most consumers would not be able to access cable television. Just as telephones and televisions are necessary devices by which consumers access particular services, personal computers are necessary devices by which consumers connect to the Internet. While it is possible for modern computers to perform server-like functions, there is no evidence that any of the Plaintiffs used their computers in this way. While computers and telephones certainly provide services in the general sense of the word, that is not enough for the purposes of the ECPA. The relevant
service
is Internet access, and the service is provided through ISPs or other servers, not though Plaintiffs’ PCs.
Even if the court were to assume that Plaintiffs’ computers are “facilities” under § 2701,
any access to stored communications was authorized and, thus, Defendants’ conduct falls under the exception from liability created by § 2701(c)(2). As was the case in
DoubleClick
and
Avenue A,
the Pharmaceutical Defendants are “users” under the ECPA.
The
DoubleClick
court noted that, “in a practical sense, Web sites are among the most active ‘users’ of Internet access.”
As
users, the Pharmaceutical Defendants could consent to Pharmatrak’s interception of Plaintiffs’ communications, and Plaintiffs cannot survive the motions for summary judgment “based solely on the naked allegation that defendant[s’] access was ‘unauthorized.’ ”
Plaintiffs argue that this case is factually different from
DoubleClick,
because the Pharmaceutical Defendants did not know that Pharmatrak would collect the type and amount of personally identifiable information that it did. Even viewing this factual distinction in the light most favorable to Plaintiffs, the Pharmaceutical Defendants nonetheless authorized Pharmat-rak to monitor electronic communications between the web sites and Plaintiffs. As discussed above in Part A.2, the Pharmaceutical Defendants consented to the monitoring service provided by Defendant Pharmatrak in NETcompare, even if they were unaware that the program was able to identify personal information.
In addition, the ECPA does not prohibit Pharmatrak’s actions with regard to the placing of cookies on Plaintiffs’ computers. Section § 2701 seeks to target communications which are in “electronic storage” incident to their transmission. This court agrees with the
DoubleClick
court that “Title II only protects electronic communications stored ‘for a limited time’ in the ‘middle’ of a transmission, i.e. when an electronic communication service temporarily stores a communication while waiting to store it.”
Even if such cookies were covered by the ECPA, Pharmatrak created and sent the cookies, and thus any accessing of the cookies by Pharmatrak at a later date would certainly be “authorized.” Because Pharmatrak’s cookies fall outside the scope of § 2701, Plaintiffs’ claim under that section must fail.
Finally, Plaintiffs persistently argue that the Pharmaceutical Defendants did not consent to the allegedly improper interception of personal information. If the Pharmaceutical Defendants did not consent to the alleged interception of personally identifiable information, then they could not have “intentionally accessed] without authorization” any electronic communications. Without the necessary intent under this punitive statute, the Pharmaceutical Defendants cannot be held liable and are entitled to summary judgment.
Accordingly, all Defendants are entitled to summary judgment on Count II.
C. Count III
— Computer
Fraud and Abuse
Act
The Computer Fraud and Abuse Act (CFAA) creates a claim against:
(a) Whoever — ... (2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains ... (c) information from any protected computer if the conduct involved an interstate or foreign communication ...
The CFAA limits recovery to those persons who suffer “damage or loss by reason of a violation” of the Act. Section 1030(e)(8) defines damage as “any impairment to the integrity or availability of data, a program, a system, or information, that — (A) causes loss aggregating at least $5,000 in value during any 1-year period to one or more individuals....”
Plaintiffs do not allege that their computers were physically damaged in any
way, or that they suffered any damage resulting from the repair or replacement of their computer systems. Instead, Plaintiffs argue that their “sensible interpretation” of the CFAA allows recovery for a “cognizable ‘loss,’ ” as distinct from economic damage, for the invasion of their privacy and the “concomitant loss of control over the dissemination of their private information.”
Plaintiffs stress that they allege both loss and damages, and that the damage threshold of $5,000 may be met by aggregating claims among individuals and over a one year period.
The CFAA does not define “loss,” and the First Circuit noted in
EF Cultural Travel BV, et. al. v.
Explorica
that “[f]ew courts have endeavored to resolve the contours of damage and loss under the CFAA.”
In that case, the First Circuit explicitly agreed with the
Doubleclick
court, and concluded that the statute’s use of “damage or loss” indicated a Congressional desire to allow recovery for more than purely physical damage.
The First Circuit was careful to note, however, that it did not hold that any loss is compensa-ble, and that “Congress could not have intended other types of loss to support recovery unless [the $5,000] threshold were met.”
Plaintiffs have not shown any evidence whatsoever that Defendants have caused them at least $5,000 of damage or loss. Even accepting Mr. Curtin’s bald assertion that “[d]ata about people are valuable, marketable assets,”
Plaintiffs are unable to meet the statutory threshold. Any damage or loss under the CFAA may be aggregated across victims and across time, but only for a single act.
Because Plaintiffs have not shown any facts that demonstrate damage or loss of over $5,000 for any single act of the Defendants, Defendants are entitled to summary judgment on Count III.
CONCLUSION
For the foregoing reasons, Defendants’ Motions for Summary Judgment [Docket ##’s 139, 143, 218, and 224] are ALLOWED as to Counts I, II, and III of the Consolidated Amended Class Action Complaint, and Plaintiffs’ Motion for Summary Judgment [Docket #237] is DENIED. Defendant Pharmatrak’s Motion to Dismiss [Docket # 269] is DENIED.
Having granted summary judgment on Counts I, II, and III, this court declines to retain jurisdiction over Counts IV-IX, and those counts are DISMISSED, without prejudice.
AN ORDER WILL ISSUE.