Matthew Carlsen v. GameStop, Inc.

833 F.3d 903, 2016 U.S. App. LEXIS 14999, 2016 WL 4363162

• Court: Court of Appeals for the Eighth Circuit
• Decided: August 16, 2016
• Docket: 15-2453
• Status: Published

Opinions

GRUENDER, Circuit Judge.

Matthew Carlsen, individually and purportedly on behalf of others similarly situated, brought claims against GameStop, Inc. and Sunrise Publications, Inc. (collectively, “GameStop”) for breach of contract, unjust enrichment, money had and received, and violation of Minnesota’s Consumer Fraud Act (CFA), Minn. Stat. §§ 325F.68, et seq., for GameStop’s alleged disclosure of personal information to a third party in. violation of an express agreement not to do so. GameStop filed a motion to dismiss Carlsen’s complaint for lack of subject-matter jurisdiction under Federal Rule of Civil Procedure 12(b)(1) and failure to state a claim under Rule 12(b)(6). The district court¹ granted the motion to dismiss for lack of subject-matter jurisdiction, finding that Carlsen lacked standing. We affirm the district court on the basis that Carlsen’s complaint failed to state a claim upon which relief can be granted.

I.

Matthew Carlsen is a user of print and online materials published by GameStop, including Game Informer Magazine. Game Informer Magazine offers news, reviews, and commentary about the video-game industry. Registered subscribers can access digital versions of the magazine through a website, www.gameinformer.com, where they also can manage their subscriptions and access enhanced content and message boards. Carlsen paid a one-year subscrip-, tion fee of $14.99 for access to the magazine and enhanced content. The terms of service for the online subscription include Game Informer’s privacy policy. The policy, in turn, includes a provision stating that, with certain exceptions, “Game Informer does not share personal information with anyone.” According to Carlsen, a user must agree to the terms of service and, thus, the privacy policy, in order to purchase subscription access.

In his complaint, Carlsen alleged that GameStop shared his personally identifiable information (“PII”) with Facebook in violation of the privacy policy. He alleged that GameStop shared this information through the Game Informer website, which includes features that allow Game Informer users to log in to the website using their Facebook accounts and to use Facebook’s “Like,” “Share,” and “Comment” functions through the Game Informer site. Game Informer provides these features by adding a Facebook Software Development Kit (“SDK”) to the source code on the Game Informer website. Carlsen alleged that this SDK transmitted a user’s unique Facebook ID and Game Informer browsing history to Facebook if the user previously had opted to stay logged in to Facebook.

Carlsen further alleged that GameStop breached a term of the privacy policy by disclosing his Facebook ID and browsing information. He also claimed that this disclosure constituted a material misrepresentation about Game Informer subscriptions because he believed his PII would not be disclosed and because part of his subscription fee paid for the protection of that PII. He alleged that, had he known about the disclosures, he either would not have paid for the subscription or would have refrained from accessing the online content for which he paid. '

Based on these allegations, Carlsen’s amended complaint sought class certification and asserted four claims: (1) breach of contract; (2) unjust enrichment; (3) money had and received; and (4) violation of Minnesota’s CFA, Minn. Stat. §§325F.68, et seq. GameStop filed a motion to dismiss for lack of subject matter jurisdiction and for failure to state a claim. The district court granted the motion to dismiss for lack of subject-matter jurisdiction, finding that Carlsen lacked standing for failure to allege an injury in fact with respect to his overpayment and would-not-have-shopped theories because his allegations were based on the Game Informer privacy policy, which applied equally to both paid and non-paid Game Informer subscriptions.

■II.

A.

“The existence of subject-matter jurisdiction is a question of law that this court reviews de novo.” ABF Freight Sys., Inc. v. Int’l Bhd. of Teamsters, 645 F.3d 954, 958 (8th Cir. 2011). “A court deciding a motion under Rule 12(b)(1) must distinguish between a ‘facial attack’ and a ‘factual attack’ ” on jurisdiction. Osborn v. United States, 918 F.2d 724, 729 n.6 (8th Cir. 1990). In a facial attack, “the court restricts itself to the face of the pleadings, and the non-moving party receives the same protections as it would defending against a motion brought under Rule 12(b)(6).” Id. (internal citations omitted). “In a factual attack, the court considers matters outside the pleadings, and the non-moving party does not have the benefit of 12(b)(6) safeguards.” Id. (internal citation omitted). The method in which the district court resolves a Rule 12(b)(1) motion — that is, whether the district court treats the motion as a facial attack or a factual attack — obliges us to follow the same approach. BP Chemicals Ltd. v. Jiangsu Sopo Corp., 285 F.3d 677, 680 (8th Cir. 2002).

Here, the district court discussed both standards but did not state which approach it followed. Toward the end of its opinion, however, the court stated that it was “accepting as true all of Plaintiffs allegations and construing all reasonable inferences in Plaintiffs favor” — i.e., that it was following the Rule 12(b)(6) standard used for a facial attack. We thus examine the Rule 12(b)(1) motion as a facial attack on jurisdiction, affording Carlsen’s complaint Rule 12(b)(6) protection by “accepting as true all facts alleged in the complaint.” See Trooien v. Mansour, 608 F.3d 1020, 1026 (8th Cir. 2010). As such, we “consider[ ] only the materials that are ‘necessarily embraced by the pleadings and exhibits attached to the complaint.’ ” Cox v. Mortgage Elec. Registration Sys., Inc., 685 F.3d 663, 668 (8th Cir. 2012) (quoting Mattes v. ABC Plastics, Inc., 323 F.3d 695, 697 n.4 (8th Cir. 2003)).

We begin by addressing the sufficiency of the complaint with respect to Carlsen’s standing. “Federal jurisdiction is limited by Article III of the Constitution to cases or controversies; if a plaintiff lacks standing to sue, the district court has no subject-matter jurisdiction.” ABF, 645 F.3d at 958. “The ‘irreducible constitutional minimum of standing’ is that a plaintiff show (1) an ‘injury-in-fact’ that (2) is ‘fairly ... trace[able] to the challenged action of the defendant’ and (3) is ‘likely ... [to] be redressed by a favorable decision’ in court.” Id. (alterations in original) (quoting Lujan v. Defenders of Wildlife, 504 U.S. 555, 560-61, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992)). A plaintiff has suffered an injury-in-fact if he has experienced “an invasion of a legally protected interest which is (a) concrete and particularized and (b) actual or imminent, not conjectural or hypothetical.” Lujan, 504 U.S. at 560, 112 S.Ct. 2130 (internal citations and quotation marks omitted). Further, “[a] ‘legally protected interest’ requires only a ‘judicially cognizable interest.’ ” ABF, 645 F.3d at 959.

The district court addressed the standing issue by evaluating Carlsen’s theories of damages. The court first discussed whether Carlsen’s alleged monetary damages based on a theory of “overpayment” constituted a cognizable injury in fact. Under this theory, Carlsen alleged that he would not have paid as much as he did for his Game Informer subscription had he known GameStop would violate the terms of the privacy policy by disclosing his PII. The court, analogizing to identity-theft and data-breach cases, found this overpayment theory insufficient to establish injury because Carlsen had failed to allege that he paid any specific amount for the privacy policy or that he bargained for additional data privacy over that received by nonpaying Game Informer visitors. The court next discussed Carlsen’s alleged injury based on a “would-not-have-shopped” theory. Under this theory, Carlsen alleged that he would not have purchased the Game Informer subscription if he had known his data would be shared. The court likewise found this theory insufficient to establish an injury in fact because the privacy policy stated that it applied equally to paid and non-paid- Game Informer users, such that any improper disclosure of PII in violation of the privacy policy was not unique to paid subscribers. Therefore, the court concluded, Carlsen’s allegations could not establish that awareness of the disclosure of PII to Facebook would have impacted his purchasing decision.

As we previously have cautioned, “[i]t is crucial ... not to conflate Article Ill’s requirement of injury in fact with a plaintiffs potential causes of action, for the concepts are not coextensive.” ABF, 645 F.3d at 960 (quoting Braden v. Wal-Mart Stores, Inc., 588 F.3d 585, 591 (8th Cir. 2009)); see also Campbell v. Minneapolis Pub. Hous. Auth. ex rel. City of Minneapolis, 168 F.3d 1069, 1074 (8th Cir. 1999) (“We repeat the fundamental principle that the ultimate merits of the case have no bearing on the threshold question of standing.”). Our court previously has held that a plaintiff who has “produced facts indicating it was a party to a breached contract” has a judicially cognizable interest for standing purposes, regardless of the' merits of the breach alleged. ABF, 645 F.3d at 960; see also Longaker v. Boston Scientific Corp., 715 F.3d 658, 664 (8th Cir. 2013) (Bye, J., dissenting) (“[Plaintiff] has stated a personal injury because [Defendant] allegedly breached his employment contract....”). To assert standing in a breach-of-contract claim, we do not require facts establishing “the legal conclusion of a valid, enforceable contract.” ABF, 645 F.3d at 960.

Here, Carlsen has provided sufficient facts alleging that he is party to a binding contract — the terms of service, which include the Game Informer privacy policy — with GameStop, and GameStop does not dispute this contractual relationship. Carlsen also has alleged that GameS-top has violated that policy by “systematically disclosing] Game Informer’s users’ PII ... to third party Facebook and/or allowing] Facebook to directly collect that information itself.” This allegation of breach is both concrete and particularized, as the breach allegedly already has occurred, and any consequences of the breach have occurred specifically to Carl-sen as a result of the actions of GameS-top’s alleged systematic disclosure via the Facebook SDK. Additionally, Carlsen alleged that he has suffered damages as a result of GameStop’s breach in the form of devaluation of his Game Informer subscription in an amount equal to the difference between the value of the subscription that he paid for and the value of the subscription that he received, ie., a subscription with compromised privacy protection. Accordingly, Carlsen has alleged an “actual” injury. See id. at 961; cf. Ben Oehrleins & Sons & Daughter, Inc. v. Hennepin Cty., 115 F.3d 1372, 1379-80 (8th Cir. 1997) (finding even indirect economic injury constitutes an injury in fact where the injury was concrete, particularized, actual, and in no way hypothetical or conjectural).

Next, Carlsen “must show that [his] injury is ‘fairly traceable to the challenged action of the defendant, and not the result of the independent action of some third party not before the court.’ ” ABF, 645 F.3d at 961 (quoting Bennett v. Spear, 520 U.S. 154, 167, 117 S.Ct. 1154, 137 L.Ed.2d 281 (1997)). Carlsen has met this element by alleging that the breach and attendant damages flow directly from GameStop’s disclosure of confidential information. Finally, Carlsen satisfies the re-dressability element of standing. He seeks damages in the amount equal to the difference between the value of the services he paid for and the services he actually received. See id. We thus conclude that Carl-sen has standing to bring his breach-of-contract claim.

We likewise conclude that Carlsen has standing to bring his other claims. Carlsen’s allegation that he did not receive the data protection set forth in GameStop’s policies suffices to support standing to assert claims related to GameStop’s unjust retention of his payment. As to the claim brought under the Minnesota CFA, the Minnesota Supreme Court has held that “the plain and unambiguous language of the [Minnesota CFA] allows ‘any person’ to bring a private action for redress of violations of the misrepresentation in sales statutes,” whether or not the plaintiffs purchased the defendant’s goods. Grp. Health Plan, Inc. v. Philip Morris Inc., 621 N.W.2d 2, 8 (Minn. 2001); Minn. Stat. § 8.31, subdiv. 3a. Here, Carlsen purchased GameStop’s goods in the form of his Game Informer subscription, and he thus has standing to bring his claim under the Minnesota CFA. See Grp. Health, 621 N.W.2d at 8.

B.

Our analysis does not end with our conclusion regarding Carlsen’s standing. “[W]e may affirm a judgment on any ground supported by the record, whether or not that ground was urged below or passed on by the District Court.” United States v. Sager, 743 F.2d 1261, 1263 n.4 (8th Cir. 1984). Here, as the district court acknowledged, GameStop filed a motion to dismiss pursuant to both Federal Rule of Civil Procedure 12(b)(1) and Rule 12(b)(6). When a district court erroneously dismisses under Rule 12(b)(1) a claim that is “clearly meritless,” an appellate court may affirm under Rule 12(b)(6). Boock v. Shalala, 48 F.3d 348, 353 (8th Cir. 1995); see also Johnson v. Mott, 376 Fed.Appx. 641 (8th Cir. 2010) (per curiam) (affirming district court under Rule 12(b)(6) after determining that the court erroneously had dismissed case with prejudice under Rule 12(b)(1)). Furthermore, the parties fully briefed the Rule 12(b)(6) issue on appeal. We thus turn to the Rule 12(b)(6) motion even though the district court did not reach it.²

To survive a motion to dismiss for failure to state a claim, “a complaint must contain sufficient factual matter, accepted as true, to state a claim to relief that is plausible on its face.” Cox, 685 F,3d at 668 (quoting Ashcroft v. Iqbal, 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009)). “A claim has facial plausibility when the plaintiff [has pleaded] factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Id. (alteration in original) (quoting Iqbal, 556 U.S. at 678, 129 S.Ct. 1937). “We make this determination by considering only the materials that are ‘necessarily embraced by the pleadings and exhibits attached to the complaint.’ ” Id. (quoting Mattes, 323 F.3d at 697 n.4).

In order to plead breach of contract under Minnesota law, “the plaintiff must show (1) formation of a contract, (2) performance by plaintiff of any conditions precedent to his right to demand performance by the defendant, and (3) breach of the contract by defendant.” Park Nicollet Clinic v. Hamann, 808 N.W.2d 828, 833 (Minn. 2011). “The construction and effect of a contract is ... a question of law unless the contract is ambiguous.” Denelsbeck v. Wells Fargo & Co., 666 N.W.2d 339, 346 (Minn. 2003). “A contract is ambiguous if, based upon its language alone, it is reasonably susceptible of more than one interpretation.” Id. (quoting Art Goebel, Inc. v. N. Suburban Agencies, Inc., 567 N.W.2d 511, 515 (Minn. 1997)). “[Wjhether a contract is ambiguous is a question of law....” Id.

Carlsen alleges that, in order to use the Game Informer website and access paid subscription benefits, he had to agree to the Game Informer terms of service, which included the privacy policy. Even assuming that Carlsen’s payment in conjunction with agreeing to the terms of service fulfills the first two breach-of-contract elements, the facts as alleged fail as a matter of law to establish GameStop’s breach. “A breach of contract is a failure, without legal excuse, to perform any promise that forms the whole or part of the contract.” Lyon Fin. Servs., Inc. v. Ill. Paper & Copier Co., 848 N.W.2d 539, 543 (Minn. 2014). “[A] breach of contract claim requires only that the promise at issue be part of the parties’ bargain.” Id.

Here, Carlsen argues that GameStop promised not to disclose PII and that this

PII included his Facebook ID and browser history. We conclude, however, that the privacy policy unambiguously does not include those pieces of information among the protected PII. The privacy policy refers to PII and notes that it:

may include: your name, home address and zip code, telephone number, e-mail address and (for those purchasing products online) credit card or checking account information including billing and shipping addresses and zip codes.

Although the phrase “may include” appears to create a non-exclusive list, the definition of personal information occurs as párt of a section entitled, “What Information does Game Informer Collect.” This provision specifies that “Game Informer may collect information about .you, but only if you voluntarily provide it to Game Informer.” The provision goes on to say, “We may ask you to submit personal and/or demographic information in connection with any one of’ a finite list of features or services. Accordingly, in order to constitute “personal information,” the information must have been specifically solicited by Game Informer (“We may ask you to submit”) and voluntarily provided by the user.

We consider these terms unambiguous. The PII set forth in the privacy policy does not encompass a user’s Facebook ID and browsing history for two reasons: (1) not only do a user’s Facebook ID and browsing history fail to appear on the list of what PII might include, but (2) those data are neither specifically solicited by Game Informer nor voluntarily submitted in response to such solicitation. Additionally, as GameStop notes, the policy contains no specific promise to prevent'Facebook’s social-media plug-in from transferring a Facebook user’s Facebook ID and browsing activity to Facebook. The policy also states that it “does not extend to Websites that may be maintained by ... other companies or organizations to which we link, or to Websites that contain links to the Site and/or the Service.” Because of this caveat, the policy further urges users to read the respective privacy policies of these other websites. Accordingly, the protection Carlsen argues GameStop failed to provide was not among the protections for which he bargained by agreeing to the terms of service, and GameStop thus could not have breached its contract with Carl-sen.

Carlsen’s Minnesota' CFA claim fails for similar reasons. To state a CFA claim, “the plaintiff need only plead that the defendant engaged in conduct prohibited by the statutes and that the plaintiff was damaged thereby.” Grp. Health, 621 N.W.2d at 12. Section 325F.69 of the Minnesota Statutes provides: “The act, use, or employment by any person of any ... misrepresentation ..., with the intent that others rely thereon in connection with the sale of any merchandise, whether or not any person has in fact been misled, deceived, or damaged thereby, is enjoinable....” Minn. Stat. § 325F.69, subdiv. 1. Moreover, “[ajllegations that the plaintiff relied on the defendant’s conduct are not required to plead a violation.” Grp. Health, 621 N.W.2d at 12. Here, Carlsen argues that GameStop’s representation in the Game Informer Privacy Policy that it would not disclose users’ PII to any third-party companies without the users’ consent or specific authorization constituted a false representation because of GameStop’s disclosure of that PII to Facebook. As .discussed above, however, Carlsen’s allegation that the PII GameStop promised not to disclose included his Facebook ID and browser history finds no support in the language of the Game Informer privacy policy. Carlsen thus has failed to state a claim under the Minnesota CFA.

We next proceed to Carlsen’s equitable claims. Unjust enrichment requires “(1) a benefit conferred; (2) the defendant’s appreciation and knowing acceptance of the benefit; and (3) the defendant’s acceptance and retention of the benefit under such circumstances that it would be inequitable for him to retain it without paying for it.” Dahl v. R.J. Reynolds Tobacco Co., 742 N.W.2d 186, 195 (Minn. Ct. App. 2007). Carlsen claims that the benefit conferred on GameStop “is the money that GameStop took from [him] in exchange for the Privacy Policy that it chose to ignore.” However, he does not allege that any specific portion of his subscriber fee went toward data protection or that GameStop agreed to provide additional protection to paid subscribers that it did not also provide to non-paid subscribers. Accordingly, taking Carlsen’s allegations as true, he has alleged neither a benefit conferred in exchange for protection of his PII, nor has he shown how GameStop’s retention of his subscription fee would be inequitable. He thus has not alleged a claim for unjust enrichment or the related claim of money had and received. See Cady v. Bush, 283 Minn. 105, 166 N.W.2d 358, 361-62 (1969) (“The theory of unjust enrichment or money had and received has salutary and beneficial uses and has been invoked in support of claims based upon failure of consideration, fraud, mistake, and in other situations where it would be morally wrong for one party to enrich himself at the expense of another.”).

III.

For the reasons set forth above, we affirm.

1 . The Honorable Donovan W. Frank, United States District Judge for the District of Minnesota.

2 . Although we have discretion to remand for the district court to rule on the Rule 12(b)(6) motion in the first instance, we are not bound to remand, and we decline to do so here. Cf. ABF, 645 F.3d at 965 (remanding for the district court to consider the Rule 12(b)(6) motion in the first instance even though the appellees had filed a motion to dismiss under both Rule 12(b)(1) and Rule 12(b)(6) because "[t]he district court's 12(b)(1) ruling resolved factual issues that courts may not resolve on motions under Rule 12(b)(6), and did not provide proper notice of such a conversion”).