Website Tracking Claims Find Very Low Threshold For Article III Standing In Federal Court

For website tracking cases involving data privacy, a business’s ability to prevail in a motion to dismiss for lack of Article III standing just took a step backward. In D’Antonio v. Cable News Network, the plaintiff brought a class action suit against Cable News Network (CNN) alleging that CNN violated the California Invasion of Privacy Act (CIPA) by using third-party trackers on its website to collect IP addresses and device identifier information, such as device type, browser type, and other metadata. The lawsuit contends that CNN and other third parties cited in the complaint use “cookies” that include unique user identifiers to identify visitors and users of CNN’s website, target them with advertising, and create comprehensive user profiles, which are then sold through a bidding process. The plaintiff alleged that at least one advertiser bid on his information.

CNN filed a motion to dismiss D’Antonio’s second amended complaint based, in part, on Article III standing. Under the U.S. Supreme Court’s Article III precedent, to determine whether a plaintiff has alleged an intangible harm that is sufficiently concrete, the court must ask whether the plaintiff has identified a close historical or common-law analogue for their asserted injury. In the CNN matter, the plaintiff argued that the allegations support a claim for injury connected to the tort of intrusion upon seclusion, which historically involved: (1) intrusion into a private place, conversation, or matter; or (2) in a manner highly offensive to a reasonable person. However, CNN argued that the complaint failed to even mention any specific personally identifying information, while also failing to identify facts suggesting that the alleged intrusion would be highly offensive to a reasonable person.

In its D’Antonio v. Cable News Network ruling, the U.S. District Court for the Southern District of New York (SDNY) acknowledged that courts are divided over whether analogous website tracking allegations can establish Article III standing. Here, the SDNY found that it “can glean no determinative or dispositive factual circumstance or allegation warranting adherence to a specific line of cases.” Therefore, “given the stage of the litigation,” the SDNY sided with courts that have declined to grant a motion to dismiss on Article III grounds. It appears that the court found these fact allegations determinative: (1) CNN caused numerous trackers owned by the third parties cited in the suit to be installed on visitors’ internet browsers; (2) these third parties are data brokers who can uniquely identify and deanonymize users by matching their IP addresses with profiles held by the third parties; (3) the third parties share users’ information amongst one another and with other entities to create the most complete profile they can; and (4) those profiles are offered for sale through the real-time bidding process to the benefit of CNN and the third parties, yet to the detriment of users’ privacy interests.

Ultimately, the SDNY found that D’Antonio sufficiently “pleaded a violation of a privacy interest bearing a ‘close relationship’ to a traditionally recognized harm.” And thus, this case was allowed to move to the next stage. Although this decision by the SDNY was a step backward for defendants in CIPA litigation, defendants can take solace in the fact that Article III standing arguments at the motion to dismiss stage can and have prevailed and are intently fact specific.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.