Plaintiffs seeking to bring a class action lawsuit against Amazon failed to allege a “loss” under the Computer Fraud and Abuse Act (CFAA), 18 U.S.C. § 1030, by simply pleading that Amazon had taken and exploited, for financial gain, private information that the plaintiffs could not show had financial value to them. Del Vecchio v. Amazon.com, Inc., No. C11-366RSL (W.D. Wash. June 1, 2012).
The plaintiffs alleged that Amazon circumvented browsers' security settings to force users to accept cookies, and used gathered information for its benefit and for the benefit of third parties in contravention of its Privacy Notice. The plaintiffs further alleged that class members' property rights, and their rights to control dissemination of their own information, were violated in an amount “substantially in excess of 1/100 of one cent” for each class member. Plaintiffs accordingly sought “relief on behalf of themselves and a proposed class under the” CFAA, as well as various state laws. Amazon brought its third motion to dismiss after the plaintiffs amended their complaint for the second time.
A civil cause of action under the CFAA requires a showing of "loss to 1 or more persons during any 1-year period . . . aggregating at least $5,000 in value." 18 U.S.C. § 1030(c)(4)(A)(i)(I). As discussed in earlier posts on this blog, the CFAA defines “loss” as "any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service." 18 U.S.C. § 1030(e)(11).
The plaintiffs reiterated prior pleadings that they claimed demonstrated the requisite $5,000 loss: Amazon's “actions 'raise[d] the cost of admission to Amazon's website,' 'charge[d] an undisclosed toll for the use of its website,' 'imposed opportunity costs on Plaintiffs,' and 'constituted a taking and use of their computer assets without compensation.'" Plaintiffs also newly alleged (1) that they had purchased anti-virus software that Amazon defeated, and (2) that their private information allegedly exploited by Amazon "had economic value far in excess of $5,000," and Amazon had exploited it for financial gain.
The court “flatly reject[ed] Plaintiffs' position that '“[c]ost" does not exclude non-monetary detriments,'" because such detriments could not aggregate to $5,000. Further, even if the plaintiffs' alleged costs were “losses” under the CFAA, they "failed to allege facts from which it could plausibly be inferred that those costs total at least $5,000." In alleging that the private information allegedly exploited by Amazon had no monetary value to plaintiffs, but only to Amazon, the plaintiffs effectively conceded that they had not suffered a “loss” under the CFAA. It was of no matter that Amazon had allegedly exploited the private information for financial gain if the plaintiffs had not suffered a “loss.”
Going a step further, the court stated that “Plaintiffs' allegations only confirm what the Court previously suggested--that Plaintiffs' raw information is not valuable.” The plaintiffs provided no factual allegations from which the court could infer that their raw data was valuable, and it was just as likely that the data gained value "only after it is organized and catalogued by [Amazon] in a manner that allows advertisers to use it in a targeted fashion."
Likewise, the fact that Amazon defeated anti-virus software did not constitute a showing of “loss.” For example, no plaintiff pled that he or she had noticed any loss in computing performance due to Amazon's alleged actions. This was unsurprising, given that cookies are of small size and unlikely to affect computing performance. Nor was there even a suggestion that the anti-virus software was related to Amazon's alleged exploits related to cookies.
In sum, the third time was not the charm for the plaintiffs with respect to their CFAA claim. The court granted Amazon's motion to dismiss with prejudice concerning that claim and one of the state law claims, although other claims did remain in the case.