Header graphic for print
Inside Privacy Updates on Developments in Global Privacy & Data Security from Covington & Burling LLP

Court Dismisses CFAA, Trespass Claims Against Amazon

Posted in Litigation, United States

By Brian Ryoo

The United States District Court for the Western District of Washington recently dismissed in part an online privacy lawsuit alleging that Amazon “circumvented” browser privacy controls in order to track users’ web browsing activities.  The plaintiffs in Del Vecchio v. Amazon had alleged that Amazon “exploit[ed]” browser controls in Internet Explorer by publishing a “gibberish” P3P compact policy and using Flash cookies (which until recently were not subject to browser settings) for tracking.  They sought relief under the Computer Fraud and Abuse Act (“CFAA”), Washington’s Consumer Protection Act (“CPA”), and common law claims for trespass to chattels and unjust enrichment. 

Stating that “Plaintiffs’ raw information is not valuable,” the court held that the plaintiffs failed to allege sufficient facts to establish at least $5,000 in “loss,” the threshold level of injury required to obtain relief under CFAA.  The court rejected the plaintiffs’ argument that because their personal  information had economic value of greater than $5,000 to Amazon (whom, they argued, has monetized the data collected from putative class members), they had adequately alleged “loss” in the amount required under the statute.  The court explained: “[i]t is not enough to allege only that the information has value to Defendant; the term “loss” requires that Plaintiffs suffer a detriment—a detriment amounting to more than $5,000.”  The court was similarly unmoved by plaintiffs’ alternative argument that Amazon’s use of Flash cookies impaired the performance of their computers, noting that “[n]ot one Plaintiff alleges that he or she experienced any noticeable difference in his or her computer’s performance traceable to [Amazon’s] actions.”  

On the remaining CPA and unjust enrichment claims, the court noted that Amazon’s “Conditions of Use and Privacy Notice” likely disclosed all of its intended actions and “would appear to serve both as an acknowledgement that cookies were being received and an implied acceptance of that fact”—facts that would likely defeat the plaintiffs’ claims.  Still, because the court will rely on materials outside the plaintiffs’ complaint in disposing of these claims (and thus will treat the motion as requesting summary judgment on them), the court granted plaintiffs limited discovery “concerning [Amazon’s] conditions and notice, their location on [Amazon’s] site, and each Plaintiff’s use of Defendant’s site.” 

The dismissal order was the second in the Del Vecchio case.  (We blogged about the first one here.)  A grant of summary judgment for Amazon could end the case for good.