As we’ve described in this recent article, the past year has witnessed a surge in privacy litigation that shows no signs of easing. Many of these suits involve allegations that defendants have used Flash local shared objects (“Flash cookies”) for the purpose of tracking Internet users’ browsing activity. Flash cookies differ from traditional browser cookies in that they are stored outside the browser and may be immune to browser privacy controls. Also, as explained in a widely cited article [PDF], Flash cookies can be used to recreate deleted brower cookies (a practice known as browser cookies “respawning”). Citing these characteristics, plaintiffs in more than a dozen class action cases have alleged that certain companies use Flash cookies in order to circumvent users’ browser privacy controls, allegedly in violation of federal and state law.
As noted in this previous post, many of the suits have settled. But at least one company, the ad network Specific Media, appears poised to continue to contest the suit [PDF] filed against it last August in the Central District of California. On February 17, Specific Media moved [PDF] to dismiss the case, arguing (among other things) that even if the plaintiffs’ allegations were true, they have failed to show that they have suffered any legally significant injury. Here, Specific Media contends that the plaintiffs have not sufficiently alleged that the use of Flash cookies caused them to suffer a concrete and particularized “injury in fact,” which is required to bring suit in federal court. This argument has been raised in numerous other cases arising from the alleged collection and sharing of information online for advertising purposes.
Earlier this month, the plaintiffs filed what, to our knowledge, is the first fully articulated theory of standing in cases of this kind. In their opposition [PDF] to the motion to dismiss, the plaintiffs argue that Specific Media’s use of Flash cookies hurt them in two ways. First, the plaintiffs assert that the use of Flash cookies for tracking–which, the plaintiffs contend, Specific Media did surreptiously–deprived them of the economic value of their personal information. Second, they contend that the use of Flash cookies affected the performance of their computers and their web browsing experience. Specifically, the plaintiffs claim that the use of Flash cookies caused websites in Specific Media’s ad network to load more slowly than they otherwise would have. Specific Media’s reply brief is due early next month.
These arguments seem unlikely to be sufficient to overcome Specific Media’s standing challenge. The plaintiffs cite essentially no authority in support of their assertions that collection of personal information causes a legally cognizable injury, and, as Specific Media points out, several cases appear to stand for the contrary proposition. As for the allegations about Flash cookies’ harmful effect on the performance of their computers, it is perhaps possible that these will enable the plaintiffs to survive Specific Media’s facial challenge to the adequacy of the complaint’s standing allegations. However, it seems unlikely that the plaintiffs will ultimately be able to show this alleged injury. Thus, even if the plaintiffs survive Specific Media’s motion to dismiss, they may face a more difficult standing challenge at a later stage of the case.
We will continue to watch the Specific Media case closely, as it may prove to be the first of the Flash cookies cases to yield a decision on whether plaintiffs in these kinds of cases may pursue their claims in federal court.