U.S. District Judge Lucy Koh, Northern District of California
U.S. District Judge Lucy Koh, Northern District of California (Jason Doiy / The Recorder)

A federal judge has defused a potentially massive privacy class action targeting Google’s scanning of Gmail messages to help sell ads.

In a 41-page order issued Tuesday evening, U.S. District Judge Lucy Koh of the Northern District of California shot down plaintiffs’ bids to certify sweeping classes of email users. Plaintiffs accused Google Inc. of intercepting Gmail messages to mine users’ personal information in violation of the Electronic Communications Privacy Act and state wiretap laws. They stressed that Google’s uniform practices made their claims perfect for class treatment.

But Koh disagreed, finding the court would have to consider how much each user knew about Google’s practices in order to determine whether they consented to the interceptions.

“The court finds that individual issues of consent are likely to predominate over any common issues, and that accordingly, class certification would be inappropriate,” she wrote.

Koh’s order declaws multidistrict litigation that has been a source of great consternation in the Valley, sparking similar suits against Yahoo Inc. and LinkedIn Corp. The cases are particularly fearsome because they contain claims filed under ECPA, which allows for statutory damages of up to $10,000 per violation.

Plaintiffs lawyer Sean Rommel of Wyly-Rommel did not immediately respond to a request for comment about In re Google Gmail Litigation, 13-2430. Google lawyer Michael Rhodes of Cooley referred a request for comment to the company, which cheered Koh’s order.

“We’re glad the court agreed that we have been upfront about Gmail’s automated processing, which allows us to provide security and spam protection, tailored ads, and other great features like Priority Inbox,” a Google spokesman said in a statement.

Plaintiffs lawyers at Texas’ Wyly-Rommel and Alabama’s Cory Watson Crowder & DeGaris sought to certify a vast class of non-Gmail users who have sent or received emails from people who use the service, as well as classes of minors, Google Apps for Education users, Cable One users and several state classes. Koh refused to allow the plaintiffs to refile their motion for class certification, noting the issue was considered by another court before the cases were consolidated as multidistrict litigation in the Northern District in 2013.

Koh rejected Google’s bid to dismiss the case in September, finding the company’s behavior was not shielded by an exemption in ECPA for an electronic service provider’s ordinary course of business. She also found Google’s privacy policy was not explicit that messages would be intercepted to deliver targeted advertisements.

But in deciding the classes can’t proceed, Koh agreed with Google that the court must look beyond the company’s formal disclosures to consider whether plaintiffs were aware of the email scanning. She noted Google’s business model had been widely reported in the media.

“Courts have consistently held that implied consent is a question of fact that requires looking at all of the circumstances surrounding the interceptions to determine whether an individual knew that her communications were being intercepted,” Koh wrote.

She rejected plaintiffs’ argument that media reports did not put consumers on notice because they did not detail the tools Google uses to intercept messages. At a February hearing on the motion for class certification, Rommel told Koh that Google relies on a little-known program called Content One Box to extract information from users’ messages.

“To find implied consent, a fact-finder need not determine email users had specific knowledge of the particular devices that intercepted their emails,” Koh wrote.

Eric Goldman, director of the High Tech Law Institute at Santa Clara University School of Law, said Koh’s order allows email providers broad leeway to establish that users give implicit consent for their practices. But he noted her order on the motion to dismiss remains troubling for the industry. He expects Google to attack Koh’s finding that automated processing is not shielded by ECPA if the case goes up on appeal.

“If we accept the net effect of these rulings—broad interception standards but broad consent standards—it still leaves open the possibility of lots of lawsuits,” Goldman said.

But the order does underscore the challenges of class certification in privacy cases, which may give the plaintiffs bar pause in the future, Goldman said.

“The plaintiffs have to be discouraged,” he said. “They survived the motion to dismiss, but they’re not making a lot more progress, and they’re sinking a lot more money into the case.”

Contact the reporter at jlove@alm.com.