In Re DoubleClick Inc. Privacy Litigation

DoubleClick Inc. (defendant) was the world’s largest provider of Internet advertising products. When Internet users (plaintiffs) visited any DoubleClick-affiliated website, a cookie would be placed on the user’s hard drive. Typically, the purpose of a cookie is to store data like usernames and passwords to make it easier for users to access websites. The plaintiffs claimed, however, that DoubleClick’s cookies collected other private and personal information, like names, addresses, phone numbers, and Internet browsing activity. The plaintiffs sued, alleging both statutory and common-law claims. One claim was an alleged violation of Title II of the Electronic Communications Privacy Act (ECPA), which prohibits unauthorized access to communications facilities to access stored electronic communications. The parties did not dispute that DoubleClick had gained unauthorized access to the users’ hard drives, and that the hard drives were communications facilities for purposes of the ECPA. Instead, DoubleClick’s defense centered on an exception provided in Title II of the ECPA. In essence, this exception said that if one party to the communication authorized someone to access the communication, then there was no liability for that access. Whether this exception applied to DoubleClick’s conduct hinged on whether the affiliated websites were considered Internet users. The plaintiffs argued that only the individual plaintiffs could be considered Internet users, not the affiliated websites. Additionally, the plaintiffs asserted that even if the cookies themselves did not violate the ECPA, the identification numbers that DoubleClick assigned to its cookies did violate the statute. This argument relied on the fact that the identification numbers were not part of a communication between the plaintiffs and the affiliated websites. Therefore, the websites could not authorize DoubleClick to access those numbers on the plaintiffs’ hard drives.