Henson v. Turn, Inc.
No. 15-cv-01497-JSW (LB), 2018 WL 5281629 (N.D. Cal. Oct. 22, 2018).
In this data privacy class action, the court denied the defendant’s request to inspect the plaintiffs’ mobile devices.
It also denied production of the plaintiffs’ full web browsing history and the cookies stored on their devices. The court noted that these requests could “sweep in” irrelevant information, were not proportional, and invaded the plaintiffs’ privacy.
The representative plaintiffs alleged that the defendant, Turn, Inc., violated their privacy by installing “zombie cookies” on their mobile devices. These cookies, they claimed, allowed Turn to continue tracking their web browsing activities even after they deleted their cookies.
During discovery, Turn propounded three requests that the plaintiffs objected to:
- production of the plaintiffs’ mobile devices, or complete forensic images of those devices, for inspection;
- their devices’ full web browsing histories;
- and “all cookies stored on or deleted from their devices.”
Turn argued that “the plaintiffs’ mobile devices ‘are at the very heart of this case,’” justifying its broad requests. It also claimed that it needed to determine when the plaintiffs accessed Turn partner websites and how often they deleted their cookies.
The plaintiffs countered that Turn’s requests would reveal “private text messages, emails, contact lists, photographs, and web browsing histories unrelated to” Turn. They argued that this broad exposure “flies in the face of [Federal Rule of Civil Procedure] 26(b)’s” limits. Full browser histories and cookies would be “overbroad, irrelevant, and invasive of [the plaintiffs’] privacy interests” as well.
The plaintiffs suggested less-invasive alternatives, which Turn rejected. For example, if Turn identified its partner sites, the plaintiffs offered to produce their associated browsing histories and cookie data.
The court began by noting that people “increasingly use a single mobile device … for [all of] their online activities.” These activities range from managing finances and shopping to communicating with friends and evaluating personal medical symptoms. Marketing companies, in an attempt to track these activities, use cookies to gather personal information about web users. As a growing number of web users have “expressed discomfort” at the privacy intrusion that cookies enable, many have started blocking and deleting cookies.
Companies like Turn have fought back by creating so-called “zombie cookies” that “respawn” after users delete them. The plaintiffs argue that Turn’s cookies restore themselves, along with their prior history, when users visit any Turn partner website.
Rule 26(b)(1) limits the scope of discovery to matters relevant to a party’s claim or defense. Discovery must also be proportional to the needs of the case. The court held that Turn’s requests encompassed information that did not satisfy either criterion.
First, inspecting the plaintiffs’ mobile devices could “sweep in documents and information that are not relevant” to the case. Similarly, while proportionality often turns on the expenses associated with discovery, it “is not limited to such financial considerations.” Instead, “privacy interests can be a consideration in evaluating proportionality,” especially regarding inspection of personal mobile devices. The court agreed that most Americans’ phones offer “a digital record of nearly every aspect of their lives.”
The court also noted that the plaintiffs here had “already forensically imaged their devices,” ensuring the preservation of information. Further, they had established a protocol for production and had complied with all of Turn’s other requests.
Given the plaintiffs’ cooperation and the potential for production of irrelevant and private information, the court found the contested requests disproportionate. It largely accepted the plaintiffs’ suggested alternatives.
In closing, the court added that granting Turn’s requests “would further invade the plaintiffs’ privacy interests,” potentially chilling future privacy cases.
Takeaways on the Benefits of Thorough Preservation
This is an interesting case, not only because of its subject (zombie cookies!), but also because of the way the court assesses proportionality to include the privacy implications of a discovery request. It also illuminates two other important takeaways for those seeking to negotiate a fair and reasonable scope of discovery. The first is the benefit of robust preservation practices — the plaintiffs helped their case here by preserving the information on their mobile devices before this discovery dispute arose, thereby protecting themselves against a later spoliation argument. Second, the court credited the plaintiffs’ cooperative production efforts in complying with nine other related requests for production, which allowed everyone to focus on the true issue in dispute.
