A group of email users can move forward with a class action lawsuit against Google for its Gmail keyword-scanning system, Judge Lucy Koh has declared. Earlier today, Koh filed a decision on Google's request to dismiss the case, which accuses it of violating anti-wiretapping laws by "reading" emails in order to display targeted advertisements. Though she agreed that aggrieved users couldn't legally bring a few of their claims to court, Google might still have run afoul of the California Invasion of Privacy Act and the federal Wiretap Act, and some of its far-reaching defenses stand little chance of success.
At the heart of the case is a question of whether Google's scanning constitutes intercepting a piece of communication without the user's consent. The company has mounted a number of defenses, from the extremely basic to the highly technical. Among other things, it's asserted that the scanning was necessary to the ordinary course of business, that individual states don't have jurisdiction in the case, and that its opponents can't show they were harmed by the scanning. But the case became infamous because of one phrase: "a person has no legitimate expectation of privacy in information he voluntarily turns over to third parties."
"Accepting Google's theory of implied consent would eviscerate the rule against interception."
The quote, actually taken verbatim from a 1979 court case, describes what's known as the third-party doctrine, which limits how much privacy users can expect when they turn over information to a third party like an email provider or phone company. Ironically, an argument that email can't reasonably be considered confidential is one of the only claims that Google won, at least under the California law in question. "Unlike phone conversations, email services are by their very nature recorded on the computer of at least the recipient, who may then easily transmit the communication to anyone else who has access to the internet or print the communications," Koh wrote, dismissing one of the California-specific charges.
In federal court, however, it's a different story. Koh unequivocally rejected Google's suggestion that non-Gmail users had to expect their communications would be scanned, and that they had therefore consented simply by virtue of using email. Even if the third-party doctrine could apply to people who use Gmail, Google has not "cited anything that suggests that by doing nothing more than receiving emails from a Gmail user, non-Gmail users have consented to the interception of those communications," she said. "Accepting Google's theory of implied consent — that by merely sending emails to or receiving emails from a Gmail user, a non-Gmail user has consented to Google's interception of such emails for any purposes — would eviscerate the rule against interception." Nor could Google claim that its scanning was necessary for the business of providing email, a narrow exception to anti-wiretapping law.
This doesn't mean the overall issue is decided. Koh didn't have to determine whether the plaintiffs made a strong enough argument to win, just whether Google had presented evidence that their claims shouldn't be considered at all. Now, the company's opponents have three weeks to amend the handful of dismissed complaints, after which the case will continue on the road to a trial. Google has lost some high-profile privacy cases, and it's possible this will add another to the pile — even if we likely won't find out for a while yet.