Last week, Judge Koh handed down a significant decision about the legality of e-mail scanning in the case of In Re: Google, Inc Gmail Litigation. In this class action, a class of Gmail users and people who sent e-mail to Gmail users complain that their e-mails were unlawfully wiretapped in violation of the Federal Wiretap Act as well as state wiretapping laws. This post will focus on a key part of the ruling and explain why I think it’s wrong.
Specifically, Judge Koh denied Google’s motion to dismiss the claims under the Federal Wiretap Act on the ground that there was insufficient evidence of consent from Gmail’s terms of service. According to Judge Koh, the TOS didn’t make clear that Gmail was going to scan in order to create user profiles or provide targeted advertisements. As a result, the notice under the TOS didn’t generate consent for purposes of the Wiretap Act:
Google points to its Terms of Service and Privacy Policies, to which all Gmail and Google Apps users agreed, to contend that these users explicitly consented to the interceptions at issue. The Court finds, however, that those policies did not explicitly notify Plaintiffs that Google would intercept users’ emails for the purposes of creating user profiles or providing targeted advertising.
. . . The Court finds that Gmail users’ acceptance of these statements does not establish explicit consent. Section 8 of the Terms of Service suggests that content may be intercepted under a different set of circumstances for a different purpose — to exclude objectionable content, such as sexual material. This does not suggest to the user that Google would intercept emails for the purposes of creating user profiles or providing targeted advertising. Watkins, 704 F.2d at 582 (“[C]onsent within the meaning of section 2511(2)(d) is not necessarily an all or nothing proposition; it can be limited. It is the task of the trier of fact to determine the scope of the consent and to decide whether and to what extent the interception exceeded that consent.”); In re Pharmatrack, Inc., 329 F.3d at 19 (“Thus, a reviewing court must inquire into the dimensions of the consent and then ascertain whether the interception exceeded those boundaries.”) (internal quotation marks omitted). Therefore, to the extent that section 8 of the Terms of Service establishes consent, it does so only for the purpose of interceptions to eliminate objectionable content. The Consolidated Complaint suggests, however, that Gmail’s interceptions for the purposes of targeted advertising and creation of user profiles was separate from screening for any objectionable content. See ECF No. 38-2 ¶¶ 5, 200. Because the two processes were allegedly separate, consent to one does not equate to consent to the other.
I don’t find that persuasive. Notice of monitoring generates consent under the Wiretap Act: A person who receives notice of the monitoring but proceeds anyway is deemed to have impliedly consented. See, e.g., Griggs-Ryan v. Smith, 904 F.2d 112, 116-17 (1st Cir. 1990) (“[I]mplied consent is consent in fact which is inferred from surrounding circumstances indicating that the party knowingly agreed to the surveillance.”) But the key question is whether the user received notice of the monitoring, not whether the user received an accurate explanation of the reason for the monitoring or what would happen after the monitoring occurred.
This is just an expression of the traditional distinction between fraud in the inducement and fraud in the factum generally taught in first-year criminal law courses. If A tricks B to consenting to an act by misrepresention, the consent is still valid unless A tricked by as to the nature of the act to which B was consenting. Misrepresentation that induces the consent doesn’t eliminate the consent. See generally Rollin M. Perkins & Ronald N. Boyce, Criminal Law 1075-84 (3d ed. 1982). In the case of Gmail’s policies, Gmail users were put on notice as to the interception. Whether they knew about what would happen after the interception occurred is immaterial to the consent.
Judge Koh cites cases stating that consent can be limited and tailored to the circumstances, requiring a close study of the dimensions of that consent. But those cases consider the scope of notice to determine the scope of what would be intercepted, not the specific reasons for the interception. In Watkins v. L.M. Berry & Co., 704 F.2d 577 (11th Cir. 1983), for example, an employee sued her former employer for recording her personal phone calls on the work phone. According to the plaintiff, the employer had announced a policy that work-related calls would be recorded but that personal phone calls would not be — at least beyond the brief window needed to identify the calls as personal. The employer had actually listened in on her personal calls beyond that brief window, the plaintiff alleged, which the plaintiff argued was a Wiretap Act violation. In holding that consent was not “all or nothing,” and courts had to determine the scope of consent, the Eleventh Circuit was merely pointing out that there is a time element of consent: Notice might allow consent for some calls and not others, or for some times but not others. That’s quite different from Judge Koh’s approach, which appears to suggest that notice requires a specific declaration of what the other party was going to do with the recording (or at least consistency between declared uses and ultimate uses.)