Google wiretapping case, what the judge ruled

1. all Cable One users who sent a message to a Gmail user and received a reply or received an email;
2. all Google Apps for Education users who have sent a message to a Gmail user and received a reply or received an email;
3. all U.S. citizen non-Gmail users (except California residents) who have sent a message to a Gmail user and received a reply or received an email from a Gmail user;
4. all U.S. citizen non-Gmail users who have sent a message to a Gmail user and received a reply or received an email from a Gmail user;
5. all Pennsylvania non-Gmail users who have sent a message to a Gmail user and received a reply or received an email from a Gmail user;
6. all Florida non-Gmail users who have sent a message to a Gmail user and received a reply or received an email from a Gmail user;
7. all Maryland non-Gmail users who have sent a message to a Gmail user and received a reply or received an email from a Gmail user; and
8. all Gmail users who were under the age of majority and who used Gmail to send an email to or received an email from a non-Gmail user or a Gmail user under the age of majority.

Plaintiffs are alleging that Gmail intercepts the content of emails, to and from Gmail users, and uses the content of those emails to build user profiles and provide targeted advertising. The initial complaint was filed under seal and is heavily redacted. The Consolidated Complaint is a little less redacted, and asserts there are multiple servers involved in scanning email outside the regular SMTP servers. Plaintiffs allege these servers outside of the normal email handling process take copies of every email going through Gmail. These copies are scanned, not to improve filtering or email handling but solely used to build individual user profiles for the purpose of targeted advertising.
The level of technical detail visible even in the consolidated complaint was surprising to me. The plaintiffs appear to have found someone who knows a lot about mail and advertising processing inside Google, up to and including naming different processing systems involved (CAT2 mixer, NEMO, Caribou server, ICEbox server, etc.) The level of detail leads me to believe these allegations are mostly accurate.
In the motion to dismiss Google lawyers did not deny any of the messaging routing as alleged by the plaintiffs. Rather, they fell back on the claim that their processing was within the “ordinary course of business” and necessary to provide mail service to Google users.
The court, however, found that in all areas that should guide a ruling (case law, statutory law and legislative intent) that ordinary course of business should be interpreted very narrowly.

[T]he Court finds that the section 2510(5)(a)(ii) exception is narrow and designed only to protect electronic communication service providers against a finding of liability under the Wiretap Act where the interception facilitated or was incidental to provision of the electronic communication service at issue. Plaintiffs have plausibly alleged that Google’s reading of their emails was not within this narrow ordinary course of its business. Specifically, Plaintiffs allege that Google intercepts emails for the purposes of creating user profiles and delivering targeted advertising, which are not instrumental to Google’s ability to transmit emails. […] The Court therefore finds that Plaintiffs have plausibly alleged that the interceptions fall outside Google’s ordinary course of business. (pg 20, Document 69)

The plaintiffs also allege that the Google violated its own privacy policies by scanning emails and using the information to build user profiles.

[T]he Court need not determine at this stage whether Plaintiffs will ultimately be able to prove that the Privacy Policies were intended to comprehensively list the information Google may collect. Rather, Plaintiffs’ plausible allegations that the Privacy Policies were exhaustive are sufficient. Because Plaintiffs have alleged that Google exceeded the scope of its own Privacy Policy, the section 2510(5)(a)(ii) exception cannot apply.
Accordingly, the Court DENIES Google’s Motion to Dismiss based on the section 2510(5)(a)(ii) exception. (pg 22, Document 69)

Google also argued that their activities are legal because Google users explicitly consented to their email being monitored and that people who send mail to Google users implicitly consent to Google monitoring their mail. The plaintiffs allege, however, that some users (specifically those attending schools using Google apps for education and customers of ISPs that outsource mail to Google) never actually agreed to those terms.
The judge looks first at the argument that users explicitly consented to Google intercepting mail. During the hearing a lot of time was spent discussing the specifics of the multiple privacy polices and terms of service. The judge repeatedly asked Google’s lawyer “what part of this policy covers email?” Google’s response was “all of it.”
The judge ruling basically says the privacy policies aren’t clear enough for users to be able to consent to interception.

[T]he policies do not put users on notice that their emails are intercepted to create user profiles. The Court therefore finds that a reasonable Gmail user who read the Privacy Policies would not have necessarily understood that her emails were being intercepted to create user profiles or to provide targeted advertisements. Accordingly, the Court finds that it cannot conclude at this phase that the new policies demonstrate that Gmail user Plaintiffs consented to the interceptions. (Document 69, page 26)

The judge then looked at Google’s contention that email senders give implicit consent for email to be intercepted and categorized by Google. I think she said it best.

Google has cited no case that stands for the proposition that users who send emails impliedly consent to interceptions and use of their communications by third parties other than the intended recipient of the email. Nor has Google cited anything that suggests that by doing nothing more than receiving emails from a Gmail user, non-Gmail users have consented to the interception of those communications. Accepting Google’s theory of implied consent — that by merely sending emails to or receiving emails from a Gmail user, a non-Gmail user has consented to Google’s interception of such emails for any purposes — would eviscerate the rule against interception. (Document 69, pg 27)

Those are the alleged violations of Federal Wiretapping law. The consolidate complaint also alleges violations of the California Invasion of Privacy Act (CIPA) and various state wiretapping laws. Given the length of this post, I’ll leave the federal claims here and I’ll look at the CIPA and state allegations in future blog posts.
(All the docs I’ve downloaded are available on my Google Drive)