## Facts

- DoubleClick operated an Internet advertising network serving ads on thousands of affiliated publisher websites.
- When users visited an affiliated site, DoubleClick’s servers placed a browser cookie on the user’s computer containing a unique identifier.
- As users visited other affiliated sites, DoubleClick used the cookie identifier to recognize the browser, track browsing activity across sites, and deliver targeted advertisements.
- Plaintiffs (a consolidated class of Internet users) alleged DoubleClick used cookies to obtain and correlate their web activity without authorization, amounting to unlawful access to stored communications, interception of electronic communications, and unauthorized access to their computers.
- The litigation was consolidated in the Southern District of New York; DoubleClick moved to dismiss the federal statutory claims under Rule 12(b)(6).

## Issues

1. Whether cookie-based tracking and related data access stated a claim under the Stored Communications Act, including whether the statutory consent exception applied.
2. Whether the alleged interception of user communications with affiliated websites stated a claim under the Wiretap Act, or was barred by the consent exception and the “criminal or tortious purpose” limitation.
3. Whether the allegations stated a civil claim under the Computer Fraud and Abuse Act, including whether plaintiffs adequately pleaded a qualifying “loss” totaling at least $5,000 within a one-year period and permissible aggregation.

## Decision

- The court granted DoubleClick’s Rule 12(b)(6) motion and dismissed the federal claims with prejudice.
- The court held the Stored Communications Act claim failed because DoubleClick’s conduct fell within the statute’s consent exception based on authorization from affiliated websites.
- The court held the Wiretap Act claim failed because a party to the communications (the affiliated websites) consented, and plaintiffs did not plausibly allege interception for a criminal or tortious purpose.
- The court held the CFAA claim failed because plaintiffs did not plead a cognizable, statutorily defined “loss” meeting the $5,000 threshold, and the proposed aggregation theory was insufficient.
- After dismissing all federal claims, the court declined supplemental jurisdiction over the state-law claims and dismissed the action in its entirety.

## Legal Principles

- Under the Stored Communications Act, access that is authorized by a “user” of the relevant service with respect to communications of or intended for that user falls within a statutory consent exception.
- For online interactions between a website and a visitor, the website can qualify as a party to the communication and can consent to a third party’s involvement in functions such as ad delivery and related data collection.
- Under the Wiretap Act, interception is not actionable when one party to the communication gives prior consent, unless the interception is undertaken for the purpose of committing a criminal or tortious act.
- The Wiretap Act’s “criminal or tortious purpose” limitation focuses on the interceptor’s purpose, not merely on allegations that the conduct could also support other claims.
- Civil CFAA claims require pleading statutorily defined “loss” and meeting the $5,000 threshold; de minimis privacy or resource-usage allegations tied to cookies, without qualifying response or service-interruption costs, are generally insufficient.
- CFAA loss aggregation is constrained and does not permit open-ended pooling of minimal harms across large numbers of users to satisfy the jurisdictional threshold.

## Conclusion

The court dismissed federal privacy and computer-access claims arising from cookie-based advertising tracking, concluding that affiliated websites’ consent defeated the SCA and Wiretap Act theories and that plaintiffs failed to plead the CFAA’s required $5,000 qualifying loss, then declined jurisdiction over the remaining state claims.


In re DoubleClick Inc. Privacy Litigation, 154 F. Supp. 2d 497 (S.D.N.Y. 2001)