The opinion of the court was delivered by: Naomi Reice Buchwald, United States District Judge.
Plaintiffs bring this class action on behalf of themselves and all
situated*fn1 against defendant DoubleClick, Inc.
("defendant" or "DoubleClick") seeking injunctive and monetary relief for
injuries they have suffered as a result of DoubleClick's purported
illegal conduct. Specifically, plaintiffs bring three claims under
federal laws: (1) 18 U.S.C. § 2701, et seq.; (2) 18 U.S.C. § 2510,
et seq.; (3) 18 U.S.C. § 1030, et seq.; and four claims under state
laws: (1) common law invasion of privacy; (2) common law unjust
enrichment; (3) common law trespass to property; and (4) Sections 349(a)
and 350 of Article 22A of the New York General Business Law.
Now pending is DoubleClick's motion, pursuant to Fed. R. Civ. P.
12(b)(6), to dismiss Claims I, II and III of the Amended Complaint for
failure to state a claim on which relief can be granted. For the reasons
discussed below, DoubleClick's motion is granted and the Amended
Complaint is dismissed with prejudice.
This case is a multidistrict consolidated class action. The initial
complaint was filed in this Court on January 31, 2000. On May 10, 2000,
this Court consolidated the set of related federal class actions against
DoubleClick in the Southern and Eastern Districts of New York pursuant to
Rule 42(a) of the Fed. R. Civ. P. and Local Rule 1.6 of the Southern and
Eastern Districts of New York.*fn2 The consolidated class filed its
Amended Complaint on May 26, 2000. Later, pursuant to 28 U.S.C. § 1407
(a), the Judicial Panel on Multidistrict Litigation transferred two cases
to this Court for pretrial proceedings: Steinbeck v. DoubleClick, 00
Civ. 5705, C.A, N.O. 8:00-98 (C.D. Cal) on July 31, 2000 and Freedman v.
DoubleClick, 00 Civ. 7194, 2:00-1559 (E.D. La) on September 22, 2000.
DoubleClick, a Delaware corporation, is the largest provider of
Internet advertising products and services in the world. Its
Internet-based advertising network of over 11,000 Web publishers has
enabled DoubleClick to become the market leader in delivering online
advertising. DoubleClick specializes in collecting, compiling and
analyzing information about Internet users through proprietary
technologies and techniques, and using it to target online advertising.
DoubleClick has placed billions of advertisements on its clients' behalf
and its services reach the majority of Internet users in the United
Although a comprehensive description of the Internet is unnecessary to
address the issues raised in this motion, a rudimentary grasp of its
architecture and engineering is
important.*fn4 The Internet is
accurately described as a "network of networks." Computer networks are
interconnected individual computers that share information. Anytime two
or more computer networks connect, they form an "internet." The
"Internet" is a shorthand name for the vast collection of interconnected
computer networks that evolved from the Advanced Research Projects Agency
Network ("ARPANet") developed by the United States Defense Department in
the 1960's and 1970's. Today, the Internet spans the globe and connects
hundreds of thousands of independent networks.
The World Wide Web ("the Web" or "WWW") is often mistakenly referred to
as the Internet. However, the two are quite different. The Internet is
the physical infrastructure of the online world: the servers, computers,
fiber-optic cables and routers through which data is shared online. The
Web is data: a vast collection of documents containing text, visual
images, audio clips and other information media that is accessed through
the Internet. Computers known as "servers" store these documents and make
them available over the Internet through "TCP/IP" (Transmission Control
Protocol/Internet Protocol), a set of standard operating and transmission
protocols that structure the Web's operation. Every document has a unique
"URL" (Universal Resource Locator) that identifies its physical location
in the Internet's infrastructure. Users access documents by sending
request messages to the servers that store the documents. When a server
receives a user's request (for example, for Lycos.com's home page), it
prepares the document and then transmits the information back to the
The Internet utilizes a technology called "packet switching" to carry
data. Packet switching works as follows. The computer wishing to send a
document ("originating computer"), such as a music file or digital
image, cuts the document up into many small "packets" of information.
Each packet contains the Internet Protocol ("IP") address of the
destination Web site, a small portion of data from the original
document, and an indication of the data's place in the original
document. The originating computer then sends all of the packets through
its local network to an external "router." A router is a device that
contains continuously-updated directories of Internet addresses called
"routing tables." The router takes each packet from the original document
and sends it to the next available router in the direction of the
destination Web site. Because each router is connected to many other
routers and because the connection between any two given routers may be
congested with traffic at a given moment, packets from the same document
are often sent to different routers. Each of these routers, in turn,
repeats this process, forwarding each packet it receives to the next
available router in the direction of the destination Web site.
Collectively, this process is called "dynamic routing."
DOUBLECLICK'S TECHNOLOGY AND SERVICES
DoubleClick provides the Internet's largest advertising service.
Commercial Web sites often rent-out online advertising "space" to other
Web sites. In the simplest type of arrangement, the host Web site (e.g.,
Lycos.com) rents space on its webpages to another Web site (e.g.,
TheGlobe.com) to place a "hotlink" banner advertisement*fn6 ("banner
advertisment"). When a user on the host Web site "clicks" on the banner
advertisement, he is automatically connected to the advertiser's
designated Web site.
DoubleClick acts as an intermediary between host Web sites and Web
sites seeking to place banner advertisements. It promises client Web
sites that it will place their banner advertisements in front of viewers
who match their demographic target. For example, DoubleClick might try to
place banner advertisements for a Web site that sells golfclubs in front
of high-income people who follow golf and have a track record of making
expensive online purchases. DoubleClick creates value for its customers
in large part by building detailed profiles of Internet users*fn7 and
using them to target clients' advertisements.
DoubleClick compiles user profiles utilizing its proprietary
technologies and analyses in cooperation with its affiliated Web sites.
DoubleClick is affiliated with over 11,000 Web sites for which and on
which it provides targeted banner advertisements.
A select group of over 1,500 of these Web sites form the "DoubleClick
Network" and are among "the most highly trafficked and branded sites on
the Web." In addition, DoubleClick owns and operates two Web sites
through which it also collects user data: (1) the Internet Address Finder
("IAF"); and (2) NetDeals.com.*fn8
When users visit any of these DoubleClick-affiliated Web sites, a
"cookie" is placed on their hard drives.*fn9 Cookies are computer
programs commonly used by
Web sites to store useful information such as
usernames, passwords, and preferences, making it easier for users to
access Web pages in an efficient manner. However, Plaintiffs allege that
DoubleClick's cookies collect "information that Web users, including
plaintiffs and the Class, consider to be personal and private, such as
names, e-mail addresses, home and business addresses, telephone numbers,
searches performed on the Internet, Web pages or sites visited on the
Internet and other communications and information that users would not
ordinarily expect advertisers to be able to collect." Amended Complaint
at ¶ 38. DoubleClick's cookies store this personal information on
users' hard drives until DoubleClick electronically accesses the cookies
and uploads the data.
How DoubleClick targets banner advertisements and utilizes cookies to
collect user information is crucial to our analysis under the three
statutes. Therefore, we examine both processes in greater detail.
A. Targeting Banner Advertisements
DoubleClick's advertising targeting process involves three participants
and four steps. The three participants are: (1) the user; (2) the
DoubleClick-affiliated Web site; (3) the DoubleClick server.*fn10 For
the purposes of this discussion, we assume that a DoubleClick cookie
already sits on the user's computer with the identification number
In Step One, a user seeks to access a DoubleClick-affiliated Web site
such as Lycos.com. The user's browser*fn11 sends a communication to
Lycos.com (technically, to Lycos.com's server) saying, in essence, "Send
me your homepage." U.S. Patent No. 5,948,061 (issued September 7, 1999)
("DoubleClick Patent"), col. 3, ll. 6-9. This communication may contain
data submitted as part of the request, such as a query string or field
In Step Two, Lycos.com receives the request, processes it, and returns
a communication to the user saying "Here is the Web page you requested."
The communication has two parts. The first part is a copy of the
Lycos.com homepage, essentially the collection article summaries,
pictures and hotlinks a user sees on his screen when Lycos.com appears.
The only objects missing are the banner advertisements; in their places
lie blank spaces. Id. at col. 3, ll. 28-34. The second part of the
communication is an IP-address link to the DoubleClick server. Id. at
col. 3, ll. 35-38. This link instructs the user's computer to send a
communication automatically to DoubleClick's server.
In Step Three, as per the IP-address instruction, the user's computer
sends a communication to the DoubleClick server saying "I am cookie
#0001, send me banner advertisements to fill the blank spaces in the
Lycos.com Web page." This communication contains information including
the cookie identification number, the name of the DoubleClick-affilated
Web site the user requested, and the user's browser-type. Id. at col. 3,
Finally, in Step Four, the DoubleClick server identifies the user's
profile by the cookie identification number and runs a complex set of
algorithms based, in part, on the user's profile, to determine which
advertisements it will present to the user. Id. at col. 3, ll. 52-57,
col. 5, l. 11 — col. 6, l. 59. It then sends a communication to the
user with banner advertisements saying "Here are the targeted banner
for the Lycos.com homepage." Meanwhile, it also updates
the user's profile with the information from the request. Id. at col. 6,
l. 60 — col. 7, l. 14.
DoubleClick's targeted advertising process is invisible to the user.
His experience consists simply of requesting the Lycos.com homepage and,
several moments later, receiving it complete with banner advertisements.
B. Cookie Information Collection
DoubleClick's cookies only collect information from one step of the
above process: Step One. The cookies capture certain parts of the
communications that users send to DoubleClick-affiliated Web sites. They
collect this information in three ways: (1) "GET" submissions, (2) "POST"
submissions, and (3) "GIF" submissions.
GET information is submitted as part of a Web site's address or "URL,"
in what is known as a "query string." For example, a request for a
hypothetical online record store's selection of Bon Jovi albums might
read: http://recordstore.hypothetical.com/search?terms=bonjovi. The URL
query string begins with the "?" character meaning the cookie would
record that the user requested information about Bon Jovi.
Users submit POST information when they fill-in multiple blank fields
on a webpage. For example, if a user signed-up for an online discussion
group, he might have to fill-in fields with his name, address, email
address, phone number and discussion group alias. The cookie would
capture this submitted POST information.
Finally, DoubleClick places GIF tags on its affiliated Web sites. GIF
tags are the size of a single pixel and are invisible to users. Unseen,
they record the users' movements throughout the affiliated Web site,
enabling DoubleClick to learn what information the user sought and
Although the information collected by DoubleClick's cookies is
allegedly voluminous and detailed, it is important to note three clearly
defined parameters. First, DoubleClick's cookies only collect information
concerning users' activities on DoubleClick-affiliated Web sites.*fn12
Thus, if a user visits an unaffiliated Web site, the DoubleClick cookie
captures no information. Second, plaintiff does not allege that
DoubleClick ever attempted to collect any information other than the
GET, POST, and GIF information submitted by users. DoubleClick is never
alleged to have accessed files, programs or other information on users'
hard drives. Third, DoubleClick will not collect information from any
user who takes simple steps to prevent DoubleClick's tracking. As
plaintiffs' counsel demonstrated at oral argument, users can easily and at
no cost prevent DoubleClick from collecting information from them. They
may do this in two ways: (1) visiting the DoubleClick Web site and
requesting an "opt-out" cookie; and (2) configuring their browsers to
block any cookies from
being deposited. Transcript of February 22, 2001
Oral Argument at 15-18.
Once DoubleClick collects information from the cookies on users' hard
drives, it aggregates and compiles the information to build demographic
profiles of users. Plaintiffs allege that DoubleClick has more than 100
million user profiles in its database. Exploiting its proprietary Dynamic
Advertising Reporting & Targeting ("DART") technology, DoubleClick and
its licensees*fn13 target banner advertisements using these demographic
ABACUS ACQUISITION AND FTC INVESTIGATION
In June 1999, DoubleClick purchased Abacus Direct Corp. ("Abacus") for
more than one billion dollars. Abacus was a direct-marketing services
company that maintained a database of names, addresses, telephone
numbers, retail purchasing habits and other personal information on
approximately ninety percent of American households, which it sold to
direct marketing companies. Plaintiffs allege that DoubleClick planned to
combine its database of online profiles with Abacus' database of offline
customer profiles in order to create a super-database capable of matching
users' online activities with their names and addresses.
In furtherance of this effort, DoubleClick created the Abacus Online
Alliance is purportedly a confidential group of online marketers and
publishers who secretly contribute their compiled customer data to a
cooperative database managed by DoubleClick. In return for their
contributions, Abacus Alliance members gain access to exclusive
DoubleClick products and services. In mid-1999, shortly after
removing its assurance that information gathered from users online
would not be associated with their personally identifiable information.
Not long after the Abacus acquisition, the Federal Trade Commission
("FTC") launched an investigation into whether DoubleClick's collection,
compilation and use of consumer information constituted unfair or
deceptive trade practices in violation of Section 5 of the Federal Trade
Commission Act.*fn14 On March 2, 2000, Kevin O'Connor, DoubleClick's CEO
and Chairman of the Board, announced that he had made a "mistake" by
planning to merge DoubleClick's and Abacus' databases and stated that
DoubleClick would undertake no such merger until it reached an agreement
with the United States government and Internet industry regarding privacy
standards. It is unclear whether DoubleClick had already
merged any of the information.*fn15
The FTC concluded its investigation on January 22, 2001. In a letter to
DoubleClick's outside counsel, the FTC announced that it was ending its
investigation with no finding that DoubleClick had engaged in unfair or
deceptive trade practices. It summarized its conclusions:
Based on this investigation, it appears to staff that
DoubleClick never used or disclosed consumers' PII
[personal identifiable information] for purposes other
Specifically, it appears that DoubleClick did not
combine PII from Abacus Direct with clickstream
collected on client Web sites. In addition, it appears
that DoubleClick has not used sensitive data for any
online preference marketing product, in contravention
of its stated online policy. We understand that
DoubleClick's Boomerang product takes user data from
one site to target advertising to the same user on
other sites. However, the user profiles DoubleClick
creates for its Boomerang clients for this targeting
contains only non-PII. Furthermore, we understand that
for all new Boomerang clients, DoubleClick requires by
that it uses DoubleClick's services to target
advertising to consumers, and DoubleClick will not
implement Boomerang on a site until such disclosures
The letter also noted several commitments DoubleClick made to modifying
user to request an "opt out" cookie that would prevent DoubleClick from
collecting information from that user.
Defendants move to dismiss plaintiffs' claims, pursuant to
Fed.R.Civ.P. 12(b)(6), for failure to state a claim upon which relief may
be granted. In considering a motion to dismiss pursuant to Fed.R.Civ.P.
12(b)(6), we accept as true all material factual allegations in the
Amended Complaint, Atlantic Mutual Ins. Co. v. Balfour Maclaine Int'l,
Ltd., 968 F.2d 196, 198 (2d Cir. 1992), and may grant the motion only
where "it appears beyond doubt that the plaintiff can prove no set of
facts in support of his claim which would entitle him to relief." Still
v. DeBuono, 101 f.3d 888, 891 (2d Cir. 1996); see Conley v. Gibson,
355 U.S. 41, 48 (1957). "General, conclusory allegations need not be
credited, however, when they are belied by more specific allegations of
the complaint." Hirsch v. Arthur Andersen & Co., 72 F.3d 1085 (2d Cir.
1995) (citing Jenkins v. S & A Chaissan & Sons, Inc., 449 F. Supp. 216,
227 (S.D.N.Y. 1978); 5A Charles A. Wright & Arthur R. Miller, Federal
Practice and Procedure § 1363, at 464-65 (2d ed. 1990). In addition
to the facts set forth in the Amended Complaint, we may also consider
documents attached thereto and incorporated by reference therein,
Automated Salvage Transp., Inc. v. Wheelabrator Envtl. Sys., Inc.,
155 F.3d 59, 67 ...