Justia U.S. 9th Circuit Court of Appeals Opinion Summaries

A company that operates a website hosting digitized yearbooks, allowing users to search for names and view yearbook pages, was sued by a California resident whose name and photo appeared in a yearbook on the site. The plaintiff alleged that the company violated California’s right-of-publicity statute by using individuals’ names without consent to advertise paid subscriptions. The plaintiff advanced a theory that simply making individuals’ names searchable on the site, even if no one actually searched for them, constituted a commercial use requiring consent under the statute.Previously, the United States District Court for the Northern District of California denied the company’s motion to dismiss, finding the plaintiff plausibly alleged a direct commercial use. The court then conditionally certified both damages and injunctive classes consisting of California residents whose names were searchable on the site, had never registered as users, and had not donated yearbooks. The company challenged class certification, arguing that individual issues predominated and that the lead plaintiff would not adequately represent the classes.The United States Court of Appeals for the Ninth Circuit reviewed the case. The court held that, for class certification purposes, whether being “searchable” is sufficient for liability under the statute is a merits question not to be resolved at the certification stage. The court further found that injury could be shown by common evidence of economic harm, and that the district court did not abuse its discretion in managing potential individualized issues regarding class membership. The appellate court also rejected the company’s adequacy challenges, noting that the lead plaintiff could represent both classes. The Ninth Circuit affirmed the district court’s order certifying the classes. View "NOLEN V. PEOPLECONNECT, INC." on Justia Law

Google was accused of violating the privacy rights of users in the United States by continuing to track and store their location data even after users had disabled the “Location History” feature on their devices. The lawsuit, brought as a class action on behalf of approximately 247.7 million individuals, consolidated multiple complaints. The parties ultimately negotiated a settlement that included both injunctive relief—requiring Google to alter its practices—and a $62 million fund. This settlement fund was to cover attorneys’ fees, litigation costs, service awards for class representatives, and administrative expenses. The remaining funds were to be distributed to selected nonprofit organizations with a focus on internet privacy, rather than directly to class members.The United States District Court for the Northern District of California, after conducting a fairness hearing under Federal Rule of Civil Procedure 23(e)(2), overruled objections from certain class members. These objectors argued that it was improper to distribute the settlement fund exclusively through the cy pres doctrine without first attempting a direct distribution to class members. The district court found that a direct distribution was infeasible because the pro rata share for each class member would be minimal (less than 25 cents) and administrative costs would further reduce any recovery. It approved the cy pres distribution, finding the selected nonprofit recipients had a substantial nexus to the class’s privacy interests.On appeal, the United States Court of Appeals for the Ninth Circuit affirmed the district court’s order. The appellate court held that the district court properly considered the relevant factors under amended Rule 23(e), did not improperly presume the fairness of the settlement, and acted within its discretion in approving a cy pres-only monetary distribution where direct payments were deemed infeasible and not verifiable. The court also found the selection of cy pres recipients appropriate and declined to address new constitutional arguments not presented below. The holding is that cy pres-only distributions are permissible in class settlements when direct distribution is infeasible and the selected recipients have a substantial nexus to the interests of the class. View "PATACSIL V. GOOGLE LLC" on Justia Law

A large group of plaintiffs, including several states, individuals, school districts, and local governments, brought suit against Meta Platforms, Inc., and associated entities, alleging that Facebook and Instagram’s design features encourage addictive behavior and inadequately protect young users from harmful content. Additional defendants included TikTok-related entities, school districts, and others. The cases were consolidated in multidistrict litigation, where plaintiffs asserted various claims, including personal injury and state law violations.The United States District Court for the Northern District of California organized the litigation into several tracks based on the nature of the claims and plaintiffs. Meta moved to dismiss certain claims, arguing that Section 230 of the Communications Decency Act provided them with immunity. The district court granted the dismissal in part, finding some claims barred by Section 230, but denied dismissal as to others, particularly where claims did not target Meta’s role as a publisher of third-party content. Meta sought interlocutory appeal on some orders, which the district court denied, and then appealed other orders as of right under the collateral order doctrine. TikTok entities joined in Meta’s arguments.The United States Court of Appeals for the Ninth Circuit reviewed whether it had appellate jurisdiction to hear Meta’s and TikTok’s interlocutory appeals. The court held that Section 230 provides a defense to liability, not immunity from suit, and that the denial of such a defense is not immediately appealable under the collateral order doctrine. The court found none of the requirements for a collateral order were met, emphasizing that Section 230 does not constitute a statutory or constitutional guarantee against trial. Accordingly, the Ninth Circuit dismissed the appeals and cross-appeals for lack of jurisdiction. View "STATE OF COLORADO V. META PLATFORMS, INC." on Justia Law

Amazon.com Services, LLC filed suit against Perplexity AI, Inc., an artificial intelligence company, asserting that Perplexity’s web browser tool, Comet, unlawfully accessed Amazon’s website in violation of the federal Computer Fraud and Abuse Act (CFAA) and California’s Comprehensive Computer Data Access and Fraud Act (CDAFA). Perplexity’s Comet browser includes an AI “Assistant” that, when activated by a user, navigates Amazon.com on the user’s behalf, sending browser screenshots to Perplexity’s servers for further instruction. Amazon claimed that this use of the Assistant, despite their explicit prohibition, amounted to unauthorized access to its servers.The United States District Court for the Northern District of California granted Amazon a preliminary injunction, finding that Amazon was likely to succeed on its claims under both the CFAA and CDAFA. The district court concluded that Perplexity, through its Assistant, accessed Amazon’s password-protected accounts without authorization, obtained private information, and caused Amazon to incur significant costs responding to this activity. The court also determined that the equitable factors supported granting the injunction, citing irreparable harm and the public interest.On appeal, the United States Court of Appeals for the Ninth Circuit vacated the preliminary injunction and remanded for further proceedings. The Ninth Circuit held that Amazon was unlikely to succeed on the merits of its claims because Perplexity did not “access” Amazon’s computers within the meaning of the CFAA or CDAFA; instead, the access was performed by the user employing the Assistant as a tool. The court found that the district court erred in its analysis of the equitable factors, which favored Perplexity, and concluded that an injunction was not warranted under these circumstances. The disposition was to vacate the injunction and remand. View "AMAZON.COM SERVICES, LLC V. PERPLEXITY AI, INC." on Justia Law

A national trade association representing large online businesses challenged a recently enacted California statute designed to protect minors’ privacy and well-being online. The law imposes specific requirements on businesses whose online services are likely to be accessed by children under eighteen, including obligations regarding data use, age estimation, and restrictions on certain user interface designs known as “dark patterns.” Before the law took effect, the association brought suit in the United States District Court for the Northern District of California, arguing that several provisions were unconstitutional on First Amendment and vagueness grounds, and sought a preliminary injunction to prevent enforcement.The district court initially enjoined the entire statute, finding the association was likely to succeed on its facial First Amendment challenge. On the State’s appeal, the United States Court of Appeals for the Ninth Circuit vacated most of the injunction, affirming only as to a specific requirement regarding Data Protection Impact Assessments and related inseverable provisions, and remanded for the district court to analyze the association’s other facial challenges and the issue of severability under the Supreme Court’s clarified standards in Moody v. NetChoice, LLC. On remand, the district court again enjoined the entire statute and, in the alternative, seven specific provisions.On further appeal, the United States Court of Appeals for the Ninth Circuit held that the association did not meet its burden for a facial challenge to the law’s coverage definition or its age estimation requirement, vacating the injunction as to those. However, the court affirmed the preliminary injunction as to the law’s data use and dark patterns restrictions on vagueness grounds, finding the provisions failed to clearly delineate prohibited conduct. The court vacated the injunction as to the statute’s remainder and remanded for further proceedings on severability. View "NETCHOICE, LLC V. BONTA" on Justia Law

California enacted a law aimed at addressing concerns about minors’ addiction to social media by regulating how internet platforms provide personalized content to users under 18. The law restricts minors’ access to algorithmic feeds without parental consent, imposes default settings such as hiding like counts and requiring private accounts, and mandates future age-verification procedures. NetChoice, a trade association representing major internet companies, challenged the law on First Amendment grounds, arguing it unconstitutionally restricts both platforms’ and users’ speech, and that some provisions are unconstitutionally vague.The United States District Court for the Northern District of California granted a preliminary injunction against two provisions not at issue in this appeal, but otherwise denied NetChoice’s request for broader injunctive relief. The district court found that NetChoice lacked associational standing to challenge the personalized-feed restrictions as applied to its members, that the age-verification requirements were not ripe for review, and that the default settings provisions (including the like-count and private-mode requirements) were constitutional. The court also rejected NetChoice’s vagueness arguments and found that any unconstitutional provisions could be severed from the Act.On appeal, the United States Court of Appeals for the Ninth Circuit affirmed most of the district court’s rulings. The Ninth Circuit agreed that NetChoice lacked associational standing for as-applied challenges to the personalized-feed provisions and that the age-verification requirements were unripe. The court held that the private-mode default setting survived intermediate scrutiny, but found that the like-count default setting was a content-based restriction on speech and failed strict scrutiny. The court determined that the like-count provision was severable and ordered the district court to enjoin its enforcement, while affirming the denial of injunctive relief as to the other challenged provisions. View "NETCHOICE, LLC V. BONTA" on Justia Law

Capstone Studios Corp., a copyright holder, sought to identify 29 subscribers of CoxCom LLC, an Internet service provider, whose IP addresses were allegedly used to share pirated copies of Capstone’s movie via the BitTorrent peer-to-peer protocol. Capstone petitioned the clerk of the United States District Court for the District of Hawaii to issue a subpoena under § 512(h) of the Digital Millennium Copyright Act (DMCA) to compel Cox to disclose the subscribers’ identities. Cox notified its subscribers, and one, identified as “John Doe,” objected, claiming he had not downloaded the movie and that his Wi-Fi had been unsecured.A magistrate judge treated John Doe’s letter as a motion to quash the subpoena. The magistrate judge found that Cox’s involvement was limited to providing Internet access, qualifying it for the safe harbor under 17 U.S.C. § 512(a), which covers service providers acting solely as conduits for data transmission. The magistrate judge concluded that, as a matter of law, a § 512(h) subpoena cannot issue to a § 512(a) service provider. The district court adopted these findings and quashed the subpoena. Capstone’s motion for reconsideration was denied, and Capstone appealed.The United States Court of Appeals for the Ninth Circuit reviewed the case. It held that the DMCA does not permit a § 512(h) subpoena to issue to a service provider whose role is limited to that described in § 512(a), because such providers cannot remove or disable access to infringing content and thus cannot receive a valid notification under § 512(c)(3)(A), which is a prerequisite for a § 512(h) subpoena. The court also found no clear error in the district court’s factual finding that Cox acted only as a § 512(a) service provider. The Ninth Circuit affirmed the district court’s order quashing the subpoena. View "In re Subpoena Internet Subscribers of Cox Communications, LLC" on Justia Law

Two minor boys, referred to as John Doe 1 and John Doe 2, were coerced by a trafficker into producing pornographic content, which was later posted on Twitter. Despite reporting the content to Twitter, the platform did not immediately remove it, leading to significant views and retweets. The boys and their mother made multiple attempts to have the content removed, but Twitter only acted after being prompted by the Department of Homeland Security.The United States District Court for the Northern District of California dismissed the plaintiffs' complaint, primarily based on the immunity provided under § 230 of the Communications Decency Act of 1996. The court found that Twitter was immune from liability for most of the claims, including those under the Trafficking Victims Protection Reauthorization Act (TVPRA) and California product-defect claims, as these claims treated Twitter as a publisher of third-party content.The United States Court of Appeals for the Ninth Circuit reviewed the case. The court held that Twitter is immune from liability under § 230 for the TVPRA claim and the California product-defect claim related to the failure to remove posts and the creation of search features that amplify child-pornography posts. However, the court found that the plaintiffs' claims for negligence per se and their product-liability theory based on defective reporting-infrastructure design are not barred by § 230 immunity, as these claims do not arise from Twitter's role as a publisher. Consequently, the court affirmed the dismissal of the TVPRA and certain product-defect claims, reversed the dismissal of the negligence per se and defective reporting-infrastructure design claims, and remanded the case for further proceedings. View "DOE 1 V. TWITTER, INC." on Justia Law

Paige Thompson committed a significant data breach, hacking into Amazon Web Services (AWS) customers' accounts, stealing data from at least 30 entities, and causing tens of millions of dollars in damage. She also used the stolen credentials to mine cryptocurrency, further increasing the financial impact on the victims. Thompson was arrested after she revealed her activities to a cybersecurity professional, leading to an FBI investigation.The United States District Court for the Western District of Washington calculated Thompson's sentencing range under the Federal Sentencing Guidelines to be 168 to 210 months of imprisonment. However, the court granted a substantial downward variance, sentencing her to time served (approximately 100 days) and five years of probation. The court emphasized Thompson's personal history, including her transgender identity, autism, and past trauma, as significant factors in its decision.The United States Court of Appeals for the Ninth Circuit reviewed the case and found that the district court overemphasized Thompson's personal story and failed to properly weigh several of the 18 U.S.C. § 3553(a) factors. The appellate court held that the district court's findings regarding Thompson's lack of malicious intent, her remorse, and the seriousness of her actions were clearly erroneous and not supported by the record. The Ninth Circuit also noted that the district court did not adequately consider the need for general and specific deterrence or the risk of unwarranted sentencing disparities.The Ninth Circuit vacated Thompson's sentence and remanded the case for resentencing, instructing the district court to properly weigh all relevant factors and provide a more substantial justification for any variance from the Guidelines. View "USA V. THOMPSON" on Justia Law

Joseph Sullivan, the former Chief Security Officer for Uber Technologies, was convicted of obstruction of justice and misprision of a felony. The case arose from Sullivan's efforts to cover up a significant data breach at Uber while the company was under investigation by the Federal Trade Commission (FTC) for its data security practices. The breach involved hackers accessing and downloading sensitive information from Uber's servers. Sullivan and his team tracked down the hackers and had them sign a non-disclosure agreement (NDA) in exchange for a payment, recharacterizing the hack as part of Uber's Bug Bounty Program.The United States District Court for the Northern District of California presided over the trial, where a jury found Sullivan guilty. Sullivan appealed, challenging the jury instructions, the sufficiency of the evidence, and an evidentiary ruling. He argued that the district court erred in rejecting his proposed jury instructions regarding the "nexus" requirement for the obstruction charge and the "duty to disclose" instruction. He also contended that the evidence was insufficient to support his misprision conviction and that the court improperly admitted a guilty plea agreement signed by one of the hackers.The United States Court of Appeals for the Ninth Circuit reviewed the case and affirmed the district court's decisions. The court held that Ninth Circuit precedent foreclosed Sullivan's argument regarding the "nexus" instruction and that the district court did not err in rejecting it. The court also found that the omission of the "duty to disclose" instruction was proper, as the theories of liability under Section 1505 and Section 2(b) were conjunctive. The court concluded that the evidence was sufficient to support Sullivan's misprision conviction and that the district court did not abuse its discretion in admitting the hacker's guilty plea agreement. The Ninth Circuit affirmed Sullivan's conviction. View "USA V. SULLIVAN" on Justia Law