Ninth Circuit Affirms State Privacy Law Claims Not Preempted by COPPA
On July 13, 2023, a three-judge Ninth Circuit panel denied Google’s challenge of its earlier decision in Jones v. Google,[1] which held that state privacy law claims in a putative class action are not preempted by the federal Children’s Online Privacy Protection Act (COPPA)[2]. The December decision reversed a lower court’s dismissal of the action on the grounds that COPPA preempted identical state law claims. Google petitioned the Ninth Circuit to have the case reheard by the full court, and the panel asked the Federal Trade Commission (FTC) to weigh in on the preemption question. In May, the FTC submitted an amicus brief in support of the Ninth Circuit’s finding that COPPA does not preclude identical state law claims. The panel’s decision affirms its December opinion and amends it to note the FTC’s support.
The case was brought by a putative class of children (represented by their guardians), accusing YouTube, its parent Google, and others of using persistent identifiers – defined by the FTC as data “that can be used to recognize a user over time and across different Web sites or online services” – to track their behavior online and collect their personal data without consent. The plaintiffs brought claims under the constitutional, statutory, and common laws of several states and, in addition to Google and YouTube, seek to hold liable several companies that allegedly uploaded child-directed entertaining content to YouTube. The plaintiffs also alleged that the challenged conduct violates COPPA, though they did not bring a claim under the Act, which states that only the FTC and state attorneys general acting in a parens patriae capacity are authorized to enforce the law.
Under COPPA, “No State or local government may impose any liability for commercial activities or actions by operators in interstate or foreign commerce in connection with an activity or action described in this chapter that is inconsistent with the treatment of those activities or actions under this section” (emphasis added). In July 2021, a district court dismissed plaintiffs’ third amended complaint on preemption grounds, finding that plaintiffs “core allegations” were based on the same alleged conduct proscribed by COPPA. Because COPPA does not create a private cause of action and the state laws do, the district court held that the state laws are “inconsistent” with COPPA’s “treatment” of the conduct and are therefore preempted. However, the Ninth Circuit panel disagreed, reversing the lower court’s decision and holding that “COPPA’s preemption clause does not bar state-law causes of action that are parallel to, or proscribe the same conduct forbidden by COPPA.” In the panel’s view, the “inconsistent treatment” described in COPPA refers to “contradictory state law requirements, or to requirements that stand as obstacles to federal objectives.” The panel was not persuaded that Congress’s insertion of the word “treatment” in the preemption clause “evidences clear congressional intent to create an exclusive remedial scheme for enforcement of COPPA requirements.”
In seeking a review of the December 2022 opinion, Google argued that the Ninth Circuit’s reading of COPPA’s preemption provision would create a circuit split with “profound consequences,” as a Third Circuit 2016 decision allowed certain state law claims to proceed only because they addressed different deceptive conduct than conduct targeted by COPPA. In the Nickelodeon Consumer Privacy Litigation,[3] the Third Circuit found that state law intrusion claims were not preempted because they were not premised on allegations that Viacom and Google collected or disclosed children’s personal information (actions covered by COPPA), but on allegations that defendants created an expectation of privacy and collected personal information under false pretenses (actions the court determined were not covered by COPPA). The Ninth Circuit panel did not address Google’s circuit split argument in its July 13, 2023, opinion but summarily noted that the panel voted to deny the petition for rehearing, and no judge on the full court requested a vote on whether to rehear the matter.
The case is now back in the district court, which must determine if alternate grounds for dismissal apply. Absent dismissal on other grounds or a further appeal to the Supreme Court, the ruling means that if plaintiffs prevail in the lower court, they could potentially recover remedies under state law for the same conduct deemed to violate COPPA. Beyond the confines of this case, the Ninth Circuit’s narrow interpretation of COPPA’s preemption, bolstered by the FTC’s express support, could lead to an increase in class action litigation under state laws based on alleged COPPA violations. At the same time, as states like California and others develop their own privacy laws that adopt limits and requirements to advance children’s privacy, litigation exposure could also increase even where such laws do not expressly authorize a private right of action. Companies faced with such lawsuits, especially in courts in the Ninth Circuit, should assess whether state laws create different substantive standards or impose contradictory requirements compared to those established by COPPA, and evaluate the implications of the expanding universe of state privacy laws. It remains to be seen if other circuit courts will apply the same narrow reading of COPPA’s preemption clause as the Ninth Circuit or will create a more explicit circuit split than the Nickelodeon decision, which may attract the Supreme Court’s attention. Equally as important, the decision is relevant to ongoing discussions about the scope of preemption under proposed federal privacy law.
[1] Jones v. Google, No. 21-16281, 56 F.4th 735 (9th Cir. Dec. 28, 2022).
[2] 15 U.S.C. §§ 6501–6506.
[3] Nickelodeon Consumer Privacy Litigation, No. 15-1441, 827 F.3d 262 (3d Cir. June 27, 2016).