Bulk Emailers (Mostly) Lose Three 47 USC 230(c)(2) Rulings–Holomaxx v. Microsoft/Yahoo & Smith v. TRUSTe
By Eric Goldman
I’ve been so behind that it’s taken me until now to blog these cases from last month. All three opinions involve the same basic fact pattern: a bulk emailer gets blocked by an email service provider (relying in part on third party filtering/blocking services) and sues to undo the block. These claims are largely preempted by 47 USC 230(c)(2), and the courts mostly get to the right place with the immunity (although not without small points of drama). The aggressive plaintiffs also assert claims not covered by 47 USC 230(c)(2), but these mostly don’t go anywhere either. The lesson is pretty clear: if an email service provider blocks your email, the courts aren’t going to help you out.
Holomaxx Technologies v. Microsoft Corp., 2011 WL 865278 (N.D. Cal. March 11, 2011), and
Holomaxx Technologies v. Yahoo, Inc., CV-10-4926-JF (N.D. Cal. March 11, 2011). Venkat’s excellent prior blog post on the complaints. These rulings are substantially identical, so I’ll discuss them together except where they diverge.
Holomaxx is a bulk email sender upset because Yahoo and Microsoft are blocking its emails based both on IP address blocks and reputation scores (including those provided by third parties). We’ve heard this refrain before in many cases over the years, and the law is pretty clear about this. Email service providers can’t be obligated to carry emails they don’t want to carry. There are a number of legal doctrines that help reach this conclusion, but the most salient one is 47 USC 230(c)(2), the immunity for filtering decisions.
In response to Holomaxx’s lawsuit over the block, Microsoft and Yahoo interposed the 230(c)(2) defense on a 12(b)(6) motion to dismiss. Holomaxx objected that 230(c)(2) is an affirmative defense and not appropriate response for a 12(b)(6) dismissal motion. This is the issue that vexed the Ninth Circuit in the Barnes v. Yahoo case until they fixed the opinion. In this case, Judge Fogel properly concludes that 230(c)(2) can support a 12(b)(6) motion to dismiss. (He reached the same conclusion in Goddard v. Google).
Holomaxx then argued that 230(c)(2) does not prevent blocking of legitimate email because such a block doesn’t fit within 230(c)(2)’s “otherwise objectionable” language. The judge says:
No court has articulated specific, objective criteria to be used in assessing whether a provider’s subjective determination of what is “objectionable” is protected by § 230(c)(2).
And Judge Fogel isn’t going to be the first. Instead, he sidesteps the issue, holding that the service providers could deem the emails “harassing” because, even if Holomaxx had a 0.1% error rate, as it claimed in the Yahoo case, that still netted 2M bad emails/year. Therefore, the filtering decisions fit within the other statutory language in 230(c)(2). This is a cute intellectual move which potentially expands the scope of 230(c)(2) by reading “harassing” broadly.
Holomaxx also attacks the “good faith” requirement of 230(c)(2), but does so in a generalized way. The judge rejects the argument, saying (in the Yahoo case):
Holomaxx alleges no facts in support of its conclusory claim that Yahoo!’s filtering program is faulty, nor does it identify an objective industry standard that Yahoo! fails to meet. While it suggests that Yahoo! is “using cheap and ineffective technologies to avoid the expense of appropriately tracking and eliminating only spam email,” it offers no factual support for these allegations. Nor does Holomaxx cite any legal authority for its claim that Yahoo! has a duty to discuss in detail the particular reasons for blocking Holomaxx’s communications or to provide a remedy for such blocking. Indeed, imposing such a duty would be inconsistent with the intent of Congress to “remove disincentives for the development and utilization of blocking and filtering technologies.”
The Microsoft opinion’s text is similar. Holomaxx gets another chance to marshal better allegations, but I’m guessing they won’t be able to do so.
The court rejects the ECPA claim (which 230(c)(2) doesn’t immunize) because Holomaxx didn’t explain clearly enough how the email service provider “intercepted,” “used” or “disclosed” Holomaxx’s email or how the ESP improperly accessed stored communications. The 17200 claim (which I think should be preempted by 230(c)(2), although that issue isn’t discussed) also fails for lack of Holomaxx’s specificity. A Microsoft-only defamation claim doesn’t survive either:
Holomaxx alleges, on information and belief, that Microsoft “informed Dragon Networks in writing” that it had blocked all IP addresses originating from Dragon Networks because “certain of Holomaxx’s .78 addresses had been rejected ‘for policy reasons,’ and were blocked manually ‘or for spamming.'” Holomaxx does not explain how the alleged statement was defamatory or produce a copy of the alleged defamatory correspondence between Microsoft and Dragon Networks. Nor does it explain how the alleged communication amounts to “a statement of fact that is false.”
As a result, the judge dismisses the lawsuit but with leave to amend.
Smith v. Trusted Universal Standards in Electronic Transactions, Inc. (d/b/a TRUSTe, Inc.), 2011 U.S. Dist. LEXIS 26757 (D. N.J. March 15, 2011).
Like Holomaxx, Smith sends a lot of email through Comcast. Comcast blocked his outgoing email twice. The first time, Comcast pointed to Microsoft’s Frontbridge/Exchange Hosted Services (EHS) quarantine system. The second time, Comcast pointed to Cisco’s IronPort/Senderbase blocklist. Smith sued all three entities (and others). Last year, the court rejected a 12(b)(6) motion to dismiss based on 47 USC 230(c)(2).
Ten months later, after presumably lots of wasted effort, the court converts Cisco’s and Microsoft’s 12(b)(6) motions into a summary judgment motion and grants the dismissal on 230(c)(2) grounds. I’m sure the defendants appreciate the dismissal, but I’m sure they would have been even more appreciative if the court had reached the result on the last go-around. The court still can’t let the case go with respect to Comcast, however.
Cisco/SenderBase gets the 230(c)(2) defense as a blocklist provider. This may sound easy, but the statutory drafting makes the court’s analysis more arduous than it ought to be.
Cisco’s senderbase.com website constitutes an ICS. This makes Cisco a “user” of an ICS because it uses its website to publish the blocklist. It is also a provider of an ICS because it runs the website. This is the issue that tripped up the court in the last ruling, and although it got to the right result, I don’t think the court has fully wrapped its head around the statutory language. I read the court’s discussion at least 6 times, and I couldn’t make it make sense. Just know that a blocklist provider probably is both a provider and user of an ICS, so this element is met.
The blocklist easily satisfies the requirements of 230(c)(2)(B). As the court notes (citing Zango v. Kaspersky), whether material is “objectionable” is measured subjectively. Thus, the court dismisses Cisco, noting:
The Court notes that Plaintiff’s breach of contract and defamation claims are dismissed because they specifically relate to Cisco’s SenderBase service. Plaintiff defamation claim is based upon the fact that Cisco publishes IP scores. Plaintiff’s breach of contract claim is based on the fact that Cisco refused to provide Plaintiff with the information that it used to calculate the reputation score for the IP address assigned to Plaintiff by Comcast.
Microsoft’s EHS quarantine operates in the cloud by routing all email through its servers, which screen out emails based on its blocklist (as modified by customers’ parameters). This should be even easier to qualify as a provider/user of an ICS. The court’s discussion on this point doesn’t make any sense either, but it reached the right result. As with Cisco, the court says the blocklist qualifies for 230(c)(2)(B) and the contract breach claim fails for the same reason.
Comcast doesn’t get so lucky. The court once again finds that Comcast could have acted in “bad faith” which could disqualify it from 230(c)(2) coverage:
the Court finds that a reasonable jury could conclude that Comcast acted in bad faith when it failed to respond to Plaintiff’s repeated requests for an explanation why it continually blocked Plaintiff’s outgoing email…the Court is not convinced that an internet service provider acts in good faith when it simply ignores a subscriber’s request for information concerning an allegedly improper email blockage…there is no reason why Comcast could not articulate its immunity (or provide another rationale for the blockage) when asked to do so by a paying customer.
Whoa. Hold on a sec. The court is saying that online providers have to provide explanations to their customers for their back-end choices. First, that’s not in the statute. Second, Judge Fogel expressly rejected this argument in his Holomaxx rulings. Third, the court’s position is ridiculous. Being legally obligated to explain business decisions to affected customers would add an extra layer of expense/hassle to everyday business decisions, and the explanations will just become additional grist for the plaintiff’s mill (see, e.g., Barnes v. Yahoo and the resulting incentives to tell customers less, not more). I’m 99%+ confident that an appellate court would reverse this judge on this point. I think he went off the rails. As a result, I don’t plan to advise clients that they have to provide explanations for their blocking decisions, and I don’t recommend you advise otherwise.
Although Comcast doesn’t get the 230(c)(2) immunity, the court still ends up granting it summary judgment on all of the claims. There’s some interesting discussion there too.
The court rejects Smith’s ECPA claims and the substantively identical state claims. Cisco doesn’t actually intercept emails, and Microsoft quarantines emails with its customers’ consent.
Smith’s contract breach and promissory estoppel claims against Comcast fail because Comcast didn’t make any promises it failed to keep and because Smith was using a personal account for unpermitted commercial activities. (To me, this is facially inconsistent with any argument that Comcast had bad faith for 230(c)(2) purposes, but the court ignores that implicit contradiction).
Smith’s NJ Consumer Fraud Act claim against Comcast also fails because he can’t show fraud or ascertainable loss (because he only alleged that he lost time). The court dismisses a couple other claims, too.