In Carlsen v GameStop, Inc. the Eighth Circuit held that a plaintiff had standing to bring privacy claims that his personal information, specifically web browsing data, was provided to a third party in violation of an allegedly express agreement not to do so (namely, the defendant’s privacy policy). The district court had previously dismissed the complaint on the grounds of lack of standing because the plaintiff – a paying customer of Gamestop’s online video game magazine – failed to allege that he paid any specific amount for the privacy policy or that he bargained for any additional privacy beyond what non-paying users obtained. However, even though the district court did not consider the defendant’s 12(b)(6) motion to dismiss the complaint on grounds of failure to state a claim, the appellate court nonetheless affirmed the dismissal on that basis.

The panel majority rejected the district court’s focus on the plaintiff’s theory that he suffered monetary damages by overpaying for the Gamestop subscription because he did not receive the privacy protections he was promised, or that he “would-not-have-shopped” at Gamestop if he had known his data would be shared. The appellate court believed this analysis of damages conflated the constitutional requirement to plead injury with analysis of the merits of plaintiff’s cause of action. Instead, the Eighth Circuit found that the complaint “provided sufficient facts alleging that he is a party to a binding contract – the terms of service, which include the … privacy policy.” Moreover, the Court found that the plaintiff’s allegation that the policy was violated by systematic disclosure of personal information about the plaintiff to a third party was both concrete and particularized. The actual injury, according to the majority, was the alleged “devaluation of his … subscription in an amount equal to the difference between the value of the subscription that he paid for and the value of the subscription that he received, i.e., a subscription with compromised privacy protection.”

This expansive view of “benefit of the bargain” injury stands in contrast to the many courts that have rejected similar theories based on alleged diminished value of the services received. But, significantly, the Gamestop court did not end its analysis there. “When a district court erroneously dismisses under Rule 12(b)(1) a claim that is ‘clearly meritless,’ an appellate court may affirm under Rule 12(b)(6).” The Court noted that “[a]lthough we have discretion to remand for the district court to rule on the Rule 12(b)(6) motion in the first instance, we are not bound to remand, and we decline to do so here.”

The panel dismissed on 12(b)(6) grounds because it found that the contract in question – namely, the defendant’s privacy policy – did not promise to protect the allegedly disclosed personal information, namely web browsing data. Rather, the policy promised not to share certain other specifically enumerated personal information, including name, address, zip code, telephone number, email address, and credit card or checking account information.

The Court wrote:

The PII set forth in the privacy policy does not encompass a user’s Facebook ID and browsing history for two reasons: (1) not only do a user’s Facebook ID and browsing history fail to appear on the list of what PII might include, but (2) those data are neither specifically solicited by Game Informer nor voluntarily submitted in response to such solicitation. Additionally, as GameStop notes, the policy contains no specific promise to prevent Facebook’s social-media plug-in from transferring a Facebook user’s Facebook ID and browsing activity to Facebook. The policy also states that it “does not extend to Websites that may be maintained by . . . other companies or organizations to which we link, or to Websites that contain links to the Site and/or the Service.” Because of this caveat, the policy further urges users to read the respective privacy policies of these other websites. Accordingly, the protection Carlsen argues GameStop failed to provide was not among the protections for which he bargained by agreeing to the terms of service, and GameStop thus could not have breached its contract with Carlsen.

Accordingly, the majority found as a matter of law that the defendant had not actually made the promise it was accused of violating. This disposed of the breach of contract claim and also the Minnesota Consumer Fraud Act claim. In a discussion that was arguably at odds with its standing analysis, the Court dismissed the unjust enrichment claim on the grounds that the plaintiff “does not allege that any specific portion of his subscriber fee went toward data protection or that GameStop agreed to provide additional protection to paid subscribers that it did not also provide to non-paid subscribers.” Accordingly, the Court found that plaintiff “has alleged neither a benefit conferred in exchange for protection of his PII, nor has he shown how GameStop’s retention of his subscription fee would be inequitable.”

Judge Arlen Beam concurred in the result but dissented from the Court’s holding on standing. He concluded that the plaintiff had not pled concrete injury as required by Spokeo. Notably, Judge Beam applied the pleading standards of Twombly and Iqbal to defendant’s 12(b)(1) motion to dismiss for lack of standing, finding the plaintiff’s allegations of injury to be “the antithesis of virtually every one of the [Supreme Court’s standing] requirements.” He wrote that the complaint’s “panoply of imprecise contractual emanations purporting to illustrate possible economic harm … is not enough.”

A lesson of this decision is that defendants prevailing on 12(b)(1) standing grounds should cross-appeal to ensure the possibility the court of appeals may consider the merits under Rule 12(b)(6) – even if the district court had not done so.

Another lesson is that the pleading standards of Twombly and Iqbal should be argued vigorously in motions to dismiss for lack of subject matter jurisdiction (i.e., standing) as well as in motions to dismiss for failure to state plausible claim for relief.

The majority opinion also demonstrates the importance of limiting and carefully specifying the definitions and promises set forth in online privacy policies.

Finally, the decision also teaches that if a complaint is “clearly meritless,” courts can find a way to dismiss it one way or another.