On March 1, 2021, Magistrate Judge Laurel Beeler of the Northern District of California dismissed a variety of claims brought against the genealogy website Ancestry.com based on the website’s use of individuals’ personal information obtained from school yearbooks. In so doing, Judge Beeler added to the growing body of case law defining what constitutes an injury sufficient to support Article III standing in the context of data privacy class actions and highlighted the potential utility of Section 230 of the Communications Decency Act (“Section 230”) as a tool defendants can use to defeat privacy-related putative class actions.

• Ancestry is a subscription service that offers its subscribers access to large databases of various types of records that are useful for conducting genealogical research. One of those databases contains nearly 730 million individual records Ancestry compiled from more than 450,000 yearbooks. Each of the records in Ancestry’s yearbook database contains an individual’s photograph, name, and various other pieces of personal information. Ancestry also uses the information in the yearbook records to create various advertisements highlighting the yearbook database’s ability to help subscribers “uniquely identify specific individuals.”
• Two California residents who are not Ancestry subscribers—but who were described in the yearbook records without their consent—alleged Ancestry’s use of their data injured them by (1) depriving them of the ability to earn money from the use of their likenesses and personal information and (2) impeding their ability to control how their likenesses were used more generally. Accordingly, the residents sued Ancestry on behalf of themselves and a putative class of similarly situated residents of California. They asserted claims for unjust enrichment, intrusion upon seclusion, right of publicity, and violations of California’s Unfair Competition Law. Ancestry moved to dismiss, arguing that the plaintiffs lacked standing to bring their claims and that it was immune from the suit under Section 230. The court agreed with both of these arguments.
• On the standing issue, the court found that the plaintiffs’ allegations of injury were insufficient to support Article III standing because the profiles that Ancestry compiled were based on data the plaintiffs had already shared with their classmates—meaning that the data was not “private.” (While Ancestry does not disclose how it creates its Yearbook database, it encourages users to donate old yearbooks.) The court concluded that “Ancestry’s using the public profiles to solicit paying subscribers—standing alone—does not establish injury.”
• The court next distinguished the case from others involving rights of publicity claims, noting that nothing about Ancestry’s use of the plaintiffs’ data implied that they personally endorsed Ancestry. Similarly, the court noted that plaintiffs did nothing to show that they had a commercial interest in their likenesses that precluded Ancestry’s use without compensation or permission.
• Because the content that the plaintiffs were challenging was based on publicly available yearbooks not created by Ancestry in the first instance, the court also found that Section 230 prohibited the plaintiffs’ claims. The plaintiffs argued that Ancestry did more than merely publish the yearbook content at issue, because it extracted data from yearbooks to create the records in its yearbook database and created ads using information in the yearbooks. But the court rejected this argument, construing Ancestry’s manipulation of the yearbook content as “just add[ing] functionality” to that content. It described Ancestry’s republishing of the yearbook content in different formats as akin to “a publisher’s traditional editorial functions.” It accordingly held that Ancestry was entitled to Section 230 immunity from suit.
• The court’s standing ruling provides further support for the general principle that a plaintiff must do more than merely allege that a company profited off the use of his or her personal information to prevail in a putative privacy class action. As the court commented, “[m]ore is needed—beyond Ancestry’s use of the data to solicit subscribers—such as an inference that the profiled persons personally endorsed Ancestry’s product (or an equivalent interest).” And the court’s ruling on Ancestry’s Communications Decency Act defense is a helpful reminder that Section 230 can provide a defendant in privacy class actions with immunity from suit even where that defendant repackages content created by third parties.
• The case is Callahan v. Ancestry.com Inc., No. 20-cv-08437-LB (N.D. Cal.), and you can read Judge Beeler’s decision here.