Pandora defeats privacy suit over Facebook integration

When Pandora was sued for alleged privacy missteps following Facebook integration, it was headline news, with one report saying the Internet radio company had stumbled "into the minefield of privacy lawsuits that are blowing up all over the tech industry." Even the Federal Trade Commission was dragged in.

But that minefield was a dud: A federal court has now tossed out the lawsuit, ruling that no "actual injury" was caused by the April 2010 partnership between Facebook and Pandora that allowed users to tie their accounts together.

The suit claimed violations of an obscure pre-Internet era Michigan law, which says a company "renting or lending" sound recordings may not disclose details about customers' transactions without their written permission. Because it specifies $5,000 penalty per violation, the possible damages could total in the tens of billions -- far more than Pandora's actual $1.8 billion market capitalization.

U.S. District Judge Saundra Armstrong in Northern California didn't buy it. The 1988 state privacy law does not permit a class action "by a person who has not suffered actual loss" or harm, she wrote in an opinion on Friday. "Had the Michigan legislature intended to provide such a remedy, it plainly could have done so."

Another hurdle, Armstrong said, was that Pandora wasn't actually "renting or lending" songs. She said: "Pandora argues that it merely streamed music to plaintiff's computer, and therefore, could not have violated (state law) because it never rented, lent, or sold sound recordings to him. The court agrees."

The multibillion dollar lawsuit was filed by Edelson McGuire, a plaintiff's law firm specializing in class actions, with offices in Chicago, Denver, and California. Edelson McGuire doesn't happen to have offices in Michigan, but it did manage to locate a Michigan resident, Peter Deacon, who was willing to lend his name to a California lawsuit alleging that "Pandora has willfully violated its users' privacy rights" and made a "reckless decision to disclose this information."

The supposedly "reckless" move happened when Facebook allowed Pandora integration two years ago. Here's how a CNET article described the process at the time:

Today, if you go to Pandora and select "Friends' Music," it will ask if you want to connect your Pandora and Facebook profiles. Enter your Facebook username and password, and suddenly, all your Facebook friends will be imported into the Pandora app. You can see what they've been listening to on Pandora recently, and click on embedded links to import their stations into your own Pandora player.

What the class-action bar had hoped to rely on was Michigan's antediluvian privacy law called the Video Rental Privacy Act (VRPA), which was intended to target misbehaving VHS, CD, and audiocassette rental stores. It says that even voluntary informed consent is insufficient.

In a bizarre twist that shows the Michigan legislature in 1988 definitely did not envision online streaming, VRPA (445.1712) says that any "record or information" about the "purchase" or "lease" of music can be disclosed only with the "written permission of the customer." (445.1713)

The 1988 law, of course, was never intended to apply to Pandora, though if the wording had been a little different, it likely would have changed the outcome of this case. VRPA was enacted at the same time as another poorly worded law, the federal Video Privacy Protection Act, which has ensnared Netflix and is the subject of a current legislative effort to bring it into the 21st century.

That didn't stop Edelson McGuire from filing the lawsuit, which asked for attorney's fees, an injunction, and "statutory damages of $5,000 per class and subclass member" -- a definition that sweeps in "all Michigan residents" who used Pandora's services.

In its September 2011 complaint, Edelson McGuire didn't offer an estimate of how many people that includes, or the total that Pandora would have to pay. But about half of Americans use Pandora, and Michigan has about 10 million residents, so a reasonable upper bound would be five million class members, or a whopping total of $25 billion dollars.

To put that figure in perspective, it's larger than the combined economic annual output of the nations of Monaco, Cambodia, and the Bahamas.

In an August 2010 blog post, the Center for Democracy and Technology said that it wasn't delighted with Pandora's "confusing" initial Facebook integration. But, the group said, the revised "privacy interface is an excellent way to inform users about how their data may be shared and to give them a real choice about whether to share or not."

Judge Armstrong did say that Edelson McGuire could refile its lawsuit if it wished, but she indicated it would be a losing proposition: "Though it is questionable whether plaintiff will be able to allege the requisite facts to establish a claim under the VRPA... the court, out of an abundance of caution, will permit him an opportunity to attempt to do so."

Armstrong also dismissed Edelson McGuire's separate allegations that Pandora violated the Michigan Consumer Protection Act, saying the fact that nobody "suffered actual damages" means the case can't continue.

Pandora did not respond to a request for comment from CNET this afternoon. Jay Edelson, an attorney at Edelson McGuire, said, however, he hasn't given up: "We're considering the court's order and will be making a decision shortly on whether to amend or appeal."

Last updated at 5:00 p.m. PT