Counsel

Re: Dkt. No. 429

Plaintiffs and defendant Google LLC (“Google™) ask the Court to resolve their dispute concerning plaintiffs’ demand that Google produce data relating to the named plaintiffs that is contained in 11 of the 69 data fields that Google maintains regarding responses RTB participants have made to bid requests. Dkt. No. 429. The Court deems this matter suitable for resolution without oral argument. Civil L.R. 7-1(b).

For the reasons explained below, the Court orders Google to produce eight of the disputed data fields.

I. BACKGROUND

Plaintiffs ask Google to produce data from the following fields for each of the named plaintiffs:

1. ad.attribute
2. ad.category
3. ad.restricted_category
4. ad.native_ad.click_link_url
5. ad.advertiser_name
6. ad.sdk_rendered_ad.declared_ad.click_through_url
7. ad.skadn.itunesitem
8. ad.skadn.sourceapp
9. ad.advertised_app_id
10. ad.slot.third_party buyer_token
11. no_bid_reason

Dkt. No. 429. Plaintiffs identify no document requests or interrogatories that call for production of these data fields. Instead, they say that the information they seek is within the scope of the Court’s August 26, 2022 order (Dkt. No. 314). That order concerns plaintiffs” demand for information responsive to their RFP Nos. 13,41, and 42.[1] See Dkt. No. 314 at 1, 2 n.2; Dkt. No. 269-1. Plaintiffs rely on the portions of the Court’s prior order that concern “links” between Google account holder information and the information Google discloses through RTB and “the use of cookie-matching.” Dkt. No. 314 at 2. Specifically, plaintiffs rely on the following portions of the prior order:

The Court expects Google to produce documents sufficient to show, for each named plaintiff, what information specific to that plaintiff was shared with an RTB participant and the details of such sharing. If Google discloses information that allows an RTB participant to identify an account holder based on information the participant may have about that account holder, Google must produce records showing the disclosure of that information as well. Otherwise, plaintiffs have not shown they are entitled to discovery of all information Google maintains about an account holder solely based on Google’s internal linking of information with an account holder.

 ***

Plaintiffs argue that “Google provides RTB participants, via cookiematching, with a key to identify exactly who certain account holders are, and cookie-matching can enable participants to link a user’s personal information obtained from the RTB auction process with its own data about that user.” . .. Plaintiffs demand that Google produce “data revealing cookie-matching about the [named plaintiffs].” ... [Clookie-matching appears to be a vehicle whereby account holder-specific information may be shared with RTB participants. It is not clear from the parties’ joint submission what records Google has about instances of cookie-matching via RTB with respect to the named plaintiffs[.] . . . In any event, if there is such data, the Court is persuaded it is relevant to plaintiffs’ claims and should be produced.

Id. at 4-5, 8 (citations omitted).

Google objects to producing the data in these 11 bid response fields because such production would exceed the scope of production in the Court’s prior order, and because no discovery requests call for the production of information contained in bid responses, but only in bid requests. Id. at 4. In addition, Google argues that because plaintiffs’ demand for bid responses encompasses both winning and non-winning bids, this demand exceeds the scope of relevant discovery. Finally, Google says that the Court’s prior order requires it to produce documents sufficient to show the information Google shares with RTB participants, and Google has already completed that production. Jd. at 5.

II. DISCUSSION

As an initial matter, the Court is not persuaded by Google’s over-arching argument that bid response data is categorically outside the scope of the Court’s August 26, 2022 order. It is certainly possible that information contained in a bid response data field may reveal, for example, whether an RTB participant has information that allows it to identify an account holder based on information the participant receives from Google. While Google is correct that the August 26, 2022 order did not specifically require Google to produce bid responses, one of the document requests at issue in the dispute that order resolves does ask for “[a]ll bid responses associated with each [a]ccount [h]older.” See Dkt. No. 269-1 at 7 (RFP No. 41).

For these reasons, the Court will address the parties” substantive arguments with respect to each of the disputed bid response fields, as well as the issue of whether Google should be required to produce responses for both winning and non-winning bids.

A. ad.attribute field

The ad.attribute field contains information showing the ad targeting category an RTB participant selected for a proposed ad: “Remarketing” (where the user previously interacted with the bidder); “UserInterestTargeting” (where the user is on the bidder’s list of users with a common interest); and “Tagging” (where the bidder’s ad contains a tracking pixel that can be used for remarketing). Dkt. No. 429 at 2, 5. Plaintiffs argue that this selection “establishes” that the information Google shares with RTB participants is “personal information.” Id. at 2. Google disputes this characterization and disputes plaintiffs’ contention that any inference about Google’s disclosure of personal information can be drawn from a data field populated, not by Google, but by an RTB participant. Id. at 5. Google states, without contradiction, that it has already produced data showing the user-specific information that i¢ shares in bid-requests. Id.

While the Court agrees that an RTB participant’s selection of one of these categories for the ad.attribute field does not necessarily establish that Google shares users” personal information or that an RTB participant has identified a particular user as a result of information shared by Google, the content of this data field may be relevant to the question of whether the information Google provides allows an RTB participant to identify a user based on information the participant already has about that user. At the very least there is a dispute between the parties on this point.

Google is correct that the Court’s August 26, 2022 order only required Google to disclose data sufficient to show the information Google disclosed to RTB participants. The information plaintiffs now demand may show only how that information is used by an RTB participant, and it is therefore not within the scope of the Court’s prior order. However, the Court agrees with plaintiffs that for purposes of discovery regarding the named plaintiffs, the ad.attribute field may contain relevant information. Google has not shown that production of this data field is disproportionate to the needs of the case.

B. ad.category and ad.restricted.category fields

These fields contain information showing the “ad sensitive category” or “ad restricted category” an RTB participant selected for a proposed ad. Dkt. No. 429 at 2-3, 5. Plaintiffs say that the contents of these fields are “evidence of whether the plaintiffs were targeted with sensitive ads because of personal information Google sold and shared through RTB.” Id. at 2. Google argues that the Court has “previously rejected Plaintiffs” efforts to gain discovery about information Google considers sensitive.” Id. at 5.

Google is correct that the Court denied plaintiffs’ request for similar information, but that was primarily because plaintiffs failed to support their earlier request. Specifically, the Court’s prior order stated:

Plaintiffs argue that their claims regarding Google’s use of “sensitive” information are “not limited to the sharing or sale of information.” They say that “[i]f Google internally deems certain kinds of account holder information ‘sensitive’ that is used for advertising, it bears directly on [p]laintiffs’ claims.” Plaintiffs do not identify the claims to which they refer or explain how the documents they seek are relevant to their claims. They do not even say what documents they want. Claiming that relevance is “undisputed,” plaintiffs cite a cobbled-together quote from Google’s statements during a hearing on a prior dispute that, in the Court’s view, distorts the statements’ original meaning. Google argues that plaintiffs are not entitled to discovery about any and all use Google may make of “sensitive” information, and contends that the Court has already resolved this issue in deciding the parties’ dispute about the scope of plaintiffs’ Rule 30(b)(6) deposition notice.

The Court cannot discern from the parties’ joint submission what records plaintiffs seek with respect to the named plaintiffs or why plaintiffs believe the records are relevant to a claim or defense. Moreover, the word “sensitive” does not appear in any of the RFPs at issue. Because plaintiffs have not shown that the discovery they seek is relevant to a claim or defense and proportional to the needs of the case, the Court denies this aspect of plaintiffs’ request for relief.

Dkt. No. 314 at 7-8 (citations omitted).

In the present joint submission, plaintiffs at least try to explain why they believe the information in these specific fields is relevant. While the Court disagrees that an RTB participant’s selection of a “sensitive” or “restricted” category label to describe its ad necessarily shows that Google users were targeted with such ads because Google shared their personal information with RTB participants, the content of these data fields may be relevant to that disputed question. Google has not shown that production of these data fields is disproportionate to the needs of the case.

C. ad.native_ad.click_link_url, ad.advertiser_name, ad.sdk_rendered_ad.declared_ad.click through_url fields

According to plaintiffs, these fields contain information that identifies the advertisers that respond to a bid request and the publishers of the page on which the ad is displayed. Dkt. No. 429 at 3. Plaintiffs say that this is contextual information that will inform their arguments about whether advertisers received users’ personal information from Google that allowed the advertisers to “target[] [users] with sensitive ads.” Id. Google argues that it has already produced the landing page domains of ads actually displayed to users, as well as fields identifying the advertisers who placed winning bids, so the additional information plaintiffs seek is superfluous. 7d. at 6. In addition, Google notes that the Court’s August 26, 2022, did not require Google to produce this information.

Google is correct that the Court’s prior order did not require Google to produce these data fields, nor did plaintiffs ever clearly demand this production; plaintiffs previously relied on a kitchen-sink approach, demanding all bid response information. Nevertheless, the Court is persuaded that the content of these data fields may be relevant to the question of whether advertisers received users’ personal information from Google that allowed the advertisers to target particular users for placement of ads on “sensitive” websites. Google has not shown that production of these data fields is disproportionate to the needs of the case.

D. ad.skadn.itunesitem, ad.skadn.sourceapp, ad.advertised_app_id fields

According to plaintiffs, each of these data fields contains an Apple app store ID for an advertiser or publisher, or indicates whether an “ad query” come from a mobile app. Dkt. No. 429 at 3. Plaintiffs do not explain how this information is relevant to a claim or defense. None of these data fields is within the scope of the Court’s August 26, 2022 order.

E. ad.slot.third_party_buyer_token field

Plaintiffs say that this data field “contains a token used to identify a third-party buyer if the bidder is acting as an intermediary,” and that this shows “whether the named plaintiffs’ information is shared beyond the RTB participants.” Id. at 3. Google says that this data field [REDACTED] Id. at 6.

The parties appear to be talking past each other, have not meaningfully conferred about their dispute, and present the Court with very little information. If this data field is intended to record the existence of a third-party buyer beyond the RTB participant, it may contain information relevant to plaintiffs’ claims. The fact that field [REDACTED] may bear on the weight it can be given in the case, but the Court concludes that it is nevertheless discoverable and should be produced.

F. no_bid_reason field

When populated by an RTB participant, this field contains a number from 1 to 10 that corresponds to a reason the participant selected for nof submitting a bid. 7d. at 3. The number 8 corresponds to the reason “unmatched user,” which plaintiffs say means no cookie-matching occurred. Id. Thus, plaintiffs argue that “for every bid response that was submitted that does not contain no_bid_reason=8, the bidder was able to identify a user with the information that Google disclosed in the Bid Request via cookie matching.” Id. at 3-4. Google responds that this field is optional, so a bidder’s decision not to fill in this field or to fill it with a different number does not show that the absence of a value “8” must mean cookie matching occurred. 7d. at 6.

The Court agrees with Google that an optional field, populated by the RTB participant does not necessarily show that an RTB participant has identified a particular user as a result of information shared by Google any time the field does not contain the value “8.” However, the content of this data field may be relevant to the question of whether the information Google provides allows an RTB participant to identify a user based on cookie matching. Google has not shown that production of this data field is disproportionate to the needs of the case.

G. Winning v. Non-Winning Bids

Plaintiffs argue that even if an RTB participant is not successful in the auction, its response to a bid request contains information that is relevant to plaintiffs’ claims for the same reasons the data fields in the winning bid response are relevant. While an unsuccessful bid does not result in the display of an ad to a user and may not support plaintiffs’ allegations that they suffered harm, even unsuccessful bid responses may nevertheless reveal whether Google discloses information that allows an RTB participant to identify a user based on information the RTB participant may already have about that user. For this reason, if a particular data field identified above is subject to production for the named plaintiffs, both winning and non-winning bid responses should be produced.

III. CONCLUSION

For the reasons explained above, Google shall produce named plaintiffs data for the following eight bid response data fields:

ad.attribute

ad.category

ad.restricted.category

ad.native_ad.click_link_url

ad.advertiser_name ad.sdk_rendered_ad.declared_ad.click_through_url

ad.slot.third_party_buyer_token

no_bid_reason

This production shall include both winning and non-winning bid responses, and is subject to sampling, as provided in the Court’s order resolving the dispute at Dkt. No. 430.

If Google must give notice to third parties before producing the above-referenced data, it shall promptly give notice, and shall use its best efforts to produce this information no later than April 28, 2023.

IT IS SO ORDERED.

Dated: April 14, 2023

Footnotes

[1]

For purposes of that dispute, plaintiffs limited their demand to responsive information concerning the named plaintiffs. See Dkt. No. 314 at 1.