Id. at 11–12. The declaration is electronically signed and dated April 30, 2024. Id. at 12.

Respondent objected to the subpoena and represented that it would not produce responsive documents, leading to Petitioners’ Motion to Compel. Dkt. No. 1 at 2. In their reply brief, Petitioners noted that Flynn completed and resubmitted Respondent's standard consent verification form to provide full consent. See Dkt. No. 6 at 30–31 (blank standard form); Dkt. No. 7-8 at 2–3 (Flynn's unaltered form). In granting Petitioners’ motion, the Court observed, “As it appears that Petitioners successfully persuaded Flynn to sign Respondent's form without alterations, there is no live issue with respect to ECPA [the Electronic Communications Privacy Act].” Dkt. No. 8 at 5. The Court thus did not address whether Flynn's declaration was sufficient to establish consent under ECPA. Id. at 5 n.2.

*2 Respondent now states that, unbeknownst to the Court, “the second consent form from Mr. Flynn failed [Respondent's] verification process.” Dkt. No. 9 at 2. “If a purported accountholder fails [Respondent's] verification process, [Respondent] does not view the unverified consent as sufficient under the ECPA to disclose the content of communications.” Id. at 3. Respondent states that its Law Enforcement National Security division determined that “the information provided in the verification form was incomplete or did not match the registration data in the account.” Id. On November 21, 2024—after the close of briefing on Petitioners’ motion but prior to the Court's Order—Respondent's counsel emailed Petitioners’ counsel informing them of this issue. See Dkt. No. 10 at 4 (email). Counsel stated that “for security reasons” Respondent could not “point to which data point doesn't match.” Id. Respondent states that Petitioners never responded to this email. Dkt. No. 9 at 3.

Respondent moves for reconsideration of the Court's prior Order. See Dkt. No. 9. Petitioners oppose. See Dkt. No. 12.

“Motions for reconsideration are disfavored.” LCR 7(h)(1). Such motions must be denied absent a showing of “manifest error in the prior ruling or ... new facts or legal authority which could not have been brought to [the Court's] attention earlier with reasonable diligence.” Id. Motions for reconsideration should be granted only in “highly unusual circumstances.” Marlyn Nutraceuticals, Inc. v. Mucos Pharma GmbH & Co., 571 F.3d 873, 880 (9th Cir. 2009) (quoting 389 Orange St. Partners v. Arnold, 179 F.3d 656, 665 (9th Cir. 1999)); see also Inventist, Inc. v. Ninebot Inc., 664 F. Supp. 3d 1211, 1215 (W.D. Wash. 2023) (noting reconsideration is an “extraordinary remedy,” and the moving party bears a “heavy burden”). “A motion for reconsideration ‘may not be used to raise arguments or present evidence for the first time when they could reasonably have been raised earlier in the litigation.’ ” Maryln Nutraceuticals, 750 F.3d at 880 (quoting Kona Enters., Inc. v. Est. of Bishop, 229 F.3d 877, 890 (9th Cir. 2000)). “Whether or not to grant reconsideration is committed to the sound discretion of the court.” Navajo Nation v. Confederated Tribes & Bands of the Yakima Indian Nation, 331 F.3d 1041, 1046 (9th Cir. 2003).

Respondent argues that the fact that “Mr. Flynn did not provide sufficient information to confirm his ownership of the account and valid consent” means that there is still a live issue with respect to ECPA. Dkt. No. 9 at 4. Respondent seeks denial of the prior Motion to Compel or a stay of its obligation to comply with the Order pending verification of consent. Id. at 5. As to consent, Respondent argues that Flynn “should resubmit a fully compliant consent form” or, “[i]n the alternative, ... submit evidence sufficient for the Court to conclude that Mr. Flynn owns the account at issue and has consented” to disclosure of his communications. Id. at 4. In response, Petitioners argue that the motion fails because Respondent could have attempted to verify Flynn's consent in October 2024 and thus raised the issue in its prior briefing, but did not. See Dkt. No. 12 at 3–4. Petitioners also argue that the motion fails because ECPA does not require consent to be verified on Respondent's preferred form. See id. at 4–5.

As an initial matter, the Court finds that Respondent failed to raise this issue in a timely manner. Petitioners rightly emphasize that Flynn's first verification form was provided to Respondent on October 11, 2024, two weeks before Respondent's response to Petitioners’ motion was due, yet Respondent did not verify the information in a timely manner. Dkt. No. 12 at 4. Instead, Respondent flagged just one problem with the form (i.e., Flynn's alteration of the form to limit consent) without reviewing the form to see if there were any other problems (e.g., form answers that did not match Respondent's information). Then, upon receiving Flynn's second form on October 24, 2024, Respondent was somehow unable to verify the contents of the form (which essentially contains just five pieces of information) until around November 21, 2024, when its counsel notified Petitioners of Flynn's failed process. Dkt. No. 10 at 4. This course of behavior suggests that Respondent was not diligent in processing Flynn's verification form and notifying Petitioners of any issues, thus resulting in the Court's Order based on outdated information and the instant motion. On this ground alone, the motion could be denied as based on “evidence ... that could reasonably have been raised earlier in the litigation.” Marlyn Nutraceuticals, 571 F.3d at 880. Still, the Court will also address the ECPA issue.

*3 “Title II of ECPA, termed the Stored Communications Act [(“SCA”)], covers access to electronic information stored in third party computers.” In re Zynga Privacy Litig., 750 F.3d 1098, 1104 (9th Cir. 2014) (citing 18 U.S.C. §§ 2701–12). ECPA generally prohibits a service provider from disclosing the contents of an account holder's communications. 18 U.S.C. §§ 2702(a)(1)–(2). However, the service provider may disclose the communications if one of several exceptions applies. 18 U.S.C. § 2702(b)(1)–(9). Relevant here, one such exception is that a provider may disclose the communications “with the lawful consent of the originator or an addressee or intended recipient of such communication, or the subscriber in the case of remote computing service.” 18 U.S.C. § 2702(b)(3).

The Parties dispute what is required to show “lawful consent” under ECPA. The statute is silent as to what that phrase means. See 18 U.S.C. § 2711 (definitions). And to the best of the Court's knowledge, caselaw provides little guidance.[2] In the absence of a clear rule or even a guiding standard, service providers like Respondents are left to make their best guess as to what constitutes “lawful consent” such that they can lawfully comply with ECPA.

The Court does not purport to create a rule or standard here. But wherever the floor may ultimately be set for proving lawful consent under ECPA, the Court finds that a sufficient showing has been made here. Flynn's declaration identifies himself and his Skype account, explicitly consents to Respondent's disclosure of his communications (albeit limited to communication with only certain individuals/accounts), and is authored under penalty of perjury. See Dkt. No. 1-2 at 11–12. Flynn later twice completed Respondent's verification form, where he again identified himself and his Skype account, explicitly consented to Respondent's disclosure of his communications (first with limitations, then with none), and answered under penalty of perjury. See Dkt. No. 6 at 34–35; Dkt. No. 7-8 at 2–3. On the form, Flynn answered additional questions, including approximate date of account creation; email address provided at time of creation; country selected at time of registration; approximate date of last login; and up to three contacts from his contacts list. Id. at 3. Petitioners also supply Skype screenshots and chats provided by Flynn—further evidence that Flynn is the actual account holder. See Dkt. Nos. 1-5, 1-6.

This case is thus like cases where lawful consent was held to be established outside of a service provider's own required process. In re Akhmedova featured a motion to quash subpoena by Google, arguing (among other things) that ECPA prohibited disclosure of account contents. No. MC20-80156, 2020 WL 6891828, at *2–4 (N.D. Cal. Nov. 24, 2020). The account holder, Mr. Akhmedova, signed mandates at the direction of an English court,[3] in which he “expressly states that he owns the accounts and consents to Google's production of their contents, including specifically for purposes of compliance with the SCA.” Id. at *3. Mr. Akhmedova also filed a stipulation in the case stating that he did not object to disclosure. Id. Google argued that Mr. Akhmedova's purported consent did not meet the “lawful consent” requirement because he did not follow Google's “verified-consent” process. Id. The court summarized Google's argument, which echoes in the briefing here:

Id. In rejecting the argument, the court praised Google's “concern for the privacy and security of its accounts holders’ communications,” and acknowledged that its verification process “is undoubtedly a satisfactory mechanism to obtain the account holder's consent.” Id. But the court noted that “nothing in the SCA requires that consent be communicated in a manner Google prescribes or permits a service provider to dictate the form of acceptable consent.” Id. This Court agrees with that conclusion. Further, the court observed that neither Mr. Akhmedova's status as account holder or consent to disclosure was “reasonably in dispute,” and that “the only information in the record before the Court is that the accounts belong to Mr. Akhmedov[a].” Id. “Google points to no evidence suggesting that Mr. Akhmedova is not the owner of the accounts,” it explained, “and he has clearly and expressly consented to production of their contents.” Id. Likewise here, the only information in the record before this Court is that the accounts belong to Flynn, and he has provided consent to the disclosure of his communications in multiple formats.

Super Vitaminas, S.A., cited by Petitioners, is also similar. No. MC17-80125, 2017 WL 5571037 (N.D. Cal. Nov. 20, 2017). There, Super Vitaminas sought emails received by its former employees on their company Google accounts. Id. at *1. In support of its application, Super Vitaminas submitted declarations from those employees, in which they consented to the disclosure of the emails. Id. at *4. The court thus concluded that lawful consent was established. Id. In its prior briefing, Respondent argues that Super Vitaminas is distinguishable because the employees “disclaimed any ownership or privacy interest in company emails.” Dkt. No. 5 at 11; see Dkt. No. 6 at 69–78 (declarations). But the Super Vitaminas court did not make that distinction, or even acknowledge that there was any relevant issue regarding ownership of the emails or Google accounts. It simply held, without qualification, that the employees’ declarations were sufficient to establish consent.

Respondent argues that “[t]he failure to provide verified consent is no small matter” and that “[its] consent verification process ensures that the actual accountholder provides consent,” making it “critical not only to [Respondent's] compliance with federal law but also to the integrity of the larger data privacy ecosystem.” Dkt. No. 9 at 4. The Court commends Respondent's commitment to the privacy of its account holders and to compliance with ECPA. But as the Akhmedova court observed, and as Petitioners note here (Dkt. No. 12 at 4), nothing in ECPA requires consent to be communicated in Respondent's preferred manner. Nor does anything in ECPA require consent to be unlimited in its scope. Further, Flynn's status as account holder and his consent to disclosure are not reasonably in dispute. Respondent states that Flynn failed its verification process, but Respondent apparently refuses to disclose to anyone—Petitioners’ counsel, the Court, or even Flynn himself—what part of the process he failed, or what he needs to correct. Respondent also does not provide any other evidence suggesting that the “David Flynn” who authored the declaration under penalty of perjury is not the owner of the “xcellent.choice” Skype account or did not give consent to disclosure. Under these circumstances, then, the Court concludes that ECPA's lawful-consent exception applies.

*5 Accordingly, Respondent Microsoft Corporation's Motion for Reconsideration (Dkt. No. 9) is DENIED. Respondent SHALL produce documents responsive to the subpoena, if any, within fourteen (14) days of this Order.

Dated this 15th day of January 2025.