Commentary

Pandora Users Allowed To Proceed With App Privacy Case -- For Now

Two years ago, Pandora dodgeda privacy lawsuit stemming from its Facebook integration. But the streaming music company's luck didn't hold in another recent privacy battle: A federal judge ruled last week that users can proceed with allegations that Pandora's mobile app engages in the “nefarious” practice of sharing data with mobile ad networks.

U.S. District Court Judge Jeffrey White in the Northern District of California rejected Pandora's argument that the users lacked “standing” because they hadn't suffered any injury from the alleged data sharing. The users alleged in their complaint that the app's data-sharing consumed additional bandwidth, which drove up the monthly fees in some cases; White said those allegations were enough for the users to move forward.

But White also indicated that Pandora stood a chance of winning the case in the future, if the users weren't able to back up their claims that the alleged data sharing cost them money. Specifically, he wrote that the users “could face an uphill battle” at a later date.

The lawsuit stems from allegations that the company allowed ad networks to access users' device identifiers -- unique alphanumeric strings. The users say that this practice violated Pandora's privacy policy, which states that personally identifiable information will be shared only in the aggregate “Put simply, Pandora represents to its users that PII will be shared only in a 'deidentified or aggregated form,' and only for purposes of using the Pandora App itself. In reality, however, something far more nefarious occurs,” they allege in the lawsuit.

The users go on to assert that devices' unique identifiers constitute personally identifiable information. White hasn't yet ruled on that question. But many observers have expressed concern that unique device identifiers can pose a privacy risk, even if they aren't tied to a user's name or address. In fact, those concerns spurred Apple to institute new policies prohibiting developers from accessing unique device identifiers on iPhones and iPads.

White's ruling, though preliminary, is enough to keep the case alive -- and exert pressure on Pandora to settle. But if the company continues to fight the case, it could well prevail in the end. In the last year, several judges have issued early-stage rulings that allowed privacy lawsuits to proceed, but then turned around and issued decisions in favor of the Web companies that were sued. The latest example occurred last night, when U.S. District Court Judge Lucy Koh -- who is presiding over a privacy lawsuit about Gmail ads -- refused to allow the users to bring a class-action.

Koh previously ruled that Google potentially violated the federal wiretap law by scanning emails in order to surround them with ads. But her latest ruling could well mean the end of the litigation, given that it's usually too costly for people to bring individual lawsuits against companies as big and well-funded as Google.

Next story loading loading..