CONSUMER PRIVACY

AND DATA PROTECTION

EDITORIAL ADVISORS

Rachel E. Barkow
Vice Dean and Charles Seligson Professor of Law
Faculty Director, Zimroth Center on the Administration of Criminal Law
New York University School of Law

Erwin Chemerinsky
Dean and Jesse H. Choper Distinguished Professor of Law
University of California, Berkeley School of Law

Richard A. Epstein
Laurence A. Tisch Professor of Law
New York University School of Law
Peter and Kirsten Bedford Senior Fellow
The Hoover Institution
Senior Lecturer in Law
The University of Chicago

Ronald J. Gilson
Charles J. Meyers Professor of Law and Business
Stanford University
Marc and Eva Stern Professor of Law and Business
Columbia Law School

James E. Krier
Earl Warren DeLano Professor of Law Emeritus
The University of Michigan Law School

Tracy L. Meares
Walton Hale Hamilton Professor of Law
Director, The Justice Collaboratory
Yale Law School

Richard K. Neumann, Jr.

Alexander Bickel Professor of Law
Maurice A. Deane School of Law at Hofstra University

Robert H. Sitkoff
Austin Wakeman Scott Professor of Law
John L. Gray Professor of Law
Harvard Law School

David Alan Sklansky

Stanley Morrison Professor of Law
Faculty Co-Director, Stanford Criminal Justice Center
Stanford Law School
 ASPEN SELECT SERIES

CONSUMER PRIVACY
AND DATA PROTECTION

Fourth Edition

Daniel J. Solove
Eugene L. and Barbara A. Bernard Professor
of Intellectual Property and Technology Law
George Washington University Law School

Paul M. Schwartz
Jefferson E. Peyser Professor of Law
U.C. Berkeley Law School
Faculty Director, Berkeley Center for Law & Technology
Copyright © 2024 Aspen Publishing. All Rights Reserved.

No part of this publication may be reproduced or transmitted in any form or by any

means, electronic or mechanical, including photocopy, recording, or utilized by any
information storage or retrieval system, without written permission from the publisher.
For information about permissions or to request permissions online, visit us at
www.AspenPublishing.com.

Cover image: Alexander/Adobe Stock

To contact Customer Service, e-mail [email protected],

call 1-800-950-5259, or mail correspondence to:

Aspen Publishing
Attn: Order Department
1 Wall Street
Burlington, MA 01803

Printed in the United States of America.

1234567890
ISBN 979-8-8861-4337-9

Library of Congress Cataloging-in-Publication Data

 About Aspen Publishing
Aspen Publishing is a leading provider of educational content and digital learning
solutions to law schools in the U.S. and around the world. Aspen provides best-in-class
solutions for legal education through authoritative textbooks, written by renowned
authors, and breakthrough products such as Connected eBooks, Connected Quizzing,
and PracticePerfect.
The Aspen Casebook Series (famously known among law faculty and students as the
"red and black" casebooks) encompasses hundreds of highly regarded textbooks in
more than eighty disciplines, from large enrollment courses, such as Torts and
Contracts, to emerging electives, such as Sustainability and the Law of Policing. Study
aids such as the Examples & Explanations and the Emanuel Law Outlines series, both
highly popular collections, help law students master complex subject matter.
Major products, programs, and initiatives include:
• Connected eBooks are enhanced digital textbooks and study aids that come
with a suite of online content and learning tools designed to maximize student
success. Designed in collaboration with hundreds of faculty and students, the
Connected eBook is a significant leap forward in the legal education learning
tools available to students.
• Connected Quizzing is an easy-to-use formative assessment tool that tests
law students’ understanding and provides timely feedback to improve learning
outcomes. Delivered through CasebookConnect.com, the learning platform
already used by students to access their Aspen casebooks, Connected
Quizzing is simple to implement and integrates seamlessly with law school
course curricula.
• PracticePerfect is a visually engaging, interactive study aid to explain
commonly encountered legal doctrines through easy-to-understand animated
videos, illustrative examples, and numerous practice questions. Developed by
a team of experts, PracticePerfect is the ideal study companion for today’s law
students.
• The Aspen Learning Library enables law schools to provide their students
with access to the most popular study aids on the market across all of their
courses. Available through an annual subscription, the online library consists
of study aids in e-book, audio, and video formats with full text search, note-
taking, and highlighting capabilities.
• Aspen’s Digital Bookshelf is an institutional-level online education
bookshelf, consolidating everything students and professors need to ensure
success. This program ensures that every student has access to affordable
course materials from day one.
• Leading Edge is a community centered on thinking differently about legal
education and putting those thoughts into actionable strategies. At the core
of the program is the Leading Edge Conference, an annual gathering of
legal education thought leaders looking to pool ideas and identify
promising directions of exploration.
To my Pamela and Griffin—DJS

To Steffie, Clara, and Leo—PMS

 SUMMARY OF CONTENTS

Contents xi

Preface xvii

Acknowledgments xix

1 INTRODUCTION 1
A. Information Privacy, Technology, and the Law 1
B. Information Privacy Law: Origins and Types 9

2 PERSPECTIVES ON PRIVACY 39
A. The Philosophical Discourse about Privacy 39
B. The Definition and the Value of Privacy 41
C. Critics of Privacy 53
D. The Feminist Perspective on Privacy 59
E. The Civil Rights Perspective on Privacy 65
F. Privacy, Poverty, and Social Class 73

3 FINANCIAL DATA 79
A. The Fair Credit Reporting Act 79
B. The Gramm-Leach-Bliley Act 108
C. Federal and State Financial Privacy Laws 113

4 CONSUMER DATA 125

A. The U.S. System of Consumer Data Privacy Regulation 126
B. Tort Law 158
C. Contract Law 170
D. Property Law 187
E. FTC Section 5 Enforcement 191
F. Federal Statutory Regulation 232
G. State Statutory Regulation 291
H. Regulating Algorithms and AI 310
I. First Amendment Limitations on Privacy Regulation 324

ix
x SUMMARY OF CONTENTS

5 DATA SECURITY 347

A. Introduction 347
B. Data Breach Notification 349
C. Civil Liability 355
D. FTC Regulation 381

Index 405
 CONTENTS

Preface xvii

Acknowledgments xix

1 INTRODUCTION 1
A. INFORMATION PRIVACY, TECHNOLOGY, AND THE LAW 1
● Sidis v. F-R Publishing Corp. 3
B. INFORMATION PRIVACY LAW: ORIGINS AND TYPES 9
1. Common Law 10
(a) The Warren and Brandeis Article 10
● Samuel D. Warren and Louis D. Brandeis, The Right to Privacy 12
(b) The Recognition of Warren and Brandeis’s Privacy Torts 23
● William Prosser, Privacy 25
● Lake v. Wal-Mart Stores, Inc. 27
(c) Privacy Protection in Tort Law 30
(d) Privacy Protection in Evidence Law 31
(e) Privacy Protection via Property Rights 31
(f) Privacy Protection in Contract Law 31
(g) Privacy Protection in Criminal Law 32
2. Constitutional Law 32
3. Statutory Law 34
4. International Law 37

xi
xii CONTENTS

2 PERSPECTIVES ON PRIVACY 39
A. THE PHILOSOPHICAL DISCOURSE ABOUT PRIVACY 39
1. The Concept of Privacy and the Right to Privacy 39
2. The Public and Private Spheres 40
B. THE DEFINITION AND THE VALUE OF PRIVACY 41
● Daniel J. Solove, Conceptualizing Privacy 42
● Julie E. Cohen, Examined Lives: Informational Privacy and the
Subject as Object 48
● Paul M. Schwartz, Privacy and Democracy in Cyberspace 51
C. CRITICS OF PRIVACY 53
● Richard A. Posner, The Right of Privacy 53
● Fred H. Cate, Principles of Internet Privacy 57
D. THE FEMINIST PERSPECTIVE ON PRIVACY 59
● Reva B. Siegel, The Rule of Love 59
● Danielle Keats Citron, Sexual Privacy 62
E. THE CIVIL RIGHTS PERSPECTIVE ON PRIVACY 65
● Alvaro M. Bedoya, Privacy as Civil Right 66
● Anita L. Allen, Dismantling the “Black Opticon” 69
F. PRIVACY, POVERTY, AND SOCIAL CLASS 73
● Khiara M. Bridges, Privacy Rights and Public Families 73

3 FINANCIAL DATA 79
A. THE FAIR CREDIT REPORTING ACT 79
1. FCRA’s Scope and Structure 82
● United States v. Spokeo, Inc. 83
2. Permissible Uses of Consumer Reports 89
3. Consumer Rights and Agency Responsibilities 91
4. Civil Liability and Qualified Immunity 93
● Sarver v. Experian Information Solutions 94
5. Identity Theft and Consumer Reporting 101
● Sloan v. Equifax Information Services, LLC 103
B. THE GRAMM-LEACH-BLIELY ACT 108
C. FEDERAL AND STATE FINANCIAL PRIVACY LAWS 113
1. State Financial Laws 113
2. Laws Regulating Government Access to Financial Data 114
 CONTENTS xiii

● United States v. Gratkowski 115

3. Identity Theft Statutes 119
4. Tort Law 121
● Wolfe v. MBNA America Bank 121

4 CONSUMER DATA 125

A. THE U.S. SYSTEM OF CONSUMER DATA PRIVACY
REGULATION 126
1. Structure 127
2. Types of Law 129
3. Personally Identifiable Information (PII) 136
● Pineda v. Williams-Sonoma Stores 137
4. Injury and Standing 144
● Spokeo, Inc. v. Robins 145
● TransUnion LLC v. Ramirez 150
B. TORT LAW 158
● Dwyer v. American Express Co. 158
● Remsberg v. Docusearch, Inc. 164
C. CONTRACT LAW 170
1. Privacy Notices 170
● Jeff Sovern, Opting In, Opting Out, or No Options at All 170
2. Contract and Promissory Estoppel 173
● In re Northwest Airlines Privacy Litigation 173
● In re Marriott International, Inc. Customer Data Security Breach Litigation 176
D. PROPERTY LAW 187
E. FTC SECTION 5 ENFORCEMENT 191
● In the Matter of Sears Holdings Management Corp. 197
● United States v. Easy Health Care Corporation 204
● In the Matter of Facebook. Inc. (2012) 210
● In the Matter of Facebook. Inc. (2019) 217
F. FEDERAL STATUTORY REGULATION 232
1. Entertainment and Communications Records 232
(a) The Video Privacy Protection Act 232
● In re: Nickelodeon Consumer Privacy Litigation 235
(b) The Federal Communications Act 242
(c) The Cable Communications Policy Act 244
2. Internet Use 246
(a) The Children’s Online Privacy Protection Act 246
xiv CONTENTS

● United States v. Path, Inc. 249

● FTC and New York v. Google and YouTube 256
(b) The Electronic Communications Privacy Act 262
● In re Facebook, Inc. Internet Tracking Litigation 262
● Dyer v. Northwest Airlines Corp. 267
(c) The Computer Fraud and Abuse Act 269
● Creative Computing v. Getloaded.com LLC 270
● United States v. Drew 273
3. Marketing 280
(a) The Telephone Consumer Protection Act 280
● Stoops v. Wells Fargo Bank 284
(b) The CAN-SPAM Act 288
G. STATE STATUTORY REGULATION 291
1. State Consumer Privacy Laws 291
(a) California Consumer Privacy Act 291
(b) Other State Consumer Privacy Laws 297
2. Biometric Privacy Laws 302
(a) Illinois Biometric Information Privacy Act 302
(b) Other State Biometric Laws 303
● Stacy Rosenbach v. Six Flags Entertainment Corporation 304
H. REGULATING ALGORITHMS AND AI 310
1. What Is AI? 310
2. Is AI a Privacy Issue? 312
3. AI, Bias, and Discrimination 315
4. Regulating AI 317
I. FIRST AMENDMENT LIMITATIONS ON PRIVACY
REGULATION 324
● Rowan v. United States Post Office Department 325
● Mainstream Marketing Services, Inc. v. Federal Trade Commission 326
● U.S. West, Inc. v. Federal Communications Commission 329
● Trans Union Corp. v. Federal Trade Commission 335
● Sorrell v. IMS Health, Inc. 337
● Barr v. American Association of Political Consultants, Inc. 344
 CONTENTS xv

5 DATA SECURITY 347

A. INTRODUCTION 347
B. DATA BREACH NOTIFICATION 349
C. CIVIL LIABILITY 355
● Clemens v. Execupharm Inc. 361
● I.C. v. Zynga Inc. 366
D. FTC REGULATION 381
● In the Matter of Drizly and James Cory Rellas 388
● LabMD v. Federal Trade Commission 394

Index 405