Yahoo tries legal pirouettes in court, breaks neck
A group of consumers who are not subscribers to Yahoo email are suing Yahoo, accusing it of analyzing their emails. Yahoo "extracts keywords from the body of the email, reviews and extracts links and attachments, and classifies the email based on its content," according to the filed lawsuit. "Yahoo also subjects the copied email and extracted information to additional analysis to create targeted advertising for its subscribers, and stores it for later use."
Yahoo's initial position is mildly defendable. To protect users against spam, junk mail and malware, all emails, incoming and outgoing, must be examined. More to the point, to support the free email service, Yahoo says that it needs to charge advertisers and that it can charge them much more if it permits them to send highly targeted messages based on email contents. Hence, Yahoo's position: You want free email You've got to pay the piper somehow.
The problem is one of consent. People who sign up for free Yahoo email have to consent to the searches in exchange for the free service. But what about people who just happen to email Yahoo customers That's where the Yahoo case starts to crumble -- but it is fun watching it try to defend it.
In the decision, U.S. District Court Judge Lucy H. Koh undercut the business contention that email analysis is essential to the free service by pointing out that Yahoo forgoes such email analysis "for commercial purposes." She then cited testimony from a Yahoo executive about non-U.S. email efforts. Yahoo "cannot use email to target ads to users without consent from both the sender and receiver in the United Kingdom. Yahoo therefore does not provide targeted advertising to Yahoo Mail subscribers in the United Kingdom."
Then comes Whopper No. 1, which is arguably the most unrealistic condition in any terms-of-service language, which is saying quite a lot. "In its terms of service, Yahoo notifies its subscribers that: 'If you consent to this [Additional Terms of Service] and communicate with non-Yahoo users using the Services, you are responsible for notifying those users about this feature.' According to Plaintiffs, Yahoo 'makes no other effort to obtain the consent of non-subscribers.' Moreover, Yahoo provides no mechanism for non-Yahoo Mail subscribers to opt out of Yahoo's scanning practices."
Let me see if I've got this straight. Based on one line in an almost-never-read TOS, it expects its free email customers to contact anyone who emails them and to tell them about Yahoo's scanning Let's set aside for the moment the facts that this is ridiculous and that pretty much no one will ever do it (nor should Yahoo have expected them to). Even if Yahoo's email users did, the damage would already have been done, as that initial message would have already been scanned. Are Yahoo's users supposed to somehow divine every person who might ever email them and proactively tell them about Yahoo's scans
And even if they possess this magical ability and are willing to use it to help out Yahoo, notification is not the same as consent. Does Yahoo expect its free users to obtain that consent, too Yahoo expects a lot for its free email.
Then this delightful nugget, to be filed under "Let's use communications to obscure information-sharing": "In 2012, Yahoo's communications department also recommended that it would be 'good to have a quiet blog post on our advertising or privacy blog about several forms of targeting (not just commercial mail) so we can say we have something out there if there is an issue. No one wants to proactively grab the attention of consumers. It's just a way of having something documented.'" (Note to IT: Don't your people understand that emails are preserved and will be subpoenaed The more embarrassing the reference, the more likely they'll have to defend it in court.)
I've had enough fun thus far. Time for Koh to have some fun. "The gravamen of Yahoo's argument is that once Plaintiffs discovered that their emails to Yahoo subscribers were being intercepted, stored, and used by Yahoo, Plaintiffs then consented to Yahoo's actions by continuing to email Yahoo subscribers. According to Yahoo, because Plaintiffs now know that any emails Plaintiffs send to Yahoo subscribers will be subject to Yahoo's interception and use of those emails, Plaintiffs 'consent' to future interceptions and cannot allege a future injury as required to establish standing for injunctive relief."
What does the judge think of that argument "Yahoo would put Plaintiffs in a Catch-22 that would essentially preclude injunctive relief altogether. Yahoo would require Plaintiffs to allege both that Plaintiffs, in order to avoid "consenting" to Yahoo's conduct, stopped emailing Yahoo subscribers after discovering Yahoo's alleged wrongful conduct. And that Plaintiffs continued to email Yahoo subscribers so that Plaintiffs allege a real and immediate threat of future injury, i.e., that Yahoo would intercept Plaintiffs' communications in the future. The Court declines to impose an impossible burden on Plaintiffs."
Yahoo also argued that non-Yahoo-mail-using people have simple options to avoid having their data scanned. "Yahoo asserts that Plaintiffs could contact Yahoo Mail subscribers via phone, fax, or email addresses provided by Yahoo's competitors," the judge wrote in her decision. "Yahoo appears to be arguing that Plaintiffs are not required, either by necessity or convenience, to consent to Yahoo's interceptions and disclosures because Plaintiffs can communicate with Yahoo Mail subscribers via other means. This argument places Plaintiffs in the same Catch-22 position referenced above. As discussed above, the Court finds Yahoo's argument unpersuasive."
Yahoo, you're suggesting that in 2015 consumers could instead fax friends or colleagues who use Yahoo Mail Really Or just pick up the phone to call them Sure, that's not an unnecessary burden.
But my absolute favorite is that they could use an email address from a Yahoo competitor. To paraphrase former U.S. Defense Secretary Donald Rumsfeld, you email someone at the address they have, not the address you might want them to have. You email people at the address they gave you. What is stunning here is that this is an email company that made that argument.
Evan Schuman has covered IT issues for a lot longer than he'll ever admit. The founding editor of retail technology site StorefrontBacktalk, he's been a columnist for CBSNews.com, RetailWeek and eWeek. Evan can be reached at eschuman@thecontentfirm.com and he can be followed at twitter.com/eschuman. Look for his column every other Tuesday.