STATE OF VERMONT SUPERIOR COURT CHITTENDEN UNIT STATE OF VERMONT, Plaintiff, v. CLEARVIEW AI, INC. Defendant. CIVIL DIVISION DOCKET NO. 226-3-20-Cncv ) ) ) ) ) ) ) ) ) PLAINTIFF’S OPPOSITION TO DEFENDANT’S MOTION TO DISMISS STATE OF VERMONT THOMAS J. DONOVAN, JR. ATTORNEY GENERAL Ryan Kriger Justin Kolber Jill Abrams Assistant Attorneys General Office of the Attorney General 109 State Street Montpelier, Vermont 05609 (802) 828-3170 ryan.kriger@vermont.gov justin.kolber@vermont.gov jill.abrams@vermont.gov Filed May 8, 2020 TABLE OF CONTENTS TABLE OF AUTHORITIES .................................................................................................... iv INTRODUCTION ....................................................................................................................... 1 BACKGROUND AND FACTS ................................................................................................. 3 I. The State’s Allegations .................................................................................................. 3 II. Clearview Collects and Stores 3,000,000,000 Photos .......................................... 5 III. Clearview Uses Facial Recognition AI to Match People ..................................... 6 IV. Clearview Has Shared Its Technology Indiscriminately .................................... 7 V. Clearview Misrepresents its Product ......................................................................... 8 ARGUMENT................................................................................................................................ 9 I. Standard on a Motion to Dismiss.............................................................................. 11 II. Section 230 of the Communications Decency Act is Inapplicable to the State’s Claims ........................................................................................................................ 12 A. Overview of Section 230 of the Communications Decency Act .................... 12 B. Clearview is an Interactive Computer Service ................................................ 15 C. The State’s Claims Are Not Based on Information Provided by Another Information Content Provider ....................................................................................... 15 1. The State’s claims do not arise from photographs posted on the internet 16 2. The photographs were not provided to Clearview .......................................... 17 3. If Section 230 applied, Clearview would be the “Information Content Provider”... 18 4. Clearview’s “search engine” argument is a red herring ................................ 19 D. III. The State’s Claims Are Not Based on Clearview Acting as a Publisher ... 23 First Amendment Protections Do Not Apply Here ............................................ 24 A. The State Asserts Claims that Are Unrelated to Speech .............................. 24 B. The First Amendment Does Not Protect Deceptive Statements ................. 25 C. The Clearview App is Not Speech....................................................................... 26 1. The Clearview App is not the type of software that has been held to merit First Amendment protections .................................................................................... 28 ii 2. The Clearview App, to the extent it might be considered “code,” does not fall within First Amendment protections................................................................ 29 D. To the Extent that the First Amendment Applies, the State’s Lawsuit is an Appropriate Regulation of Commercial Speech ................................................... 33 1. Clearview’s statements do not concern lawful activity and are misleading.. 33 2. The State has a substantial interest in protecting the privacy and safety of consumers .................................................................................................................. 34 3. This lawsuit directly advances the governmental interest........................... 35 4. The State does not seek remedies that are more extensive than necessary . 36 IV. Clearview’s Void-for-Vagueness Argument Is Misplaced ................................. 36 V. Vermont Has a Valid Claim for Unfair and Deceptive Conduct under the CPA .. 39 A. Consumers Have a Reasonable Expectation of Privacy to be Free from Unrestricted Facial Recognition and Identification by Third Parties. ................. 40 1. State v. VanBuren is distinguishable................................................................. 40 2. Privacy exists on the internet .............................................................................. 43 3. Consumers did not relinquish their privacy expectations ............................ 48 4. Consumers still expect their anonymity in the real world ........................... 51 B. The CPA Covers Clearview’s Conduct ............................................................... 56 1. The Christie test for unfairness has three independent criteria ................. 56 2. The CPA encompasses common law or public policies like privacy............ 61 3. Clearview’s conduct is immoral and unscrupulous ........................................ 63 4. Clearview’s conduct is deceptive ......................................................................... 65 VI. The Fraudulent Acquisition of Data Law Applies to Clearview’s Conduct .. 69 VII. The State Has Standing........................................................................................ 71 VIII. This Court is an Appropriate Venue for this Action ...................................... 76 iii TABLE OF AUTHORITIES Cases Alexander v. Cahill, 598 F.3d 79 (2d Cir. 2010)................................................................. 34 Alfred L. Snapp & Son, Inc. v. Puerto Rico, ex rel., Barez, 458 U.S. 592 (1982).... 73, 74 American Council of Life Insurers, et al. v. Vermont Dep’t of Banking, Ins., Sec., & Healthcare Admin., et al., No. 50-1-02WNCV, 2004 WL 578737 (Vt. Super. Feb. 12, 2004) .........................33 Anderson v. Johnson, 2011 VT 17, 189 Vt. 603 (2011) ..................................................... 65 Barnes v. Yahoo!, Inc., 570 F.3d 1096 (9th Cir. 2009)..............................................passim Birnbaum v. United States, 588 F.2d 319 (2d Cir. 1978).......................................... 47, 48 Brody v. Barasch, 155 Vt. 103, 582 A.2d 132 (1990) ........................................................ 37 Brown v. Entm't Merchs. Ass'n, 564 U.S. 786 (2011) ................................................ 28, 30 Carpenter v. United States, 138 S. Ct. 2206, 201 L. Ed. 2d 507 (2018) ................. 53, 62 Carter v. Gugliuzzi, 168 Vt. 48, 716 A.2d 17 (1998).......................................................... 67 Cent. Hudson Gas & Elec. Corp. v. Pub. Serv. Comm'n of New York, 447 U.S. 557 (1980).... 25, 33, 34 Centerline Equip. Corp. v. Banner Pers. Serv., Inc., 545 F. Supp. 2d 768 (N.D. Ill. 2008)....63 Colby v. Umbrella, Inc., 2008 VT 20, 184 Vt. 1, 955 A.2d 1082 (2008)......................... 12 Colgate v. JUUL Labs, Inc., 402 F. Supp. 3d 728 (N.D. Cal. 2019) .............................. 58 Commodity Futures Trading Comm’n v. Vartuli, 228 F.3d 94 (2d Cir. 2000) ............ 31 Connecticut v. American Elec. Power Co., Inc., 582 F.3d 309 (2009) ..................... 74, 75 Cooper v. Slice Techs., Inc., 17-CV-7102 (JPO), 2018 WL 2727888 (S.D.N.Y. Jun. 6, 2018) ..46 Def. Distributed v. U.S. Dep't of State, 838 F.3d 451 (5th Cir. 2016) ........................... 31 Denton v. Chittenden Bank, 163 Vt. 62, 655 A.2d 703 (1994)..................... 38, 47, 51, 63 DMG Studio Holdings, Inc. v. N. Bay S. Corp., 2013 WL 3992402 (D. Conn. Aug. 2, 2013) .....66 Edenfield v. Fane, 507 U.S. 761 (1993) ......................................................................... 25, 35 Edge Broadcasting, 509 U.S. 418 (1993) ............................................................................. 25 Elkins v. Microsoft Corp., 174 Vt. 328, 817 A.2d 9 (2002) ............................................... 11 Fair Hous. Council of San Fernando Valley v. Roommates.com, LLC, 521F.3d 1157 (9th Cir. 2008).....13, 16 iv Fenwick v. Kay Am. Jeep, Inc., 371 A.2d 13 (N.J. 1977) .................................................. 39 Fla. Bar v. Went For It, Inc., 515 U.S. 618 (1995) ............................................................. 25 Friedl v. City of New York, 210 F.3d 79 (2d Cir. 2000) .................................................... 68 FTC v. Accusearch, 570 F.3d 1187 (10th Cir. 2009)................................................... 15, 19 FTC v. Equifax Inc., No. 1:19-mi-99999 (N.D. Ga. July 22, 2019) ......................... 66, 67 FTC v. Google, No. 512-cv-04177-HRL (N.D. Cal. Nov. 16, 2012) .......................... 44, 45 FTC v. InMobi Pte Ltd, No. 3:16-cv-3474 (N.D. Cal. June 22, 2016) ..................... 38, 62 FTC v. LeadClick Media, LLC., 838 F.3d 158 (2d Cir. 2016) ............................13, 14, 15 FTC v. Raladam Co., 316 U.S. 149 (1942) .......................................................................... 39 FTC v. Sperry & Hutchinson Co., 405 U.S. 233 (1972) ............................................passim Gager v. Dell Fin. Servs., LLC, 727 F.3d 265 (3d Cir. 2013)........................................... 50 Gibson v. Craigslist, Inc., 2009 WL 1704355 (S.D.N.Y. June 15, 2009)................ 13, 16 Green v. America Online (AOL), 318 F.3d 465 (3d Cir. 2003) ................................. 13, 16 Grocery Mfrs. Ass'n v. Sorrell, 102 F. Supp. 3d 583 (D. Vt. 2015).......................... 35, 64 Henderson v. United Student Aid Funds, Inc., 918 F.3d 1068 (9th Cir. 2019) ........... 63 Hodgdon v. Mount Mansfield Co., 160 Vt. 150, 624 A.2d 1122 (1992) .................. 38, 47 In re Cambridge Analytica, LLC, No. 9383 (F.T.C. Nov. 25, 2019) ........................ 26, 67 In re Deyo, 164 Vt. 613, 670 A.2d 793 (1995)...................................................................... 25 In re Epic Media Group, LLC, No. C-4389 (F.T.C. Mar. 19, 2013)................................ 65 In re Google Inc. Cookie Placement Consumer Privacy Litig., 806 F.3d 125 (3d Cir. 2015).....46 In re International Harvester, 104 F.T.C. 949, 1984 WL565290 (1984) ....................... 57 In re LaBerge NOV, 2016 VT 99, 203 Vt. 98, 152 A.3d 1165 (2016) ............................. 39 In re Lenovo (United States) Inc., No. 152-3134 (F.T.C. Sept. 5, 2017) ........................ 27 In re Palmer, 171 Vt. 464, 769 A.2d 623 (2000) ............................................................. 37 In re Retina-X Studios, LLC, No. C-4711 (F.T.C. Mar. 26, 2020) .................................. 27 J. O. Bilodeau & Co. v. Reed, 119 Vt. 342, 126 A.2d 118 (1956).................................... 76 v Jane Doe No. 1 v. Backpage.com, LLC, 817 F.3d 12 (1st Cir. 2016) ................13, 15, 16 Jones v. Dirty World Entm’t Recordings LLC, 755 F.3d 398 (6th Cir. 2014) ......passim Junger v. Daley, 209 F.3d 481 (6th Cir. 2000) ................................................................... 31 Kaplan v. Morgan Stanley & Co., 2009 VT 78; 186 Vt. 605; 987 A.2d 258 (2009)..... 11 Kitt v. Pathmakers, Inc., 672 A.2d 76 (D.C. App. 1996) ................................................... 68 Kyllo v. United States, 533 U.S. 27 (2001) .......................................................................... 62 LabMD, Inc. v. FTC, 894 F.3d 1221 (11th Cir. 2018) ..........................................57, 61, 63 Lujan v. Defs. Of Wildlife, 504 U.S. 555 (1992) .......................................................... 72, 75 Mass. v. EPA, 549 U.S. 497 (2007)........................................................................................ 72 McDonald v. Kiloo ApS, 385 F. Supp. 3d 1022 (N.D. Cal. 2019) ............................ 38, 62 Messier v. Bushman, 2018 VT 93, 208 Vt. 261, 197 A.3d 882 (2018)............................ 71 Minnesota ex rel. Hatch v. Sunbelt Commc'ns & Mktg., 282 F. Supp. 2d 976 (D. Minn. 2002)....35 Morrison v. Toys “R” Us, Inc., 806 N.E.2d 388 (Mass. 2004) .......................................... 58 Mount v. PulsePoint, Inc., 684 F. App’x 32 (2d Cir. 2017)........................................ 38, 75 Nader v. Gen. Motors Corp., 25 N.Y.2d 560, 255 N.E.2d 765 (1970) ............................ 53 O’Kroley v. Fastcase Inc., 2014 WL 2881526 (M.D. Tenn, June 25, 2014) .....13, 16, 22 Opperman v. Path, Inc., 84 F. Supp. 3d 962 (N.D. Cal. 2015) ................................passim Patel v. Facebook, Inc., 932 F.3d 1264 (9th Cir. 2019) .............................................passim People by Underwood v. LaRose Indus. LLC, 386 F. Supp. 3d 214 (N.D.N.Y. 2019) 73 People ex rel. Spitzer v. Grasso, 42 A.D.3d 126 (N.Y. 2007) ............................................ 74 Renzello v. Nelson, No. 1:05-CV-00153-JGM, 2015 WL 13685375 (D. Vt. May 20, 2015) (D. Vt. Sept. 4, 2015)................................................................................................. 14 Richards v. Town of Norwich, 169 Vt. 44, 726 A.2d 81 (1999) ....................................... 11 Riley v. California, 573 U.S. 373 (2014) .............................................................................. 48 Rockford Mem’l Hosp. v. Havrilesko, 858 N.E.2d 56 (Ill. 2006)) .................................... 59 Rohrer v. Knudson, 2009 MT 35, 349 Mont. 197, 203 P.3d 759 (Mt 2009) ........... 58, 63 Rubin v. Coors Brewing Co., 514 U.S. 476 (1995) ............................................................. 35 vi Sanders v. Am. Broad. Companies, Inc., 20 Cal. 4th 907, 978 P.2d 67 (1999) .... 53, 54 Saponaro v. Grindr, LLC, 93 F. Supp. 3d 319 (D.N.J. 2015).......................................... 13 See State ex rel. Hatch v. Cross Country Bank, Inc., 703 N.W.2d 562 (2005) ............. 73 Seldon v. Magedson, 2012 WL 4475274 (S.D.N.Y. July 10, 2012).......................... 13, 16 Sessions v. Dimaya, 138 S. Ct. 1204, 200 L. Ed. 2d 549 (2018) ..................................... 39 Sony Computer Entm't v. Connectix Corp., 203 F.3d 596 (9th Cir. 2000) ................... 31 Sorrell v. IMS Health Inc., 564 U.S. 552 (2011) ................................................................ 27 State of N. Y. by Abrams v. Gen. Motors Corp., 547 F. Supp. 703 (S.D.N.Y. 1982) ......36, 73, 74 State of Vermont v. CSA-Credit Solutions of Am., LLC & Doug Van Arsdale, Dec. and Order: Mot. for Summ. J. (Vt. Super. Ct. March 5, 2012) ................................... 58 State v. Big Brother, No. 326-4-20 Cncv, Dec. on Prelim. Inj. (Apr. 27, 2020)........... passim State v. Int'l Collection Serv., Inc., 156 Vt. 540, 594 A.2d 426 (1991) .......................... 36 State v. VanBuren, 2018 VT 95, 214 A.3d 791 (2019) .................................. 35, 38, 40, 41 Stratton Oakmont, Inc. v. Prodigy Servs. Co., 1995 WL 323710 (N.Y. Sup. Ct. May 24, 1995)....12, 13 Sutton v. Vermont Reg'l Ctr., 2019 VT 71 (Vt. Oct. 4, 2019) .......................................... 12 Terry v. O'Brien, 2015 VT 132, 200 Vt. 511, 134 A.3d 203 (2015)................................. 71 U.S. Dep’t of Justice v. Reporters Comm. For Freedom of Press, 489 U.S. 749 (1989).... 52, 55, 56 U.S. v. Facebook, Inc., 2020 WL 1975785 (D.D.C. Apr. 23, 2020) ................................. 26 Universal City Studios, Inc. v. Corley, 273 F.3d 429 (2d Cir. 2001).......... 29, 30, 31, 32 Votto v. Am. Car Rental, Inc., 871 A.2d 981 (Conn. 2005) .............................................. 64 Wendorf v. Landers, 755 F. Supp. 2d 972 (N.D. Ill. 2010) ........................................ 58, 59 Woodwinds, Inc. v. Dimeo, 229 F.3d 1136, 2000 WL 1425161 (2d Cir. 2000)............. 58 Zeran v. AOL, 129 F.3d 327 (4th Cir. 1997) ................................................... 13, 15, 16, 22 Statutes 10 V.S.A. § 488........................................................................................................................... 55 9 V.S.A. § 2430........................................................................................................................... 70 9 V.S.A. § 2445........................................................................................................................... 70 vii 9 V.S.A. § 2457........................................................................................................................... 71 9 V.S.A. § 2458....................................................................................................... 11, 35, 73, 76 9. V.S.A. § 2435 ......................................................................................................................... 70 Section 230 of the Communications Decency Act, 47 U.S.C. § 230 .......................passim Vermont Consumer Protection Act, 9 V.S.A. § 2451 .................................................passim Vermont Fraudulent Acquisition of Data Law, 9 V.S.A. § 2431 ............................passim Other Authorities Alexander H. Tran, The Internet of Things and Potential Remedies in Privacy Tort Law, 50 Colum. J.L. & Soc. Probs. 263 (2017) ........................................................ 46, 48 FTC Policy Statement on Unfairness (Dec. 17, 1980) ............................................... 57, 61 General Assembly, Act 171 of 2018 (Vt., enacted Jan 1., 2019) ..................................... 74 Jane Yakowitz Bambauer, The New Intrusion, 88 Notre Dame L. Rev. 205 (2012).... 48 Nancy Yue Liu, Bio-Privacy, Privacy Regulation and the Challenge of Biometrics, 177 (2012)......54 Restatement (Second) of Torts § 652A (1977) .................................................................... 47 Samuel D. Warren & Louis D. Brandeis, Right to Privacy, 4 Harv. L. Rev. 193 (1890)........51 The Perpetual Line-up: Unregulated Police Face Recognition in America, Georgetown Law Center on Privacy & Technology (Oct. 18, 2016) .......................... 42 U.S. v. Durachinsky, No. CR 18-00022 (E.D. OH, Jan. 10, 2018) (Indictment) ......... 27 Yana Welinder, A Face Tells More Than A Thousand Posts: Developing Face Recognition Privacy in Social Networks, 26 Harv. J.L. & Tech. 165 (2012)............ 56 viii NOW COMES Plaintiff State of Vermont (the “State”) to oppose the Motion to Dismiss made by Defendant Clearview AI, Inc. (“Defendant” or “Clearview”). The State respectfully requests that the Court hear oral argument on the motion. INTRODUCTION This action was filed by the Vermont Attorney General on behalf of the State of Vermont pursuant to the Vermont Consumer Protection Act, 9 V.S.A. § 2451 et seq. (“CPA”) and Vermont’s Fraudulent Acquisition of Data Law, 9 V.S.A. § 2431 (“FADL”), for which the State seeks injunctive relief and penalties. The State alleges that Clearview committed unfair and deceptive acts and practices in violation of the CPA relating to its collection of billions of photographs, including those of Vermonters, without the consent of the owners or their subjects; applying facial recognition technology to them; and creating a surveillance tool which exposes Vermonters to significant harms. Clearview’s collection methods also violated Vermont’s Fraudulent Acquisition of Data Law. At stake in this matter is Vermont’s ability to enforce its consumer protection act, specifically to protect Vermonters from unfair or deceptive acts that interfere with the rights to privacy and anonymity of Vermont’s citizenry. We should be able to walk down the street, go to the doctor, attend a rally, or have dinner in a restaurant without being surveilled and instantly identified by any stalker, con artist, or overreaching government official. The technology to accomplish this has existed for a decade, but prior to Clearview, no American business was willing to 1 implement it because they recognized that to do so would be unconscionable. Complaint ¶¶ 16-18 (hereinafter “Compl.”). 1 Defendant seeks to dismiss the State’s Complaint under Vermont Rule of Civil Procedure 12(b)(6) and contends that the State’s complaint “fails to state a claim under the Vermont Consumer Protection Act, the Vermont Data Protection Act or other law, and it is prohibited by federal Constitutional, statutory and common law which is supreme to Vermont law, including the First, Fourth, Fifth, and Fourteenth Amendments to the United States Constitution.” Defendant’s Motion to Dismiss (“MTD”) at 2. However, other than incorporating its Memorandum of Law In Opposition to Vermont’s Motion For a Preliminary Injunction (“Opp.”) by reference (since it did not attach a Memorandum of Law), Clearview does not elucidate which arguments support its specific legal theories on its Motion to Dismiss and which apply to its Opposition to the Preliminary Injunction. Id. at 1. The State reads Defendant’s motion to dismiss to argue that: (1) Vermont’s Action is preempted by Section 230 of the Communications Decency Act, 47 U.S.C. § 230; (2) the remedies that Vermont seeks would violate Defendant’s rights under the First Amendment; (3) Vermont’s Action is void for vagueness under the Fifth and Fourteenth Amendments; (4) Vermont lacks standing to bring this action; and In 2011, Google’s then-CEO stated, “We built that technology and we withheld it. . . As far as I know, it’s the only technology Google has built and, after looking at it, we decided to stop. Compl. ¶ 17. 1 2 (5) Vermont cannot sue defendant in Chittenden County. The State responds to each of these arguments herein. It is unclear from Defendant’s filings what the basis for dismissal would be under the Fourth Amendment, so the State cannot address that point. To the extent the State has overlooked an argument that properly applies to Clearview’s Motion to Dismiss (as opposed to its Opposition to a Preliminary Injunction), that argument will be addressed in the State’s forthcoming Reply Memorandum in Support of its Motion for a Preliminary Injunction. BACKGROUND AND FACTS I. The State’s Allegations As described below, the Complaint alleges that Clearview has engaged in the following unfair acts and practices in violation of the CPA: a. screen scraping billions of photographs without the consent of their owners, many of which had been uploaded subject to Terms of Service of websites which limited how they could be used (Compl. ¶¶ 37-46); b. collecting, storing, analyzing and distributing the photographs of minors without the consent of their parents or guardians (Compl. ¶¶ 47-55); c. invading the privacy of consumers (Compl. ¶¶ 13, 15); d. failing to provide adequate data security for the data it has collected (Compl. ¶¶ 63-68); e. exposing consumers’ sensitive personal data to theft by foreign actors and criminals (Compl. ¶ 67); 3 f. violating the civil rights of consumers by chilling their freedoms of assembly and political expression (Compl. ¶ 23); g. violating the rights that consumers have as to the display and distribution of their photographs and other property rights (Compl. ¶ 38); and h. exposing citizens to the threat of surveillance, stalking, harassing, and fraud (Compl. ¶¶ 15, 23). Clearview’s deceptive acts include making materially false or misleading statements regarding: a. the ways that Vermont consumers can assert their privacy rights to opt out of the product (Compl. ¶¶ 56-60); b. that Clearview’s processing of consumers’ personal data does not unduly affect their interests or fundamental rights and freedoms (Compl. ¶¶ 5960); c. the strength of its data security (Compl. ¶¶ 61-68); d. that the product is only used by law enforcement agencies and is not publicly available (Compl. ¶¶ 30-32); e. that it removes consumers from its database to comply with relevant laws (Compl. ¶¶ 50-51); f. the accuracy of its facial recognition matching product (Compl. ¶¶ 71-73); and g. its success in assisting law enforcement investigations (Compl. ¶¶ 74-75). 4 Finally, Clearview’s use of screen scraping technology constitutes fraudulent acquisition of brokered personal information in violation of the FADL (Compl. ¶¶ 83-86). II. Clearview Collects and Stores 3,000,000,000 Photos Clearview AI is a small startup technology company. Compl. ¶ 24. Clearview uses and sells a proprietary facial recognition technology as applied to a database of photographs that it collected through screen scraping. Compl. ¶ 24. Clearview’s owner is Hoan Ton-That, a California resident with a history of allegedly developing spurious “phishing” technology in order to send “spam.” Compl. ¶¶ 26-28. Clearview used a technological process known as “screen scraping” to automatically gather approximately three billion online photographs. Compl. ¶ 24. This process indiscriminately collects the photos of adults and children alike. Compl. ¶ 50. “Screen scraping” refers to using an automated process, sometimes called a “spider” or “crawler,” to mass-download information from internet websites. This technique bypasses the intended use and limitations of the websites and their publishers. Compl. ¶¶ 39, 43-44. Clearview used scraping technology to gather photos from countless internet sites including Google, Facebook, Twitter, YouTube, Venmo, and LinkedIn, among others. Compl. ¶ 43. Many of these websites contain terms of service with prohibitions on screen scraping and implement technology to attempt to prevent screen scraping. Id. The Complaint alleges that Clearview’s scraping violated these contracts and terms of service and bypassed those technological protections, and 5 several of the websites sent cease and desist or similar letters to Clearview as a result. Compl. ¶¶ 43. Clearview also did not obtain any rights to the photos it collected. Compl. ¶¶ 38, 41-42 or obtain consent either the owners of any of the photos, or the individuals pictured in those photos, to use their images. Compl. ¶¶ 42, 45, 54-55. III. Clearview Uses Facial Recognition AI to Match People In addition to collecting and storing billions of photos, Clearview developed a facial recognition algorithm. Compl. ¶ 24. Users of Clearview’s app can upload a photo of an individual and the Clearview technology will return, in real time, all of the photos in its database in which that person appears. The person could be in a crowd, the background, or even a reflection in a mirror. Clearview does this by mapping the person’s facial features to create a biometric “fingerprint” of the person being searched, and then finds that fingerprint in other photos. Compl. ¶¶ 11-13. Clearview returns to the user an indicator of where that photo exists on the internet. Combined with other readily available tools or data sources, there is no limit to obtaining other identifiable and personal details like addresses, locations, relatives, friends and associates, etc. Compl. ¶ 15. For example, using this app, one could go to a public park, a shopping center, or a protest, and then photograph individuals and instantly find their LinkedIn profiles. In fact, The New York Times reported that wealthy investors were using the app for exactly this purpose. Compl. ¶ 31. Facial recognition technology in general is highly controversial. It is often inaccurate, particularly with respect to persons of color, and it is so new and 6 emergent that there are few or no legal safeguards and protections against abuse and misuse. See Compl. ¶¶ 14-18. Many businesses and municipalities even refuse to use facial recognition technology for the purposes Clearview has. See Compl. ¶¶ 16-17; 21-22. IV. Clearview Has Shared Its Technology Indiscriminately Clearview claims that its app is not publicly available and that its app is exclusively for law enforcement to conduct their own searches. Compl. ¶ 30. As a result of a recent data breach, Clearview’s customer list was stolen. Compl. ¶ 64. Clearview’s customers reportedly included some of the largest U.S. businesses such as: Best Buy, Macy’s, Kohl’s, Walmart, Albertsons, Home Depot, Rite Aid, AT&T, Verizon, and T-Mobile. Compl. ¶ 31. They also included banks (Wells Fargo and Bank of America) and other large organizations (Las Vegas Sands Casino, Equinox Fitness, Madison Square Garden, the NBA, and more than 50 universities). Id. Clearview has even provided its app to other countries like Saudi Arabia and the United Arab Emirates. Id. Clearview also gave access to its app to the company’s investors, clients and friends. Id. As The New York Times reported, the app was a “perk” for investors and a “plaything of the rich”; as one investor stated, people would “use it on themselves and their friends to see who they look like in the world . . . It’s kind of fun for people.” Id. In marketing its app, Clearview pushes the unrestricted nature of its technology. In one promotional email sent by Clearview: Clearview recommended 7 searching “friends or family [o]r a celebrity” and told users of the app “to run wild with your searches.” Compl. ¶¶ 33-34. V. Clearview Misrepresents its Product The Complaint alleges that Clearview makes several materially false and misleading claims about its product. First, Clearview has a Privacy Policy and claims that members of the public have express “data protection rights,” including rights to remove and erase their photos from the app, and that Clearview will comply with those requests. Compl. ¶ 56. In fact, these rights are subject to a limitation by Clearview, which states that it will only honor a deletion request in jurisdictions where there is a regulation requiring them to do so. Compl. ¶ 57. For example, the “data protection rights” cited by Clearview are those conferred upon citizens in the European Union. There is no United States federal law that provides these rights, and the only State law that provides any similar explicit rights exists in California, and only applies to California citizens. Compl. ¶¶ 57-58. The Complaint alleges that Clearview’s claims—made to assuage privacy fears—are materially false and misleading with respect to all non-California U.S. residents, including Vermonters. Id. Clearview falsely states that it “actively work[s]” to remove images of minors from California and that it can “process[] all opt-out requests” Compl. ¶ 50 but, to the State’s knowledge, Clearview currently has no such capability to detect and remove minors’ photos or even any photos based on age or geographic location. Compl. ¶ 51. Second, Clearview claims that it “secure[s] all personal information that we store on computer servers in a controlled, secure environment, protected from 8 unauthorized access, use or disclosure” and that it uses “appropriate physical, technical and organizational measures.” Compl. ¶ 61. As mentioned, above, Clearview suffered a data breach. Compl. ¶ 64. Clearview has created a misimpression that its data is being stored with reasonable data security, which is materially false and misleading. Id. See also Compl. ¶¶ 61-65. Finally, Clearview made other deceptive claims as well, including that its product is only used by law enforcement and that it enforces a code of conduct with regard to that use. Compl. ¶ 30. Despite this self-described limitation, Clearview markets its app with no restrictions, encouraging users “to run wild” with their searches and highlighting how searches are “never stored.” Compl. ¶ 33. Based on the facts alleged in the Complaint and for the reasons set forth below, Defendant’s motion to dismiss should be denied. ARGUMENT The State’s argument is as follows: First, Section 230 of the Communications Decency Act does not confer the type of broad immunity that Clearview claims and does not apply to the situation at hand. It was not drafted to address the type of case or claims that the State brings, it has never been found to apply to this type of case by any court, and the plain language of the statute shows that it is inapplicable. Second, no court has ever found that software such as Clearview’s was entitled to First Amendment protections, as this software is simply not expressive speech. Furthermore, several of the State’s claims arise from Clearview’s acts and statements that do not involve the operation of its software, such as its 9 inappropriate collection and unsafe storage of data, and its misleading statements. If Clearview’s software were somehow speech, it would be the type of commercial speech that the State’s lawsuit can restrain under settled constitutional analysis. Third, Clearview had sufficient notice of the claims to satisfy due process. The CPA’s broad prohibition against unfair and deceptive conduct is sufficiently clear to businesses that any conduct in violation of common law or public policy is prohibited. As this Court recently stated, “a precise statute or declaration directly discussing” the unfair conduct is not necessary to satisfy due process. State v. Big Brother, No. 326-4-20 Cncv, Dec. on Prelim. Inj. (Apr. 27, 2020) (attached as Exhibit A). Fourth, the CPA applies to Clearview. According to numerous cases, unfair conduct indisputably includes a host of technological intrusions that implicate privacy concerns. The consumers in Clearview’s database had no reasonable expectation that a photo uploaded to a specific website would result in a mass surveillance and identification system. Consumers did not relinquish their privacy rights, especially the right to anonymity. Further, Clearview made several key misrepresentations that are actionable by the State on behalf of consumers, regardless of whether they are customers of Clearview. Fifth, the FADL claims are appropriate in that the data Clearview collected fall within the definition of “Brokered Personal Information” and Clearview’s screen-scraping practices constitute consumer fraud. 10 Sixth, the State has standing to bring its case as a quasi-sovereign and parens patriae. Even under Clearview’s (incorrect) analysis, the State would have standing because it has sufficiently pled a privacy injury. Finally, Clearview misinterprets 9 V.S.A. § 2458 and regardless, this Court is an appropriate venue for this matter as Clearview has done business in Vermont, including in Chittenden County. I. Standard on a Motion to Dismiss The Court should deny a Rule 12(b)(6) motion unless “it is beyond doubt that there exist no facts or circumstances that would entitle the plaintiff to relief.” Richards v. Town of Norwich, 169 Vt. 44, 48, 726 A.2d 81, 85 (Vt. 1999); Elkins v. Microsoft Corp., 174 Vt. 328, 330, 817 A.2d 9, 12 (2002). The facts pled in the State’s Complaint and all reasonable inferences that can be derived from those facts are assumed to be true. Id. Assertions pled in Defendant’s Motion to Dismiss that contradict the State’s pleadings should be assumed false. Richards, 169 Vt. at 49, 726 A.2d at 85. The court may consider documents referred to in the Complaint, as well as matters subject to judicial notice such as statutes, regulations, and matters of public record. Kaplan v. Morgan Stanley & Co., 2009 VT 78, ¶ 10, n.4; 186 Vt. 605, 609; 987 A.2d 258, 264 (2009). 2 Defendant introduced several facts outside what the State pled in its Complaint and appended three Affidavits. The Court should not consider this extraneous information to the extent it contradicts the allegations in the Complaint. Otherwise, this information only further counsels denial of the motion to dismiss so that the State can rebut the factual assertions through discovery. Richards 169 Vt. at 49, 726 A.2d at 85 (“We . . . assume that all contravening assertions in defendant's pleadings are false.”) 2 11 Vermont’s Rules of Civil Procedure only require a “short and plain statement of the claim showing that the pleader is entitled to relief.” Sutton v. Vermont Reg'l Ctr., 2019 VT 71, ¶ 20 (Vt. Oct. 4, 2019). This policy seeks to encourage valid causes of action despite the possible need for further discovery while discouraging baseless complaints and recognizes that the plaintiff need not prove the merits of its case in the opening pleading. Id. (citing Colby v. Umbrella, Inc., 2008 VT 20, ¶ 13, 184 Vt. 1, 955 A.2d 1082 (2008)). II. Section 230 of the Communications Decency Act is Inapplicable to the State’s Claims A. Overview of Section 230 of the Communications Decency Act Section 230 of the Communications Decency Act of 1996, 47 U.S.C. § 230 (“Section 230”) states, “No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider.” 47 U.S.C. § 230(c)(1). Section 230 was passed to address a specific situation that was generating inconsistent decisions in the courts. Stratton Oakmont, Inc. v. Prodigy Servs. Co., 1995 WL 323710 (N.Y. Sup. Ct. May 24, 1995) (unpublished), the case which spurred the passage of the statute, is illustrative of the scenario which Section 230 addresses. In that case, an anonymous individual posted allegedly defamatory statements on an internet message board run by Prodigy (an early dial-up Online Service Provider). Id. at *2. Plaintiffs, claiming injury from the statements, sued Prodigy as the “publisher” of the statements. Id. The Prodigy court found that the defendant could be held liable for the defamatory statements posted on its service. 12 Id. at *5. Congress, fearing that if platforms like Prodigy, which it termed “Interactive Computer Services,” could be sued for any content posted by a thirdparty, it would stifle free expression and the growth of the internet. Section 230 was passed to overturn the Prodigy ruling and provide a defense to Interactive Computer Services in this circumstance. See FTC v. LeadClick Media, LLC., 838 F.3d 158, 173 (2d Cir. 2016); Barnes v. Yahoo!, Inc., 570 F.3d 1096, 1099 (9th Cir. 2009). Every case cited by Clearview in which Section 230 was found applicable follows this same pattern: a third party (who is not party to the suit) posts offensive (defamatory, fraudulent, discriminatory or otherwise harmful) content to the internet. 3 Specifically, the third party places the content on the defendant’s platform which distributes the offensive message. The third party is usually anonymous, unreachable, or judgment proof, so the plaintiff instead sues the defendant, usually a large web service that offers message boards, chatrooms, or Prodigy, 1995 WL 323710 at *1 (defamatory statements on an internet bulletin board); Saponaro v. Grindr, LLC, 93 F. Supp. 3d 319, 321 (D.N.J. 2015) (underage sexual solicitation on a dating profile hosting app); Green v. America Online (AOL), 318 F.3d 465, 469-70 (3d Cir. 2003) ) (malware posted on chat room); Barnes, 570 F.3d at 1098 (fraudulent profile/revenge porn on chat room); Gibson v. Craigslist, Inc., 2009 WL 1704355, *1 (S.D.N.Y. June 15, 2009) (advertisement of “hazardous object,” a handgun later used to commit a crime on classified ad site); Jones v. Dirty World Entm’t Recordings LLC, 755 F.3d 398, 403 (6th Cir. 2014) (defamatory content on gossip-focused message board); Zeran v. AOL, 129 F.3d 327, 329 (4th Cir. 1997) (fraudulent, defamatory advertisement on bulletin board); Jane Doe No. 1 v. Backpage.com, LLC, 817 F.3d 12, 16 (1st Cir. 2016) (ads for sextrafficked minors on classified ad site); Seldon v. Magedson, 2012 WL 4475274, *1 (S.D.N.Y. July 10, 2012) (defamatory statements on business review site); Fair Hous. Council of San Fernando Valley v. Roommates.com, LLC, 521 F.3d 1157 (9th Cir. 2008) (discriminatory statements on classified ad site); O’Kroley v. Fastcase Inc., 2014 WL 2881526, *1 (M.D. Tenn, June 25, 2014) (defamatory content on search engine). 3 13 classified ads. The plaintiff’s claims in those cases, which arise out of the offensive content, plead that the defendant is the “publisher” of the offensive third-party content. This is the specific type of claim which Section 230 bars. No Vermont court has interpreted Section 230. 4 While some federal circuit courts have interpreted Section 230 broadly, FTC v. LeadClick, 838 F.3d at 173, no court has interpreted Section 230 to provide the “near absolute immunity” that Clearview claims. Opp. 10. Though the Courts do frequently use the shorthand “Section 230 immunity,” the Ninth Circuit has noted that Section 230 never mentions the word “immunity” and that “[l]ooking at the text, it appears clear that neither this subsection nor any other declares a general immunity from liability deriving from third-party content.” Barnes, 570 F.3d at 1100. No court has found that Section 230 applies in the situation presented here, as neither the policy behind Section 230 nor the statute’s plain language provides Clearview with the immunity it claims. The analysis generally adopted by the Courts requires that three elements be met in order to find that Section 230 applies: “(1) [the defendant] is a provider or user of an interactive computer service, (2) the claim is based on information provided by another information content provider and (3) the claim would treat [the Section 230 is addressed in dicta in Renzello v. Nelson, No. 1:05-CV-00153-JGM, 2015 WL 13685375, at *2 (D. Vt. May 20, 2015), vacated, No. 1:05-CV-00153-JGM, 2015 WL 5177778 (D. Vt. Sept. 4, 2015) (Noting that print-based content is treated differently than web-based content under Section 230). 4 14 defendant] as the publisher or speaker of that information.” FTC v. LeadClick, 838 F.3d at 173 (quoting Jane Doe No. 1, 817 F.3d at 19). B. Clearview is an Interactive Computer Service The statute defines “Interactive Computer Service” as “any information service, system, or access software provider that provides or enables computer access by multiple users to a computer server. . .” 47 U.S.C. § 230(f)(2). This is a very broad definition that arguably captures every website, mobile application, or cloud-based tool. Clearview appears to be a provider of an Interactive Computer Service under a plain reading of the statute. C. The State’s Claims Are Not Based on Information Provided by Another Information Content Provider It is under the second prong (that the claim is based on “information provided by another information content provider”) that Clearview’s argument begins to fall apart. The plain language of the section can be distilled into three elements, all of which must be met for this prong to be true: 1. The plaintiff’s claims arise out of the information at issue; 5 2. The information at issue was provided to the defendant; and 3. The information at issue was not created by the defendant but was instead created by a third-party. 6 Zeran, 129 F.3d at 330-31 (Congress decided against “imposing tort liability on companies that serve as intermediaries for other parties' potentially injurious messages.”). 5 FTC v. Accusearch, 570 F.3d 1187, 1199 (10th Cir. 2009) (“[A]n interactive computer service that is also an “information content provider” of certain content is not immune from liability arising from publication of that content.”) 6 15 1. The State’s claims do not arise from photographs posted on the internet The reason Section 230 was created, as demonstrated in every case upholding Section 230, was to prevent a plaintiff from bringing a tort claim against an Interactive Computer Service that should properly be brought against the third party (“Another Information Content Provider”) who created the information from which the claim arises. This means that the information itself must be somehow injurious. Zeran, 129 F.3d at 330. In Section 230 cases, the information at issue is always defamatory and/or fraudulent, 7 discriminatory, 8 or otherwise harmful. 9 The plaintiff’s claim is always one that could have been asserted against the third party but was instead brought against the Interactive Computer Service. The entire purpose of Section 230 is to shield defendants from such claims. The injurious information that Clearview claims gives it Section 230 immunity are the photographs that it screen-scraped. But the photographs themselves, as they were posted on the internet by their owners, are not injurious, and do not give rise to any of the State’s claims. Put another way, the State’s cause Stratton, 1995 WL 323710 at *1; Barnes, 570 F.3d at 1098; Jones v. Dirty World, 755 F.3d at 403; Zeran, 129 F.3d at 329; Seldon, 2012 WL 4475274 at *1; O’Kroley, 2014 WL 2881526 at *1. 7 8 Fair Hous. Council v. Roommates.com, 521 F.3d at 1173. Saponaro, 93 F. Supp. 3d at 321; Green, 318 F.3d at 469-70; Gibson, 2009 WL 1704355 at *1; Jane Doe No. 1, 817 F.3d at 16. 9 16 of action is not properly against millions of individuals who posted anodyne photographs on the internet. The State’s claims are not based on the specific information at issue. The photographs themselves do not give rise to any of these claims. The State’s claims are for unfairness, deception, and fraudulent acquisition of data. Compl. ¶¶ 76-86. Specifically, Clearview’s conduct in acquiring the photographs through fraudulent means (see Section VI infra, discussing use of term “fraudulent”), storing them without proper security, applying facial recognition technology in a manner meant to violate privacy and infringe civil rights, and providing access to the database to whomever wanted it without concern for the safety or rights of the public, give rise to the State’s claims. 2. The photographs were not provided to Clearview Section 230 requires that the information at issue be provided by the thirdparty content provider. Again, the common thread in Section 230 cases is that the Information Content Provider posted the offensive information on the defendant’s servers. Here, no Vermont consumer could have intentionally provided any photographs to Clearview’s servers, because prior to the discovery in January of this year that Clearview had 3 billion photographs in a New York Times exposé, the general public did not know that Clearview existed. Compl. ¶ 29. Clearview collected, or more accurately, fraudulently acquired, these photos through its screen-scraping. It was not given these photographs by the third party. 17 3. If Section 230 applied, Clearview would be the “Information Content Provider” The State reiterates that the framework for analyzing Section 230 does not apply here because the State’s claims are not for defamation or other types of actions that necessarily arise out of specific information and therefore do not meet the second prong. This part of the test asks whether the claims are based on information that was “provided by Another Information Content Provider” (a thirdparty), as opposed to information that was created by the defendant. Section 230 defines “Information Content Provider” as “any person or entity that is responsible, in whole or in part, for the creation or development of information provided through the Internet or any other interactive computer service.” To the extent that State’s claims are “based on” any information that was created or developed, it is the biometric fingerprints that Clearview generated through its facial recognition algorithms that threaten to cause the privacy and civil rights harms that are the basis for the State’s case. Compl. ¶¶ 11-13. This information was entirely and solely created by Clearview. The photographs themselves, which were arguably provided by “Another Information Content Provider” do not give rise to the State’s claims. Clearview’s own conduct of biometric analysis and biometric fingerprint indexing does. See Opperman v. Path, Inc., 84 F. Supp. 3d 962, 987 (N.D. Cal. 2015) (denying motion to dismiss, and holding that Apple and its apps were not entitled to “blanket CDA immunity” because they “contributed to the creation of the offensive content.”) Indeed, even Clearview’s own 18 description reveals this fact. See Opp. 4 (“All of the data created by the neural net algorithm is stored on secured servers separate from the database of photos”). This statement confirms that “the data” in Clearview’s database was “created” by Clearview per its “neural net algorithm”. Id. This matter is similar to FTC v. Accusearch, 570 F.3d at 1199, in which the defendant committed unfair acts by publishing private telephone records. After a lengthy analysis, the court concluded that “a service provider is ‘responsible’ for the development of offensive content only if it in some way specifically encourages development of what is offensive about the content.” Id. The court denied Section 230 protection to the defendant. Id. at 1201. Here, what is offensive about the content is the incorporation of facial recognition technology, which was solely the responsibility of Clearview. 4. Clearview’s “search engine” argument is a red herring Clearview argues that Clearview is a search engine and search engines are protected by Section 230. Clearview’s attempt to position itself as a search engine like Google or Bing would accomplish two goals. First, it would frame its product as something familiar and harmless, even beneficial. Second, it facilitates Clearview’s attempt to fit its product into existing case law. Defendant is wrong on both counts: Defendant’s software application that permits users to identify strangers using facial recognition (the “Clearview App”) is not a search engine as the term is generally understood, and even if it were, the law does not provide any sort of blanket immunity for search engines under Section 230. 19 First, Clearview is not a search engine like Google or Bing. Clearview’s App does something that no other company operating in the United States, including search engine companies, has ever done. In fact, search engine companies that are capable of creating a product like Clearview’s refused to do so for ethical reasons. Compl. ¶¶ 16-18, 52. Defendant cites half of the Merriam Webster dictionary definition of “search engine” to support its position. Opp. 13 (quoting the first half, which states: “computer software used to search data (such as text or a database) for specified information.”). The other half is: “a site on the World Wide Web that uses such software to locate key words in other sites.” 10 This definition of search engine more accurately describes the search engines that various courts have considered. It is also the definition that is more widely accepted, as a number of other sources will attest: Cambridge English Dictionary: “a computer program that finds information on the internet by looking for words that you have typed in.” 11 Techopedia: “Search engine is a service that allows Internet users to search for content via the World Wide Web (WWW). A user enters keywords or key phrases into a search engine and receives a list of Web content results in the form of websites, images, videos or other online data.” 12 Wikipedia: “A web search engine or Internet search engine is a software system that is designed to carry out web search (Internet search), which means to search the World Wide Web in a systematic way for particular 10 https://www.merriam-webster.com/dictionary/search%20engine (last visited 4/22/2020). https://dictionary.cambridge.org/us/dictionary/english/search-engine (last visited 4/22/2020). 11 https://www.techopedia.com/definition/12708/search-engine-world-wide-web (last visited 4/21/2020). 12 20 information specified in a textual web search query. The search results are generally presented in a line of results, often referred to as search engine results pages (SERPs). The information may be a mix of links to web pages, images, videos, infographics, articles, research papers, and other types of files.” 13 Note the commonalities – a search engine is commonly understood to be a website used for general internet searches based on inputting textual keywords or phrases. It also implies knowing a basic premise of what you are searching for, i.e., the name of a person or thing you are searching. It is not a surveillance tool specifically used to identify heretofore unidentified strangers. Internet search engines do not invoke the same privacy concerns that the Clearview App does. Internet search engines does not threaten to destroy the concept of anonymity or our ability to move about in the world free of surveillance by stalkers, con artists, or overreaching government. Second, even if the Clearview App were a search engine, there is simply no “search engine immunity” under Section 230, nor has any court found there to be. Clearview cites several cases in which search engines have benefited from Section 230. However, in each of these cases, the reason Section 230 applied was not because of any broad immunity for search engines. It was because the fact pattern followed those for which Section 230 was created. In each of those cases, the Information Content Providers had posted defamatory or fraudulent content, which was reposted by the search engine. 13 https://en.wikipedia.org/wiki/Web_search_engine (last visited 4/21/2020). 21 O’Kroley, 2014 WL 2881526 at *1 (false statements that the plaintiff was accused or convicted of a crime); Bennett v. Google, LLC, 882 F.3d 1163, 1167 (D.C. Cir. 2018) (blog post accusing plaintiff of various bad acts); Marshall's Locksmith Serv. Inc. v. Google, LLC, 925 F.3d 1263, 1265 (D.C. Cir. 2019) (scam locksmith websites that threatened plaintiff’s business); Parker v. Google, Inc., 422 F. Supp. 2d 492, 500–01 (E.D. Pa. 2006) (defamatory comments posted to USENET). 14 The plaintiff’s claims in those cases (for defamation, tortious interference with contract, intentional infliction of emotional distress, etc.), arose out of the offensive content. The plaintiff attempted to treat the search engine as the publisher in order to sue the search engine instead of the Information Content Provider and the courts held that this was not permissible under Section 230. This is not the fact pattern of the State’s case. The same result should not apply because the State’s claims (for unfairness and deception) are not based on the information (non-defamatory, harmful, or otherwise offensive photographs) published by another information content provider (the millions of individuals whose photographs Clearview screen-scraped). For the fact pattern to apply, the photographs themselves would have to somehow be unfair or deceptive and the State’s claims would more properly be brought against the individuals. Two of the cases cited by Defendant are incorrectly described as dealing with search engines. Barnes, 570 F.3d 1096 involved Yahoo!’s member directory and message board functions, and Zeran, 129 F.3d 327 concerned AOL’s message board service. In neither case is the publication associated with search engine functions. 14 22 D. The State’s Claims Are Not Based on Clearview Acting as a Publisher The final element of this somewhat tortured attempt to fit this case into the framework of Section 230 also demonstrates the inapplicability of Section 230 to this situation. This is the requirement that the State’s claim would treat Clearview as the publisher or speaker of information provided by a third party. The question is not whether defendant is a publisher generally – it is whether the liability claim necessarily treats the defendant as a publisher. Barnes, 570 F.3d at 1102 (“What matters is whether the cause of action inherently requires the court to treat the defendant as the ‘publisher or speaker’ of content provided by another.”). The prototypical situation is where, in an action for defamation, the plaintiff attempts to treat the defendant as the publisher of the defamatory information. The State’s case is based on three causes of action: unfairness, deception, and fraudulent acquisition of data. The acts and practices supporting the State’s unfairness claims have nothing to do with speaking or publication. See generally Section I, Background and Facts, pp. 3-9. They relate to Clearview’s conduct. For example, failing to implement reasonable data security does not require the court to treat the defendant as a publisher or speaker at all. Thus, Section 230 is inapplicable to these claims. While the State’s claims grounded in deception do involve speech, it is speech made in Clearview’s internally generated marketing materials, not speech based on any third-party information. Id. at 8-9. Again, none of those acts are based on Clearview being a “publisher or speaker of any information provided by another.” For example, making misleading statements about the strength of its data security 23 or over whether consumers are able to opt out of their database does not make Clearview a “publisher” under Section 230. Lastly, the fact that Clearview fraudulently acquired data is unrelated to publishing or speaking of any sort. As none of the claims described rely on Clearview being the publisher or speaker of information provided by another, Clearview cannot claim protection from liability under Section 230. III. First Amendment Protections Do Not Apply Here Clearview contends that the State’s claims should be dismissed because the First Amendment’s protection of expressive speech applies to its software. This argument also fails for several reasons: 1. Many of the harms that the State alleges do not arise from the Clearview App itself but from Clearview’s unfair conduct, which involves no speech or expression; 2. Clearview’s deceptive marketing and public statements are not protected by the First Amendment; 3. The Clearview App is not protected by the First Amendment, and even if it were, the State’s lawsuit would survive the intermediate scrutiny applied to commercial speech, or even strict scrutiny by this Court. A. The State Asserts Claims that Are Unrelated to Speech For the same reason that the State’s claims described in the previous section do not rely on Clearview “publishing” any information, they do not rely on any sort of speech or other expression by Clearview. 24 None of the acts based on Clearview’s conduct listed on page 4 are protected by the First Amendment. The First Amendment does not give a business the right to store sensitive data in an insecure manner, to expose consumers’ information to theft and resultant harms, to collecting consumers’ photographs without their consent, or to invade their privacy. B. The First Amendment Does Not Protect Deceptive Statements All of the claims listed on page 4 relate to materially false and misleading statements made by Clearview in its marketing materials and on its website. These statements are commercial speech because they constitute “expression related solely to the economic interests of the speaker and its audience.” Cent. Hudson Gas & Elec. Corp. v. Pub. Serv. Comm'n of New York, 447 U.S. 557, 561 (1980). There is no protection under the First Amendment for commercial speech that is false, misleading, or concerns unlawful activity. Fla. Bar v. Went For It, Inc., 515 U.S. 618, 623–24 (1995) (“The government may freely regulate commercial speech that concerns unlawful activity or is misleading.”); Edenfield v. Fane, 507 U.S. 761, 769 (1993) (“[T]here is no question that [the State’s] interest in ensuring the accuracy of commercial information in the marketplace is substantial”); In re Deyo, 164 Vt. 613, 614, 670 A.2d 793, 794 (1995) (“For commercial speech to come within [the First Amendment], it must at least concern lawful activity and not be misleading”) (quoting Edge Broadcasting, 509 U.S. 418, 424 (1993)). Here, None of Clearview’s misrepresentations about the scope of consumers’ privacy rights and their ability to opt out of Clearview’s database; the strength of Clearview’s data security; who has access to the Clearview App and for what 25 purposes; its ability to comply with the law; its success in assisting law enforcement investigations or the accuracy of its results are protected by the First Amendment. C. The Clearview App is Not Speech Clearview overstates how settled the law is regarding the First Amendment protections of software. Courts have looked at some specific instances where writers of software code sought constitutional protections in circumstances that vary significantly from this one. Only one type of software – video games – have been definitively established as subject to First Amendment protections, but Clearview’s surveillance app is not a video game, nor does it have the characteristics of a video game (described below) that justified their special status under the First Amendment. All software does not qualify as speech for First Amendment purposes, and certainly not Clearview’s facial recognition app. Defendant’s argument that its application is built from computer code, and that code is speech and therefore protected by the First Amendment, is flawed. This argument, if accepted by the Court, leads to the absurd result that no service provided by a business, if implemented through computer software, can ever be subject to regulation without facing a constitutional challenge. Facebook’s sharing of its customers’ data with Cambridge Analytica and other third parties, which resulted in Facebook paying a $5 billion fine to the FTC, would be protected speech. U.S. v. Facebook, Inc., 2020 WL 1975785, at *1 (D.D.C. Apr. 23, 2020). Stalking Apps and spyware installed on your phone to track your movements would be 26 protected speech. In re Retina-X Studios, LLC, No. C-4711 (F.T.C. Mar. 26, 2020). 15 Malware deployed to compromise your laptop and watch you through your camera would be protected speech. U.S. v. Durachinsky, No. CR 18-00022 (E.D. OH, Jan. 10, 2018) (Indictment). 16 See also In re of Lenovo (United States) Inc., No. 152-3134 (F.T.C. Sept. 5, 2017). 17 Clearview’s argument is equivalent to saying that no bookstore can violate consumer protection laws because books are protected by the First Amendment. Defendant also states that the Supreme Court held “that the gathering and distribution of the records by commercial data miners was speech protected by the First Amendment.” Opp. 28. While the Court did comment on the question of whether information is speech, the protected speech in that case was not the underlying information collected by data miners but the use of that information by pharmaceutical marketers. The State sought to restrict the speech of pharmaceutical marketers by denying them access to the information, while permitting access to that same information by academics. Sorrell v. IMS Health Inc., 564 U.S. 552,571 (2011). This was the basis on which the Supreme Court found a First Amendment Violation. Id. at 578-79. Available at: https://www.ftc.gov/enforcement/cases-proceedings/172-3118/retina-xstudios-llc-matter. (last visited 5/7/2020) 15 Available at: https://www.justice.gov/opa/pr/ohio-computer-programmer-indictedinfecting-thousands-computers-malicious-software-and (last visited 5/7/2020) 16 Available at: https://www.ftc.gov/news-events/press-releases/2017/09/lenovo-settles-ftccharges-it-harmed-consumers-preinstalled. (last visited 5/7/2020) 17 27 The equivalent in this case would be if the State were arguing that it approved of Clearview’s use by hospitals or universities, but not by merchants or law enforcement. This, however, is not the case. The State merely asks that Clearview remove the inappropriately acquired photos of Vermonters from its database, so they cannot be subjected to pervasive surveillance by anyone. And, like IMS, the underlying data collected by Clearview is not the issue. The Supreme Court has not ruled on the question of whether computer code is speech, nor has any court with controlling authority in this jurisdiction. There are two contexts in which courts have found that software contains expressive speech subject to constitutional protection. Neither situation is applicable here. 1. The Clearview App is not the type of software that has been held to merit First Amendment protections The Supreme Court has only addressed the First Amendment protections of computer software (as opposed to code) once. Video games merit constitutional protections because they are analogous to other types of constitutionally protected expressive entertainment. “Like the protected books, plays, and movies that preceded them, video games communicate ideas—and even social messages— through many familiar literary devices (such as characters, dialogue, plot, and music) and through features distinctive to the medium (such as the player's interaction with the virtual world). That suffices to confer First Amendment protection.” Brown v. Entm't Merchs. Ass'n, 564 U.S. 786, 790 (2011). The reasoning applied by the Court to find constitutional protection for video games is inapplicable here. The Clearview App is not analogous to a narrative work 28 like a play or a movie. Its role is not to communicate ideas or social messages. It does not make use of literary devices. The Clearview App exists to enhance surveillance and to eliminate anonymity. 2. The Clearview App, to the extent it might be considered “code,” does not fall within First Amendment protections The second circumstance in which courts have found that software contains expressive speech subject to constitutional protection is where the computer code itself communicates expressive elements to other computer programmers. This is the situation in Universal City Studios, Inc. v. Corley, 273 F.3d 429 (2d Cir. 2001), discussed extensively by Defendants. Corley involved a computer programmer who developed a program that could break the encryption on commercially produced DVDs so that they could be copied. Id. at 435. Importantly, the programmer distributed the object code for the program on his website, where it could be downloaded, read, and implemented by other computer programmers. Id. at 438-39. Defendants’ argument elides important concepts and terminology within the computer science world (terminology 9that even the courts use loosely on occasion). There are critical differences between a “computer language,” “source code,” “object code,” and the final executable “application” or “software” that you launch on your smart phone. All of these are at base made of “ones and zeros,” but their expressive capabilities are very different. The first three are the different stages of coding that 29 go into the development of the final product, the application. 18 A file shared at any one of these stages can be read by another computer programmer, and it is this sort of expression that some courts have found merits First Amendment protection. Once the application is deployed to a smart phone, it is not presented in a format whereby the underlying code, object or otherwise, can be read by anything but the computer’s central processing unit. The only type of executable software ever held to merit Constitutional protection was a video game because of its equivalence to other narrative art forms. Brown, 564 U.S. at 790. The Second Circuit explained that code can communicate in three ways, each of which has different potentials for First Amendment protection. The first two were “to the user of the program (not necessarily protected) and to the computer (never protected).” Id. at 449. The third was “to another programmer.” Id. Corley was entirely concerned with this third type of communication, which is not at issue here because the State’s action relates only to Clearview’s distribution of an application to end-users, not human-readable source code or object code. Put another way, the first two types of communication involve the code actually running on the computer as an application, where the human user’s primary interaction is launching the software and mechanically following the application’s prompts. In the third type, the code itself is being reviewed by human “Source code” is an instruction set written in a “computer language” like C, C++, Java (the official programming language for Android Apps), or Swift (the language for Apple iPhone Apps). “Object Code” is a file containing low-level instructions (also called “machine language”) that is readable by a computer, or a very committed computer programmer. 18 30 beings, whether or not it is ever executed by a computer. This type of communication has been held to fall within the realm of expressive communication, which is rightly protected by the First Amendment. This third type of “code” was at issue in the other cases Clearview relies on as well. Def. Distributed v. U.S. Dep't of State, 838 F.3d 451, 454 (5th Cir. 2016) (text or computer assisted design (CAD) files containing specifications of firearms for printing on a 3D printer); Junger v. Daley, 209 F.3d 481, 484 (6th Cir. 2000) (source code posted on an academic website); and Sony Computer Entm't v. Connectix Corp., 203 F.3d 596, 598 (9th Cir. 2000) (object code for BIOS software). This matter involves an application which communicates its instructions to a computer, in this case a smart phone. This is not protected speech. To the extent that the Clearview App communicates with the user, it does so by providing links to photographs containing the individual whose photograph was input into the app. In this way, the Clearview App is acting no differently than Microsoft Excel when it mechanically outputs calculations in response to inputted formulae. (Defendant does not argue that this communication is protected speech). The situation here is much closer to a different Second Circuit case, Commodity Futures Trading Comm’n v. Vartuli, 228 F.3d 94 (2d Cir. 2000). That case involved a piece of software called Recurrence which engaged in futures trading advice. Users input market prices and Recurrence output a signal to buy or sell. Id. at 111. Code was not at issue in this case, just the system as marketed. As the Corley court noted, in that matter it was acceptable for the government to 31 regulate “Recurrence’s intended use because such use was devoid of any constitutionally protected speech.” Corley, 273 F.3d at 449. As a marketed system that more closely resembles Recurrence than the code at issue in Corley, the Clearview App does not fall within any of the contexts in which the Circuit Courts have identified a constitutional interest. Defendant, however, makes a leap of logic in its attempt to wedge the square peg of its application into the round hole of current jurisprudence. Defendant states: “Clearview AI's search engines - both those that index and cache public photos from the internet, as well as its facial biometric algorithm that searches those cached public photos, are computer languages the [sic] expressively convey information for a computer user to evaluate and act on.” Opp. 26. A search engine is not a computer language 19 – it is an application built from a computer language. 20 A facial recognition algorithm that searches cached photos is also not a computer language – it is a program that is built from a computer language. The user inputs a photograph, and the App extracts a biometric identifier and outputs other photographs containing that identifier. Adding the word It is unclear whether Defendant is using the phrase “computer language” as a synonym for “computer code” or for its common meaning, a language used to communicate with a computer to write code, the instruction set that a computer executes to perform actions. 19 The State also disputes Clearview’s characterization of its App as a search engine See Section II.C.4 supra. 20 32 “expressively” to this process does not magically convert this data output into constitutionally protected speech. D. To the Extent that the First Amendment Applies, the State’s Lawsuit is an Appropriate Regulation of Commercial Speech Defendant’s First Amendment analysis ignores the fact that Clearview is a business operating out of a profit motive. If this Court does determine that the Clearview App constitutes speech, then the appropriate First Amendment test is for commercial speech: In commercial speech cases, then, a four-part analysis has developed. At the outset, we must determine whether the expression is protected by the First Amendment. For commercial speech to come within that provision, it at least must concern lawful activity and not be misleading. Next, we ask whether the asserted governmental interest is substantial. If both inquiries yield positive answers, we must determine whether the regulation directly advances the governmental interest asserted, and whether it is not more extensive than is necessary to serve that interest. American Council of Life Insurers, et al. v. Vermont Dep’t of Banking, Ins., Sec., & Healthcare Admin., et al., No. 50-1-02WNCV, 2004 WL 578737, at *5 (Vt. Super. Feb. 12, 2004) (quoting Central Hudson, 447 U.S. at 566). 1. Clearview’s statements do not concern lawful activity and are misleading As previously noted, Clearview’s multiple misrepresentations about the use of the Clearview App, its data security, its willingness to let consumers opt out of its database, and its accuracy are misleading and therefore merit no constitutional protection. The reason these misrepresentations are significant is because Clearview’s modus operandi was to fly under the radar and expand its operations 33 while assuring the public that its product is legitimate and beneficial to society, its motivations are pure, and that neither consumers nor regulators need to worry because existing legal protections and internal policies will ensure that their privacy rights will be respected. As multiple journalists have pointed out and the State has asserted in its Complaint, none of this true. Deceptive statements merit no constitutional protection. Alexander v. Cahill, 598 F.3d 79, 89 (2d Cir. 2010) (“[T]he only categories that Central Hudson, and its sequellae, clearly excludes from protection are speech that is false, deceptive, or misleading, and speech that concerns unlawful activities.”) Even if this Court were to accept Clearview’s argument that the Clearview App itself is speech, that speech would not be protected because it unfairly and deceptively collects personal information without the consent of its owners, then uses that information to facilitate surveillance over those people. The State has adequately alleged that Clearview has engaged in unfair acts which are unethical, unscrupulous, against public policy, violate individuals’ privacy rights found within the penumbra of Constitutional, common law, and statutory protections, and is reasonably likely to lead to injury which consumers will be unable to avoid. Compl. ¶¶ 78-84. See also Section V infra. Thus, the State satisfied the first prong of the commercial speech analysis. 2. The State has a substantial interest in protecting the privacy and safety of consumers The second prong of the consumer speech analysis is also satisfied. It is uncontroversial that the State has a substantial interest in maintaining a fair and 34 honest commercial marketplace, 21 protecting the health and welfare of its citizenry, 22 and protecting the privacy of its citizens. 23 In fact, the Vermont Supreme Court has found that the State’s interest to protect individual privacy is compelling enough to withstand strict scrutiny. VanBuren, 2018 VT 95, at ¶ 48. The Attorney General has been statutorily instructed by the General Assembly to do exactly this in the CPA and the FADL. The State seeks to accomplish these goals in asking to have its citizenry removed from Clearview’s surveillance database. 3. This lawsuit directly advances the governmental interest This lawsuit satisfies the third prong of the commercial speech inquiry in that it seeks to have the images of Vermont citizens removed from Clearview’s facial recognition database to protect their privacy The State also seeks penalties for Clearview’s unfair and deceptive acts. Injunctive relief and civil penalties are the tools the legislature provided to the Attorney General to enforce the CPA and FADL and thereby protect the public. See 9 V.S.A. § 2458(a)-(b); 9 V.S.A. § 2431(b); 9 V.S.A. § 2451 (one of the purposes of the CPA is “to encourage fair and honest competition”); Grocery Mfrs. Ass'n v. Sorrell, 102 F. Supp. 3d 583, 640 (D. Vt. 2015) (“[T]here is no question that [the State’s] interest in ensuring the accuracy of commercial information in the marketplace is substantial”) (quoting Edenfield, 507 U.S. at 769). 21 9 V.S.A. § 2451 (another purpose of the CPA is “to protect the public”); Rubin v. Coors Brewing Co., 514 U.S. 476, 485 (1995) (recognizing the substantial governmental interest in “protecting the health, safety, and welfare of its citizens.”) 22 State v. VanBuren, 2018 VT 95, ¶ 57, 214 A.3d 791, 811 (Vt. 2019), as supplemented (June 7, 2019) (“The government’s interest in preventing any intrusions on individual privacy is substantial.”); Minnesota ex rel. Hatch v. Sunbelt Commc'ns & Mktg., 282 F. Supp. 2d 976, 982 (D. Minn. 2002) (“[T]he United States Supreme Court stated that the government has a substantial interest in protecting the public’s right to privacy.”) (citing Edenfield, 507 U.S. at 769). 23 35 State v. Int'l Collection Serv., Inc., 156 Vt. 540, 543, 594 A.2d 426, 429 (1991) (citing the CPA’s “broader” purpose “to protect the public”); State of N. Y. by Abrams v. Gen. Motors Corp., 547 F. Supp. 703, 707 (S.D.N.Y. 1982) (discussing tools of attorney general to seek restitution, penalties, and injunctive relief and noting that “wide-ranging injunctive relief” is “designed to vindicate the State’s quasi-sovereign interest in securing an honest marketplace for all consumers”). 4. The State does not seek remedies that are more extensive than necessary The State’s objective is to protect its citizens from being entered into a facial recognition database that will destroy their privacy and anonymity, without their affirmative consent. In satisfaction of the final prong of the commercial speech test, the State has done its best to determine the least burdensome means of accomplishing this goal. Removal of Vermont’s citizens will leave 99.8% or more of Clearview’s database intact. The State is not aware of a less burdensome remedy that will accomplish its goal. Having satisfied the four-part test for commercial speech, the State urges the court to reject Clearview’s request for First Amendment protection. IV. Clearview’s Void-for-Vagueness Argument Is Misplaced Clearview invokes the void-for-vagueness doctrine, claiming that it had no notice that Vermont law prohibits privacy intrusions. Opp. 42-43. This Court recently rejected a similar argument in the context of a preliminary injunction under the CPA. In State v. Big Brother, this Court 36 found that the unfairness standard of the CPA prohibits price gouging even without a price gouging statute. State v. Big Brother attached as Exhibit A. In relying on In re Palmer, this court noted that “[s]tatutory language that conveys a definite warning as to proscribed conduct when measured by common understanding and practices will satisfy due process.” Id. at 14 (quoting In re Palmer, 171 Vt. 464, 472, 769 A.2d 623, 628 (2000)). See also Brody v. Barasch, 155 Vt. 103, 110, 582 A.2d 132, 137 (1990) (A statute must be sufficiently clear to give a person of “ordinary intelligence a reasonable opportunity” to know what is proscribed and holding that “moral unfitness” to practice psychology is not impermissibly vague). Further, the standard in question does not need to be defined and does not need to detail each act that is prohibited. Id. at 111. Thus, in State v. Big Brother, this Court found that the general prohibition of the CPA provides sufficient notice to encompass a practice or conduct if it is reflected in a public policy or common law. State v. Big Brother at 14-15. See also Christie v. Dalmig, Inc., 136 Vt. 597, 601, 396 A.2d 1385, 1388 (1979). The same result is warranted here. Clearview is simply wrong in suggesting that Vermont needed to pass a specific law prohibiting unauthorized screen scraping and facial recognition of Vermonters. As this Court recently explained: The fact that there is not a precise statute or declaration directly discussing [the conduct] is not relevant. If a separate law or executive order was required to find a particular practice unfair under the Act, the Act would have little meaning. Moreover, the Sperry case expressly rejected the argument, concluding that in determining what is “unfair” the FTC may “consider[] public values beyond simply those enshrined in the letter or encompassed in the spirit of' other laws. Sperry. 405 U.S. at 244. 37 State v. Big Brother at 12 (citing FTC v. Sperry & Hutchinson Co., 405 U.S. 233, 92 S. Ct. 898, 31 L. Ed. 2d 170 (1972)). Here, the State relies on the same unfairness prohibition of the CPA. This includes unfair conduct based on privacy rights. Privacy is rooted in the common law in Vermont, just as in other jurisdictions. Denton v. Chittenden Bank, 163 Vt. 62, 655 A.2d 703 (1994); Hodgdon v. Mount Mansfield Co., 160 Vt. 150, 624 A.2d 1122 (1992). Clearview had notice that Vermont prohibits intrusions on privacy. E.g., VanBuren, 2018 VT 95, at ¶ 57 (“The government’s interest in preventing any intrusions on individual privacy is substantial.”). Further, consumer protection statutes are applied to a vast array of specific behaviors that themselves are not proscribed in any particular statute or text. For example, numerous privacy cases involve the secret tracking of internet websites for purposes of geo-targeted advertising. See McDonald v. Kiloo ApS, 385 F. Supp. 3d 1022, 1029 (N.D. Cal. 2019); FTC v. InMobi Pte Ltd, No. 3:16-cv-3474 (N.D. Cal. June 22, 2016). 24 There is no specific law covering this exact conduct. In McDonald v. Kiloo, there was no law against a gaming app collecting user data for geo-targeted advertising. The claim was brought and upheld under a general consumer protection statute for privacy violations. 385 F. Supp. 3d at 1029. Particularly in the realm of technology, the list could go on ad infinitum. States and the FTC are not required to pass a new law every time a new and Available at: https://www.ftc.gov/news-events/press-releases/2016/06/mobile-advertisingnetwork-inmobi-settles-ftc-charges-it-tracked (last visited 5/7/2020) 24 38 unscrupulous technological practice is brought to market. Otherwise, regulators would forever be playing legislative catch-up to unfair practices. That is the precise reason behind the broad proscriptive purpose of the CPA. See FTC v. Raladam Co., 316 U.S. 149, 152 (1942) (“One of the objects of the Act creating the Federal Trade Commission was to prevent potential injury by stopping unfair methods of competition in their incipiency.”); Fenwick v. Kay Am. Jeep, Inc., 371 A.2d 13, 15 (N.J. 1977) (purpose of consumer protection statute is “to prevent” deceptive and unfair conduct). Even a cursory review of the FTC’s ongoing actions against unfair technological practices illustrate this concept. 25 Lastly, Clearview’s due process challenge is reviewed under a less stringent standard. Because less is presumed to be at stake, provisions involving civil penalties are afforded more flexibility than those imposing criminal penalties. See Sessions v. Dimaya, 138 S. Ct. 1204, 1212, 200 L. Ed. 2d 549 (2018). Therefore, Clearview’s due process challenge based on vagueness does not meet its high burden. In re LaBerge NOV, 2016 VT 99, ¶ 18, 203 Vt. 98, 105, 152 A.3d 1165, 1170 (2016) (“the proponent of a [due process] challenge has a very weighty burden to overcome.”) (emphasis added; citations and quotation marks omitted). V. Vermont Has a Valid Claim for Unfair and Deceptive Conduct under the CPA Accepting all facts in the Complaint as true, the State has a valid claim under the CPA. See, e.g., https://www.ftc.gov/enforcement/cases-proceedings/advancedsearch?combine=&field_consumer_protection_topics_tid=245 (last visited 5/7/2020) (collecting numerous cases against online practices based on general unfairness principles). 25 39 Clearview’s arguments against a CPA claim boil down to two main points: (i) that consumers have no reasonable expectation of privacy regarding Clearview’s use of their photos; and (ii) that the CPA does not cover Clearview’s conduct. Both are addressed in turn. A. Consumers Have a Reasonable Expectation of Privacy to be Free from Unrestricted Facial Recognition and Identification by Third Parties. 1. State v. VanBuren is distinguishable Clearview first stakes its position on the State v. Van Buren case. See Opp. 48-52; VanBuren, 2018 VT 95. This case and Clearview’s reliance on it are distinguishable for two reasons. First, VanBuren was a criminal case involving a constitutional challenge to the State’s nonconsensual pornography statute. The Vermont Supreme Court discussed expectation of privacy at length. However, the critical distinction is that the victim’s reasonable expectation of privacy was an element of the crime and the State had a high burden to prove it under a strict scrutiny standard because the statute itself was constitutionally challenged. See VanBuren, 2018 VT 95, at ¶ 97 (the “reasonable expectation of privacy . . . is fundamental to the constitutionality and purpose of this statute, and must be understood as an element of the crime.”). None of those elements are present here. This is not a criminal matter. Clearview also is not challenging the constitutionality of the CPA. There is no strict scrutiny standard. At most, an expectation of privacy could be an element of a common law tort of privacy that the State can prove at the merits of this case under a preponderance of evidence standard. 40 Thus, the State does not have the same high bar as VanBuren. To survive a motion to dismiss, the Court need only find that consumers could have a reasonable expectation of privacy that their photos would not be used in the way that Clearview uses them. Which brings us to the second distinguishing fact: how Clearview uses photos. In VanBuren, the claimed privacy violation was based on the mere reposting of the victim’s image on the internet. Clearview spends four pages of its brief (Opp. 48-52) analogizing to VanBuren, claiming that the conduct is the same: a mere reproduction of an image. That is untrue. This is not a case of merely reposting a photo without consent, as in VanBuren. Here, Clearview leaves out a critical distinguishing fact: Clearview is taking consumers’ photos without consent (similar to VanBuren) and then applying AI technology for facial recognition and identification of that person by anyone who uses Clearview’s app (which includes more than law enforcement users). Compl. ¶¶ 25; 32. This latter fact is crucial. It goes far beyond VanBuren and far beyond any other use of a person’s online photo to date in our society. Clearview is not some neutral search engine, merely reposting images, as it claims. Clearview’s analogy to VanBuren is thus completely inapposite. See Opp. 51 (claiming that “[u]nder the Vermont Supreme Court’s framework [in Van Buren] downstream third parties, who cannot know what putative restrictions may exist on a publicly available image, cannot be held responsible for their republication of an image.” Clearview is not some “downstream third party.” Clearview is not 41 republishing an image. Clearview is not Google Image Search. See Section II.C.4 supra. Clearview is a manipulator of photos, and a seller of the most powerful facial recognition tool ever released, without a person’s consent. Until now, facial recognition databases were drawn from pools of photos where a consumer would have at least consented, or known, or reasonably expected, that the photo would be used by government. See The Perpetual Line-up: Unregulated Police Face Recognition in America, Georgetown Law Center on Privacy & Technology (Oct. 18, 2016) at 20 (photos in facial recognition databases come from drivers’ licenses in motor vehicle agencies, from mug shots, and unsolved case files). 26 Here, Clearview can and should be held responsible for its knowing conduct of commercially exploiting our photos for purposes of creating a surveillance tool without any consent or safeguards. This critical and unprecedented use of photos distinguishes Clearview from the mere republication discussion in Van Buren and other similar situations. For the same reasons, Clearview’s reliance on Vermont’s voyeurism statute is also misplaced. It is a criminal statute, and as discussed below, numerous other cases provide the standard for an expectation of privacy, which derives from common law as opposed to a particular Vermont statute. 26 Available at: www.perpetuallineup.org (last visited 5/7/2020) 42 2. Privacy exists on the internet Clearview’s next main argument essentially claims that there is no privacy on the internet regarding photos. In support of this notion, Clearview subtly refers to a vague but self-serving concept it calls “the public internet.” See, e.g., Opp. 5051. It should be noted there is no legally recognized category of “the public internet” as distinct from some “private internet.” 27 Clearview takes this self-serving concept to far-reaching and unsupported conclusions. For one, Clearview claims that photos posted online are “released into the wild” (Opp. 52) and that no further legal protections or expectations can ever follow. See Opp. 51 (arguing that persons “cannot be held responsible for their republication of an image.”). Following this logic would mean that once a photo is online, no further protections could ever apply. Here is an example: Clearview copies my photo and creates a fake profile – this conduct could be subject to a host of common law and consumer protection violations, like identity theft, conversion of likeness, etc. The creation of the fake profile is an additional, affirmative act that creates tortious and actionable conduct. The same applies here: Clearview is not merely republishing photos; Clearview is adding an affirmative act of creating a new biometric product: a person’s facial recognition profile and then selling it. This certainly could be found to be a privacy violation and it survives a 12(b)(6) standard of review. See Opperman, 84 F. Supp. 3d at 992. In Opperman, This is another reason for the Court to deny the motion to dismiss, so that the Court can hear from technology and privacy experts who can illuminate such concepts. 27 43 plaintiffs brought an intrusion of seclusion claim against Apple and its apps for copying and storing users’ contact list and address book without consent. Id. at 972. Defendants argued that the users had no expectation of privacy because they agreed to a feature known as “Find Friends” that allowed access to their contact list. Id. at 992. However, the apps did more than access the contact list; they compiled, used and stored the lists. Id. at 972-73. In denying the motion to dismiss, the court relied on the allegations that the user data was more than merely accessed: “Plaintiffs allege not only that App Defendants accessed their address book information and used it to ‘Find Friends,’ but that the Apps also uploaded, misused, and/or misappropriated that data. To the extent that Apps used Plaintiffs’ information for something other than purely ‘Finding Friends,’ Plaintiffs retained a reasonable expectation of privacy in that information.” Id. at 992-93 (emphasis added). The FTC has found the same conduct actionable against Google. See FTC v. Google, No. 512-cv-04177-HRL (N.D. Cal. Nov. 16, 2012) (finding that Google committed unfair and deceptive acts by using Gmail user contacts for its social networking tool, Google Buzz, without consumer consent). 28 Similarly, Clearview is doing more than merely accessing consumers’ photos. Clearview is using the photos beyond how consumers could ever have expected, by applying facial recognition AI for unrestricted identification. Clearview has thus “misappropriated that data” and is using the information in “other, unauthorized Available at: https://www.ftc.gov/enforcement/cases-proceedings/google-inc (last visited 5/7/2020) 28 44 ways” that consumers did not expect. Opperman, 84 F. Supp. 3d at 992 (users “were not aware that those features and the Apps with which they were associated used their address book information in other, unauthorized ways”). This robs consumers of their anonymity. The privacy harms are even more compelling here than Opperman and FTC v. Google, which only involved a person’s contact list, not their biometric data for purposes of identification by law enforcement and others. Clearview’s argument nevertheless continues in this vein, claiming that “[w]hen it comes to images on the internet . . . the notion of solitude or seclusion,” aka the notion of privacy, is “anachronistic.” Opp. 56-57. This is precisely the Orwellian position that society must rebuff and protect against. Clearview’s position is the not-so-subtle slippery slope into accepting that there simply “is no privacy on the internet.” This is not only dangerous and scary. It is also legally wrong. Privacy does exist on the internet, and it exists for this kind of conduct. For example, the Ninth Circuit recently upheld a case involving facial recognition technology, which expressly linked such technology to privacy protections. Patel v. Facebook, Inc., 932 F.3d 1264, 1273 (9th Cir. 2019), cert. denied, No. 19-706, 2020 WL 283288 (U.S. Jan. 21, 2020) (“we conclude that the development of a face template using facial-recognition technology without consent (as alleged here) invades an individual’s private affairs and concrete interests. Similar conduct is actionable at common law.”). Other cases find that online conduct, such as collecting user data without consent or monitoring users online could be a privacy violation, including an 45 intrusion of seclusion. See, e.g., Cooper v. Slice Techs., Inc., 17-CV-7102 (JPO), 2018 WL 2727888, at *3 (S.D.N.Y. Jun. 6, 2018) (S.D.N.Y. June 6, 2018) (noting that “unauthorized accessing and monitoring of plaintiffs’ web-browsing activity implicates harms similar to those associated with the common law tort of intrusion upon seclusion”); In re Google Inc. Cookie Placement Consumer Privacy Litig., 806 F.3d 125, 153 (3d Cir. 2015) (discussing intrusion of seclusion and reversing district court’s dismissal of privacy claims against Google for secretly tracking user websites); McDonald, 385 F. Supp. 3d at 1034-35 (“find[ing] that plaintiffs have adequately alleged an intrusion upon seclusion claim” where “Plaintiffs state in detail what data was secretly collected, how the collection was done, and how the harvested data was used.”). Numerous other cases exist, albeit not in Vermont, that support a claim of technological intrusions of seclusion. See, e.g., Alexander H. Tran, The Internet of Things and Potential Remedies in Privacy Tort Law, 50 Colum. J.L. & Soc. Probs. 263, 290-96 (2017) (collecting cases where intrusion of seclusion is used in technology and privacy, and noting that “state courts are in the best position to define seclusion and identify circumstances in which we should be able to expect seclusion while surfing the World Wide Web.”) (quotation omitted). Of course, Vermont also recognizes both a general right to privacy, Denton, 163 Vt. at 69, 655 A.2d at 707, and the tort of intrusion of seclusion, Hodgdon, 160 Vt. at 162, 624 A.2d at 1129. The State’s claims may proceed under that precedent. 46 To be clear, the State does not allege an actual claim of intrusion of seclusion. This is a CPA case prohibiting unfair conduct. Under that rubric, the State relies on the broader right to privacy as a basis for its primary unfairness claim. Compl. ¶ 78. And privacy rights are indisputable. Birnbaum v. United States, 588 F.2d 319, 323 (2d Cir. 1978) (“The manifold nature of what is loosely termed ‘the right to privacy’ is well established.”). At most, the tort of intrusion of seclusion provides a close analogy and a potential framework to find certain technological practices illegal (see cases cited above)—but it is not the only basis to assert privacy rights. Restatement (Second) of Torts § 652A (1977) cmt. c (“Other forms [of privacy] may still appear, particularly since some courts, and in particular the Supreme Court of the United States, have spoken in very broad general terms of a somewhat undefined ‘right of privacy’ as a ground for various constitutional decisions involving indeterminate civil and personal rights.”). Thus, Clearview is simply wrong in arguing that privacy based on an intrusion of seclusion cannot exist online or that it must be limited to physical intrusions. See Opp. 43 (“all the case law involves physical intrusions of privacy”); Opp. 55 (“These cases demonstrate that only extreme, persistent, and directed action taken against the plaintiff are sufficient to state a claim, and always the intrusion is a physical one.”). The caselaw, including from the United States Supreme Court, is clear that technology has created its own world of intrusions that are actionable at law: “In its recent Fourth Amendment jurisprudence, the Supreme Court has 47 recognized that advances in technology can increase the potential for unreasonable intrusions into personal privacy.” Patel, 932 F.3d at 1272. As the Patel court crisply summarized: “[t]echnological advances provide ‘access to a category of information otherwise unknowable,’ and ‘implicate privacy concerns’ in a manner as different from traditional intrusions as ‘a ride on horseback’ is different from ‘a flight to the moon.’”) (quoting Riley v. California, 573 U.S. 373, 393 (2014)). This is especially important in the context of emerging technologies like Clearview. See Birnbaum, 588 F.2d at 325 (noting that privacy law “does change with times and circumstances”); see also Tran, The Internet of Things and Potential Remedies in Privacy Tort Law, 50 Colum. J.L. & Soc. Probs. at 291–92 (“the intrusion tort offers the best theory to target legitimate privacy concerns in the information age” because “the tort is ‘conceptually adaptable to changing technology’ and ‘legal enforcement of the right to seclusion can expand sensibly, outlawing the most disconcerting data practices without imposing unrealistic demands on industry and regulatory enforcement agencies.’”) (quoting Jane Yakowitz Bambauer, The New Intrusion, 88 Notre Dame L. Rev. 205 (2012)). 3. Consumers did not relinquish their privacy expectations Clearview’s final main argument is that consumers effectively waived and consented to their photos being used by Clearview. Opp. 51 (“the act of uploading an 48 image . . . nullifies any reasonable expectation of privacy”); Opp. 52 (“consumers have waived” their rights regarding their photos). 29 In support, Clearview first cites and relies on terms of service from social media sites like Facebook, Google, Twitter, Venmo, LinkedIn, and YouTube (collectively referred to hereafter as “the Social Media Sites”). For example, as cited by Clearview, Google states that once it is shared, your photo may continue to appear in your friend’s Google account even after you remove your photo (Opp. 52); Facebook states that you give Facebook permission to “copy and share it with others” (Opp. 52). The other Social Media Sites have similar language about users granting permission to those sites to use their photos. None of this language is availing to Clearview. The key distinction is that consumers are consenting to the Social Media Sites, not to Clearview. Consumers have a contractual relationship with the Social Media Sites with remedies if those Sites misuse or misappropriate consumers’ data. Consumers can also choose not to do business with Social Media Sites that act contrary to their interests. This relationship with consumers, and the knowledge that consumers can cancel their accounts, can also act as a curb on Social Media Sites’ worst instincts. Most importantly, consumers can revoke their consent and remove images from Social It should be noted that not all photos on the internet were voluntarily posted. Compl. ¶¶ 45-46. Thus, Clearview’s argument ignores this large category of consumers who are now swept up in Clearview’s database without any idea that such photos of them even existed online. 29 49 Media Sites. Compl. ¶¶ 42-44; Gager v. Dell Fin. Servs., LLC, 727 F.3d 265, 270 (3d Cir. 2013) (“the common law concept of consent shows that it is revocable.”). Clearview ignores these distinguishing features of consent and consumers’ contractual relationship with the Social Media Sites. Clearview’s argument would thus only hold up if the Social Media Sites included a term to the effect of: “you consent that your images may be used for facial recognition by third parties.” That is obviously not the case. The consent that consumers gave is only to the Social Media Sites, and only with the understanding that at most, the image could be copied and viewed if allowed by those Sites; not that it could be collected, commercialized, analyzed, searched and identified by untold third parties who obtained Clearview’s app. In short, Clearview cannot claim the consent as its own. Moreover, those Social Media Sites all have express terms that are supposed to prohibit what Clearview did: take users’ photos secretly and without permission. Compl. ¶¶ 43-44. The Social Media Sites expressly prohibit unauthorized scraping of photos. Those terms of service make clear that users’ content is supposed to stay on those platforms or only be shared if the Social Media Sites themselves decide to share it. This did not occur. Facebook and Google did not give permission for Clearview to use their photos. In fact, those two companies sent cease-and-desist letters to Clearview. Compl. ¶ 39. Thus, Clearview’s argument that by posting a photo to the Social Media Sites, “the individual at that time most certainly relinquishes any reasonable expectation of privacy,” does not apply to Clearview. Opp. 51. At most, it would 50 apply only to the use of those photos by the Social Media Sites themselves, which is not at issue here. Clearview is therefore incorrect in citing Brandeis for this point, whereby “[t]he right to privacy, according to Brandeis, ‘ceases upon the publication of the facts by the individual, or with his consent.’” Opp. 48 (citing Samuel D. Warren & Louis D. Brandeis, Right to Privacy, 4 Harv. L. Rev. 193, at 218 (1890)). For that statement to apply to Clearview, Clearview needed to obtain the consumers’ consent directly. Or, implicit in the statement of “publication” is a knowing publication, i.e., the consumer knows what they are publishing. Here, as explained, no one reasonably knew that posting a photo on Facebook would or could lead to the identification of them in the way Clearview now offers. 4. Consumers still expect their anonymity in the real world Vermont expressly recognizes “the right to be left alone.” Denton, 163 Vt. 62, at 69, 655 A.2d at 707. This can only mean something if consumers can maintain their reasonable expectation of privacy regarding the right to remain anonymous in the real world. Clearview’s app now eliminates the right to be left alone. Yet Clearview claims that consumers somehow relinquished their right to be left alone in the real world, simply by posting photos to the internet. In support of that contention, Clearview continues to misconstrue the “public” nature of the photos involved here. For example, Clearview suggests that it is no different than what already exists: “The same material is available to any single one of us by opening a browser, typing a name into a search engine, or logging onto Facebook. Any single one of us can screenshot an image we find online and put it somewhere 51 else online. This not an unfair practice nor an intrusion on anybody’s seclusion.” Opp. 56. This is a major misconstruction and a dangerous supposition. Clearview is not a search engine. See Section II.C.4 supra. Clearview is emphatically not Google Image Search. As even Clearview acknowledges, for that scenario you must know who you are looking for, by “typing a name into a search engine.” Opp. 56. No one can do what Clearview is doing, which is the exact reverse process: it is personally identifying heretofore the anonymous world without a prior name or identity. It is only now, because of advanced AI technology, combined with Clearview’s unscrupulous scraping of the entire internet, that for the very first time, an otherwise anonymous person in the real world can be plucked from anonymity and identified. This is not the “same material” “available to any one of us.” Opp. 56. It is far from it. None of us can do what Clearview is doing. See U.S. Dep’t of Justice v. Reporters Comm. For Freedom of Press, 489 U.S. 749 (1989) (hereafter “DOJ v. RCFP”). In DOJ v. RCFP, journalists sent a FOIA request for a “rap sheet” from the FBI, arguing that the arrest information contained within the rap sheet was public and “freely available.” Id. at 757. The FBI withheld the rap sheet claiming that it would result in an unwarranted intrusion of privacy. Id. at 758. The Supreme Court upheld the protection of the rap sheet because “[a]lthough much rap-sheet information is a matter of public record,” the FBI’s compilation and indexing of it created a new product that was not freely available. Id. at 753. Specifically, the 52 Court held that “there is a vast difference between the public records that might be found after a diligent search of courthouse files, county archives, and local police stations throughout the country and a computerized summary located in a single clearinghouse of information.” Id. at 764. Similarly, Clearview’s compilation of photos into a biometric identifier is a wholly new product of information that is not freely available and certainly was not disclosed for that purpose. Further, the test is not between some public and private online world. See supra p. 43 and note 27. The Supreme Court has made clear that the privacy test always comes down to what a reasonable person would expect, even when one is out in public. Carpenter v. United States, 138 S. Ct. 2206, 2217, 201 L. Ed. 2d 507 (2018) (“[a] person does not surrender all [privacy] protection by venturing into the public sphere.”). Courts continue to uphold privacy rights even when some information is made public or visible, especially when combined with “overzealous” or affirmative acts that create a new layer of intrusion or surveillance. For example, in Nader v. Gen. Motors Corp., 25 N.Y.2d 560, 570, 255 N.E.2d 765, 771 (1970), the Court of Appeals of New York stated that: [T]he mere observation of the plaintiff in a public place does not amount to an invasion of his privacy. But, under certain circumstances, surveillance may be so ‘overzealous' as to render it actionable .... A person does not automatically make public everything he does merely by being in a public place, and the mere fact that Nader was in a bank did not give anyone the right to try to discover the amount of money he was withdrawing. Next, in Sanders v. Am. Broad. Companies, Inc., 20 Cal. 4th 907, 912, 978 P.2d 67, 70 (1999), the California Supreme Court upheld an intrusion of seclusion 53 for surreptitiously videotaping the plaintiff using a “hat cam[era]” during an interview. The court noted that “[l]ike ‘privacy,’ the concept of ‘seclusion’ is relative. The mere fact that a person can be seen by someone does not automatically mean that he or she can legally be forced to be subject to being seen by everyone.” Sanders, 20 Cal. 4th at 916, 978 P.2d at 72. Similarly, Clearview has taken information that consumers made somewhat public, like standing in a bank, or giving an interview, and applied an overzealous and secret act on top of that, i.e., applying AI technology to a new creation consisting of a unique biometric identifier. It is no longer just the photo that the consumer posted. Clearview’s product is a new creation that consumers did not consent to, nor expect. As in Sanders, the mere fact that a consumer posted a photo to Facebook for a limited purpose does not mean that “he or she can legally be forced to be subject to being [searched and identified] by everyone” who has access to Clearview’s App. Id. See also U.S. v. Jones, 565 U.S. 400, 417-18 (2012) (Justice Sotomayor “would not assume that all information voluntarily disclosed to some member of the public for a limited purpose is, for that reason alone, disentitled to [privacy] protection.”). Lastly, even if a photo were considered public on the internet, a consumer would, at most, expect that photo to be viewed online. Consumers do not expect that photo to be commercialized into biometric data such that the person is no longer anonymous in the real world, as a result of that online photo. See Nancy Yue Liu, Bio-Privacy, Privacy Regulation and the Challenge of Biometrics, 177 (2012) (“While 54 there may be no expectation of privacy in public places, there may still be an expectation of anonymity.”); see also Opperman, 84 F. Supp. 3d at 992 (even when consumers consent to some use of data, using consumer information in “other, unauthorized” ways is sufficient to state a privacy claim). In this way, the United States Supreme Court’s notion of “practical obscurity” rings true here. DOJ v. RCFP, 489 U.S. at 763 (discussing how “[i]n an organized society, there are few facts that are not at one time or another divulged to another” and finding that privacy still applies to information that was disclosed for a limited purpose, especially where an additional layer of effort is expended to “prepare, index, and maintain” the disclosed information). Thus, any analogies to consumer behavior online and in the real world must take into account the unique circumstances of this case of applying facial recognition AI to create a surveillance and identification database. Clearview’s argument wholly ignores this critical aspect. See, e.g., Opp. 52 (claiming that posting one’s photo online is “is the equivalent of posting a billboard with your likeness alongside a highway”). That analogy is flatly wrong. Clearview again omits its crucial but affirmative and overzealous conduct of taking that photo and turning it into something wholly new and unprecedented. 30 Clearview has gone several steps beyond mere collection of photos and has “prepare[d], index[ed] and States are also permitted to enforce their own laws and values, e.g., Vermont has also banned billboards alongside highways. 10 V.S.A. § 488. 30 55 maintain[ed]” the photos in an entirely new way. DOJ v. RCFP, 489 U.S. at 764. As one scholar summarized the privacy expectations regarding facial recognition: A person may expose her face when she is in a public place or publicly posts her picture in a social network, such that if friends see her or the picture, they may recognize her. But she is not necessarily exposing her biometric data, which is not visible to the human eye. Arguably, much as a private person may not have the right to use binoculars to try to discover how much money a bank patron is withdrawing from across the bank office, so too [companies] likely cannot extract biometric data from a person’s face even if the person shows her face in public. Yana Welinder, A Face Tells More Than A Thousand Posts: Developing Face Recognition Privacy in Social Networks, 26 Harv. J.L. & Tech. 165, 203 (2012). Therefore, consumers should still be permitted to expect their right of anonymity. B. The CPA Covers Clearview’s Conduct Clearview’s main argument to avoid CPA liability is that the State has not proved substantial consumer injury. However, substantial consumer injury is but one of three separate bases for unfairness. They are: (i) a substantial consumer injury; or (ii) a public policy or common law prohibition; or (iii) an immoral or unscrupulous act. The State may proceed under all three separately or in combination, and the latter two are even more applicable here. It is telling that Clearview spends the bulk of its argument on the first substantial injury test, while giving short shrift to the other two. All three are discussed in turn. 1. The Christie test for unfairness has three independent criteria Clearview claims that the State is ignoring the FTC’s development of unfairness. It is true that the FTC has stated that for its unfairness doctrine, the FTC primarily relies on substantial consumer injury. Clearview relies on the FTC’s 56 statement that “unjustified consumer injury is the primary focus of the FTC Act, and the most important” of the three criteria for unfairness set forth in Sperry. Opp. 58 (quoting In re International Harvester, 104 F.T.C. 949, 1984 WL565290 at *97 (1984)). See also LabMD, Inc. v. FTC, 894 F.3d 1221, 1229 (11th Cir. 2018) (“the FTC stated that it was nixing the third 1964 unfairness factor—whether a practice is immoral, unethical, or unscrupulous—because it was ‘largely duplicative’ of the first two.”) (quoting FTC Policy Statement on Unfairness, (Dec. 17, 1980)). Clearview then spends the next four pages of its brief (Opp. 57-61) strenuously arguing against any consumer injury and mostly propping up the supposed benefits to law enforcement of using Clearview’s app. None of this discussion is particularly relevant. That is because the State is not limited only to the FTC’s substantial consumer injury test. In Vermont, the Supreme Court adopted the three-part Sperry test in Christie v. Dalmig, Inc., 136 Vt. 597, 601, 396 A.2d 1385, 1388 (1979): Id. “(1) whether the practice, without necessarily having been previously considered unlawful, offends public policy as it has been established by statutes, the common law, or otherwise – whether, in other words, it is within at least the penumbra of some commonlaw, statutory, or other established concept of unfairness; (2) whether it is immoral, unethical, oppressive, or unscrupulous; (3) whether it causes substantial injury to consumers . . . .” The Vermont Supreme Court acknowledged an open question as to these three criteria being independent. Id. (noting that there was no CPA violation in that case “under any construction of these factors”) (emphasis added). At least one Vermont superior court recites the test with an “or” – indicating the separateness of 57 the three sub-tests. State of Vermont v. CSA-Credit Solutions of Am., LLC & Doug Van Arsdale, Dec. and Order: Mot. for Summ. J., at 7 (Vt. Super. Ct. March 5, 2012) (attached as Exhibit B). Many state courts follow this approach as well and apply the three Sperry factors independently or in some combination. See Woodwinds, Inc. v. Dimeo, 229 F.3d 1136, 2000 WL 1425161, at *2 (2d Cir. 2000) (“a Connecticut Unfair and Trade Practices Act claim requires a showing that the defendants’ conduct: (1) offended public policy; (2) was immoral, unethical or oppressive; or (3) caused substantial injury to consumers”) (emphasis added); Colgate v. JUUL Labs, Inc., 402 F. Supp. 3d 728, 759 (N.D. Cal. 2019) (California court reciting the Sperry test with an “or” and upholding unfairness claim against “JUUL’s intentional targeting of minors” because it “violates public policy against promoting youth nicotine addiction.”); Wendorf v. Landers, 755 F. Supp. 2d 972, 979 (N.D. Ill. 2010) (“The Illinois Supreme Court has interpreted Sperry to impose only a factor-based framework, not a threepart conjunctive test: ‘All three criteria do not need to be satisfied to support a finding of unfairness. A practice may be unfair because of the degree to which it meets one of the criteria or because to a lesser degree it meets all three’”) (citation omitted); Morrison v. Toys “R” Us, Inc., 806 N.E.2d 388, 392 (Mass. 2004) (Massachusetts recites the Sperry test with an “or”); Rohrer v. Knudson, 2009 MT 35, ¶ 31, 349 Mont. 197, 205, 203 P.3d 759, 764 (Mt 2009) (Montana “join[s] these [dozen] jurisdictions in adopting a version of the [Sperry] standard” and [w]e hold as a matter of law that an unfair act or practice is one which offends established public 58 policy and which is either immoral, unethical, oppressive, unscrupulous or substantially injurious to consumers.”) (emphasis added). Thus, the State alleges that, at a minimum, Clearview’s practices violate public policy and are immoral and unscrupulous. This is sufficient for the pleading stage. See, e.g., Wendorf, 755 F. Supp. 2d at 979 (“To state a claim under the [Illinois Consumer Fraud Act] using any of the Sperry factors, ‘the plaintiffs must describe how the [unfair practice] is oppressive or violates public policy. Without such a description, the complaint fails to state a cause of action.’” (quoting Rockford Mem’l Hosp. v. Havrilesko, 858 N.E.2d 56, 65 (Ill. 2006)). The State may also seek to prove substantial consumer injury at trial, but this Court should deny the motion to dismiss to allow for discovery and expert testimony on the harms that consumers suffer as a result of Clearview’s App. For example, experts can illustrate the evolving norms and expectations around facial recognition software and privacy. The State has also alleged that facial recognition and Clearview’s App may result in false identifications and thus harm consumers who are ensnared in an unjustified police investigation, particularly for persons of color. See Compl. ¶¶ 65-67 (alleging lower accuracy of facial recognition); Compl. ¶ 18 (facial recognition was 10 to 100 times inaccurate for African Americans or Asians). There is also the matter of Clearview’s data security and the risk it poses to consumers, especially minors. Compl. ¶¶ 63-65. Accepting these facts as true, and with further discovery, the State can show concrete injuries to consumers at trial. 59 Further, Clearview is wrong in asserting that consumers can “reasonably avoid” the harm. Opp. 61. Clearview first suggests that consumers should not post photos on the internet. Id. (“anyone can refrain from publishing his or her photographs to the web.”). This is absurd and turns the case on its head. Clearview engaged in the wrongful conduct of secretly harvesting every photo on the internet to apply facial recognition AI to it. Consumers had no idea this was occurring and thus had no idea they needed to avoid posting photos. And regardless, as the Supreme Court has noted, “secrecy” should not be a “prerequisite for privacy.” Jones, 565 U.S. at 418. Clearview next suggests that it has a “robust opt-out policy for individuals who want their photographs to be removed from Clearview AI’s indexing process.” Opp. 61. This is also false. The State has alleged that Clearview does not have the technological capability to remove an induvial based on location or residence, Compl. ¶ 47, and that Clearview’s “opt-out” policy only applies to jurisdictions that already have a law providing for it, which is California in the U.S. and the European Union, and it is a voluntary decision by Clearview, Compl. ¶¶ 52-54. And in fact, Clearview actually admits that it will not honor opt-out requests from anyone outside of those jurisdictions, i.e., outside California or the EU. Opp. 65 (Clearview “has good reason for denying data deletion and access [aka opt-out] requests”). Again, accepting these allegations as true, consumers are unable to force their removal from Clearview’s app. These allegations will satisfy the substantial injury test, if that test is even applied here. 60 2. The CPA encompasses common law or public policies like privacy Clearview next argues that there is no “clear and well-established public policy” of privacy. Opp. 62. Clearview spends one paragraph arguing this point, essentially repeating its void-for-vagueness argument, that because there is no specific Vermont statute prohibiting Clearview’s exact conduct of using facial recognition technology as it does, then there is no clear or established standard to apply. This is patently wrong. First, as noted supra Section IV, Vermont is not required to pass a law outlawing the precise practice complained of, so long as the practice meets the unfairness standard. Clearview mistakes “clear and well-established” as meaning one particular statute addressing the exact conduct. Clearview ignores the “penumbra” test—i.e., “whether, in other words, [the conduct] is within at least the penumbra of some common-law, statutory, or other established concept of unfairness.” Christie, 136 Vt. at 60. This Court already rejected Clearview’s argument in a similar case. State v. Big Brother at 12 (“[t]he fact that there is not a precise statute or declaration directly discussing [the conduct] is not relevant.”). As the FTC explains further: As to the second 1964 unfairness factor, public policy, the FTC specified that the policies relied upon “should be clear and well-established”—that is, “declared or embodied in formal sources such as statutes, judicial decisions, or the Constitution as interpreted by the courts, rather than being ascertained from the general sense of the national values.” Put another way, an act or practice's “unfairness” must be grounded in statute, judicial decisions—i.e., the common law—or the Constitution. LabMD, 894 F.3d at 1229 (quoting FTC Policy Statement). 61 Here, the State relies on the clear and well-established privacy rights that are grounded in countless judicial decisions. These decisions specifically address privacy in the realm of technology. See, e.g., Carpenter, 138 S. Ct. 2206, 201 L. Ed. 2d 507 (using cell phone records without consent); Jones, 565 U.S. 400 (using GPS tracking without consent); Kyllo v. United States, 533 U.S. 27, 33 (2001) (using thermal imaging without consent); Patel, 932 F.3d at 1273 (using facial recognition without consent); McDonald, 385 F. Supp. 3d at 1029 (collecting user data without consent); FTC v. InMobi, supra note 25 (secret tracking of website history); Opperman, 84 F. Supp. 3d at 992 (accessing user’s address and contact lists without consent). None of those cases had a specific statute addressing that exact conduct. Apart from the Fourth Amendment cases, they all relied on general unfairness principles contained within state or federal consumer protection law and/or privacy law. Lastly, the State does not have to prove an “unconstitutional violation of privacy.” Opp. 62. It is unclear what that even means. The State need only allege (and will prove at trial) that Clearview is violating established norms that are already reflected in common law actions like intrusion of seclusion. Likewise, the State is not creating its own public policy, as Clearview suggests. Opp. 62 (arguing that the Sate “ascertain[s] public policy from the State’s own general sense of the national values.”). This is also untrue. The State is defending the public’s existing rights to privacy and anonymity as already reflected by the national and Vermont 62 values in common law (and as contained in the judicial sources cited herein). See Denton, 163 Vt. at 69, 655 A.2d at 707 (Vermont has an established policy of the “right to be left alone.”). See also State v. Big Brother at 12 (the State may “consider[] public values beyond simply those enshrined in the letter or encompassed in the spirit of' other laws.”) (quoting Sperry, 405 U.S. at 244). 3. Clearview’s conduct is immoral and unscrupulous First, the immoral and unscrupulous standard under the CPA could be an independent basis for finding unfairness. See supra Section V.B.1. At most, it combines with the public policy standard. See, e.g., Rohrer, 2009 MT 35, at ¶ 31 (“an unfair act or practice is one which offends established public policy and which is either immoral, unethical, oppressive, unscrupulous or substantially injurious to consumers.”); LabMD, 894 F.3d at 1229 (“the FTC stated that it was nixing the third 1964 unfairness factor—whether a practice is immoral, unethical, or unscrupulous—because it was ‘largely duplicative’ of the first two.”) (quoting FTC Policy Statement). Here, the State alleges both together. Compl. ¶¶ 77-78. Next, Clearview overstates its argument that the State is “the morality police.” Opp. 62. Not so. The State draws on established standards contained in judicial decisions to determine whether a practice is oppressive or unscrupulous. See, e.g., Centerline Equip. Corp. v. Banner Pers. Serv., Inc., 545 F. Supp. 2d 768, 780 (N.D. Ill. 2008) (“Conduct is oppressive only if it imposes a lack of meaningful choice or an unreasonable burden on its target); Henderson v. United Student Aid Funds, Inc., 918 F.3d 1068, 1076 (9th Cir. 2019) (unsolicited automated messages from debt collectors are oppressive and unscrupulous acts); Votto v. Am. Car Rental, 63 Inc., 871 A.2d 981 (Conn. 2005) (car rental agency that increased a repair charge without customer’s consent was “without question unscrupulous, immoral and oppressive”). Finally, there is no requirement for the State to engage in rulemaking in this context. That is a complete red herring. Opp. 63 (arguing that because the State created a rule on GMO food labeling, it should do the same here, to ascertain broad public consensus on facial recognition technology generally). In fact, the State’s foray into GMO rulemaking only bolsters this case further. In the landscape of GMO food production, the State was addressing a gap in information from an industry of countless companies. The State was asking hundreds of companies to start doing something affirmatively, by labeling foods in Vermont. Grocery Mfrs. Ass’n v. Sorrell, 102 F. Supp. 3d 583. This case presents a completely opposite picture: one company is doing something unfair and unscrupulous that should be stopped. Despite Clearview’s attempts to elevate its arguments into a philosophical debate, this matter is not a referendum on facial recognition software generally, nor its use by law enforcement. It is specific to Clearview, a startup company with a history of alleged phishing and spam technologies (Compl. ¶¶ 27-28) who has gone beyond the bounds of even the giants in this field like Facebook and Google, who themselves are holding back from doing what Clearview does out of a sense of restraint. Compl. ¶¶ 16-17. See also id. at ¶¶ 21-22 (states and municipalities are placing restraints on use of facial recognition technology for law enforcement uses). 64 This Court can find potentially immoral and unscrupulous conduct based on the unique facts alleged here. See supra pp. 3-4 and Compl. ¶ 78 (recounting all facts supporting Clearview’s immoral and unscrupulous conduct). 4. Clearview’s conduct is deceptive There are four reasons to allow the State’s deceptive claim to go forward. First, Clearview argues that no CPA deception claims can be brought because Vermonters are not “consumers” since they did not purchase the App. Opp. 63. According to Clearview, only law enforcement are purchasers and therefore “consumers’ of the App. However, the CPA broadly permits states to protect consumers when they are affected by unfair and deceptive practices. See 9 V.S.A. § 2453 (the Attorney General may bring actions in the public interest to protect consumers). This can include consumers who never purchased a product but are nonetheless caught in a company’s deceptive practice. This Court has recognized that the CPA “is designed not merely to compensate consumers for actual monetary losses resulting from fraudulent or deceptive practices in the marketplace, but more broadly to protect citizens from unfair or deceptive acts in commerce ... and to encourage a commercial environment highlighted by integrity and fairness.” State v. Big Brother at 9 (quoting Anderson v. Johnson, 2011 VT 17, ¶ 7, 189 Vt. 603 (2011)). For example, the FTC regularly takes actions against technology companies that exploit consumers who themselves are not direct customers. See In re Epic Media Group, LLC, No. C-4389 (F.T.C. Mar. 19, 2013) (FTC found that deceptive acts included “history sniffing” where company secretly tracked 54,000 websites that consumers visited for purposes of doing targeted advertising; these consumers 65 were not buying anything, only visiting the company’s website). 31 See also FTC v. Equifax Inc., No. 1:19-mi-99999 (N.D. Ga. July 22, 2019) (FTC took action against Equifax for not protecting consumer information, and many of the affected consumers of that data breach were not purchasers of an Equifax product; Equifax simply collected and stored national consumer information in a deceptive way). 32 The same occurred here. Clearview collected consumer information without consent. It would defy logic to say that consumers have no recourse when they were deliberately deceived and shielded from even knowing that Clearview was obtaining their information. Thus, the State may bring deception claims against Clearview. Second, Clearview’s motion to dismiss should be denied because the claim for deceptive conduct necessarily involves factual misrepresentations that should be resolved after full discovery and opportunity for a merits hearing. Compl. ¶¶ 56-75. See also DMG Studio Holdings, Inc. v. N. Bay S. Corp., 2013 WL 3992402, at *12 (D. Conn. Aug. 2, 2013) (denying motion to dismiss and citing case where “the district court and the Second Circuit had the benefit of analyzing the plaintiffs’ [deceptive] claims with an evidentiary record”). At most, the Court should only consider whether the State has pled allegations that could be found deceptive. Third, the State has pled sufficient allegations to satisfy the CPA. Compl. ¶ 81. Under the CPA, the State need only show: (1) “a representation, omission, or Available at: https://www.ftc.gov/news-events/press-releases/2012/12/ftc-settlement-putsend-history-sniffing-online-advertising (last visited 5/7/2020) 31 Available at: https://www.ftc.gov/news-events/press-releases/2019/07/equifax-pay-575million-part-settlement-ftc-cfpb-states-related (last visited 5/7/2020) 32 66 practice likely to mislead consumers; (2) the consumer must be interpreting the message reasonably under the circumstances; and (3) the misleading effects must be material, that is, likely to affect the consumer’s conduct or decision regarding the product.” Carter v. Gugliuzzi, 168 Vt. 48, 56 (1998). Importantly, the State does not have to prove any consumer injury. Thus, Clearview’s arguments about consumers not being harmed, even if accepted, would be unavailing to avoid liability for its misrepresentations under the CPA. Fourth and last, Clearview’s misrepresentations are significant and they are discussed briefly below. Data security. Clearview claims that the State is arguing over the quality of the security and apparently Clearview even suggests that data security is an opinion. Opp. 65-66. This is misleading. Data security is a fact, not an opinion. And the fact of whether data is secure is a material representation that is actionable. See FTC v. Equifax, supra note 33; In re Cambridge Analytica, LLC, No. 9383 (F.T.C. Nov. 25, 2019) (FTC settlement where company made misrepresentations about its privacy certifications). 33 Further, in a wide-reaching survey, American consumers explained that representations of data security are very important to them: Available at: https://www.ftc.gov/enforcement/cases-proceedings/182-3107/cambridgeanalytica-llc-matter (last visited 5/7/2020) 33 67 • 52% of U.S. adults said they decided recently not to use a product or service because they were worried about how much personal information would be collected about them. 34 • 81% of Americans say the potential risks outweigh the benefits when it comes to companies collecting data. 35 • 84% of Americans say they feel very little or no control over the data collected about them by the government, and 81% say the same when company data collection is considered. 36 Opt-out rights. Clearview claims it has a “robust opt-out policy for individuals who want their photographs to be removed from Clearview AI’s indexing process.” Opp. 61. This is untrue. See supra at pp. 8; 60. Facial recognition accuracy. Clearview attempts to rebut this allegation by citing new facts that are outside the complaint. See Opp. 66 (citing a “Megaface” test and affidavit from Clearview). However, this is inappropriate on a motion to dismiss where new factual information outside the four corners of the complaint should not be considered. Friedl v. City of New York, 210 F.3d 79, 83 (2d Cir. 2000) (“district court erred in dismissing plaintiff's complaint” because it “considered materials outside the pleadings”); Kitt v. Pathmakers, Inc., 672 A.2d 76, 79 (D.C. App. 1996) (a motion to dismiss should not rely “upon facts outside the complaint”). Available at: https://www.pewresearch.org/fact-tank/2020/04/14/half-ofamericans-have-decided-not-to-use-a-product-or-service-because-of-privacyconcerns/ (last visited 5/7/2020) 34 Available at: https://www.pewresearch.org/fact-tank/2019/11/15/key-takeawayson-americans-views-about-privacy-surveillance-and-data-sharing/ (last visited 5/7/2020) 35 36 Id. 68 Client list. Clearview tries to avoid this allegation by claiming that it currently only provides its app to law enforcement and financial institutions. Opp. 66. This is a fact outside the Complaint and cannot be relied on. Further, it does not resolve the statements that Clearview made that its app was “NOT available to the public” and only for law enforcement. Complaint ¶¶ 30-32. And factual discovery is necessary to identify when each statement was made and when different users had access to the App. The Complaint alleges additional misrepresentations as well. Compl. ¶¶ 5675; supra pp. 8-9. In sum, for all of these allegations, a motion to dismiss is inappropriate. These are necessarily factual issues that should be fleshed out through discovery and resolved through a merits hearing. VI. The Fraudulent Acquisition of Data Law Applies to Clearview’s Conduct Clearview’s argument that the FADL does not apply boils down to “The data is not brokered. It is not acquired by fraud.” Opp. 68. The law, passed in 2018 as part of the same act that created Vermont’s Data Broker Registry, states in relevant part: “A person shall not acquire brokered personal information through fraudulent means.” To the State’s knowledge, this law was a first-of-its-kind in the nation, and this is the first time it is being applied. The phrase “brokered personal information” is a defined term which, interestingly, does not required that the personal 69 information at issue be “brokered.” 37 The term was titled as such to distinguish it from the multiple other “personal information” definitions found in Title 9 V.S.A. Chapter 62 (Protection of Personal Information). 38 “Brokered Personal Information” is defined, in relevant part, as “one or more of the following computerized data elements about a consumer, if categorized or organized for dissemination to third parties: . . . (vi) unique biometric data generated from measurements or technical analysis of human body characteristics used by the owner or licensee of the data to identify or authenticate the consumer, such as a fingerprint, retina or iris image, or other unique physical representation or digital representation of biometric data; . . . or (ix) other information that, alone or in combination with the other information sold or licensed, would allow a reasonable person to identify the consumer with reasonable certainty.” 9 V.S.A. § 2430(1)(A). The information at issue is the computerized photographs of individuals, which were gathered in order to apply facial recognitions identifiers to, in order to identify individuals. This falls squarely within the definition of “Brokered Personal Information.” Title 9 V.S.A. Chapter 62 (Protection of Personal Information) contains multiple definitions of “personal information” that apply to different statutes: 37 Vermont’s Security Breach Notice Act, 9. V.S.A. § 2435 addresses “Personally Identifiable Information” defined in 9 V.S.A. 2430(9); while the Document Safe Destruction Act, 9 V.S.A. § 2445 applies to “personal information” defined in 9 V.S.A. § 2445(a)(3). 38 70 While “fraud” is not defined anywhere in Chapter 62, a violation of the FADL is treated as a violation of the Consumer Protection Act. It is clear that “fraud” in this context refers to consumer fraud, which is synonymous with “unfair and deceptive acts and practices.” Messier v. Bushman, 2018 VT 93, ¶ 24, 208 Vt. 261, 272, 197 A.3d 882, 891 (2018) (“The purpose of the CPA, previously known as the Consumer Fraud Act, is to protect citizens from unfair and deceptive acts in consumer transactions.”); Terry v. O'Brien, 2015 VT 132, ¶ 27, 200 Vt. 511, 525, 134 A.3d 203, 212 (2015) (“A consumer who contracts for products or services in reliance upon, or who sustains an injury as a result of, fraudulent representations prohibited by 9 V.S.A. § 2453 may bring an action under the CPA.”). 39 Here, Clearview’s indiscriminate screen-scraping, which involved using “spiders” that misrepresented their purpose in accessing websites, violating the Terms of Service of the websites whose data it took, and collecting consumers personal photographs without their knowledge or consent in order to turn those photographs against their owners through the use of facial recognition, constitutes an unfair and/or deceptive acquisition of data. VII. The State Has Standing Clearview argues that the State lacks standing because there is no concrete, material injury. The State has alleged material injury, but its standing has a different basis. The Article III standing analysis when the State is the plaintiff is Note also that 9 V.S.A. § 2457, which concerns a rebuttable presumption of a violation of the CPA, is titled “Evidence of Fraud.” 39 71 different from when a private citizen is a plaintiff. Mass. v. EPA, 549 U.S. 497, 517 (2007) (“It is of considerable relevance that the party seeking review here is a sovereign State and not, as it was in Lujan, a private individual.”). The case relied on by Defendant, Patel v. Facebook, 932 F.3d 1264, involved private plaintiffs and is inapposite to this analysis. 40 The United States Supreme Court has established the general requirement for Article III standing to include “an invasion of a legally protected interest which is (a) concrete and particularized . . . and (b) actual or imminent, not ‘conjectural’ or ‘hypothetical.’” Lujan v. Defs. Of Wildlife, 504 U.S. 555, 561 (1992). Fifteen years later the Court revisited Lujan to clarify that a State can seek remedies involving more diffuse interests. Mass. v. EPA, 549 U.S. at 517. The relevant inquiry is whether the State has been accorded a procedural right to bring the action by the legislature and if it is operating in its “quasi-sovereign” capacity. In such a case the State is “entitled to special solicitude in [the Court’s] standing analysis.” Id. at 520. Specifically, the Court held that if a litigant has been accorded a procedural right, the normal standards of redressability and immediacy need not be met. Id. at 517-18. The Vermont Attorney General has been granted the right to bring actions in the name of the State whenever he “has reason to believe that any person is using or is about to use any method, act, or practice declared by [the CPA] to be Regardless, the Patel case actually found standing existed for nearly identical conduct: using facial recognition technology without consent. Id. at 1273. 40 72 unlawful . . . and that proceedings would be in the public interest.” 9 V.S.A. § 2458(a). The Attorney General has the same authority to sue when he believes that Vermont’s prohibition on the fraudulent acquisition of data has been violated. 9 V.S.A. § 2431(b)(2). (“The Attorney General has the same authority to . . . bring civil actions, and take other enforcement actions as provided under [the CPA].) The State is acting in its capacity as a quasi-sovereign in this matter. Quasisovereign interests “consist of a set of interests that the State has in the well-being of its populace.” Alfred L. Snapp & Son, Inc. v. Puerto Rico, ex rel., Barez, 458 U.S. 592, 603 (1982) (“Snapp”). There is no definitive list of quasi-sovereign interests and they must be considered on a case-by-case basis, but one broad category of such interests is in “the health and well-being – both physical and economic – of its residents in general.” Id. at 607. Protecting consumers, preventing fraud, and ensuring an honest marketplace are seminal State interests necessary to protect the economic well-being of our citizens. See People by Underwood v. LaRose Indus. LLC, 386 F. Supp. 3d 214, 218 (N.D.N.Y. 2019); Abrams v. Gen. Motors Corp., 547 F. Supp. at 706. Protecting our citizens’ privacy is another. See State ex rel. Hatch v. Cross Country Bank, Inc., 703 N.W.2d 562 (2005). The Vermont General Assembly confirmed the necessity of protecting Vermonter’s privacy when it passed the FADL, including specifically the “risks associated with the widespread aggregation and sale of data about consumers, including risks related to consumers’ ability to know and control information held and sold about them and risks arising from the unauthorized or 73 harmful acquisition and use of consumer information.” General Assembly, Act 171 of 2018 at 2 (Vt., enacted Jan 1., 2019). Additionally, other courts apply a similar standing test when the State is acting as parens patriae. E.g. Connecticut v. American Elec. Power Co., Inc., 582 F.3d 309, 335 (2009). When acting in its quasi-sovereign interest as parens patriae the State is both representing the interests of its citizens and has an interest independent of its citizens. Snapp, 458 U.S. at 607 (“In order to maintain such an action, the State must articulate an interest apart from the interests of particular private parties, i.e., the State must be more than a nominal party. The State must express a quasi-sovereign interest.”) To have standing as parens patriae a state: (1) “must articulate an interest apart from the interests of particular private parties, i.e., the State must be more than a nominal party”; (2) “must express a quasi-sovereign interest”; and (3) must have “alleged injury to a sufficiently substantial segment of its population.” Connecticut, 582 F.3d at 335-36 (citing Snapp, 458 U.S. at 607). Here, the State’s interests in protecting an honest and fair marketplace and in avoiding the societal harm that can come from mass surveillance go beyond those of any individual party. See Abrams v. Gen. Motors Corp., 547 F. Supp. at 707 (upholding standing of attorney general where “the State had a “quasi-sovereign interest in securing an honest marketplace for all consumers”); People ex rel. Spitzer v. Grasso, 42 A.D.3d 126, 149-51 (N.Y. 2007), aff’d, 11 N.Y.3d 64, 893 N.E.2d 105 (2008) (“[t]he action is brought by the Attorney General, through its authority as 74 parens patriae”; “the Attorney General had a responsibility to bring this action to ensure that the [stock] Exchange was being operated in a fair and honest manner.”).As explained above the State brings this case in its capacity as a quasisovereign. It is unclear how many of Clearview’s 3 billion photographs are those of Americans – if they all are then 0.2% of them are likely to be photographs of Vermonters, or 6 million photographs. This indicates that a substantial segment of our population is at risk of injury. As to Clearview’s argument that “there is no harm, or material risk of harm, to the interests of Vermont,” Opp. 70. the State has set forth numerous harms in its Compl. ¶¶ 78; 81, and discussed them under the privacy impacts to consumers, including the loss of anonymity in Section V.A supra. General allegations of injury suffice to demonstrate injury at the pleading stage. Connecticut, 582 F.3d at 333 (“The Supreme Court has commented on the lowered bar for standing at the pleading stage.”) (citing Lujan, 504 U.S. at 561.) Finally, even as to private plaintiffs, privacy interests are deemed concrete injuries. See Opperman, 84 F. Supp. 3d at 991 (denying motion to dismiss for standing in class action against Apple and its Apps for collecting contact list and address books without consent and finding that “Plaintiffs here have sufficiently pleaded the injury of an invasion of their privacy by intrusion upon their seclusion . . . .Accordingly, the Court finds that Plaintiffs have adequately alleged an Article III injury.”); see also Mount v. PulsePoint, Inc., 684 F. App’x 32, 34 (2d Cir. 2017), as amended (May 3, 2017) (upholding standing and noting that “The district court 75 determined that plaintiffs adequately alleged two injuries in fact: loss of privacy and effect upon web-browser functionality. We agree as to loss of privacy and, therefore, need not address the latter. As the district court observed, PulsePoint’s alleged unauthorized accessing and monitoring of plaintiffs’ web-browsing activity implicates harms similar to those associated with the common law tort of intrusion upon seclusion so as to satisfy the requirement of concreteness.”); Patel, 932 F.3d at 1273 (finding standing for allegations of privacy intrusions). Similarly, the State adequately pled the privacy interests and harms that flow from Clearview’s conduct. See Section V.A supra. These same interests and harms suffice for purposes of standing. VIII. This Court is an Appropriate Venue for this Action Defendant states that actions for a violation of the CPA “can only be filed in the Superior Court in which the defendant ‘resides, has a place of business or is doing business’” under 9 V.S.A. § 2458(a), but then makes no argument that this action should not be brought in this Court Defendant does not argue that this Court lacks jurisdiction over it under V.R.C.P. 12(b)(2) or that this is an improper venue under V.R.C.P. 12(b)(3). In fact, Clearview says nothing more on the topic. The State presumes this was intended as a venue argument and will respond as such. Statutes that set forth which counties a defendant may be sued in “generally relate only to jurisdiction over the person, and confer on the defendant a privilege with regard to the place where he may be sued which may be waived by him.” J. O. Bilodeau & Co. v. Reed, 119 Vt. 342, 344, 126 A.2d 118, 119 (1956). Where the defendant has entered a general appearance, this privilege is waived and the 76 defendant becomes subject to that Court’s jurisdiction. Id. Further, 12 V.S.A. § 402 permits an action to be brought in whatever county a party resides, or where both parties are out of state, in any county. Here, Defendant resides out of state, and Plaintiff is the State. Clearview has directed its marketing materials to law enforcement agencies nationwide including in the State of Vermont. (See Defendant’s Response to Plaintiff’s Request for Admissions at 22-23, attached as Exhibit C). It has collected the photographs of Vermont citizens for the purpose of feeding them into its surveillance application. Compl. ¶¶ 24-25. It is unclear how many of Clearview’s 3 billion photographs are those of Americans – if they all are, then 0.2% of them are likely to be photographs of Vermonters, or 6 million photographs. Approximately one quarter of all Vermonters reside in Chittenden County. Clearview has also provided access to its App to businesses like Best Buy, Kohl’s, Walmart, Albertsons (which owns Shaw’s markets), Rite Aid, AT&T, and Verizon. Compl. ¶ 31. All these businesses operate throughout the State of Vermont, including in Chittenden County. The State has sufficiently demonstrated that this matter is properly brought in this Court. 77 CONCLUSION For all of the foregoing reasons, the State respectfully requests that Clearview’s motion to dismiss the Complaint be denied in its entirety. The State respectfully requests that the Court hear oral argument on the motion. Dated at Montpelier, Vermont, this 8th day of May 2020. STATE OF VERMONT THOMAS J. DONOVAN, JR. ATTORNEY GENERAL By: /s/ Ryan Kriger Ryan Kriger Justin Kolber Jill Abrams Assistant Attorneys General Office of the Attorney General 109 State Street Montpelier, Vermont 05609 ryan.kriger@vermont.gov justin.kolber@vermont.gov jill.abrams@vermont.gov (802) 828-3170 78 CERTIFICATE OF SERVICE I hereby certify that on this 8th day of May 2020, I served Plaintiff’s Opposition to Defendant’s Motion to Dismiss in the above-captioned matter by sending the same via electronic mail to Defendant’s counsel, Tristram J. Coffin, Esq. tcoffin@drm.com By: /s/ Ryan Kriger Ryan Kriger Assistant Attorney General 79 Exhibit A STATE OF VERMONT SUPERIOR COURT Chittenden Unit CIVIL DIVISION Docket No. 326-4-20 Cncv State of Vermont vs. Big Brother Security Programs and Palmer ENTRY REGARDING MOTION VERMONT SUPERIOR COURT FILED Title: Motion for Preliminary Injunction (Motion 1) Filer: State of Vermont Attorney: Justin E. Kolber Filed Date: April 13, 2020 Opposition filed April 20, 2020 by Ernest M. Allen, Attorney for Defendants . APR 2 7 2020 CHITTENDEN UNIT The State of Vermont brings this case against defendants Big Brother Security Programs Inc. and Shelley Palmer, alleging that they have engaged iri unconscionable price-gouging of essential personal protective equipment during the COVID-19 pandemic in violation of the Vermont Consumer Protection Act. The State seeks a preliminary injunction barring defendants from such sales. The court held a preliminary injunction hearing on April 22, a date agreed on by the parties. The parties agreed that the sworn declarations of the State's witnesses-David Cheney, Michael Schirling, and Shea Bellino-would be treated as their direct testimony, and they were all made available for cross-examination by defense counseL The parties stipulated to the admission of all the exhibits that had previously been submitted by both sides. Both sides chose to present oral argument on the record rather than filing post-hearing memoranda. Findings of Fact The court finds the following facts to be established by a preponderance of the evidence for purposes of this motion. Because this is a preliminary hearing, these facts are not necessarily binding for future proceedings. The· court could reach· contrary conclusions with a more through presentation of evidence at trial. On March 13, Governor Scott declared a state of emergency due to the COVID-19 crisis. Executive Order No. 01-20. That Order noted the March 11 declaration of a COVID19 pandemic by the World Health Organization, and among other things placed restrictions on travel, visits to residential care facilities and hospitals, and non-essential gatherings. The Order noted: it is critical we take steps to control outbreaks of COVID-19, particularly among those who are elderly or already have underlying chronic health conditions, to minjmize the risk to the public, maintain the health and safety of Vermonters, and limit the spread of infection in our communities and within our healthcare facilities. Id. at 1-2. Defendant Big Brother Security Programs, Inc. is solely owned and managed by Palmer. Its primary business is transporting patients for non-emergency medical treatment. Palmer also has several other businesses, including selling gold bullion, importing renewable energy systems from China, and renting medical equipment such as wheelchairs. Big Brother was not in the business of selling personal protective equipment (PPE) prior to March of this year. Neither Big Brother nor Palmer are certified resellers of PPE. Palmer has contacts in China and realized that PPE was going to be necessary as the COVID-19 pandemic hit the United States. Through his contacts he obtained thousands of surgical masks. He claims that he paid 55 to 60 cents per mask. He proffered an email that appears to show 60-cent and 65-cent prices (5,000 masks for $3,000 and 5,000 makes for $3,250). Ex. A. However, an invoice in one of the boxes of masks he sold 2 shows that he paid 10 cents per mask. Ex. 2. Palmer claims that the invoice is a fraudulent document created by someone he does not know for purposes of getting the masks though U.S. customs easily and without a customs duty. The court does not find Palmer's testimony on that issue to be credible, given the fact that-as discussed below-his testimony on other matters was obviously false. The court finds that he paid ten cents per mask. Palmer went to Central Vermont Medical Center (CVMC) on March 16 and spoke to David Cheney, the Director of Patient Support Services. They apparently knew each other already, presumably from Palmer's medical transport business. Palmer told Cheney he had surgical masks available for sale. Cheney asked for samples and pricing. On March 17, Palmer returned with a sample pack of 50 masks and quoted a price of $2.50 per mask. He said they were "considered in China as N95 masks." Cheney could see they were clearly only surgical masks. Palmer told Cheney he was "here to help" and was not malting a profit on the masks. That was clearly false. Cheney told Palmer the hospital usually paid 6 cents per mask, but that the hospital "had little choice due to the impending PPE shortages and need to keep patients and employees safe." Cheney Declaration at 9. Cheney had the samples reviewed by the hospital's quality control department, which found that they met standards for surgical masks. He then received approval to purchase them, and bought 9,500 on March 18, 15,000 on March 20, and 18,000 on March 24, all for $2.50 per mask. CVMC paid 6 cents per mask prior to the COVID-19 crisis. During the crisis, it has paid other sellers up to 30 or 40 cents per mask. CVMC paid the much higher prices for Palmer's masks because of concerns about the supply shortage and the need to protect 3 employees and visitors. CVMC currently has a large shipment of PPE on order that it is having trouble getting into the United States. The invoices to CVMC from Big Brother falsely described them as N 95 masks. The original packaging in which the masks came did not say N95, but only "face masks." Exs. 4c, 4d. In one of the boxes was an invoice from the manufacturer showing a sale price of 10 cents per mask. Ex. 2. Mr. Palmer tried to sell the masks to Champlain Medical Urgent Care on March 17. The conversation was recorded on the office video system. Palmer held two packets of masks wrapped in plastic and offered them to the practice for $2.50 a mask. He said: "these aren't the fancy ones, these are regular industrial N95s." The medical assistant, Shea Bellino, looked at the package and said: "these look like surgical masks to me, not the N95s." A coworker held up an N95 mask and showed Palmer what N95s look like. Palmer responded: "those each have the same rate" and asserted that his were N95s because they had "the aluminum that goes on your nose." Bellina's declaration adds to what can be heard on the video. She explained that aluminum on the mask does not make it an N 95 mask. Bellino is familiar with such masks because the clinic specializes in occupational health services and many of the clinic's patients are sent by their employers to be fitted for respirators. She routinely conducts N95 fit testing and was clear that Palmer's masks were not N95s. The practice declined to purchase them. Bellino Dec. ,i,i 9-12. The same day, Palmer approached the Vermont Department of Public Safety with an offer to sell it masks. He met with Commissioner Michael Schirling, and showed him a box of masks that Palmer stated were N95 masks. Palmer offered to sell 10,000 masks for $2.50 each. Schirling and Deputy Commissioner Christopher Herrick examined the 4 masks and, being familiar with N95 masks, immediately saw ·that they were merely surgical masks. They told Palmer the price was too high for surgical masks, which should be under $1.00, and declined to purchase them. Palmer continued to maintain that they were N95 masks. Palmer asserts that Commissioner Schirling is lying both about Palmer claiming they were N 95 masks, and about Schirling saying the price was too high for surgical masks. The court disagrees, and finds Commissioner Schirling credible. Palmer testified that he is OSHA certified and knows all about the different types of masks. He also asserts that an N95 "is a respirator, it is not a mask." He claims that his office manager put "N95" on the CVMC invoices without his input, and that he does not care what she puts on the invoices. The court does not find it credible that the office manager would do that without Palmer's direction, given that the masks were not identified as N-95 by the distributor. At the end of March, the State sent Palmer a cease-and-desist order. 1 However, Palmer contacted CVMC again on April 6 and said that "the AG had reached out" so he was no longer selling the masks, but had a "partner company" that could sell them. He identified that company as "RICHCO Inc." and stated that the price remained $2.50. CVMC bought 16,850 more masks for $2.50 each on April 6 and 8 by payment totaling $41,625 to RICH CO. They were delivered by someone wearing a Big Brother Securities tshirt. Palmer's testimony as to his actions after receiving the cease-and-desist letter was inconsistent. He first denied selling masks to anyone other than CVMC. Later he claimed that he had sold some to one of his own employees, Richard Morrell. Morell's wife is The letter was not offered in evidence, and it is unclear whether Palmer was ordered to stop selling masks entirely, or ordered to sell only at lower prices. 5 1 Palmer's office manager. Palmer claimed that he did not tell Morrell to sell them to CVMC, or that the price should be $2.50. He claimed that Morrell must have made those decisions himself, since he knew where Palmer had been selling them and for how much. Palmer also claimed that he believed Morrell was selling the masks out of state. The court finds these claims are false. Palmer either had Morrell sell CVMC 16,850 masks for Palmer through a front company, or sold the masks to Morrell at roughly $2.00 a mask to resell, after the State sent the cease and desist letter. Morrell personally paid Palmer a total of $32,500 in two separate payments on April 2, and one on April 10. Palmer had the payments go to a different one of his companies, Ca-Ching, Inc., rather than to Big Brother. Ca-Ching then paid the funds over to Big Brother. Palmer asserts that the price of $2.50 a mask was justified because in addition to the price he paid for the masks-which he claims was 50-60 cents per mask, but which the court has found was 10 cents per mask-he incurred costs for loans to buy them, staff to repackage them, a 4 % credit card fee that the seller charged back to him, and bank transfer fees. He offered no documentation of any of these alleged costs. He claims that he had his staff repackage the masks in 50-count quantities into Ziplock bags (while wearing PPE and in a decontamination room) after the first shipment to CVMC because it was reported to be undercounted. However, all of the photos of the deliveries to CVMC show the masks in their original packaging. Ex. 4. The court does not find Palmer's claims about all of these extra costs to be credible. The court finds that his cost was actually ten cents per mask, with no other costs but his minor expenditure of time delivering them, which he has not documented. Therefore, he was charging essentially 2500 % of his cost. 2 2 In any case, even if his claims were true, Palmer testified that the additional expenses increased his cost to a total of only $1.00 per mask. Under his own numbers, then, his profit would have been 150 % of his cost. 6 His profit was· $2-40 per mask, or a 2400 % profit. Palmer asserts that this was nonetheless a very reasonable price because the masks are in short supply all over the United States and "no one can get any." He claims that "people are very appreciative to get a quality product at a price they can afford." Palmer states that he has given away thousands of the masks for free, including to his wife's department at UVM Medical Center, police departments, and grocery stores. That is not directly relevant to whether his sales and attempted sales were in violation of the law. In sum, the court rejects much of Palmer's testimony, because some was just not believable, some was contradicted by other more credible witnesses, he changed his own testimony from moment to moment, he lied to his customers, and he blatantly lied under oath. For example, Palmer falsely testified that he never said the masks were N95 masks despite the fact that he is heard on video saying exactly that, and Commissioner Schirling also credibly testified that he said that. Palmer testified that he repackaged most of the masks into zip-lock bags despite the photographs in evidence clearly showing they were sold in their original plastic packaging from China. He lied to his potential customers when he said that he was just there "to help" and when he claimed he was not malting a profit. He falsely testified that he never told CVMC he could sell more masks through another company despite the cease-and-desist letter. His claims are for the most part entirely lacking in credibility. Conclusions of Law To obtain a preliminary injunction at the start of a case a plaintiff must normally demonstrate "(1) the threat of irreparable harm to the movant; (2) the potential harm to the other parties; (3) the likelihood of success on the merits; and (4) the public interest." 7 Taylor v. Town of Cabot, 2017 VT 92, ,r 19, 205 Vt. 586; Glossip v. Gross; 135 S. Ct. 2726, 2736 (2015). Irreparable harm generally means that the harm cannot be fully remedied at the end of the litigation-for example, by an award of money damages. Taylor, 2017VT 92, ,r,r 40-42; In re Investigation Into Gen. Order No. 45, 2013 VT 24, ,r 7, 193 Vt. 676 (mem.). "Because of the often drastic effects of the temporary injunction, the power to issue it must be used sparingly, and only upon a showing of irreparable damage during the pendency of the action .... " State v. Glens Falls Ins. Co., 134 Vt. 443,450 (1976). However, where the government seeks an injunction to enforce a statute, it generally "is not required to show irreparable harm or the unavailability of an adequate remedy at law... " Town of Sherburne v. Carpenter, 155 Vt. 126, 129 (1990). Under those circumstances, we "instead employ a presumption of irreparable harm based on a statutory violation." City of New York v. Golden Feather Smoke Shop, Inc., 597 F.3d 115, 120 (2d Cir. 2010). "The passage of the statute is, in a sense, an implied finding that violations will harm the public and ought, if necessary, be restrained." United States v. Diapulse Corp. of Am., 457 F.2d 25, 28 (2d Cir. 1972). Thus, the State need not demonstrate irreparable harm here: it is presumed if the State shows a likelihood of success on the merits. Likelihood of Success The State relies upon the Vermont Consumer Protection Act (the Act), 9 V.S.A. § 2451 et seq. That statute provides that the Vermont Attorney General may seek a preliminary injunction to restrain violations of the Act. Id. § 2458(a). The specific provision at issue here is Section 2453(a), which provides as follows: "Unfair methods of competition in commerce and unfair or deceptive acts or practices in commerce are hereby declared unlawful." Although the phrase "unfair or deceptive acts or practices in 8 commerce" is not defined, the Act points the courts to the interpretations given to the phrase under federal law. Id.§ 2453(b); Poulin v. Ford Motor Co., 147Vt. 120,124 (1986). Although the Act refers to "consumer" protection, it applies to business customers as well as individual customers. Id. at§ 2451a(a); Rathe Salvage, Inc. v. R. Brown &Sons, Inc., 2008 VT 99, ,i 21, 184 Vt. 355. The Act "is designed not merely to compensate consumers for actual monetary losses resulting from fraudulent or deceptive practices in the marketplace, but more broadly to protect citizens from unfair or deceptive acts in commerce ... and to encourage a commercial environment highlighted by integrity and fairness." Anderson v. Johnson, 2011 VT 17, ,i 7, 189 Vt. 603 (quotations and citations omitted). The State argues that selling the surgical masks at issue here at 2500 % of cost-or even 150% of cost as Palmer claims-is an unfair act in commerce. The Vermont Supreme Court has pointed to three criteria to consider in determining whether a practice is unfair, including (1) whether it "offends public policy," (2) whether it is "immoral, unethical, oppressive, or unscrupulous," and (3) whether it "causes substantial injury to consumers." Christie v. Dalmig, Inc., 136 Vt. 597, 601 (1979), quoting F.T.C. v. Sperry & Hutchinson Co., 405 U.S. 233, 244 n.5 (1972). Our Supreme Court has not yet addressed whether all three criteria are required. However, the United States Supreme Court in Sperry seemed to reject that argument (albeit in passing in a footnote). Sperry, 405 U.S. at 244 n.5. The Federal Trade Commission has since made that its express position. FTC Policy Statement on Unfairness (Dec. 1980), 2 Fed. Trade Comm'n. Appendix D-1 (noting that "[u]njustified consumer injury" by itself "can be sufficient to warrant a finding of unfairness" and "[s]ometimes public policy will independently support a Commission action."); see also, Ramirez v. 9 Health Net of the Northeast, Inc., 938 A.2d 576, 589 (Conn: 2008)("All three criteria do not need to be satisfied to support a finding of unfairness. A practice may be unfair because of the degree to which it meets one of the criteria or because to a lesser extent it meets all three.")(citation omitted); Johnson v. Phoenix Mut. Life Ins. Co., 266 S.E.2d 610, 621 (N. C. 198o)("A practice is unfair when it offends established public policy as well as when the practice is immoral, unethical, oppressive, unscrupulous, or substantially injurious to consumers.")(emphasis added; citations omitted). Palmer does not argue to the contrary (arguing instead only that "the three criteria ... have little application to the facts" here-Opp. at 3). Thus, the court concludes that the three factors are independent. Public Policy The first issue is that of public policy. To determine this question, we look to whether the policy is "established by statutes, the common law, or otherwise-whether, in other words, it is within at least the penumbra of some common-law, statutory, or other established concept of unfairness." 29 Fed. Reg. 8355 (1964), quoted in Sperry, 405 U.S. at 244 n. 5. The only Vermont Supreme Court case the court has found addressing whether overpricing is an unfair practice is Lalande Air & Water Corp. v. Pratt, 173 Vt. 602 (2002)(mem.). That case involved a mobile home rent increase. The court held on the facts of that case that the increase, and the landlord's attempts to collect it, were not unfair practices. It did not reject the overall idea that such increases could, at some level, constitute an unfair practice. Here, the State points to a number of sources for a policy determination. The first is the COVID-19 emergency declaration issued by Governor Scott on March 13-several days before the acts at issue here-which focused on the need to protect public health in 10 the community and "within our healthcare facilities." Executive Order No. 01-20 at 2. The next is other states' "price-gouging" laws, as well as Vermont's fuel products pricegouging law, 9 V.S.A. § 2461(d). The last is federal law, which bars price-gouging of designated critical materials, including PPEs such as face masks. 50 U.S.C. §4512; Notice of Designation of Scarce Materials or Threatened Materials Subject to COVID-19 Hoarding Prevention Measures (effective March 25, 202o)("HHS Notice"). Price-gouging is a term of art used to mean "[t]he unlawful or unfair raising of prices." Black's Law Dictionary (11th ed. 2019). For example, New York's price-gouging law bars "charging unconscionably excessive prices for essential consumer goods during disruptions in the market caused by such forces as strikes, power failures, weather conditions and other emergencies." People by Abrams v. Two Wheel Corp., 525 N.E.2d 692,693 (N. Y. 1988). The Vermont statute to which the State points says, inter alia, that a price for a fuel product "is unconscionably high" if there is "a gross disparity" between it and the pre-emergency prices,3 and that disparity is not substantially attributable to increased costs at the supply end. 9 V.S.A. § 2461d(c). Other states use similar definitions for "unconscionably excessive" or "unconscionably high" prices during states of emergency. See, e.g., N.Y. Gen. Bus. Law§ 396-r (McKinney); Fla. Stat. Ann.§ 501.160 (West). The federal law bars sales "in excess of prevailing market prices." 50 U.S.C.A. § 4512. Under any of these statutes, the $2.50 per mask prices Palmer charged-at a $2-40 profit per mask-would be excessive. They were certainly "in excess of prevailing market 3 That fuel products statute refers to the pre-emergency prices at which the defendant sold the product. 9 V.S.A. § 2461d(c)(1)A). Here, defendants were not selling the product prior to the emergency. However, the concept is the same for purposes of the analogy the State is making: what was the product going for prior to the emergency? 11 prices" and there was unquestionably a "gross disparity" between his price and both preemergency and current prices in the marketplace-respectively 6 cents per mask and 3040 cents per mask. The question is whether these analogous provisions are a proper source for a finding that Palmer's conduct violated public policy. Palmer argues that they are not, for two reasons. First, because the Legislature has never passed a price-gouging law for PPE, only-in 2005-for fuel products. Second, because the Governor's emergency declaration does not squarely address "hospital supplies of the pricing thereof." Opp. at 4. The fact that there is not a precise statute or declaration directly discussing PPEs is not relevant. If a separate law or executive order was required to find a particular practice unfair under the Act, the Act would have little meaning. Moreover, the Sperry case expressly rejected the argument, concluding that in determining what is "unfair" the FTC may "consider[] public values beyond simply those enshrined in the letter or encompassed in the spirit of' other laws. Sperry, 405 U.S. at 244. Palmer also argues that there is nothing wrong with making a large profit, and that many businesses routinely have significant markups on their products. However, no evidence was presented to support such claims, and even Palmer did not argue that charging 2500 % of cost is a normal business practice in any industry. Even if it were, the issue here is what is fair when the product is a crucial one needed by medical providers and patients during a health emergency, not what is permissible in normal market conditions. The court concludes that charging extremely inflated prices to medical providers for crucial personal protective equipment during a public health emergency is a violation of public policy. Palmer's pricing of 25 times his cost, and at least six times the prevailing 12 price during the emergency, is by any measure·grossly excessive and unconscionably high. Even if the court accepted his claims that his cost was $1.00 per mask rather than 10 cents-which it does not-he was making a profit of 150%. That, too, would be grossly excessive and unconscionably high. Such overcharging for needed medical supplies during a pandemic the likes of which few people alive today have ever seen, solely for personal profit, shocks the conscience. There is no question that it meets the definition of unfair business conduct. Palmer presents several other skeletal arguments in opposition. First, he argues that there is no proof that CVMC is a "consumer" under the Act, because those who purchase for resale are not consumers. 9 V.S.A. § 2451(a). Palmer argues that perhaps CVMC resells masks to patients. The court deems that highly unlikely, but in any case Palmer's speculation is not a sufficient basis on which the court can rule. As Palmer presented no evidence to support these musings, the argument fails. Next, Palmer argues that the Act applies only to acts removing competition from the marketplace. He cites zero authority for that proposition, and the court rejects it. The Act "is designed not merely to compensate consumers for actual monetary losses resulting from fraudulent or deceptive practices in the marketplace, but more broadly to protect citizens from unfair or deceptive acts in commerce ... and to encourage a commercial environment highlighted by integrity and fairness." Anderson, 2011 VT 17, ,i 7 (quotations and citations omitted). Palmer also contends that there was no deception here because the prospective purchasers were all smart enough to know the masks were not N95s, and the one purchaser knew what it was getting: surgical masks, not N95 masks. As the State is not relying on the "deceptive act" portion of the statute, this is not relevant. 13 Finally, Palmer argues that the statute is too vague to be enforced. Again, he cites zero authority for this proposition. Palmer unsuccessfully made a similar argument in a previous case. In re Palmer, 171 Vt. 464 (2000). The case involved the revocation of Palmer's license to act as a bail bondman due to a "pattern of misconduct." Id. at 469. In addition to lying to a court-as here-the misconduct included (1) taking a deed to a defendant's home worth $28,500 as collateral for $200 bail, then transferring title to himself when the defendant failed to pay him the $200, and (2) taking a truck as collateral for a $2,500 promissory note for bail, then selling the truck and keeping the full $17, 650 sale price for himself. The statute in question, which applied to insurance and similar businesses, used the same language as in the Act here: "unfair or deceptive act or practice." 8 V.S.A. § § 4723. It also barred "untrustworthy or financially irresponsible" conduct. Id.§ 4804(a)(9). Among other things, Palmer argued that "the vagueness of the statutes prevented him from getting fair notice of what conduct was circumscribed." Id. at 471. The Court rejected that claim, ruling that "[s]tatutory language that conveys a definite warning as to proscribed conduct when measured by common understanding and practices will satisfy due process." Id. at 472. The Court went on to note that "Palmer's conduct ... was nothing short of outrageous. The terms of the bail agreements negotiated in those instances were plainly unconscionable, and defendant's conduct in attempting to enforce the unconscionable terms of those agreements was plainly dishonest." Id. at 47374. The same is true here. Palmer's claim that similar statutory language here is too vague for him to have known what was proscribed falls flat. Because the court has found that Palmer's actions violate public policy, it need not address the other two potential bases for a finding of unfairness under the Consumer 14 Protection Act. The court concludes that the State is likely to succeed on the merits of its claim at trial. Potential Harm to Others Before issuing a preliminary injunction, the court must also weigh the potential harm to others. Palmer and his company proffered little evidence in the way of harm to them. Palmer testified that he has many businesses, and that selling PPE is a new venture he has just stepped into, so there is no evidence that he will be put out of business in general. 4 Other than the fact that he took out a loan to purchase some of the materials, which the court questions as it is entirely undocumented, no evidence was presented as to any real harm to him or his company. There is potential harm to others in that the surgical masks Palmer was selling may not be otherwise available to Vermont purchasers. However, Palmer could certainly choose to sell them for a reasonable price instead. The evidence did not establish that he is the only source of such masks in Vermont, or how much his contribution of masks to the market here matters. No medical providers testified that they desperately need his masks today. The court does not have sufficient evidence to find that there will be significant harm to consumers if Palmer is enjoined from selling masks at inflated prices. The Public Interest The last element of the preliminary injunction analysis is the public interest. In this case, as noted above, there is a presumption that it is in the public interest to enforce laws passed by the Legislature for the protection of the pubic. "The passage of the statute is, in a sense, an implied finding that violations will harm the public and ought, if 4 At the end of the hearing, after the evidence was closed and legal arguments were concluded, Mr. Palmer spontaneously offered that he has lost other business due to the allegations by the State. As he was not under oath and the evidence was closed, the court cannot consider such an offhand statement. 15 necessary; be restrained." Diapulse, 457 F.2d at 28. Palmer offers no contrary argument. There is of course a public interest in making PPE available to medical providers and patients, but that is not the question. The court is not being asked to bar Palmer from selling PPE at all: only to bar him from selling such equipment at outrageously inflated prices. The court can see no public interest that supports his pricing. Order The evidence established that Palmer and his company bought surgical masks from China for 10 cents a mask, and then marketed and sold them to medical professionals at a price of_ $2.50 a mask. This was a $2,40 profit per mask. Selling crucial personal protective equipment (PPE) desperately needed to save lives during a health emergency at a 2400 % markup is an unconscionable act in violation of public policy. The State is therefore likely to succeed at trial on the merits of its claim that Palmer and Big Brother Security, Inc. violated the Vermont Consumer Protection Act. There was no evidence of any significant harm to others if the injunction is issued, and the public interest supports enforcement of the consumer protection laws. Therefore, the State is entitled to a preliminary injunction barring Palmer and any of his companies from selling PPE at inflated prices. Palmer may file by April 30 any objection to the specific language in paragraphs 7-13 of the preliminary injunction order proposed by the State. Electronically signed on April 26, 2020 at 02:09 PM pursuant to V.R.E.F. 7(d). Helen M. Toor Superior Court Judge 16 Notifications: Justin E. Kolber (ERN4303), Attorney for Plaintiff State of Vermont Ernest M. Allen (ERN 3968), Attorney for Defendant Big Brother Security Programs Ernest M. Allen (ERN 3968), Attorney for Defendant Shelley Palmer Merideth C. Chaudoir (ERN 5805), Attorney for party 1 Co-Counsel James David Renner (ERN 6803), Attorney for party 1 Co-Counsel 17 Exhibit STATE OF VERMONT CIVIL DIVISION Docket No. 484-7-10 Wncv SUPERIOR COURT Washington Unit STATE OF VERMONT, Plaintiff V. CSA-CREDIT SOLUTIONS OF AMERICA, LLC and DOUG VAN ARSDALE, Defendants -.0 DECISION AND ORDER: MOTION FOR SUMMARY JUDGMENT I. INTRODUCTION The State of Vermont, by the Office of the Attorney General, filed this lawsuit under the Consumer Fraud Act, 9 V.S.A. chapter 63, in which it alleged four categories of consumer fraud violation by CSA-Credit Solutions of America ("CSA"), a Texas-based "debt settlement" company, and by Doug Van Arsdale, its chief executive. The suit alleges that Defendants (a) used deceptive and unsubstantiated online "results" claims to advertise their services to economically distressed consumers, (b) failed to comply with statutory requirements relating to consumers' right to cancel their contract with CSA, (c) failed to abide by many provisions of the Vermont Debt Adjusters Act, and (d) employed an advance-fee structure that constituted an unfair trade practice. The first three of these causes of action are the subject of a Motion for Summary Judgment filed by the State. This action was filed on July 2, 2010; Defendants' Answer was filed on July 9, 2010. On September 20, 2011, Defendants' counsel moved for leave to withdraw. On September 29, 1 the motion was granted and Defendants were directed to have successor counsel file a notice of appearance within 45 days. To date, the Court has received neither notice of appearance by counsel nor a notice of self-representation. On November 18, Plaintiff filed its Motion for Summary Judgment with supporting documents. 1 To date, Defendants have not responded to the motion in any manner. II. THE STANDARDS GOVERNING SUMMARY JUDGMENT The procedure for summary judgment is authorized by Rule 56 of the Vermont Rules of Civil Procedure. That rule provides a method by which a case, or a claim or defense, may be disposed of before trial where no genuine issue as to any material fact exists, or where only a question of law is involved. As stated in Rule 56(c), "Nile judgment sought shall be rendered forthwith if the pleadings, depositions, answers to interrogatories, and admissions on file, together with the affidavits, if any, show that the moving party is entitled to a judgment as a matter of law." The moving party has the burden of establishing that there exist no issues of material fact, and that the movant is entitled to judgment as a matter of law. Gore v. Green Mountain Lakes, Inc., 140 Vt. 262, 264 (1981). On the other hand, where the issue before the court is solely one of law, and the moving party is entitled to judgment as a matter of law, the granting of summary judgment is appropriate. Garneau v. Curtis & Bedell, Inc., 158 Vt. 363, 366 (1992). Moreover, opposing allegations must have sufficient support in specific facts to create a genuine issue of material fact, Baldwin v. Upper Valley Services, Inc., 162 Vt. 51, 55 (1994); mere denial of the moving party's pleadings is not enough. Gendreau v. Gorczyk, 161 Vt. 595, 596 (1993) (mem.). All material facts set forth in the statement The motion was anticipated by an amended Discovery Stipulation and Order filed by the parties on September 29, 2011. 2 required to be served by the moving party will be deemed to be admitted unless controverted by the statement required to be served by the opposing party. V.R.C.P. 56(c)(2). III. THE MATERIAL FACTS AS TO WHICH THERE IS NO GENUINE ISSUE TO BE TRIED As required by V.R.C.P. 56(c)(2), the State annexed to this Motion a Statement of Material Facts as to Which There is No Genuine Issue to Be Tried. ). Since the Defendants have not controverted any of the statements submitted by the Plaintiff, the Court deems them to be admitted. Gallipo v. City of Rutland, 2005 VT 83, 411 33, 178 Vt. 244. Material facts from the Statement are referred to below as "MF" followed by their corresponding number, as in "MF 13." IV. OVERVIEW OF DEFENDANTS' BUSINESS AND INDUSTRY Defendant CSA-Credit Solutions of America, LLC, is a Delaware limited liability corporation with offices in Dallas, Texas. MF 1. The company is engaged in the business of settling consumer debts with the creditors to whom the debts are owed. MF 2. CSA-Credit Solutions of America, LLC, is the surviving entity of a December 2009 merger with CSACredit Solutions of America, Inc. MF 3. The former has stipulated that it is liable for the actions of its "Inc." predecessor. 2 MF 4. Defendant Doug Van Arsdale is a resident of Texas. MF 5. In December 2003, he founded CSA (Inc.). MF 6. He then served as Chief Executive Officer and Director of the company until November 2006 and Registered Agent until June 2007. MF 7. In December 2007, Mr. Van Arsdale resumed his positions as Chief Executive Officer and Registered Agent of the corporation. MF 8. He was also the sole owner of CSA from December 2003 to 2 In the remainder of this, CSA-Credit Solutions of America, Inc., and CSA-Credit Solutions of America, LLC, are referred to as "CSA." 3 November 2006, and from December 2007 until December 2009. MF 9. In December 2009, he founded CSA (LLC), of which he has served as Manager and Governing Person. MF 10. At all times relevant to this action, CSA held itself out as a "debt settlement" company offering to negotiate reductions in the principal amount of consumers' debts. MF 11. CSA advertised its services through its Internet website, and consumers who wished to respond either called CSA or provided their contact information on the web site and received a return call from CSA. 3 MF 12. Under CSA's Terms of Agreement—also called its Client Service Agreement, MF 14 consumers enrolled" their debts with CSA in exchange for service fees. MF 15. CSA was responsible for negotiating settlement offers on those debts. MF 16. Consumers were to make contractually-specified monthly payments into a bank account, out of which CSA's fees were electronically drawn by the company. MF 17. Consumers were responsible for depositing additional monies to pay any agreed-upon settlements to their creditors. MF 18. CSA's service fees were typically calculated as 15 percent of the principal amount of each debt enrolled in its program, MF 19, and paid during the first months of enrollment. MF 20. For example, one Vermont consumer with $42,400 in debts was charged fees of 15 percent of that amount, or $6,360, of which $636 was paid in each of the first four months, and $318 was paid in each of the next 12 months; the consumer was also expected to set aside an additional $332 a month for 12 months to fund debt settlements. MF 21. At its height, CSA had 1,200 employees, including some 400 sales staff. MF 22. The company's website referred at various times to having enrolled 250,000 consumers, MF 23, with enrolled debts worth a total of more than $1 billion. MF 24. 3 CSA may also have called some other consumers whose names were provided by "lead generators." MF13. 4 CSA is a member of an industry described by the FTC as offering debt settlement plans that, "as they are often marketed and implemented, raise[d] several consumer protection concerns." One concern of direct relevance to the instant motion is advertising that made what the FTC termed "false, misleading, or unsubstantiated representations," such as claims that "the provider will or is highly likely to obtain large debt reductions for enrollees, e.g., a 50% reduction of what the consumer owes," and that "the provider will or is highly likely to eliminate the consumer's debt entirely in a specific time frame, e.g., 12 to 36 months." FTC, Telemarketing Sales Rule, Final Rule Amendments, 75 Fed. Reg. 48458, 48463 (Aug. 10, 2010) (hereinafter "FTC). Between January 19, 2004, and October 29, 2008, 4 207 Vermonters paid CSA over $350,000 in debt settlement fees, net of refunds. 5 MF 26. V. STATUTORY FRAMEWORK: THE VERMONT CONSUMER FRAUD ACT—DECEPTION, UNFAIRNESS, AND LACK OF SUBSTANTIATION A. Introduction The legal framework for most of the State's causes of action in this case is provided by the Vermont Consumer Fraud Act. 6 That statute prohibits any unfair or deceptive act or practice in commerce. See 9 V.S.A. § 2453(a). In applying the concepts of unfairness and deception, the courts of Vermont are to be "guided" by precedent from the FTC and the federal courts. 9 V . S .A. § 2453(b). The Consumer Fraud Act is a remedial statute, to be interpreted liberally to effectuate its purpose of protecting consumers. See, e.g., Carter v. Gugliuzzi, 168 Vt. 48, 52 4 Of the 207 Vermont consumers enrolled with CSA, all but 3 signed up before the start of 2008, and all but 66 before the start of 2007. MF 25. 5 According to CSA's data, Vermonters paid a total of $371,886.43 and received refunds of $18,051.06, for a net of $353,835.37. MF 27. 5 (1998) ("The express statutory purpose of the Act is to 'protect the public' against 'unfair or deceptive acts or practices.' ... Its purpose is remedial, and as such we apply the Act liberally to accomplish its purposes."); Sawyer v. Robson, 181 Vt. 216, 223 (2006) ("As we emphasized in Elkins [v. Microsoft, 174 Vt. 328, 331 (2002)], 'The Legislature clearly intended the [Consumer Fraud Act] to have as broad a reach as possible in order to best protect consumers against unfair trade practices.'"); State v. Custom Pools, 150 Vt. 533, 536 (1988) ("[T]he Act is clearly remedial in nature. Therefore, we must construe the statute liberally so as to furnish all the remedy and accomplish all the purposes intended."); accord, State v. Therrien, 161 Vt. 26, 30-32 (1993), and Fancher v. Benson, 154 Vt. 586 (1990). B. The Consumer Fraud Act Prohibits Deceptive Trade Practices. The Consumer Fraud Act prohibits deceptive acts and practices in commerce. 9 V.S.A. § 2453(a). As noted in Carter v. Gugliuzzi, 168 Vt. at 56, deception has three elements: (1) there must be a representation, omission, or practice likely to mislead consumers; (2) the consumer must be interpreting the message reasonably under the circumstances; and (3) the misleading effects must be material, that is, likely to affect the consumer's conduct or decision regarding the product. ... Deception is measured by an objective standard, looking to whether the representation or omission had the "capacity or tendency to deceive" a reasonable consumer; actual injury need not be shown. ... To be reasonable, moreover, the consumer's understanding need not be the only one possible; "[i]f an ad conveys more than one meaning to reasonable consumers and one of those meanings is false, that ad may be condemned." ... Furthermore, the Act "does not require a showing of intent to mislead, but only an intent to publish the statement challenged." [Citations omitted.] The third element of deception, materiality, is measured by an objective standard, based on what a reasonable person would regard as important in making a decision. Carter, 168 Vt. at 56 (citing In re Cliffdale Assocs., 103 F.T.C. 110, 179 (1984)). The federal courts and the FTC apply a general presumption of materiality: "Where the seller knew, or should 6 The other statute relied upon in this lawsuit is the Vermont Debt Adjusters Act 6 have known, that an ordinary consumer would need omitted information to evaluate the product or service, or that the claim was false, materiality will be presumed because the manufacturer intended the information or omission to have an effect." Id. at 56 (quoting Cliffdale, 103 F.T.C. at 182). Express claims are automatically deemed to be material. Id. C. The Consumer Fraud Act Prohibits Unfair Trade Practices. In addition to prohibiting deceptive trade acts and practices, the Consumer Fraud Act, 9 V.S.A. § 2453(a), bans unfair acts and practices in commerce. The definition of unfairness is set out in Christie v. Dalmig, 136 Vt. 597, 601 (1979) (quoting F.T.C. v. Sperry & Hutchinson Co., 405 U.S. 233, 244 n.5 (1972)): "(1) whether the practice, without necessarily having been previously considered unlawful, offends public policy as it has been established by statutes, the common law, or otherwise—whether, in other words, it is within at least the penumbra of some common-law, statutory, or other established concept of unfairness; (2) whether it is immoral, unethical, oppressive or unscrupulous; [or] (3) whether it causes substantial injury to consumers..." While the FTC has stated that substantial injury is the most important of the three alternative formulations of unfairness, it has also noted that violation of public policy as established by statute (among other legal sources) can be used either to support an unfairness claim based on substantial consumer injury or to demonstrate on its own that such injury is present, as long as the public policy is "clear and well-established." Commission Statement of policy on the Scope of the Consumer Unfairness Doctrine, Appendix to In re International Harvester, 104 F.T.C. 949, 1984 WL 565290 at *95, *98-99.7 D. Lack of Prior Reasonable Substantiation Is Both Deceptive and Unfair. 7 In Lalande Air & Water Corp. v. Pratt, 173 Vt. 602 (2002), the Vermont Supreme Court also analyzed unfairness in terms of its oppressive or unscrupulous character under that alternative prong of the Sperry & Hutchinson standards, although there it did not find the acts at issue—sending demand letters and filing suit to collect rent beyond that allowed by a ruling whose constitutionality was under legal challenge—to be unfair. 7 A key requirement of commercial advertising is that the advertiser must possess prior reasonable substantiation for any factual claims that are made. See Policy Statement Regarding Advertising Substantiation Program, 49 Fed. Reg. 30999 (Aug. 2, 1984) ("We affirm our commitment to the underlying legal requirement of advertising substantiation—that advertisers and ad agencies have a reasonable basis for advertising claims before they are disseminated.") It has been held to be both unfair and deceptive for a person to make factual claims to prospective customers without prior reasonable substantiation. For example, analyzing the need for substantiation from the standpoint of unfairness, the FTC stated in In re Pfizer, Inc., 81 F.T.C. 23, 1972 WL 127465 at *29, [T]he Commission is of the view that it is an unfair practice in violation of the Federal Trade Commission Act to make an affirmative product claim without a reasonable basis for making that claim. Fairness to the consumer, as well as fairness to competitors, dictates this conclusion. Absent a reasonable basis for a vendor's affirmative product claims, a consumer's ability to make an economically rational product choice, and a competitor's ability to compete on the basis of price, quality, service or convenience, are materially impaired and impeded. At the same time, the FTC has also held a failure to substantiate to be deceptive: Advertising that lacks a reasonable basis is also deceptive. ... The deception theory is based on the fact that most ads making objective claims imply, and many expressly state, that an advertiser has certain specific grounds for the claims. If the advertiser does not, the consumer is acting under a false impression. The consumer might have perceived the advertising differently had he or she known the advertiser had no basis for the claim. Cliffdale Associates, Inc., 103 F.T.C. 110, 1984 WL 565319 at *45 n.5. Finally, where claims are involved "whose truth or falsity would be difficult or impossible for consumers to evaluate by themselves"—as is true in this case—a "high level of substantiation" is required. Thompson Medical Co., Inc., 104 F.T.C. 648, 1984 WL 565377 at *72. 8 VI. DEFENDANTS VIOLATED THE CONSUMER FRAUD ACT BY MAKING DECEPTIVE AND UNSUBSTANTIATED RESULTS CLAIMS. The first of the State's causes of action is that Defendants violated the Vermont Consumer Fraud Act by repeatedly advertising, deceptively and without substantiation, that they could achieve specified results for consumers in terms of settling debts at amounts substantially below the principal balance due. These claims—which were expressed in terms of percentages (e.g., "Settle Debts For 40%-60% Off Balance") or time (e.g., "Become Debt Free In Less Than 36 Months")—appeared on CSA's website, through which consumers in financial difficulty were lured to contact the company. A. CSA Repeatedly Promised Consumers Major Reductions in Their Debts. CSA solicited potential customers through its Internet website. MF 12. Using that medium, the company advertised its debt settlement services with a succession of prominent, home-page claims about the results that consumers could expect from its services, including: • "Affordable Monthly Payments Settle Debts For 40%-60% Off Balance" (on CSA's website from December 2004 to December 2006). • "It [debt settlement] specifically reduces your current outstanding total balances 40-60%" (December 2004 to May 2007). • "Reduce your debt 60% in seconds!" (March 2005 to February 2006). • "Reduce your debt 50-75% in seconds!" (August 2004 to December 2004). • "When you hire us, we negotiate with your creditors to settle your outstanding balance by eliminating 40-60% of your debt" (August 2005 to December 2006). • "Reduce Total Balances 40-60%" (July 2005 to April 2007). • "Become Debt Free In Less Than 36 Months" (December 2004 to May 2007). • "Most of our clients become debt free within 36 months or less" (September 2007 to November 2007). • "A typical settlement can be accomplished within 36 months or less" (December 2004 to May 2007). 9 • "We help you become debt free in 12 to 36 months" (June 2007 to October 2007). MF 30. These claims were made continuously through at least 347 modifications of CSA's website during the years 2004 through 2007, while the company was offering and selling its debt collection services to Vermonters. MF 31. Moreover, the CSA Enrollment Summary Page (the title was later dropped, but the content remained the same), which was part of the Customer Enrollment Package that CSA mailed to all its customers, MF 32, routinely used a 60% figure to calculate projected savings. MF 33. An example of a Vermont consumer's Enrollment Summary Page appears below, with a total debt of $42,400 and an "Estimated Settlement Amount (Approx. 40%)" of $16,960—which reflects a 60% savings off the amount due at enrollment. MF 34. In his deposition in a lawsuit similar to this one brought by the New York Attorney General, Defendant Van Arsdale agreed that the reference to an estimated 60% savings on this form "would mean that this consumer can anticipate or would reasonably anticipate that they were going to have a savings off of their debt of 60 percent." People ex rel. Cuomo v. GSA-Credit Solutions of America, Inc. (N.Y. Sup. Ct. No. 401225/09) (Deposition of Douglas Van Arsdale, May 25, 2011) (hereinafter "DVA") at 237. 8 MF 35. a See also DVA at 72 (Q. "CSA was saying to a reasonable consumer you can expect to save 50 percent of your debt [when the CSA website advertised a "50%" savings]?" A. "Sure."), and DVA at 222 (to same effect). MF 36. 10 CONFIDENTIAL &Matt to Protective Order In State of Vermont v. GSA-Credit Solutions of America. LW. Dodcet No, 484-7-10 Who One Solution, of Arnerleaft En ollment$ arli Page wasellOO *be Maned &WI* E mit C,SA." 5dIcP:117 Ffc-In C,c1,2t. In ottir ttsr b"to setup ofietteltto to be corrotot aUelfinent Ps Fkri fcr CSAT'' SC,'171; 'Cc r.r.) OSA* Teter Eames Nes CSA Dopmtt &Mated Sotbsetert Amount (Approx. 404 EstImatadiSeitenvontarnount 53 .00 Soulr Budget DOI iP Mittel Week payteetrae 2544,00 4 Mel Dept* Palmetto& 03640 33100 show Promote rst PetteileteNter CS' Fee le Feld: Total Parma:stewards Einrimp-hlterAil Payments: Estimated DM Ma Vine Awe: IOW Debt DImInatioe Met Total Debt %Vita 1.2 Moetbly Stoke Fei P wIol Etteleate Monthly Oud I WMAtet IM FIR Tote] Menthato PeyallfSenam Ric ** NM Outiannt * 650.00 17634.00 The aittlenoteet wins plan is the minimum suggested for payoff of your +smelled eccoonts. MN" highly relit that EN addition.; Melo, whkh may become evalleble, he allocetsd boverda your pommel sa y ings Recount. g l s Tho eett atalged te KM es eiCh ttnelltle sowings es possible, es it lit rt your advantage to do so. The wicker you save money, the sooner you am gat your enrolled debts resolved. Mewigt ACP tv,t'l Fcc-Sii mrv ci' cii Somrwiri,t FebtiMay 15,2004 leelelnett Sardoe Fes Mart Mx Peewee Sivings Steps* June 15, 2004 June IS, 2004 Vioni Sipe= . The above clan sobsdule Is the atit' s eetoominended palm& watuthit*MiDektUtt iabeisiunn peroon Anal Omelet 41- shesdes ultua According to the FTC, "phrases such as 'as much as' or 'up to' (e.g., 'up to 60% savings') likely convey to consumers that the product or service will consistently produce results in the range of the stated percentage or amount." FTC, 48500 n. 578 (emphasis added). Thus, while both CSA's 40% and 60% savings claims must be supported by substantial data, the 40% savings must be typical, whereas the 60% savings "only" need be consistent. On the other hand, since CSA customarily informed consumers, in its Customer Enrollment Package, that they could expect 60% savings on their debts—and CSA's principal acknowledges that this was a reasonable expectation—that higher standard should have been met, at a minimum, for most enrolled consumers. 11 CSA's results claims were not qualified or vague. On the contrary, they were unqualified and quantitative, stating precise percentages, ranges of percentages, or time frames to describe the reduction in principal debt amounts—which is to say, the savings— that consumers could anticipate. On their face, as Defendant Van Arsdale has acknowledged, such claims communicated to reasonable consumers that they could personally expect to achieve the stated results, or, put another way, that those outcomes were typical of what CSA customers would achieve. B. CSA's Actual Results Were Dramatically Inconsistent with Its Claims. The Attorney General's Office sought from CSA through discovery in this case all data that would support the company's advertised results claims. MF 37. In response, two sets of data were produced. One set included a spreadsheet containing a list of 903 debts enrolled by Vermont consumers who paid fees to CSA, the dollar amounts of those debts at the time of enrollment, and the dollar amounts of the settlement offers negotiated by CSA, MF 38 (referred to herein as "the Vermont data"). The other data set consisted of a list of 33,390 debts settled between August 2006 and November 2007, the dollar amounts due at the time of settlement (not at the time of enrollment), and the dollar amounts of the settlements (referred to herein as "the national data"), MF 39, from which the percentage savings for each debt for which there was a settlement offer could be computed. (However, as noted infra text 18, CSA did not have a "denominator" to compare these results to, and thus could not say whether its national success rate was 50% or 5% or .5%.) Vermont results. The focus of the State's analysis of the Vermont data was to answer the following questions, in order to determine the accuracy of CSA's advertising of "40%" savings, "60%" savings, and "debt-free": 12 1. What percentage of Vermont-enrolled debts were the subject of a settlement offer obtained by CSA that met the advertised percentage of 40%, including in the calculation the amount of fees the consumer had to pay to CSA? 2. What percentage of Vermont-enrolled debts were the subject of a settlement offer obtained by CSA that met the advertised percentage of 40%, excluding from the calculation the amount of fees the consumer had to pay CSA? 3. What percentage of Vermont-enrolled debts were the subject of a settlement offer obtained by CSA that met the advertised percentage of 60%, including in the calculation the amount of fees the consumer had to pay to CSA? 4. What percentage of Vermont-enrolled debts were the subject of a settlement offer obtained by CSA that met the advertised percentage of 60%, excluding from the calculation the amount of fees the consumer had to pay to CSA? 5. What percentage of Vermont consumers who signed up with CSA were "debtfree" within three years—that is, had a settlement offer negotiated by CSA for all of their enrolled debts? In 2010, the FTC, relying on existing precedent, provided detailed guidance on how to calculate these numbers. In its commentary on debt settlement amendments to the federal Telemarketing Sales Rule, the agency complained that debt settlement companies "often use [deficiencies in data] to support their savings claims. All of these deficiencies inflate the savings consumers are likely to obtain." FTC at 48499. As a cure, certain principles must be followed: 1. Any savings must be measured against the amount of the debt at the time of enrollment. 2. Any savings must take into account the fees paid to the debt settlement company. 3. Any savings claims must be based on all of the debts enrolled by all of the debt settlement company's customers, not just on debts that were settled. As the FTC has stated, "savings claims must be calculated based on the amount of debt owed at the time of enrollment, rather than the amount at the time of settlement, in order to account for (a) increases in debt levels from creditor fees or interest charges that 13 accrue during the period of the program, [91 and (b) fees the consumer pays to the provider. [I]n making savings claims, a provider must take into account the experiences of all of its past customers, including those who dropped out or otherwise failed to complete the program. ... In making savings claims, a provider must [also] include all of the debts enrolled by each consumer in the prop-am. The provider may not exclude debts that it has failed to settle—including those associated with consumers who dropped out of the program—from its calculation of the average savings percentage or amount of its consumers' debt reduction." FTC at 48500-49501 (footnotes omitted). Moreover, this guidance from the FTC is based not on some new legal theory, but on the agency's decadesold legal test for deception.1° These principles make absolute sense from the viewpoint of a consumer who views an online debt settlement advertisement such as, "Reduce your debt 60% in seconds," and who, let us say, has a debt on which the balance as of the time of the viewing is $10,000. Underscoring the importance of calculating savings against the amount of the debt at enrollment (not at settlement), a reasonable consumer should be able to expect a settlement 9 The FTC's description of debts increasing from the date of enrollment to the date of settlement accurately describes what happened to most Vermont consumers. Of 394 debts for which CSA's data shows both an enrollment amount and a current balance, 358 debts increased from the time of enrollment; the total net increase was $385,429.72, and the average change in amount was an increase of $978.25. MF 40. 10 See FTC at 48497 n. 549 (citing FTC's 1984 Policy Statement on Deception), and FTC at 48499 n. 567 (citing FTC cases challenging percentage savings claims that date back to 2002, including FTC v. Debt-Set, No. 1:07-cv-00558-RPM (D. Colo. filed Mar. 19, 2007) (promising to reduce amount owed to 50% to 60% of amount at time of enrollment); FTC v. Connelly, No. SA CV 06-701 DOC (RNBx) (C.D. Cal. Am. Compl. filed Nov. 27, 2006) (promising to reduce overall amount owed by up to 40% to 60%); FTC v. Nat'l Consumer Council, Inc., No. SACVO4-0474 CJC (JWJX) (C.D. Cal. filed Apr. 23, 2004); FTC v. Better Budget Fin. Servs., Inc., No. 04-12326 (WG4) (D. Mass. filed Nov. 2, 2004) (promising to reduce consumers' debts by up to 50% to 70%); FTC v. Innovative Sys. Tech., Inc., No. CVO4-0728 GAF JTLx (C.D. Cal. filed Feb. 3, 2004) (representing it could save consumers up to 70% of debt owed); FTC v. Jubilee Fin. Servs., Inc., No. 02-6468 ABC (Ex) (C.D. Cal. filed Aug. 19, 2002) (promising to reduce debts by up to 60%). Thus, CSA had reason to know that its advertising was deceptive, had it inquired into the matter. Indeed, in another consumer fraud case brought by the State, the Vermont Supreme Court opined that it "must give substantial deference to the FTC's express position" as articulated not prior to the conduct at issue, but in an amicus curiae brief filed in support of the State in that very appeal. See State v. Internat'l Collection Service, Inc., 156 Vt. at 545-46. 14 offer of 60% off the amount of the debt when she signs up, or $4,000—not an offer of 60% off some as-yet-unknown higher amount due (higher because of potential future interest, fees, and penalties). Likewise, if the consumer also has to pay $1,500 in fees, those fees will be real money out of her pocket that reduces her savings and should therefore be taken into account in figuring the actual extent of those savings. Finally, if she were told that the promised 60% reduction in her debt would occur only if there is a settlement offer, and that in many cases the company will not be able to obtain such an offer, it is unlikely that she or many other consumers would bother to enroll in the first place. In response to the State's discovery requests, CSA produced an Excel spreadsheet that contained key information on the debts enrolled by company's Vermont customers, including consumer identification information, the amount of the debt at enrollment ("enrollment amount"), and the amount of settlement offers, MF 42; CSA has stipulated that the spreadsheet is the most accurate data compilation for Vermont." MF 29. By comparing the debt enrollment amounts to the corresponding best (lowest-dollar) settlement amounts, it is possible to determine how many of the Vermont debts were the subject of a settlement offer that met the terms of CSA's savings claims (i.e., a 40% or 60% reduction in the amount to be paid to the creditor), and to determine how many Vermonters became "debtfree" (had settlement offers for all of their debts) at any point in time. Responding to the five questions set out on page 13, above, here are the actual results achieved by CSA for Vermonters, based on comparing (1) the dollar amount due at the time of enrollment of the each of the 903 Vermont debts, with (2) the lowest-dollar settlement offer, if any, negotiated by CSA for each of those debts: 11 CSA's Vermont data actually omitted some settlement offers that the Attorney General's Office identified from other company documents and added to the spreadsheet, to CSA's benefit. MF 41. 15 1. Of the 903 Vermont debts, 63-7.0%—were the subject of an offer in an amount at least 40% less than the enrollment amount of the debt, including CSA's estimated fees. 12 MF 44. 2. Of the 903 Vermont debts, 139-15.4%—were the subject of an offer in an amount at least 40% less than the enrollment amount of the debt, excluding fees. MF 45. 3. Of the 903 Vermont debts, 6-0.7%—were the subject of an offer in an amount at least 60% less than the enrollment amount of the debt, including CSA's estimated fees. MF 46. 4. Of the 903 Vermont debts, 4/1 1.9%—were the subject of an offer in an amount at least 60% less than the enrollment amount of the debt, excluding fees. MF 47. 5. Of the 207 Vermont consumers who signed up with CSA, 31-15.0%— received a settlement offer in any amount for all of their enrolled debts. MF 48. Restated in tabular form, the first four figures are as follows: 40% Savings 60% Savings Counting CSA Fees 7.0% 0.7% Not Counting CSA Fees 15.4% 4.9% It is obvious that these Vermont results are not remotely consistent with CSA's advertised results claims. Indeed, following the FTC framework (and thus including CSA's fees in the calculation), and focusing on the 60% savings that CSA routinely set out in Vermont consumers' paperwork, only 0.7% of Vermont consumers' debts—one debt in 200—were the subject of a settlement offer consistent with CSA's promises. What is more, 12 CSA's Vermont data does not link consumer fees paid to the specific debts that form the basis for calculating those fees; the data only shows the total of fees paid by each consumer. To calculate success rates including fees, the State multiplied the enrollment amount of each debt by CSA's customary 15% fee formula; but the fees associated with debts for which there was no settlement offer were ignored. This ended up understating the total fees that Vermonters paid (and favoring CSA), but it provided the best estimate possible of how much consumers who received a settlement offer had to pay in order to settle a debt—that is, the settlement amount plus the associated CSA fees. MF 43. 16 almost two-thirds of Vermont consumers' debts-599 out of 903—were the subject of no settlement offer at all. While there may be many reasons for these dismal results—including poor performance by CSA, intransigence by creditors, and consumer inability or unwillingness to continue with the CSA program—it was still CSA's legal obligation to have prior reasonable substantiation for its advertising claims, taking into account all of the debts and debtors enrolled. The actual numbers show that even on a post hac basis, the Vermont data is completely at odds with what CSA told the public in order to lure consumers to sign up with the company.13 National results. The national results data set produced by CSA is insufficient to prove much of anything, for several reasons. First, that data covers only a brief period of time, encompassing just 12 nonsequential months between August 2006 and October 2007, MF 52, a time period that did not even begin until over two years after the first Vermonters enrolled with CSA. In fact, by August 2006, fully 94 (45.4%) of the total of 207 Vermont customers of CSA had already enrolled with the company, MF 53, so the national data provided by CSA completely misses the time period that is most relevant to almost half of the company's Vermont customers. 13 There are two possible explanations for why Defendants might believe they had stronger support for their claims than they did, but both of these involve unfairly inflating consumers' savings, contrary to the FTC principles described in the text. First, CSA calculated savings based on the amount of the debt at the time of settlement, rather than at the time of enrollment. See DVA at 87, ME 49. Even so, CSA itself focused on the amount of the debt at the time of enrollment in its telemarketing script, which stated, "Now, what our company does is called settlement. We dramatically reduce your debt and get you out in 3 years or less!! Based on (original amount) what we'll do is reduce your debt down to $ (50% of original amount)." MF 50 (bold and italics in original, underline added for emphasis). Second, Defendant Van Arsdale thought it acceptable to base CSA's claims on only the debts the company settled, rather than on all of the debts consumers enrolled. See DVA at 200 (CSA's percentage savings claim was based on "just the actual ones [debt settlements] that were accepted"), ME 51. 17 Second, CSA's claimed national results are completely inconsistent with the FTC principles described above: they include only debts that were settled, not all debts for any period of time; they are based on amounts due at the time of settlement, not at enrollment; and they do not include any of CSA's fees in the calculation of savings. Third, the only way to evaluate CSA's claimed national results as potential substantiation for its results advertisements is to compare the number of settlements at the advertised level of savings with all enrolled debts. 14 However, as noted in the State's Motion of Sanctions Under V.R.C.P. 37(b), filed on November 16, 2011, CSA has never produced that total number of debts—the needed "denominator," as it were—despite repeated discovery requests and a stipulated Order of the Court that it do so. The fact that CSA has not calculated this "denominator" before is a patently clear indication that it did not have prior, or reasonable, factual substantiation for its claims. Again, actual results were not consistent with promised results, nor can CSA substantiate its claims with data, this time at the national level. C. CSA's Results Claims Were Deceptive and Thus Unlawful. Based on the above data analysis, it is apparent that the three elements of deception under the Consumer Fraud Act, 9 V.S.A. § 2453(a)—misrepresentation, reasonable interpretation and materiality—were present in CSA's advertised results claims. With respect to the first of those elements, CSA clearly misrepresented the settlement results it obtained for the vast majority of Vermont and national debts. Success rates (as defined by the advertised claims) in the range of 0.7% to 15.4% (the former taking 14 By way of example, if the national data showed 900 debts successfully settled (e.g., at a 60% savings or more) out of a total of 1,000 debts available to be settled, that would mean that 90% of the debts (900/1,000) were settled consistent with CSA's ads. However, if 900 debts were successfiffly settled out of a total of 10,000 debts, the 18 into account fees paid to CSA) mean that CSA negotiated very few Vermont debts at the promised savings. In light of that track record, Vermonters were surely deceived, given that "[i]t is deceptive to make unqualified performance claims that are only true for some consumers, because consumers are likely to interpret such claims to apply to the typical consumer." FTC at 48500 n.575; accord, FTC v. Five-Star Auto Club, Inc., 97 F. Supp. 2d 502, 528-29 (S.D.N.Y. 2000) (it was reasonable for consumers to assume that earnings expressly claimed for multi-level marketing scheme were achieved by typical participant); National Dynamics Corp. v. FTC, 492 F.2d 1333, 1335 (2d Cir. 1974), cert. denied, 419 U.S. 993 (1974) (advertising may not make "deceptive use of unusual earnings claims realized only by a few"); Bailey Employment System, Inc. v. Hahn, 545 F. Supp. 62, 70 (D. Conn. 1982), affd 723 F.2d 895 (2d Cir.1983) (projected earnings claims held deceptive where they did not "bear a reasonable relationship to the average amounts earned in the past by a majority of existing franchisees"); Porter & Dietsch, Inc. v. FTC, 605 F.2d 294, 303 (7th Cir. 1979) (deception found where "[t]he typical and ordinary experiences of consumers do not parallel the experiences reported in [advertised] testimonials"). CSA's advertised results were anything but typical and thus misrepresented the truth of the matter. As for the second element of deception, in light of the prevailing precedent on the "typicality" that is required of results claims, it was certainly reasonable for consumers to read CSA's percentage-savings and "debt-free" claims to mean that those were the outcomes they could expect—if not in every case, then for most of them. In this regard, it should be recalled that even if some consumers had a different understanding of the advertising, the success rate would be only 9% (900/10,000). The difference is crucial: the data could be said to substantiate the advertising only in the first of the two hypotheticals. 19 claims were still deceptive if they "convey[ed] more than one meaning to reasonable consumers and one of those meanings [was] false." Carter v. Gugliuzzi, 168 Vt. at 56. Finally, as noted supra text 7, the third element—materiality—is satisfied if the representations at issue are express, for those are deemed to be material. Indeed, other than price, what could be more material to consumers, in terms of influencing their decision to enroll with CSA or not, than the savings on their debts that they could expect for their money? In short, CSA's website claims were deceptive within the meaning of the Consumer Fraud Act and thus violated the law. D. CSA's Advertising Claims Were Unsubstantiated and Thus Unlawful. As discussed supra text 8-9, failure to possess prior reasonable factual substantiation for advertising claims is considered to be an unfair and deceptive trade practice. As the FTC restated in its debt settlement rule commentary, "It is an unfair and deceptive practice to make an express or implied objective claim without a reasonable basis supporting it." FTC at 48500 n. 574. The FTC has applied this substantiation requirement to debt settlement companies: When a debt relief service provider represents that it will save consumers a certain amount or reduce the debts by a certain percentage, it also represents, by implication, that this savings claim is supported by competent and reliable, methodologically sound evidence showing that consumers generally who enroll in the program will obtain the advertised results. ... Generally, savings claims should reflect the experiences of the provider's past customers. ... Similarly, the existence of some satisfied customers does not constitute a reasonable basis. FTC at 48500 (footnotes omitted). Given the wide gulf between CSA's advertised results and its actual outcomes, the question becomes, is it possible that CSA had some other prior, reasonable substantiation to 20 support its online results claims? As detailed below, the answer from Defendant Van Arsdale's New York deposition testimony is clearly "no," at least as to CSA's initial year of 2004 in Vermont; and for later years, CSA looked to its own national data, which has already been shown to have failed to support those claims. Consider the question of whether CSA had any reasonable substantiation in the company's early years, starting with the company's founding in 2003. Obviously at that point, CSA had no track record of its own to rely on. Instead, Van Arsdale testified, he looked at what other debt settlement companies were doing. DVA at 32-33, MF 54. Asked if he obtained any information from those companies about the percentage savings that consumers were likely to achieve, he stated that the savings "varied from 50, 60, 70, 80, 90." Id. at 33. However, when asked whether he had seen "any data or records substantiating these percentages," he replied, "I saw a couple of settlement letters." 15 Id. Those letters, he said, were shown to him by an employee of a debt settlement company called Debt XS. Id. at 33-34. Van Arsdale was then asked whether he had any information beyond those specific letters, and he responded, "Online at the time as well, there were other smaller companies that were posting their letters of what they were achieving for their clients." Id. at 34. Pressed as to whether he saw "other data besides these letters that would reflect consumer savings," he said, "I don't think so." Id. at 35. After describing a "general discussion" he had with someone at Debt XS, Van Arsdale was then asked if he knew about the savings for "the total percentage of consumers" at that company, and he replied, "I didn't inquire about 15 Later in his deposition, Van Arsdale inexplicably changed "a couple of' letters to "a few hundred." DVA at 98, MF 55. Nonetheless, he also clarified that he did not know how many times the savings reflected in those letters were reached, did not ask anyone about that, and did not ask any company how often consumers dropped out of their program, id. at 103—although he did put CSA's dropout rate at 60%, id. at 104—thus 21 that." Id. at 36. Finally, Van Arsdale was asked if he had "any other substantiation, independent substantiation for the claims that you advertised on the website back in 2003?" His answer was "No." Id. at 40. It was not until the year 2005 that CSA "started to get more regular reporting [on settlement results] ... and operations started putting those [data] systems in place." Id. at 81, MF 56. This reporting "may have started in late '04," but Van Arsdale became more aware of it late in 2005 through reports he received. Id. at 81-82.16 Defendant Van Arsdale attempts to support his company's results claims are wholly insufficient. For at least the years 2003-04 and into 2005, the only conceivable support for CSA's quantitative results claims were some settlement letters from another company. Such anecdotal information cannot establish that advertised savings percentages represented typical or consistent outcomes for CSA's customers. As for later years, the small percentage of debts for which CSA negotiated savings of 40% or 60% is reflected in its own records, as discussed above.. This lack of substantiation extended to CSA's "debt free" claims, too. Apart from his general statements, lacking in any detail, that the "debt free in 36 months" claim was chosen based on "industry data" and then on what CSA "saw ... as well," Van Arsdale admitted that he had no specific figures. DVA at 210, MF 57. Asked "What percentage of CSA consumers became debt free in less than 36 months?" he replied, "I do not know that." DVA at 217, MF 58. Asked "Did you have any data to support this claim?" he said, "I knew that clients were settling in three or four months. So I'm assuming there was some data." reinforcing the fact that he had nothing but anecdotes on which to base his company's results claims 16 Mr. Van Arsdale was asked if he started getting this "more data" in "late '05 and in '06." He answered, "Correct." Id. at 87. 22 Id. at 217-18. Nor did he know what percentage of consumers took more than 36 months to settle all of their debts. Id. at 218. Again, where the law required there to be prior reasonable substantiation, there was none. The FTC—and thus Vermont law—patently expect much more in the way of quantitative data to substantiate the kinds of percentage savings claims that CSA used to solicit its customers: Although providers [i.e., debt settlement companies] may use samples of their historical data to substantiate savings claims, these samples must be representative of the entire relevant population of past customers. Providers using samples must, among other things, employ appropriate sampling techniques, proper statistical analysis, and safeguards for reducing bias and random error. Providers may not cherry-pick specific categories of consumers or exclude others in order to inflate the savings. FTC at 48500 n.577 (emphasis added). In sum, CSA violated the Consumer Fraud Act by failing to have prior reasonable substantiation of its online results claims. VII. DEFENDANTS VIOLATED THE CONSUMER FRAUD ACT'S REQUIREMENTS ON THE RIGHT TO CANCEL TELEPHONIC TRANSACTIONS. A. The Consumer Fraud Act Imposes Specific Requirements with Respect to Consumers' Right to Cancel Telephonic Transactions. Under the Vermont Consumer Fraud Act, "home solicitation sales" are subject to a three-business-day right to cancel, 9 V.S.A. § 2451a(d). A "home solicitation sale" includes a transaction "solicited or consummated wholly or in part by telephone with a consumer at the residence or place of business or employment of the consumer." Id. Under 9 V.S.A. § 2454(a)(1), with limited exceptions not pertinent here, "in addition to any right otherwise to revoke an offer, the consumer or any other person obligated for any 23 part of the purchase price may cancel a home solicitation sale until midnight of the third business day after the day on which the consumer has signed an agreement or offer to purchase relating to such sale, or has otherwise agreed to buy consumer goods or services from the seller." (Emphasis added.) A "business day" is defined as "any calendar day except Saturday, Sunday or any day classified as a holiday under [state law]." 9 V.S.A. § 2451a(e); accord, CF 113.01(b). Moreover, "[w]ithin ten [business] days after a home solicitation sale has been cancelled ..., the seller shall tender to the consumer any payments made by the consumer." 9 V.S.A. § 2454(c)(1). This right to cancel is an extremely important protection for consumers, affording them a "cooling off' period during which they can reconsider their decision to enter into a transaction or contract with a business that they have dealt with only at a distance. Title 9 V.S.A. § 2454, and, for telephonic sales, the Vermont Attorney General's Consumer Fraud Rule (CF) 113, available at http://www.atg.state.vt.us/display.php?smod=131, describe the kinds of disclosures of this right to cancel that must be made by a seller of goods or services. Under 9 V.S.A. § 2454(b) and CF 113.02, in every telephonic home solicitation sale, the seller must furnish to the consumer, prior to debiting a bank account or otherwise initiating payment, a receipt or contract of sale containing both a short and a multi-paragraph disclosure of the right to cancel, the latter containing the terms of that right. In addition, the seller in a telephonic sale must orally inform the consumer of his or her right to cancel the transaction prior to the buyer's receipt of those written notices. 9 V.S.A. § 2454(b)(2)(D) and CF 113.02(c). Failure to comply with CF 113 is an unfair and deceptive act and practice in commerce under the Consumer Fraud Act. 9 V.S.A. § 2454(h) and CF 113.05. One remedy 24 for this failure is described in 9 V.S.A. § 2454(b)(3): "Until the seller has complied with this subsection, the consumer ... may cancel the home solicitation sale by notifying the seller in any manner and by any means of his intention to cancel. The cancellation period of three business days shall begin to run from the time the seller complies with this subsection." Accord, CF 103.02(d) and 103.03. Thus there is no time limit on this important entitlement, affording a strong incentive for businesses to comply strictly with the requirements of the law. Moreover, if a company like CSA has performed any services pursuant to a "home solicitation sale" prior to its cancellation, "the seller shall be entitled to no compensation therefor." 9 V. S .A. § 2454(d)(7). Thus, among other things, the Consumer Fraud Act and CF 113 require: 1. Oral as well as written disclosure of the right to cancel. 2. An opportunity to cancel within three business days. 3. An opportunity to cancel by mail. 4. Upon cancellation, payment of a full refund to the consumer. 5. Payment of any required refund within ten business days of cancellation. It should be stressed that all of these requirements associated with the right to cancel are very specific and not open to variation or revision by any business. Indeed, the Vermont Supreme Court does not approve of attempts to read limitations into the Consumer Fraud Act that do not expressly appear on the face of the statute. See State v. Internael Collection Service, Inc., 156 Vt. 540 (1991) (rejecting argument that Consumer Fraud Act did not authorize Attorney General to sue business for engaging in unfair or deceptive acts or practices against other businesses, rather than against individual consumers). B. CSA's Cancellation Notice Did Not Meet the Statutory Requirements. As a threshold matter, all of Defendants' transactions with Vermont consumers involved a telephone conversation between the consumer and a CSA representative to solicit 25 the consumer's interest in entering into a service contract with the company and to firm up the details of that agreement. MF 59. As such, they were "home solicitation sales" within the meaning of the Consumer Fraud Act and thus required a three-business-day right to cancel as prescribed by the Act and CF 113. However, in no fewer than five respects CSA failed to comply strictly with its obligations relating to the right to cancel and thus violated the Consumer Fraud Act, 9 V.S.A. §§ 2453(a) and 2454, and CF 113. First, CSA's telephonic marketing script contained no oral disclosure of any right to cancel. MF 60. Second, CSA's written notice of the right to cancel, which appeared in its standard Agreement, set out a right to cancel that lasted only until "midnight of the third day after the date of the transaction," MF 61—in other words, three calendar days, not the statutory three business days, after that date. The difference had real importance: over a weekend, it meant that a right to cancel that should have lasted for five calendar days (three business days and two weekend days) was two days shorter than it should have been, and over a holiday weekend it was shorter by three days. Third, CSA compelled consumers both to mail and to fax their cancellation request, rather than simply to mail, deliver, or telegraph the request. MF 62. That imposed a significant burden on their customers, particularly in rural Vermont, to access a fax machine if they wanted to cancel. Fourth, CSA's contract with consumers stated that consumers were "OBLIGATED TO PAY CREDIT SOLUTIONS THAT PORTION OF THE TOTAL FEES ALREADY EARNED BY COMPANY IN ACCORDANCE WITH PARAGRAPH 13 OF THIS 26 AGREEMENT." MF 63 (capitals and bold in original, italics added). Paragraph 13 of the contract between consumers and CSA in turn described the installment payments to be made by the consumer to Credit Solutions of America, including the service fees due the company. MF 64. The first of these installments was often due as early as the date the consumer signed the Agreement, or, in the absence of a signature, the date of the Agreement itself." MF 65. That first month's payment could be substantial. For example, Vermont consumer B.M.'s first monthly payment of $538.13 in fees was due, under Paragraph 13 of his contract with CSA, on the same day as the date on the contract and thus was "already earned by the company" and not refundable. MF 67. As a result, the consumer's entitlement to a full refund was substantially compromised. Fifth, CSA's written right-to-cancel notice provided that the company had 30 days to pay a refund in the event of a cancellation, MF 68, thus substantially lengthening the repayment interval from the statutory 10 business days, to the consumer's detriment. In short, CSA systemically violated its right-to-cancel-related obligations under Vermont law and is now required to provide a full refund to any consumer who manifests an intention to cancel. VIII. DEFENDANTS VIOLATED THE CONSUMER FRAUD ACT BY FAILING TO COMPLY WITH THE VERMONT DEBT ADJUSTERS ACT. As noted above, one of the alternative tests for determining whether a trade practice is unfair under the Consumer Fraud Act is "whether the practice, without necessarily having been previously considered unlawful, offends public policy as it has been established by 17 Of the 207 Vermont consumer files analyzed for this Motion, fully 145 had a first payment due on the same date as the contract was signed (or on the printed contract date, if there was no signature date). MF 66. 27 statutes, the common law, or otherwise—whether, in other words, it is within at least the penumbra of some common-law, statutory, or other established concept of unfairness." Christie v. Dalmig, 136 Vt. at 601 (quoting FTC v. Sperry & Hutchinson Co., 405 U.S. at 244 n.5). Here, the State alleges that Defendants failed to comply with the Vermont Debt Adjusters Act, 8 V.S.A. chapter 83, 8 V.S.A. ch. 133, 18 a statute designed in large part to protect consumers, and that Defendants' non-compliance in turn amounted to an unfair trade practice. A. CSA Was a "Debt Adjuster" Subject to the Debt Adjusters Act. At all times relevant to this lawsuit, CSA's business fell within the following definition of "debt adjustment" in 8 V.S.A. § 4861(2) as that definition existed during the time period relevant to this case 19 and was thus subject to the provisions of the Debt Adjusters Act: "Debt adjustment" means making a contract with a debtor whereby the debtor agrees to pay a sum or sums of money periodically and the other party to the contract distributes, supervises, coordinates, negotiates, or controls the distribution of such money or evidences thereof among one or more of the debtor's creditors in full or partial payment of obligations of the debtor. For purposes of this chapter, engaging in debt adjustment in this state shall include: (A) soliciting debt adjustment business from within this state, whether by mail, by telephone, by electronic means, or by other means regardless of whether the debtor resides within this state or outside this state; (B) soliciting debt adjustment business with an individual residing in this state, whether by mail, by telephone, by electronic means, or by other means; or (C) entering into, or succeeding to, a debt adjustment contract with an individual residing in this state. [Emphasis added.] Under CSA's business model, echoing the language of the statute, (1) "the debtor agrees to pay a sum or sums of money periodically," and (2) CSA ("the other party to the 18 Former chapter 133 of title 8 V.S.A., consisting of sections 4861-4876, was recodified in 2010 as chapter 83 of the same title, comprising sections 2751-2766. Act 137 (2009 Adj. Sess.), § 3. 19 The quoted definition was amended in 2010 simply "to clarify existing law," see S. 278 as passed by the House and Senate, § 29(c), http://www.leg.state.vt.us/docs/2010/bills/Passed/S-278.pdf; but in any event, the current definition continues to encompass CSA's core activity, which is to "negotiate ... the distribution of money or evidences thereof among one or more of the debtor's creditors in full or partial payment of obligations of the debtor." 28 contract") "negotiates ... the distribution of such money ... among one or more of the debtor's creditors in full or partial payment of obligations of the debtor." The first of these elements—the debtor's agreement to make periodic payments—is reflected in the Estimated Personal Savings Plan for Payments to Creditors ("the Plan") set out in the CSA Customer Enrollment Package sent to all customers of the company. MF 69. As noted in the example reprinted supra text 29, the Plan includes a chart that contains information on the total dollar amount of the consumer's enrolled debts, the fees due CSA, and total savings. Pertinent to the statutory issue at hand, it also states the amount of "Minimum Personal Saving Payments After Credit Solutions Fee is Paid," to be deposited by the consumer into his or her bank account. These payments, as noted at the bottom of the sheet, are "the minimum20 suggested for payoff of your enrolled account ... Credit Solutions highly recommends that any additional funds which may become available be allocated towards your personal savings account." MF 70 (emphasis in original). These consumer payments are an essential element of the CSA program, as described by the company: "When the client has the available funds to settle an account, [CSA] contacts the creditor and asks that a settlement be negotiated in the amount that the customer has saved." MF 71; see also Client Service Agreement 12 (consumer agrees to budget a set amount per month for ultimate distribution to creditors). MF 72. The second element—negotiation of the distribution of such money among one or more of the debtor's creditors in full or partial payment of the debtor's obligations—exactly describes CSA's core service. CSA offers to negotiate with a consumer's creditors to reduce the principal amount of the consumer's debts, thus purportedly achieving the A later version of the Estimated Personal Savings Plan dropped that title and highlighted the word "minimum" by italicizing and bolding it ("minimum"). 20 29 percentage savings described earlier in this Memorandum. As the company has acknowledged, CSA "provides consumer debt negotiation and settlement services. [CSA] customers enroll certain unsecured accounts with [CSA] and [CSA] negotiates for settlement offers on those accounts." MF 73 (emphasis added). Once one or more debt settlements have been negotiated by CSA and accepted by the consumer, the agreed-upon funds are thus distributed by the consumer to or among the creditors according to the settlement terms. 21 MF 74. When interpreting a statute, the courts "first rely upon the plain language of the law as a means of determining legislative intent." Nichols v. Hofmann, 2010 Vt. 36, 7, 188 Vt. 1 (citing Delta Psi Fraternity v. City of Burlington, 2008 VT 129, 7, 185 Vt. 129). "If that plain language resolves the conflict without doing violence to the legislative scheme, there is no need to go further ...." Id. (quoting Lubinsky v. Fair Haven Zoning Bd., 148 Vt. 47, 49 (1986)). Moreover, in this case, the licensing agency for debt adjusters, the Vermont Department of Banking, Insurance, Securities and Health Care Administration (BISHCA), has opined that CSA meets the definition of debt adjuster under the law, MF 75, which is significant because "[t]he interpretation of an agency charged with the administration of a statute is entitled to substantial deference, if it is a sensible reading of the statutory language, ... and if it is not inconsistent with the legislative history." Internael Collection Service, 156 Vt. at 545-46 (quoting Lawrence County v. Lead-Deadwood School Dist. I, 469 U.S. 256, 262 (1985)). 21 Because CSA has expressly acknowledged that it negotiates with consumers' creditors for the payment of a reduced debt amount, there is no need to resort to rules of construction to try to discern what the term "negotiates" means in the Debt Adjusters Act. 30 Here, nothing in the Debt Adjusters Act requires CSA itself to handle the consumer's settlement funds. The "distribution" of such funds need not be effected directly by CSA in order for the company to be considered a debt adjuster. It is simply the consumer's agreement to make periodic payments and CSA's negotiation of a reduced principal amount due on the consumer's debt that characterizes a debt adjuster under a plain-language reading of Vermont law; and CSA meets that definition. B. CSA Violated At Least Seven Requirements of the Debt Adjusters Act. The Debt Adjusters Act goes on to impose a series of pro-consumer obligations on companies subject to the law. These obligations first include having to obtain a license from BISHCA, 8 V.S.A. § 2752, to ensure, among other things, that the company and those who control it have "the financial responsibility, experience, character, and general fitness ... [to] command the confidence of the community and warrant belief that the business will be operated honestly, fairly, and efficiently within the purposes of [the law]." 8 V.S.A. § 2756. However, CSA never obtained a license. MF 76. Other obligations under the Act designed to protect Vermont consumers include licensees' having to (1) post a bond to secure the company's performance of its obligations as a licensee, 8 V.S.A. § 2755; (2) submit an annual report containing, among other things, the number of new consumer contracts entered into with Vermont consumers, contracts completed, contracts cancelled, and total contracts in force, 8 V.S.A. § 2757a(a)(2)—all factors relevant to the success of the licensee's program; (3) provide consumers with written contracts in a form approved by BISHCA and containing specified disclosures, including the fact that debt adjustment plans are not suitable for all debtors, 8 V.S.A. § 2759(a)-(b); (4) afford a three-business-day right to cancel the contract and provide disclosures of that right, 31 8 V.S.A. § 2759, identical to those required by the Consumer Fraud Act; and (5) limit their fee for services to a $50.00 initial setup fee plus ten percent of any payment received by the company for distribution to creditors, 8 V.S.A. § 2762. Finally, no one other than a licensee may use the term "debt reduction" in any public advertisement. 8 V.S.A. § 2760b(c). In fact, CSA failed to comply with any of these requirements. CSA did not post the requisite bond. MF 77. The company did not submit an annual report. MF 78. It did not disclose in its contract that debt adjustment plans are not suitable for all debtors. MF 79. It did not comply strictly with the right-to-cancel requirement for the same five reasons as it failed to comply with the right-to-cancel disclosure requirements of the Consumer Fraud Act, see supra text 26-28. MF 80. And it clearly did not limit its fee for services to a $50.00 initial setup fee plus ten percent of any payment received by the company for distribution to creditors. MF 81. Moreover, CSA did use the prohibited term "debt reduction" in many of its public advertisements. MF 82. It should be noted, finally, that most of the provisions of the Debt Adjusters Act relevant to this case share with the Consumer Fraud Act the objective of protecting Vermonters from financial harm, in this case at the hands of a regulated industry. The limit on fees to be charged is clearly one such provision, as is the requirement of a contractual disclosure that debt adjustment plans are not suitable for all debtors, the requirement of a three-day right to cancel properly disclosed, and, to a lesser but still extant degree, the bonding and annual report provisions and the restriction on the use of the term "debt reduction" in any public advertisement. As such, the statute's goals are remedial, warranting a liberal construction in the application of the law to CSA. See Carter v. Fred's 32 Plumbing & Heating, Inc., 174 Vt. 572, 574 (mem. 2002) ("Remedial statutes are entitled to liberal construction."); see also cases cited supra text 6. IX. DEFENDANT VAN ARSDALE IS PERSONALLY LIABLE FOR CSA'S VIOLATIONS OF LAW. A. Vermont Law Supports Personal Liability for Consumer Fraud Violations. Under Vermont law, a corporate officer may be held derivatively liable for consumer fraud where he or she has directly participated in the unfair or deceptive acts, directly aided the actor, or has a principal/agent relationship with the actor. See State v. Stedman, 149 Vt. 594, 598 (Vt. 1988). In Stedman, the Supreme Court acknowledged that such derivative liability can also extend to a principal who "has engaged in, is aware of, or has condoned deceptive acts of his agents." Id. (citing Jackson v. Harkey, 704 P.2d 687, 692 (Wash. App. 1985)). Federal courts have taken a similar approach to derivative liability. For example, in FTC v. Amy Travel Service, Inc., 875 F.2d 564, 573-74 (7th Cir. 1989), the FTC sued three telemarketing companies and two of their owner-officers for deceptively marketing and selling "vacation certificates." The individual defendants had developed the basic script used by the companies' telemarketers, which the trial court found to be deceptive. As is alleged here, the individual defendants "were certainly aware of the misrepresentations contained in them." 875 F.2d at 574. The court held that since the officers had both the authority to control their companies and some knowledge of the challenged practices, they were personally liable. See 875 F.2d at 573. Accord, Consumer Protection Division v. Morgan, 874 A.2d 919, 949 (Md. App. 2005) ("We hold that the Consumer Protection Division may hold individuals jointly and severally liable for restitution for the Consumer 33 Protection Act violations of corporations, when the Division proves that (1) the individual participated directly in or had authority to control the deceptions or misrepresentations, and (2) the individual had knowledge of the practices.") Authority to control a company, in turn, "can be evidenced by active involvement in business affairs and the making of corporate policy, including assuming the duties of a corporate officer." Amy Travel, 875 F.2d at 573. As for the knowledge requirement, that may be satisfied by demonstrating that the individual had 'actual knowledge of material misrepresentations, reckless indifference to the truth or falsity of such misrepresentations, or an awareness of a high probability of fraud along with an intentional avoidance of the truth.' Id. at 574 (citation omitted). However, it need not be shown that the person intended to defraud consumers. Id. This view of officer liability is consistent with decisions in other states holding that officers who have not themselves made deceptive representations may be held liable for unfair or deceptive acts and practices by their corporations where they have either knowingly entered into the deceptive scheme, see Schmidt Enterprises, Inc. v. State, 354 N.E.2d 247, 253 (Ind. App. 1976); established the company policy, see Moy v. Schreiber Deed Security Co., 535 A.2d 1168, 1171 (Pa. Super. Ct. 1988), and State ex rel. Medlock v. Nest Egg Society Today, Inc., 348 S.E.2d 381, 385-86 (S.C. App. 1986); or approved of promotional materials that were deceptive, see Grayson v. Nordic Construction Co., Inc., 599 P.2d 1271, 1274 (Wash. 1979). Finally, in an action alleging involvement in unfair or deceptive practices by corporate owner-officers, the Chittenden Superior Court denied a motion to dismiss filed by the individual defendants based on allegations that they had knowledge or control of the 34 wrongful conduct at issue. See State v. Vacation Break U.S.A., Inc., et al., No. S353-97 CnC (Chittenden Super. Ct., Mar. 11, 1998) (Opinion and Order at 3) ("corporate officers and directors are liable for tortious acts the corporation commits under their direction or with their participation."). Noting that according to the complaint, the corporate officers "ha[d] known of or controlled" the company's allegedly unfair and deceptive acts, the Court in that case denied the individual defendants' motion to dismiss. Id. at 3-4. B. Defendant Van Arsdale Is Personally Liable for CSA's Violations of Law. Here, as noted supra text 4, Defendant Van Arsdale founded CSA and served as its CEO, Director and Registered Agent until November 2006, as well as resuming his positions as CEO and Registered Agent of CSA in December 2007 and founding CSA's successor limited liability corporation. However, his role at CSA went well beyond those titles. First, Defendant Van Arsdale has acknowledged that he had authority over CSA's web site content and was aware of the company's results claims at or shortly after they appeared on the website, MF 83. Indeed, his "research" into the debt settlement industry—such as it was—led to the inclusion of percentage savings claims on the company's website, DVA at 3240, a website that Mr. Van Arsdale himself helped put together, DVA at 37, 39. MF 84. Second, Defendant Van Arsdale was aware of CSA's right to cancel and related notifications from their inception. MF 85. Not only that, but he helped create, approved, and had the authority to change any part of, CSA's enrollment package, DVA at 42-43, which package contained the right-to-cancel rules and procedures challenged in this lawsuit. MF 86. Similarly, Mr. Van Arsdale reviewed, approved, and retained the authority to change the telephone scripts used by CSA, DVA at 41-42, MF 87, which scripts omitted the oral notice of the right to cancel mandated by Vermont statute. 35 Third, Defendant Van Arsdale was aware of Vermont's debt adjuster licensing law on or about the time it became effective. MF 88. Based on the above, Defendant Van Arsdale is personally liable for CSA's conduct with respect to the company's online results claims, its consumer right-to-cancel policies, and its failure to comply with Vermont's debt adjusters statute, because he had the requisite authority and knowledge of that conduct, as well as direct involvement in it (although such involvement is not strictly needed to establish liability). X. APPROPRIATE RELIEF Once the liability of Defendants is established, the issue of appropriate relief must be addressed. The Consumer Fraud Act authorizes the Court to render "any" temporary or permanent relief as may be in the public interest, including consumer restitution, civil penalties of up to $10,000 per violation, injunctive relief and attorney's fees and costs. 9 V.S.A. § 2458(b). A. Injunctive Relief The State has represented that CSA is no longer doing business in Vermont or with Vermont consumers. However, "[it is settled that an action for an injunction does not become moot merely because the conduct complained of has terminated, if there is a possibility of recurrence[1" Id. (quoting Allee v. Medrano, 416 U.S. 802, 810 (1974)). Otherwise 'the defendant is free to return to his old ways." Id. (quoting U.S. v. W.T. Grant, 345 U.S. 629, 632 (1953), and citing Beneficial Corp. v. FTC, 542 F.2d 611, 617 (3d Cir. 1976) (court may bar prior deceptive practice if practice could be resumed), and Fedders Corp. v. FTC, 529 F.2d 1398, 1403 (2d Cir.1976) (injunctive relief may extend to discontinued deceptive practice where public interest requires)). 36 As a result, it is appropriate for the Court to order either that Defendants not conduct any future debt settlement or similar business in Vermont, or, in the alternative, that they (1) not advertise the savings or other results it can achieve unless they first possess reasonable and specific factual substantiation that those results represent the typical outcome for their customers, using a calculation based on all debts enrolled, the amounts due at the time of enrollment, and the inclusion of service fees; (2) strictly comply with Vermont's right-tocancel requirements as set out in 9 V.S.A. § 2454 and CF 113; and (3) first obtain a state debt adjuster's license and comply with all requirements of the Vermont Debt Adjusters Act. The Court will enjoin Defendants from conducting any debt settlement or similar business in Vermont unless and until they obtain leave of the Court. B. Consumer Refunds and Other Monetary Relief Vermont consumers who enrolled with CSA were both deceived by the company as to the debt-reduction results they could expect to achieve, and denied their statutory right to cancel. Accordingly, Defendants will be required, jointly and severally, to provide prompt and full refunds of all as-yet-unrefunded amounts received from Vermont consumers. C. Civil Penalties The Consumer Fraud Act, 9 V.S.A. § 2458(b), authorizes the imposition of civil penalties in an amount not to exceed $10,000 per violation. Each online results claim—of which there were at least 347, measured by just website revisions, MF 31—and each one of CSA's 207 Vermont customers represents a separate violation. See, e.g., People v. Bestline Products, Inc., 132 Cal. Rptr. 767, 795 (1976) (one violation per solicitee); State ex rel. Corbin v. United Energy Corp. of America, 725 P.2d 752 (Ariz. Ct. App. 1986) (permitting maximum penalty per victim per violation); see also State v. Menard, Inc., 358 N.W.2d 813, 815 (Wis. 37 Ct. App. 1984), and May Dept. Stores Co. v. State ex rel. Woodard, 863 P.2d 967, 975 (Colo. 1993) ("transaction" under consumer fraud statute means one advertisement in one media outlet per day). Defendants' unfair and deceptive practices were substantial and widespread enough to warrant the imposition of significant civil penalties, both as a sanction for Defendant's conduct and as a deterrent to similar conduct by them and others in the future. The State proposes a civil penalty of $1,000 for each per-consumer violation, for a total of $207,000, to be imposed, jointly and severally, on CSA and Defendant Van Arsdale. However, because of the extent and breadth of Defendants' fraudulent conduct, the Court believes that the maximum penalty of $2.07 million ($10,000 times 207 consumers) is appropriate, D. Fees and Costs The Consumer Fraud Act, 9 V.S.A. § 2458(b), also provides for "an order requiring reimbursement to the State of Vermont for the reasonable value of its services and its expenses in investigating and prosecuting [this] action." The Court will order CSA and Defendant Arsdale, jointly and severally, to pay the State's reasonable fees and costs in this matter. The State will submit an affidavit to the Court setting out the hours logged by its legal staff and recommended reimbursement rates within 30 days of this Order. ORDER The State's Motion for Summary Judgment on Counts 1, 2 and 4 is granted. The State will file a proposed order, consistent with this decision within ten days. Dated at Montpelier, Vt., March 5, 2012, Michael S. pers *th Superior Judge 38 Exhibit STATE OF VERMONT SUPERIOR COURT CHITTENDEN UNIT Index No.: 226-3-20 STATE OF VERMONT, DEFENDANT’S RESPONSES TO PLAINTIFF’S FIRST SET OF REQUESTS FOR ADMISSIONS Plaintiff, -againstCLEARVIEW AI, INC, Defendant. 1 Clearview repeats and incorporates by reference each of the General Objections set forth above as though fully restated herein. Clearview cannot admit or deny and objects to this Request as vague and ambiguous as to the word "accuracy" as it fails to specify the numerous metrics there are that the word can encompass, and the extent it calls for a legal conclusion as to that word's meaning, as well as to the meaning and any legal conclusions called for by the phrase "complete compliance." Clearview further cannot admit or deny and objects to the fact that the request constitutes a compound question. Based on the foregoing, the Request is denied. 36. Admit that Clearview has sent marketing materials, via email or otherwise, to individuals in Vermont. Request for Admission No. 36: Clearview repeats and incorporates by reference each of the General Objections set forth above as though fully restated herein. Clearview cannot admit or deny and objects to this Request because the word "individual" is vague and ambiguous to the extent that it calls for a legal conclusion. Clearview admits it has sent marketing materials targeted to law enforcement and security professionals in all 50 states. 37. Admit that Clearview has sent marketing materials, via email or otherwise, to businesses in Vermont. Request for Admission No. 37: Clearview repeats and incorporates by reference each of the General Objections set forth above as though fully restated herein. Clearview cannot admit or deny and objects to the word "businesses" as vague and ambiguous to this Request to the extent 21