Internet Library of Law
and Court Decisions

In Re Pharmatrak, Inc. Privacy Litigation

Reversing the decision of the court below, the First Circuit holds that the grant of permission by web site owners to defendant Pharmatrak to operate web tracking software on their web sites does not constitute consent to intercept their communications with site users, because the site owners expressly instructed defendant Pharmatrak not to gather personal information about site users.  As a result, the First Circuit reversed the District Court's decision, which had dismissed claims brought by site users under the Electronic Communications Privacy Act ("ECPA") arising out of defendant Pharmatrak's gathering of information concerning individual site users, and their use of the web site owners' sites, from communications between the users and the sites themselves.  The First Circuit remanded the case for further consideration as to whether defendant Pharmatrak's actions were intentional, a prerequisite to an ECPA claim, in light of the fact that Pharmatrak appeared to have gathered personally identifiable information as to only 232 of the approximately 18.7 million users whose activities it tracked.

Defendant Pharmatrak sold a product known as Netcompare, which permitted a company to compare the web traffic on pages of its website with that of the pages of its competitors' sites with similar content.  Pharmatrak received permission from various pharmaceutical companies to operate this product on their websites.  However, these companies expressly informed Pharmatrak that they did not want Pharmatrak to gather personally identifiable information concerning any particular user of their sites.  Rather, site user statistics were to be presented in the aggregate, anonymously.

To facilitate the operation of Netcompare, the Pharmaceutical companies installed HTML code on their web sites which caused a user's computer, when the user visited these sites, to contact servers maintained by Pharmatrak.  These servers, in turn, embedded a 'persistent cookie' on the user's computer.  These cookies, which contained  individual identifiers, permitted Pharmatrak to track the user's use of client's sites, including the web pages visited, time spent at each web page, and path through the site.  The cookies also enabled Pharmatrak to ascertain the web site the user visited just before, and just after the conclusion of his visit to the client's web site.

Pharmatrak presented the data it obtained from Netcompare to its clients in monthly reports, which, while detailing the use of clients' sites, contained no personally identifiable information.

Apparently as the result of an unintended interaction between its Netcompare software and the code found on various web pages of its clients' sites, Pharmatrak collected personally identifiable information concerning 232 of the approximately 18.7 million users whose activities it tracked.  While this information was resident on its computers, there is no indication in the First Circuit's decision that this information was disseminated to Pharmatrak's customers.

Plaintiffs commenced this suit, charging that Pharmatrak's actions violated the ECPA.  On Pharmatrak's motion for summary judgment, the district court dismissed the suit, finding that plaintiffs' communications with the Pharmaceutical companies' web sites were not improperly intercepted because those companies had consented to their interception by permitting Phamatrak to utilize its Netcompare product on their sites.  The First Circuit disagreed, but remanded the case for further consideration, as explained below.

The ECPA prohibits the intentional interception of electronic communications.  As explained by the First Circuit, "plaintiffs must show five elements to make their claim under Title I of the ECPA:  that a defendant (1) intentionally (2) intercepted, endeavored to intercept or procured another person to intercept or endeavor to intercept (3) the contents of (4) an electronic communication (5) using a device."

A party can avoid prosecution under the ECPA "where one of the parties to the communication has given prior consent to such interception unless such communication is intercepted for the purpose of committing any criminal or tortuous act…" 18 U.S.C. §2511(2)(d).

Rejecting the conclusion of the District Court, the First Circuit held that neither the Pharmaceutical companies, nor the site users had consented to Pharmatrak's interception of their communications.  After holding that the burden of proving consent rested on the party seeking the benefit of the exception, here Pharmatrak, the First Circuit rejected the lower court's conclusion that the Pharmaceutical companies had consented to the interception of their communications with users by consenting to the installation of Netcompare on their sites.  In reaching this conclusion, the Court relied on the fact that the Pharmaceutical companies had expressly directed Pharmatrak not to collect personally identifiable information, and had terminated their contracts with Pharmatrak when they learned of plaintiffs' allegations that such information had been collected.  The Court also relied on the fact that the Pharmaceutical companies were unaware of the manner in which Netcompare worked, or of the product's ability to gather personally identifiable information.

In addition, the Court concluded that the site's users did not consent to the interception of their communications, because they were unaware of Pharmatrak's activities.

The First Circuit held that Pharmatrak had intercepted electronic communications, within the meaning of the ECPA, because its acquisition of information relating thereto occurred simultaneously with the communication itself.  "Separate but simultaneous and identical communications satisfy even the strictest real-time requirement" of the ECPA, held the Court.

However, the First Circuit remanded the case to the District Court for a determination as to whether such interceptions were intentional, another prerequisite to an ECPA claim.  The First Circuit noted that this intent element was included within the statute "to underscore that 'inadvertent interceptions' are not a basis for criminal or civil liability under the ECPA."  In addition, the court noted the following relevant Congressional history.  "'Intentional' means more than that one voluntarily engaged in conduct or caused a result.  Such conduct or the causing of the result must have been the person's conscious objective."

As a result, the First Circuit remanded for a determination as to whether Pharmatrak's conduct was in fact intentional, particularly in light of the fact that personal information was only found as to 232 of approximately 18.7 million users, was apparently inadvertently gathered, and was apparently not disseminated to third parties.