When big technology companies engage in misconduct, the primary legal redress available to their consumers is class action litigation.1 But in order to file such lawsuits, consumers must have standing, a legal requirement that protects the constitutional separation of powers imperative. Rooted in the Article III limitation that courts adjudicate only actual “[c]ases” and “[c]ontroversies,”2 standing requires plaintiffs to show that they have suffered an “injury in fact” in order to access the courts.3 In order to meet that “irreducible constitutional minimum,” injuries must be “concrete and particularized,” and “actual or imminent.”4 “[C]onjectural or hypothetical” disputes should be left to the other branches.5 Recently, in Robins v. Spokeo, Inc.,6 the Ninth Circuit held that a plaintiff who alleged he had been harmed by the defendant’s violation of the Fair Credit Reporting Act7 (FCRA) had suffered an injury sufficiently concrete to confer standing.8 In doing so, the Ninth Circuit affirmed standing’s separation of powers roots, honored congressional intent, and preserved class actions as a primary enforcement mechanism against technology companies.
Congress passed the FCRA in 1970 with the stated intent of “prevent[ing] consumers from being unjustly damaged because of inaccurate or arbitrary information in a credit report.”9 To achieve that aim, the FCRA imposes on consumer reporting agencies a number of requirements concerning the creation and use of consumer reports, including that agencies “follow reasonable procedures to assure maximum possible accuracy of” their reports.10 The FCRA also provides that “[a]ny person who willfully fails to comply with any requirement [of the FCRA] with respect to any [person] is liable to that [person]” for, among other things, actual damages, statutory damages of $100 to $1000 per violation, costs of the action, and attorney’s fees.11
Spokeo, Inc. operates a “people search engine,” which aggregates personal information about individuals to share with its users, including employers evaluating prospective employees.12 When Thomas Robins learned that his Spokeo profile stated he was a relatively affluent fifty-something, with children, a job, and a graduate degree — none of which was true — he filed a class action complaint in the Central District of California, alleging that Spokeo had willfully violated the FCRA by failing to follow reasonable procedures to ensure the accuracy of the information it disseminated about him.13 He alleged that Spokeo’s violation had harmed his employment prospects when he had been unemployed, causing him ongoing anxiety and stress.14
The district court dismissed Robins’s complaint for lack of Article III standing, holding that the procedural violation of the FCRA, without any actualized injury, was not a sufficient injury.15 The Ninth Circuit reversed.16 It stated that “the violation of a statutory right is usually a sufficient injury” within Article III’s limits,17 and that those limits were respected in this case because “Spokeo violated [Robins’s] statutory rights, not just the statutory rights of other people,” and because Robins’s interests were “individualized rather than collective.”18 Thus, the court said, Robins had suffered a standing-sufficient injury by the violation of his FCRA-conferred rights.19
The Supreme Court vacated and remanded.20 Writing for the Court, Justice Alito21 explained that standing is a logical conjunction, not a disjunction, and that though the Ninth Circuit properly established that Robins’s injury was particularized, it did not sufficiently consider whether his injury was also concrete.22 In remanding the case with instructions to conduct the concreteness inquiry,23 Justice Alito offered some guidance: a concrete injury is “real, and not abstract” and “must be de facto; that is, it must actually exist.”24 Concrete injuries are more than “bare procedural” harms, but need not be tangible.25 And whether an intangible harm qualifies as an injury turns on both history and congressional decisions.26
Justice Alito declined to take a position on the correct result of the prescribed concreteness inquiry in Robins’s case.27 However, he did set the goalposts. “On the one hand,” he wrote, “Congress plainly sought to curb the dissemination of false information by adopting procedures [in the FCRA] designed to decrease that risk. On the other hand, Robins cannot satisfy the demands of Article III by alleging a bare procedural violation.”28 Not all procedural violations create harm or a material risk of harm; for example, “[i]t is difficult to imagine how the dissemination of an incorrect zip code, without more, could work any concrete harm.”29
Justice Thomas concurred in the judgment. He preferred to reach the majority’s result by tracing the development of private versus public rights through common law courts.30
Justice Ginsburg, joined by Justice Sotomayor, dissented. She felt no need to remand the case, because she believed Robins’s complaint to have sufficiently alleged that Spokeo had harmed his job prospects.31
Given these goalposts, the Ninth Circuit determined on remand that Spokeo’s alleged FCRA violation established a concrete harm sufficient to confer standing.32 Writing for the panel, Senior Judge O’Scannlain33 adopted the two-pronged test for concreteness put forth by the Second Circuit in Strubel v. Comenity Bank34: “(1) whether the statutory provisions at issue were established to protect [Robins’s] concrete interests (as opposed to purely procedural rights), and if so, (2) whether the specific procedural violations alleged in this case actually harm, or present a material risk of harm to, such interests.”35 Given the congressional record tracking the increasing “ubiquity and importance of consumer reports,” Judge O’Scannlain had “little difficulty” concluding that the FCRA was established to protect a concrete interest in preventing dissemination of false information to future employers.36 He analogized that interest to others protected by common law — for example, tort law has long provided remedies for defamatory statements that cause harm.37 Guided by congressional judgment and historical practice, Judge O’Scannlain concluded that the first prong was easily satisfied.38
On the second prong, Judge O’Scannlain acknowledged that the failure to follow reasonable procedures as prescribed by the FCRA does not always cause real-world harm.39 For example, even if a credit reporting agency collects false information, it does not always publish it.40 But he declined to draw a precise line between violations that do and do not confer standing.41 Instead, he weighed Robins’s harm against the Supreme Court’s counterexample — an incorrect zip code — and concluded that a misrepresented age, marital status, educational background, employment history, and the like were much more likely to harm employment prospects or create emotional distress.42 Relying on an amicus brief by the Consumer Financial Protection Bureau, Judge O’Scannlain reasoned that “even seemingly flattering inaccuracies can hurt an individual’s employment prospects as they may cause a prospective employer to question the applicant’s truthfulness or to determine that he is overqualified.”43 Thus, Judge O’Scannlain concluded that the alleged FCRA violation was an injury sufficient to confer standing and remanded the case.44
With that conclusion, the Ninth Circuit respected congressional intent and preserved a key safeguard for consumers in the digital era. By adopting the Strubel standard, and applying it liberally, the court respected standing’s separation of powers roots and exercised a healthy deference to Congress. Moreover, the court’s decision will have the important consequence of preserving the vitality of class action litigation as the best — and sometimes only — mechanism for protecting against online abuses. Thus, Robins made Spokeo practical in the best way possible.
The Supreme Court’s guidance on what constitutes a concrete injury was itself anything but concrete. On the one hand, the Court rejected the notion that the mere violation of a statute conferring a procedural right is a sufficient injury to confer standing; on the other, it affirmed Congress’s power to “define injuries . . . that will give rise to a case or controversy where none existed before.”45 It was not, therefore, a foregone conclusion that the Ninth Circuit would hold that Robins had standing.46 In fact, during oral arguments, Justice Alito called Robins’s alleged injury a “quintessential speculative harm.”47 He seemed troubled by the lack of proof that anyone other than Robins had ever searched for Robins on the Spokeo website, let alone used the information they found against him.48 Similarly, Justice Ginsburg expressed concerns about the difficulty of quantifying intangible harms for the purpose of assessing statutory damages.49 The FCRA provides for $100 to $1000 per violation50 — but what is a violation? A false fact published? A page view of that fact?
That the Ninth Circuit’s ultimate decision was not compelled by the Supreme Court is further illustrated by the fact that other circuits have taken the Court’s guidance in different directions. Perhaps the most crystallized realization of this split is between the Eighth and the Sixth Circuits. In decisions just days apart, both citing Spokeo, the former ruled that a violation of a consumer protection statute was insufficient to confer standing because the plaintiff had not identified any actual harm that resulted from the defendant’s violation of the statute, while the latter held in a class action about a data breach that plaintiffs did not have to show their data had actually been misused to clear Spokeo’s standing bar — a statutory violation was enough.51 In another recent FCRA case, the Third Circuit spelled out the “material risk of harm” concreteness test used by numerous other circuits before adopting its own, new test, supplying no explanation for the departure.52
The Ninth Circuit thus chose one plausible interpretation — the Strubel test — out of many. That choice was normatively desirable on at least three dimensions: the nature of the test itself, the manner in which it was applied, and the implications for future class action litigation in the online sphere. First, the Strubel test reflects an appropriate deference to Congress in that it is supported by an examination of congressional intent.53 The choice of a deferential test was no accident; the Ninth Circuit cited affirmatively to opinions that have weighed congressional intent in determining what is a concrete injury.54 The court seemed to respect that “legal rights reflect social judgments about where harm has and has not occurred,” and those social judgments are best left to a democratically accountable branch.55 Here, the Supreme Court overstepped in its declaration that a mistaken zip code would not have adverse offline consequences.56 This mismatch underscores the genius of separation of powers in the standing context and explains the importance of the Ninth Circuit’s deference to Congress on what Congress sees as important rights to protect.
Second, the court was generous in its application of the test. It briefly examined the FCRA and its legislative history before concluding with “little difficulty” that the “interests protected by [the] FCRA’s procedural requirements are ‘real,’ rather than purely legal creations.”57 Those interests were similar enough to certain torts — libel and slander — for which “[c]ourts have long entertained causes of action” that the court felt no need to conduct a more fact-intensive inquiry.58 Given that the analogized common law torts are difficult to prove,59 the court could easily have been more stringent in its application of the Strubel test. For example, in applying the “material risk of harm” prong, it could have followed Justice Alito’s line of questioning at oral argument60 and asked for proof — or at least proof of a material risk — that a prospective employer had seen the misinformation about Robins on Spokeo. To do so would have required remanding to the trial court to allow Robins to subpoena data from Spokeo, track down each individual or company who had viewed his Spokeo profile, and ascertain whether the access of that profile had in any way influenced their decisions about whether to hire him; that is, it would have effectively precluded the lawsuit. Instead, the court gave Robins the benefit of the doubt in its willingness to simply imagine how Spokeo’s misinformation could have harmed Robins.
Finally, if deference to Congress was the Ninth Circuit’s rationale, the preservation of class actions to protect individuals in the online sphere was the practically significant consequence. When the Supreme Court granted certiorari, courts around the country stayed statutory damages cases.61 When its decision came down, the implications for class actions to vindicate online harm were seemingly bleak. The Court appeared to set a high, fact-intensive bar for finding the violation of a statutorily conferred intangible harm — that is, the exact type of harm that tends to occur online — which would significantly narrow the class of named plaintiffs who could bring enforcement actions.62 Instead, the Ninth Circuit’s willingness to extrapolate, as discussed above, will ensure that class actions remain available as a regulatory mechanism.
This consequence is especially important in the online sphere, where class actions are often the only available regulatory mechanism. Online, a few search engines wield enormous power,63 and the information they make (or do not make) available is deployed in “make or break” contexts — employment decisions, loan applications, and the like.64 The sheer magnitude of information available online, and thus the sheer amount of misinformation that will inevitably be published, means executive agencies simply do not have the resources to prosecute every violation. And it would be financially untenable for every wronged individual to pursue litigation to recover $100 to $1000. Thus, the FCRA deputizes the private bar, incentivizing it with statutory damages to file class actions and effectively act as a regulator.65 Denying access to that regulatory mechanism would have the practical effect of allowing powerful companies to operate unchecked. Had the Ninth Circuit denied standing, it would have allowed Spokeo to “get away” with disseminating inaccuracies regarding important personal data. Thus, the court shifted the contours of the doctrine to avoid a pattern of undesirable outcomes.66
Robins made Spokeo practical in the best possible way. It moved away from the Supreme Court’s failure to recognize the potential real-world importance of a correct zip code, toward a legal rule that recognizes the incentives that individuals have to litigate and the significance of disseminating false information. In deferring to Congress’s judgment, imagining the significance of an online, intangible harm, and allowing the litigation to proceed, the Ninth Circuit preserved a critical tool for consumers who wish to hold companies accountable.