                  FOR PUBLICATION

  UNITED STATES COURT OF APPEALS
       FOR THE NINTH CIRCUIT


FAYELYNN SAMS, Individually, and           No. 11-16938
on behalf of a class of all others
similarly situated,                           D.C. No.
                    Plaintiff-Appellant,   5:10-cv-05897-
                                                 JF
                  v.

YAHOO ! INC.,                                OPINION
                  Defendant-Appellee.


       Appeal from the United States District Court
          for the Northern District of California
        Jeremy D. Fogel, District Judge, Presiding

                 Argued and Submitted
      February 11, 2013—San Francisco, California

                    Filed April 15, 2013

     Before: Dorothy W. Nelson, Stephen Reinhardt,
        and Milan D. Smith, Jr., Circuit Judges.

          Opinion by Judge Milan D. Smith, Jr.
2                     SAMS V . YAHOO ! INC.

                           SUMMARY*


                 Stored Communications Act

    The panel affirmed the dismissal of putative class claims
that Yahoo! Inc., a network service provider, violated the
Stored Communications Act when it disclosed subscriber
information to the government pursuant to allegedly invalid
subpoenas.

    The panel held that Yahoo! was immune from suit under
18 U.S.C. § 2707(e) because it produced the requested
documents in good faith reliance on grand jury subpoenas.
The panel held that the good faith defense is met when the
defendant complies with a subpoena that appears valid on its
face, in the absence of any indication of irregularity sufficient
to put the defendant on notice that the subpoena may be
invalid or contrary to applicable law. A defendant may not
benefit from the defense, however, if the defendant actually
knew that the subpoena was invalid under the applicable law.


                            COUNSEL

Joshua A. Millican (argued), Law Office of Joshua A.
Millican, P.C., Atlanta, Georgia; Laurence D. King and Mario
M. Choi, Kaplan Fox & Kilsheimer LLP, San Francisco,
California, for Plaintiff-Appellant.




  *
    This summary constitutes no part of the opinion of the court. It has
been prepared by court staff for the convenience of the reader.
                    SAMS V . YAHOO ! INC.                     3

Marc J. Zwillinger (argued) and Jacob A. Sommer, Zwillgen
PLLC, Washington, D.C., for Defendant-Appellee.


                          OPINION

M. SMITH, Circuit Judge:

     Fayelynn Sams appeals the district court’s order
dismissing her putative class claims against Yahoo! Inc. with
prejudice. Sams alleges that Yahoo! violated the Stored
Communications Act (SCA), 18 U.S.C. §§ 2701–2712, when
it disclosed some of Sams’ noncontent subscriber information
to the government pursuant to allegedly invalid subpoenas.
Sams further argues that even if the subpoenas were valid,
Yahoo! failed to comply with their terms when it produced
the requested documents prior to the deadline set in the
subpoenas. Because the SCA provides a “complete defense
to any civil or criminal action” where the defendant can
demonstrate that it produced documents in “good faith
reliance on . . . a grand jury subpoena,” we affirm the district
court’s order dismissing Sams’ claims.

                      BACKGROUND

    Yahoo! styles itself as a “premier digital media
company,” whose product offerings include Internet search
and email. Yahoo! is a Delaware corporation, and its
principal place of business is located in Sunnyvale,
California. While Yahoo! maintains an office in Georgia, its
legal compliance team is located in Sunnyvale.

    On December 2, 2008, Yahoo!’s legal compliance team
received a facsimile of a grand jury subpoena from the
4                       SAMS V . YAHOO ! INC.

District Attorney’s Office for the Southern Judicial Circuit of
Georgia. The District Attorney requested that Yahoo!
disclose “any and all records regarding the identification” of
one of its users.1 The user in question was later determined
to be Sams. The subpoena was signed by both a judge and
the clerk of the Superior Court of Lowndes County, Georgia,
and demanded that Yahoo! produce the requested records at
8:30 a.m. on January 28, 2009. A substantially similar
subpoena was faxed to Yahoo!’s legal compliance team on
December 15, 2008, demanding the production of additional
documents by the January 28 deadline.2

   Both subpoenas were accompanied by nearly identical
cover letters that purported to explain Yahoo!’s obligations
under the subpoenas. Those letters read, in relevant part:

         As the subpoena indicates, you are required
         by law to appear and produce the evidence
         described in the subpoena before the Grand
         Jury on the date and time specified. Prior to
         your appearance, you may wish to voluntarily
         provide copies of this evidence to Inv. Wendy
         Lain at the District Attorney’s Office. . . By
         voluntarily providing us with copies prior to


  1
    Specifically, the December 2 subpoena requested the user’s “name and
address, date account created, account status, Yahoo! E-mail [sic] address,
alternate e-mail address, registration from IP, date IP registered and login
IP addresses associated with session time and dates of November 12, 2008
at 3:45 p.m. GMT, November 13, 2008 at 3:24 p.m. GMT, November 18,
2008 at 4:04 p.m. GMT, and December 1, 2008 at 3:43 p.m. GMT.”

    2
     The December 15 subpoena requested “[a]ny and all IP login tracker
. . . for the dates of December 1, 2008, December 3, 2008, December 8,
2008, and December 9, 2008.”
                     SAMS V . YAHOO ! INC.                        5

        your scheduled appearance, you will make it
        possible for us to review the evidence in your
        possession in advance. This should expedite
        your appearance before the Grand Jury and
        may make it possible for us to put you on call.

Yahoo! produced the requested information sometime before
January 28, 2009. Consequently, the prosecutor determined
that the attendance of a witness was not needed, and no
Yahoo! witness testified before the grand jury pursuant to the
subpoenas.

    Based on the above conduct, Sams filed a putative class
action in the Superior Court of Fulton County, Georgia,
purporting to represent a class of plaintiffs whose information
Yahoo! had allegedly disclosed to law enforcement in
violation of the SCA. Sams claimed that Yahoo!’s
disclosures were unlawful because the subpoenas failed to
comply with the requirements of Georgia law, and
specifically the Uniform Act to Secure the Attendance of
Witnesses from Without the State in Criminal Proceedings
(Uniform Act). Ga. Code Ann. §§ 24-13-90–24-13-97.3
Sams further claimed that Yahoo!’s disclosures were
unlawful because they were “voluntarily” made before the
deadline for compliance set forth in the subpoenas.

    Yahoo! successfully removed the action to the United
States District Court for the Northern District of Georgia.
Sams then filed a motion to transfer the case to the Northern
District of California. Yahoo! agreed “that transfer to the
Northern District of California was the appropriate remedy in

  3
    Before January 1, 2013, Georgia’s version of the Uniform Act was
codified at Ga. Code. Ann. §§ 24-10-90–24-10-97.
6                   SAMS V . YAHOO ! INC.

light of Yahoo!’s terms of service,” and the case was
transferred.

    On January 10, 2011, Yahoo! moved to dismiss Sams’
complaint. The district court granted Yahoo!’s motion after
finding Yahoo! was statutorily immune from suit under
18 U.S.C. § 2703(e). The district court also granted Sams
leave to amend her complaint to allege that Yahoo!
impermissibly over-produced Sams’ content-based
information. When Sams did not amend her complaint within
the allotted 30 days, the district court dismissed her complaint
with prejudice. Sams timely appealed.

    JURISDICTION AND STANDARD OF REVIEW

    We have jurisdiction to review the district court’s order
of dismissal under 28 U.S.C. § 1291. We review the district
court’s order de novo, Cousins v. Lockyer, 568 F.3d 1063,
1067 (9th Cir. 2009), and may affirm on any ground
supported in the record, Islamic Republic of Iran v. Boeing
Co., 771 F.2d 1279, 1288 (9th Cir. 1985).

                       DISCUSSION

I. Consideration of Extrinsic Evidence and Affirmative
   Defenses

     This case comes to us on a motion to dismiss under
Federal Rule of Civil Procedure 12(b)(6). At this stage of the
litigation, we would usually be confined to reviewing the
body of Sams’ complaint, which did not include copies of the
two subpoenas. See Lee v. City of Los Angeles, 250 F.3d 668,
688 (9th Cir. 2001) (citation omitted). However, we are
permitted to consider documents that were not physically
                       SAMS V . YAHOO ! INC.                            7

attached to the complaint where the documents’ authenticity
is not contested, and the plaintiff’s complaint necessarily
relies on them. Id. at 688–89 (citing Parrino v. FHP, Inc.,
146 F.3d 699, 705–06 (9th Cir. 1998)).4 Because the
subpoenas are critical to Sams’ lawsuit, and there is no
factual dispute as to their contents, we may properly consider
the appearance and content of the subpoenas at this stage in
the litigation.

    Similarly, the assertion of an affirmative defense may be
considered properly on a motion to dismiss where the
“allegations in the complaint suffice to establish” the defense.
Jones v. Bock, 549 U.S. 199, 215 (2007); see also Goddard
v. Google Inc., 640 F. Supp. 2d 1193, 1199 n.5 (noting that
“affirmative defenses routinely serve as a basis for granting
Rule 12(b)(6) motions where the defense is apparent from the
face of the [c]omplaint”) (internal quotation and citation
omitted).

II. The Stored Communications Act Claims

    Congress passed the SCA in 1986 as part of the Electronic
Communications Privacy Act. “The SCA was enacted
because the advent of the Internet presented a host of
potential privacy breaches that the Fourth Amendment does
not address.” Quon v. Arch Wireless Operating Co., 529 F.3d




 4
    See also 5 Charles Alan W right & Arthur R. Miller, Federal Practice
and Procedure § 1327 (2012) (“when the plaintiff fails to introduce a
pertinent document as part of her pleading . . . the defendant may
introduce the document as an exhibit to a motion attacking the sufficiency
of the pleading”).
8                      SAMS V . YAHOO ! INC.

892, 900 (9th Cir. 2008), rev’d on other grounds, 130 S. Ct.
2619 (2010) (citation omitted). To address these potential
privacy breaches, the SCA “creates a set of Fourth
Amendment-like privacy protections by statute, regulating the
relationship between government investigators and service
providers in possession of users’ private information.” Orin
S. Kerr, A User’s Guide to the Stored Communications Act,
and a Legislator’s Guide to Amending It, 72 Geo. Wash. L.
Rev. 1208, 1212 (2004). Specifically, the statute protects the
privacy of electronic communications by (1) placing limits on
the government’s ability to compel network service providers
to disclose information they posses about their customers and
subscribers, 18 U.S.C. § 2703, and (2) restricting the ability
of network service providers to voluntarily disclose
information about their customers and subscribers to the
government, 18 U.S.C. § 2702. Violation of these provisions
may result in criminal or civil liability, unless one or both of
the SCA’s statutory immunity provisions applies. 18 U.S.C.
§§ 2703(e), 2707(e).

                                    A.

    § 2703(c)(2) of the SCA provides the rules for compelling
the production of a subset of noncontent records (sometimes
known as “basic subscriber information”) that Congress has
deemed less private than other records.5 Under § 2703(c)(2),

    5
    Specifically, § 2703(c)(2) states that a provider “shall disclose to a
government entity the—(A) name; (B) address; (C) local and long distance
telephone connection records, or records of session times and durations;
(D) length of service (including start date) and types of service utilized;
(E) telephone or instrument number or other subscriber number or
identity, including any temporarily assigned network address; and
(F) means and source of payment for such service (including any credit
card or bank account number), of a subscriber to or customer of such
                        SAMS V . YAHOO ! INC.                             9

the government can obtain basic subscriber
information—such as the information Yahoo! produced
here—with a mere subpoena.6 And where a provider, like
Yahoo!, discloses basic subscriber information to the
government “in accordance with the terms of a . . .
subpoena,” 18 U.S.C. § 2703(e), or in “good faith reliance on
. . . a grand jury subpoena,” 18 U.S.C. § 2707(e), the provider
is immune from suit.

    Sams argues that Yahoo! is not entitled to benefit from
either immunity provision because her basic subscriber
information was produced pursuant to allegedly invalid
subpoenas.7 Specifically, Sams contends that because Yahoo!
is not a citizen of Georgia, it may only be lawfully
subpoenaed in a criminal case pursuant to the provisions of
the Uniform Act. Ga. Code Ann. §§ 24-13-90–24-13-97.
Yahoo! admits that the subpoenas here did not comply with
the requirements of the Uniform Act, but argues that the
Uniform Act does not apply where a foreign corporation
maintains a presence in the state.

   To our knowledge, no Georgia court has determined
whether Georgia law requires the government to comply with


service when the governmental entity uses an administrative subpoena
authorized by a Federal or State statute or a Federal or State grand jury or
trial subpoena[.]”

      6
   See generally Kerr, supra, at 1219–1220; Patricia L. Bellia, The
Memory Gap in Surveillance Law, 75 U. Chi. L. Rev. 137, 162 (2008).

  7
    Yahoo! argues that § 2703(e) provides immunity from suit even if a
subpoena is facially invalid. Because we conclude that Sams’ claims are
barred by § 2707(e), infra, we decline to address Yahoo!’s contention, or
to otherwise construe § 2703(e).
10                 SAMS V . YAHOO ! INC.

the Uniform Act in order to obtain the testimony of a foreign
corporation that maintains a physical presence within the
State of Georgia. See generally Yeary v. State, 711 S.E. 2d
694 (Ga. 2011). However, we see no reason to be the first
appellate court to address this unsettled aspect of Georgia law
because, regardless of the outcome of that issue, we conclude
that Yahoo! is immune from suit under the SCA’s good-faith
immunity provision. 18 U.S.C. § 2707(e).

    § 2707(e) provides that “good faith reliance on . . . a
grand jury subpoena” is “a complete defense” to any action
brought under the SCA. 18 U.S.C. § 2707(e). The legal
definition of “good faith reliance” under § 2707(e) is a matter
of first impression in this circuit, and few other courts have
interpreted this provision. See, e.g., McCready v. eBay, Inc.,
453 F.3d 882, 892 (7th Cir. 2006) (adopting objective test of
good faith); Freedman v. America Online, Inc., 325 F. Supp.
2d 638, 647–48 (E.D. Va. 2004) (adopting test of good faith
with both an objective and subjective component); Fox v.
CoxCom Inc., No. CV-11-594, 2012 WL 6019016, at *3 (D.
Ariz. Dec. 3, 2012) (same). Although we reject the
Freedman court’s specific formulation of the good faith test,
we agree that the test of good faith reliance under § 2707(e)
should contain both an objective and subjective element.
Accordingly, we now hold that the good faith defense under
18 U.S.C. § 2707(e) is met when the defendant complies with
a subpoena (or other process detailed in § 2707(e) of the
SCA) that appears valid on its face, in the absence of any
indication of irregularity sufficient to put the defendant on
notice that the subpoena may be invalid or contrary to
applicable law. A defendant may not benefit from the good
faith defense, however, if the defendant actually knew that the
subpoena (or other process) was invalid under the applicable
law.
                       SAMS V . YAHOO ! INC.                          11

    Thus, whether a particular defendant satisfies the
requirements to establish “good faith reliance” is a mixed
question of law and fact. See, e.g., Sinaloa Lake Owners
Ass’n v. City of Simi Valley, 70 F.3d 1095, 1099 (9th Cir.
1995). Whether the defendant actually knew that a subpoena
was invalid is a question of fact. Whether the defendant’s
belief in the subpoena’s validity was objectively reasonable
is itself a mixed question of law and fact. If there are
disputed issues of material fact as to the “historical facts of
what the [defendant] knew or what he did, it is clear that
these are questions of fact for the jury to determine.” Id.; see
also Act Up!/Portland v. Bagley, 988 F.2d 868, 873 (9th Cir.
1993). Whether those “historical facts” support an objective
belief that the defendant acted reasonably, however, is a
question of law to be decided by the court. Act Up!/Portland,
988 F.2d at 873; see also Hunter v. Bryant, 502 U.S. 224,
228–29 (1991).

    Applying these principles to Yahoo!’s conduct here, we
find that Yahoo! is statutorily immune from suit. First, Sams
pled no facts sufficient to lead to a plausible inference that
Yahoo! actually knew that these subpoenas were invalid.
Sams’ sole allegation that Yahoo! did not act in good faith is
no more than a threadbare recital of the language of
§ 2707(e), precisely the kind that we decline to credit.8 See
Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). Under Iqbal,
such bald legal conclusions are not entitled to be accepted as
true and thus “do not suffice” to prevail over a motion to



 8
   Sams alleges that “[n]one of the foregoing acts and omissions taken by
Yahoo! were based on a valid and enforceable grand jury subpoena or a
good faith reliance on the same so as to constitute a complete defense to
this civil action as set forth in 18 U.S.C. § 2707(e).”
12                     SAMS V . YAHOO ! INC.

dismiss. Id.; see also Faulkner v. ADT Sec. Servs., Inc.,
706 F.3d 1017, 1020 (9th Cir. 2013).

    Second, Yahoo!’s production in response to these
subpoenas was objectively reasonable as a matter of law.9
For even assuming, arguendo, that these subpoenas were
ultimately invalid, they bore all of the indicia of lawful
authority. See United States v. Crews, 502 F.3d 1130,
1136–38 (9th Cir. 2007) (finding good faith reliance as a
matter of law where search warrant affidavit contained
sufficient indicia of probable cause on its face); McCready,
453 F.3d at 892 (good faith reliance under SCA established
as a matter of law where “nothing” about subpoena would
have put defendant “on notice that the subpoena was
‘phony’”). For instance, the subpoenas were faxed from the
District Attorney’s Office, stated the name of the court and
the title of the action, and bore the signature of both the court
clerk and a superior court judge. See Ga. Code Ann. § 24-10-
20 (2012) (repealed 2013) (“Every subpoena shall be issued
by the clerk under the seal of the court, shall state the name
of the court and the title of the action, and shall command
each person to whom it is directed to attend and give
testimony at a time and place therein specified.”) Moreover,
Yahoo!’s response to the first subpoena was received by the
proper office, and that response prompted the District
Attorney to seek additional information by way of a second
subpoena. Simply put, nothing about these subpoenas would



     9
      As previously noted, where the historical facts regarding what a
defendant knew or did are not in dispute, as is the case here, the question
of objective reasonableness is a question of law “that should be
determined by the district court at the earliest possible point in the
litigation.” Act Up!/Portland, 988 F.2d at 873.
                   SAMS V . YAHOO ! INC.                  13

place a reasonable person on notice that they might be
invalid.

    Sams relies on Freedman to argue that dismissal of her
claims was nevertheless inappropriate. 325 F. Supp. 2d 638
(E.D. Va. 2004). But even if we were bound by Freedman,
it does not support Sams’ position. In Freedman, the district
court refused to grant a defendant’s summary judgment
motion regarding good faith reliance. Id. at 650. The court
reasoned that a jury could find the defendant’s conduct
unreasonable where it produced the plaintiff’s records in
response to a search warrant that was not signed by a judge
and that had been only partially completed. Id.

    In contrast to Freedman, there is simply no reason to
suspect that Yahoo! acted in bad faith here, where the
subpoenas displayed no “indication of irregularity sufficient
to put [Yahoo!] on notice that the subpoena[s] w[ere] phony.”
McCready, 453 F.3d at 892.

                             B.

   Sams argues in the alternative that Yahoo! remains liable
because it failed to comply with the terms of the subpoenas
when it produced the requested documents before the
specified deadline. Essentially, Sams contends that Yahoo!
was obligated to send a corporate representative to Lowndes
County on January 28, 2009, to hand-deliver the requested
documents to the grand jury. We reject Sams’ contention.

    Sams cites no authority in support of her claim that a
person or entity responding to a subpoena may not provide
the demanded documents earlier than the time specified in the
subpoena in order to avoid legal sanction. This lack of
14                  SAMS V . YAHOO ! INC.

supporting precedent is unsurprising since Sams’ proposed
rule would defy common sense, and wreak havoc on courts
and litigants alike. The principle Sams would apparently
have us adopt would, among other things, outlaw the
negotiated resolution of discovery disputes, and related
cooperation among counsel to minimize inconvenience and
cost to the parties. The legal profession is often criticized for
its rancor and inefficiency, and we decline to adopt a rule that
would make the situation worse by discouraging common
sense cooperation among parties and counsel.

    Nor do we credit Sams’ final contention that Yahoo!’s
early production of documents constituted an unlawful
“voluntary” disclosure under the SCA. For while we
acknowledge that the letters accompanying the subpoenas
suggested that Yahoo! might “voluntarily provide copies of
the evidence,” in order to “expedite [its] appearance before
the Grand Jury, ” nothing in the record indicates that Yahoo!
did not feel itself legally bound to produce the subpoenaed
documents. Yahoo! did not produce documents to the
Lowndes County grand jury spontaneously or in response to
an informal request by an investigator—it did so only after
receiving apparently valid subpoenas from the District
Attorney’s Office. Yahoo!’s acquiescence “to a claim of
lawful authority” did not render its compliance “voluntary,”
regardless of the language employed by the District Attorney
in his cover letter. See Bumper v. North Carolina, 391 U.S.
543, 549 (1968) (holding that acquiescence to a claim of
lawful authority “cannot be consent”).

                       CONCLUSION

   The district court properly dismissed Sams’ SCA claims
because Yahoo! is statutorily immune from suit. Yahoo!’s
                   SAMS V . YAHOO ! INC.                 15

early compliance with the subpoenas did not vitiate Yahoo!’s
immunity.

   AFFIRMED.
