Court filing
Exhibit 1 — Brooks v. Thomson Reuters Corporation (Dkt. 199.1)
No. 3:21-cv-01418-EMC · Doc. 199-1 · Docket on CourtListener
Summary
Exhibit 1, filed April 12, 2023 as Document 199-1 in Brooks v. Thomson Reuters Corporation, No. 3:21-cv-01418-EMC, in the U.S. District Court for the Northern District of California. The 25-page exhibit is a copy of an order dated April 6, 2023 by Chief Judge Richard Seeborg granting in part and denying in part the motion to dismiss of Oracle America, Inc. in a putative privacy class action, Case No. 22-cv-04792-RS. The order dismisses without prejudice the UCL, ECPA and unjust enrichment claims and the intrusion upon seclusion claim for the Worldwide and United States sub-classes. The invasion of privacy, California sub-class intrusion upon seclusion, CIPA, declaratory judgment and equitable relief claims survive. The order denies the motion to strike, grants incorporation by reference only as to Exhibits J and H and gives the plaintiffs 30 days to amend.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
Full text
Case 3:21-cv-01418-EMC Document 199-1 Filed 04/12/23 Page 1 of 25
Exhibit 1
CaseCase
3:21-cv-01418-EMC
3:22-cv-04792-RS Document
Document 49
199-1Filed
Filed
04/06/23
04/12/23
Page 1
Pageof 24of 25
1
2
3
4
5
6
7 UNITED STATES DISTRICT COURT
8 NORTHERN DISTRICT OF CALIFORNIA
9
MICHAEL KATZ-LACABE, et al.,
10 Case No. 22-cv-04792-RS
Plaintiffs,
11
v. ORDER GRANTING IN PART AND
12 DENYING IN PART MOTION TO
United States District Court
ORACLE AMERICA, INC., DISMISS
13
Defendant.
14
15 I. INTRODUCTION
Northern District of California
16 Three individual plaintiffs bring this putative class action against Oracle America, Inc.
17 (“Defendant” or “Oracle”), alleging the company violates internet users’ right to privacy, as
18 provided under the California Constitution and various state and federal privacy statutes.
19 Defendant moves to dismiss under Federal Rules of Civil Procedure 12(b)(1) and 12(b)(6) for lack
20 of standing and failure to state a claim, as well as failure to comply with Federal Rule of Civil
21 Procedure 8. In addition, Oracle moves for an order striking portions of the Complaint pursuant to
22 Federal Rule of Civil Procedure 12(f), as well as for judicial notice of several documents in
23 support of its motion to dismiss. For the reasons that follow, the request for judicial notice is
24 granted in part and denied in part; the motion to dismiss is granted in part and denied in part; and
25 the motion to strike is denied.
26 II. BACKGROUND1
27
1
The factual background is based on the well-pled allegations in the complaint, which are taken as
28 true for the purposes of this motion.
CaseCase
3:21-cv-01418-EMC
3:22-cv-04792-RS Document
Document 49
199-1Filed
Filed
04/06/23
04/12/23
Page 2
Pageof 3
24of 25
1 Plaintiffs in this case are three named individuals—Michael Katz-Lacabe, a resident of San
2 Leandro, California; Dr. Jennifer Golbeck, a resident of Sugarloaf Key, Florida; and Dr. Johnny
3 Ryan, a resident of Dublin, Ireland—who purportedly represent five separate classes of individuals
4 in a suit against Oracle. Plaintiffs’ Complaint alleges that, “despite taking precautions to keep
5 [their] personal information” private, Plaintiffs received a document from Oracle indicating that
6 the company had tracked, compiled, and analyzed their web browsing and other activity, thereby
7 creating an “electronic profile” on them. Dkt. 1 at 2-4.
8 Plaintiffs take issue with Oracle’s extensive data brokering business—and in particular,
9 two key features of Defendant’s data management platform (BlueKai Data Management
10 Platform): (1) the Oracle Data Marketplace, allegedly one of the world’s largest commercial data
11 exchanges; and (2) the Oracle ID Graph, a product designed to “match[] individual customer
12 identities . . . and combin[e] them into a single consistent and accurate customer profile.” Dkt. 1 at
United States District Court
13 7. According to Plaintiffs, Defendant’s business model proceeds as follows: first, it collects as
14 many types of personal information from internet users as possible. Then Defendant synchronizes
15 that data to create individual profiles, and ultimately sells that data—bolstered by data made
Northern District of California
16 available by its partners—on its Data Marketplace.
17 A. Oracle’s Alleged Data Collection
18 As Plaintiffs explain, Defendant’s vast data accumulation is made possible by both
19 Defendant’s own technologies and the acquisition of data from other parties. In the former
20 category, Defendant employs seven technologies, including: (1) cookies (pieces of software code
21 stored on web browsers that collect users’ data, like IP addresses); (2) the javascript code “bk-
22 coretag.js” (proprietary code which copies and sends to Oracle what information users are
23 requesting from a website server, such as a URL, date and time of visit, and webpage keywords);
24 (3) tracking pixels (code embedded into webpages that track information whenever the webpage is
25 opened); (4) device identification; (5) cross-device tracking; (6) AddThis widgets; and (7)
26 Datalogix (an information broker specializing in profiles built from brick and mortar purchases).
27 Allegedly “ubiquitous throughout the Internet,” this data collection requires no relationship
28 ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
CASE NO. 22-cv-04792-RS
2
CaseCase
3:21-cv-01418-EMC
3:22-cv-04792-RS Document
Document 49
199-1Filed
Filed
04/06/23
04/12/23
Page 3
Pageof 4
24of 25
1 between the internet user and Oracle to occur. Given this lack of privity, users “may not know
2 Oracle is amassing data about them.” Dkt. 1 at 12.
3 Defendant next uses its Oracle ID Graph to aggregate and synchronize the collected data to
4 perform “identity resolution.” This process takes three steps: (1) filtering and combining data from
5 its various sources to identify and establish “a single, universal view of identity” for each user,
6 across devices and marketing channels; (2) applying analytics to that raw data to develop insights
7 about users and create segments along dimensions such as life events (e.g., marriage), education,
8 purchase history, or even health and wellness (e.g., weight, sleep habits, and categories like
9 “Aging & Geriatrics” and “Pain Relief”); and (3) matching data provided by customers to existing
10 profiles that Defendant has developed and maintains in its Oracle Data Cloud, which helps “knit
11 together” information from Defendant’s own data sources.
12 Finally, Plaintiffs allege that Defendant’s Data marketplace “is an online store owned and
United States District Court
13 operated by Oracle where Oracle facilitates the buying and selling of data and data-derived
14 services by Oracle” and its partners. Dkt. 1 at 26. This Marketplace trades in personal data Oracle
15 collects itself, personal data that private companies collect from their own users and sell directly to
Northern District of California
16 Oracle’s clients, and personal data that other third-party data brokers collect and sell to Oracle
17 clients on the Marketplace. Defendant partners with over sixty-five “major brokers of third party
18 data” in the Database, which allows it to profit from the sale of allegedly sensitive personal
19 information including race, location, politics, and medical information. Id. at 33. With all of the
20 available data, Defendant’s products allow its clients to “analyze, segment, and target” users based
21 on the information, including the categories of sensitive information outlined above.
22 B. Defendant’s Privacy Policies & Plaintiffs’ Lack of Consent
23 Plaintiffs further allege that neither Oracle’s privacy policies, nor the policies of internet
24 publishers, could provide any basis for Plaintiffs to have consented to the extensive data collection
25 and profiling scheme described. Oracle’s website leads to seven different privacy policies, which
26 Plaintiffs describe as “convoluted, opaque, and not reasonably comprehensible to the average
27 Internet user,” Dkt. 1 at 43, and which Plaintiffs attack as failing to disclose what Oracle does with
28 ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
CASE NO. 22-cv-04792-RS
3
CaseCase
3:21-cv-01418-EMC
3:22-cv-04792-RS Document
Document 49
199-1Filed
Filed
04/06/23
04/12/23
Page 4
Pageof 5
24of 25
1 internet users’ information in any meaningful way. By way of example, Plaintiffs point to the
2 Oracle Advertising Privacy Policy, which states that “Oracle does not create any online interest
3 segments that reflect personal information that is sensitive,” and includes in the category of
4 sensitive information “certain aspects linked to personal life, such as racial or ethnic, religious,
5 political, citizenship, immigration status, or sexual orientation.” Dkt. 1 at 44; Oracle Advertising
6 Privacy Policy, https://www.oracle.com/legal/privacy/advertising-privacy-policy.html. Plaintiffs
7 allege that Defendant’s practices are actually contrary to the reasonable reader’s inference, from
8 reading the policy, that Oracle would not facilitate the sale of their political views.
9 III. LEGAL STANDARD
10 Article III of the U.S. Constitution authorizes the judiciary to adjudicate only “cases” and
11 “controversies.” The doctrine of standing is “an essential and unchanging part of the case-or-
12 controversy requirement of Article III.” Lujan v. Defs. of Wildlife, 504 U.S. 555, 560 (1992).
United States District Court
13 Defendant moves to dismiss on the basis that Plaintiffs lack standing under Rule 12(b)(1) of the
14 Federal Rules of Civil Procedure. A 12(b)(1) motion to dismiss a complaint challenges the court’s
15 subject matter jurisdiction over the asserted claims. It is the plaintiff’s burden to prove jurisdiction
Northern District of California
16 at the time the action is commenced. Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016).
17 “A Rule 12(b)(1) jurisdictional attack may be facial or factual.” Safe Air for Everyone v.
18 Meyer, 373 F.3d 1035, 1039 (9th Cir. 2004). “In a facial attack, the challenger asserts that the
19 allegations contained in the complaint are insufficient on their face to invoke federal jurisdiction.”
20 Id. Accordingly, when considering this type of challenge, the court is required to “accept as true
21 the allegations of the complaint.” U.S. ex rel. Lujan v. Hughes Aircraft Co., 243 F.3d 1181, 1189
22 (9th Cir. 2001). However, “the district court is not restricted to the pleadings, but may review any
23 evidence, such as affidavits and testimony, to resolve factual disputes concerning the existence of
24 jurisdiction.” McCarthy v. United States, 850 F.2d 558, 560 (9th Cir. 1988).
25 Defendant also alleges that Plaintiffs fail to state a claim. A complaint must contain “a
26 short and plain statement of the claim showing that the pleader is entitled to relief.” Fed. R. Civ. P.
27 8(a)(2). While “detailed factual allegations” are not required, a complaint must have sufficient
28 ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
CASE NO. 22-cv-04792-RS
4
CaseCase
3:21-cv-01418-EMC
3:22-cv-04792-RS Document
Document 49
199-1Filed
Filed
04/06/23
04/12/23
Page 5
Pageof 6
24of 25
1 factual allegations to state a claim that is “plausible on its face.” Ashcroft v. Iqbal, 556 U.S. 662,
2 678 (2009) (citing Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555, 570 (2007)). A claim is facially
3 plausible “when the plaintiff pleads factual content that allows the court to draw the reasonable
4 inference that the defendant is liable for the misconduct alleged.” Id. (citing Twombly, 550 U.S. at
5 556). This standard asks for “more than a sheer possibility that a defendant has acted unlawfully.”
6 Id. The determination is a context-specific task requiring the court “to draw on its judicial
7 experience and common sense.” Id. at 679.
8 A Rule 12(b)(6) motion to dismiss tests the sufficiency of the claims alleged in the
9 complaint. Dismissal under Rule 12(b)(6) may be based on either the “lack of a cognizable legal
10 theory” or on “the absence of sufficient facts alleged under a cognizable legal theory.” See
11 Conservation Force v. Salazar, 646 F.3d 1240, 1242 (9th Cir. 2011) (internal quotation marks and
12 citation omitted). When evaluating such a motion, the court must accept all material allegations in
United States District Court
13 the complaint as true and construe them in the light most favorable to the non-moving party. In re
14 Quality Sys., Inc. Sec. Litig., 865 F.3d 1130, 1140 (9th Cir. 2017). It must also “draw all
15 reasonable inferences in favor of the nonmoving party.” Usher v. City of Los Angeles, 828 F.2d
Northern District of California
16 556, 561 (9th Cir. 1987).
17 IV. DISCUSSION
18 Plaintiffs claim to represent five different potential classes of plaintiffs: the Worldwide
19 Class,2 the United States Sub-Class,3 the California Sub-Class,4 the CIPA Sub-Class,5 and the
20
2
“All natural persons whose personal information, or data derived from their personal
21 information, was used to create a profile and made available for sale or use through Oracle’s ID
22 Graph or Data Marketplace.”
3
“All natural persons located in the United States whose personal information, or data derived
23 from their personal information, was used to create a profile and made available for sale or use
24 through Oracle’s ID Graph or Data Marketplace.”
4
“All natural persons located in California whose personal information, or data derived from their
25 personal information, was used to create a profile and made available for sale or use through
Oracle’s ID Graph or Data Marketplace.”
26
5
“All members of the California Sub-Class whose contents of their electronic communications
27 were intercepted by the use of Oracle’s bk-coretag.js functionality.”
28 ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
CASE NO. 22-cv-04792-RS
5
CaseCase
3:21-cv-01418-EMC
3:22-cv-04792-RS Document
Document 49
199-1Filed
Filed
04/06/23
04/12/23
Page 6
Pageof 7
24of 25
1 ECPA Sub-Class.6 On behalf of these classes, the Complaint alleges seven causes of action: (1)
2 Invasion of Privacy under the California Constitution (for the California Sub-Class); (2) Intrusion
3 Upon Seclusion under California Common Law (on behalf of all classes); (3) Violation of the
4 Unfair Competition Law under Cal. Bus. & Prof Code § 17200 et seq. (on behalf of all classes);
5 (4) Violation of the California Invasion of Privacy Act (on behalf of the CIPA Sub-Class); (5)
6 Violation of the Federal Wiretap Act, under 18 U.S.C. § 2510; (6) Unjust Enrichment (on behalf
7 of all classes); and (7) Declaratory Judgment and Injunctive Relief (on behalf of all classes).
8 Defendant moves to dismiss all of the claims under 12(b)(1) and 12(b)(6). In addition to its
9 substantive arguments, Defendant has also moved for certain paragraphs be stricken from the
10 Complaint, and requests judicial notice of several documents.
11 A. Judicial Notice
12 Defendant requests judicial notice of twelve different documents, arguing Plaintiffs either
United States District Court
13 refer to them extensively in the Complaint, or rely on them as a basis for their claims. Three of
14 these are customer-facing company policies and agreements (Exhibit B: Oracle Advertising’s
15 Online Data Agreement; Exhibit H: AddThis Privacy Policy; and Exhibit J: Oracle Advertising
Northern District of California
16 Privacy Policy); the rest are Oracle web pages or press releases hosted on Oracle’s own website.
17 There are two exceptions to the general rule that “district courts may not consider material
18 outside the pleadings when assessing the sufficiency of a complaint under Rule 12(b)(6)”: judicial
19 notice and incorporation by reference. Khoja v. Orexigen Therapeutics, Inc., 899 F.3d 988, 998
20 (9th Cir. 2018). Courts may take judicial notice of matters that are either (1) generally known
21 within the trial court’s territorial jurisdiction or (2) capable of accurate and ready determination by
22 resort to sources whose accuracy cannot reasonably be questioned. Fed. R. Evid. 201(b). As an
23 alternative, the “incorporation by reference” doctrine is “a judicially created doctrine that treats
24 certain documents as though they are part of the complaint itself,” in order to “prevent[] plaintiffs
25
26
6
“All members of the United States Sub-Class whose contents of their electronic communications
27 were intercepted by the use of Oracle’s bk-coretag.js functionality.”
28 ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
CASE NO. 22-cv-04792-RS
6
CaseCase
3:21-cv-01418-EMC
3:22-cv-04792-RS Document
Document 49
199-1Filed
Filed
04/06/23
04/12/23
Page 7
Pageof 8
24of 25
1 from selecting only portions of documents that support their claims, while omitting portions of
2 those very documents that weaken—or doom—their claims.” Khoja, 899 F.3d at 1002.
3 As Defendant correctly identifies, Plaintiffs make copious reference to Defendant’s
4 websites in the Complaint, and specifically hyperlink two of the requested documents (Exhibits J
5 and H) in a footnote. At the same time, there is reason to “be cautious before taking judicial notice
6 of documents . . . published on a website,” “particularly . . . when a party seeks to introduce
7 documents it created and posted on its own website,” as is the case here. Rollins v. Dignity Health,
8 338 F. Supp. 3d 1025, 1033 (N.D. Cal. 2018). Likewise, the Ninth Circuit has warned that
9 “incorporation by reference” is “improper” if used “to resolve factual disputes against the
10 plaintiff’s well-pled allegations in the complaint.” Khoja, 899 F.3d at 1014 (“The incorporation-
11 by-reference doctrine does not override the fundamental rule that courts must interpret the
12 allegations and factual disputes in favor of the plaintiff at the pleading stage.”). A document
United States District Court
13 should not be incorporated if the defendant seeks its incorporation “merely [to] create[] a defense
14 to the well-pled allegations in the complaint,” as “[o]therwise, defendants could use the doctrine to
15 insert their own version of events into the complaint to defeat otherwise cognizable claims.” Id. at
Northern District of California
16 1002.
17 Though Plaintiffs notably do not dispute the authenticity of the documents, judicially
18 noticing all of the information contained on Oracle’s own webpages is improper and unnecessary,
19 as it would serve no purpose other than exactly what the Ninth Circuit warned against: crafting an
20 alternative version of events. For the same reasons, Defendant’s request to incorporate the
21 documents by reference is denied, except as to Exhibits J and H, which are clearly referenced in
22 Plaintiffs’ allegations both by name and by link.7
23
24
25 7
Although Exhibit B is generally referenced in the Complaint, see, e.g., Dkt. 1 ¶ 38 (“Oracle has
26 agreements with numerous high-traffic websites like the New York Times, ESPN, and Amazon to
place cookies and/or pixels on their websites.”), it is not used by Plaintiffs to the same degree as
27 Exhibits J and H. As a result, it is inappropriate to find the document incorporated by reference.
28 ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
CASE NO. 22-cv-04792-RS
7
CaseCase
3:21-cv-01418-EMC
3:22-cv-04792-RS Document
Document 49
199-1Filed
Filed
04/06/23
04/12/23
Page 8
Pageof 9
24of 25
1 B. Article III Standing (All Causes of Action)
2 Defendant first argues that the case must be dismissed, because Plaintiffs have failed to
3 allege two of the three elements that make up the “irreducible constitutional minimum” of Article
4 III standing under Lujan: (1) a concrete and particularized injury, that (2) is fairly traceable to
5 Defendant’s conduct. 504 U.S. at 560.
6 “‘[A]n injury in fact’ is ‘an invasion of a legally protected interest’ that is ‘concrete and
7 particularized’ and ‘actual or imminent, not conjectural or hypothetical.’” Novak v. United States,
8 795 F.3d 1012, 1018 (9th Cir. 2015) (quoting Lujan, 504 U.S. at 560) (alternation in original).
9 Causation, the second element, requires a “causal connection between the injury and the conduct
10 complained of.” Novak, 795 F.3d at 1018 (9th Cir. 2015) (citing Lujan, 504 U.S. at 560). This
11 element is concerned with ensuring that the injury is “fairly . . . trace[able] to the challenged action
12 of the defendant, and not . . . th[e] result [of] the independent action of some third party not before
United States District Court
13 the court.” Lujan, 504 U.S. at 560 (citing Simon v. Eastern Ky. Welfare Rts. Org., 426 U.S. 26,
14 41–42 (1976)) (alternations in original).
15 While Plaintiffs’ Complaint extensively quotes news articles and other outside sources
Northern District of California
16 painting a dramatic picture of Defendant’s data brokerage business, it contains scarce specific
17 allegations regarding the named Plaintiffs. In its claim that the Plaintiffs have not sufficiently
18 pointed to a concrete and particularized harm, Defendant specifically argues that Plaintiffs have
19 not alleged the profiles “were actually sold or made available for sale by Oracle to anyone,” Dkt.
20 23 at 6. Defendant further argues that any harm is not fairly traceable to Oracle, because Plaintiffs
21 fail to allege that “Oracle tracked, profiled, or sold any of Plaintiffs’ personal information,” Dkt.
22 23 at 8, and because there are “numerous third parties that made independent decisions leading to
23 the alleged harm,” which breaks the causal link. Dkt. 23 at 9.
24 Although the Complaint would indeed be much better served by the inclusion of more
25 allegations specifically tying their general allegations of the “financial, dignitary, reputational, and
26 relational harms [Defendant] has caused” to the named Plaintiffs, the Complaint is not so devoid
27 of allegations that Plaintiffs’ suit must be dismissed. Plaintiffs allege that Katz-Lacabe “received a
28 ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
CASE NO. 22-cv-04792-RS
8
CaseCase
3:21-cv-01418-EMC
3:22-cv-04792-RSDocument
Document199-1
49 Filed
Filed
04/06/23
04/12/23Page
Page
9 of10
24of 25
1 document from Oracle indicating Oracle had tracked, compiled, and analyzed his web browsing
2 and other activity and thereby created an electronic profile on him,” and that “Oracle continues to
3 track [his] internet and offline activity, enrich the profile of him as described below, and make his
4 personal information available to third parties without his consent.” Dkt. 1 at 2. The Complaint
5 provides similar but varied allegations for Plaintiffs Golbeck and Ryan, adding for the former that
6 she “discovered Oracle tracking devices on multiple of her computers that she regularly uses for
7 internet browsing and other activities,” Dkt. 1 at 3, and asserting the allegations for Plaintiff Ryan
8 on information and belief. As to all Plaintiffs, the Complaint’s use of “as described below”—when
9 construed in the light most favorable to them—references Defendant’s data collection methods
10 and attendant dangers generally described in the body of the Complaint, such as Oracle’s ability to
11 amass “vast amounts of personal data” for the purpose of “identify[ing] individuals and
12 aggregat[ing] their many identifiers,” Dkt. 1 at 7, the result of which is the creation of a “cradle-to-
United States District Court
13 grave” profile[] of Class members.” Dkt. 1 at 50. Such profiles are effectively dossiers which “can
14 be used to further invade Plaintiffs’ privacy” by “allowing third parties to learn intimate details of
15 [Plaintiffs’] lives, and target them for advertising, political, and other purposes,” ultimately
Northern District of California
16 “harming them through the abrogation of their autonomy and their ability to control dissemination
17 and use of information about them.” Dkt. 1 at 52. Altogether, these allegations are in line with
18 those found in other cases in the Circuit and sufficiently allege harm to the Plaintiffs for Article III
19 standing. See, e.g, In re Facebook, Inc. Internet Tracking Litig. (“Facebook Tracking”), 956 F.3d
20 589, 601 (9th Cir. 2020).
21 Defendant’s other arguments about Plaintiffs’ allegedly inadequate pleading of harm—
22 including its attempts to distinguish relevant cases—are similarly unpersuasive. As the Ninth
23 Circuit has recognized, invasion of privacy can be a harm in and of itself, see Eichenberger v.
24 ESPN, Inc., 876 F.3d 979, 983 (9th Cir. 2017). Plaintiffs’ case is not merely about a risk or
25 inference of future harm. The letters that Plaintiffs received from Oracle indicate that Plaintiffs’
26 data had been collected. The other inferences that Plaintiffs seek—including the harm that results
27 from such data collection—are not altogether unreasonable, and must be accepted for the purposes
28 ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
CASE NO. 22-cv-04792-RS
9
CaseCase
3:21-cv-01418-EMC
3:22-cv-04792-RS Document
Document 49
199-1Filed
Filed
04/06/23
04/12/23
PagePage
10 of11
24of 25
1 of the motion. Plaintiffs are not yet required to make specific allegations as to what particular
2 information was purportedly sold. See Maya v. Centex Corp., 658 F.3d 1060, 1068 (9th Cir. 2011)
3 (“At the pleading stage, general factual allegations of injury resulting from the defendant’s
4 conduct may suffice, for on a motion to dismiss we ‘presum[e] that general allegations embrace
5 those specific facts that are necessary to support the claim.’”) (quoting Lujan, 504 U.S at 561).
6 Defendant’s argument that the string of causation is broken because of “numerous third
7 parties” who made “independent decisions” misapprehends the law—a conclusion apparent from
8 the cases to which it attempts to appeal. As the Ninth Circuit explains in Maya: “[t]o survive a
9 motion to dismiss for lack of constitutional standing,” plaintiffs are not required to show that the
10 defendant’s actions are the “‘proximate cause’ of plaintiffs’ injuries”; instead, “plaintiffs must
11 establish a ‘line of causation’ between defendants’ action and their alleged harm that is more than
12 ‘attenuated.’” 658 F.3d at 1070 (citing Allen v. Wright, 468 U.S. 737, 757 (1984)). In fact, Maya
United States District Court
13 counsels that “[a] causation chain does not fail simply because it has several ‘links,’ provided
14 those links are ‘not hypothetical or tenuous’ and remain ‘plausib[le].’” Id. (citations omitted).
15 Here, Plaintiffs allege that Oracle’s products, implemented by numerous websites, lead to the
Northern District of California
16 collection of vast amounts of data which, when “synchronized” altogether, lead to personal
17 identification and purported invasions of privacy. That is, in fact, the very outcome that Oracle
18 wishes—and markets to its customers. Plaintiffs’ allegations simply do not hinge on hypothetical
19 or tenuous links of causation the way that allegations of predatory lending to high-risk mortgagees
20 necessarily result in decreased home values, Maya, 658 F. 3d at 1072, or that federal tax
21 exemptions to racially discriminatory private schools impair school desegregation. Wright, 468
22 U.S. at 758-59 (“The chain of causation is even weaker in this case. It involves numerous third
23 parties (officials of racially discriminatory schools receiving tax exemptions and the parents of
24 children attending such schools) who may not even exist in respondents’ communities and whose
25 independent decisions may not collectively have a significant effect on the ability of public school
26 students to receive a desegregated education.”). Plaintiffs thus have alleged harm that fairly could
27 be ascribed to Defendant, and they have Article III standing to maintain the present action.
28 ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
CASE NO. 22-cv-04792-RS
10
CaseCase
3:21-cv-01418-EMC
3:22-cv-04792-RS Document
Document 49
199-1Filed
Filed
04/06/23
04/12/23
PagePage
11 of124of 25
1 C. First & Second Causes of Action: Invasion of Privacy (California Constitution) &
2 Intrusion Upon Seclusion
3 The tests for an invasion of privacy under the California Constitution and intrusion upon
4 seclusion under California common law “involve[] similar elements”—as a result, “courts
5 consider the claims together” with one test, “and ask whether: (1) there exists a reasonable
6 expectation of privacy, and (2) the intrusion was highly offensive.” Facebook Tracking, 956 F.3d
7 at 601 (citing Hernandez v. Hillsides, Inc., 47 Cal. 4th 272, 287 (2009)).
8 A reasonable expectation of privacy can exist where a defendant gains “unwanted access to
9 data by electronic or other covert means, in violation of the law or social norms.” Facebook
10 Tracking, 956 F.3d at 601-02 (quoting Hernandez, 47 Cal 4th at 286). This determination entails a
11 consideration of the customs, practices, and circumstances surrounding the data collection, such as
12 “the amount of data collected, the sensitivity of data collected, the manner of data collection, and
United States District Court
the defendant’s representations to its customers.” Hammerling v. Google LLC, No. 21-cv-09004-
13
CRB, 2022 WL 2812188, at *10 (N.D. Cal. July 18, 2022) (citations omitted).
14
Evaluating whether Defendant’s actions were “highly offensive” necessitates a “holistic
15
consideration of factors such as the likelihood of serious harm to the victim, the degree and setting
Northern District of California
16
of the intrusion, the intruder’s motives and objectives, and whether countervailing interests or
17
social norms render the intrusion inoffensive.” Facebook Tracking, 956 F.3d at 606 (quoting
18
Hernandez, 47 Cal 4th at 287). This inquiry also “focuses on the degree to which the intrusion is
19
unacceptable as a matter of public policy.” Id.
20
Defendant invokes Low v. LinkedIn Corp., 900 F. Supp. 2d 1010 (N.D. Cal. 2012) and
21
cases cited therein to argue that California’s constitution and common law “set a high bar for an
22
invasion of privacy claim,” id. at 1025, and to explain that even disclosure of social security
23
numbers would not constitute an “egregious breach of social norms.” Id. (citing cases). As the data
24
allegedly collected was not sensitive in nature, and the company’s data collection practices were
25
publicly disclosed, Defendant argues, Plaintiffs could not have had a reasonable expectation of
26
privacy, and Defendant’s conduct was neither highly offensive nor egregious.
27
28 ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
CASE NO. 22-cv-04792-RS
11
CaseCase
3:21-cv-01418-EMC
3:22-cv-04792-RS Document
Document 49
199-1Filed
Filed
04/06/23
04/12/23
PagePage
12 of13
24of 25
1 Plaintiffs’ strongest argument lies in its allegation that Oracle’s accumulation of a “vast
2 repository of personal data,” Dkt. 30 at 11—from compiling Plaintiffs’ browsing activity, online
3 communications, and offline activity—is what contravenes the reasonable expectation of privacy.
4 This is in line with the analysis provided in Facebook Tracking. Explaining that technological
5 advances, such as the “use of cookies to track and compile internet browsing histories,” enable
“access to a category of information otherwise unknowable and implicate privacy concerns,”
6
Facebook Tracking, 956 F.3d at 603, the Ninth Circuit found a reasonable expectation of privacy
7
from “allegations that Facebook allegedly compiled highly personalized profiles from sensitive
8
browsing histories and habits.” Id. at 604; see also Hammerling, 2022 WL 2812188, at *11
9
(finding a reasonable expectation of privacy where Google collected a “large amount of personal
10
information from users’ smartphones”).
11
Indeed, in differentiating Facebook Tracking from the analysis in United States v.
12
United States District Court
Forrester, 512 F.3d 500, 510 n.6 (9th Cir. 2008) (where the Ninth Circuit expressed, in a footnote,
13
that URLs might be constitutionally problematic due to the information it reveals about people’s
14
internet activity) and In re Zynga Priv. Litig., 750 F.3d 1098, 1108-09 (9th Cir. 2014) (where the
15
Ninth Circuit declined to find a reasonable expectation of privacy in referral headers containing
Northern District of California
16
URLs), the Ninth Circuit explained that in Facebook Tracking, the search terms and URLs at issue
17 “could divulge a user’s personal interests, queries, and habits on third-party websites operating
18 outside of Facebook’s platform.” Facebook Tracking, 956 F.3d at 605.
19 Here, Plaintiffs allegations extend to “sensitive health and personal safety information,”
20 Dkt. 1 at 14-15, 27 (“Oracle’s Health and Wellness segments reveal sensitive, health-related types
21 of personal information Oracle collects on Class members.”), and race and politics, see Dkt. 1 at
22 31-32, 44. While these are alleged generally and it is a close question as to whether Oracle
23 plausibly did collect and aggregate information to reveal such insights, viewing the allegations in
24 the light most favorable to Plaintiffs, such allegations of data collection would go well beyond the
25 “routine commercial behavior” of collecting contact information for sending advertisements. Dkt.
26 23 at 17 (citing Folgelstrom v. Lamps Plus, Inc., 195 Cal. App. 4th 986, 992 (2011)).
27 Finally, determinations of the egregiousness of the privacy intrusion are not usually
28 ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
CASE NO. 22-cv-04792-RS
12
CaseCase
3:21-cv-01418-EMC
3:22-cv-04792-RS Document
Document 49
199-1Filed
Filed
04/06/23
04/12/23
PagePage
13 of14
24of 25
1 resolved at the pleading stage. See Facebook Tracking, 956 F.3d at 606 (“The ultimate question of
2 whether Facebook’s tracking and collection practices could highly offend a reasonable individual
3 is an issue that cannot be resolved at the pleading stage.”); In re Facebook, Inc., Consumer Priv.
4 User Profile Litig. (“Facebook Consumer Privacy”), 402 F. Supp. 3d 767, 797 (N.D. Cal. 2019)
5 (“Under California law, courts must be reluctant to reach a conclusion at the pleading stage about
6 how offensive or serious the privacy intrusion is.”). Accordingly, Plaintiffs have alleged enough in
7 the Complaint for these claims to withstand dismissal.
8 D. Third Cause of Action: UCL
9 The UCL provides a cause of action to challenge any “unlawful, unfair or fraudulent
10 business act or practice.” Cal. Bus. & Prof. Code § 17200. While Plaintiffs allege that Defendant
11 violated the first two (the unfair and unlawful prongs), both of these claims fail for lack of
12 standing.
United States District Court
13 Over and above the demands of Article III, the UCL limits standing to those who have
“suffered injury in fact and ha[ve] lost money or property as a result of . . . unfair competition.”
14
Cal. Bus. & Prof. Code § 17204. Thus, “[t]o satisfy the narrower standing requirements imposed
15
by [§ 17204], a party must . . . (1) establish a loss or deprivation of money or property sufficient to
Northern District of California
16
qualify as injury in fact . . . and (2) show that the economic injury was the result of, i.e., caused by,
17
the unfair business practice . . . that is the gravamen of the claim.” Kwikset Corp. v. Superior Ct.,
18
51 Cal. 4th 310, 322 (2011) (emphasis in original).
19
Here, Plaintiffs fail to show they have an economic injury. Plaintiffs do identify some
20
support for the idea that personal information without consent constitutes economic injury. See
21
Calhoun v. Google LLC, 526 F. Supp. 3d 605, 636 (N.D. Cal. 2021) (“[T]he Ninth Circuit and a
22
number of district courts, including this Court, have concluded that plaintiffs who suffered a loss
23
of their personal information suffered economic injury and had standing.”) (citing cases, including
24
In re Facebook Privacy Litig. (“Facebook Privacy”), 572 F. App’x 494, 494 (9th Cir. 2014); and
25 In re Yahoo! Inc. Cust. Data Sec. Breach Litig., No. 16-MD-02752-LHK, 2017 WL 3727318, at
26 *13 (N.D. Cal. Aug. 30, 2017)). The weight of the authority in the district and the state, however,
27 point in the opposite direction: that “the ‘mere misappropriation of personal information’ does not
28 ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
CASE NO. 22-cv-04792-RS
13
CaseCase
3:21-cv-01418-EMC
3:22-cv-04792-RS Document
Document 49
199-1Filed
Filed
04/06/23
04/12/23
PagePage
14 of15
24of 25
1 establish compensable damages.” Pruchnicki v. Envision Healthcare Corp., 845 F. App’x 613,
2 615 (9th Cir. 2021); see also Moore v. Centrelake Med. Grp., Inc., 83 Cal. App. 5th 515, 540-41
3 & n.13 (2022) (noting that “[t]he scant California authority cited by Facebook Privacy did not
4 address the value of PII, much less any deprivation thereof” and finding Facebook Privacy and
5 district court cases following Facebook Privacy “unpersuasive.”); Facebook Consumer Privacy,
402 F. Supp. 3d at 804 (distinguishing a company’s gain of money through sharing or use of
6
Plaintiffs’ information from a claim that Plaintiffs actually lost money and dismissing Plaintiffs’
7
theory of economic loss as “purely hypothetical”); Gonzales v. Uber Techs., Inc., 305 F. Supp. 3d
8
1078, 1093 (N.D. Cal. 2018) (“However, the sharing of names, user IDs, location and other
9
personal information does not constitute lost money or property for UCL standing purposes.”)
10
(citing Campbell v. Facebook, 77 F. Supp. 3d 836, 849 (N.D. Cal. 2014); Svenson v. Google Inc.,
11
65 F. Supp. 3d 717, 730 (N.D. Cal. 2014) (finding that Plaintiff could not proceed with UCL claim
12
United States District Court
because she had “not alleged any facts showing that Defendants’ business practice—disclosing
13
users’ Contact Information to third-party App vendors—changed her economic position at all”)).
14
Because Plaintiffs have not alleged a specific monetary or economic loss, Plaintiffs lack standing
15
to maintain their UCL claims.
Northern District of California
16
E. Fourth and Fifth Causes of Action: CIPA & ECPA (Federal Wiretap Act)
17
Defendant raises three defenses to Plaintiffs’ wiretapping claims: (1) Defendant is exempt
18
from liability as a party to Plaintiffs’ alleged communications; (2) Plaintiffs fail to plead the
19
interception of “contents” as defined under the relevant statutes; and (3) Oracle’s customers’
20
consent satisfies one-party consent under the ECPA.
21
With respect to the first argument, Plaintiffs are correct that the weight of the authority in
22
this Circuit teaches that Defendant is not a party to Plaintiffs’ alleged communications. Defendant
23
invokes Graham v. Noom, Inc., 533 F. Supp. 3d 823 (N.D. Cal. 2021) to argue that it is simply “an
24
extension” of the website operators, rather than an outsider. Yet such application ignores the
25
analysis provided in Noom itself, which explains that the third-party “is a vendor that provides a
26
software service that captures its clients’ data, hosts it on [its own] servers, and allows the clients
27
28 ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
CASE NO. 22-cv-04792-RS
14
CaseCase
3:21-cv-01418-EMC
3:22-cv-04792-RS Document
Document 49
199-1Filed
Filed
04/06/23
04/12/23
PagePage
15 of16
24of 25
1 to analyze their data.” Id. at 832. Importantly, there were “no allegations . . . that [the vendor]
2 intercepted and used the data itself,” which rendered it altogether different from companies which
3 “mined information from other websites and sold it.” Id. In this analysis, Noom specifically
4 distinguished Facebook Tracking—where “Facebook tracked its users to third-party websites
5 (through Facebook’s code on the websites) . . . and then it sold that data to advertisers,” Noom,
6 533 F. Supp. 3d at 832—and Revitch v. New Moosejaw, LLC, 2019 WL 5485330 (N.D. Cal. Oct.
7 23, 2019)—where “NaviStone was a marketing company that partnered with e-commerce sites to
8 intercept visitor data and create marketing databases of consumer information.” Noom, 533 F.
9 Supp. 3d at 832. The situation at bar is far more analogous to those at issue in Facebook Tracking
10 and Revitch8—and as such, Defendant is not a party to the communications.
11 With respect to Defendant’s second argument, the definition of “contents” is similar under
12 both the CIPA and the ECPA. In re Google RTB Consumer Priv. Litig., 21-cv-2155-YGR, 2022
United States District Court
13 WL 2165489, at *11 (N.D. Cal. June 13, 2022) (citing Brodsky v. Apple Inc., 445 F. Supp. 3d 110,
14 127 (N.D. Cal. 2020)). The Ninth Circuit has held that, under the ECPA, “‘contents’ refers to the
15 intended message conveyed by the communication, and does not include record information
Northern District of California
16 regarding the characteristics of the message that is generated in the course of the communication.”
17 Zynga, 750 F.3d at 1106. Of the nine types of information that Plaintiffs allege was captured by
18 Defendant’s bk-coretag.js code, then, only two are mainly at issue9: (1) referrer URLs; and (2)
19 data entered into forms. Though Plaintiffs suggest that URLs “can also constitute contents of
20 communications,” Dkt. 30 at 18, Defendant argues that Plaintiffs fail to identify whether the URLs
21 at issue here include elements that would render their collection problematic, such as search terms
22
23 8
Defendant attempts to distinguish those cases, but as Plaintiffs have alleged that Oracle combines
24 and sells information in its Data Marketplace, it appears that Defendant’s products cannot be
properly analogized to the tools in Noom.
25 9
Defendant is correct that the other seven pieces of information, which include webpage titles,
webpage keywords, the date and times of website visits, IP addresses, page visits, purchase intent
26 signals, and add-to-cart actions, are conceded to be record information that does not constitute
“content” under the ECPA. See Zynga, 750 F.3d at 1106 (“[R]ecord information . . . includes the
27 ‘name,’ ‘address,’ and ‘subscriber number or identity’ of a subscriber or customer.”).
28 ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
CASE NO. 22-cv-04792-RS
15
CaseCase
3:21-cv-01418-EMC
3:22-cv-04792-RS Document
Document 49
199-1Filed
Filed
04/06/23
04/12/23
PagePage
16 of17
24of 25
1 which would reveal the content a user searched for, see Zynga, 750 F.3d at 1108, or full-string
2 detailed URLs that might contain folder and file names. Facebook Tracking, 956 F.3d at 605.
3 While Plaintiffs’ lack of specificity makes this a close call, the allegation about the data entered
4 into forms resolves the question in their favor. Though Defendant correctly notes the absence of a
5 blanket rule that all entries in a web form are content, its suggestion that In re Pharmatrak, Inc.,
6 329 F.3d 9 (1st Cir. 2003) only found disclosure of contents because Plaintiffs entered personal
7 medical information into a web form reads the decision too narrowly. Instead, the First Circuit
8 explained that the definition of contents “encompasses personally identifiable information such as
9 a party’s name, date of birth, and medical condition.” Id. at 18. For both of these pieces of
10 information, when the allegations are construed in the light most favorable to Plaintiffs, they have
11 pled just barely enough to withstand dismissal at this juncture.
12 Finally, Defendant is correct that the federal Wiretap Act is a one-party consent statute,
United States District Court
13 pursuant to 18 U.S.C. § 2511(2)(d). As Defendant’s customers must have chosen to deploy
14 Oracle’s tools on their websites, it necessarily follows that “one of the parties to the
15 communication”—the websites themselves—gave “prior consent to such interception.” Id; see
Northern District of California
16 also Rodriguez v. Google LLC, No. 20-cv-04688-RS, 2021 WL 2026726, at *6 (N.D. Cal. May
17 21, 2021); In re Yahoo Mail Litig., 7 F. Supp. 3d 1016, 1026 (N.D. Cal. 2014) (“[T]he consent of
18 one party is a complete defense to a Wiretap Act claim.”). Plaintiffs’ attempt to invoke the crime-
19 tort exception, requiring them to plead sufficient facts to show that “the primary motivation or a
20 determining factor in the interceptor’s actions has been to injure plaintiffs tortiously,” does not
21 apply to a case such as this, where Defendant’s “purpose has plainly not been to perpetuate torts
22 on millions of Internet users, but to make money.” Rodriguez, 2021 WL 2026726 at *6 n.8 (citing
23 In re Google Inc. Gmail Litigation, No. 13-MD-02430-LHK, 2014 WL 1102660, at *18 n.13
24 (N.D. Cal. Mar. 18, 2014). As a result, Plaintiffs’ Wiretap Act claim must be dismissed on this
25 basis while their CIPA claim survives.
26 F. Sixth Cause of Action: Unjust Enrichment
27 Defendant next seeks to dismiss Plaintiffs’ unjust enrichment claim, explaining that no
28 ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
CASE NO. 22-cv-04792-RS
16
CaseCase
3:21-cv-01418-EMC
3:22-cv-04792-RS Document
Document 49
199-1Filed
Filed
04/06/23
04/12/23
PagePage
17 of18
24of 25
1 such standalone cause of action exists in California law and that Plaintiffs have failed to allege
2 mistake, fraud or coercion, or that a benefit was conferred on Oracle that would be unjust for it to
3 retain.
4 Though “in California, there is not a standalone cause of action for ‘unjust enrichment,’”
5 Astiana v. Hain Celestial Grp., Inc., 783 F.3d 753, 762 (9th Cir. 2015), “[w]hen a plaintiff alleges
6 unjust enrichment, a court may ‘construe the cause of action as a quasi-contract claim seeking
7 restitution.’” Id. (quoting Rutherford Holdings, LLC v. Plaza Del Rey, 223 Cal. App. 4th 221, 231
8 (2014)). “To allege unjust enrichment as an independent cause of action, a plaintiff must show that
9 the defendant received and unjustly retained a benefit at the plaintiff’s expense.” ESG Cap.
10 Partners, LP v. Stratos, 828 F.3d 1023, 1038 (9th Cir. 2016).10
11 Plaintiffs do not demonstrate that Defendant has unjustly retained a benefit at Plaintiffs’
12 expense. While they argue “a right to disgorgement of profits resulting from unjust enrichment,”
United States District Court
13 Plaintiffs’ appeal to Facebook Tracking misses the opinion’s full context: “California law requires
14 disgorgement of unjustly earned profits regardless of whether a defendant's actions caused a
15 plaintiff to directly expend his or her own financial resources or whether a defendant’s actions
Northern District of California
16 directly caused the plaintiff’s property to become less valuable.” Facebook Tracking, 956 F.3d at
17 600. Here, Plaintiffs and putative class members have neither directly expended their own
18 resources, nor shown that their property has become less valuable. Unlike the Plaintiffs in Hart v.
19 TWC Prod. & Tech. LLC, 526 F. Supp. 3d 592 (N.D. Cal. 2021), Plaintiffs here were at no time in
20 direct privity with Oracle. As a result, Defendant did not collect information from Plaintiffs in a
21 manner contrary to expectations created by the consent process. See id. at 597 (noting users’
22
10
Plaintiffs are mistaken that Astiana, which continues to be applied in this Circuit, is no longer
23 good law. See, e.g., Hillori Graham v. Central Garden & Pet Co., No. 22-CV-06507-JSC, 2023
WL 2744391, at *3 n.2 (N.D. Cal. Mar. 30, 2023); Day v. Advanced Micro Devices, Inc., No. 22-
24 CV-04305-VC, 2023 WL 2347421, at *1 n.1 (N.D. Cal. Mar. 2, 2023). Moreover, “[t]he argument
that California law does not recognize a cause of action for unjust enrichment is for all intents and
25 purposes a nonstarter,” as “California law recognizes, at a minimum, a quasi-contract claim based
on an unjust-enrichment theory.” Day, 2023 WL 2347421 at *1 n.1 (citing both Astiana, 783 F.3d
26 at 762 and ESG Cap. Partners, 828 F.3d at 1038). Litigants’ appeal to semantics is therefore
resisted, and the unjust enrichment claim will be construed in accordance with the direction from
27 the Ninth Circuit, as conveyed in Astiana and ESG Capital Partners.
28 ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
CASE NO. 22-cv-04792-RS
17
CaseCase
3:21-cv-01418-EMC
3:22-cv-04792-RS Document
Document 49
199-1Filed
Filed
04/06/23
04/12/23
PagePage
18 of19
24of 25
1 information was tracked even when the application was not open, and that “[n]owhere in the
2 consent process was the user confronted with the information that their minute-by-minute
3 geolocation data [would] be broadly disseminated by [Defendant] and that [Defendant] would
4 make millions disseminating users' geolocation data”).11 Without more, Plaintiffs have not stated a
5 claim for unjust enrichment.
6 G. Choice of Law
7 Defendant takes issue with Plaintiffs’ assertion of California state claims on behalf of non-
8 California residents—both named Plaintiffs Golbeck and Ryan (residents of Florida and Ireland,
9 respectively), as well as the classes that include non-residents (e.g., the nationwide and worldwide
10 classes)—and seek dismissal of those claims on this basis. As this order dismisses the UCL, ECPA
11 and unjust enrichment claims, the only remaining claim at issue is Plaintiffs’ intrusion upon
12 seclusion claim alleged under California common law.
United States District Court
13 Both parties are in agreement that “[a] federal court sitting in diversity must look to the
14 forum state's choice of law rules,” thus requiring the court to apply California’s “governmental
15 interest approach” to determine questions of choice of law. Zinser v. Accufix Rsch. Inst., Inc., 253
Northern District of California
16 F.3d 1180, 1187 (9th Cir. 2001). This is a three-step process. The first task is to determine whether
17 the laws of the affected jurisdictions are “the same or different.” Mazza v. American Honda Motor
18 Co., Inc., 666 F.3d 581, 590 (9th Cir. 2012) (quoting McCann v. Foster Wheeler LLC, 48 Cal. 4th
19 68, 81-82 (2010)). If the laws are different, the second step requires an examination of “each
20 jurisdiction’s interest in the application of its own law” to determine whether a true conflict
21 exists. Id. If it does, then the final step involves analyzing “which state’s interest would be more
22 impaired if its policy were subordinated to the policy of the other state.” Id.
23 Applying this analysis, Defendant explains that significant differences exist between
24 California’s law that of Florida and the GDPR that render it inappropriate to apply California law
25
11
To the extent Defendant has data, moreover, it was received and/or collected with permission
26 from the third-party websites. If Plaintiffs challenge unjust enrichment based on the monetization
of that data, they must explain why the access they received to those websites would not defeat the
27 unjust enrichment claim.
28 ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
CASE NO. 22-cv-04792-RS
18
CaseCase
3:21-cv-01418-EMC
3:22-cv-04792-RS Document
Document 49
199-1Filed
Filed
04/06/23
04/12/23
PagePage
19 of20
24of 25
1 to the latter two. In response, Plaintiffs contend that Defendant’s choice of law analysis is too
2 sparse to fulfill its burden of displacing California law, and, in the alternative, that such analysis is
3 premature at the pleadings stage.
4 Plaintiffs are correct that district courts in this Circuit have often deferred choice-of-law
5 issues until the class certification stage. See, e.g., Wallace v. SharkNinja Operating, LLC, No. 18-
6 cv-05221-BLF, 2020 WL 1139649, at *15 (N.D. Cal. Mar. 9, 2020). However, “whether a choice-
7 of-law analysis can be properly conducted at the motion to dismiss stage depends on the individual
8 case.” Bartel v. Tokyo Elec. Power Co., Inc., 371 F. Supp. 3d 769, 790 (S.D. Cal. 2019). “To
9 determine whether the choice-of-law analysis should occur on the pleadings or at class
10 certification, courts generally look to whether discovery would be a meaningful aid to that
11 inquiry.” Anderson v. Apple Inc., 500 F. Supp. 3d 993, 1010 (N.D. Cal. 2020) (collecting cases).
12 When it is unlikely that further fact development would materially impact the choice of law
United States District Court
13 determination, that determination need not be deferred. Frenzel v. AliphCom, 76 F. Supp. 3d 999,
14 1007–08 (N.D. Cal. 2014) (dismissing individual and class claims at the motion to dismiss stage
15 where named plaintiff was “a nonresident who did not purchase the defendant’s product in
Northern District of California
16 California”).
17 That is the case here. With respect to Florida, Defendant notes it specifically requires a
18 plaintiff to show an intrusion into a private quarter. Hammer v. Sorensen, 824 F. App’x 689, 695
19 (11th Cir. 2020) (plaintiffs are required “to show an intrusion into a private place and not merely a
20 private activity”) (citing Allstate Ins. Co. v. Ginsberg, 863 So. 2d 156, 161 n.3, 162 (Fla. 2003)).
21 Plaintiffs insist Defendant’s analysis is not “rigorous,” in that it only identifies “superficial
differences in . . . language,” which are minimal, as both Florida and California rely on the
22
Restatement of Torts (Second) to define intrusion upon seclusion. Dkt. 30 at 8. These general
23
arguments are not themselves an answer, however, to the differences that Defendant has raised.
24
The requirement of a private quarter is an element of the claim in Florida that is not an explicit
25
requirement in California. As California requires a plaintiff to show only that there exists a
26
reasonable expectation of privacy, and that whatever intrusion on plaintiff’s privacy was “highly
27
28 ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
CASE NO. 22-cv-04792-RS
19
CaseCase
3:21-cv-01418-EMC
3:22-cv-04792-RS Document
Document 49
199-1Filed
Filed
04/06/23
04/12/23
PagePage
20 of21
24of 25
1 offensive,” Facebook Tracking, 956 F.3d at 601, which in turn necessitates consideration of legal
2 and social norms and circumstances surrounding the data collection and intrusion, there is indeed a
3 possibility that a successful claim under California law would fail to be meritorious under the law
4 of Florida. Indeed, such a conclusion, particularly for cases like the one at bar, is bolstered by
5 Defendant’s explanation that “Florida’s laws have not stretched to reach” claims premised on the
collection of online data, Dkt. 35 at 5, as well as Florida’s failure to enact consumer privacy
6
legislation conferring substantive data privacy rights in the way that California has done. See Dkt.
7
35 at 5 n.8 (comparing H.B. 9, 2022 Fla. Leg., Reg. Sess. (Fla. 2022) (unenacted) and S.B. 1864,
8
2022 Fla. Leg., Reg. Sess. (Fla 2022) (unenacted) with Cal. Civ. Code §§ 1798.100, et seq.).
9
Moreover, even though Florida relies on the Restatement, the Eleventh Circuit has noted,
10
specifically with respect to the private quarter requirement, that “the Supreme Court of Florida has
11
construed the tort of intrusion upon seclusion even more narrowly than the Restatement provides.”
12
United States District Court
Hammer, 824 F. App’x at 695 (citing Allstate, 863 So. 2d at 161 n.3, 162).
13
Because this difference is neither “trivial [n]or wholly immaterial,” each state’s interest in
14
applying its law must be analyzed. Mazza, 666 F.3d at 591. California recognizes that “with
15
respect to regulating or affecting conduct within its borders, the place of the wrong has the
Northern District of California
16
predominant interest,” id. at 593 (citing Hernandez v. Burger, 102 Cal. App. 3d 795, 802 (1980)),
17 where the “place of the wrong” is defined as “the state where the last event necessary to make the
18 actor liable occurred.” Id. (citing McCann, 48 Cal. 4th at 94 n.12 (geographic location of an
19 omission is the place of the transaction where it should have been disclosed) and Zinn v. Ex–Cell–
20 O Corp., 148 Cal. App. 2d 56, 80 n.6 (1957) (concluding in a fraud case that the place of the
21 wrong was the state where the misrepresentations were communicated to the plaintiffs, not the
22 state where the intention to misrepresent was formed or where the misrepresented acts took
23 place)). Additionally, “California’s interest in applying its law to residents of foreign states is
24 attenuated,” id. at 594 (citing Edgar v. MITE Corp., 457 U.S. 624, 644 (1982)), particularly where
25 “the claims of foreign residents concern[] acts that took place in other states.” Id.
26
27
28 ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
CASE NO. 22-cv-04792-RS
20
CaseCase
3:21-cv-01418-EMC
3:22-cv-04792-RS Document
Document 49
199-1Filed
Filed
04/06/23
04/12/23
PagePage
21 of224of 25
1 Here, although Oracle is headquartered in California,12 Plaintiffs interactions with the
2 third-party websites do not necessarily take place in California—and presumably do not, when
3 considering Plaintiffs Golbeck and Ryan. Therefore, even if some of the challenged conduct
4 allegedly emanated from California, it is not enough to establish California’s interest, particularly
5 where the “last event[s]” involved in the collection and interception of data (e.g., the third-party
websites’ decision to use Oracle’s services) were made possible by an intermediary that may or
6
may not be located in the state. See Mazza, 666 F.3d at 594 (“[T]he last events necessary for
7
liability as to the foreign class members—communication of the advertisements to the claimants
8
and their reliance thereon in purchasing vehicles—took place in the various foreign states, not in
9
California. These foreign states have a strong interest in the application of their laws to
10
transactions between their citizens and corporations doing business within their state.”) Reliant on
11
tests requiring courts to assess whether expectations about privacy are reasonable or data
12
United States District Court
collection is egregious, privacy is an evolving area of law that is inherently tied to community
13
standards. In light of this and the apparent differences in the legal framework among states,
14
Plaintiffs have failed to show that the law of California should be applied nationwide.
15
The even greater legal differences between intrusion upon seclusion under California’s
Northern District of California
16
laws and the GDPR leads to a similar conclusion for Plaintiffs’ Worldwide class. Defendant raises
17 several differences that would impact the present matter, including that the GDPR: lacks an
18 “evaluation of contemporary social norms,” Dkt. 23 at 10, provides a “comprehensive policy
19 framework” that clearly describes the legal requirements, Dkt. 35 at 6,13 and requires
20
21 12
During the hearing, Defendant raised the factual issue that Oracle moved its headquarters out of
California. Although this choice of law analysis proceeds on the assumption that Oracle was
22 headquartered in California, it is noted that this issue would be relevant for determining class
definitions (such as timelines), and would only present additional hurdles in the choice of law
23 analysis for selecting California as the law to apply nationally and globally.
13
24 Compare, e.g., Facebook Tracking, 956 F.3d at 601 (describing the tests for an invasion of
privacy under both the California Constitution and intrusion upon seclusion as an inquiry of two
25 elements—“whether: (1) there exists a reasonable expectation of privacy, and (2) the intrusion was
highly offensive”), with, GDPR Art. 4(11) (“‘[C]onsent’ of the data subject means any freely
26 given, specific, informed and unambiguous indication of the data subject’s wishes by which he or
she, by a statement or by a clear affirmative action, signifies agreement to the processing of
27 personal data relating to him or her.”) and id. Art. 6(1)(a) (“Processing shall be lawful only if and
to the extent that at least one of the following applies: the data subject has given consent to the
28 ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
CASE NO. 22-cv-04792-RS
21
CaseCase
3:21-cv-01418-EMC
3:22-cv-04792-RS Document
Document 49
199-1Filed
Filed
04/06/23
04/12/23
PagePage
22 of23
24of 25
1 intermediaries for consumers to bring class actions (i.e., consumers cannot do so directly).
2 Because such legal differences are significant and Plaintiffs have not explained what evidence
3 additional discovery could adduce, the choice of law analysis can be made at this juncture.
4 Accordingly, the intrusion upon seclusion claim (applying California common law) for Plaintiffs’
5 nationwide and global classes cannot stand.
6 H. Seventh Cause of Action: Declaratory Judgment
7 Plaintiffs’ declaratory judgment claim will rise and fall with its other claims: if Plaintiffs
8 fail to allege facts sufficient to state a claim under any other cause of action, the claim for
9 declaratory judgment will be dismissed. As not all of Plaintiffs’ claims have been dismissed, the
10 declaratory judgment claim survives to that extent.
11 I. Equitable Relief
Defendant cites Sonner v. Premier Nutrition Corp. for the proposition that a plaintiff
12
United States District Court
cannot seek equitable relief “for past harm under the UCL and CLRA” unless she first “establish
13
that she lacks an adequate remedy at law.” 971 F.3d 834, 844 (9th Cir. 2020). Under Sonner,
14
Defendant argues, Plaintiffs’ equitable claims should be dismissed, because Plaintiffs have not
15
shown they lack an adequate remedy at law. Plaintiffs respond that Sonner does not apply to their
Northern District of California
16
request for prospective injunctive relief, nor does it bar remedies that “go beyond” damages, Dkt.
17
30 at 24, or equitable relief asserted in the alternative.
18
“[T]he import of Sonner at the pleading stage is an unsettled question of law and has given
19
rise to an intra-circuit split.” Yeomans v. World Fin. Grp. Ins. Agency, Inc., No. 19-cv-00792-
20
EMC, 2022 WL 844152, at *7 (N.D. Cal. Mar. 22, 2022) (collecting cases). Plaintiffs are correct
21
that “Sonner does not preclude a plaintiff from pleading equitable remedies in the alternative.” Id.
22
at *8. Notably, some courts have found that “Sonner has limited applicability to the pleading stage
23 because it pertained to circumstances in which a plaintiff dropped all damages claims on the eve of
24 trial,” Jeong v. Nexo Fin. LLC, No. 21-cv-02392-BLF, 2022 WL 174236, at *27 (N.D. Cal. Jan.
25 19, 2022), circumstances which do not even remotely exist here. See Yeomans, 2022 WL 844152,
26
27 processing of his or her personal data for one or more specific purposes. . . .”).
28 ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
CASE NO. 22-cv-04792-RS
22
CaseCase
3:21-cv-01418-EMC
3:22-cv-04792-RS Document
Document 49
199-1Filed
Filed
04/06/23
04/12/23
PagePage
23 of24
24of 25
1 at *7 (“Sonner teaches that a plaintiff, on the eve of trial, cannot create an inadequacy of a legal
2 remedy by eliminating its availability by taking volitional action.”). Because the cases are
3 distinguishable, and because “[t]he issue of Plaintiff’s entitlement to seek the equitable remedy of
4 restitution may be revisited at a later stage,” Nacarino v. Chobani, LLC, No. 20-cv-07437-EMC,
5 2022 WL 344966, at *10 (N.D. Cal. Feb. 4, 2022), Defendant’s motion to dismiss the claims for
equitable relief is denied.
6
J. Motion to Strike
7
Federal Rule of Civil Procedure 12(f) permits a court to strike “any redundant, immaterial,
8
impertinent, or scandalous matter” from a pleading. The purpose of a motion to strike is primarily
9
“to avoid the expenditure of time and money that must arise from litigating spurious issues by
10
dispensing with those issues prior to trial.” Whittlestone, Inc. v. Handi-Craft Co., 618 F.3d 970,
11
973 (9th Cir. 2010) (quotation omitted).
12
United States District Court
Defendant’s request to strike the allegations in Paragraphs 64-65, 76-81, and 147 as
13
redundant and immaterial is not well taken. Motions to strike are “generally disfavored,”
14
XpertUniverse, Inc. v. Cisco Sys., Inc., No. 17-cv-03848-RS, 2019 WL 3413309, at *3 (N.D. Cal.
15
July 29, 2019) (citations omitted). The paragraphs in question concern topics related to Plaintiffs’
Northern District of California
16
allegations about Defendant—including, broadly, data brokers and data potentially available on
17
Defendant’s Data Marketplace. Contrary to Defendant’s argument, none of the information
18
contained therein presents content so prejudicial or immaterial and irrelevant as to warrant their
19
removal at this juncture. Accordingly, Defendant’s request to strike is denied.
20
V. CONCLUSION
21
In light of the above, Plaintiffs’ UCL, ECPA, unjust enrichment, and intrusion upon
22
seclusion (on behalf of the Worldwide and United States sub-classes) claims are dismissed without
23
prejudice, whereas their remaining claims—invasion of privacy, intrusion upon seclusion (for the
24
California sub-class), CIPA, declaratory judgment and equitable relief—survive, albeit some
25
barely. Defendant’s motion to strike is denied, and its request for incorporation by reference is
26
granted only as to Exhibits J and H. Plaintiffs are given 30 days to file an amended complaint.
27
28 ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
CASE NO. 22-cv-04792-RS
23
CaseCase
3:21-cv-01418-EMC
3:22-cv-04792-RS Document
Document 49
199-1Filed
Filed
04/06/23
04/12/23
PagePage
24 of25
24of 25
1 IT IS SO ORDERED.
2
3 Dated: April 6, 2023
4 ______________________________________
RICHARD SEEBORG
5 Chief United States District Judge
6
7
8
9
10
11
12
United States District Court
13
14
15
Northern District of California
16
17
18
19
20
21
22
23
24
25
26
27
28 ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS
CASE NO. 22-cv-04792-RS
24
File and source
- File
- gov.uscourts.cand.374304.199.1.pdf
- Size
- 430,740 bytes
- SHA-256
- c8845e72af58308c946d3d83153c14fdc860ee447fe11f48faa539e65cacdb23
- Original
- PACER (login required)