Opposition to Plaid's Motion to Dismiss — In re Plaid Inc. Privacy Litigation (N.D. Cal. No. 4:20-cv-03056-DMR)
Summary
Plaintiffs' opposition to Plaid's motion to dismiss the consolidated amended complaint in In re Plaid Inc. Privacy Litigation, Master Docket No. 4:20-cv-03056-DMR, in the U.S. District Court for the Northern District of California, Oakland Division, dated November 17, 2020 and filed by Interim Co-Lead Class Counsel before Hon. Donna M. Ryu. Its table of contents argues that Plaid acted without plaintiffs' consent because they were not on notice of its privacy policy, that Article III standing is satisfied, that the claims are timely and that the equitable claims are not barred by remedies at law. It then defends each pleaded claim: the California Constitution and common law invasion of privacy, the UCL, the CFAA and CDAFA, the Stored Communications Act, the California Anti-Phishing Act, deceit, and unjust enrichment.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
- Date
- 2020-11-17
Cite this document
“Opposition to Plaid's Motion to Dismiss — In re Plaid Inc. Privacy Litigation (N.D. Cal. No. 4:20-cv-03056-DMR).”
Original at archive.org, dated 2020-11-17. Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/2020-05-04-adams-v-johnston/
, SHA-256 07797fe5109b5051b448a396641a870e5d8e991fe1d38bf42be25c9332b6eb6a.Full text
1 HERRERA PURDY LLP LIEFF CABRASER HEIMANN &
Shawn M. Kennedy (SBN 218472) BERNSTEIN, LLP
2 skennedy@herrerapurdy.com Michael W. Sobol (SBN 194857)
Andrew M. Purdy (SBN 261912) msobol@lchb.com
3 apurdy@herrerapurdy.com Melissa Gardner (SBN 289096)
Bret D. Hembd (SBN 272826) mgardner@lchb.com
4 bhembd@herrerapurdy.com 275 Battery Street, 29th Floor
4590 MacArthur Blvd., Suite 500 San Francisco, CA 94111-3339
5 Newport Beach, CA 92660 Tel: (415) 956-1000
Tel: (949) 936-0900 Fax: (415) 956-1008
6 Fax: (855) 969-2050
BURNS CHAREST LLP
7 HERRERA PURDY LLP Warren T. Burns (Pro Hac Vice)
Nicomedes Sy Herrera (SBN 275332) wburns@burnscharest.com
8 nherrera@herrerapurdy.com Russell Herman (Pro Hac Vice)
Laura E. Seidl (SBN 269891) rherman@burnscharest.com
9 lseidl@herrerapurdy.com 900 Jackson Street, Suite 500
1300 Clay Street, Suite 600 Dallas, TX 75202
10 Oakland, CA 94612 Tel: (469) 904-4550
Tel: (510) 422-4700 Fax: (469) 444-5002
11 Fax: (855) 969-2050
BURNS CHAREST LLP
12 LIEFF CABRASER HEIMANN & Christopher J. Cormier (Pro Hac Vice)
BERNSTEIN, LLP ccormier@burnscharest.com
13 Rachel Geman (Pro Hac Vice) 4725 Wisconsin Avenue, NW, Suite 200
rgeman@lchb.com Washington, DC 20016
14 Rhea Ghosh (Pro Hac Vice) Tel: (202) 577-3977
rghosh@lchb.com Fax: (469) 444-5002
15 250 Hudson Street, 8th Floor
New York, NY 10013-1413
16 Tel: (212) 355-9500
Fax: (212) 355-9592
17
Interim Co-Lead Class Counsel
18
UNITED STATES DISTRICT COURT
19
NORTHERN DISTRICT OF CALIFORNIA
20 OAKLAND DIVISION
21 IN RE PLAID INC. PRIVACY Master Docket No.: 4:20-cv-03056-DMR
LITIGATION
22 OPPOSITION TO PLAID’S MOTION TO
THIS DOCUMENT RELATES TO: DISMISS PLAINTIFFS’ CONSOLIDATED
23
ALL ACTIONS AMENDED COMPLAINT
24
Hon. Donna M. Ryu
25
Action Filed: May 4, 2020
26
Trial Date: None Set
27
28
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
CASE NO. 4:20-CV-03056-DMR
1 TABLE OF CONTENTS
2 Page
3 INTRODUCTION ...........................................................................................................................1
FACTUAL BACKGROUND ..........................................................................................................2
4
I. Plaid’s Wrongful And Deceptive Business Practices ..............................................2
5 II. Plaid Took Plaintiffs’ Private Login And Banking Information .............................3
6 III. Plaintiffs Were Harmed By Plaid’s Misconduct ......................................................4
ARGUMENT ...................................................................................................................................5
7
I. Legal Standard .........................................................................................................5
8 II. Plaid Acted Without Plaintiffs’ Consent..................................................................5
9 A. Plaintiffs Were Not On Notice Of Plaid’s Privacy Policy ...........................6
B. Plaid’s Privacy Policy Would Not Establish Consent If It Were
10 Disclosed ......................................................................................................8
11 III. Article III Is Satisfied.............................................................................................10
A. Plaid’s Privacy Invasions Establish Injury In Fact ....................................10
12
B. Plaid’s Statutory Violations Establish Injury In Fact ................................11
13 C. Plaintiffs Have Standing To Seek Disgorgement Of Plaid’s
Unjustly-Earned Profits .............................................................................13
14
D. Plaintiffs’ Economic Injury Is Well-Pled ..................................................13
15 E. Plaintiffs’ Injuries Are “Fairly Traceable” To Plaid’s Conduct,
And Redressable ........................................................................................15
16
IV. Plaintiffs’ Claims Are Timely ................................................................................16
17 V. Plaintiffs’ Equitable Claims Are Not Barred By Remedies at Law.......................17
18 VI. Plaid’s Rule 12(b)(6) Arguments Have No Merit..................................................20
A. Plaintiffs Properly Plead Claims Under The California
19 Constitution And For Common Law Invasion Of Privacy-
Intrusion Into Private Affairs .....................................................................20
20
B.
Plaintiffs Have Properly Pleaded Claims Under The UCL .......................23
21 C.
Plaintiffs Have Properly Pleaded Claims Under The CFAA And
CDAFA ......................................................................................................26
22
D. Plaintiffs Have Properly Pleaded A Claim Under The Stored
23 Communications Act .................................................................................35
E. Plaid’s Violations Of The California Anti-Phishing Act Are Well-
24 Pled ............................................................................................................38
25 F. Plaintiffs Properly Plead A Claim For Deceit............................................42
G. Plaintiffs State A Claim For Unjust Enrichment/Quasi-Contract ..............44
26
CONCLUSION ..............................................................................................................................45
27
28
OPP TO PLAID’S MOT. TO DISMISS
2061689.1 -i- CASE NO. 4:20-CV-03056-DMR
1 TABLE OF AUTHORITIES
2 Page
3 CASES
4 Adams v. Johnston,
355 F.3d 1179 (9th Cir. 2004) .............................................................................................................. 39
5
Adkins v. Comcast Corp.,
6 No. 16-05969, 2017 WL 3491973 (N.D. Cal. Aug. 1, 2017) ............................................................... 19
7 Am. Life Ins. Co. v. Stewart,
300 U.S. 203 (1937) .............................................................................................................................. 18
8
Applebaum v. Lyft, Inc.,
9
263 F. Supp. 3d 454 (S.D.N.Y. 2017) .................................................................................................... 7
10
Archer v. United Rentals, Inc.,
11 195 Cal. App. 4th 807 (2011) ............................................................................................................... 23
12 Aryeh v. Canon Bus. Sols., Inc.,
55 Cal. 4th 1185 (2013) ........................................................................................................................ 16
13
Ashcroft v. Iqbal (2007),
14 556 U.S. 662 (2009) .......................................................................................................................... 5, 39
15 Astiana v. Hain Celestial Grp., Inc.,
783 F.3d 753 (9th Cir. 2015) .......................................................................................................... 19, 44
16
Backhaut v. Apple, Inc.,
17 74 F. Supp. 3d 1033 (N.D. Cal. 2014) ............................................................................................ 36, 37
18 Bell Atlantic Corp. v. Twombly,
550 U.S. 554 (2007) .............................................................................................................................. 39
19
Beltran v. United States,
20
441 F.2d 954 (7th Cir. 1971) ................................................................................................................ 14
21
Brazil v. Dole Packaged Foods, LLC,
22 660 F. App’x 531 (9th Cir. 2016) ......................................................................................................... 44
23 Britton v. Girardi,
235 Cal. App. 4th 721 (2015) ............................................................................................................... 17
24
Cahen v. Toyota Motor Corp.,
25 147 F. Supp. 3d 955, 971, 973 (N.D. Cal. 2015) ...................................................................................... 11
26 Cal. Bankers Ass’n v. Shultz,
416 U.S. 21 (1974) ................................................................................................................................ 20
27
Calsoft Labs, Inc. v. Panchumarthi,
28 No. 19 -04398-NC, 2020 WL 512123 (N.D. Cal. Jan. 31, 2020) ......................................................... 27
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
- ii - CASE NO. 4:20-CV-03056-DMR
1 TABLE OF AUTHORITIES
(continued)
2 Page
3 Campbell v. Facebook,
77 F. Supp. 3d 836 (N.D. Cal. 2014) .................................................................................................... 23
4
Campbell v. Facebook, Inc.,
5 951 F.3d 1106 (9th Cir. 2020) .................................................................................................. 11, 12, 16
6 Catholic League for Religious & Civil Rights v. City & Cnty. of San Francisco,
624 F.3d 1043 (9th Cir. 2010) .............................................................................................................. 11
7
Cel-Tech Commc’ns, Inc. v. L.A. Cellular Tel. Co.,
8
20 Cal. 4th 163 (1999) .......................................................................................................................... 24
9
Central Bank & Trust v. Smith,
10 215 F. Supp. 3d 1226 (D. Wy. 2016) .............................................................................................. 36, 38
11 Cline v. Reetz-Laiolo,
329 F. Supp. 3d 1000 (N.D. Cal. 2018) ................................................................................................ 38
12
Colgate v. JUUL Labs, Inc.,
13 402 F. Supp. 3d 728 (N.D. Cal. 2019) .................................................................................................... 7
14 Creative Computing v. Getloaded.com, LLC,
386 F.3d 930 (9th Cir. 2004) ................................................................................................................ 28
15
Daniel v. Ford Motor Co.,
16 806 F.3d 1217 (9th Cir. 2015) .............................................................................................................. 26
17 Davis v. HSBC Bank Nevada,
691 F.3d 1152 (9th Cir. 2012) .............................................................................................................. 24
18
Decoursey v. Sherwin-Williams Co.,
19
No. 19-02198, 2020 WL 1812266 (D. Kan. Apr. 9, 2020)................................................................... 36
20
Dinan v. SanDisk LLC,
21 No. 18-05420, 2020 WL 364277 (N.D. Cal. Jan. 22, 2020) ................................................................... 8
22 eBay Inc. v. Digital Point Solutions, Inc.,
608 F. Supp. 2d 1156 (N.D. Cal. 2009) ................................................................................................ 32
23
Ehling v. Monmouth-Ocean Hosp. Serv. Corp.,
24 961 F. Supp. 2d 659 (D.N.J. 2013) ....................................................................................................... 36
25 Erickson v. Pardus,
551 U.S. 89 (2007) .................................................................................................................................. 5
26
Facebook, Inc. v. Fisher,
27 No. 09-05842, 2011 WL 250395 (N.D. Cal. Jan. 26, 2011) ................................................................. 40
28
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
- iii - CASE NO. 4:20-CV-03056-DMR
1 TABLE OF AUTHORITIES
(continued)
2 Page
3 Facebook, Inc. v. MaxBounty,
274 F.R.D. 279 (N.D. Cal. 2011) .......................................................................................................... 32
4
Facebook, Inc. v. Power Ventures, Inc.,
5 844 F.3d 1058 (9th Cir. 2016) .............................................................................................................. 29
6 Facebook, Inc. v. Power Ventures, Inc.,
No. 08-05780, 2010 WL 3291750 (N.D. Cal. July 20, 2010) .............................................................. 27
7
Ferrington v. McAfee, Inc.,
8
No. 10-01455, 2010 WL 3910169 (N.D. Cal. Oct. 5, 2010) ................................................................ 43
9
Fidlar Techs. v. LPS Real Estate Data Sols., Inc.,
10 810 F.3d 1075 (7th Cir. 2016) .................................................................................................. 31, 32, 34
11 Flextronics Int’l, Ltd. v. Parametric Tech. Corp.,
No. 13-00034, 2014 WL 2213910 (N.D. Cal. May 28, 2014) .............................................................. 35
12
Folgelstrom v. Lamps Plus, Inc.,
13 195 Cal. App. 4th 986 (2011) ............................................................................................................... 22
14 Fox v. Ethicon Endo-Surgery, Inc.,
35 Cal. 4th 797 (2005) .......................................................................................................................... 16
15
GM L.L.C. v. Autel.US Inc.,
16 No. 14-14864, 2016 WL 1223357 (E.D. Mich. Mar. 29, 2016) ........................................................... 30
17 Gonzales v. Uber Techs., Inc.,
305 F. Supp. 3d 1078 (N.D. Cal. 2018) .......................................................................................... 23, 28
18
Goodman v. HTC Am., Inc.,
19
No. 11-1793, 2012 WL 2412070 (W.D. Wash. June 26, 2012) ........................................................... 24
20
Greenwich Ins. Co, v. Media Breakaway,
21 No. 08-937, 2009 WL 6521581 (C.D. Cal. Jun. 11, 2009) ................................................................... 41
22 Hanger Prosthetics & Orthotics, Inc. v. Capstone Orthopedic, Inc.,
556 F. Supp. 2d 1122 (E.D. Cal. 2008) ................................................................................................ 32
23
Heeger v. Facebook, Inc.,
24 No. 18-06399, 2019 WL 7282477 (N.D. Cal. Dec. 27, 2019).............................................................. 22
25 Hernandez v. Hillsides, Inc.,
47 Cal. 4th 272 (2009) .................................................................................................................... 20, 21
26
Hexcel Corp. v. Ineos Polymers, Inc.,
27 681 F.3d 1055 (9th Cir. 2012) .............................................................................................................. 17
28
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
- iv - CASE NO. 4:20-CV-03056-DMR
1 TABLE OF AUTHORITIES
(continued)
2 Page
3 Hill v. NCAA,
7 Cal. 4th 1 (1994) ................................................................................................................................ 20
4
HiQ Labs, Inc. v. LinkedIn Corp.,
5 938 F.3d 985 (9th Cir. 2019) .......................................................................................................... 27, 38
6 Hoffman v. 162 N. Wolfe LLC,
228 Cal. App. 4th 1178 (2014) ....................................................................................................... 42, 43
7
In re Anthem Data Breach Litig.,
8
162 F. Supp. 3d 953 (N.D. Cal. 2016) .................................................................................................. 24
9
In re Apple & AT&TM Antitrust Litig.,
10 596 F. Supp. 2d 1288 (N.D. Cal. 2008) ................................................................................................ 28
11 In re Apple & ATTM Antitrust Litig,
No. 07-5152, 2010 WL 3521965 (N.D. Cal. July 8, 2010) .................................................................. 31
12
In re Facebook Privacy Litig.,
13 572 F. App'x 494 (9th Cir. 2014) .......................................................................................................... 15
14 In re Facebook, Inc. Internet Tracking Litig.,
956 F.3d 589 (9th Cir. 2020) ......................................................................................................... passim
15
In re Facebook, Inc. Sec. Litig.,
16 405 F. Supp. 3d 809 (N.D. Cal. 2019) .................................................................................................... 6
17 In re Facebook, Inc., Consumer Priv. User Profile Litig.,
402 F. Supp. 3d 767 (N.D. Cal. 2019) ........................................................................................ 9, 11, 15
18
In re Google Assistant Privacy Litig.,
19
457 F. Supp. 3d 797 (N.D. Cal. 2020) .............................................................................................. 8, 24
20
In re Google Inc. Cookie Placement Consumer Privacy Litig.,
21 806 F.3d 125 (3d Cir. 2015) ................................................................................................................. 22
22 In re Google Referrer Header Privacy Litig.,
No. 10-04809, 2020 WL 3035796 (N.D. Cal. June 5, 2020) ...................................................... 5, 12, 13
23
In re Google, Inc. Privacy Policy Litig.,
24 No. 12-01382, 2013 WL 6248499 (N.D. Cal. Dec. 3, 2013)................................................................ 15
25 In re iPhone Application Litig.,
844 F. Supp. 2d 1040 (N.D. Cal. 2012) .......................................................................................... 14, 22
26
In re Marriott Int’l, Inc., Customer Data Sec. Breach Litig.,
27 440 F. Supp. 3d 447 (D. Md. 2020) ...................................................................................................... 15
28
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
-v- CASE NO. 4:20-CV-03056-DMR
1 TABLE OF AUTHORITIES
(continued)
2 Page
3 In re Tobacco II Cases,
46 Cal. 4th 298 (2009) .......................................................................................................................... 26
4
In re Toys R Us, Inc., Privacy Litig.,
5 No. 00-2746, 2001 WL 34517252 (N.D. Cal. Oct. 9, 2001) ................................................................ 28
6 In re Vizio, Inc., Consumer Privacy Litig.,
238 F. Supp. 3d 1204 (C.D. Cal. 2017) .................................................................................... 11, 22, 44
7
In re Webkinz Antitrust Litig.,
8
695 F. Supp. 2d 987 (N.D. Cal. 2010) .................................................................................................. 25
9
In re Zappos.com, Inc.,
10 888 F.3d 1020 (9th Cir. 2018) .............................................................................................................. 14
11 Jewel v. Nat’l Sec. Agency,
673 F.3d 902 (9th Cir. 2011) ................................................................................................................ 16
12
Johnson v. Riverside Healthcare Sys.,
13 534 F.3d 1116 (9th Cir. 2008) .............................................................................................................. 39
14 Kasky v. Nike, Inc.,
27 Cal. 4th 939 (2002) .......................................................................................................................... 24
15
Katz v. Pershing LLC,
16 672 F.3d 64 (1st Cir. 2012) ................................................................................................................... 14
17 Krottner v. Starbucks Corp.,
628 F.3d 1139 (9th Cir. 2010) .............................................................................................................. 14
18
Kwikset Corp. v. Superior Ct.,
19
51 Cal. 4th 310 (2011) .......................................................................................................................... 23
20
Low v. LinkedIn Corp.,
21 900 F. Supp. 2d 1010 (N.D. Cal. 2012) ................................................................................................ 22
22 LSH CO v. Transamerica Life Ins. Co.,
No. 18-09711, 2019 WL 3064422 (C.D. Cal. Mar. 20, 2019).............................................................. 17
23
Luong v. Subaru of Am., Inc.,
24 No. 17-03160, 2018 WL 2047646 (N.D. Cal. May 2, 2018) ................................................................ 19
25 Mangum v. Action Collection Serv., Inc.,
575 F.3d 935 (9th Cir. 2009) ................................................................................................................ 16
26
Marolda v. Symantec Corp.,
27 672 F. Supp. 2d 992 (N.D. Cal. 2009) .................................................................................................. 44
28
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
- vi - CASE NO. 4:20-CV-03056-DMR
1 TABLE OF AUTHORITIES
(continued)
2 Page
3 Matera v. Google, Inc.,
No. 15-4062, 2016 WL 5339806 (N.D. Cal. Sept. 23, 2016). .............................................................. 12
4
McDonald v. Coldwell Banker,
5 543 F.3d 498 (9th Cir. 2008) ................................................................................................................ 25
6 McKee v. Audible, Inc.,
No. 17-1941, 2017 WL 4685039 (C.D. Cal. July 17, 2017)................................................................... 7
7
McLellan v. Fitbit, Inc.,
8
No. 16-00036, 2018 WL 2688781 (N.D. Cal. June 5, 2018) ................................................................ 44
9
Microsoft Corp. v. Doe,
10 No. 14-00811, 2015 WL 4937441 (E.D. Va. Aug. 17, 2015) .............................................................. 30
11 Microsoft Corp. v. Mutairi,
No. 14-00987, 2015 U.S. Dist. LEXIS 95541 (D. Nev. June 25, 2015)............................................... 30
12
Mobile Active Def., Inc. v. L.A. Unified Sch. Dist.,
13 No. 15-8762, 2016 WL 7444876 (C.D. Cal. Apr. 6, 2016) .................................................................. 33
14 Moss v. U.S. Secret Serv.,
572 F.3d 962 (9th Cir. 2009) ................................................................................................................ 45
15
Multiven, Inc. v. Cisco Sys., Inc.,
16 725 F. Supp. 2d 887 (N.D. Cal. July 20, 2010) .................................................................................... 29
17 NACM Tampa, Inc. v. Sunray Notices, Inc.,
No. 15-1776, 2017 WL 2209970 (M.D. Fla. Feb. 8, 2017) .................................................................. 34
18
NetApp v. Nimble Storage, Inc.,
19
No. 13-05058, 2015 WL 400251 (N.D. Cal. Jan. 29, 2015) ................................................................. 31
20
NetApp, Inc. v. Nimble Storage,
21 41 F. Supp. 3d 816 (N.D. Cal. 2014) .................................................................................................... 32
22 Neubronner v. Milken,
6 F.3d 666 (9th Cir.1993) ....................................................................................................................... 5
23
Nguyen v. Barnes & Noble Inc.,
24 763 F.3d 1171 (9th Cir. 2014) ............................................................................................................ 6, 7
25 Opperman v. Path, Inc.,
205 F. Supp. 3d 1064 (N.D. Cal. 2016) ................................................................................ 8, 10, 20, 22
26
Oracle Am., Inc. v. TERiX Comput. Co.,
27 No. 13-03385, 2014 WL 31344 (N.D. Cal. Jan. 3, 2014) ..................................................................... 34
28
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
- vii - CASE NO. 4:20-CV-03056-DMR
1 TABLE OF AUTHORITIES
(continued)
2 Page
3 Overton v. Bird Brain, Inc.,
No. 11-1054, 2012 WL 909295 (C.D. Cal. Mar. 15, 2012).................................................................. 44
4
Patel v. Facebook, Inc.,
5 932 F.3d 1264 (9th Cir. 2019) .............................................................................................................. 21
6 Philips v. Ford Motor Co.,
No. 14-02989, 2015 WL 4111448 (N.D. Cal. July 7, 2015) ................................................................ 19
7
Pineda v. Williams-Sonoma Stores, Inc.,
8
51 Cal. 4th 524 (2011) .......................................................................................................................... 41
9
Riley v. California,
10 573 U.S. 373 (2014) .............................................................................................................................. 21
11 Romero v. Securus Techs., Inc.,
216 F. Supp. 3d 1078 (S.D. Cal. 2016) ................................................................................................. 23
12
Satmodo, LLC v. Whenever Commcns.., LLC,
13 No. 17-0192, 2017 WL 6327132 (S.D. Cal. Dec. 8, 2017) ............................................................ 29, 31
14 Shroyer v. New Cingular Wireless Servs., Inc.,
622 F.3d 1035 (9th Cir. 2010) ................................................................................................................ 5
15
Shurgard Storage Centers, Inc., v. Safeguard Self Storage, Inc.,
16 119 F. Supp. 2d 1121 (W.D. Wash. 2000)...................................................................................... 29, 32
17 Singer Co. v. Superior Court,
179 Cal. App. 3d 875 (1986) ................................................................................................................ 14
18
Sloan v. GM, LLC,
19
287 F. Supp. 3d 840 (N.D. Cal. 2018) .................................................................................................. 43
20
Sonner v. Premier Nutrition Corp.,
21 971 F.3d 834 (9th Cir. 2020) .......................................................................................................... 18, 19
22 Spokeo, Inc. v. Robins,
136 S. Ct. 1540 (2016) .............................................................................................................. 10, 11, 12
23
State v. Mayze,
24 622 S.E.2d 836 (Ga. 2005) ................................................................................................................... 15
25 Steel Co. v. Citizens for a Better Env’t,
523 U.S. 83 (1998) ................................................................................................................................ 15
26
Svenson v. Google Inc.,
27 No. 13-04080, 2016 WL 8943301 (N.D. Cal. Dec. 21, 2016).............................................................. 15
28
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
- viii - CASE NO. 4:20-CV-03056-DMR
1 TABLE OF AUTHORITIES
(continued)
2 Page
3 T. K. v. Adobe Sys. Inc.,
No. 17-04595, 2018 WL 1812200 (N.D. Cal. Apr. 17, 2018) .............................................................. 18
4
Theofel v. Farey-Jones,
5 359 F.3d 1066 (9th Cir. 2004) .............................................................................................................. 37
6 Therapeutic Research Faculty v. NBTY, Inc.,
488 F. Supp. 2d 991 (E.D. Cal. 2007) .................................................................................................. 29
7
Thompson v. Transamerica Life Ins. Co.,
8
No. 18-05422, 2018 WL 6790561 (C.D. Cal. Dec. 26, 2018) .............................................................. 19
9
Ticketmaster L.L.C. v. Prestige Entm’t W., Inc.,
10 315 F. Supp. 3d 1147 (C.D. Cal. 2018) ................................................................................................ 31
11 T-Mobile USA, Inc. v. Terry,
862 F. Supp. 2d 1121 (W.D. Wash. 2012)............................................................................................ 34
12
Trazo v. Nestle USA, Inc.,
13 113 F. Supp. 3d 1047 (N.D. Cal. 2015) ................................................................................................ 44
14 United States v. Corinthian Colls.,
655 F.3d 984 (9th Cir. 2011) .................................................................................................................. 5
15
United States v. Cotterman,
16 709 F.3d 952 (9th Cir. 2013) ................................................................................................................ 20
17 United States v. Neville,
985 F.2d 992 (9th Cir. 1993) ................................................................................................................ 40
18
United States v. Nosal,
19
844 F.3d 1024 (9th Cir. 2016) .............................................................................................................. 27
20
United States v. Weaver,
21 636 F. Supp. 2d 769 (C.D. Ill. 2009) .................................................................................................... 38
22 United States v. Yücel,
97 F. Supp. 3d 413 (S.D.N.Y. 2015) .............................................................................................. 30, 31
23
Van Patten v. Vertical Fitness Grp., LLC,
24 847 F.3d 1037 (9th Cir. 2017) ........................................................................................................ 10, 12
25 Wildin v. FCA US LLC,
No. 17-02594, 2018 WL 3032986 (S.D. Cal. June 19, 2018) .............................................................. 19
26
Wilding v. DNC Servs.,
27 No. 16-61511, 2017 WL 6345492 (S.D. Fla. Aug. 25, 2017) .............................................................. 14
28
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
- ix - CASE NO. 4:20-CV-03056-DMR
1 TABLE OF AUTHORITIES
(continued)
2 Page
3 STATUTES
4 12 U.S.C. § 3401 ....................................................................................................................................... 12
5 18 U.S.C. § 1030 ................................................................................................................................ passim
6 18 U.S.C. § 1030(a)(4).............................................................................................................................. 32
7 18 U.S.C. § 1030(a)(5)(A) ........................................................................................................................ 34
8 18 U.S.C. § 1030(a)(6).............................................................................................................................. 32
9 18 U.S.C. § 1030(c)(4)(A)(i)(I) ................................................................................................................ 27
10 18 U.S.C. § 1030(e)(11) ............................................................................................................................ 30
11 18 U.S.C. § 1030(g) ............................................................................................................................ 16, 27
12 18 U.S.C. § 2510(12) ................................................................................................................................ 36
13 18 U.S.C. § 2510(12)(D)........................................................................................................................... 37
14 18 U.S.C. § 2510(15) ................................................................................................................................ 36
15 18 U.S.C. § 2510(17)(B) ........................................................................................................................... 37
16 18 U.S.C. § 2701 ................................................................................................................................ passim
17 18 U.S.C. § 2701(a) .................................................................................................................................. 35
18 18 U.S.C. § 2701(a)(1).............................................................................................................................. 36
19 18 U.S.C. § 2707 ....................................................................................................................................... 35
20 18 U.S.C. § 2707(f) ................................................................................................................................... 16
21 18 U.S.C. § 2711(1) .................................................................................................................................. 36
22 Cal. Bus. & Prof. Code § 17203 ............................................................................................................... 26
23 Cal. Bus. & Prof. Code § 22577 ......................................................................................................... 24, 25
24 Cal. Bus. & Prof. Code § 22948 ............................................................................................................... 12
25 Cal. Bus. & Prof. Code § 22948.2 ................................................................................................ 39, 40, 41
26 Cal. Bus. & Prof. Code § 22948.3 ............................................................................................................ 41
27 Cal. Bus. & Prof. Code § 22948.3(a)(2) ................................................................................................... 40
28 Cal. Bus. & Prof. Code § 22948.3(d) ........................................................................................................ 41
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
-x- CASE NO. 4:20-CV-03056-DMR
1 TABLE OF AUTHORITIES
(continued)
2 Page
3 Cal. Civ. Code § 1709 ............................................................................................................. 23, 42, 43, 44
4 Cal. Fin. Code § 4051 ............................................................................................................................... 24
5 Cal. Pen. Code § 502.......................................................................................................................... passim
6 Cal. Pen. Code § 502(a) ............................................................................................................................ 12
7 Cal. Pen. Code § 502(b)(10) ............................................................................................................... 34, 35
8 Cal. Pen. Code § 502(c)(1) ....................................................................................................................... 31
9 Cal. Pen. Code § 502(c)(4) ....................................................................................................................... 31
10 Cal. Pen. Code § 502(c)(8) ....................................................................................................................... 34
11 Cal. Pen. Code § 502(e)(1) ................................................................................................................. 27, 28
12 REGULATIONS
13 16 C.F.R. § 313.3(b)(1)-(2)..........................................................................................................................7
14 16 C.F.R. § 313.4 .........................................................................................................................................8
15 16 C.F.R. § 313.5 ........................................................................................................................................ 8
16
17 RULES
18 Fed. R. Civ. P. 57 ...................................................................................................................................... 17
19 Fed. R. Civ. P. 57 1937 Advisory Committee Notes ................................................................................ 17
20 Fed. R. Civ. P. 9(b) ..................................................................................................................................... 5
21 OTHER AUTHORITIES
22 Camille Calman, Bigger Phish to Fry: California's Anti-Phishing Statute and Its Potential
Imposition of Secondary Liability on Internet Service Providers, 13 Rich. J.L. & Tech. 2
23 (2006) .................................................................................................................................................... 40
24 S. Rep. 104-357 (1996) ............................................................................................................................. 11
25 S. Rep. 99-432 (1986) ............................................................................................................................... 11
26 S. Rep. No. 99-541 (1986) ........................................................................................................................ 11
27 Vasileios Karagiannopoulos, From Morris to Nosal: The History of Exceeding Authorization and
the Need for a Change, 30 J. Marshall J. Info. Tech. & Privacy L. 465 (2014) ................................... 11
28
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
- xi - CASE NO. 4:20-CV-03056-DMR
1 INTRODUCTION
2 The Consolidated Amended Complaint (Dkt. 61) (“CAC”) describes in detail how Plaid embeds
3 its own software in Venmo and other apps to surreptitiously collect private bank login information—and
4 then actual bank account transactions—from Plaintiffs and millions of other consumers. This egregious
5 invasion of privacy is facilitated (and exacerbated) by Plaid’s pretending to be consumers’ trusted banks,
6 and otherwise hiding the true nature of its misconduct. Plaintiffs neither knew about nor consented to
7 Plaid’s systematic monitoring of their personal financial lives, or to Plaid’s collection and use of
8 Plaintiffs’ data. The well-pleaded allegations state claims under multiple federal and state laws. In its
9 Motion to Dismiss (Dkt. 78) (“MTD”), Plaid paints itself as a harmless conduit that Plaintiffs used to
10 connect apps to Plaintiffs’ financial accounts, ignoring the allegations and injecting fact-based defenses
11 that will require discovery. Its motion should be denied.
12 First, Plaid entirely fails to demonstrate its principal argument that Plaintiffs consented to its
13 activities. Plaid’s express design from the start was that consumers would not learn Plaid even exists.
14 Plaid’s inadequate and obscure privacy policy failed to provide actual or constructive notice of Plaid’s
15 activities. Consent is not a defense to any, let alone all, of Plaintiffs’ claims.
16 Second, Plaintiffs adequately allege standing. Privacy invasions are concrete and redressable, the
17 statutes under which Plaintiffs seek relief provide additional statutory standing, and recent governing
18 law confirms the existence of Plaintiffs’ injuries (including economic harm).
19 Third, Plaintiffs’ claims are timely because they allege misconduct within the statutes of
20 limitations of their claims (namely, Plaid’s access, continuous collection, and use of private data). In any
21 event, application of the discovery rule and Plaid’s fraudulent concealment of its conduct would save
22 any claims that otherwise would be untimely (although there are none).
23 Fourth, Plaintiffs adequately allege all the specific elements of their claims and entitlement to
24 the prayed-for relief. Plaid’s 12(b)(6) arguments boil down to constant reiteration of its failed consent
25 argument, premature disagreements over the facts, and an unsupported challenge to whether it is subject
26 to privacy-related statutes. Yet, Plaid’s intrusion into consumers’ private lives is exactly what
27 contemporary statutes—drawing on centuries of common-law principles—proscribe.
28
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
-1- CASE NO. 4:20-CV-03056-DMR
1 FACTUAL BACKGROUND
2 I. Plaid’s Wrongful And Deceptive Business Practices
3 Plaid’s business operates as follows: First, Plaid embeds software in the apps of financial
4 technology (fintech) clients that enable funds transfers, such as Venmo, Coinbase, Square’s “Cash App,”
5 and Stripe (the “Apps”). ¶ 31.1 When consumers are prompted to link or verify their bank account for
6 these Apps, Plaid’s software activates. ¶¶ 31-32. Plaid designed its software to mimic a standard
7 “OAuth” login procedure (that is, one where a website or app user is redirected to log in directly to a
8 third-party website), including by mimicking the bank’s mobile website. ¶ 38. Specifically, Plaid
9 presents the consumer with an interface that appears to come from their bank, including the bank’s logo
10 and color scheme. Id. The experience—a shift in the screen, suggesting the user has been directed from
11 the app to the bank— gives the definite impression that login information is being passed directly to
12 trusted financial institutions. Id. Plaid provides no warnings that reasonable consumers would expect
13 when requested to hand over their bank login credentials to a third-party instead. Plaid makes no effort
14 to meaningfully disclose what it is about to do and obtain consent. Instead, Plaid hides the link to its
15 (substantively inadequate) privacy policy, via disproportionately small font and a light gray color
16 designed to escape attention. ¶¶ 67-69. The design features of Plaid’s software look like familiar
17 banking pages to consumers, inducing them to enter private credentials to “log in” to the bank. ¶¶ 35,
18 37-41. In reality, consumers unwittingly hand their credentials directly to Plaid. ¶¶ 35, 45.
19 Second, Plaid takes the consumer’s login credentials and uses them to establish its own
20 connection to the bank. ¶¶ 45, 70. Once that connection is established, Plaid accesses the bank’s
21 computer systems for all available data connected to that consumer, including years of historical
22 transaction data, identifying information, and data related to all associated savings, investment, and
23 accounts—even minor children’s accounts. ¶¶ 5, 49-50, 53, 56. Plaid continues to collect that data every
24 few hours, regardless of whether the data has any tie to the App’s money-transfer purposes, and
25 regardless of whether the consumer stops using or deletes that App. ¶¶ 5, 55, 267.
26 Third, having scraped all available data, Plaid exports the data wholesale to its own servers,
27
1
28 Throughout this brief, all citations identified with “¶” are to paragraphs of the CAC.
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
-2- CASE NO. 4:20-CV-03056-DMR
1 where it cross-references it with other data (“enriches” it). ¶¶ 54-55. Plaid then sells products that make
2 the data available to its clients, the Apps. ¶ 59. Plaid employs a large team of data scientists to run
3 analytics on the data so that it can develop value-added products, which it also sells. ¶¶ 63-64.
4 Plaid has collected consumer banking data from over 200 million individual accounts, what it
5 touts as “one of the largest transactional data sets in the world.” ¶¶ 28, 54, 57. This is remarkable
6 given—indeed, because—Plaid’s objective was that “most people will never know we exist.” ¶ 76.
7 II. Plaid Took Plaintiffs’ Private Login And Banking Information
8 Contrary to Plaid’s suggestion, Plaintiffs specifically, expressly, and repeatedly allege that
9 Plaid’s software was used to connect the Apps to their respective bank accounts. ¶ 99 (Plaintiffs are
10 “App users who linked their financial accounts using Plaid’s software integrated with the app”)
11 (emphasis added); ¶ 215 (“Plaid deceptively acquired [Plaintiffs’] bank login credentials and informed
12 their financial institutions that they had provided Plaid with permission to gain access to all information
13 available in their bank accounts”). The individual Plaintiffs believed, at the time, that they were logging
14 into their own banks (¶¶102, 113, 123, 132, 142, 152, 161, 170, 180, 191, 201), and describe how their
15 bank accounts were actually accessed by Plaid through the process illustrated in the CAC. For example,
16 Plaintiff Anderson alleges that, when she signed up to use Venmo and Cash App, she was prompted in
17 those apps to connect her bank account by logging into it, and that she actually did so. ¶¶ 100, 102-05.
18 Similarly, Ms. Anderson alleges that, to the extent she recalls specific details regarding the process of
19 logging into her bank account in the apps, those details are “consistent with the discussion of Plaid’s
20 interface” in the CAC. ¶ 101. She also alleges that her financial account was “linked” to and “verified
21 for use with” Venmo and Cash App. ¶ 109. Each of the named Plaintiffs makes a similar allegation. ¶¶
22 109, 119, 129, 139, 149, 158, 167, 177, 187, 198, 207.2
23 Lest there be any doubt (and there is not), Plaintiffs’ allegations necessarily refer to Plaintiffs
24 linking their accounts through Plaid’s instant verification and linking process, through which consumers
25
2
And, behind the scenes, Plaid’s software operated in materially the same way for each Plaintiff in that
26 it followed the same process of surreptitiously collecting their bank login credentials while hiding
Plaid’s role and indicating that Plaid was and/or represented the banks. While certain of the named
27 Plaintiffs first connected Apps to their bank accounts using versions of Plaid’s software from prior to
2016 and others from after Plaid implemented its “Managed OAuth” procedure (see ¶¶ 34-35, 121, 140,
28 150, 159, 188, 199), in all cases Plaid received and maintained login information through deception.
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
-3- CASE NO. 4:20-CV-03056-DMR
1 are directed to log into their bank accounts using Plaid’s spoofed bank login screens. ¶¶ 32-41. The CAC
2 explains that the sole alternative to link a bank account is a different process involving micro-deposits to
3 a consumer’s account, where consumers must report the amounts back to the App. ¶ 32. None of the
4 Plaintiffs allege they engaged in micro-deposit verification, which would not be consistent with Plaid’s
5 interface. Instead, all allege facts consistent with Plaid’s process of instant verification.
6 Plaintiffs further allege that Plaid actually took their private data from their bank accounts,
7 further confirming their allegations that, unknowingly at the time, they were using Plaid’s software. For
8 example, Plaintiffs allege that Plaid (1) “obtained access to their personal financial accounts and
9 stripped out all available data” (¶ 208); (2) “intruded upon Plaintiffs’ . . . private affairs and concerns by
10 improperly accessing, downloading, transferring, selling, storing and using their private banking
11 information” (¶ 262); and (3) “removed Plaintiffs’ . . . banking data from the secure banking
12 environment, selling or transferring it to the [] Apps and storing it for its own use.” ¶ 292(a). In addition,
13 certain Plaintiffs allege that, as a result of having connected the Apps to their bank accounts through
14 Plaid, Plaid accessed their minor children’s accounts without authorization. ¶¶ 110, 120. Plaid’s
15 suggestion that Plaintiffs failed to allege their connection to Plaid is easily belied by the CAC.
16 III. Plaintiffs Were Harmed By Plaid’s Misconduct
17 Plaid intruded upon a deeply personal aspect of Plaintiffs’ lives. Banking information is private,
18 not only because it reveals sensitive facts about people’s income and expenditures, but because it is a
19 sharp light on the details of their lives, priorities, habits, and associations. ¶¶ 50, 208. What Plaid took
20 from Plaintiffs’ accounts is particularly illuminating, in that it includes stored technical information
21 about the precise locations where Plaintiffs made their purchases, as well as data from other accounts. ¶¶
22 27, 208. In Plaid’s control, this data becomes even more revealing: Plaid acknowledges that it runs
23 “analytics” and draws inferences about those whose accounts it has accessed, beyond what may be
24 shown by isolated data points. ¶¶ 25, 64. Plaid’s privacy invasions and abuse of the trust that Plaintiffs
25 placed in their own financial institutions (by representing itself as those institutions) violates social
26 norms and Plaintiffs’ dignitary rights to control access to their own information, and to decide for
27 themselves what, when, and why it should be shared. Plaid parries that it does not “sell” Plaintiffs’ data,
28 but it is beyond dispute that Plaid, at a minimum, sells products that make Plaintiffs’ data available to
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
-4- CASE NO. 4:20-CV-03056-DMR
1 others (¶¶ 99, 206, 208-11, 214-34) and used Plaintiffs’ data to generate value for itself. ¶¶ 63-65, 107.
2 The harm to Plaintiffs’ privacy and dignitary interests is pronounced, and gives rise to Plaintiffs’
3 entitlement to seek disgorgement of the benefits Plaid has acquired by virtue of these abuses. Plaid’s
4 misconduct also caused Plaintiffs to lose indemnification rights and protections their data would
5 otherwise have had (¶¶ 47, 78, 215-24, 335), and lose control over their own sensitive financial
6 information—property of demonstrable value (¶¶ 6, 59, 62, 228-31). Plaintiffs now face a heightened
7 risk of identity theft and fraud, which has required expenditures of time and resources. ¶¶ 57, 79, 201,
8 108, 118, 206, 232-35.
9 ARGUMENT
10 I. Legal Standard
11 On a Rule 12(b)(6) motion, the court must “accept as true all of the factual allegations contained
12 in the complaint,” Erickson v. Pardus, 551 U.S. 89, 94 (2007), and construe them “in the light most
13 favorable to the [Plaintiffs].” In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 601 (9th Cir.
14 2020). A claim may be dismissed “only where there is no cognizable legal theory” or the complaint does
15 not plead sufficient facts to “state a facially plausible claim to relief.” Shroyer v. New Cingular Wireless
16 Servs., Inc., 622 F.3d 1035, 1041 (9th Cir. 2010) (citations omitted). A claim is facially plausible when
17 the facts alleged allow the court to “draw the reasonable inference that the defendant is liable for the
18 misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). Likewise, when considering
19 challenges to Article III standing pursuant to Rule 12(b)(1), the Court should construe Plaintiffs’
20 allegations as true. In re Google Referrer Header Privacy Litig., No. 10-04809, 2020 WL 3035796, at
21 *3-4 (N.D. Cal. June 5, 2020). As to Rule 9(b), the pleading standard “requires only that the
22 circumstances of fraud be stated with particularity.” United States v. Corinthian Colls., 655 F.3d 984,
23 992 (9th Cir. 2011). “Malice, intent, knowledge, and other conditions of a person’s mind may be alleged
24 generally.” Fed. R. Civ. P. 9(b). Further, the Rule 9(b) standard may be relaxed when fraud allegations
25 relate to matters particularly within the opposing party’s knowledge, such that a plaintiff cannot be
26 expected to have personal knowledge. See Neubronner v. Milken, 6 F.3d 666, 672 (9th Cir.1993).
27 II. Plaid Acted Without Plaintiffs’ Consent
28 Plaintiffs allege they did not consent to Plaid’s initial acquisition of their account credentials or
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
-5- CASE NO. 4:20-CV-03056-DMR
1 subsequent access to and use of their banking information. ¶¶ 1, 3, 32, 76, 107, 117, 127, 137, 147, 156,
2 165, 175, 185, 196, 205, 208, 226, 265, 315, 331, 346. Yet Plaid asserts consent as an overarching
3 defense to all of Plaintiffs’ claims, purportedly based upon the existence and terms of its privacy policy.
4 See MTD at 1, 3-5, 13, 16, 18, 27, 31-36. Plaid’s consent defense fails for multiple, independently-
5 sufficient reasons: (1) Plaid’s privacy policy is unenforceable; (2) even if it applied, it is inadequate to
6 establish knowing consent to Plaid’s conduct alleged; and (3) Plaid has failed to support its argument
7 with evidence that would be properly before the Court on this motion.3
8 A. Plaintiffs Were Not On Notice Of Plaid’s Privacy Policy
9 Plaid cannot and does not claim that Plaintiffs actually saw its privacy policy or manifested
10 agreement to its terms. A consumer cannot be bound by the terms of an online privacy policy unless—at
11 a minimum, among other requirements—those terms are so conspicuously displayed to put the consumer
12 on constructive notice of them. See Nguyen v. Barnes & Noble Inc., 763 F.3d 1171, 1178–79 (9th Cir.
13 2014) (“[T]he onus must be on website owners to put users on notice of the terms to which they wish to
14 bind consumers.”).
15 Here, Plaid operated in the deep background, soliciting bank login information through a
16 “familiar[]” process that gave the false impression that only trusted apps and banks were involved in the
17 account linking process. ¶ 41. To any reasonable consumer, it appeared that the App, not a third-party,
18 was linking their accounts to banks.4 ¶¶ 35-45. In Plaid’s process, it was never apparent that a data
19 aggregator was even present. Id. The law does not bind consumers to a purported contract of whose
20 existence the consumers were unaware, with a company of whose existence consumers are unaware, let
21 alone a contract granting that company unrestricted access to the sensitive information in consumer’s
22 3
Plaid seeks judicial notice of documents to support its consent-based arguments, but the policies it cites
23 are facially irrelevant to the issue of Plaintiffs’ knowledge and consent. This is because the policies
Plaid submitted were not in place at the various relevant dates when Plaid first accessed Plaintiffs’
24 information, including in March and June 2014, April and August 2015, July 2016, and January 2019. ¶¶
100, 111, 121, 130, 140, 150, 159, 168, 178, 188, 199. This alone provides sufficient basis to deny
25 Plaid’s motion on the issue of consent. See In re Facebook, Inc. Sec. Litig., 405 F. Supp. 3d 809, 831
(N.D. Cal. 2019) (“[J]udicial notice on the issue of user consent is not appropriate.”) (citation omitted);
26 see also Plaintiffs’ Opp. to Request for Judicial Notice, filed herewith.
4
Venmo users were presented with a screen stating “Venmo uses Plaid,” but the screen did not explain
27 that Plaid is a third-party independent of Venmo, rather than a service of Venmo, or the banks. ¶¶ 67-68.
Worse, some Apps make no Plaid-related consumer disclosures whatsoever through Plaid’s interface,
28 simply directing consumers to screens that appear to come from their banks. ¶ 66.
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
-6- CASE NO. 4:20-CV-03056-DMR
1 bank accounts.5 “[C]ontracts cannot be formed on the basis of stealth drafting.” Colgate v. JUUL Labs,
2 Inc., 402 F. Supp. 3d 728, 763 (N.D. Cal. 2019); see also McKee v. Audible, Inc., No. 17-1941, 2017
3 WL 4685039, at *10-11 (C.D. Cal. July 17, 2017) (“It is simply hard for the Court to imagine that a
4 reasonable consumer registering the Amazon Echo expects to be presented with terms of use governing
5 his or her contractual relationship with separate corporate entities, let alone one he or she has never
6 dealt with. . . . [n]o amount of hyperlinking . . . changes the reality of internet commerce: a consumer
7 agreeing to terms of use for his or her Echo cannot be reasonably expected to know they are giving up
8 the right to sue Audible.”). These principles apply in particular in the context of private financial
9 information, in light of (among other sources) the heightened disclosure requirements under the Gramm-
10 Leach-Bliley Act (“GLBA”). 16 C.F.R. § 313.3(b)(1)-(2) (requiring clear and conspicuous policies on
11 which consumers have actual and acknowledged notice).
12 Contrary to applicable law, Plaid failed to provide reasonable notice of the terms of its privacy
13 policy. Instead, Plaid effectively hid those terms, including by de-emphasizing the subtle hyperlink to its
14 privacy policy, which was not underlined or offset to give any indication that it was a hyperlink, and
15 used light grey font and a miniscule font size much smaller than other large, colorful, high-contrast
16 items on the screen. The hyperlink is difficult to see in the large screenshot within Plaintiffs’ CAC, let
17 alone on a mobile device, and there is no checkbox to assent to it, ensuring that it would be, and was,
18 overlooked. ¶¶ 67-69. “Given the breadth of the range of technological savvy of online purchasers,
19 consumers cannot be expected to ferret out hyperlinks to terms and conditions to which they have no
20 reason to suspect they will be bound.” Nguyen, 763 F.3d at 1179.
21 Even in disputes over the applicability of terms between known parties where the nature of the
22 interaction is clear, courts consistently have found that similarly inadequate notice rendered purported
23 contracts unenforceable. See, e.g., Colgate, 402 F. Supp. 3d at 764 (no consent by website visitors where
24 non-underlined hyperlink near “sign up” button was “not a different color, underlined, italicized, or in
25 any way visually distinct from the surrounding text”); Applebaum v. Lyft, Inc., 263 F. Supp. 3d 454, 467
26 (S.D.N.Y. 2017) (no consent by Lyft drivers where hyperlink was a different color but “there were no
27
5
Banking information is subject to particularly exacting, historically recognized, privacy protections.
28 See infra Arg. § VI-A.
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
-7- CASE NO. 4:20-CV-03056-DMR
1 familiar indicia to inform consumers that there was in fact a hyperlink that should be clicked and that a
2 contract should be reviewed”). Plaid has not come close to complying with the law.
3 B. Plaid’s Privacy Policy Would Not Establish Consent If It Were Disclosed
4 Even if Plaintiffs were on constructive notice of Plaid’s privacy policy, Plaid could not establish
5 consent to its specific conduct. The generic terms of Plaid’s hidden policy do not explain what Plaid
6 actually is, or does. Where a privacy policy is asserted as a defense, courts examine whether “a
7 reasonable user reading the privacy policy must have understood it to cover” the conduct at issue. In re
8 Google Assistant Privacy Litig., 457 F. Supp. 3d 797, 823 (N.D. Cal. 2020); Opperman v. Path, Inc.,
9 205 F. Supp. 3d 1064, 1072–73 (N.D. Cal. 2016) (“[C]onsent is only effective if the person alleging
10 harm consented ‘to the particular conduct, or to substantially the same conduct’” and if the alleged
11 tortfeasor did not exceed the scope of that consent.”) (citation omitted). Plaid’s vague and overly-general
12 privacy policy fails this standard. And in any case, the reasonable consumer standard “raises questions
13 of fact that are appropriate for resolution on a motion to dismiss only in rare situations.” Dinan v.
14 SanDisk LLC, No. 18-05420, 2020 WL 364277, at *7 (N.D. Cal. Jan. 22, 2020) (citation omitted).
15 Plaid highlights and re-emphasizes out-of-context snippets from the policy in a chart, but ignores
16 Plaintiffs’ allegations about the misleading and deceptive nature of the privacy policy on the whole.
17 ¶¶ 71, 74-76. Neither has Plaid established that its policy “accurately reflects” its practices, as required
18 under the GLBA. 16 C.F.R. §§ 313.4 & 313.5. The specific and prominent disclosures a reasonable
19 consumer would expect from a company acquiring access to their extremely private and sensitive bank
20 account data are nowhere found in Plaid’s generic policy. Here, a reasonable App user viewing the
21 policy would not understand that their private banking credentials and financial data were even at issue.
22 The policy strongly, and deceptively, suggests that App users’ banking data would not be
23 accessed by Plaid. To start, the policy states that Plaid collects consumers’ banking login information
24 only when they connect their accounts “through Plaid”—something consumers interacting with Apps
25 and bank login screens would be unaware was happening.6 Even that data collection, the policy says,
26
6
This reasonable inference is bolstered by another provision in Plaid’s current privacy policy, which
27 states that Plaid obtains information when consumers “connect to our services through a developer’s
application” about “which features within our services you access.” Dettmer Decl. Ex. A, at 4
28 (emphasis added). The typical experience of an App user does not permit them to choose from any Plaid
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
-8- CASE NO. 4:20-CV-03056-DMR
1 occurs “where applicable” (id. at 2), suggesting some frequency far lower than Plaid’s actual practice of
2 transmitting all consumer login information to itself, at all times. If, despite implicit and explicit
3 suggestions to the contrary, a Plaintiff had surmised that Plaid’s policy might apply to the account
4 connections they were making, they would still understand that they fell within the exception where any
5 collection of their login credentials was not “applicable” based on the more prominent statement in the
6 Apps that their “credentials will never be made accessible to” the App that used Plaid (¶¶ 67-68, 360). If
7 a consumer realized Plaid had accessed their accounts at all, they would also reasonably expect that
8 disconnecting their accounts from the App would terminate Plaid’s access (see MTD at 6, asserting that
9 consumers are told they can “turn off Venmo’s use of Plaid”), but disconnecting bank accounts from
10 Venmo does not disconnect them from Plaid, or cause Plaid to delete the data it already has. ¶ 55.
11 Furthermore, consistent with any common sense expectation where private banking data is
12 concerned, the policy can fairly be read to state that Plaid’s access to account data would have some
13 relationship to the function of the App to which financial accounts are being linked: “The information
14 we receive from the financial product and service providers that maintain your financial accounts [i.e.,
15 banks] varies depending on the specific Plaid services developers use to power their applications,
16 as well as the information made available by those providers.” Dettmer Decl. Ex. A, at 2-3 (emphasis
17 added). Because the Apps’ function of transferring funds has nothing to do with historical banking data,
18 address information, or the other private data beyond confirming that a consumer owns the linked
19 account, it is reasonable to expect that any “Plaid services” used by the Apps would not collect any data
20 beyond that needed to verify the account. This reasonable interpretation is further bolstered by the
21 policy’s statement that it collects EU citizens’ data “to fulfill [Plaid’s] responsibilities and obligations”
22 to consumers; and that it retains such information “for no longer than necessary to fulfill the purposes
23 for which it was collected and used.” This policy does not reasonably disclose that Plaid collects
24 banking data without reference to the “purpose” of the particular App at issue.7
25
“features,” so this reference suggests that connecting “through Plaid” is a different process.
7
26 No part of Plaid’s privacy policy mentions that Plaid is a data aggregator that will retain users’ banking
credentials; use them on an indefinite, ongoing basis to acquire forward- and backward-looking private
27 data about their purchases; or use and sell that and other data for its own benefit. See In re Facebook,
Inc., Consumer Priv. User Profile Litig. (“Facebook Consumer Privacy”), 402 F. Supp. 3d 767, 792
28 (N.D. Cal. 2019) (rejecting argument based on consent where policy did “not come close to disclosing
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
-9- CASE NO. 4:20-CV-03056-DMR
1 Plaintiffs’ interpretation is supported by material factual allegations, including that banks and
2 industry groups recognized the “lack of clarity and transparency” provided by data aggregators such as
3 Plaid regarding its collection and use of private data “isn’t fair or right.” ¶¶ 78, 80-81; see also ¶ 79
4 (“consumers are not given adequate information or control over what information is being taken, how
5 long it is accessible, and how it will be used in the future.”). Plaid’s contrary interpretation of its privacy
6 policy should be rejected on this motion. See Starr v. Baca, 652 F.3d 1202, 1216 (9th Cir. 2011) (if two
7 alternative plausible explanations exist, the plaintiff’s version should be followed at the motion to
8 dismiss stage). Plaid’s argument that Plaintiffs show “consent” by not alleging they asked Plaid to delete
9 their data (which Plaid asserts, without support, it would do upon request) is contradicted by Plaintiffs’
10 specific request for an order requiring Plaid to purge the data it has unlawfully collected. MTD at 7, 13;
11 Prayer for Relief D. At most, factual disputes about consent remain, and “[t]his is an issue for the jury.”
12 Opperman, 205 F. Supp. 3d at 1073.
13 III. Article III Is Satisfied
14 Plaid acquired Plaintiffs’ banking credentials in violation of established common law and
15 statutory protections, without consent, and used that private information to enrich itself. These
16 allegations satisfy standing, as shown below.
17 A. Plaid’s Privacy Invasions Establish Injury In Fact
18 Plaintiffs have standing to bring all claims asserted in this action because each relates to Plaid’s
19 invasion of their privacy rights. Such violations constitute “concrete and particularized injury” for
20 purposes of Article III. See Van Patten v. Vertical Fitness Grp., LLC, 847 F.3d 1037, 1043 (9th Cir.
21 2017) (“Actions to remedy defendants’ invasions of privacy . . . have long been heard by American
22 courts”). “It is beyond meaningful dispute that a plaintiff alleging invasion of privacy . . . presents a
23 dispute the Court is permitted to adjudicate.” Opperman, 87 F. Supp. 3d at 1057.
24 Contrary to Plaid’s incorrect suggestion, intangible injuries may be “concrete” and constitute
25 injury in fact. Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 1548 (2016). “To say that a ‘mere’ privacy
26 invasion is not capable of inflicting an ‘actual injury’ serious enough to warrant the attention of the
27
28 the massive information-sharing program” at issue).
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
- 10 - CASE NO. 4:20-CV-03056-DMR
1 federal courts is to disregard the importance of privacy in our society, not to mention the historic role of
2 the federal judiciary in protecting it.” Facebook Consumer Privacy, 402 F. Supp. 3d at 786 (citation
3 omitted) (privacy injury sufficient for SCA, California common law intrusion into private affairs,
4 constitutional right to privacy, negligence, deceit by concealment, breach of implied covenant of good
5 faith and fair dealing, unjust enrichment, and UCL claims, among others). Plaid relies on an inapposite
6 case, Cahen v. Toyota Motor Corp., wherein the cursory assertion, without support, that the Constitution
7 protected data about a vehicle's driving history, performance, and occasional location, did not pass
8 muster. 147 F. Supp. 3d 955, 971, 973 (N.D. Cal. 2015), aff’d, 717 F. App’x 720 (9th Cir. 2017). By
9 contrast, here, the manner, circumstances, and nature of Plaid’s privacy violations are alleged in detail,
10 and sensitive, protected information is at issue. Facts §§ I-III.
11 Plaid disputes Plaintiffs’ standing by claiming that Plaintiffs consented to or were informed of
12 (and failed to attempt to stop) Plaid’s practices. MTD at 13 (restating consent defense in another guise).
13 But its argument “improperly conflates the merits of Plaintiffs’ claims with their standing to bring suit.”
14 In re Vizio, Inc., Consumer Privacy Litig., 238 F. Supp. 3d 1204, 1216 (C.D. Cal. 2017). The “standing
15 analysis . . . [may not] be used to disguise merits analysis, which determines whether a claim is one for
16 which relief can be granted if factually true.” Catholic League for Religious & Civil Rights v. City &
17 Cnty. of San Francisco, 624 F.3d 1043, 1049 (9th Cir. 2010). Recently, as Judge Chhabria noted in
18 Facebook Consumer Privacy, “in virtually every privacy case, consent will be part of the merits inquiry.
19 Because courts presume success on the merits when evaluating standing, these are not standing issues
20 in privacy cases.” 402 F. Supp. 3d at 788 (emphasis added); see also Campbell v. Facebook, Inc., 951
21 F.3d 1106, 1119 n.9 (9th Cir. 2020) (argument that Plaintiffs consented to the use of URL data was a
22 “merits arguments in disguise” that “tell[s] us nothing about whether Plaintiffs had standing to bring the
23 case in the first place”).
24 B. Plaid’s Statutory Violations Establish Injury In Fact
25 Plaintiffs also have standing to bring their claims under the CFAA, CDAFA, SCA, and CAPA
26 for the additional reason that those statutes afford them that right. Where the legislature codifies a
27 statutory right that protects against “the risk of real harm,” a plaintiff need not “allege any additional
28 harm beyond the one identified by Congress.” Spokeo, 136 S. Ct. at 1544. See also Matera v. Google,
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
- 11 - CASE NO. 4:20-CV-03056-DMR
1 Inc., No. 15-4062, 2016 WL 5339806, at **9, 14 (N.D. Cal. Sept. 23, 2016).
2 Congress and the California legislature granted citizens the means to enforce a right to privacy
3 with respect to electronically stored information (CFAA, CDAFA, SCA), and solicitation of the same
4 (CAPA). These statutes protect consumers, respectively, from unauthorized access to computers housing
5 private information, at the federal level (see ¶¶ 270-98)8 and in California (¶¶ 364-78);9 from
6 unauthorized access to stored information itself (¶¶ 299-312);10 and from using deceit to solicit personal
7 information from another person online (¶¶ 349-55).11 Plaid’s unauthorized solicitation, access,
8 collection, and distribution of Plaintiffs’ electronically stored private financial information “present the
9 precise harm and infringe the same privacy interests” the legislatures sought to protect. Van Patten, 847
10 F.3d at 1043. These statutes’ protections are an extension of traditional common law and Constitutional
11 principles, applied by the legislature to the context of electronically stored and transmitted information.
12 See Facebook Internet Tracking, 956 F.3d at 599 (“Advances in technology can increase the potential
13 for unreasonable intrusions into personal privacy”) (citation omitted). Thus, Plaid’s violation of these
14 statutes gives rise to a concrete injury sufficient to confer standing. See Spokeo, 136 S. Ct. at 1548.
15
16
17
8
In addition to “computer crime” such as “trespass,” Congress passed the CFAA to address “privacy
18 protections.” S. Rep. 99-432 at 2484 (1986); Congress reaffirmed this purpose by amending the CFAA
in 1996 to fill in “gaps” in “privacy protection coverage.” S. Rep. 104-357, at *4 (1996). See also
19 Vasileios Karagiannopoulos, From Morris to Nosal: The History of Exceeding Authorization and the
Need for a Change, 30 J. Marshall J. Info. Tech. & Privacy L. 465, 467 (2014) (“[A]mendments to the
20 CFAA have expanded its scope in parallel with the increasing importance of computer systems and
information contained in them to protect the privacy of information”). For example, 1030(a)(2) was
21 amended specifically to “increase protection for the privacy and confidentiality of computer
information” S. Rep. 104-357, at *7 (1996) (emphasis added).
22 9
See Cal. Pen. Code § 502(a) (legislative intent is to “expand the degree of protection afforded to
individuals . . . protection of the integrity of all types and forms of lawfully created computers, computer
23 systems, and computer data is vital to the protection of the privacy of individuals”)(emphasis added).
10
24 The SCA “codif[ies] a substantive right to privacy.” Facebook Internet Tracking, 956 F.3d at 598
(citing Campbell, 951 F.3d at 1117-19); id. (citing S. Rep. No. 99-541, at 3 (1986) (the SCA was
25 “modeled after the Right to Financial Privacy Act, 12 U.S.C. §§ 3401 et seq. to protect privacy interests
in personal and proprietary information . . . .”)). See also Google Referrer Header Privacy, 2020 WL
26 3035796, at *7 (SCA “reflects Congress’s judgment that users have a legitimate interest in the
confidentiality of communications in electronic storage”) (citation omitted).
11
27 CAPA’s history shows that lawmakers were concerned with protecting consumers from requests for
personal information by entities impersonating other businesses whose reputations and customer
28 relationships would provide comfort to consumers in providing such data. See infra Arg. § VI-E).
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
- 12 - CASE NO. 4:20-CV-03056-DMR
1 C. Plaintiffs Have Standing To Seek Disgorgement Of Plaid’s Unjustly-Earned Profits
2 Plaintiffs also have standing to recover the equitable relief they seek12 due to Plaid’s gains
3 achieved through its violations of their dignitary rights, invasions of their privacy, and illicit use of their
4 private information. “California law recognizes a right to disgorgement of profits resulting from unjust
5 enrichment, even where an individual has not suffered a corresponding loss.” Facebook Internet
6 Tracking, 956 F.3d at 599-600 (citations omitted).
7 The Ninth Circuit has explained that “an entitlement to unjustly earned profits” sufficient to
8 confer Article III standing for California state law claims is established where plaintiffs allege that “they
9 retain a stake in the profits garnered from their personal [data] because ‘the circumstances are such that,
10 as between the two [parties], it is unjust for [defendant] to retain it.’” Id. at 600 (holding that Article III
11 was satisfied on this basis as to claims for, inter alia, common law fraud and violations of the CDAFA)
12 (citation omitted). In In re Facebook, that was established through allegations that Facebook profited by
13 selling the plaintiffs’ internet browsing history data.
14 Here, Plaintiffs allege that Plaid has built a very successful business, generating tens of millions
15 of dollars annually, by deceiving Plaintiffs to collect, use, and sell their data to companies such as the
16 Apps. Supra Facts §§ A-C. These allegations are “sufficient at the pleading stage to demonstrate that
17 [Plaid’s] profits were unjustly earned.” Facebook Internet Tracking, 956 F.3d at 601. See also Google
18 Referrer Header Privacy, 2020 WL 3035796, at *10 (allegations that Google profited from disclosing
19 plaintiffs’ search terms to its advertisers without their consent and despite promises to the contrary
20 “‘sufficiently alleged a state law interest whose violation constitutes an injury sufficient to establish
21 standing’” (quoting Facebook Internet Tracking, 956 F.3d at 601).
22 D. Plaintiffs’ Economic Injury Is Well-Pled
23 Plaintiffs’ allegations of economic injury—specifically, loss of indemnification rights; loss of
24 regulatory protections over personal financial data; loss of control over personal data; increased risk of
25 identity theft and fraud, and corresponding need to expend time and resources—although not required,
26
12
27 See ¶ 268 (Intrusion); ¶ 325 (unjust enrichment); ¶ 347 (Cal. Constitution); ¶ 355 (CAPA); ¶ 363
(Deceit); ¶ 378 (CDAFA). Plaintiffs, as the owners of the data at issue, also have standing to seek, inter
28 alia, disgorgement of that data by Plaid under the UCL. ¶ 336.
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
- 13 - CASE NO. 4:20-CV-03056-DMR
1 provide independent additional grounds to support standing. Plaid’s arguments in response fail.
2 First, Plaid argues that Plaintiffs’ claims of economic injury are conjectural. However, under
3 Ninth Circuit law, a risk of future identity theft can constitute an injury in fact. In re Zappos.com, Inc.,
4 888 F.3d 1020 (9th Cir. 2018); Krottner v. Starbucks Corp., 628 F.3d 1139 (9th Cir. 2010). Plaid’s
5 citation to Katz v. Pershing LLC, 672 F.3d 64, 70 (1st Cir. 2012), which is non-governing law that has
6 been expressly contrasted to Ninth Circuit law,13 is misplaced. Plaintiffs are not required to wait until the
7 harms materialize before filing suit. See also In re iPhone Application Litig., 844 F. Supp. 2d 1040,
8 1054 (N.D. Cal. 2012) (injury properly alleged based on “increased, unexpected, and unreasonable risk
9 to the security of [plaintiffs’] sensitive personal information,” where plaintiffs alleged that defendant
10 communicated their data to third parties without consent). Plaid is a particularly attractive target for a
11 data breach: it has the banking information of one in four people with a U.S. bank account, (¶ 57), and
12 the ABA has acknowledged the outsized security risks that Plaid faces. ¶ 79(f) (noting that “the sheer
13 volume and value of the aggregated data make data aggregators a priority target for criminals, including
14 identity thieves”). Plaid’s cases are inapposite because they involved significantly less sensitive data,
15 such as names, drivers’ licenses, and anonymous social media browsing history—nothing like the
16 consolidated banking data and access credentials of millions of financial accounts—and the
17 circumstances were otherwise different. MTD at 11. Plaintiffs’ mitigation measures are justified. As to
18 indemnification, Plaintiffs’ allegation is not that they “could” lose indemnification rights, as Plaid
19 suggests (id.); it is that they have lost them, and they are presently-possessed personal property rights.
20 See Singer Co. v. Superior Court, 179 Cal. App. 3d 875, 890 (1986) (describing the loss of partial
21 indemnity as a deprivation of a “property right”); see also Beltran v. United States, 441 F.2d 954, 960-
22 61 (7th Cir. 1971) (recognizing the loss of a right to indemnification as a loss of personal property).
23 Second, Plaid claims Plaintiffs do not specifically identify which regulatory protections they lost
24 due to Plaid’s conduct. MTD at 10. Yet Plaintiffs’ allegation—that Plaid’s removal of their data from
25 the secure banking environment stripped it of regulatory safeguards—is supported by a February 2017
26 response from the ABA to an RFI from the CFPB recognizing the loss of these protections, and thus is
27
13
See Wilding v. DNC Servs., No. 16-61511, 2017 WL 6345492, at *7 (S.D. Fla. Aug. 25, 2017), aff’d,
28 941 F.3d 1116 (11th Cir. 2019) (contrasting Krottner and Katz).
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
- 14 - CASE NO. 4:20-CV-03056-DMR
1 more than sufficient at this stage to “plausibly” allege injury based on this loss. ¶¶ 215-24. See
2 Zappos.com, 888 F.3d at 1022 (“[C]ontentions about the absence of certain facts . . . may be appropriate
3 for summary judgment” but not “at the motion to dismiss stage.”).
4 Third, although Plaid suggests otherwise, courts nationwide have recognized that loss of control
5 over one’s personally identifying information constitutes a cognizable harm sufficient to confer
6 standing. See In re Marriott Int’l, Inc., Customer Data Sec. Breach Litig., 440 F. Supp. 3d 447, 461 (D.
7 Md. 2020) (“[T]he growing trend across courts that have considered this issue is to recognize the lost
8 property value of [PII].” (citing cases)); accord State v. Mayze, 622 S.E.2d 836, 841 (Ga. 2005)
9 (“identity fraud is an offense against the victim’s possessory interest in his or her personal
10 information”). As the Ninth Circuit has held, the loss of value of such information gives rise to damages,
11 irrespective of whether the plaintiffs participated in the market for personal information. In re Facebook
12 Privacy Litig., 572 F. App’x 494 (9th Cir. 2014); see also Svenson v. Google Inc., No. 13-04080, 2016
13 WL 8943301, at *9 (N.D. Cal. Dec. 21, 2016) (mobile app user plaintiff alleged injury-in-fact based on
14 diminution of value of PII disseminated by Google to third parties). The lone case cited by Plaid, In re
15 Google, Inc. Privacy Policy Litig., pre-dated Facebook Privacy, and does not alter the analysis here. No.
16 12-01382, 2013 WL 6248499, at *5 (N.D. Cal. Dec. 3, 2013). The allegations are sufficient: Plaid’s
17 merits-based challenges to Plaintiffs’ injury-in-fact must await a full record.
18 E. Plaintiffs’ Injuries Are “Fairly Traceable” To Plaid’s Conduct, And Redressable
19 Plaid’s argument that Plaintiffs’ injuries are not “fairly traceable” to its misconduct because
20 Plaintiffs do not allege linking a bank account through Plaid is erroneous, as discussed supra, Facts § II.
21 Plaintiffs’ allegations suffice to establish a causal nexus between Plaid’s conduct and their injuries.
22 With respect to redressability, courts have consistently recognized that violation of privacy rights
23 can be redressed by an award of damages, i.e., such remedy provides more than “psychic satisfaction,”
24 MTD at 14-1514 See Facebook Consumer Privacy, 402 F. Supp. 3d at 784 (“[T]he Ninth Circuit has
25
14
26 In the case cited by Plaid, Steel Co. v. Citizens for a Better Environment, the Supreme Court held that
because the civil penalties authorized by the statute at issue were payable to the United State Treasury,
27 the plaintiff-respondent “seeks not remediation of its own injury . . . but vindication of the rule of
law . . .” 523 U.S. at 106. There is no comparable concern at issue here, where the statutory damages
28 would be paid to Plaintiffs for remediation of their injury.
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
- 15 - CASE NO. 4:20-CV-03056-DMR
1 repeatedly explained that intangible privacy injuries can be redressed in the federal courts.”). The
2 injunctive relief sought by Plaintiffs—inter alia, deleting existing data and terminating Plaid’s practice
3 of harvesting and profiting from user’s personal financial data—would redress future harms suffered by
4 Plaintiffs. See Jewel v. Nat’l Sec. Agency, 673 F.3d 902, 912 (9th Cir. 2011) (ruling that there was “no
5 real question about redressability” when a plaintiff sought “an injunction and damages, either of which
6 is an available remedy”). Plaintiffs thus “easily meet[] the third prong of the standing requirement.” Id.15
7 IV. Plaintiffs’ Claims Are Timely
8 Plaid does not challenge the allegations that are plainly within the statutes of limitations,
9 including as to the multiple Plaintiffs whose data Plaid first took within the last couple of years, or the
10 fact that Plaid continues to pull data to this day from Plaintiffs regardless of when the misconduct began.
11 Each discrete breach by Plaid of its continuing obligations “may be treated as an independently
12 actionable wrong with its own time limit for recovery.” Aryeh v. Canon Bus. Sols., Inc., 55 Cal. 4th
13 1185, 1199 (2013). Each time Plaid updates its cache of Plaintiffs’ data, and/or monetizes the data, it
14 commits a discrete, independently actionable wrong. ¶¶ 59-65
15 To the extent Plaid challenges the timeliness of some claims—its argument is vague—based on
16 the fact that certain Plaintiffs first had their data taken by Plaid as far back as 2014 (e.g., ¶ 150), this
17 argument fails. Plaintiffs’ claims are subject to the “discovery rule,” i.e., the rule that accrual of a cause
18 of action is postponed “until the plaintiff discovers, or has reason to discover, the cause of action.” Fox
19 v. Ethicon Endo-Surgery, Inc., 35 Cal. 4th 797, 807 (2005); Mangum v. Action Collection Serv., Inc.,
20 575 F.3d 935, 940 (9th Cir. 2009); 18 U.S.C. § 1030(g) (CFAA discovery rule); 18 U.S.C. § 2707(f)
21 (SCA discovery rule). “A plaintiff has reason to discover a cause of action when he or she has reason at
22 least to suspect a factual basis for its elements.” Fox, 35 Cal. 4th at 807 (citation omitted). “Resolution
23 of the statute of limitations issue is normally a question of fact.” Id. at 810.
24 Plaintiffs allege that when they linked their bank accounts they were unaware of the existence or
25
15
26 Finally, Plaid does not dispute Plaintiffs’ standing to pursue injunctive relief. This requires showing
“either continuing, present adverse effects’ due to their exposure to [Plaid’s] past illegal conduct or a
27 sufficient likelihood that they will again be wronged in a similar way.” Campbell v. Facebook, Inc., 951
F.3d 1106, 1120 (9th Cir. 2020) (internal quotation marks and alterations omitted). Plaintiffs allege
28 Plaid’s ongoing retention, use, and sharing of the data it collects.
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
- 16 - CASE NO. 4:20-CV-03056-DMR
1 role of Plaid; unaware of providing login credentials to Plaid; and unaware that Plaid would collect,
2 receive, store, use, and sell their banking information. ¶¶ 100-207. Plaintiffs’ allegations make clear that
3 they did not uncover Plaid’s misconduct until recently. ¶ 241. Plaintiffs further allege that they “could
4 not have learned through the exercise of reasonable diligence of Plaid’s conduct,” ¶ 243, and the covert
5 and deceptive nature of Plaid’s operations lends ample support to this assertion. ¶¶ 26-77. Accordingly,
6 Plaintiffs have adequately alleged that the applicable statutes of limitations did not begin to accrue until
7 recently—certainly less than two years prior to filing—and that their claims are therefore timely.
8 In addition, or in the alternative, Plaid’s fraudulent concealment tolls the statutes of limitations
9 given that Plaid hid its misconduct, and Plaid is estopped from asserting them. See Hexcel Corp. v. Ineos
10 Polymers, Inc., 681 F.3d 1055, 1060 (9th Cir. 2012) (“A statute of limitations may be tolled if the
11 defendant fraudulently concealed the existence of a cause of action in such a way that the plaintiff,
12 acting as a reasonable person, did not know of its existence.”); Britton v. Girardi, 235 Cal. App. 4th 721,
13 734 (2015) (estoppel applies). Plaintiffs allege in detail Plaid’s misleading statements and intentional
14 concealment that continued up to and beyond the time the initial complaint was filed. While Plaid denies
15 on the merits that it concealed the true facts of its conduct, this factual defense is premature.
16 V. Plaintiffs’ Equitable Claims Are Not Barred By Remedies at Law
17 Plaid asserts that Plaintiffs’ claims for unjust enrichment and under the UCL, and requested
18 equitable remedies under all claims, are barred by the existence of an adequate remedy at law. MTD at
19 17. This is premature and ignores the remedies to which Plaintiffs are entitled under the applicable
20 statutes (and that serve a distinct purpose that damages will not redress).
21 First, remedies at law alone would not make Plaintiffs whole. Plaintiffs seek to compel Plaid to
22 take prospective action to protect consumers from future privacy invasions, including to “cease its
23 misconduct, purge the data it has unlawfully collected, notify consumers of its misconduct, and inform
24 consumers of the steps they can take to protect themselves from further invasions.” ¶ 7. These are
25 paradigmatic examples of prospective relief to address an ongoing harm, which money damages cannot
26 adequately address. See, e.g., LSH CO v. Transamerica Life Ins. Co., No. 18-09711, 2019 WL 3064422,
27 at *15 (C.D. Cal. Mar. 20, 2019) (“Even if the monetary compensation that may be found . . . would
28 properly compensate the alleged [unlawful conduct], Plaintiffs properly allege facts to show the
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
- 17 - CASE NO. 4:20-CV-03056-DMR
1 necessity of an injunction to counter the threat of continuing misconduct.”).16
2 Second, Plaintiffs seek declaratory relief that would clarify and define the scope of Plaintiffs’
3 and Class members’ rights under the relevant statutory and common law, including Plaid’s obligations
4 to transparently disclose to consumers the scope and nature of its practices. E.g., ¶¶ 310, Prayer for
5 Relief C. Federal Rule 57 provides that “[t]he existence of another adequate remedy does not preclude a
6 declaratory judgment that is otherwise appropriate.” Fed. R. Civ. P. 57; see also id., 1937 Advisory
7 Committee Notes (“[T]he fact that another remedy would be equally effective affords no ground for
8 declining declaratory relief.”). Ultimately, the “critical question is whether the declaratory relief ‘will
9 serve a useful purpose in clarifying and settling the legal relations in issue.’” T. K. v. Adobe Sys. Inc.,
10 No. 17-04595, 2018 WL 1812200, at *12–13 (N.D. Cal. Apr. 17, 2018) (citation omitted). Plaid
11 possesses and profits from personal financial data from over 200 million unique accounts, and it
12 continues to add data from those and new, unsuspecting users each day. Defining Plaid’s prospective
13 legal obligations cannot be achieved through monetary damages.
14 Third, none of Plaid’s authority permits, let alone requires, a District Court to override clear
15 direction from Congress in providing a statutory right to equitable relief under the CFAA and SCA. See
16 Sonner v. Premier Nutrition Corp., 971 F.3d 834, 842 (9th Cir. 2020).
17 Fourth, Plaid offers nothing to support its assertion that any of the legal remedies Plaintiffs seek
18 are “plain, adequate, and complete.” Plaintiffs seek equitable disgorgement and restitution precisely
19 because they are well-supported by the facts of this action, and damages tethered to individual losses
20 may be incomplete. See id. at 844 n.8; Am. Life Ins. Co. v. Stewart, 300 U.S. 203, 214 (1937) (“A
21 remedy at law does not exclude one in equity unless it is equally prompt and certain and in other ways
22 efficient.”). In this case, the fact question of whether other remedies are complete and equally efficient
23 for the Class will turn on the resolution of questions regarding Plaid’s profits, revenues, competitive
24 advantage, and other valuable benefits derived from Plaintiffs’ and Class members’ data, and concerning
25 the extent and manifestations of the harm Plaid has caused. Plaid’s authority confirms that its argument
26 is premature. Cf. Sonner, 971 F.3d at 837-38 (affirming dismissal of CLRA claim for equitable
27
16
Contrary to Plaid’s suggestion (MTD at 17), the law does not require recitation of the words “damages
28 are inadequate.” Plaintiffs plead facts showing no adequate remedy at law exists, which is sufficient.
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
- 18 - CASE NO. 4:20-CV-03056-DMR
1 restitution “[o]n the brink of trial after more than four years of litigation,” and after plaintiff defeated
2 summary judgment on the alternative legal claim).17
3 Plaid’s reference to court opinions that have dismissed claims for equitable relief at the pleading
4 stage are distinguishable, and are against the weight of authority. While “[a] few federal courts seem to
5 have decided that claims for equitable relief should be dismissed at the pleading stage if the plaintiff
6 manages to state a claim for relief that carries a remedy at law,”18 most courts have concluded that there
7 is “no basis in California or federal law for prohibiting the plaintiffs from pursuing their equitable claims
8 in the alternative to legal remedies at the pleadings stage.” Adkins v. Comcast Corp., No. 16-05969,
9 2017 WL 3491973, at *3 (N.D. Cal. Aug. 1, 2017). In fact, the Ninth Circuit has held that allowing a
10 plaintiff to plead an equitable remedy that is “duplicative of or superfluous to” a plaintiff’s other claims
11 is supported by the Federal Rules, and does not warrant dismissal. Astiana v. Hain Celestial Grp., Inc.,
12 783 F.3d 753, 762–63 (9th Cir. 2015). Similarly, courts in this district have concluded that “those
13 decisions allowing claims for equitable relief to proceed as an alternative remedy, at the pleading stage”
14 better reflect “the broad remedial purposes of the California consumer protection statutes.” Luong v.
15 Subaru of Am., Inc., No. 17-03160, 2018 WL 2047646, at *7 n.6 (N.D. Cal. May 2, 2018) (denying
16 dismissal of plaintiff’s UCL claim, notwithstanding adequacy of remedies at law). Otherwise stated,
17 “alternative remedial requests should be dealt with at the end of a case, not the beginning.” Wildin v.
18 FCA US LLC, No. 17-02594, 2018 WL 3032986, at *7 n.4 (S.D. Cal. June 19, 2018). Ultimately,
19 Plaintiffs “may be required to make an election of remedies if [they] prevail[] on multiple claims.”
20 Thompson v. Transamerica Life Ins. Co., No. 18-05422, 2018 WL 6790561, at *13 (C.D. Cal. Dec. 26,
21 2018). But this is not the time for such an election.19
22 17
Indeed, Sonner—cited multiple times by Plaid—is uniquely inapposite to the facts of this case.
“[L]ess than two months before trial,” the plaintiff “voluntarily dismissed her sole state law damages
23 claim and chose to proceed with only state law equitable claims for restitution and injunctive relief.” 971
F.3d at 837-38. The Ninth Circuit was particularly troubled by the plaintiff’s attempt “to try the class
24 action as a bench trial rather than to a jury” so close to the trial date. Id. at 837. Further, plaintiff sought
“the same sum in equitable restitution” as “she requested in damages to compensate her for the same
25 past harm.” Id. at 844. None of that holds true here.
18
26 In Philips v. Ford Motor Co., injunctive relief claims were dismissed where the plaintiffs did not
contest that adequate legal remedies were available. No. 14-02989, 2015 WL 4111448, at *16 (N.D.
27 Cal. July 7, 2015) (plaintiffs did “not even address the issue”), aff’d, 726 F. App’x 608 (9th Cir. 2018).
19
While Plaintiffs concede Count 4 should be dismissed as a standalone cause of action, there is no
28 basis to dismiss Plaintiffs’ requests for declaratory and injunctive relief, predicated on other causes of
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
- 19 - CASE NO. 4:20-CV-03056-DMR
1 VI. Plaid’s Rule 12(b)(6) Arguments Have No Merit
2 A. Plaintiffs Properly Plead Claims Under The California Constitution And For
Common Law Invasion Of Privacy-Intrusion Into Private Affairs
3
Plaintiffs adequately allege that Plaid’s conduct (supra, Facts § I-II) violated Plaintiffs’
4
reasonable expectations of privacy in a highly offensive manner, stating claims for invasion of privacy
5
under the California Constitution and under the California common law. Because the tests for these two
6
claims are similar, “courts consider the claims together and ask whether: (1) there exists a reasonable
7
expectation of privacy, and (2) the intrusion was highly offensive.” Facebook Internet Tracking, 956
8
F.3d at 601 (citing Hernandez v. Hillsides, Inc., 47 Cal. 4th 272, 287 (2009)). Both issues present
9
“mixed questions of law and fact.” Opperman, 87 F. Supp. 3d at 1059 (citing Hill v. NCAA, 7 Cal. 4th 1,
10
40 (1994)). Thus, these claims may only be disposed as a matter of law if the undisputed material facts
11
show no reasonable expectation of privacy or an insubstantial impact on privacy interests. See id. Plaid
12
has failed to make that showing.
13
Plaintiffs plead a reasonable expectation of privacy. The types of information Plaid collected—
14
login credentials, account numbers, and detailed financial records—are clearly those in which
15
consumers have a reasonable expectation of privacy. See United States v. Cotterman, 709 F.3d 952, 964
16
(9th Cir. 2013) (noting that financial records are reasonably “expected to be kept private”). The
17
reasonableness of this expectation is reflected in longstanding custom and practice, security measures
18
intended to prevent unauthorized access to banking account information, laws protecting a right to
19
financial privacy, and assurances of protection by applications that use Plaid. See ¶ 272. In this case, it is
20
not only the data itself that gives rise to these expectations, but also the amount of data at issue, a
21
volume sufficiently comprehensive that it allows Plaid to generate detailed profiles of consumers’ lives,
22
habits, associations, and activities. ¶¶ 50, 64, 266-268, 345; Cal. Bankers Ass’n v. Shultz, 416 U.S. 21,
23
89-90 (1974) (Douglas, J., dissenting) (“One’s bank accounts are within the ‘expectations of privacy’
24
category. For they mirror not only one’s finances but his interests, his debts, his way of life, his family,
25
and his civic commitments, . . . [They] may well record a citizen’s activities, opinion, and beliefs as
26
fully as transcripts of his telephone conversations.”); Patel v. Facebook, Inc., 932 F.3d 1264, 1273 (9th
27
28 action. See ¶¶ 297, 310, 336-37, 355, 378; Prayer for Relief C, D.
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
- 20 - CASE NO. 4:20-CV-03056-DMR
1 Cir. 2019) (where “vast quantities of personal information” are involved, “[t]echnological advances
2 provide ‘access to a category of information otherwise unknowable,’ and ‘implicate privacy concerns’”
3 in new and different ways) (quoting Riley v. California, 573 U.S. 373, 393 (2014)). Plaid’s acts violated
4 reasonable and well-established expectations shared across society.
5 Plaid asserts that Plaintiffs (and presumably the millions of class members) are somehow unlike
6 typical consumers for whom these expectations are reasonable. This assertion is based entirely on
7 Plaid’s disregarding the Plaintiffs’ allegations, and on the same legally and factually flawed consent
8 arguments it raises throughout its motion. Plaid’s merits defenses do not establish that Plaintiffs’ privacy
9 expectations were unreasonable as a matter of law.
10 Plaid’s intrusions were highly offensive. Plaintiffs also satisfy the second prong for pleading
11 these privacy claims. “Determining whether a defendant’s actions were ‘highly offensive to a reasonable
12 person’ requires a holistic consideration of factors such as the likelihood of serious harm to the victim,
13 the degree and setting of the intrusion, the intruder’s motives and objectives, and whether countervailing
14 interests or social norms render the intrusion inoffensive.” Facebook Internet Tracking, 956 F.3d at 606
15 (citation omitted). This requires a fact-intensive inquiry that “examines all of the surrounding
16 circumstances.” Hernandez, 47 Cal. 4th at 295. Such an inquiry cannot be conducted at the motion to
17 dismiss stage where, as here, there are open factual questions regarding “the degree and setting of the
18 intrusion, the intruder’s motives and objectives, and whether countervailing interests or social norms
19 render the intrusion inoffensive.” Facebook Internet Tracking, 956 F.3d at 606. Those questions are best
20 left for a trier of fact, with a full record.
21 Plaintiffs more than adequately plead that Plaid’s conduct was highly offensive (or, at a
22 minimum, the offensiveness presents a question for the finder of fact). The Apps provide money transfer
23 services, enabling users to send and receive money from their financial accounts. ¶ 31. By inserting
24 itself into the account linking process, Plaid secretly accessed, stored, and sold data about every
25 financial transaction Plaintiffs made, over a period of years, through any account that could be accessed
26 using the credentials Plaid obtained. Supra, Facts § I-III. Even if Plaintiffs had known Plaid was present
27 (which they did not), Plaid’s extraordinary intrusions—far exceeding anything reasonably related to
28 verifying an account or sending and receiving funds—would still be unexpected, excessive, and
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
- 21 - CASE NO. 4:20-CV-03056-DMR
1 offensive. Its intrusions also violate industry norms. ¶¶ 78-97. In circumstances less plainly egregious
2 than this, courts have consistently held that collection of intimate or sensitive personally identifiable
3 information may amount to a highly offensive intrusion. See, e.g., In re Vizio, 238 F. Supp. 3d at 1233.
4 Plaintiffs’ allegations concerning how Plaid obtained their data, i.e., by representing itself to be
5 trusted financial institutions and hiding its involvement as a third-party, further underscores the
6 offensive and misleading nature of Plaid’s practices. “[D]eceit can be a ‘kind of “plus” factor [that is]
7 significant in establishing an expectation of privacy or making a privacy intrusion especially offensive.’”
8 Heeger v. Facebook, Inc., No. 18-06399, 2019 WL 7282477, at *4 (N.D. Cal. Dec. 27, 2019) (quotation
9 omitted); see also In re Google Inc. Cookie Placement Consumer Privacy Litig., 806 F.3d 125, 150-51
10 (3d Cir. 2015) (“What is notable about this case is how Google accomplished its tracking . . . .
11 Characterized by deceit and disregard, the alleged conduct raises different issues than tracking or
12 disclosure alone.”) (applying California law).
13 None of Plaid’s authorities hold or even imply that the conduct alleged here is inoffensive—it
14 plainly is not. Plaid’s cited cases involve defendants that compiled far less sensitive information, in both
15 scope and content, than here. See Folgelstrom v. Lamps Plus, Inc., 195 Cal. App. 4th 986, 992 (2011)
16 (defendant engaged in “routine commercial behavior” by requesting zip codes to procure home address
17 to mail marketing materials); Low v. LinkedIn Corp., 900 F. Supp. 2d 1010, 1025 (N.D. Cal. 2012)
18 (anonymized LinkedIn ID and URL data, disclosing browsing history among LinkedIn profiles); In re
19 iPhone Application Litig., 844 F. Supp. 2d 1040, 1050 (N.D. Cal. 2012) (collection of sporadic location
20 data and basic personal information by developers from mobile devices). Those cases simply cannot be
21 compared to the multi-year, expansive, deeply personal privacy invasions involving sensitive data
22 alleged here. See also Opperman, 205 F. Supp. 3d at 1078-79 (distinguishing Folgelstrom because it did
23 not involve the surreptitious theft or any data “more private than a person’s mailing address,” and
24 criticizing In re iPhone for failing to “explain how expansion of Folgelstrom’s holding, counter to the
25 privacy interests of iDevice users, was consistent with California’s privacy norms.”). See also ¶¶ 262-
26 65, 342-46. Accordingly, the Court should reject Plaid’s argument that its actions were not, as a matter
27 of law, sufficiently serious. See Facebook Internet Tracking, 956 F.3d at 606 (concluding that
28 “Plaintiffs’ allegations of surreptitious data collection when individuals were not using Facebook are
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
- 22 - CASE NO. 4:20-CV-03056-DMR
1 sufficient to survive a dismissal motion” on whether Facebook’s “[data] collection practices could
2 highly offend a reasonable individual”).
3 B. Plaintiffs Have Properly Pleaded Claims Under The UCL
4 Plaid raises several arguments against Plaintiffs’ UCL claims, but none have merit.
5 Plaintiffs lost money or property. Under the UCL’s “lost money or property” requirement, a
6 plaintiff must show “‘some form of economic injury’” such as “‘having a present or future property
7 interest diminished.’” Gonzales v. Uber Techs., Inc., 305 F. Supp. 3d 1078, 1093 (N.D. Cal. 2018)
8 (quoting Kwikset Corp. v. Superior Ct., 51 Cal. 4th 310, 323 (2011)). “‘At the pleading stage, general
9 factual allegations of injury resulting from the defendant’s conduct may suffice.’” Id. (quoting Kwikset,
10 51 Cal. 4th at 327).
11 Unlike the cases cited by Plaid, Plaintiffs have not alleged the loss of information such as their
12 names and addresses (see Archer v. United Rentals, Inc., 195 Cal. App. 4th 807, 813, 816 (2011)) or the
13 content of Facebook messages (see Campbell v. Facebook, 77 F. Supp. 3d 836, 849 (N.D. Cal. 2014).
14 As discussed supra, Facts § III, Plaintiffs have suffered economic injuries (i.e., lost money or property),
15 including in the form of lost indemnity rights that existed when Plaintiffs’ data was held at their banks.
16 Those economic injuries are sufficient to survive a pleadings challenge. See Gonzales, 305 F. Supp. 3d
17 at 1093 (allegations that Uber intercepted private communications satisfied the lost money or property
18 requirement when combined with allegations that the communications were used to reduce the supply of
19 drivers, thereby increasing wait times and ultimately decreasing drivers’ earnings).
20 In addition, Plaintiffs have alleged that they would not have connected their bank accounts to the
21 Apps the way they did (for the purpose of transferring money) if they had known the truth about Plaid’s
22 role and its practices. See, e.g., ¶¶ 105, 116. Those allegations also establish standing under the UCL.
23 See Romero v. Securus Techs., Inc., 216 F. Supp. 3d 1078, 1091 (S.D. Cal. 2016) (allegations that the
24 plaintiffs “would not have paid for and used” a telephone system had they known the calls were being
25 recorded was sufficient for lost money or property element).
26 Plaid’s “unlawful” business practices: Plaid’s conduct is “unlawful” under the UCL because it
27 violated the following statutes and regulations: (1) CFAA; (2) SCA; (3) CDAFA; (4) CAPA; (5) Cal.
28 Civ. Code § 1709; (6) Article 1, § 1 of the California Constitution; (7) CalFIPA, Cal. Fin. Code § 4051,
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
- 23 - CASE NO. 4:20-CV-03056-DMR
1 et seq. ; (8) CalOPPA, Cal. Bus. & Prof. Code § 22575, et seq.; and (9) the GLBA’s Privacy Rule, 16
2 C.F.R. § 313, and Reg. P, 12 C.F.R. Part 1016. ¶ 330. As to the first five violations, Plaid relies upon its
3 arguments against Plaintiffs’ claims based upon the same provisions. MTD at 20. Plaid’s challenges to
4 those claims as a UCL predicate fail for the reasons discussed elsewhere in this brief. Plaid fails to
5 address the California constitutional predicate, which is valid. See Goodman v. HTC Am., Inc., No. 11-
6 1793, 2012 WL 2412070, at *12 (W.D. Wash. June 26, 2012).
7 As for the violations of the GLBA’s Privacy Rule and CalFIPA, Plaid argues that those statutes
8 “preclude a private right of action,” and thus cannot support a UCL claim. MTD at 20. As a general
9 matter, “‘[v]irtually any state, federal or local law can serve as the predicate for an action under section
10 17200,’” In re Google Assistant Privacy Litig., 457 F. Supp. 3d at 841 (quoting Davis v. HSBC Bank
11 Nevada, 691 F.3d 1152, 1168 (9th Cir. 2012)). A private right of action is no prerequisite. Cel-Tech
12 Commc’ns, Inc. v. L.A. Cellular Tel. Co., 20 Cal. 4th 163, 182-83 (1999); Kasky v. Nike, Inc., 27 Cal.
13 4th 939, 950 (2002) (UCL action permitted “even when ‘the conduct . . . violates a statute for the direct
14 enforcement of which there is no private right of action’”) (citation and quotation marks omitted).
15 Rather, “[t]o forestall an action under the [UCL], another provision must actually ‘bar’ the action or
16 clearly permit the conduct.” Cel-Tech, 20 Cal. 4th at 183. Neither the GLBA nor CalFIPA explicitly
17 bars a private UCL claim. In fact, a court from this District approved an “unlawful” UCL claim based
18 upon the violation of the GLBA. See In re Anthem Data Breach Litig., 162 F. Supp. 3d 953, 989 (N.D.
19 Cal. 2016). Plaid’s argument that it did not violate certain provisions in the GLBA and CalFIPA in light
20 of partial exemptions for requests authorized by consumers (MTD at 20 n.16) begs the question by
21 assuming that Plaintiffs authorized or requested Plaid to collect, transfer, and sell their private banking
22 information. They did not. Supra, Facts § I and Arg. § II.
23 Plaid argues that CalOPPA cannot serve as the basis for Plaintiffs’ “unlawful” UCL claim
24 because they do not allege they purchased or leased anything from Plaid. MTD at 20-21. CalOPPA
25 defines “consumer” as “any individual who seeks or acquires, by purchase or lease, any goods, services,
26 money, or credit for personal, family, or household purposes.” Cal. Bus. & Prof. Code § 22577
27 (emphasis added). Plaintiffs sought services for personal purposes: the use of “seek” indicates that the
28 statute does not require money to have changed hands. Plaid also drops a footnote to argue that it did not
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
- 24 - CASE NO. 4:20-CV-03056-DMR
1 violate CalOPPA for a handful of reasons. MTD at 21 n.17. Because Plaid operated both consumer-
2 facing web-based software and a behind-the-scenes online software (¶¶ 31-32), Plaid clearly constitutes
3 an “operator,” and its arguments based upon “online service” status under CalOPPA are unavailing.
4 Plaid’s “unfair” business practices: Plaid’s conduct is “unfair” under the UCL because it
5 violated California’s public policy of protecting consumers’ privacy interests by surreptitiously
6 collecting Plaintiffs’ bank login information, using that information to access their bank accounts,
7 accessing and copying private banking data, selling that data to the Apps, and storing and using that data
8 for its own purposes, all without consent. ¶ 331. Plaid violated important public interests protected by
9 the laws under which Plaintiffs’ claims are brought. ¶ 332. Plaid’s conduct did not create a benefit
10 outweighing these strong public policy interests, but instead benefitted Plaid at the expense of
11 consumers’ privacy. ¶ 333.
12 If the detailed facts alleged in the CAC could be deemed conclusory, as Plaid asserts (MTD at
13 21), it is difficult to imagine the complaint that could pass muster under Rule 8. Stealing the private
14 login credentials of millions of consumers obviously offends public policy, is immoral, unethical,
15 oppressive, unscrupulous, and substantially injurious to consumers. See McDonald v. Coldwell Banker,
16 543 F.3d 498, 506 (9th Cir. 2008). Surreptitiously accessing hundreds of millions of bank accounts is
17 unfair. Stealing years of private banking data is unfair. Profiting off that data without permission is
18 unfair. Plaintiffs need plead nothing more under any test. See In re Webkinz Antitrust Litig., 695 F.
19 Supp. 2d 987, 998-99 (N.D. Cal. 2010) (“the central issue presented under [the UCL] is whether the
20 public at large, or consumers generally, are affected by the alleged unlawful business practice”).
21 Plaid’s “fraudulent” business practices: Plaid engages in “fraudulent” business practices by (1)
22 mimicking bank websites in its software to surreptitiously collect consumers’ private bank login
23 information; (2) using consumers’ private bank login information to access their bank accounts and use
24 their data as alleged, all without consent. ¶ 334. Plaid’s business practices are both likely to deceive
25 members of the public and already have accomplished widespread public deception. Id.
26 Plaid raises a single challenge to this claim, arguing that Plaintiffs fail to satisfy Rules 8 and
27 9(b). MTD at 21-22. As discussed infra at Arg. § VI-F, however, Plaintiffs’ fraud-based allegations
28 more than satisfy the Rule 9(b) standard. And Plaintiffs show their reliance upon Plaid’s uniform
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
- 25 - CASE NO. 4:20-CV-03056-DMR
1 omissions and misleading partial representations by alleging that they would not have connected their
2 bank accounts to the Apps the way they did if they had known the truth about Plaid and its practices.
3 See, e.g., ¶¶ 4, 35-41, 47, 105, 116, 334, 360-61. Those uniform omissions are material and thus support
4 a presumption of reliance. See Daniel v. Ford Motor Co., 806 F.3d 1217, 1225 (9th Cir. 2015) (citing In
5 re Tobacco II Cases, 46 Cal. 4th 298, 327 (2009)).
6 Plaintiffs’ entitlement to restitution and disgorgement: The UCL provides that “[t]he court may
7 make such orders or judgments . . . as may be necessary to restore to any person in interest any money or
8 property, real or personal, which may have been acquired by means of such unfair competition.” Cal.
9 Bus. & Prof. Code § 17203. Here, Plaintiffs seek (1) restitution, (2) “disgorgement by Plaid of the
10 wrongfully-obtained private data obtained from their financial accounts, including without limitation a
11 return of that data to Plaintiffs and Class members and the Plaintiffs’ and Class members’ financial
12 institutions with corresponding protections and security,” and injunctive relief. ¶ 336.
13 While Plaintiffs are in fact entitled to restitution for the economic value that Plaid derived from
14 unlawfully accessing their banking accounts and data—an especially important remedy when there are
15 severe violations of privacy and dignitary interests—they are not, contrary to Plaid’s argument (MTD at
16 22), seeking such remedy under the UCL. Under the UCL, Plaintiffs seek only disgorgement of their
17 property in the form of the data Plaintiffs unwittingly allowed Plaid to take from them. Plaid established
18 the market for the personal data extracted from Plaintiffs’ banks by arranging to siphon it out and sell it
19 to the Apps, in addition to using the data to sell value-added products. In the “but-for” world, Plaintiffs
20 would not have connected the Apps to their banks through Plaid, but instead would have followed a
21 standard microdeposit procedure that would have (1) left Plaid out of the picture completely, and (2) left
22 Plaintiffs’ private data secure in their banks. But as a result of Plaid’s deception, Plaintiffs lost control
23 over the data that Plaid took and sold behind their backs. Disgorgement of the data itself Plaid
24 wrongfully took from their banks (or the value thereof) is properly sought under the UCL.
25 C. Plaintiffs Have Properly Pleaded Claims Under The CFAA And CDAFA
26 Plaid addresses its arguments against Plaintiffs’ CFAA and CDAFA claims in tandem, and
27 Plaintiffs reply in kind. MTD at 22-29. As discussed below, none of Plaid’s arguments have any merit.
28 The CFAA and CDAFA apply to the facts as alleged. Plaid first argues that the CFAA and
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
- 26 - CASE NO. 4:20-CV-03056-DMR
1 CDAFA are “anti-hacking” statutes (MTD at 22), but neither statute is limited to a stereotypical hacking
2 operation on the dark web. For example, the CFAA’s prohibition on accessing a computer “without
3 authorization” may be violated “when a person circumvents a computer’s generally applicable rules
4 regarding access permissions, such as username and password requirements, to gain access to a
5 computer.” HiQ Labs, Inc. v. LinkedIn Corp., 938 F.3d 985, 1003 (9th Cir. 2019). That prohibition
6 extends to where otherwise valid login credentials are used by a party who lacks authority to use them.
7 See United States v. Nosal, 844 F.3d 1024, 1034 (9th Cir. 2016) (use of another party’s login credentials
8 may violate the CFAA where permission to access has been revoked); Calsoft Labs, Inc. v.
9 Panchumarthi, No. 19 -04398-NC, 2020 WL 512123, at *10-11 (N.D. Cal. Jan. 31, 2020) (use of
10 “legitimate access credentials” may violate the CFAA where the party lacked permission to use them).20
11 As a result, Plaid’s argument that Plaintiffs do not allege “facts suggestive of hacking” (MTD at
12 23) is irrelevant, and ignores that Plaintiffs have in fact alleged that Plaid acted as an unauthorized,
13 unknown bad actor when it obtained and used consumers’ bank login credentials, then collected,
14 transferred, sold and used consumers’ private banking data without their permission. Those facts suffice.
15 Plaintiffs have standing under the CFAA and CDAFA. Plaid next argues that Plaintiffs lack
16 standing because they have not pleaded “economic damages” under the CFAA and “damage or loss”
17 under the CDAFA. Id. The CFAA permits any person who suffers damage or loss by reason of a
18 violation to sue a violator whose conduct causes economic losses to “1 or more persons” of at least
19 $5,000 during a one-year period. See 18 U.S.C. §§ 1030(g) & (c)(4)(A)(i)(I).21 The CDAFA does not
20 impose a minimum damages requirement, but instead provides a civil claim for one who suffers any
21 “damage or loss by reason of a violation.” Cal. Pen. Code § 502(e)(1); see also Facebook, Inc. v. Power
22 Ventures, Inc., No. 08-05780, 2010 WL 3291750, at *4 (N.D. Cal. July 20, 2010).
23 Plaintiffs have pleaded the required economic losses (or damage and loss), including losses of at
24 least $5,000 during a one-year period. Under the CFAA, damages may be aggregated across class
25 members to meet the $5,000 minimum. See In re Apple & AT&TM Antitrust Litig., 596 F. Supp. 2d
26 20
See also supra, Arg. § III-B, n.9 & n.10 (discussing legislative intent).
21
27 Plaid is incorrect in arguing that Plaintiffs’ claim for injunctive and other equitable relief must be
dismissed. MTD at 23 n.19. The statute allows a civil plaintiff to recover “compensatory damages and
28 injunctive or other equitable relief.” 18 U.S.C. § 1030(g) (emphasis added).
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
- 27 - CASE NO. 4:20-CV-03056-DMR
1 1288, 1308 (N.D. Cal. 2008) ($5,000 threshold could be met by aggregating individual damages, such as
2 diminution of value of the plaintiffs’ iPhones). Multiple intrusions may combine over a one-year period
3 to meet the $5,000 minimum. See Creative Computing v. Getloaded.com, LLC, 386 F.3d 930, 934-35
4 (9th Cir. 2004); In re Toys R Us, Inc., Privacy Litig., No. 00-2746, 2001 WL 34517252, at *10 (N.D.
5 Cal. Oct. 9, 2001) (allegations that defendant caused a file to be implanted in each of plaintiffs’
6 computers at various points, causing damages including misappropriating the economic value of their
7 “personality,” showed aggregated damages exceeding $5,000 in one year).
8 When Plaid removed consumers’ data from the secure banking environment, the lost value of
9 their indemnification rights alone clearly exceeds $5,000, especially considering the Class includes tens
10 of millions of consumers, many of whom must have had substantial funds in their accounts. See ¶¶ 54,
11 215-24. It is proper to aggregate Class losses to meet the minimum threshold, especially because (1)
12 Plaid used the same methods to intrude upon Plaintiffs’ and the Class members’ financial accounts and
13 the data in those accounts (¶ 49); and (2) Plaid deployed the same software templates in the Apps to
14 intrude upon and compromise the integrity of Plaintiffs’ and the Class members’ mobile devices (¶ 39
15 n.22). See Creative Computing, 386 F.3d at 934-35; Apple & AT&TM Antitrust, 596 F. Supp. 2d at
16 1308.
17 Plaid also attempts to argue that Plaintiffs lack standing to sue under § 502(c)(3), (6) & (7) of the
18 CDAFA because standing “only exists for the owner of the computer services or computer attacked and
19 damaged.” MTD at 23 (emphasis in original). But the CDAFA provides a private right of action for “the
20 owner or lessee of the . . . data” in addition to the owner of the computer itself. Cal. Pen. Code
21 § 502(e)(1); accord Gonzales, 305 F. Supp. 3d at 1090. Plaintiffs own the private banking data at issue.
22 Plaid accessed a computer or data without authorization. Plaid asserts that Plaintiffs do not
23 plausibly allege that it accessed any computer or data without authorization because “Plaintiffs chose to
24 link their accounts (whether through Plaid or not)” and because “Plaid’s Privacy Policy lists the data
25 Plaid can collect.” MTD at 26-27. Both arguments fail. As discussed supra at Arg. § II, Plaid’s privacy
26 policy-based argument is meritless and cannot be decided on a motion to dismiss. And, consumers
27 routinely authorize money transfers to and from accounts, such as for automatic payments and deposits,
28 with no expectation that their banking data is being disclosed. Nothing about that general proposition
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
- 28 - CASE NO. 4:20-CV-03056-DMR
1 lends any support to the idea that Plaintiffs gave permission to Plaid, or for Plaid’s conduct—an idea
2 refuted throughout the CAC. Plaid comes nowhere close to demonstrating the unambiguous
3 authorization that would be required to defeat Plaintiffs’ claims on a motion to dismiss. See, e.g., Apple
4 & AT&TM Antitrust, 596 F. Supp. 2d at 1308 (rejecting Apple’s argument that plaintiffs’ CFAA claims
5 failed because they alleged that they authorized a software update, noting that plaintiffs did not authorize
6 damage to their iPhones, Apple’s warning in connection with the update was ambiguous, and some
7 downloading of the update was “unsuspected”).22
8 Plaintiffs plead facts showing “damage” under the CFAA and CDAFA. Plaid next argues that
9 Plaintiffs fail to allege “damage” for a claim under CFAA §§ (a)(5)(A)-(C) because simply downloading
10 data does not impair the integrity of the data or systems. MTD at 27. Contrary to Plaid’s suggestion,
11 “‘courts in the Ninth Circuit have expressly held that, under the CFAA, “it is not necessary for data to be
12 physically changed or erased to constitute damage to that data.” Satmodo, LLC v. Whenever Commcns.,
13 LLC, No. 17-0192, 2017 WL 6327132, at *3 (S.D. Cal. Dec. 8, 2017) (quotations omitted); see also
14 Multiven, Inc. v. Cisco Sys., Inc., 725 F. Supp. 2d 887, 894-95 (N.D. Cal. July 20, 2010) (“[i]t is
15 sufficient to show that there has been an impairment to the integrity of data”) (emphasis added; quoting
16 18 U.S.C. § 1030(e)(8)).
17 In Shurgard Storage Centers, Inc., v. Safeguard Self Storage, Inc., the plaintiff alleged that an
18 employee accessed its computer system and emailed proprietary information to the defendant, without
19 otherwise damaging its computers. 119 F. Supp. 2d 1121, 1123 (W.D. Wash. 2000). The court found the
20 plaintiff had thereby adequately alleged “damage” under the CFAA because an “impairment to
21 integrity” had occurred even though no data was physically changed or erased. Id. at 1126; see also
22 Therapeutic Research Faculty v. NBTY, Inc., 488 F. Supp. 2d 991, 996-97 (E.D. Cal. 2007) (finding that
23 unauthorized access to a computer system and disclosure of its information may constitute an
24
22
Plaid argues that Plaintiffs’ lack of notice of its privacy policy “cannot form the basis for a claim”
25 under the CFAA or CDAFA because there can be no violation if the defendant “reasonably could have
thought” it had permission. MTD at 27 n.24. That argument conflates Plaid’s state of mind with
26 Plaintiffs’ notice of and consent to be bound to the terms of Plaid’s policy. It also ignores well-pled
allegations that Plaid acted with the intent to deceive. See, e.g., ¶ 74(d). Cf. Facebook, Inc. v. Power
27 Ventures, Inc., 844 F.3d 1058, 1067 (9th Cir. 2016) (citing summary judgment evidence that end users
gave the defendant permission to share a promotion, and thus—arguably—permission to use Facebook’s
28 computers).
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
- 29 - CASE NO. 4:20-CV-03056-DMR
1 impairment to integrity even though no data was physically changed or erased).
2 Plaintiffs have adequately alleged impairment to the integrity of their data by alleging Plaid (1)
3 deceptively acquired their bank login credentials and gained access to their banking data, thereby
4 destroying their valuable indemnity rights; (2) took their data out of their banks’ secure environment and
5 sold it without adequate controls over what purchasers would do with it; (3) obtained an open
6 connection to their accounts so that it could control access to, and steal information from, the banks’
7 computer systems; (4) installed software in the Apps to capture their sensitive bank login data; and (5)
8 accessed Plaintiffs’ banks’ computer systems, copied their banking data, sold it to the Apps, and used it
9 for its own purposes. ¶¶ 214-27, 285(a)-(d), 288(a)-(d), 291(a)-(d).23
10 Moreover, courts also recognize “damage” under the CFAA where, as here, software is used to
11 alter the controls of a computer and the integrity of the system is thereby impaired. See Microsoft Corp.
12 v. Mutairi, No. 14-00987, 2015 U.S. Dist. LEXIS 95541, at *3 (D. Nev. June 25, 2015) (program caused
13 “damage” to computers because it was able to “steal information from the computer, control the
14 computer, and upload data to the computer”); GM L.L.C. v. Autel.US Inc., No. 14-14864, 2016 WL
15 1223357, at *10 (E.D. Mich. Mar. 29, 2016) (finding impaired integrity of a computer system where the
16 defendants copied information and shared usernames with unauthorized users, leading to unauthorized
17 use of accounts and downloads); Microsoft Corp. v. Doe, No. 14-00811, 2015 WL 4937441, at *9 (E.D.
18 Va. Aug. 17, 2015) (finding “damage” where software allowed defendants to take control of computers,
19 then extract sensitive, personal information and funds from bank accounts).
20 Here, Plaid impaired the integrity of Plaintiffs’ smartphones when it installed software in the
21 Apps to capture their sensitive bank login data. ¶¶ 285(c), 288(c), 291(c). Plaid also impaired the
22 integrity of their banks’ computer systems, including when it (1) deceptively accessed those systems and
23 destroyed Plaintiffs’ valuable indemnity rights; and (2) obtained an open connection to steal information
24 from those systems. ¶¶ 214-24, 285(b), 288(b), 291(b). See United States v. Yücel, 97 F. Supp. 3d 413,
25 419-20 (S.D.N.Y. 2015) (by causing a computer to “be operated by unauthorized users who have the
26
23
27 In addition to incurring “damage,” Plaintiffs also incurred “loss” under CFAA § 1030(e)(11) due to
the loss of their valuable indemnification rights and additional data protections, as well as the loss of
28 their data itself. ¶¶ 292, 297.
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
- 30 - CASE NO. 4:20-CV-03056-DMR
1 capability of extracting confidential information from the computer’s hard drive,” the defendant
2 impaired the “uncorrupted condition” of the computer system because “the system no longer operates as
3 it did” and “the economic value of the computer system” was “negatively impact[ed]”).
4 The cases Plaid cites are distinguishable because Plaid did not “simply download[]” Plaintiffs’
5 data “without leaving a trace.” Fidlar Techs. v. LPS Real Estate Data Sols., Inc., 810 F.3d 1075, 1084
6 (7th Cir. 2016). Rather, Plaid uses its software to compromise the security of Plaintiffs’ banks’
7 computers on an ongoing basis. See NetApp v. Nimble Storage, Inc., No. 13-05058, 2015 WL 400251, at
8 *14 (N.D. Cal. Jan. 29, 2015) (“[C]opying information does not necessarily render computer systems
9 less secure, because copying information on its own does not necessarily allow a hacker to access other
10 systems, programs, or data.”) (emphasis in original); Yücel, 97 F. Supp. 3d at 421 (distinguishing cases
11 finding no damage where data was copied because the defendants did not “install a program on the
12 target computer that compromised the computer’s security on an ongoing basis”).24
13 Plaid also argues that Plaintiffs’ claims under Sections 502(c)(1) and (c)(4) of the CDAFA fail
14 because damage to the integrity of computers and data is not recognized as “damage” under that statute.
15 MTD at 27-28. In the single case Plaid cites in support of its argument, Ticketmaster L.L.C. v. Prestige
16 Entm’t W., Inc., 315 F. Supp. 3d 1147 (C.D. Cal. 2018), there was no allegation of damage to the
17 integrity of a computer or data similar to the types of “damage” routinely recognized for claims under
18 the CFAA. The court found that it was not enough to show damage or use under Sections 502(c)(1) and
19 (c)(4) of the CDAFA where the plaintiff alleged that the defendants used bots to access its public-facing
20 website and purchase more tickets than would be available to a human user. Id. at 1155, 1175 & n.5. But
21 Plaid offers no reason to believe that these sections of the CDAFA deviate from the CFAA in applying
22 to damage to the integrity of computers and data because the substantive pleading standards for the
23 CDAFA are the same as for the CFAA. See Satmodo, 2017 WL 6327132, at *7.
24 Plaintiffs adequately plead “intent to defraud” under the CFAA. Plaid argues that Plaintiffs’
25
24
26 Plaid erroneously asserts that Plaintiffs do not allege facts showing it intended to cause damage under
§ 1030(a)(5)(A) or recklessly caused damage under § 1030(a)(5)(B). MTD at 27. Plaintiffs in fact have
27 pleaded the requisite intent, and the case Plaid cites examined the evidence of Apple’s intent in the
context of a summary judgment motion. See In re Apple & ATTM Antitrust Litig, No. 07-5152, 2010
28 WL 3521965, at *7 (N.D. Cal. July 8, 2010).
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
- 31 - CASE NO. 4:20-CV-03056-DMR
1 claims under Sections 1030(a)(4) & (6) of the CFAA fail because they do not adequately allege Plaid
2 intended to “deceive or cheat” (MTD at 28), but that is not the relevant legal standard. While the CFAA
3 does not define “intent to defraud,” courts in the Ninth Circuit have interpreted this phrase to mean proof
4 of “unlawful access” or “wrongdoing,” rather than to require proof of each of the elements of common
5 law fraud. See eBay Inc. v. Digital Point Solutions, Inc., 608 F. Supp. 2d 1156, 1164 (N.D. Cal. 2009);
6 Hanger Prosthetics & Orthotics, Inc. v. Capstone Orthopedic, Inc., 556 F. Supp. 2d 1122, 1131 (E.D.
7 Cal. 2008). Intent can be shown where “the defendant participated in dishonest methods to obtain the
8 plaintiff’s secret information.” Shurgard, 119 F. Supp. 2d at 1126.25
9 Plaintiffs adequately allege that Plaid acted with the requisite intent by alleging unlawful access
10 and wrongdoing on Plaid’s part. See ¶ 280 (Plaid accessed Plaintiffs’ banks’ computer systems “with the
11 intent to collect banking data to which it was not entitled and which it intended to sell and use without
12 authority”), ¶ 295 (Plaid transferred access tokens to the Apps “with the intent that those entities would
13 use such access tokens or similar information to collect banking data to which they were not entitled,
14 and that Plaid would be able to charge the Apps for the information or access”). Plaid cannot evade
15 liability because it built its entire business around wrongful conduct. MTD at 28.
16 Plaid also is incorrect in asserting that “intent to defraud” under the CFAA is governed by Rule
17 9(b) pleading standards. See NetApp, Inc. v. Nimble Storage, 41 F. Supp. 3d 816, 833 (N.D. Cal. 2014)
18 (“[M]ost CFAA cases in this district have not applied Rule 9(b)’s pleading standards to all CFAA
19 claims.”); Facebook, Inc. v. MaxBounty, 274 F.R.D. 279, 284 (N.D. Cal. 2011) (“fraud under the CFAA
20 only requires a showing of unlawful access; there is no need to plead the elements of common law
21 fraud”) (quotation omitted). Even if Rule 9(b) applied to claims under Sections (a)(4) and (a)(6) of the
22 CFAA, as discussed infra at Arg. § VI-F, Plaintiffs have adequately pleaded the who, what, when, where
23 and how of Plaid’s fraudulent actions.
24 Plaintiffs properly plead a claim under CFAA § 1030(a)(6). Plaid argues that Plaintiffs’
25 allegations of trafficking under this provision are “conclusory” and “not supported by any facts at all.”
26 MTD at 28. But Plaintiffs’ claim is amply supported by two alternative violations. First, Plaid
27
25
The case cited by Plaid, Fidlar, looked to inapposite Seventh Circuit authority interpreting “intent to
28 defraud” in unnamed “similar statutes.” 810 F.3d at 1079.
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
- 32 - CASE NO. 4:20-CV-03056-DMR
1 knowingly trafficked in “passwords or similar information through which a computer may be accessed”
2 by obtaining “access tokens or similar information from Plaintiffs’ and Class members’ financial
3 institutions through which the institutions’ computer systems could be accessed without authorization.”
4 ¶ 293. Alternatively, Plaid knowingly trafficked in passwords or similar information by “transferring to
5 the Participating Apps access tokens or similar information from Plaintiffs’ and Class members’ banks
6 through which the banks’ computer systems could be accessed” using Plaid’s software. ¶ 294. In both
7 cases, Plaid’s intent was to allow the Apps to access data from the banks. ¶¶ 293-94. In addition,
8 Plaintiffs pleaded facts showing how such tokens or similar information are used in a typical “OAuth”
9 process: “Behind the scenes, the bank returns a ‘token’ that allows the original app to access the
10 consumer’s bank information as necessary and authorized by the consumer, but without giving the app
11 provider access to the login information.” ¶ 33.
12 Plaintiffs thus allege facts showing that Plaid, using its “Managed OAuth” procedure, obtains
13 access tokens or similar information that allow ongoing access to Plaintiffs’ data stored at their banks,
14 either directly from the banks (the first alternative scenario) or through Plaid (the second scenario).
15 These factual allegations are clearly sufficient. See Mobile Active Def., Inc. v. L.A. Unified Sch. Dist.,
16 No. 15-8762, 2016 WL 7444876, at *7 (C.D. Cal. Apr. 6, 2016) (allegation that the defendant provided
17 another party a “secret, confidentially held URL” was sufficient under § 1030(a)(6) as transfer of
18 information similar to a password). Plaid’s challenge belongs at summary judgment.
19 Plaid also argues that Plaintiffs’ allegations somehow contradict this claim, citing ¶ 68. MTD at
20 28. That argument fails because Plaintiffs allege that the language quoted in ¶ 68 is false and
21 misleading: “By stating that the login credentials will not be made accessible to Venmo, consumers are
22 falsely led to reasonably expect that their credentials are not shared at all during the account verification
23 process, other than with the bank they know and trust, while in fact those credentials are intercepted by
24 Plaid for its use.” ¶ 74(b). Plaid’s receipt of an access token and transfer of that token to an App is fully
25 consistent with these allegations. Also, Plaintiffs do not allege that Plaid trafficked in their login
26 credentials, but rather in access tokens or similar information that Plaid received by using Plaintiffs’
27 login credentials.
28 Because Plaintiffs allege that Plaid transferred the tokens or similar information to the Apps, the
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
- 33 - CASE NO. 4:20-CV-03056-DMR
1 single case cited by Plaid is inapposite. See Oracle Am., Inc. v. TERiX Comput. Co., No. 13-03385, 2014
2 WL 31344, at *6 (N.D. Cal. Jan. 3, 2014) (“Oracle has not alleged that Defendants transferred or
3 otherwise disposed of its customer’s login credentials. Instead, Defendants are alleged only to have
4 received the login credentials from their customer and used the credentials themselves.”); see also T-
5 Mobile USA, Inc. v. Terry, 862 F. Supp. 2d 1121, 1131 (W.D. Wash. 2012) (upholding § 1030(a)(6)
6 claim where the defendant and co-conspirators trafficked in “confidential pass-codes” that accessed
7 “proprietary computer systems” and by trafficking in SIM cards which “operate[d] as a gateway (or
8 computer password)” to a network); NACM Tampa, Inc. v. Sunray Notices, Inc., No. 15-1776, 2017 WL
9 2209970, at *6 (M.D. Fla. Feb. 8, 2017) (upholding § 1030(a)(6) claim where the defendant transferred
10 account and password information for the plaintiff’s confidential database).
11 Plaintiffs properly plead claims under CFAA § 1030(a)(5)(A) and CDAFA § 502(c)(8). Plaid
12 argues that these claims fail because Plaid’s software is not like a virus or worm that “usurps the normal
13 operation of the computer or computer system.” MTD at 28-29. These statutes are not as limited as Plaid
14 suggests. Plaid violated CFAA § 1030(a)(5)(A) by transmitting Plaintiffs’ bank login information to
15 access their banks’ computer systems and by transmitting its software to the Apps for incorporation into
16 their apps so that Plaid could collect Plaintiffs’ login information, thereby causing damage to the banks’
17 computer system and their data therein, as well as to Plaintiffs’ smartphones and their data within.
18 ¶¶ 283-84. Plaid argues that its software “does ‘not impair the integrity or availability of’ data or
19 systems.” MTD at 29 (quoting Fidlar, 810 F.3d at 1084). But the court in Fidlar recognized that the
20 phrase “causes damage” in § 1030(a)(5)(A) both “encompasses clearly destructive behavior such as
21 using a virus or worm or deleting data” and “may also include less obviously invasive conduct.” Id. at
22 1084 (citation omitted). There is no basis for limiting a § 1030(a)(5)(A) claim as Plaid suggests.
23 Section 502(c)(8) of the CDAFA imposes liability upon one who “[k]nowingly introduces any
24 computer contaminant into any computer, computer system, or computer network.” Cal. Pen. Code
25 § 502(c)(8). A “computer contaminant” is defined as “‘any set of computer instructions that are
26 designed to modify, damage, destroy, record, or transmit information within a computer . . . without the
27 intent or permission of the owner of the information.’” Cal. Pen. Code § 502(b)(10) (emphasis added).
28 “The drafters spelled out that they intended this provision to encompass things including, but not
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
- 34 - CASE NO. 4:20-CV-03056-DMR
1 limited to, ‘a group of computer instructions commonly called viruses or worms.’” Flextronics Int’l, Ltd.
2 v. Parametric Tech. Corp., No. 13-00034, 2014 WL 2213910, at *6 (N.D. Cal. May 28, 2014) (quoting
3 Cal. Pen. Code § 502(b)(10)) (emphasis added).
4 Plaintiffs allege that Plaid violated CDAFA § 502(c)(8) by knowingly introducing a computer
5 contaminant into Plaintiffs’ smartphones, in the form of the software it incorporated into the Apps to
6 collect Plaintiffs’ login information. ¶ 375. Plaid again argues, however, that its software does not
7 “impair the integrity or availability of data or systems.” MTD at 29. The court in Flextronics considered
8 and rejected the same argument. See 2014 WL 2213910, at *6 (“PTC attempts to argue that because the
9 technology does not ‘usurp the normal operation of the computer,’ it does not qualify as a ‘contaminant.’
10 However, that argument misinterprets an illustrative phrase at the end of a list of possible ways things
11 that a set of computer instructions might do to be considered a ‘contaminant.’ Earlier in that same
12 sentence, the statute teaches that a set of instructions which ‘consume computer resources, modify,
13 destroy, record, or transmit data’ may also be considered a contaminant.”) (quotation omitted).
14 Here, Plaintiffs have alleged sufficient facts showing that Plaid’s software constitutes a set of
15 instructions embedded in Plaintiffs’ smartphones which record and transmit data. See ¶¶ 37-39, 45.
16 Plaintiffs also sufficiently allege that Plaid’s software was intended to damage the integrity of Plaintiffs’
17 smartphones and their data therein. See, e.g., ¶ 285(c). As a result, they have adequately alleged Plaid
18 introduced a computer contaminant for purposes of their claim under § 502(c)(8).
19 D. Plaintiffs Have Properly Pleaded A Claim Under The Stored Communications Act
20 The SCA authorizes civil claims against anyone who intentionally accesses without or in excess
21 of authorization “a facility through which an electronic communication service is provided” and thereby
22 obtains or alters an electronic communication “while it is in electronic storage in such system . . . .” 18
23 U.S.C. §§ 2701(a), 2707. Plaid violated the SCA by accessing Plaintiffs’ banks’ computer systems
24 without authorization, thereby obtaining access to the contents of Plaintiffs’ electronic communications
25 while they were in electronic storage. ¶ 307. To the extent Plaid obtained purported authorization to
26 access those computers, it exceeded any authorization by collecting, aggregating, selling, and divulging
27 the contents of electronic banking communications that were unrelated to the purpose for which
28 Plaintiffs used the Apps. ¶ 308.
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
- 35 - CASE NO. 4:20-CV-03056-DMR
1 Plaid first argues that Plaintiffs’ claims under the SCA fail because their banks do not constitute
2 a “facility through which an electronic communication service is provided” because they are not an
3 internet service provider, email provider, or bulletin board. MTD at 29. The SCA is not so restrictive.
4 Contrary to Plaid’s argument, Plaintiffs plausibly allege that each such entity’s systems and servers
5 constitute a facility under the SCA “which provides its users with the ability to send and receive
6 electronic communications, including, inter alia, images, data, queries, messages, notifications,
7 statements, forms, updates, and intelligence regarding the financial institutions and their policies and
8 promotions, as well as about customers’ individual accounts and activities, among others. ¶ 302 (citing
9 18 U.S.C. §§ 2701(a)(1); 2711(1), 2510(15) & 2510(12)). Plaintiffs further allege that their banks
10 communicate information about their financial affairs, including “account balances, historical
11 transactions, pending transactions, withdrawals, deposits, transfers, outgoing wires, loan terms, and
12 interest rates through the electronic interface provided . . . for access via web browsers and the
13 institutions’ mobile apps.” ¶ 302. See Decoursey v. Sherwin-Williams Co., No. 19-02198, 2020 WL
14 1812266, at *6 (D. Kan. Apr. 9, 2020) (plaintiff adequately alleged that Facebook was a “facility” under
15 the SCA, where she alleged that Facebook “provides its users with the ability to send and receive
16 electronic messages”); Ehling v. Monmouth-Ocean Hosp. Serv. Corp., 961 F. Supp. 2d 659, 667 (D.N.J.
17 2013) (same) (citation omitted).
18 The cases Plaid cites are inapposite. Central Bank & Trust v. Smith is distinguishable because the
19 bank at issue did not allege that the defendant accessed systems maintained by a third party that were
20 designed for communication to consumers; rather, it alleged that former bank employees accessed its
21 own servers and stole customer information to create a competing bank. 215 F. Supp. 3d 1226, 1234-35
22 (D. Wy. 2016); accord Satcom Sol. & Res. LLC v. Pope, No. 19- 02104, 2020 WL 4511773, at *6-7 (D.
23 Colo. Apr. 20, 2020) (following Central Bank where former employee was alleged to have downloaded
24 customer and marketing distribution lists to compete with former employer); see also Backhaut v. Apple,
25 Inc., 74 F. Supp. 3d 1033, 1041 (N.D. Cal. 2014) (under the SCA, “any ‘facilities’ must be operated by a
26 third-party”). The other cases cited by Plaid have no application because Plaintiffs do not allege that
27 their mobile devices constitute the facility at issue. See In re iPhone Application, 844 F. Supp. 2d at
28 1058 (“iOS devices do not constitute ‘facilit[ies] through which an electronic communication service is
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
- 36 - CASE NO. 4:20-CV-03056-DMR
1 provided’”); Backhaut, 74 F. Supp. 3d at 1041 (“mobile devices cannot be ‘facilities’”).
2 Plaid next argues that Plaintiffs failed to allege Plaid accessed an “electronic communication” in
3 the form of “non-EFT information.” MTD at 30. To the contrary, Plaintiffs alleged that Plaid accessed a
4 host of “electronic communications,” including (1) images, (2) data, (3) queries, (4) messages,
5 (5) notifications, (6) statements, (7) forms, (8) updates, (9) intelligence regarding the financial
6 institutions and their policies and promotions, (10) intelligence regarding their individual accounts and
7 activities, and (11) information about their account balances, historical transactions, pending
8 transactions, withdrawals, deposits, transfers, outgoing wires, loan terms, and interest rates. ¶¶ 302, 307;
9 see also ¶ 56. Plaintiffs further allege that their banks store their “past banking activities, historical direct
10 messages, and other communications.” ¶ 305. As a result, the electronic communications at issue do not
11 constitute “electronic funds transfer information” in the first place, and they are not stored “in a
12 communications system used for the electronic storage and transfer of funds.” 18 U.S.C. § 2510(12)(D).
13 Plaid also argues that Plaintiffs do not plausibly allege Plaid accessed a communication while it
14 was in “electronic storage” because they do not allege that Plaid accessed any historical communications
15 held “for purposes of backup protection.” MTD at 30 (citing 18 U.S.C. § 2510(17)(B)). Plaid’s argument
16 fails because Plaintiffs have alleged facts showing that the communications at issue were stored, among
17 other reasons, “for the purposes of backup protection,” explaining that their banks “necessarily store
18 historical communications regarding a customer’s past banking activities, historical direct messages, and
19 other communications so that they may be accessed by consumers, including Plaintiffs and Class
20 members (e.g., for tax purposes).” ¶ 305. Plaintiffs allege that Plaid accessed all information available at
21 their respective banks, including such historical information held for backup purposes. See, e.g., ¶ 56.
22 Contrary to Plaid’s suggestion, courts recognize that information is held for backup purposes
23 when it is stored in case the user needs to access and download it again, especially where data is made
24 available for use outside the original system. See Theofel v. Farey-Jones, 359 F.3d 1066, 1075 (9th Cir.
25 2004) (emails remaining on NetGate’s server after delivery were held for backup purposes should the
26 user need to download them , such as if the emails were accidentally erased from the user’s computer).
27 The communications held by Plaintiffs’ banks are fundamentally different than data that is only
28 accessible through its place of storage and is not intended to be made available for use outside the
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
- 37 - CASE NO. 4:20-CV-03056-DMR
1 original system. See Cline v. Reetz-Laiolo, 329 F. Supp. 3d 1000, 1044 (N.D. Cal. 2018) (distinguishing
2 Theofel and finding that messages stored in a web-based email system were not held for purposes of
3 backup protection because they were not meant to be downloaded outside of the original system);
4 United States v. Weaver, 636 F. Supp. 2d 769, 772 (C.D. Ill. 2009) (recognizing that where messages
5 were downloaded to a different email client, the original system may hold messages for backup
6 purposes). Here, Plaintiffs’ banking information is useful outside of the bank’s systems, which is why
7 Plaid has built a business off retrieving that information from where it is maintained at the banks and
8 delivering it elsewhere, updating that cache of data every few hours in the process. See, e.g., ¶ 55.
9 Plaid also argues that Plaintiffs fail to allege that Plaid accessed data “without or in excess of
10 authorization” or that it did so intentionally. The concept of authorization in the SCA is interpreted
11 consistently with its interpretation under the CFAA. See HiQ Labs, 938 F.3d at 1002-03. Thus, for all
12 the reasons discussed supra in Arg. § VI-C, Plaintiffs have properly alleged that Plaid acted without
13 authorization or, alternatively, exceeded any purported authorization, in accessing Plaintiffs’ banking
14 data for purposes of their claims under the SCA.
15 Plaid argues, however, that because the SCA prohibits unauthorized access to information rather
16 than use of that information, Plaintiffs’ claims are somehow flawed. Plaid’s argument misses the point.
17 The cases Plaid cites distinguish between access to and use of data where the defendant was authorized
18 to access the data in the first place, but then allegedly misused the data. See, e.g., Central Bank, 215 F.
19 Supp. 3d at 1236 (SCA did not apply because the plaintiff did not allege “the defendants were accessing
20 electronic information beyond what its information technology department authorized them to see”).
21 To get around this obstacle, Plaid rehashes its same unsupported assertion that “[a]ny data Plaid
22 allegedly accessed was accessed with Plaintiffs’ authorization and at their request,” attempting to
23 conjure authorization from a mix of the terms of Plaid’s privacy policy, the irrelevant client policies
24 Plaid attaches to its counsel’s declaration, and Plaintiffs’ “stated purpose for using the apps.” MTD at
25 31. For the reasons discussed supra at Arg. § II, Plaid’s consent-based arguments are baseless.
26 E. Plaid’s Violations Of The California Anti-Phishing Act Are Well-Pled
27 Plaid’s violation of CAPA is clear: Plaid used the Internet to induce Plaintiffs to provide their
28 financial account credentials and banking information (“identifying information,” defined at Cal. Bus.
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
- 38 - CASE NO. 4:20-CV-03056-DMR
1 & Prof. Code § 22948.1) by representing itself to be Plaintiffs’ financial institutions, without the
2 institutions’ authority or approval. See CAPA § 22948.2; ¶¶ 35, 38-41, 74(b)-(d), 321, 349-55; Facts §
3 II. Holding Plaid responsible to the individuals whose unlawfully-obtained data it used to generate a
4 windfall for itself is fully consistent with CAPA and the legislature’s intent.
5 All elements of CAPA are well-pled. As an initial matter, Plaid does not dispute the well-pleaded
6 allegations that it in fact used banks’ logos and color schemes, or that the banking credentials and data it
7 obtains are “identifying information” under CAPA. Instead, Plaid recycles its argument that despite
8 Plaintiffs’ detailed allegations showing Plaid hid the truth, consumers must have known anyway that
9 they were not logging into their own banks (addressed supra, Arg. § II-A).
10 Plaid erroneously claims Plaintiffs do not support the allegation that Plaid acted “without
11 obtaining the authority or approval of each financial institution” (MTD at 34; ¶ 353), but Plaintiffs
12 specifically support their allegation with the fact that banks, and the ABA, voiced concerns about
13 customer data acquisition by aggregators like Plaid (¶¶ 78-79); that banks compete with the Apps that
14 use Plaid (¶ 81 n.65 & citation, describing “War Between Banks, Fintech Firms”); and that some of
15 these banks took steps to stop Plaid from accessing their customers’ data (¶¶ 80-81). In fact, and
16 underscoring the adequacy of Plaintiffs’ allegations, one institution, TD Bank, sued Plaid on October 14,
17 2020 for counterfeiting and unfair competition based on Plaid’s use of TD’s “trademarks, logo, and
18 green color scheme to replicate TD’s genuine login page and to dupe consumers into believing they are
19 entering their sensitive personal and financial information in the bank’s trusted and secure platform.”
20 Geman Decl. Ex. 1, at ¶ 4. Plaid is asking this Court to infer, improperly under the authority it cites,26
21 that over 11,000 financial institutions (¶ 58)—one of which is now suing Plaid for this very conduct—
22 actually authorized Plaid to acquire their customers’ data by appropriating their branding, at the same
23 time as they voiced concerns, competed with the fintech apps whose growth Plaid was facilitating, and
24 tried to stop Plaid from accessing their customers’ accounts. The CAC contradicts Plaid’s argument,
25 particularly drawn in a light most favorable to Plaintiffs.
26
26
27 See Bell Atlantic Corp. v. Twombly, 550 U.S. 554, 555 (2007); Ashcroft v. Iqbal (2007), 556 U.S. 662,
678-80 (2009); Adams v. Johnston, 355 F.3d 1179, 1183 (9th Cir. 2004); Johnson v. Riverside
28 Healthcare Sys., 534 F.3d 1116, 1122 (9th Cir. 2008), cited by Plaid.
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
- 39 - CASE NO. 4:20-CV-03056-DMR
1 Plaintiffs were “adversely affected” by Plaid’s phishing because Plaid acquired their private
2 information under false pretenses. Plaintiffs thus have a statutory right to bring their claim for damages
3 and the other relief. ¶¶ 253, 349-55; supra Facts §§ I-III; Arg. § III-B; CAPA § 22948.3(a)(2).
4 The law applies to Plaid. Plaid’s primary argument asks the Court to ignore CAPA’s plain text,
5 declaring—without support—that the legislature must have intended to create an amorphous exception
6 for “legitimate” businesses, which Plaid claims to be. MTD at 33. Absolutely nothing supports Plaid’s
7 contention. Both CAPA and its legislative history confirm that civil liability attaches to any entity that
8 solicits private information by misrepresenting itself to be another business, as Plaid did. See CAPA
9 § 22948.2 (unlawful for “any” person); Ex. 2 at 1 (“This bill makes it illegal for anyone to request that a
10 consumer provide personal information by using e-mail, Web sites, or the Internet to impersonate a
11 legitimate business.”) (emphasis added). The statute does not limit who can be a defendant as Plaid
12 suggests, or otherwise use “legitimate” or its synonyms. CAPA’s history shows that lawmakers were
13 concerned, not with insulating certain companies from liability, but with protecting “unsuspecting
14 consumers” from providing personal information to false imitators of businesses—including banks
15 specifically—whose reputations and customer relationships violators like Plaid exploit. See Ex. 3 at 1.27
16 Plaid’s attempt to create an ill-defined exception, where CAPA itself is clear, violates basic
17 canons of statutory interpretation. See United States v. Neville, 985 F.2d 992, 995 (9th Cir. 1993) (“[I]f
18 the language of a statute is clear . . . then there is no need to ‘interpret’ the language by resorting to the
19 legislative history or other extrinsic aids”) (citation omitted). Judgments holding other established
20 companies liable for their CAPA violations also give the lie to Plaid’s position. See, e.g. Facebook, Inc.
21 v. Fisher, No. 09-05842, 2011 WL 250395, at *2 (N.D. Cal. Jan. 26, 2011); id. ECF No. 1 (awarding
22 injunction and statutory damages against otherwise legitimate marketing companies); Greenwich Ins.
23
27
24 Earlier drafts of CAPA prohibited impersonating an “online business,” but the language was amended
to clarify that misrepresenting oneself as any business gave rise to a CAPA violation. See Ex. 3 at 4. For
25 this reason, Plaid’s assertion that the CAPA claim is a “red herring” because some banks do not have the
technical capability to provide an OAuth protocol of their own (MTD at 7) is irrelevant—CAPA does
26 not require a defendant to exactly replicate the businesses it impersonates. Indeed, liability does not even
require that Plaid represented itself to “be” Plaintiffs’ financial institutions (as it did), but could also be
27 established with proof that Plaid purported to “represent” those institutions (as it also did). See Ex. 4 at 2
(to “indicate that he or she is or represents an online business without authorization from that business”
28 would be an example of conduct violating CAPA) (emphasis added).
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
- 40 - CASE NO. 4:20-CV-03056-DMR
1 Co, v. Media Breakaway, LLC, No. 08-937, 2009 WL 6521581 (C.D. Cal. Jun. 11, 2009) (same, in
2 arbitration).
3 CAPA must be broadly construed. Plaid is flat wrong to argue that the rule of lenity—under
4 which penal statutes are construed strictly—exculpates Plaid from its scheme to pose as banks. MTD at
5 24 n.21, 33. CAPA is a civil statute in Business and Professions Code Division 8 (Special Business
6 Regulations), not a penal statute, and it carries no criminal penalties. CAPA § 22948.3. “[T]he rule of
7 strict construction of penal statutes” does not apply to civil statutes such as CAPA. Pineda v. Williams-
8 Sonoma Stores, Inc., 51 Cal. 4th 524, 532 n.8 (2011). Instead, the California Supreme Court instructs
9 that “courts should liberally construe remedial statutes in favor of their protective purpose.” Id.
10 (emphasis added). And, where lawmakers use broad language such as “any” (e.g., “any person,” “take
11 any action” in CAPA § 22948.2), courts should infer that the legislature did not want the statutory
12 protections to be narrowly construed. See id. at 533.
13 Certainly, Plaid’s citations show that lawmakers were aware of criminal phishing schemes. MTD
14 at 33; Ex. 3 at 3. However, as widely observed when CAPA came into force, California took a different
15 approach from the criminal laws in certain other states, because of the legislature’s interest in deterrence
16 and use of civil liability as the appropriate vehicle to effectuate that purpose. See Camille Calman,
17 Bigger Phish to Fry: California’s Anti-Phishing Statute and Its Potential Imposition of Secondary
18 Liability on Internet Service Providers, 13 Rich. J.L. & Tech. 2, 4 (2006); see also CAPA § 22948.3(d)
19 (criminal remedies not precluded by statute). The bill’s author’s stated intent in introducing the law was
20 to “improve the security of the Internet,” and supporters of the law lauded its ability to preserve
21 “confidence in the integrity of personal information transmitted via the internet [which is] an integral
22 part of the medium’s development.” Ex. 3 at 3. Plaid’s false banking login pages compromise
23 confidence in financial technology apps precisely in the way that concerned the legislature and
24 supporters of this law. See, e.g., ¶ 79 (explaining that such practices create risk and undermine consumer
25 trust).
26 Accordingly, contrary to Plaid’s suggestion (MTD at 34), this remedial statute does not require
27 Plaintiffs to plead that Plaid’s “goal” was to commit identity theft. See CAPA § 22948.2; Ex. 7 at 2
28 (explaining CAPA would change “existing law,” which required proving intent to defraud). Even if it
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
- 41 - CASE NO. 4:20-CV-03056-DMR
1 did, Plaintiffs plainly allege that Plaid’s purpose in violating CAPA was to acquire banking credentials
2 for classic identity theft, i.e., to pose as consumers logging into their financial accounts in order to
3 extract their banking data. See ¶ 40 (Plaid’s interface was designed “for the purpose of ensuring . . . its
4 process would fool consumers” into “handing their login information to a third party.”); ¶ 32 (“Plaid has
5 achieved its success by accessing all of the data stored in consumers’ financial accounts without
6 consumers’ knowledge or consent.”); ¶ 27 (“Plaid’s true purpose is to monetize consumer transactional
7 and other banking data”); ¶¶ 29, 34, 39, 41, 45, 46, 48-58.
8 F. Plaintiffs Properly Plead A Claim For Deceit
9 Plaid argues in error that Plaintiffs cannot meet any of the five elements for deceit under
10 California law. MTD at 34. Plaintiffs plead facts supporting each element with the requisite specificity.
11 First, Plaid concealed and failed to disclose its true nature and conduct through misleading
12 statements, omissions, and nondisclosures. ¶¶ 360(a)-(f). As discussed supra at Arg. § II, Plaid cannot
13 defeat these well-pled allegations by trotting out its privacy policy.
14 Second, Plaid had a duty to disclose. Deceit is not limited to fiduciary relationships, but extends
15 to where “the defendant [has] excusive knowledge of material facts not known to the plaintiff”, where
16 there is “active conceal[ment of] a material fact”, or where “the defendant makes [a] partial
17 representation[] but also suppresses some material facts.” Hoffman v. 162 N. Wolfe LLC, 228 Cal. App.
18 4th 1178, 1187 (2014), as modified (Aug. 13, 2014). In such alternatives, “[a] relationship between the
19 parties is present if there is ‘some sort of transaction between the parties.’ . . . like any kind of
20 contractual agreement.” Id. (emphasis in original). Plaintiffs allege they were involved with transactions
21 with Plaid (albeit unbeknownst to them) whereby they connected the Apps to their bank accounts using
22 Plaid’s software that was embedded in the Apps, unwittingly granting Plaid the keys to their accounts
23 (and access to all the data therein) in the process. See ¶¶ 100-207. Those transactions create the minimal
24 relationship required for Plaid to have a duty to disclose arising out of its exclusive knowledge of
25 material facts not known to Plaintiffs (¶ 360(a), (c)), its active concealment of material facts (¶ 360(d)),
26 and its partial representations while suppressing some material facts. ¶ 360(b), (e)-(f).
27 Third, Plaid’s deceit was intentional. Intent may be alleged generally, Fed. R. Civ. P. 9(b), and
28 there are more than sufficient allegations in the CAC. See, e.g., ¶¶ 40-41, 76-77. Again, Plaid’s only
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
- 42 - CASE NO. 4:20-CV-03056-DMR
1 rebuttal is to point to its legally (and factually) insufficient privacy policy, which was so dramatically
2 minimized in the account linking process, and is drafted so broadly and misleadingly, that the policy in
3 itself suggests an intent to deceive. See supra Arg. § II.
4 Fourth, Plaintiffs adequately plead reliance. In an omissions case such as this, reliance may be
5 shown by showing that “had the omitted information been disclosed, [the plaintiff] would have been
6 aware of it and behaved differently.” Sloan v. GM, LLC, 287 F. Supp. 3d 840, 873 (N.D. Cal. 2018)
7 (quotation omitted). This “can be presumed, or at least inferred, when the omission is material.” Id. at
8 874. A misrepresentation is material “if a reasonable man [sic] would attach importance to its existence
9 or nonexistence in determining his choice of action in the transaction in question”—“as such materiality
10 is generally a question of fact.” Id. (quotation omitted); see also Hoffman, 228 Cal. App. 4th at 1193-94
11 (reliance is a factual issue that may only be decided as a matter of law “if reasonable minds can come to
12 only one conclusion based on the facts,” and then only on summary judgment).28 At the pleading stage,
13 it suffices for Plaintiffs to allege that they would not have entered the transaction if they had been aware
14 of the omitted information. See Sloan, 287 F. Supp. 3d at 874. Plaintiffs have pled just that. ¶¶ 105, 116,
15 126, 135, 145, 155, 164, 173, 183, 194, 204.29
16 Fifth, Plaid argues that Plaintiffs fail to allege damage, cross-referencing the arguments it made
17 regarding injury-in-fact. MTD at 36. For the reasons stated supra at Facts § III and Arg. §§ III-A, C &
18 D, Plaid’s argument fails.
19 Sixth, Plaintiffs satisfy Rule 9(b). Particularity can be met, as it is here, by Plaintiffs’ description
20 of what is misleading about a webpage or other online content that is “specific enough to give
21 defendants notice of the particular misconduct which is alleged to constitute the fraud.” Ferrington v.
22 McAfee, Inc., No. 10-01455, 2010 WL 3910169, at *2, *6 (N.D. Cal. Oct. 5, 2010) (quotation omitted)
23 (9(b) satisfied by describing misleading aspects of a pop-up ad, including how it mimicked the look of
24 other pages, the ad’s contents, and the color and font of information in the ad). Likewise, Plaintiffs plead
25
28
26 That Plaid’s violations implicate the GLBA, which requires privacy notices to be “clear and
conspicuous,” further underscores the materiality of the omitted information. Consumers must have
27 meaningful choice in connection with their sensitive financial information.
29
Plaid also improperly relies on its privacy policy as a defense against the well-pleaded allegations of
28 reliance (MTD at 36).
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
- 43 - CASE NO. 4:20-CV-03056-DMR
1 the specific misconduct that is fraudulent, including misleading statements and omissions in Plaid’s
2 template software (along with the font size, color, lack of underlining, and other elements of the screens
3 at issue), as well as misleading statements and omissions in its privacy policy. ¶¶ 37-39, 66-75. Plaid is
4 on notice as required by Rule 9(b).
5 Plaid cites a different and non-governing articulation of 9(b) as set forth in Marolda v. Symantec
6 Corp., 672 F. Supp. 2d 992 (N.D. Cal. 2009), but that case is distinguishable and its holding has not
7 been adopted. See, e.g., Overton v. Bird Brain, Inc., No. 11-1054, 2012 WL 909295, at *6 (C.D. Cal.
8 Mar. 15, 2012) (“[T]he Marolda requirements are not necessarily appropriate for all cases alleging a
9 fraudulent omission.”). Nevertheless, Plaintiffs have satisfied even this non-applicable standard as well
10 by providing “representative samples” of the screens Plaid employed. See ¶¶ 38, 67 (sample screens
11 from Venmo and Plaid’s bank login templates).
12 G. Plaintiffs State A Claim For Unjust Enrichment/Quasi-Contract
13 Plaintiffs state a claim for unjust enrichment/quasi-contract, entitling them to restitution of the
14 economic benefits Plaid gained by violating their rights. Plaid’s argument about remedies at law is
15 addressed supra, Arg. § V. Plaid is incorrect to argue that California does not recognize this claim.
16 Astiana, 783 F.3d at 762 (unjust enrichment a claim); see also Brazil v. Dole Packaged Foods, LLC, 660
17 F. App’x 531, 535 (9th Cir. 2016) (reversing district court’s dismissal of a claim for unjust enrichment);
18 In re Vizio, 238 F. Supp. 3d at 1233 (C.D. Cal. 2017); Trazo v. Nestle USA, Inc., 113 F. Supp. 3d 1047,
19 1049 (N.D. Cal. 2015) (citing Astiana and reinstating plaintiff’s quasi-contract claims). Plaid’s only
20 case, McLellan v. Fitbit, Inc., fails to advert to Astiana or other binding law and references unjust
21 enrichment in one conclusory sentence. No. 16-00036, 2018 WL 2688781, at *4 (N.D. Cal. June 5,
22 2018).
23 To the extent Plaid takes issue with the sufficiency of its alleged “misrepresentation or omission”
24 (MTD at 37), this is addressed in previous sections, and belied by the robust allegations in the CAC. See,
25 e.g., ¶¶ 74, 76, 229 (summarizing the “unethical, unfair, and deceptive practices Plaid employed); supra,
26 Facts § I and Arg. §§ VI-B & F. Plaid unjustly retained the meaningful monetary benefits of harvesting
27 and selling Plaintiffs’ data. ¶¶ 6, 62-63, 229, 320-24, 333, 354. These allegations far exceed the
28 “straightforward statement” required to state this cause of action. Astiana, 783 F.3d at 762-63.
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
- 44 - CASE NO. 4:20-CV-03056-DMR
1 CONCLUSION
2 For all the foregoing reasons, Plaintiffs respectfully request that the Court deny Plaid’s Motion to
3 Dismiss and allow this case to proceed on the merits. In the alternative, the Court should grant leave to
4 amend. Contrary to Plaid’s assertions that Plaintiffs have amended five complaints with “ample time”
5 (MTD at 2, 38), Interim Co-Lead Class Counsel have filed one consolidated complaint in this action, on
6 August 5, 2020, seven days after they were appointed. Dkt. 57. The sufficiency of that pleading has not
7 previously been addressed. See U.S. v. United Healthcare Ins. Co., 848 F.3d 1161, 1183 (9th Cir. 2016);
8 Moss v. U.S. Secret Serv., 572 F.3d 962, 972 (9th Cir. 2009) (“requests for leave should be granted with
9 ‘extreme liberality’”) (citation omitted).
10
11
Dated: November 17, 2020 HERRERA PURDY LLP
12
/s/ Shawn Kennedy
13 Shawn M. Kennedy
14 Shawn M. Kennedy (SBN 218472)
skennedy@herrerapurdy.com
15 Andrew M. Purdy (SBN 261912)
apurdy@herrerapurdy.com
16 Bret D. Hembd (SBN 272826)
bhembd@herrerapurdy.com
17 4590 MacArthur Blvd., Suite 500
Newport Beach, CA 92660
18 Tel: (949) 936-0900
Fax: (855) 969-2050
19
HERRERA PURDY LLP
20 Nicomedes Sy Herrera (SBN 275332)
nherrera@herrerapurdy.com
21 Laura E. Seidl (SBN 269891)
lseidl@herrerapurdy.com
22 1300 Clay Street, Suite 600
Oakland, CA 94612
23 Tel: (510) 422-4700
Fax: (855) 969-2050
24
25
26
27
28
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
- 45 - CASE NO. 4:20-CV-03056-DMR
1 Dated: November 17, 2020 LIEFF CABRASER HEIMANN & BERNSTEIN, LLP
2 /s/ Rachel Geman
Rachel Geman
3
Rachel Geman (Pro Hac Vice)
4 rgeman@lchb.com
Rhea Ghosh (Pro Hac Vice)
5 rghosh@lchb.com
250 Hudson Street, 8th Floor
6 New York, NY 10013-1413
Tel: (212) 355-9500
7 Fax: (212) 355-9592
8 LIEFF CABRASER HEIMANN & BERNSTEIN, LLP
Michael W. Sobol (SBN 194857)
9 msobol@lchb.com
Melissa Gardner (SBN 289096)
10 mgardner@lchb.com
275 Battery Street, 29th Floor
11 San Francisco, CA 94111-3339
Tel: (415) 956-1000
12 Fax: (415) 956-1008
13 Dated: November 17, 2020 BURNS CHAREST LLP
14 /s/ Christopher Cormier
Christopher J. Cormier
15
Christopher J. Cormier (Pro Hac Vice)
16 ccormier@burnscharest.com
4725 Wisconsin Avenue, NW
17 Washington, DC 20016
Tel: (202) 577-3977
18 Fax: (469) 444-5002
19 BURNS CHAREST LLP
Warren T. Burns (Pro Hac Vice)
20 wburns@burnscharest.com
Russell Herman (Pro Hac Vice)
21 rherman@burnscharest.com
900 Jackson Street, Suite 500
22 Dallas, TX 75202
Tel: (469) 904-4550
23 Fax: (469) 444-5002
24 Interim Co-Lead Class Counsel
25
26
27
28
OPP TO PLAID’S MOT. TO DISMISS
2061689.1
- 46 - CASE NO. 4:20-CV-03056-DMR
File and source
- File
- gov.uscourts.cand.359040.108.0_1.pdf
- Size
- 209,334 bytes
- SHA-256
- 07797fe5109b5051b448a396641a870e5d8e991fe1d38bf42be25c9332b6eb6a
- Original
- archive.org