1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 7 A.B., A MINOR, BY AND THROUGH HIS Case No. 23-cv-03101-PCP GUARDIAN JEN TURNER, et al., 8 Plaintiffs, ORDER DENYING MOTION TO 9 DISMISS v. 10 Re: Dkt. No. 27 GOOGLE LLC, et al., 11 Defendants.
12 13 Plaintiffs, six minors under the age of 13 domiciled in California, Florida, and New York, 14 allege that defendants Google LLC, AdMob Google Inc., and AdMob Inc. unlawfully invaded 15 their privacy by collecting their personal information through various mobile apps without 16 parental consent. The defendants now move to dismiss plaintiffs’ complaint pursuant to Federal 17 Rule of Civil Procedure 12(b)(6). For the following reasons, the defendants’ motion is denied. 18 BACKGROUND 19 Google maintains a marketplace for Android mobile phone apps called the Google Play 20 Store, where AdMob Google and AdMob (both owned by Google) show advertisements to users 21 of such apps.1 The AdMob software development kit (SDK) purportedly enables Google to collect 22 data from Android app users and show them targeted advertisements based on this data. AdMob 23 allegedly pays Android app developers to integrate its SDK into their mobile apps to make this 24 data collection and targeted advertising possible. 25 In April 2015, Google developed a Designed for Families (DFF) program for children’s 26 1 The following facts are drawn from the complaint. In considering a Rule 12(b)(6) motion 27 contending that a complaint fails to state a claim, the Court must “accept all factual allegations in 1 apps, which purportedly imposed requirements set by the federal Children’s Online Privacy 2 Protection Act (COPPA) to protect children under the age of 13 from having their personal 3 information collected without parental consent. COPPA states: “It is unlawful for an operator of a 4 website or online service directed to children, or any operator that has actual knowledge that it is 5 collecting personal information from a child, to collect personal information from a child in a 6 manner that violates the regulations prescribed [by the Federal Trade Commission].” 15 U.S.C. § 7 6502(a). The FTC has interpreted “website or online service” to include mobile apps as well as 8 individual channels like the Google Play Store that serve as the platform for such apps. 16 C.F.R. 9 § 312.2. The relevant FTC rule has interpreted “directed to children” to mean that data cannot be 10 collected through apps that are primarily child-directed or for mixed audiences but not properly 11 age-gated. 12 In 2018, security researchers from the University of California, Berkeley purportedly 13 informed defendants of surreptitious tracking and data collection in violation of COPPA by 14 developers of apps included in Google’s DFF program. Specifically, the researchers found that 15 2,667 apps were potentially incorrectly characterized by developers as directed to “mixed 16 audiences” or “not primarily directed to children,” allowing developers to engage in defective age- 17 gating and thus participate in prohibited behavioral advertising to children. Dkt. No. 1, at 36. 18 Based on the results of this study, Google banned the app developer Tiny Lab Productions from its 19 Play Store in September 2018. The New Mexico Attorney General’s Office then brought a lawsuit 20 against Tiny Lab Productions, various advertising networks including AdMob, and Google as the 21 operator of the Play Store. N.M. ex rel. Balderas v. Tiny Lab Prods., 457 F. Supp. 3d 1103 22 (D.N.M. 2020). On December 10, 2021, as part of a settlement agreement and without admitting 23 any liability, Google and AdMob agreed to implement policy changes to prevent the 24 mischaracterization of DFF apps. Dkt. No. 27, at 12. 25 Plaintiffs here allege that defendants obtained personal information from children under 26 the age of 13 through Android apps in violation of COPPA and other common law privacy 27 protections. Google purportedly accepted children’s apps (including 86 from the app developer 1 categorized as for a “mixed audience” or “not primarily intended for children” without proper age- 2 gating, thereby enabling developers to skirt COPPA’s prohibitions on collecting data from minors 3 under the age of 13. Dkt. No. 1, at 30. Plaintiffs further allege that defendants knew about the 4 collection of personal data from children through DFF program apps. Plaintiffs assert the 5 following causes of action: (1) violation of California’s Unfair Competition Law (UCL); (2) 6 violation of common law intrusion upon seclusion; (3) unjust enrichment under California law; (4) 7 violation of California’s constitutional right to privacy; (5) violation of Florida’s Deceptive and 8 Unfair Trade Practices Act (FDUTPA); (6) unjust enrichment under Florida law; (7) violation of 9 New York’s General Business Law (NYGBL); and (8) unjust enrichment under New York law. 10 Plaintiffs’ claims under the UCL, FDUTPA, and NYGBL are all premised on an underlying 11 COPPA violation. 12 Defendants now move to dismiss plaintiffs’ complaint, contending that the purported 13 unlawful conduct only pertains to developer Tiny Lab Productions, which was banned from the 14 Google Play Store in September 2018. Defendants also argue that plaintiffs: (1) fail to provide fair 15 notice under Rule 8 because they do not allege when the supposed misconduct occurred and most 16 of the state law claims have statutes of limitations between 2 to 4 years; (2) lack standing to seek 17 prospective injunctive relief because they do not demonstrate a threat of being harmed again; (3) 18 cannot assert any state law claims because they are preempted by COPPA; (4) fail to state a claim 19 under the UCL because they have not established an economic injury, do not allege wrongful 20 conduct under any of the three prongs, and are not entitled to equitable relief; (5) fail to state a 21 claim under New York and Florida’s consumer protection laws because Google’s Terms of 22 Service contain a California choice-of-law provision and plaintiffs do not plead claims with 23 particularity or provide a sufficient nexus to New York and Florida; (6) fail to state claims for 24 common law and constitutional right to privacy violations under California law because they do 25 not allege egregious conduct violating a reasonable expectation of privacy; and (7) fail to state a 26 claim for unjust enrichment because this cause of action does not exist. 27 1 LEGAL STANDARDS 2 The Federal Rules require a complaint to include only a “short and plain statement of the 3 claim showing that the pleader is entitled to relief.” Fed. R. Civ. P. 8(a)(2). In considering a Rule 4 12(b)(6) motion contending that a complaint fails to state a claim, the Court must “accept all 5 factual allegations in the complaint as true and construe the pleadings in the light most favorable” 6 to the non-moving party. Rowe v. Educ. Credit Mgmt. Corp., 559 F.3d 1028, 1029 (9th Cir. 2009). 7 Dismissal is required if the plaintiff fails to allege facts allowing the Court to “draw the reasonable 8 inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 9 663 (2009). While legal conclusions “can provide the complaint’s framework,” the Court will not 10 assume they are correct unless adequately “supported by factual allegations.” Id. at 664. 11 On a Rule 12(b)(6) motion, materials outside the complaint can be considered only if they 12 are incorporated by reference therein or otherwise judicially noticeable. See United States v. 13 Ritchie, 342 F.3d 903, 908 (9th Cir. 2003) (“A [district] court may … consider certain materials— 14 documents attached to the complaint, documents incorporated by reference in the complaint, or 15 matters of judicial notice—without converting the motion to dismiss into a motion for summary 16 judgment.”). Incorporation by reference is permitted if the complaint “refers extensively to the 17 document” or if “the document forms the basis” of the claim. Khoja v. Orexigen Therapeutics, 18 Inc., 899 F.3d 988, 1002 (9th Cir. 2018). Federal Rule of Evidence 201 permits judicial notice of 19 “a fact that is not subject to reasonable dispute” because it is “generally known.” 20 Fraud-based claims are subject to the heightened pleading requirements established by 21 Federal Rule of Civil Procedure 9(b) instead of the more lenient Rule 8 standard. When “alleging 22 fraud or mistake, a party must state with particularity the circumstances constituting fraud or 23 mistake.” Fed. R. Civ. P. 9(b). The pleading of fraud must be “specific enough to give defendants 24 notice of the particular misconduct … so that they can defend against the charge and not just deny 25 that they have done anything wrong.” Vess v. Ciba-Geigy Corp. USA, 317 F.3d 1097, 1106 (9th 26 Cir. 2003). Malice, intent, and knowledge may be alleged generally, however. Fed. R. Civ. P. 9(b). 27 1 ANALYSIS 2 I. Plaintiffs’ Claims Are Not Time-Barred. 3 Defendants argue that because Tiny Lab was banned from the Google Play Store in 4 September 2018, more than 4 years before this complaint was filed on June 6, 2023, plaintiffs’ 5 claims are time-barred.2 Plaintiffs respond that while the AdMob SDK was discovered in DFF 6 program children’s apps in 2018, Google did not remedy this conduct until December 10, 2021, 7 when it reached a settlement agreement with the New Mexico Attorney General’s Office to 8 prevent further mischaracterization of child-targeted DFF apps as apps for “mixed audiences.” 9 Dkt. No. 33, at 14. Accordingly, plaintiffs argue, the COPPA violations that form the primary 10 basis for their claims continued through 2021 in apps by developers other than Tiny Lab. Plaintiffs 11 also contend that even if Tiny Lab was banned from the Google Play Store in September 2018, 12 apps by Tiny Lab were not deleted from children’s phones so tracking and data collection through 13 such apps could have continued past 2018. Id. at 15 (noting that collection of plaintiffs’ 14 information through AdMob’s SDK also occurs “during the use of the already-downloaded DFF 15 AdMob Apps”). 16 In the Ninth Circuit, the statute of limitations is generally an affirmative defense rather 17 than an element of the plaintiff’s claim. See Lasko v. Caliber Home Loans, 2022 WL 728820, at 18 *1 (9th Cir. Mar. 10, 2022) (noting that “a statute of limitations is an affirmative defense, not a 19 cause of action”) (citing United States v. Allahyari, 980 F.3d 684, 686 (9th Cir. 2020)). As a 20 result, the defense generally cannot be asserted on a Rule 12(b)(6) motion. “If the running of the 21 statute is apparent on the face of the complaint,” however, “the defense may be raised by a motion 22 to dismiss.” Jablon v. Dean Witter & Co., 614 F.2d 677, 682 (9th Cir. 1980). “When a motion to 23 dismiss is based on the running of the statute of limitations, it can be granted only if the assertions 24 of the complaint, read with the required liberality, would not permit the plaintiff to prove that the 25 statute was tolled” or that the claims were timely. Id. Thus, to survive a motion to dismiss, 26 2 The fact that Google banned Tiny Lab from its Play Store in September 2018 is judicially 27 noticeable because plaintiffs explicitly reference a news article saying as much in their complaint. 1 plaintiffs “simply need to plead facts demonstrating a potential factual dispute that could affect 2 whether the defense applies.” Rabin v. Google LLC, 2024 WL 1269313, at *2 (N.D. Cal. Mar. 26, 3 2024). “Only when the plaintiff pleads itself out of court—that is, admits all the ingredients of an 4 impenetrable defense—may a complaint that otherwise states a claim be dismissed under Rule 5 12(b)(6).” Durnford v. MusclePharm Corp., 907 F.3d 595, 604 (9th Cir. 2018). 6 Plaintiffs’ complaint here, when construed liberally, pleads facts demonstrating a potential 7 factual dispute by sufficiently alleging that defendants’ purportedly unlawful conduct continued 8 within the relevant statute-of-limitations period. Specifically, the complaint alleges that minors 9 were tracked through various Android apps in Google’s DFF program, not just Tiny Lab’s apps. 10 The fact that Tiny Lab was removed from the Google Play Store in 2018 therefore does not on its 11 own render plaintiffs’ claims time-barred. Further, plaintiffs allege that unlawful tracking 12 continued to occur through 2021 on the devices of children who had downloaded Tiny Lab apps 13 before its 2018 removal from the Google Play Store because the apps were not deleted from their 14 devices. 15 Because plaintiffs allege that unlawful tracking and advertising was occurring through 16 Android apps at least until 2021, defendants cannot establish, from the face of the complaint, that 17 plaintiffs’ claims are time-barred.3 18 II. Plaintiffs Have Standing To Seek Injunctive Relief. 19 Defendants argue that plaintiffs lack standing to seek injunctive relief because they fail to 20 establish a “real or immediate threat that [they] will again be wronged in a similar way.” Mayfield 21 v. United States, 599 F.3d 964, 970 (9th Cir. 2010). “Past exposure to illegal conduct does not in 22 itself show a present case or controversy regarding injunctive relief … if unaccompanied by any 23 continuing, present adverse effects.” O’Shea v. Littleton, 414 U.S. 488, 495–96 (1974). Because 24 Google purportedly altered its policies concerning the characterization of apps in the DFF program 25
26 3 Defendants cite statutes of limitations ranging between 2 and 4 years for the various causes of action. Dkt. No. 27, at 15 n.5. Because the settlement with the New Mexico Attorney General’s 27 Office occurred in December 2021 and the complaint was filed in June 2023, even claims with a 1 through its settlement with the New Mexico Attorney General’s Office in 2021, defendants 2 contend that plaintiffs fail to allege any continuing harm to warrant injunctive relief. 3 The defendants may be correct that plaintiffs lack standing to seek prospective changes to 4 Google’s DFF program policies. But plaintiffs also request that defendants “permanently delete, 5 destroy or otherwise sequester the Personal Information collected without parental consent.” Dkt. 6 No. 1, at 63. Notwithstanding any change in defendants’ DFF policies, defendants have not 7 provided evidence that the information purportedly collected from minors before the 2021 8 settlement has been deleted. Dkt. No. 33, at 33. Because the harm from defendants’ alleged 9 possession and use of plaintiffs’ information purportedly continues, plaintiffs have standing to 10 seek injunctive relief to remedy that harm. 11 III. Plaintiffs’ State Law Claims Are Not Preempted by COPPA. 12 Defendants argue that plaintiffs’ state law claims are preempted by COPPA because those 13 claims are inconsistent with the federal statute. The FTC’s COPPA Rule requires a defendant to 14 have “actual knowledge” that data is being collected from apps that are primarily child-directed or 15 relevant to mixed audiences but not properly age-gated. 16 C.F.R. § 312.2. Defendants argue that 16 plaintiffs fail to meet this actual knowledge requirement because they only allege in a conclusory 17 manner that “Google had actual knowledge that every DFF App was ‘child directed’ as defined 18 under COPPA.” Dkt. No. 1, at 33. Defendants also contend that plaintiffs’ state law claims are too 19 broad because the fact that DFF apps were deemed “appropriate for children” per Google’s 20 policies did not mean that they were “directed to children” under COPPA’s statutory definition. 21 The Ninth Circuit recently held in a similar case that the same causes of action being 22 pursued here were not preempted by COPPA because they did not “stand as an obstacle to 23 COPPA in purpose or effect” and were “consistent with COPPA.” Jones v. Google LLC, 73 F.4th 24 636, 643 (9th Cir. 2023). The Jones Court found that COPPA does not preempt “state-law causes 25 of action that are parallel to, or proscribe the same conduct forbidden by, COPPA.” Id. The Court 26 explained that COPPA does not preempt “state law claims based on underlying conduct that also 27 violates COPPA’s regulations.” Id. at 640–41. 1 because plaintiffs fail to sufficiently plead that defendants had actual knowledge about data 2 collection through apps that were directed to children, and thus do not allege an underlying 3 COPPA violation but instead seek to hold the defendants liable for conduct that does not violate 4 COPPA’s regulations. 5 Defendants may or may not be right that state law claims permitting liability to be 6 established absent actual knowledge are preempted by COPPA.4 Contrary to the defendants’ 7 contentions, however, plaintiffs have adequately pleaded actual knowledge. As noted already, 8 plaintiffs specifically allege that “Google had actual knowledge that every DFF App was ‘child 9 directed’ as defined under COPPA.” Dkt. No. 1, at 33; see Fed. R. Civ. P. 9(b) (noting that 10 knowledge may be alleged generally). They have also pleaded facts plausibly supporting this 11 allegation. Plaintiffs allege that defendants were made aware by security researchers at Berkeley 12 that 2,667 DFF apps (~51% of the apps in their sample) were incorrectly listed as directed to 13 “mixed audiences” and “not primarily directed to children.” Dkt. No. 1, at 36. The researchers 14 noted that developers were miscategorizing their apps and then engaging in defective age-gating, 15 thereby collecting data from minors under the age of 13 in violation of COPPA. The researchers 16 used 84 Tiny Lab apps as a case study to show evidence of this behavior. Because plaintiffs allege 17 that Google was informed of this study, plaintiffs at the very least adequately plead that Google 18 had actual knowledge of Tiny Lab’s purportedly unlawful behavior (which, as previously noted, 19 allegedly continued to permit tracking and data collection until 2021). 20 Plaintiffs also allege that Google “reviewed each DFF App submission to ensure that the 21 App provided a specific benefit to children under thirteen or was relevant to children under 22 thirteen.” Dkt. No. 1, at 32. As plaintiffs note, Google’s 2015 DFF program policy stated that 23 “[g]eneral audience apps that have no specific benefit or relevance for audiences under the age of 24 thirteen will not be accepted into the program. To participate, there are specific guidelines your 25 apps need to meet, which are assessed in an app content review.” Dkt. No. 1, at 27–28 (emphasis 26
27 4 Because plaintiffs have adequately pleaded actual knowledge, the Court will not decide that issue 1 added). Assuming that Google reviewed every app for compliance with COPPA before accepting 2 it into the DFF program, plaintiffs sufficiently allege that Google had actual knowledge that 3 certain apps were being mischaracterized as for “mixed audiences” when they were in fact child- 4 directed. 5 Taken together, plaintiffs’ allegations about the Berkeley study and Google’s 6 individualized review of each app submitted to the DFF program adequately plead that defendants 7 had actual knowledge of the purported misconduct. The District of New Mexico held as much in 8 its related 2020 case:
9 Putting it all together, these facts state that: Google reviews the content of apps submitted to its Designed for Families program with 10 a particular eye toward whether the apps are relevant for children; Tiny Lab’s apps, replete with characteristics revealing their child- 11 directed content, were submitted to and accepted by Google into that program; and, after being contacted by concerned [Berkeley] 12 researchers, Google reviewed the content of Tiny Lab’s apps with the specific goal of determining whether they were primarily directed to 13 children. The reasonable inference to be drawn from these facts is that Google conducted not one but two reviews of the content of Tiny 14 Lab’s apps, during which Google gained (and gained again) a first- hand awareness or understanding of the child-directed nature of those 15 apps. The Complaint thus plausibly claims that, first through its review process in connection with the submission of Tiny Lab’s apps 16 to its Designed for Families program and again through its investigation of those apps to determine whether they were primarily 17 child-directed, Google obtained actual knowledge that Tiny Lab’s apps are directed to children. 18 19 Balderas, 457 F. Supp. 3d at 1107.5 Similarly here, plaintiffs sufficiently allege that defendants 20 had actual knowledge, generated through its internal review process and the Berkeley study, that 21 apps directed to children in the DFF program had been instead characterized as for mixed 22 audiences and were using the AdMob SDK to track and collect data. Because plaintiffs adequately 23 plead an underlying COPPA violation, their state law claims proscribing the same conduct are not 24
25 5 Google moved for reconsideration, but the Court denied its motion in 2021. See N.M. ex rel. Balderas v. Tiny Lab Prods, 516 F. Supp. 3d 1293, 1301 (D.N.M. 2021) (“Reading these 26 allegations together, the factual content of the Complaint plausibly alleges that, first through its review process in connection with the submission of Tiny Lab’s apps to its Designed for Families 27 program and again through its investigation of those apps to determine whether they were 1 preempted by COPPA. 2 IV. Plaintiffs Adequately Plead a UCL Claim. 3 California’s Unfair Competition Law (UCL) prohibits unfair competition, which means 4 “any unlawful, unfair, or fraudulent business act or practice and unfair, deceptive, untrue, or 5 misleading advertising.” Cal. Bus. & Prof. Code § 17200. When assessing a UCL claim, courts 6 consider each of three prongs—unlawful, fraudulent, and unfair—to determine whether a practice 7 constitutes unfair competition, and “a claim that sufficiently pleads any of these prongs survives a 8 motion to dismiss.” MacDonald v. Ford Motor Co., 37 F. Supp. 3d 1087, 1097 (N.D. Cal. 2014). 9 Defendants first contend that plaintiffs lack standing to bring a UCL claim because they 10 have not alleged an economic injury. See Turner v. Wells Fargo Bank NA, 859 F.3d 1145, 1151 11 (9th Cir. 2017) (noting that a plaintiff must “establish a loss or deprivation of money or property 12 sufficient to qualify as injury in fact, i.e., economic injury” to assert a UCL claim). In their view, 13 the misappropriation of personal information does not qualify. Pruchnicki v. Envision Healthcare 14 Corp., 845 F. App’x 613, 615 (9th Cir. 2021) (holding that “mere misappropriation of personal 15 information does not establish compensable damages”); see also In re Google, Inc. Privacy Pol’y 16 Litig., 2015 WL 4317479, at *5 n.63 (N.D. Cal. Jul. 15, 2015) (finding the misappropriation of 17 personal information without a resultant economic harm to be neither damage nor injury-in-fact). 18 There is a split of authority in this District on this issue and no binding Ninth Circuit 19 precedent. Compare In re Facebook Privacy Litig., 791 F. Supp. 2d 705, 714 (N.D. Cal. 2011), 20 aff’d 572 F. App’x 494 (9th Cir. 2014) (“[P]ersonal information does not constitute property for 21 purposes of a UCL claim.”) and M.K. v. Google LLC, 2023 WL 2671381, at *5 (N.D. Cal. Mar. 22 27, 2023) (same) with Calhoun v. Google LLC, 526 F. Supp. 3d 605, 636 (N.D. Cal. 2021) 23 (concluding that “plaintiffs who suffered a loss of their personal information suffered economic 24 injury and had standing”) and Brown v. Google LLC, 2021 WL 6064009, at *15 (N.D. Cal. Dec. 25 22, 2021) (finding the loss of personal information through Google’s data collection as sufficient 26 to qualify as the diminution of a future property interest). 27 Notwithstanding decisions in this District holding otherwise, see, e.g., Katz-Lacabe v. 1 with the rationale of Calhoun and Brown and concludes that plaintiffs have adequately pleaded the 2 economic injury needed to establish UCL standing. As the Court has previously held, “Privacy 3 harms involving personal data can constitute an injury to money or property sufficient to provide 4 standing under the UCL.” In re Meta Pixel Tax Filing Cases, 2024 WL 1251350, at *24 (N.D. 5 Cal. Mar. 25, 2024) (noting that privacy harms can constitute economic injury to confer UCL 6 standing under three theories: unfair benefit-of-the-bargain to businesses who violate user 7 expectations about how their data will be used, diminished value of personal information, and 8 reduced right to exclude others from accessing personal data). 9 In Brown, the Court noted it was plausible that plaintiffs would “decide to sell their data at 10 some point,” and because Google obtained the data and sold it to advertisers, Google diminished 11 plaintiffs’ “future property interest.” 2021 WL 6064009, at *15. Similarly, plaintiffs here 12 recognize that there is a market for their data, alleging in their complaint that “there is a market for 13 consumers to monetize Personal Information and the behavioral preferences that Defendants have 14 usurped.” Dkt. No. 1, at 47 (citing studies placing a value of $200 on an individual’s personal 15 information). Because plaintiffs allege that they can “no longer realize the full economic value of 16 their Personal Information” due to the data collection by defendants, they adequately plead an 17 economic injury resulting from defendants’ purported misconduct. Id. at 48. Accordingly, they 18 have sufficiently alleged that they “lost money or property as the result of the unfair competition,” 19 as is required to establish standing under the UCL. Cal. Bus. & Prof. Code § 17204. 20 Defendants separately argue that plaintiffs fail to adequately plead a UCL violation under 21 either of the three prongs. Because the Court finds that plaintiffs sufficiently alleged an underlying 22 COPPA violation, however, they have adequately pleaded a UCL claim under at least the unlawful 23 prong. 24 V. Plaintiffs Adequately Plead Violations of New York and Florida Statutes. 25 The New York General Business Law (NYGBL) states, “Deceptive acts or practices in the 26 conduct of any business, trade or commerce or in the furnishing of any service in this state are 27 hereby declared unlawful.” N.Y. Gen. Bus. Law § 349(a). An NYGBL claim consists of three 1 misleading in a material way; and third, that the plaintiff suffered injury as a result of the 2 deceptive act.” Boris v. Wal-Mart Stores, Inc., 35 F. Supp. 1163, 1173 (C.D. Cal. 2014). “Whether 3 a representation or omission is a deceptive act or practice depends on the likelihood that it will 4 mislead a reasonable consumer acting reasonably under the circumstances.” Id. (citation omitted). 5 The Florida Deceptive and Unfair Trade Practices Act (FDUTPA) prohibits “[u]nfair 6 methods of competition, unconscionable acts or practices, and unfair or deceptive acts or practices 7 in the conduct of any trade of commence.” Fla. Stat. § 501.204(1). “A consumer claim for 8 damages under FDUTPA has three elements: (1) a deceptive act or unfair practice; (2) causation; 9 and (3) actual damages.” Parziale v. HP, Inc., 445 F. Supp. 3d 435, 442 (N.D. Cal. 2020). “An 10 unfair practice is one that offends established public policy and one that is immoral, unethical, 11 oppressive, unscrupulous or substantially injurious to consumers.” In re Carrier IQ, Inc., 78 F. 12 Supp. 3d 1051, 1119 (N.D. Cal. 2015). A deceptive act “occurs if there is a representation, 13 omission, or practice that is likely to mislead consumers acting reasonably in the circumstances, to 14 the consumer’s detriment.” Id. (citations and internal quotations omitted). 15 Defendants argue that plaintiffs’ causes of action under the NYGBL and FDUTPA must 16 fail because Google’s Terms of Service contain a California choice-of-law provision. They also 17 contend that the claims are not pleaded with particularity and lack a sufficient nexus to New York 18 and Florida. The Court disagrees. 19 First, the Court cannot hold at this stage that the California choice-of-law provision applies 20 because defendants’ argument depends upon Google’s Terms of Service, which are not properly 21 cognizable on this Rule 12(b)(6) motion. Dkt. No. 29-4. Those Terms of Service are neither 22 incorporated by reference in the complaint nor judicially noticeable. See Urban v. Tesla, Inc., 23 2023 WL 6796021, at * 3 (N.D. Cal. Oct. 13, 2023) (holding that defendant’s evidence of a 24 choice-of-law provision in a purported purchase agreement “outside the four corners of the 25 complaint” “must be disregarded” under Rule 12(b)(6)). And even if the Terms of Service were 26 judicially noticeable, defendants fail to show that plaintiffs actually agreed to these specific Terms 27 when downloading Android apps from the Google Play Store. The Terms presented by defendants 1 consented to these Terms when they downloaded apps through the DFF program in 2021 and 2 before. See, e.g., Weizman v. Talkspace, Inc., 2023 WL 8461173, at *5 (N.D. Cal. Dec. 6, 2023) 3 (holding that defendants’ undated screenshot showing its Terms as clickwrap at the sign up page 4 fails to establish that plaintiffs consented to those Terms). Because defendants cannot introduce 5 Google’s Terms of Service at this juncture and fail to show that plaintiffs agreed to those Terms, 6 the California choice-of-law provision therein does not bar plaintiffs’ New York and Florida 7 claims for purposes of this Rule 12(b)(6) motion. 8 Second, plaintiffs adequately plead their NYGBL and FDUTPA claims, even under Rule 9 9(b)’s heightened pleading standard.6 Both the NYGBL and FDUTPA require a deceptive act that 10 misleads consumers and causes them to suffer an injury. As discussed above in the context of 11 UCL standing, plaintiffs have adequately pleaded that they suffered an economic injury. The 12 remaining question, therefore, is whether plaintiffs have pleaded with particularity that defendants 13 engaged in a deceptive act that resulted in said injury. Plaintiffs specifically allege that “Google 14 broadly promoted, marketed, and represented in numerous ways that the DFF program and the 15 Apps included in the program [were] suitable and safe and designed for children and legally 16 compliant,” citing relevant provisions from Google’s 2015 DFF policy and 2018 DFF eligibility 17 requirements. Dkt. No. 1, at 70, 78. By pointing out specific statements made by defendants about 18 the suitability of DFF apps for children, and adequately pleading with circumstantial evidence that 19 defendants had actual knowledge about the mischaracterization of child-directed apps on the 20 platform, plaintiffs sufficiently allege that defendants made representations likely to mislead 21 reasonable consumers. By making consumers feel as though children’s personal information was 22 6 Defendants argue that plaintiffs must plead their consumer protection statute claims with 23 particularity because they sound in fraud. Dkt. No. 27, at 26. The Second Circuit, however, has held that “an action under § 349 is not subject to the pleading-with-particularity requirements of 24 Rule 9(b) … but need only meet the bare bones notice-pleading requirements of Rule 8(a).” Pelman ex rel. Pelman v. McDonald’s Corp., 396 F.3d 508, 511 (2d Cir. 2005). And “[f]ederal 25 district courts are split as to whether FDUTPA claims are subject to the heightened pleading requirements of Rule 9(b).” Parziale, 445 F. Supp. 3d at 442; see also Griffey v. Magellan Health 26 Inc., 562 F. Supp. 3d 34, 54 (N.D. Cal. 2021) (“There is a district split about whether Rule 9(b) applies to the Florida DUTPA. But … where the gravamen of the claims sounds in fraud … Rule 27 9(b) applies.”). Because the Court concludes that plaintiffs satisfy Rule 9(b), it need not decide 1 not being collected through DFF program apps, defendants encouraged plaintiffs to download and 2 use the DFF apps, which resulted in the purportedly unlawful collection of data and subsequent 3 advertising targeted toward minors. 4 Third, defendants argue that plaintiffs did not plead a sufficient nexus to New York or 5 Florida. But plaintiffs residing in New York and Florida allege that they used the DFF apps while 6 in those states and they were presumably injured by the alleged misconduct in those states. Dkt. 7 No. 1, at 69 (alleging that plaintiffs C.D.1, C.D.2, and C.D.3 “are or were residents of Florida 8 and/or used the Apps in Florida”); id. at 77 (alleging that plaintiffs E.F.1 and E.F.2 “are or were 9 residents of New York and/or used the Apps in New York”). This provides a sufficient nexus for 10 the purposes of Rule 12(b)(6). 11 VI. Plaintiffs Adequately Plead California Privacy Claims. 12 To state a claim for invasion of privacy under California law, a plaintiff must allege (1) a 13 legally protected privacy interest; (2) a reasonable expectation of privacy under the circumstances; 14 and (3) a serious invasion of the protected privacy interest. Hill v. Nat’l Collegiate Athletic Assn., 15 7 Cal. 4th 1, 6 (1994). Stating a claim for intrusion upon seclusion in California requires a 16 showing that the defendant (1) intruded into a private place, conversation or matter, (2) in a 17 manner highly offensive to a reasonable person. Taus v. Loftus, 40 Cal. 4th 683, 725 (2007). As 18 summarized by the Ninth Circuit, both claims are plausibly alleged where (1) there exists a 19 reasonable expectation of privacy, and (2) the intrusion was highly offensive. In re Facebook, Inc. 20 Internet Tracking Litig., 956 F.3d 589, 601 (9th Cir. 2020). 21 Defendants first argue that plaintiffs fail to allege that they have a legally protected interest 22 in their personal information. But as discussed above, plaintiffs have a property interest in their 23 data. 24 Defendants also argue that Google’s Privacy Policy discloses that Google engages in 25 interest-based advertising and shares non-personally identifiable information with advertising 26 partners, undermining any expectation of privacy. Dkt. No. 27, at 28. As already discussed, 27 however, defendants cannot establish, for purposes of this motion, that plaintiffs actually saw or 1 guidelines, which state that ads “displayed to child audiences do not involve interest-based 2 advertising.” Dkt. No. 1, at 4, 23. Given the legal bar on interest-based advertising for the 3 narrower class of DFF children’s apps, the minor plaintiffs have adequately pleaded that they had 4 a reasonable expectation of privacy in their personal information notwithstanding any general 5 disclosure by Google about potential interest-based advertising and data collection they might 6 have seen. These facts stand in contrast to cases cited by defendants that only involve a general 7 disclosure provision. See, e.g., Smith v. Facebook, Inc., 745 F. App’x 8, 9 (9th Cir. 2018) 8 (dismissing intrusion upon seclusion claim given users’ acquiescence to policies disclosing data 9 collection practices). 10 Defendants also argue that the purported intrusion into plaintiffs’ reasonable expectation of 11 privacy was not highly offensive. Under California law, an intrusion must constitute “an egregious 12 breach of the social norms underlying the privacy right” to be actionable. Folgelstrom v. Lamps 13 Plus, Inc., 195 Cal. App. 4th 986, 992 (Cal. Ct. App. 2011). By surreptitiously collecting data 14 from minors under the age of 13 after representing that DFF apps were child-directed, defendants 15 allegedly engaged in the specific conduct proscribed by COPPA. A violation of federal law is 16 generally considered egregious, and because COPPA prohibits such data collection from minors to 17 protect their privacy, plaintiffs have adequately pleaded an egregious intrusion into the minors’ 18 expectation of privacy. See, e.g., In re Facebook, Inc. Internet Tracking Litig., 956 F.3d at 602–03 19 (finding privacy violations when “the online entity represented to the plaintiffs that their 20 information would not be collected, but then proceeded to collect it anyway”). No matter how un- 21 sensitive or un-intimate the personal information collected here was, the allegation that defendants 22 collected the data in violation of federal law despite representing that their DFF program apps did 23 not engage in interest-based advertising suffices to show that defendants’ intrusion upon plaintiffs’ 24 expectation of privacy was highly offensive. 25 VII. Plaintiffs Adequately Plead Unjust Enrichment Claims. 26 Defendants finally argue that plaintiffs’ unjust enrichment claim under California law 27 should be dismissed because “there is no cause of action in California labeled unjust enrichment.” 1 under New York and Florida law should fail because the purported contracts at issue (Google’s 2 || Terms of Service and Privacy Policy) cover the same subject matter as the dispute. Jd. 3 The Ninth Circuit has recently acknowledged (albeit in a nonprecedential opinion) that 4 || unjust enrichment may constitute a standalone cause of action under California law. Bruton v. 5 Gerber Products Co., 703 F. App’x 468, 470 (9th Cir. 2017). To adequately allege unjust 6 || enrichment as an independent cause of action, “a plaintiff must show that the defendant received 7 and unjustly retained benefit at the plaintiff's expense.” ESG Capital Partners, LP v. Stratos, 828 8 F.3d 1023, 1038 (9th Cir. 2016). Here, plaintiffs have adequately pleaded that defendants were 9 || unjustly enriched by collecting plaintiffs’ personal information and employing it to target 10 advertisements to children. See In re Facebook, Inc., Consumer Priv. User Profile Litig., 402 F. 11 Supp. 3d 767, 808 (N.D. Cal. 2019) (“And even if the plaintiffs suffered no economic loss from 12 || the disclosure of their information, they may proceed at this stage on a claim for unjust enrichment 13 || to recover the gains that Facebook realized from its allegedly improper conduct.”’). 14 As to the unjust enrichment claims under New York and Florida law, defendants fail to 3 15 establish the existence of a contract between plaintiffs and defendants because the Court cannot a 16 || consider defendants’ extrinsic evidence of Google’s Terms of Service and Privacy Policy on this 3 17 Rule 12(b)(6) motion. The Court therefore denies defendants’ motion to dismiss these unjust S 18 || enrichment claims as well. 19 CONCLUSION 20 For the foregoing reasons, the Court denies the defendants’ motion to dismiss. 21 IT IS SO ORDERED. 22 Dated: June 18, 2024 23 2 Qe 24 P. Casey Pitts 25 United States District Judge 26 27 28