Brooks v. Thomson Reuters Corporation

• Court: District Court, N.D. California
• Decided: August 16, 2021
• Docket: 3:21-cv-01418
• Status: Unknown

Opinion

1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 7 CAT BROOKS, et al., Case No. 21-cv-01418-EMC

8 Plaintiffs, ORDER GRANTING IN PART AND 9 v. DENYING IN PART DEFENDANT’S MOTION TO DISMISS 10 THOMSON REUTERS CORPORATION, Docket Nos. 28, 37 11 Defendant.

12 13 14 Pending before the Court is Defendant Thomson Reuters Corporation’s (“Thomson 15 Reuters’s”) motion to dismiss Plaintiffs Cat Brooks and Rasheed Shabazz’s complaint pursuant to 16 Federal Rule of Civil Procedure 12(b)(6). See Docket No. 28 (“Mot.”). 17 For the following reasons, the Court GRANTS in part and DENIES in part Thomson 18 Reuters’s motion to dismiss. 19 I. BACKGROUND 20 Plaintiffs’ complaint alleges as follows. Thomson Reuters “aggregates both public and 21 non-public information about millions of people” to create “detailed cradle-to-grave dossiers on 22 each person, including names, photographs, criminal history, relatives, associates, financial 23 information, and employment information.” See Docket No. 1-1 (Compl.) ⁋ 2. Other than 24 publicly available information on social networks, blogs, and even chat rooms, Thomson Reuters 25 also pulls “information from third-party data brokers and law enforcement agencies that are not 26 available to the general public, including live cell phone records, location data from billions of 27 license plate detections, real-time booking information from thousands of facilities, and millions 1 information, DMV records, social-media posts, utility records, and even records indicating 2 whether a person has had an abortion. Id. ¶¶ 2, 16, 20, 35(a). 3 Thomson Reuters then sells this information to its customers—without the knowledge or 4 consent of the persons to whom the information concerns—through an online platform it calls 5 CLEAR. Id. ⁋⁋ 2–3, 12. CLEAR users pay a fixed fee for a dossier report with all the information 6 Thomson Reuters has on an individual in the company’s database, as well as information on their 7 family members and associates. Id. ⁋⁋ 24–26, 28, 62. The company’s “pay-as-you-go” pricing 8 model even goes so far as to place a specific dollar value on the different types of information it 9 sells. Id. ¶ 62. Its website “advertises that CLEAR enables its users to access ‘both surface and 10 deep web data to examine intelligence’ about people ‘not found in public records or traditional 11 search engines.’ This allows CLEAR users ‘to uncover’ personal ‘facts hidden online,’ by 12 scraping ‘real-time information’ about individuals.” Id. at 2, 14–15. Because the company 13 updates this information in real time, Id. ⁋⁋ 2, 17, the New York Times has described CLEAR as 14 “an ever-evolving 360-degree view of U.S. residents’ lives.” Id. (quoting McKenzie Funk, How 15 ICE Picks Its Targets in the Surveillance Age, N.Y. Times (Oct. 3, 2019)). Thomson Reuters 16 makes significant profits from selling these reports. Id. ⁋⁋ 58–63. 17 The named Plaintiffs are Californians whose identities Thomson Reuters sells to its 18 customers through CLEAR. Id. ¶¶ 6–7. Neither consented to the company selling their personal 19 information—and neither wants the company to do so. Id. ¶¶ 41–42, 50–51. Both are Black civil 20 rights activists concerned about being targeted because of their work. Id. They do not want a 360- 21 degree view of their lives available to those willing to pay for it. Id. In fact, Ms. Brooks even 22 subscribes to a service that routinely deletes her information from the internet. Id. ¶ 41. Mr. 23 Shabazz also alleges that Thomson Reuters’s CLEAR profile on him incorrectly indicates that he 24 is divorced and has failed to pay child support when he was never legally married and at the time 25 had no children. Id. ⁋ 54. 26 On December 23, 2020, Plaintiffs filed their class action complaint in the Superior Court 27 of California, County of Alameda, on behalf of all California residents “whose name, photographs, 1 during the limitations period.” Id. ⁋ 70. They assert four causes of action on behalf of the 2 proposed class: (1) violations of the California common law right of publicity; (2) a claim for 3 monetary relief for violations of California’s Unfair Competition Law (UCL), Cal Bus. & Prof. 4 Code § 17200; (3) unjust enrichment; and (4) a claim for injunctive relief for violations of the 5 UCL. Id. ⁋⁋ 81–118. 6 On February 26, 2021, Thomson Reuters removed the action to federal court pursuant to 7 the Class Action Fairness Act of 2005 (CAFA), 28 U.S.C. §§ 1332(d), 1453(b), and filed the 8 pending motion to dismiss on April 5, 2021. Mot. Thereafter it filed a motion to stay discovery 9 pending resolution of the motion to dismiss. See Docket No. 37. 10 II. STANDARD OF REVIEW 11 Federal Rule of Civil Procedure 8(a)(2) requires a complaint to include “a short and plain 12 statement of the claim showing that the pleader is entitled to relief.” Fed. R. Civ. P. 8(a)(2). A 13 complaint that fails to meet this standard may be dismissed pursuant to Rule 12(b)(6). See Fed. R. 14 Civ. P. 12(b)(6). To overcome a Rule 12(b)(6) motion to dismiss after the Supreme Court’s 15 decisions in Ashcroft v. Iqbal, 556 U.S. 662 (2009) and Bell Atlantic Corporation v. Twombly, 550 16 U.S. 544 (2007), a plaintiff’s “factual allegations [in the complaint] ‘must . . . suggest that the 17 claim has at least a plausible chance of success.’” Levitt v. Yelp! Inc., 765 F.3d 1123, 1135 (9th 18 Cir. 2014). The court “accept[s] factual allegations in the complaint as true and construe[s] the 19 pleadings in the light most favorable to the nonmoving party.” Manzarek v. St. Paul Fire & 20 Marine Ins. Co., 519 F.3d 1025, 1031 (9th Cir. 2008). But “allegations in a complaint . . . may not 21 simply recite the elements of a cause of action [and] must contain sufficient allegations of 22 underlying facts to give fair notice and to enable the opposing party to defend itself effectively.” 23 Levitt, 765 F.3d at 1135 (quoting Eclectic Props. E., LLC v. Marcus & Millichap Co., 751 F.3d 24 990, 996 (9th Cir. 2014)). “A claim has facial plausibility when the Plaintiff pleads factual 25 content that allows the court to draw the reasonable inference that the Defendant is liable for the 26 misconduct alleged.” Iqbal, 556 U.S. at 678. “The plausibility standard is not akin to a 27 ‘probability requirement,’ but it asks for more than a sheer possibility that a defendant has acted 1 III. DISCUSSION 2 A. Right of Publicity 3 California has long recognized a right of publicity (also known as a “commercial 4 misappropriation” claim), which protects a person’s name and likeness against appropriation by 5 others for their commercial advantage. Downing v. Abercrombie & Fitch, 265 F.3d 994, 1001 6 (9th Cir. 2001). There are two ways to assert a right of publicity claim: a common law cause of 7 action for commercial misappropriation, and a statutory remedy for commercial misappropriation 8 under section 3344 of the California Civil Code. Id. To state a common law claim for 9 commercial misappropriation, “a plaintiff must prove: ‘(1) the defendant’s use of the plaintiff’s 10 identity; (2) the appropriation of plaintiff’s name or likeness to defendant’s advantage, 11 commercially or otherwise; (3) lack of consent; and (4) resulting injury.’” Stewart v. Rolling 12 Stone LLC, 105 Cal. Rptr. 3d 98, 111 (Ct. App. 2010), as modified on denial of reh’g (Feb. 24, 13 2010) (quoting Eastwood v. Sup. Ct., 198 Cal. Rptr. 342, 347 (Ct. App. 1983)); see also 14 Newcombe v. Adolf Coors Co., 157 F.3d 686, 692 (9th Cir.1998) (listing the same factors). To 15 state a statutory claim under section 3344,1 a plaintiff must plead all the elements of the common 16 law claim and must also prove (5) “a knowing use by the defendant,” and (6) “a direct connection 17 between the alleged use and the commercial purpose.” Downing, 265 F.3d at 1001.2 18 Thomson Reuters challenges only the “use” and “appropriation” elements of Plaintiffs’ 19 right of publicity claims. It also contends that Plaintiffs’ right of publicity claims are barred by the 20 First Amendment and that their section 3344 claim is barred by the newsworthy exception. This 21 order will address each of these challenges in turn. 22

23 1 Although Plaintiffs are not raising a separate claim under section 3344, their claim under the unlawful prong of the UCL is predicated on a violation of section 3344. See Compl. ⁋ 94. 24

2 These two additional requirements are laid out in the language of the statute: section 3344(a) 25 states that “[a]ny person who knowingly uses another’s name, voice, signature, photograph, or likeness, in any manner, . . . shall be liable for any damages sustained by the person or persons 26 injured as a result thereof,” Cal Civ. Code § 3344(a); and section 3344(e) states that “it shall be a question of fact whether or not the use of the person’s name, voice, signature, photograph, or 27 likeness was so directly connected with the commercial sponsorship or with the paid advertising 1 1. Use of Plaintiffs’ Identities 2 Thomson Reuters argues that “[t]he display of a plaintiff’s name or likeness in third-party 3 content” does not constitute “use” of the Plaintiffs’ identity for purposes of a right of publicity 4 claim. Mot. at 7. But the dossiers on the CLEAR platform are not “third-party content,” they are 5 created by Thomson Reuters, albeit from third-party sources. By contrast, the cases Thomson 6 Reuters cites involved clearly “third-party content,” i.e. third parties posting people’s personal 7 information on the defendant’s websites. For example, in Perfect 10, Inc. v. Google, Inc., third 8 parties posted models’ names and likenesses on websites hosted by Google. See CV 04-9484 9 AHM (SHx), 2010 WL 9479060, at *13 (C.D. Cal. July 30, 2010). Similarly, in Cross v. 10 Facebook, Inc., third-party users posted the plaintiff’s name and likeness on Facebook. See 222 11 Cal. Rptr. 3d 250, 265–66 (Ct. App. 217). In those cases, Google and Facebook—unlike 12 Thomson Reuters—were not posting or sharing the plaintiffs’ identities; they were simply 13 providing the websites or platforms where others posted that information. 14 This case is more akin to Perkins v. LinkedIn Corporation, where the plaintiffs’ complaint 15 alleged that, when they created a LinkedIn account, the company automatically sent emails signed 16 by the plaintiffs to all their contacts saying “I’d like to add you to my professional network.” 53 17 F. Supp. 3d 1190, 1215–17 (N.D. Cal. 2014). Similarly, in Fraley v. Facebook, Facebook 18 allegedly posted “sponsored stories” on users’ pages with other users’ names, pictures, and an 19 assertion that the other users “liked” certain advertisers. 830 F. Supp. 2d 785, 791–92 (N.D. Cal. 20 2011). In those cases, it was LinkedIn that sent the emails and Facebook that posted the sponsored 21 stories, not third parties. Likewise here, it is Thomson Reuters that posted the dossiers with 22 Plaintiffs’ name, likeness, and personal information on its CLEAR platform. In other words, 23 Thomson Reuters—not third parties—used Plaintiffs’ identities. 24 Accordingly, the Court concludes that Plaintiffs’ have properly pled that Defendant has 25 “used” their names and likenesses for purposes of stating a right of publicity claim. 26 2. Appropriation of Plaintiffs’ Name or Likeness For A Commercial Advantage 27 Thomson Reuters also argues it does not appropriate Plaintiffs’ name, likeness, or personal 1 publicity,” i.e., “for promotional purposes or to imply an endorsement.” Mot. at 8 (citing 2 Restatement (Second) of Torts § 652C cmt d (1977)). Indeed, the Ninth Circuit and the California 3 Supreme Court have explained that the right of publicity was conceived and is most often applied 4 to protect against the unauthorized use of celebrities’ name and likeness to advertise or promote a 5 product or service. See White v. Samsung Elecs., Am., Inc., 971 F.2d 1395, 1396 (9th Cir. 6 1992), as amended (Aug. 19, 1992) (“The right of publicity was developed to protect the 7 commercial interest of celebrities in their identities. The theory of the right is that a celebrity’s 8 identity can be valuable in the promotion of products.” (emphasis added) (quoting Carson v. 9 Here’s Johnny Portable Toilets, Inc., 698 F.2d 831, 835 (6th Cir. 1983)); Lugosi v. Universal 10 Pictures, 603 P.2d 425, 431 (1979) (“[T]he so-called right of publicity means in essence that the 11 reaction of the public to name and likeness . . . endows the name and likeness of the person 12 involved with commercially exploitable opportunities. The protection of name and likeness from 13 unwarranted intrusion or exploitation is the heart of the law of privacy.”). As a result, right of 14 publicity cases involve the unauthorized use of someone’s—typically a celebrity’s—name or 15 likeness in commercial advertisings or promotions. 16 Defendant’s first argument is that this is not a right of publicity case because it does not 17 involve an advertisement that uses Plaintiffs’ name or likeness to suggest an endorsement. See 18 e.g., Perkins, 53 F. Supp. 3d at 1190 (unauthorized emails representing that the plaintiffs endorsed 19 the use of LinkedIn); Fraley, 830 F. Supp. 2d at 791 (unauthorized “sponsored stories” 20 representing that the plaintiffs endorsed certain products advertised on Facebook); Abdul-Jabbar 21 v. Gen. Motors Corp., 85 F.3d 407, 410 (9th Cir. 1996) (commercial falsely representing that 22 Kareem Abdul-Jabbar endorsed “the ‘88 Oldsmobile”); Fairfield v. Am. Photocopy Equip. Co., 23 291 P.2d 194, 197 (Ct. App. 1955) (advertisement falsely representing that plaintiff, a famous 24 lawyer, was a satisfied user of defendant’s product). It is true that Thomson Reuters in no way 25 suggests that Plaintiffs endorse its dossiers or any of its other products. 26 But this distinction is not dispositive because the Ninth Circuit and the California Court of 27 Appeal have held that commercial appropriation in a right of publicity case does not require the 1 imposed any requirement that the unauthorized use or publication of a person’s name or picture be 2 suggestive of an endorsement or association with the injured person.” (quoting Eastwood, 198 Cal. 3 Rptr. at 347–48)). In Eastwood, for example, the National Enquirer used Clint Eastwood’s name 4 and photograph in an allegedly false news piece titled “Clint Eastwood in a Love Triangle with 5 Tanya Tucker.” 198 Cal. Rptr. at 349. The “news” piece did not state or imply that Clint 6 Eastwood endorsed or in any way wanted readers to purchase the Enquirer. Id. Instead, the court 7 explained that the Enquirer “used Eastwood’s personality and fame . . . [t]o the extent their use [of 8 Eastwood’s name and photograph in the news piece] attracted the readers’ attention.” Id. 9 Therefore, the Eastwood court explicitly held that “the appearance of an endorsement is not the 10 sine qua non of a claim for commercial appropriation.” Id. at 348. 11 Plaintiffs therefore correctly argue that here, as in Eastwood, their names, likeness, and 12 personal information is what attracts the attention of Thomson Reuters’s customers to the dossiers 13 on the CLEAR platform, even if Thomson Reuters is not suggesting that Plaintiffs endorse its 14 dossiers. The only reason CLEAR subscribers pay Thomson Reuters is to have direct access to 15 Plaintiffs’ personal information, regardless of whether Plaintiffs authorized or endorsed the 16 creation of the dossiers. The Court therefore cannot conclude that this is not a right of publicity 17 case simply because Thomson Reuters is not suggesting that Plaintiffs endorse its dossiers. 18 Thomson Reuters’s second argument is more persuasive: this is not a right of publicity 19 case because Thomson Reuters is not using Plaintiffs’ name or likeness “for promotional 20 purposes,” i.e., to advertise or promote a separate product or service. Virtually all right of 21 publicity cases involve the use of a person’s name or likeness to advertise a separate product or 22 service. See e.g., Hilton v. Hallmark Cards, 599 F.3d 894, 899–900 (9th Cir. 2010) (unauthorized 23 use of Paris Hilton’s image and catch phrase on defendant’s greeting cards); Solano v. Playgirl, 24 Inc., 292 F.3d 1078, 1081–82 (9th Cir. 2002) (unauthorized use of Jose Solano, Jr.’s photograph 25 on the cover of adult magazine); Downing, 265 F.3d at 999–1000 (unauthorized use of plaintiffs’ 26 photograph from a surfing competition on advertisement for defendant’s clothes); Newcombe, 157 27 F.3d at 689 (unauthorized use of a drawing allegedly depicting Donald Newcombe on 1 (unauthorized use of animatronic robots based on actors’ likenesses placed in the defendant’s 2 airport bars resembling the set of the television program where the actors played principal 3 characters); Abdul-Jabbar, 85 F.3d at 410 (unauthorized use of Kareem Abdul-Jabbar’s identity on 4 advertisement for “the ‘88 Oldmosbile”); White, 971 F.2d at 1396 (unauthorized use of a robot 5 resembling Vanna White on advertisement for defendant’s electronics); Eastwood, 198 Cal. Rptr. 6 at 347–48 (unauthorized use of Clint Eastwood’s name and photograph on the cover of magazine). 7 Here, by contrast, Plaintiffs allege the product is their name, likeness, and personal information. 8 Plaintiffs do not cite a single right of publicity case with analogous facts. Although the publishing 9 of Plaintiffs’ most private and intimate information for profit might be a gross invasion of their 10 privacy, it is not a misappropriation of their name or likeness to advertise or promote a separate 11 product or service. 12 This case is also dissimilar from right of publicity cases involving social media platforms 13 using the names and likeness of their users. Even those cases always involve an advertisement or 14 promotion for a separate product or service. One example is Perkins, where Judge Koh refused to 15 dismiss a right of publicity claim because LinkedIn placed its users’ names and photographs— 16 without their authorization—in “endorsement emails,” i.e., advertisements, encouraging other 17 users to join the LinkedIn platform. 53 F. Supp. 3d at 1199. Another example is Fraley, where 18 Judge Koh also refused to dismiss right of publicity claims because Facebook placed its users’ 19 names and photographs—without their authorization—in “Sponsored Stories,” which are “a form 20 of paid advertisement[s] that appear[] on a member’s Facebook page and that generally consists of 21 another Friend’s name, profile picture, and an assertion that the person ‘likes’ the advertiser.” 830 22 F. Supp. 2d at 791. Unlike here, the defendants in Perkins and Fraley were using their users’ 23 names and likeness to advertise a separate product or service, namely, the LinkedIn platform in 24 Perkins and the third-party advertisers’ products in Fraley. The use of a person’s name and 25 likeness to promote a product (other than that which pertains to the person themselves) is the 26 essence of an “appropriation” of one’s name or likeness. No such appropriation is alleged here; 27 unlike Perkins and Fraley, Plaintiffs’ name or likeness in this case were not sent to unsuspecting 1 services; they were sent only to CLEAR subscribers who deliberately paid Thomson Reuters to 2 receive information about them. 3 This case is more akin to In re Facebook, Inc., Consumer Privacy User Profile Litigation 4 (“In re Facebook”), where Judge Chhabria dismissed plaintiffs’ right of publicity claim because 5 “[t]he allegations about how Facebook shared the plaintiffs’ information with third parties is 6 categorically different from the type of conduct made unlawful by this tort, such as using a 7 plaintiff’s face or name to promote a product or service.” 402 F. Supp. 3d 767, 803 (N.D. Cal. 8 2019). In that case, like here, the plaintiffs alleged Facebook made their sensitive personal 9 information available to third parties, including Cambridge Analytica (a British political 10 consulting firm), application developers, whitelisted applications, and Facebook’s business 11 partners, and failed to prevent those third parties from selling or otherwise misusing the 12 information. Id. at 779–82. This Court agrees with In re Facebook that the injury Plaintiffs 13 suffered here—although deeply concerning and perhaps a violation of their privacy—is not a 14 violation of their right of publicity because their name or likeness is not being “appropriated” and 15 used to advertise a separate product or service. Cambridge Analytica, and the other third parties in 16 In re Facebook, paid Facebook specifically to obtain its users’ personal information. The same is 17 true here. 18 In sum, the Court agrees with Thomson Reuters that Plaintiffs have failed to state a claim 19 for a violation of the tight of publicity because Thomson Reuters did not appropriate their name or 20 likeness.3 21 B. UCL Claims 22 The UCL “prohibits, and provides civil remedies for, unfair competition, which it defines 23 as ‘any unlawful, unfair or fraudulent business act or practice.’” Kwikset Corp. v. Super. Ct., 246 24 P.3d 877, 883 (Cal. 2011) (quoting Cal. Bus. & Prof. Code § 17200). Here, Plaintiffs allege that 25 Thomson Reuters engaged in unlawful and unfair (but not fraudulent) business practices. Compl. 26

27 3 Because the Court finds that Plaintiffs have failed to state right of publicity claims, it need not 1 ¶¶ 90–104 (monetary relief), 111–18 (injunctive relief). Thomson Reuters challenges Plaintiffs’ 2 claims under both prongs. It also argues that Plaintiffs are precluded from obtaining equitable 3 relief under the UCL because they have an adequate remedy at law. The Court will address each 4 of these arguments in turn. 5 1. Unlawful 6 Plaintiffs’ claims under the unlawful prong of the UCL are entirely predicated on their 7 common law and statutory right of publicity claims. See id. ⁋⁋ 93, 94–110. Because Plaintiffs 8 failed to properly plead those predicate claims, see supra Part III.A, they have also failed to 9 plausibly plead their claim under the unlawful prong of the UCL. 10 2. Unfair 11 According to Thomson Reuters, its conduct is not “unfair” under the UCL because it is (1) 12 expressly permitted by the California Consumer Privacy Act (CCPA), Cal Civ. Code §§ 13 1798.100–1798.199.95, and (2) does not meet any of the tests used by California courts for unfair 14 conduct. This Court disagrees. 15 a. CCPA Defense 16 Under the CCPA, “[a] consumer4 shall have the right, at any time, to direct a business that 17 sells personal information about the consumer to third parties not to sell the consumer’s personal 18 information. This right may be referred to as the right to opt-out.” Cal Civ. Code § 1798.20. 19 Relying on this statutory language, Thomson Reuters argues its conduct cannot be unfair because 20 the CCPA expressly allows it to sell Plaintiffs’ personal information if it provides Plaintiffs a 21 mechanism to opt out of such sale. Mot. at 15–16 (citing Compl. ⁋⁋ 46–47, 57). 22 This is a meritless argument for multiple reasons. As an initial matter, Thomson Reuters 23 does not cite a single case where the court dismissed a plaintiff’s claim that the dissemination of 24 their personal information is unfair under the UCL simply because the defendant provided an 25 adequate opt-out mechanism under the CCPA. 26

27 4 Although Plaintiffs are not purchasers or users of Thomson Reuters’s products, they qualify as 1 Moreover, several provisions of the CCPA clearly state that the law is not meant to curtail 2 other privacy statutes. For example, the CCPA explains that the private right of action it creates 3 under section 17980.50 for the “unauthorized access and exfiltration, theft, or disclosure [of 4 consumer’s personal information] . . . shall not be construed to relieve any party from any duties 5 or obligations imposed under other law or the United States or California Constitutions.” Cal. 6 Civ. Code § 1798.50(a)(1), (c). More broadly, section 1798.175 explains that the CCPA “is 7 intended to further the constitutional right of privacy and to supplement existing laws relating to 8 consumers’ personal information,” and that, “[w]herever possible, law relating to consumers’ 9 personal information should be construed to harmonize with the provisions of this title.” Id. § 10 1798.175 (emphasis added). The statute goes further: “in the event of a conflict between other 11 laws and the provisions of [the CCPA] the provisions of the law that afford the greatest protection 12 for the right of privacy for consumers shall control.” Id. 13 Here, the Court can easily harmonize the CCPA’s right to opt-out with Plaintiffs’ claim 14 under the unfair prong of the UCL by concluding that CLEAR’s opt-out mechanism does not 15 necessarily mean Thomson Reuters’s unauthorized sale of Plaintiffs’ personal information is fair 16 under the UCL as a matter of law. The UCL fairness prong may provide broader protection than 17 specific statutes such as the CCPA. This interpretation of both statutes controls because it 18 “afford[s] the greatest protection for the right of privacy for consumers.” Id. 19 Even if providing an opt-out mechanism under the CCPA was a defense, there is a 20 question of fact as to whether CLEAR’s opt-out mechanism complies with the CCPA. To 21 actualize the “right to opt-out” in section 1798.120,

22 [a] business . . . shall, in a form that is reasonably accessible to consumers: 23 (1) Provide a clear and conspicuous link on the business’s Internet 24 homepage, titled “Do Not Sell My Personal Information,” to an Internet Web page that enables a consumer, or a person authorized 25 by the consumer, to opt-out of the sale of the consumer’s personal information. 26 27 Cal Civ. Code §§ 1798.135(a)(1) (emphases added). Similarly, the regulations that implement the 1 A business’s methods for submitting request to opt-out shall be easy for consumers to execute and shall require minimal steps to allow 2 the consumer to opt-out. A business shall not use a method that is designed with the purpose or has the substantial effect of subverting 3 or impairing a consumer’s choice to opt-out. 4 Cal. Code Regs. tit. 11, § 999.315(h) (emphasis added). The regulations also prohibit an opt-out 5 mechanism that “require[]s the consumer to provide personal information that is not necessary to 6 implement the request.” Id. § 999.315(h)(4). 7 The complaint here alleges that Thomson Reuters places a “tiny link” at the bottom of its 8 CLEAR homepage and “provides no notice to consumers that the link exists. Nor does the 9 company enable consumers who happen to find out about the link to easily make use of it.” 10 Compl. ⁋⁋ 46–48. It also alleges that when both named Plaintiffs attempted to opt out by clicking 11 on the small link at the bottom of the CLEAR website, “Thomson Reuters required that [they] 12 provide a photograph of [their] government-issued identification card as well as a separate picture 13 of [their] face.” Compl. ⁋⁋ 49, 57. Taking these allegations as true and drawing every inference 14 in Plaintiffs’ favor, the Court cannot determine as a matter of law that CLEAR’s opt-out 15 mechanism complies with the CCPA and its implementing regulations. In the words of the statute, 16 CLEAR’s opt-out mechanism—as alleged in the complaint—is not “reasonably accessible to 17 consumers” or “clear and conspicuous.” Cal Civ. Code §§ 1798.135(a)(1). Nor is it “easy for 18 consumers” to opt-out using “minimal steps.” Cal. Code Regs. tit. 11, § 999.315(h). In fact, 19 plaintiff alleges that CLEAR required Plaintiffs’ photo identifications and faces to opt out. If true, 20 those allegations could easily lead a reasonable trier of fact to conclude that CLEAR’s opt-out 21 mechanism, itself, is unfair under the UCL. 22 Accordingly, compliance with the CCPA is not a defense to Plaintiffs’ claims that the sale 23 of their personal information is an unfair business practice under the UCL. At the very least, there 24 is a serious question of material fact as to whether Thomson Reuters’s opt-out mechanism even 25 complies with the CCPA. 26 b. Unfairness Allegations 27 Thomson Reuters also argues that the complaint’s allegations are insufficient to state a 1 business practice under the UCL. Mot. at 16–18. An “unfair business act or practice” is one that 2 “offends an established public policy or when the practice is immoral, unethical, oppressive, 3 unscrupulous or substantially injurious to consumers.” Cel-Tech Commc’ns, Inc. v. L.A. Cellular 4 Tel. Co., 973 P.2d 527, 543 (Cal. 1999) (quoting State Farm Fire & Cas. Co. v. Sup. Ct., 53 Cal. 5 Rptr. 2d 229, 235 (Ct. App. 1996)). In evaluating “unfair” claims, California courts apply two 6 tests: the balancing test and the tethering test. See Lozano v. AT & T Wireless Servs., Inc., 504 7 F.3d 718, 735 (9th Cir. 2007).5 Thomson Reuters’s conduct, as plausibly alleged in Plaintiffs’ 8 complaint, is unfair under either test. 9 i. The Balancing Test 10 Under the balancing test—also known as the South Bay test—courts weigh “the harm to 11 the consumer against the utility of the defendant’s practice.” See Id. (citing S. Bay Chevrolet v. 12 Gen. Motors Acceptance Corp., 85 Cal. Rptr. 2d 301, 316 (Ct. App. 1999)). To start, the South 13 Bay balancing test requires an in-depth evaluation of the facts that is not suitable for the pleading 14 stage. See In re Anthem, Inc. Data Breach Litig. (“In re Anthem”), 162 F. Supp. 3d 953, 990 15 (N.D. Cal. 2016) (“Whether Defendants’ public policy violation is outweighed by the utility of 16 their conduct under the balancing test is a question to be resolved at a later stage in this litigation. 17 Thus, based on the balancing test alone, the Court DENIES Defendants’ motion to dismiss 18 Plaintiffs’ UCL claim under the unfair prong.”); In re Carrier IQ, Inc., 78 F. Supp. 3d 1051, 1117 19 (N.D. Cal. 2015) (“The cost-benefit analysis this test calls for is not properly suited for resolution 20 at the pealing stage.”); McKell v. Washington Mut., Inc., 49 Cal. Rptr. 3d 227, 240 (Ct. App. 2006) 21 (“As with the determination whether a practice is fraudulent, the determination whether it is unfair 22 is one of fact which requires a review of the evidence from both parties.”). The Court declines 23 Thomson Reuters’s invitation to perform the balancing test before discovery at this early pleading 24 stage. 25 Moreover, even if the Court were to apply the balancing test based solely on the 26

27 5 Thomson Reuters urges this Court to apply a third test—the “FTC test”—which is inapplicable 1 allegations in the complaint—as it must at this stage—the complaint plausible alleges the harm 2 caused by the unauthorized dissemination of Plaintiffs’ most private and personal information 3 clearly outweighs the utility of that sale. 4 On the one hand, the harm to Plaintiffs is tremendous: an all-encompassing invasion of 5 Plaintiffs’ privacy, whereby virtually everything about them—including their contact information, 6 partially redacted social security number, criminal history, family history, and even whether they 7 got an abortion, to name just a few—is transmitted to strangers without their knowledge, let alone 8 their consent. Compl. ⁋⁋ 2–4, 26–30, 33, 35, 87, 102–04, 115. The Supreme Court has long 9 recognized, in no uncertain terms, that “both the common law and the literal understandings of 10 privacy encompass the individual’s control of information concerning his or her person.” U.S. 11 Dep’t of Just. v. Reps. Comm. For Freedom of Press, 489 U.S. 749, 763 (1989). The California 12 Supreme Court has likewise underlined how deeply pernicious it is to lose one’s privacy due to 13 forced disclosure:

14 Privacy rights also have psychological foundations emanating from personal needs to establish and maintain identity and self-esteem by 15 controlling self-disclosure: “In a society in which multiple, often conflicting role performances are demanded of each individual, the 16 original etymological meaning of the word ‘person’—mask—has taken on new meaning. [People] fear exposure not only to those 17 closest to them; much of the outrage underlying the asserted right to privacy is a reaction to exposure to persons known only through 18 business or other secondary relationships. The claim is not so much one of total secrecy as it is of the right to define one’s circle of 19 intimacy—to choose who shall see beneath the quotidian mask. Loss of control over which ‘face’ one puts on may result in literal 20 loss of self-identity, and is humiliating beneath the gaze of those whose curiosity treats a human being as an object.” 21 22 Hill v. Nat’l Collegiate Athletic Ass’n., 865 P.2d 633, 647 (Cal. 1994) (In Bank) (emphasis added) 23 (quoting Briscoe v. Reader’s Digest Ass’n, Inc., 483 P.2d 34, 37 (Cal. 1971)). CLEAR dossiers 24 may deeply damage Plaintiffs by directly contravening their right to keep private their most 25 intimate and personal information. 26 Thomson Reuters tries to minimize this harm by pointing out that its dossiers are mere 27 compilations of publicly available information. Mot. at 17. According to the complaint, however, 1 information about Plaintiffs that is “not ascertainable via public records or traditional search 2 engine queries,” “facts hidden online,” and “key proprietary and public records.” Compl. ⁋⁋ 18– 3 20. Indeed, the complaint alleges that the company also pulls “information from third-party data 4 brokers and law enforcement agencies that are not available to the general public, including live 5 cell phone records, location data from billions of license plate detections, real-time booking 6 information from thousands of facilities, and millions of historical arrest records and intake 7 photos.” Id. ⁋ 2. In other contexts, the Supreme Court has found that the unauthorized 8 dissemination of this and other similar personal information is a significant invasion of privacy. 9 See e.g., U.S. Dep’t of Def. v. Fed. Lab. Rels. Auth., 510 U.S. 487, 501 (1994) (employees 10 “have some nontrivial privacy interest in nondisclosure [of their home addresses]”); Reps. Comm. 11 For Freedom of Press, 489 U.S. at 749–50, 764 (unauthorized dissemination of “rap sheets” to 12 third parties constitutes “an unwarranted invasion of privacy”); U.S. Dep’t of State v. Ray, 502 13 U.S. 164, 175–76 (1991) (unauthorized dissemination of “highly personal information regarding 14 marital and employment status, children, living conditions and attempts to enter the United States” 15 constitutes an “invasion of privacy . . . significant when the personal information is linked to 16 particular [persons]”). The California Constitution also expressly enshrines the right to privacy. 17 See Cal. Const. art. 1, § 1 (“All people are by nature free and independent and have inalienable 18 rights. Among these [is] . . . obtaining . . . privacy.”). See Pioneer Elecs. (USA), Inc. v. Sup. Ct., 19 150 P.3d 198, 204 (Cal. 2007) ([“W]e have explained that the right of privacy protects the 20 individual's reasonable expectation of privacy against a serious invasion; Am. Acad. of Pediatrics 21 v. Lungren, 940 P.2d 797, 808 (Cal. 1997) (“The California Constitution, by contrast [to the U.S. 22 Constitution], contains in article I, section 1, an explicit guarantee of the right of “privacy.”); Hill, 23 865 P.2d at 644 (Cal. 1994)(“[T]he Privacy Initiative in article I, section 1 of the California 24 Constitution creates a right of action against private as well as government entities.”); Leonel v. 25 Am. Airlines, Inc., 400 F.3d 702, 711 (9th Cir. 2005), opinion amended on denial of reh'g, No. 03- 26 15890, 2005 WL 976985 (9th Cir. Apr. 28, 2005) (“Article I, section 1 of the California 27 Constitution declares privacy an inalienable right of the people of California. The right, in many 1 of their privacy not only by state actors but also by private parties.” (citation omitted)). The 2 unauthorized dissemination of virtually every piece of Plaintiffs’ personal information on the 3 CLEAR platform may constitute a severe invasion of privacy. 4 Even assuming everything in the dossiers was otherwise publicly available, “[a]n 5 individual’s interest in controlling the dissemination of information regarding personal matters 6 does not dissolve simply because that information may be available to the public in some form.” 7 Fed. Lab. Rels. Auth., 510 U.S. at 500. The Supreme Court has held that compiling disparate 8 pieces of information about a person into a single dossier, even if the individual pieces of 9 information are publicly available, constitutes a significant invasion of privacy. Reps. Comm. For 10 Freedom of Press, 489 U.S. at 763. In fact, the Supreme Court in Reporters Committee for 11 Freedom of Press noted that there was a “distinction, in terms of personal privacy, between 12 scattered disclosure of the bits of information contained in a rap sheet and revelation of the rap 13 sheet as a whole.” 489 U.S. at 763. The Court underlined that “there is a vast difference between 14 the public records that might be found after a diligent search of courthouse files, county archives, 15 and local police stations throughout the country and a computerized summary located in a single 16 clearinghouse of information.” Id. at 764. Here, too, compiling bits of Plaintiffs’ personal 17 information scattered throughout the internet (and allegedly in non-public sources) into a dossier is 18 a significant invasion of privacy because it is much easier to access that information in one place. 19 Otherwise why would CLEAR subscribers pay to access the dossiers? That some of Plaintiffs’ 20 personal information on the CLEAR dossiers comes from publicly available sources does not 21 diminish the significant harm Plaintiffs suffer from the sale of that compiled information to 22 whomever is willing to pay for it. 23 Thomson Reuters cites Cox Broadcasting Corp. v. Cohn for the proposition that “interests 24 in privacy fade when the information involved appears on the public record.” 420 U.S. 469, 494– 25 95 (1975). In that case, the Court held that the State of Georgia could not impose civil liability on 26 a journalist for publishing the name of a sexual assault survivor obtained from court records. Id. at 27 496–97. The central reasoning of Cox Broadcasting was that “[p]ublic records by their very 1 benefit is performed by the reporting of the true contents of the records by the media.” Id. at 495. 2 Here, by contrast, Thomson Reuters is not a journalist performing a “public benefit” by making 3 Plaintiffs’ personal information available to the public. Rather, the company’s dissemination of 4 this information only benefits the private parties who purchase the CLEAR dossiers. All the other 5 cases cited by Thomson Reuters to suggest that there is no privacy right in speech derived from 6 public records are similarly inapposite because they involve journalists disclosing publicly 7 available information to the general public. See e.g., Bartnicki v. Vopper, 532 U.S. 514 (2001) 8 (media defendants broadcasting cellular telephone conversation taped and given to them without 9 the speakers’ consent); The Fla. Star v. B.J.F., 491 U.S. 524 (1989) (newspaper publishing sexual 10 assault survivor’s name from a publicly released police report); Smith v. Daily Mail Pub. Co., 443 11 U.S. 97 (1979) (newspaper publishing name of minor charged as a juvenile offender); Okla. 12 Publ’g Co. v. Dist. Ct. In & For Okla. Cnty, 430 U.S. 308 (1977) (newspapers publishing name or 13 picture of minor child involved in juvenile proceeding). Moreover, none of these cases involve 14 the compilation and aggregation of information on the scale alleged here. 15 Against this well-pleaded substantial harm to Plaintiffs, Thomson Reuters simply states in 16 conclusory fashion that the utility of its unauthorized sale of Plaintiffs’ personal information is 17 “substantial.” Mot. 17. Without more, the Court has no basis for finding as a matter of law that 18 this sale has any utility, much less that its utility outweighs the gravity of the alleged harm to 19 Plaintiffs. 20 Accordingly, Thomson Reuters’s sale of Plaintiffs’ most private and personal information 21 states a claim under the unfair prong of the UCL. 22 ii. The Tethering Test 23 Under the tethering test—also known as the Cel-Tech test—“the unfairness must ‘be 24 tethered to some legislatively declared policy.’” Lozano, 504 F.3d at 736 (quoting Cel-Tech, 973 25 P.2d at 544). This test is easily satisfied here because numerous California statutes—including the 26 CCPA—“reflect ‘California’s public policy of protecting consumer data.’” In re Anthem, 162 F. 27 Supp. 3d at 990 (quoting In re Adobe Sys., Inc. Priv. Litig. (“In re Adobe”), 66 F. Supp. 3d 1197, 1 independent and have inalienable rights. Among these [is] . . . obtaining . . . privacy”); Cal. Civ. 2 Code § 1798.1 (“The Legislature declares that . . . all individuals have a right of privacy in 3 information pertaining to them . . The increasing use of computers . . . has greatly magnified the 4 potential risk to individual privacy that can occur from the maintenance of personal 5 information.”); Cal. Civ. Code § 1798.81.5(a) (“It is the intent of the Legislature to ensure that 6 personal information about California residents is protected.”); Cal. Bus. & Prof. Code § 22578 7 (explaining that the Legislature’s intent was to have a uniform policy state-wide regarding privacy 8 policies on the Internet). Hence, there are ample examples of the California legislature’s intent to 9 protect Plaintiffs’ personal information and consumer data from being disseminated online, such 10 that Thomson Reuters’s sale of this information “is comparable to a violation of law.” In re 11 Adobe, 66 F. Supp. 3d at 1227. 12 Accordingly, the Court concludes that, applying either test, Plaintiffs have plausibly pled a 13 claim that Thomson Reuters’s unauthorized sale of their personal information on the CLEAR 14 platform is an unfair business practice under the UCL. 15 3. Equitable Relief 16 Finally, Thomson Reuters argues that Plaintiffs are precluded from obtaining equitable 17 relief under the UCL because they “also seek monetary damages” as compensation for their right 18 of publicity and unjust enrichment claims, and therefore have an adequate remedy at law. Mot. at 19 18. Indeed, the Ninth Circuit recently held in Sonner v. Premier Nutrition Corp. that a plaintiff 20 “must establish that she lacks an adequate remedy at law before securing equitable restitution for 21 past harm under the UCL and CLRA.” 971 F.3d. 834, 884 (9th Cir. 2020) (emphasis added). 22 Even though the Court is dismissing their right of publicity claims under the first cause of action, 23 see supra Part III.A., Plaintiffs’ unjust enrichment claim under the third cause of action survives, 24 see infra Part III.C., and is “an adequate remedy at law” for which Plaintiffs are seeking “equitable 25 relief including restitution and disgorgement of all revenues, earnings, and profits that Thomson 26 Reuters obtained as a result of its unlawful and wrongful conduct.” Compl. ¶ 109. In other words, 27 Plaintiffs seek “the same amount of money for the same harm” in their unjust enrichment and 1 Plaintiffs’ second cause of action for monetary relief under the UCL. Id. ¶¶ 90–104. 2 However, in their fourth cause of action, Plaintiffs are also seeking equitable relief in the 3 form of an injunction under the UCL. Id. ¶¶ 111–118. This Court has explained that “equitable 4 relief can come in different forms—for example, injunctive relief or restitution.” See Julian v. 5 TTE Tech., Inc., No. 20-CV-02857-EMC, 2020 WL 6743912, at *4 (N.D. Cal. Nov. 17, 2020). 6 The holding in Sonner applies only to “equitable restitution for past harm under the UCL,” not to 7 an injunction for future harm. 971 F.3d. at 884 (emphasis added). Therefore, Plaintiffs are not 8 barred from seeking equitable relief in the form of an injunction under the UCL. 9 Admittedly, one court in this district and several courts in California have applied Sonner 10 to injunctive relief claims under the UCL, typically in cases where monetary damages can 11 compensate for the harm suffered, such as overpayment for defective or falsely advertised 12 products. See, e.g., Zaback v. Kellogg Sales Co., No. 3:20-cv-00268-BEN-MSB, 2020 WL 13 6381987, *4 (S.D. Cal. Oct. 29, 2020) (dismissing a UCL claim for injunctive relief because the 14 plaintiff failed to allege that there was no adequate remedy at law); In re MacBook Keyboard 15 Litig., No. 5:18-cv-02813-EJD, 2020 WL 6047253, at *2-3 (N.D. Cal. Oct. 13, 2020) (“Courts 16 generally hold that monetary damages are an adequate remedy for claims based on an alleged 17 product defect, and reject the argument that injunctive relief requiring repair or replacement is 18 appropriate.”); Gibson v. Jaguar Land Rover N. Am., LLC, No. CV 20-00769 CJC (GJSx), 2020 19 WL 5492990, at *3-4 (C.D. Cal. Sept. 9, 2020) (dismissing UCL claims for injunction and 20 restitution based on Sonner); Teresa Adams v. Cole Haan, LLC, No. Sacv 20-913 JVS (DFMx), 21 2020 WL 5648605, at *2 (C.D. Cal. Sept. 3, 2020) (finding, under the reasoning of Sonner, that 22 there is no “exception for injunctions as opposed to other forms of equitable relief”); Schertz v. 23 Ford Motor Co., No. CV 20-03221 TJH (PVCx), 2020 WL 5919731, at *2 (C.D. Cal. July 27, 24 2020) (dismissing UCL claims for injunction and restitution where the plaintiff failed to allege 25 that there was no adequate remedy at law). 26 More recently, however, other courts have declined to apply Sonner to bar UCL claims for 27 injunctive relief, recognizing that the prospect of paying damages is sometimes insufficient to 1 See Zeiger v. WellPet LLC, No. 3:17-CV-04056-WHO, 2021 WL 756109, at *21 (N.D. Cal. Feb. 2 26, 2021) (“Assuming that Sonner applies to injunctive relief, Zeiger has shown that monetary 3 damages for past harm are an inadequate remedy for . . . future harm. . . . Damages would 4 compensate Zeiger for his past purchases. An injunction would ensure that he (and other 5 consumers) can rely on WellPet’s representations in the future.”); Andino v. Apple, Inc., No. 2:20- 6 CV-01628-JAM-AC, 2021 WL 1549667, at *5 (E.D. Cal. Apr. 20, 2021) (“Sonner does not 7 warrant dismissal of [the plaintiff’s] request for injunctive relief. Money damages are an 8 inadequate remedy for future harm, as they will not prevent Defendant from continuing the 9 allegedly deceptive practice.”). Without an injunction, as in Zeiger and Andino, there is no way 10 the Court can ensure that Thomson Reuters will stop selling Plaintiffs’ personal information 11 without their consent. Damages for past sales are not likely to dissuade Thomson Reuters from 12 continuing this behavior in the future. 13 More importantly, the instant case is fundamentally different from typical UCL cases 14 involving defective products or false advertising because the injury here is an invasion of privacy 15 that can never be fully remedied through damages. See Meyer v. Portfolio Recovery Assocs., LLC, 16 707 F.3d 1036, 1045 (9th Cir. 2012) (violation of privacy is “irreparable harm”); Ne. Fla. Chapter 17 of Ass’n of Gen. Contractors of Am. v. City of Jacksonville, 896 F.2d 1283, 1285 (11th Cir. 1990) 18 (“[I]nvasions of privacy, because of their intangible nature, could not be compensated for by 19 monetary damages[.]”); Maxcrest Ltd. v. United States, No. 15-MC-80270-JST, 2016 WL 20 6599463, at *4 (N.D. Cal. Nov. 7, 2016) (“[A]ny harm to Maxcrest’s privacy interests would be 21 irreparable because ‘there is nothing a court can do to withdraw all knowledge or information that 22 IRS agents may have acquired by examination of the [the requested information]’ once that 23 information has already been divulged.” (quoting Church of Scientology of Cal. v. United States, 24 506 U.S. 9, 13 (1992))). Even if Plaintiffs could obtain damages the unauthorized sale of their 25 personal information to third parties, that amount will not compensate them adequately for the 26 irreparable loss of their privacy. 27 Accordingly, the Court concludes that Plaintiffs can seek equitable relief in the form of an 1 C. Unjust Enrichment Claim 2 The Court rejects Thomson Reuters’s argument that unjust enrichment is not a standalone 3 cause of action and thus cannot be asserted, because that argument is based on outdated law. Mot. 4 at 18 (citing Low v. LinkedIn Corp., 900 F. Supp. 2d 1010, 1031 (N.D. Cal. 2012)). The Ninth 5 Circuit has allowed a claim for unjust enrichment “as an independent cause of action or a quasi- 6 contract claim for restitution.” ESG Capital Partners, LP v. Stratos, 828 F.3d 1023, 1038 (9th Cir. 7 2016). In doing so, the court recognized that “[s]ome California courts allow a plaintiff to state a 8 cause of action for unjust enrichment, while others have maintained that California has no such 9 cause of action.” Id. 10 More recently, albeit in an unpublished order, the Ninth Circuit explained that 11 “California’s case law on whether unjust enrichment could be sustained as a standalone cause of 12 action was uncertain and inconsistent. But [in 2015], the California Supreme Court . . . clarified 13 California law, allowing an independent claim for unjust enrichment to proceed in an insurance 14 dispute.” Bruton v. Gerber Prod. Co., 703 F. App’x 468, 470 (9th Cir. 2017). Indeed, the 15 California Supreme Court held in Hartford Casualty Insurance Co. v. J.R. Marketing, L.L.C. that 16 an insurer could bring a standalone unjust enrichment claim against its insured’s legal counsel for 17 “‘padd[ing]’ their bills by charging fees that were, in part, excessive, unreasonable, and 18 unnecessary.” 353 P.3d 319, 322 (Cal. 2015). District courts in the Ninth Circuit have since 19 routinely recognized standalone unjust enrichment claims. See e.g., Hart v. TWC Prod. & Tech. 20 LLC, No. 20-CV-03842-JST, 2021 WL 1032354, at *8 (N.D. Cal. Mar. 17, 2021) (“Even though 21 the Court earlier concluded that Hart ‘suffered no economic loss from the disclosure of [his] 22 information, [he] may proceed at this stage on a claim for unjust enrichment to recover the gains 23 that [TWC] realized from its allegedly improper conduct.’” (quoting In re Facebook, 402 F. Supp. 24 3d at 893)); Wu v. Sunrider Corp., No. CV 17-4825 DSF (SSX), 2017 WL 6880087, at *4 (C.D. 25 Cal. Oct. 10, 2017) (“Defendants rely on outdated precedent. As the Ninth Circuit noted, the 26 California Supreme Court has recently clarified that unjust enrichment may be sustained as a 27 stand-alone cause of action.”). 1 Bruton is persuasive precedent, this Court concludes that Plaintiffs can raise a standalone unjust 2 enrichment claim. 3 D. The Communications Decency Act 4 The Communications Decency Act of 1996 (CDA), 47 U.S.C. § 230, provides, in relevant 5 part, (1) Treatment of publisher or speaker 6 No provider or user of an interactive computer service shall be 7 treated as the publisher or speaker of any information provided by another information content provider. 8 (2) Civil liability 9 No provider or user of an interactive computer service shall be held 10 liable on account of—

11 (A) any action voluntarily taken in good faith to restrict access to or availability of material that the provider or user 12 considers to be obscene, lewd, lascivious, filthy, excessively violent, harassing, or otherwise objectionable, whether or not 13 such material is constitutionally protected. 14 47 U.S.C. § 230(c). Thus, the CDA immunizes providers of an “interactive computer service”6 15 (i.e. Facebook, Twitter, LinkedIn, etc.) from liability for content independently created or 16 developed by third-party “information content providers”7 (i.e., users), unless the interactive 17 computer service created or developed part of that content. Accordingly, “any activity that can be 18 boiled down to deciding whether to exclude material that third parties seek to post online is 19 perforce immune under section 230.” Fair Housing Council of San Fernando Valley v. 20 Roommates.com, LLC, 521 F.3d 1157, 1170–71 (9th Cir.2008) (en banc). The CDA allows 21 websites like Facebook or Twitter to take down objectionable content posted by their users 22 without becoming liable either for the content they do not take down, 47 U.S.C. § 230(c)(1), or for 23 taking down content in good faith, id. § 230(c)(2)(A). 24 6 An “interactive computer service” is defined as “any information service, system, or access 25 software provider that provides or enables computer access by multiple users to a computer server, including specifically a service or system that provides access to the Internet and such systems 26 operated or services offered by libraries or educational institutions.” Id. § 230(f)(2).

27 7 An “information content provider” is defined as “any person or entity that is responsible, in 1 The Court is not persuaded by Thomson Reuters’s contention that the CDA immunizes it 2 from civil liability stemming from the unauthorized sale of Plaintiffs’ personal information. Mot. 3 at 19–23. In the Ninth Circuit, §230(c)(1) only immunizes “(1) a provider or user of an interactive 4 computer service (2) whom a plaintiff seeks to treat, under a state law cause of action, as a 5 publisher or speaker (3) of information provided by another information content 6 provider.” HomeAway.com, Inc. v. City of Santa Monica, 918 F.3d 676, 681 (9th Cir. 2019) 7 (quoting Barnes v. Yahoo!, Inc., 570 F.3d 1096, 1100–01 (9th Cir. 2009)). Thomson Reuters fails 8 to meet the second and third requirements of this test. 9 First, the Ninth Circuit has been very clear that a plaintiff seeks to treat an interactive 10 computer service as a “publisher or speaker” under § 230(c)(1) only when it is asking that service 11 to “review[], edit[], and decid[e] whether to publish or withdraw from publication third-party 12 content.” Id. (quoting Barnes, 570 F.3d at 1102). Here, Plaintiffs are not seeking to hold 13 Thomson Reuters liable “as the publisher or speaker” because they are not asking it to monitor 14 third-party content; they are asking to moderate its own content. 15 Second, and relatedly, the “information” at issue here—the dossiers with Plaintiffs’ 16 personal information—is not “provided by another information content provider.” 47 U.S.C. § 17 230(c)(1). In Roomates.com, the panel explained that § 230 was passed by Congress to 18 “immunize[] providers of interactive computer services against liability arising from content 19 created by third parties.” 521 F.3d at 1162 (emphasis added). The whole point was to allow 20 those providers to “perform some editing on user-generated content without thereby becoming 21 liable for all defamatory or otherwise unlawful messages that they didn’t edit or delete. In other 22 words, Congress sought to immunize the removal of user-generated content, not the creation of 23 content.” Id. at 1163 (emphases added). Here, there is no user-generated content—Thomson 24 Reuters generates all the dossiers with Plaintiffs’ personal information that is posted on the 25 CLEAR platform. See Compl. ⁋⁋ 1–3. In other words, Thomson Reuter is the “information 26 content provider” of the CLEAR dossiers because it is “responsible, in whole or in part, for the 27 creation or development of” those dossiers. 47 U.S.C. § 230(f)(3). It is nothing like the paradigm 1 Furthermore, the Ninth Circuit has repeatedly rejected arguments like Thomson Reuters’s 2 contention that its dossiers are covered by § 230(c)(1) because it creates those dossiers from data 3 contained in third-party content. See, e.g., Doe v. Internet Brands, 824 F.3d 846, 852–53 (“We 4 have already held that the CDA does not declare ‘a general immunity from liability deriving from 5 third-party content.’” (quoting Barnes, 570 F.3d at 1100)); Roommates.com, 521 F.3d at 1171 6 (“Providing immunity every time a website uses data initially obtained from third parties would 7 eviscerate the exception to section 230 for ‘develop[ing]’ unlawful content ‘in whole or in part.’” 8 (quoting 47 U.S.C. § 230(f))). 9 Section 230 is therefore inapplicable. 10 E. California’s Anti-SLAPP Statute 11 Section 425.16 of the California Civil Code, also known as California’s Strategic Lawsuit 12 Against Public Participation (“anti-SLAPP”) statute, provides

13 [a] cause of action against a person arising from any act of that person in furtherance of the person’s right of petition or free speech 14 under the United States Constitution or the California Constitution in connection with a public issue shall be subject to a special motion 15 to strike, unless the court determines that the plaintiff has established that there is a probability that the plaintiff will prevail on 16 the claim. 17 Cal. Civ. Proc. Code § 425.16(b)(1). To adjudicate an anti-SLAPP claim, the Court must apply a 18 two-step burden-shifting test. At step one, the defendant must show that the plaintiff’s action 19 arises from “an act in furtherance of the person’s right of petition or free speech.” Id. If the 20 defendant satisfies step one, “the burden then shifts to the Plaintiff . . . to establish a reasonable 21 probability that it will prevail on its claim in order for the claim to survive dismissal.” Makaeff v. 22 Trump Univ., LLC, 715 F.3d 254, 261 (9th Cir. 2013). Thomson Reuters’s anti-SLAPP motion 23 fails at step one. 24 To satisfy its burden at step one, Thomson Reuters must establish that the basis of this 25 lawsuit is one of the following acts in furtherance of its right of free speech:

26 (1) any written or oral statement or writing made before a legislative, executive, or judicial proceeding, or any other official 27 proceeding authorized by law, an issue under consideration or review by a legislative, executive, or 1 judicial body, or any other official proceeding authorized by law,

2 (3) any written or oral statement or writing made in a place open to the public or a public forum in connection with an issue of public 3 interest, or

4 (4) any other conduct in furtherance of the exercise of the constitutional right of petition or the constitutional right of free 5 speech in connection with a public issue or an issue of public interest. 6 7 Cal. Civ. Proc. Code § 425.16(e). According to Thomson Reuters, Plaintiffs’ claims arise from its 8 right of free speech pursuant to section 425.16(e)(3) because its unauthorized sale of Plaintiffs’ 9 personal information (1) involves “a public forum,” i.e., the CLEAR platform; and (2) is “in 10 connection with an issue of public interest” pursuant to section 425.16(e)(3). Mot. at 23–24. 11 First, the CLEAR platform is arguably not a “public forum” because only “[w]eb sites 12 accessible to the public, . . . are ‘public forums’ for purposes of the anti-SLAPP statute.” Barrett 13 v. Rosenthal, 146 P.3d 510, 514 n.4 (Cal. 2006) (emphasis added); see also Huntingdon Life Scis., 14 Inc. v. Stop Huntingdon Animal Cruelty USA, Inc., 129 Cal. Rptr. 3d 521, 536 (Ct. App. 2005) 15 (website is accessible to the public because it is “accessible to anyone who chooses to visit the 16 site”). CLEAR is not accessible to “anyone who chooses to visit the site;” it requires payment. 17 On the other hand, anyone who pays for the service can presumably have access to it, much like 18 anyone who pays cover to enter a bar or a ticket to see a theater show would have access to enter 19 those public fora. Therefore, it is unclear whether the CLEAR platform is a public forum or not. 20 However, even if the CLEAR platform is a public forum, Thomson Reuters fails to explain 21 how the dossiers it posts on the CLEAR platform are “in connection with an issue of public 22 interest.” Cal. Civ. Proc. Code § 425.16(e)(3). It merely extolls, in conclusory fashion, that 23 “Plaintiffs’ claims arise from conduct in connection with an issue of public interest because 24 Thomson Reuters’ CLEAR platform provides access to current and historical factual information.” 25 Mot. at 24. These conclusory allegations are insufficient to satisfy Thomson Reuters’s burden at 26 step one because the unauthorized sale of people’s most personal and private information is not a 27 matter of public interest, particularly when the information pertains to any individual regardless of 1 The Supreme Court has long explained that “not all speech is of equal First Amendment 2 importance. It is speech on ‘matters of public concern’ that is ‘at the heart of the First 3 Amendment protection.’” Dun & Bradstreet, Inc. v. Greenmoss Builders, Inc., 472 U.S. 749, 4 758–59 (1985) (quoting First Nat. Bank of Boston v. Bellotti, 435 U.S. 765, 776 (1978)). 5 Conversely, “speech on matters of purely private concern is of less First Amendment concern” 6 because “[t]here is no threat to the free and robust debate of public issues; there is no potential 7 interference with a meaningful dialogue of ideas concerning self-government; and there is no 8 threat of liability causing a reaction of self-censorship by the press.” Id. at 759–60 (quoting 9 Connick v. Myers, 461 U.S. 138, 145 (1983)); Snyder v. Phelps, 562 U.S. 443, 452 (2011) (“[N]ot 10 all speech is of equal First Amendment importance, . . . and where matters of purely private 11 significance are at issue, First Amendment protections are often less rigorous.”) (quoting Hustler 12 Mag., Inc. v. Falwell, 485 U.S. 46, 56 (1988)). More recently, the Court explained in Snyder that 13 courts are to look at “content, form, and context” to determine if speech is of public concern. 562 14 U.S. at 453. As to “content,” the Court explained that “[s]peech deals with matters of public 15 concern when it can ‘be fairly considered as relating to any matter of political, social, or other 16 concern to the community,’ or when it ‘is a subject of legitimate news interest; that is, a subject of 17 general interest and of value and concern to the public.’” Id. (first quoting Connick, 461 U.S. at 18 156; then quoting City of San Diego v. Roe, 543 U.S. 77, 83–84 (2004)). Speech of private 19 concern—like Plaintiffs’ personal and private information—does not “seek to communicate to the 20 public or to advance a political or social point of view.” Borough of Duryea v. Guarnieri, 564 21 U.S. 379, 398 (2011). 22 The public does not have a particular cognizable interest in the “speech” at issue here—the 23 dissemination of Plaintiffs’ personal information—because that information is purely a matter of 24 private concern, does not relate to any matter of “political” or “social” concern, and does they seek 25 to communicate a political or social point of view. To the contrary, like the credit report at issue 26 in Dun & Bradstreet, CLEAR dossiers with Plaintiffs’ personal information “concern[] no public 27 issue” because “[they are] speech solely in the individual interest of the speaker [i.e. Thomson 1 Whitepages Inc., No. 19 C 4871, 2020 WL 6287369, at *6 (N.D. Ill. Oct. 27, 2020) 2 (“[B]ackground reports are properly characterized as private concern, not public concern, 3 speech.”). Also, that Thomson Reuters only shares Plaintiffs’ personal information with its 4 CLEAR subscribers who specifically pay for it, and not with the general public, cuts heavily 5 against concluding that Thomson Reuters’s conduct is of public concern. Dun & Bradstreet, 472 6 U.S. at 762 (“[S]ince the credit report was made available to only five subscribers, who, under the 7 terms of the subscription agreement, could not disseminate it further, it cannot be said that the 8 report involves any ‘strong interest in the free flow of commercial information.’” (quoting Va. 9 Pharmacy Bd. v. Va. Citizens Consumer Council, Inc., 425 U.S. 748, 764 (1976))); Cf. IMDb.com 10 Inc. v. Becerra, 962 F.3d 1111, 1124–25 (9th Cir. 2020) (“[T]he ‘speech’ at issue—the sale of 11 data—was itself an inherently private exchange between private parties. Here, in contrast, IMDb 12 posts the information on its website free of charge for the public to review. This fact alone 13 imparts an inherently public character to the speech at issue.”). If anything, as the District of 14 Columbia Circuit correctly pointed out in Trans Union Corp. v. FTC, the “speech” at issue here is 15 less of the public’s concern than the credit report in Dunn & Bradstreet because it involves the 16 personal information “of private individuals, not incorporated businesses like the respondent 17 in Dun & Bradstreet.” 267 F.3d 1138, 1140 (D.C. Cir. 2001) (“[T]he particular information at 18 issue in this case—people’s names, addresses, and financial circumstances—is less public than the 19 same information about companies whose articles of incorporation and financial statements are 20 generally available for inspection.”). The Court therefore concludes that Thomson Reuters’s 21 private and unauthorized sale of Plaintiffs’ personal information is “an inherently private exchange 22 between private parties,” not a matter of public concern. IMDb.com Inc., 962 F.3d at 1124–25. 23 Thomson Reuters’s attempt to characterize its unauthorized sale of Plaintiffs’ personal 24 information on the CLEAR platform as “[t]he dissemination of news and information about 25 current and historical events” is unpersuasive. Mot. at 10. The complaint alleges only that 26 Thomson Reuters “aggregates both public and non-public information about millions of people” 27 into “dossiers on each person” that it then sells to its customers via the CLEAR platform. Compl. 1 context, commentary, opinion, or in any way editorializes this information.8 More importantly, it 2 does not use this information in “reporting about public events,” Downing, 265 F.3d at 1001 3 (quoting Eastwood, 198 Cal. Rptr. at 350), or “in connection with any news, public affairs, or 4 sports broadcast or account, or any political campaign,” Cal Civ. Code § 3344(d). See also Lukis, 5 2020 WL 6287369, at *6 (“The background reports do not relate to ‘political’ or ‘social’ issues; 6 rather, they list information like phone numbers, current and past addresses, and possible 7 relatives.”); Fraley, 830 F. Supp. at 805 (“Because Facebook’s publication of Plaintiffs’ ‘Likes’ is 8 alleged to be for commercial advertising purposes and not part of ‘any news, public affairs, or 9 sports broadcast or account, or any political campaign,’ the Court does not find it appropriate to 10 dismiss the claim under the newsworthiness exception provided in § 3344(d)”). In other words, 11 the sale of Plaintiffs’ personal information cannot be fairly characterized as journalistic. It is hard 12 to conceive how the public has any interest—let alone a compelling interest protected by the First 13 Amendment—in the raw personal information of every California resident, especially where it is 14 not connected to a matter of public interest. 15 Thomson Reuters also contends that the public has a strong interest in the named 16 Plaintiffs’ personal information because they “are in the public eye due to their role as activists, 17 actors, and journalists.” Mot. at 15 (citing Compl. ⁋⁋ 41, 50). The problem with this argument is 18 that most of the Plaintiffs in the proposed class will not be famous or notorious people who “create 19 a legitimate and widespread attention to their activities” because they are in the public eye. 20 Downing, 265 F.3d at 1001 (quoting Eastwood, 198 Cal. Rptr. at 350). 21 Accordingly, because Thomson Reuters’s anti-SLAPP motion does not make it past step 22 one, the Court need not consider whether it satisfies step two. Moreover, even if Thomson 23 Reuters had satisfied its burden at step one, Plaintiffs have, for the reasons discussed above in 24 parts III.B through III.C, c met their burden of showing that they have a reasonable probability of 25 8 According to Thomson Reuters, it provides “opinion” about consumers in the form of “risk 26 scores” where it purports to measure the riskiness of extending credit to a consumer. Mot. at 12. But Plaintiffs do not challenge the risk scores themselves, only Thomson Reuters’s sale of their 27 personal information. Even if the First Amendment gave Thomson Reuters a right to sell its risk 1 succeeding on their UCL and unjust enrichment claims.9 See Planned Parenthood Fed’n of Am., 2 Inc. v. Ctr. for Med. Progress, 890 F.3d 828, 834 (9th Cir.), amended, 897 F.3d 1224 (9th Cir. 3 2018) (“[W]hen an anti-SLAPP motion to strike challenges only the legal sufficiency of a claim, a 4 district court should apply the Federal Rule of Civil Procedure 12(b)(6) standard and consider 5 whether a claim is properly stated.”). 6 IV. CONCLUSION 7 For the foregoing reasons, the Court GRANTS in part and DENIES in part Thomson 8 Reuters’s motion to dismiss. The Court also DENIES as moot Thomson Reuter’s motion to stay 9 discovery pending resolution of the instant motion. 10 This order disposes of Docket Nos. 28 and 37. 11 12 IT IS SO ORDERED. 13 14 Dated: August 16, 2021 15 16 ______________________________________ EDWARD M. CHEN 17 United States District Judge 18 19 20 21 22 23 24 25 26

27 9 Because Thomson Reuters’s anti-SLAPP motion is meritless, the Court does not reach Plaintiffs’