Brooks v. Thomson Reuters Corporation

Opinion

CAT BROOKS, et al., Case No. 21-cv-01418-EMC

Plaintiffs, ORDER GRANTING IN PART AND v. DENYING IN PART DEFENDANT’S MOTION TO DISMISS Docket Nos. 28, 37 Defendant.

Pending before the Court is Defendant Thomson Reuters Corporation’s (“Thomson Reuters’s”) motion to dismiss Plaintiffs Cat Brooks and Rasheed Shabazz’s complaint pursuant to Federal Rule of Civil Procedure 12(b)(6). See Docket No. 28 (“Mot.”). For the following reasons, the Court GRANTS in part and DENIES in part Thomson Reuters’s motion to dismiss. Plaintiffs’ complaint alleges as follows. Thomson Reuters “aggregates both public and non-public information about millions of people” to create “detailed cradle-to-grave dossiers on each person, including names, photographs, criminal history, relatives, associates, financial information, and employment information.” See Docket No. 1-1 (Compl.) ⁋ 2. Other than publicly available information on social networks, blogs, and even chat rooms, Thomson Reuters also pulls “information from third-party data brokers and law enforcement agencies that are not available to the general public, including live cell phone records, location data from billions of license plate detections, real-time booking information from thousands of facilities, and millions information, DMV records, social-media posts, utility records, and even records indicating whether a person has had an abortion. Id. ¶¶ 2, 16, 20, 35(a). Thomson Reuters then sells this information to its customers—without the knowledge or consent of the persons to whom the information concerns—through an online platform it calls CLEAR. Id. ⁋⁋ 2–3, 12. CLEAR users pay a fixed fee for a dossier report with all the information Thomson Reuters has on an individual in the company’s database, as well as information on their family members and associates. Id. ⁋⁋ 24–26, 28, 62. The company’s “pay-as-you-go” pricing model even goes so far as to place a specific dollar value on the different types of information it sells. Id. ¶ 62. Its website “advertises that CLEAR enables its users to access ‘both surface and deep web data to examine intelligence’ about people ‘not found in public records or traditional search engines.’ This allows CLEAR users ‘to uncover’ personal ‘facts hidden online,’ by scraping ‘real-time information’ about individuals.” Id. at 2, 14–15. Because the company updates this information in real time, Id. ⁋⁋ 2, 17, the New York Times has described CLEAR as “an ever-evolving 360-degree view of U.S. residents’ lives.” Id. (quoting McKenzie Funk, How ICE Picks Its Targets in the Surveillance Age, N.Y. Times (Oct. 3, 2019)). Thomson Reuters makes significant profits from selling these reports. Id. ⁋⁋ 58–63. The named Plaintiffs are Californians whose identities Thomson Reuters sells to its customers through CLEAR. Id. ¶¶ 6–7. Neither consented to the company selling their personal information—and neither wants the company to do so. Id. ¶¶ 41–42, 50–51. Both are Black civil rights activists concerned about being targeted because of their work. Id. They do not want a 360- degree view of their lives available to those willing to pay for it. Id. In fact, Ms. Brooks even subscribes to a service that routinely deletes her information from the internet. Id. ¶ 41. Mr. Shabazz also alleges that Thomson Reuters’s CLEAR profile on him incorrectly indicates that he is divorced and has failed to pay child support when he was never legally married and at the time had no children. Id. ⁋ 54. On December 23, 2020, Plaintiffs filed their class action complaint in the Superior Court of California, County of Alameda, on behalf of all California residents “whose name, photographs, during the limitations period.” Id. ⁋ 70. They assert four causes of action on behalf of the proposed class: (1) violations of the California common law right of publicity; (2) a claim for monetary relief for violations of California’s Unfair Competition Law (UCL), Cal Bus. & Prof. Code § 17200; (3) unjust enrichment; and (4) a claim for injunctive relief for violations of the UCL. Id. ⁋⁋ 81–118. On February 26, 2021, Thomson Reuters removed the action to federal court pursuant to the Class Action Fairness Act of 2005 (CAFA), 28 U.S.C. §§ 1332(d), 1453(b), and filed the pending motion to dismiss on April 5, 2021. Mot. Thereafter it filed a motion to stay discovery pending resolution of the motion to dismiss. See Docket No. 37. Federal Rule of Civil Procedure 8(a)(2) requires a complaint to include “a short and plain statement of the claim showing that the pleader is entitled to relief.” Fed. R. Civ. P. 8(a)(2). A complaint that fails to meet this standard may be dismissed pursuant to Rule 12(b)(6). See Fed. R. Civ. P. 12(b)(6). To overcome a Rule 12(b)(6) motion to dismiss after the Supreme Court’s decisions in Ashcroft v. Iqbal, 556 U.S. 662 (2009) and Bell Atlantic Corporation v. Twombly, 550 U.S. 544 (2007), a plaintiff’s “factual allegations [in the complaint] ‘must . . . suggest that the claim has at least a plausible chance of success.’” Levitt v. Yelp! Inc., 765 F.3d 1123, 1135 (9th Cir. 2014). The court “accept[s] factual allegations in the complaint as true and construe[s] the pleadings in the light most favorable to the nonmoving party.” Manzarek v. St. Paul Fire & Marine Ins. Co., 519 F.3d 1025, 1031 (9th Cir. 2008). But “allegations in a complaint . . . may not simply recite the elements of a cause of action [and] must contain sufficient allegations of underlying facts to give fair notice and to enable the opposing party to defend itself effectively.” Levitt, 765 F.3d at 1135 (quoting Eclectic Props. E., LLC v. Marcus & Millichap Co., 751 F.3d 990, 996 (9th Cir. 2014)). “A claim has facial plausibility when the Plaintiff pleads factual content that allows the court to draw the reasonable inference that the Defendant is liable for the misconduct alleged.” Iqbal, 556 U.S. at 678. “The plausibility standard is not akin to a ‘probability requirement,’ but it asks for more than a sheer possibility that a defendant has acted A. Right of Publicity California has long recognized a right of publicity (also known as a “commercial misappropriation” claim), which protects a person’s name and likeness against appropriation by others for their commercial advantage. Downing v. Abercrombie & Fitch, 265 F.3d 994, 1001 (9th Cir. 2001). There are two ways to assert a right of publicity claim: a common law cause of action for commercial misappropriation, and a statutory remedy for commercial misappropriation under section 3344 of the California Civil Code. Id. To state a common law claim for commercial misappropriation, “a plaintiff must prove: ‘(1) the defendant’s use of the plaintiff’s identity; (2) the appropriation of plaintiff’s name or likeness to defendant’s advantage, commercially or otherwise; (3) lack of consent; and (4) resulting injury.’” Stewart v. Rolling Stone LLC, 105 Cal. Rptr. 3d 98, 111 (Ct. App. 2010), as modified on denial of reh’g (Feb. 24, 2010) (quoting Eastwood v. Sup. Ct., 198 Cal. Rptr. 342, 347 (Ct. App. 1983)); see also Newcombe v. Adolf Coors Co., 157 F.3d 686, 692 (9th Cir.1998) (listing the same factors). To state a statutory claim under section 3344,1 a plaintiff must plead all the elements of the common law claim and must also prove (5) “a knowing use by the defendant,” and (6) “a direct connection between the alleged use and the commercial purpose.” Downing, 265 F.3d at 1001.2 Thomson Reuters challenges only the “use” and “appropriation” elements of Plaintiffs’ right of publicity claims. It also contends that Plaintiffs’ right of publicity claims are barred by the First Amendment and that their section 3344 claim is barred by the newsworthy exception. This order will address each of these challenges in turn.

1 Although Plaintiffs are not raising a separate claim under section 3344, their claim under the unlawful prong of the UCL is predicated on a violation of section 3344. See Compl. ⁋ 94.

2 These two additional requirements are laid out in the language of the statute: section 3344(a) states that “[a]ny person who knowingly uses another’s name, voice, signature, photograph, or likeness, in any manner, . . . shall be liable for any damages sustained by the person or persons injured as a result thereof,” Cal Civ. Code § 3344(a); and section 3344(e) states that “it shall be a question of fact whether or not the use of the person’s name, voice, signature, photograph, or likeness was so directly connected with the commercial sponsorship or with the paid advertising 1. Use of Plaintiffs’ Identities Thomson Reuters argues that “[t]he display of a plaintiff’s name or likeness in third-party content” does not constitute “use” of the Plaintiffs’ identity for purposes of a right of publicity claim. Mot. at 7. But the dossiers on the CLEAR platform are not “third-party content,” they are created by Thomson Reuters, albeit from third-party sources. By contrast, the cases Thomson Reuters cites involved clearly “third-party content,” i.e. third parties posting people’s personal information on the defendant’s websites. For example, in Perfect 10, Inc. v. Google, Inc., third parties posted models’ names and likenesses on websites hosted by Google. See CV 04-9484 AHM (SHx), 2010 WL 9479060, at *13 (C.D. Cal. July 30, 2010). Similarly, in Cross v. Facebook, Inc., third-party users posted the plaintiff’s name and likeness on Facebook. See 222 Cal. Rptr. 3d 250, 265–66 (Ct. App. 217). In those cases, Google and Facebook—unlike Thomson Reuters—were not posting or sharing the plaintiffs’ identities; they were simply providing the websites or platforms where others posted that information. This case is more akin to Perkins v. LinkedIn Corporation, where the plaintiffs’ complaint alleged that, when they created a LinkedIn account, the company automatically sent emails signed by the plaintiffs to all their contacts saying “I’d like to add you to my professional network.” 53 F. Supp. 3d 1190, 1215–17 (N.D. Cal. 2014). Similarly, in Fraley v. Facebook, Facebook allegedly posted “sponsored stories” on users’ pages with other users’ names, pictures, and an assertion that the other users “liked” certain advertisers. 830 F. Supp. 2d 785, 791–92 (N.D. Cal. 2011). In those cases, it was LinkedIn that sent the emails and Facebook that posted the sponsored stories, not third parties. Likewise here, it is Thomson Reuters that posted the dossiers with Plaintiffs’ name, likeness, and personal information on its CLEAR platform. In other words, Thomson Reuters—not third parties—used Plaintiffs’ identities. Accordingly, the Court concludes that Plaintiffs’ have properly pled that Defendant has “used” their names and likenesses for purposes of stating a right of publicity claim. 2. Appropriation of Plaintiffs’ Name or Likeness For A Commercial Advantage Thomson Reuters also argues it does not appropriate Plaintiffs’ name, likeness, or personal publicity,” i.e., “for promotional purposes or to imply an endorsement.” Mot. at 8 (citing Restatement (Second) of Torts § 652C cmt d (1977)). Indeed, the Ninth Circuit and the California Supreme Court have explained that the right of publicity was conceived and is most often applied to protect against the unauthorized use of celebrities’ name and likeness to advertise or promote a product or service. See White v. Samsung Elecs., Am., Inc., 971 F.2d 1395, 1396 (9th Cir. 1992), as amended (Aug. 19, 1992) (“The right of publicity was developed to protect the commercial interest of celebrities in their identities. The theory of the right is that a celebrity’s identity can be valuable in the promotion of products.” (emphasis added) (quoting Carson v. Here’s Johnny Portable Toilets, Inc., 698 F.2d 831, 835 (6th Cir. 1983)); Lugosi v. Universal Pictures, 603 P.2d 425, 431 (1979) (“[T]he so-called right of publicity means in essence that the reaction of the public to name and likeness . . . endows the name and likeness of the person involved with commercially exploitable opportunities. The protection of name and likeness from unwarranted intrusion or exploitation is the heart of the law of privacy.”). As a result, right of publicity cases involve the unauthorized use of someone’s—typically a celebrity’s—name or likeness in commercial advertisings or promotions. Defendant’s first argument is that this is not a right of publicity case because it does not involve an advertisement that uses Plaintiffs’ name or likeness to suggest an endorsement. See e.g., Perkins, 53 F. Supp. 3d at 1190 (unauthorized emails representing that the plaintiffs endorsed the use of LinkedIn); Fraley, 830 F. Supp. 2d at 791 (unauthorized “sponsored stories” representing that the plaintiffs endorsed certain products advertised on Facebook); Abdul-Jabbar v. Gen. Motors Corp., 85 F.3d 407, 410 (9th Cir. 1996) (commercial falsely representing that Kareem Abdul-Jabbar endorsed “the ‘88 Oldsmobile”); Fairfield v. Am. Photocopy Equip. Co., 291 P.2d 194, 197 (Ct. App. 1955) (advertisement falsely representing that plaintiff, a famous lawyer, was a satisfied user of defendant’s product). It is true that Thomson Reuters in no way suggests that Plaintiffs endorse its dossiers or any of its other products. But this distinction is not dispositive because the Ninth Circuit and the California Court of Appeal have held that commercial appropriation in a right of publicity case does not require the imposed any requirement that the unauthorized use or publication of a person’s name or picture be suggestive of an endorsement or association with the injured person.” (quoting Eastwood, 198 Cal. Rptr. at 347–48)). In Eastwood, for example, the National Enquirer used Clint Eastwood’s name and photograph in an allegedly false news piece titled “Clint Eastwood in a Love Triangle with Tanya Tucker.” 198 Cal. Rptr. at 349. The “news” piece did not state or imply that Clint Eastwood endorsed or in any way wanted readers to purchase the Enquirer. Id. Instead, the court explained that the Enquirer “used Eastwood’s personality and fame . . . [t]o the extent their use [of Eastwood’s name and photograph in the news piece] attracted the readers’ attention.” Id. Therefore, the Eastwood court explicitly held that “the appearance of an endorsement is not the sine qua non of a claim for commercial appropriation.” Id. at 348. Plaintiffs therefore correctly argue that here, as in Eastwood, their names, likeness, and personal information is what attracts the attention of Thomson Reuters’s customers to the dossiers on the CLEAR platform, even if Thomson Reuters is not suggesting that Plaintiffs endorse its dossiers. The only reason CLEAR subscribers pay Thomson Reuters is to have direct access to Plaintiffs’ personal information, regardless of whether Plaintiffs authorized or endorsed the creation of the dossiers. The Court therefore cannot conclude that this is not a right of publicity case simply because Thomson Reuters is not suggesting that Plaintiffs endorse its dossiers. Thomson Reuters’s second argument is more persuasive: this is not a right of publicity case because Thomson Reuters is not using Plaintiffs’ name or likeness “for promotional purposes,” i.e., to advertise or promote a separate product or service. Virtually all right of publicity cases involve the use of a person’s name or likeness to advertise a separate product or service. See e.g., Hilton v. Hallmark Cards, 599 F.3d 894, 899–900 (9th Cir. 2010) (unauthorized use of Paris Hilton’s image and catch phrase on defendant’s greeting cards); Solano v. Playgirl, Inc., 292 F.3d 1078, 1081–82 (9th Cir. 2002) (unauthorized use of Jose Solano, Jr.’s photograph on the cover of adult magazine); Downing, 265 F.3d at 999–1000 (unauthorized use of plaintiffs’ photograph from a surfing competition on advertisement for defendant’s clothes); Newcombe, 157 F.3d at 689 (unauthorized use of a drawing allegedly depicting Donald Newcombe on (unauthorized use of animatronic robots based on actors’ likenesses placed in the defendant’s airport bars resembling the set of the television program where the actors played principal characters); Abdul-Jabbar, 85 F.3d at 410 (unauthorized use of Kareem Abdul-Jabbar’s identity on advertisement for “the ‘88 Oldmosbile”); White, 971 F.2d at 1396 (unauthorized use of a robot resembling Vanna White on advertisement for defendant’s electronics); Eastwood, 198 Cal. Rptr. at 347–48 (unauthorized use of Clint Eastwood’s name and photograph on the cover of magazine). Here, by contrast, Plaintiffs allege the product is their name, likeness, and personal information. Plaintiffs do not cite a single right of publicity case with analogous facts. Although the publishing of Plaintiffs’ most private and intimate information for profit might be a gross invasion of their privacy, it is not a misappropriation of their name or likeness to advertise or promote a separate product or service. This case is also dissimilar from right of publicity cases involving social media platforms using the names and likeness of their users. Even those cases always involve an advertisement or promotion for a separate product or service. One example is Perkins, where Judge Koh refused to dismiss a right of publicity claim because LinkedIn placed its users’ names and photographs— without their authorization—in “endorsement emails,” i.e., advertisements, encouraging other users to join the LinkedIn platform. 53 F. Supp. 3d at 1199. Another example is Fraley, where Judge Koh also refused to dismiss right of publicity claims because Facebook placed its users’ names and photographs—without their authorization—in “Sponsored Stories,” which are “a form of paid advertisement[s] that appear[] on a member’s Facebook page and that generally consists of another Friend’s name, profile picture, and an assertion that the person ‘likes’ the advertiser.” 830 F. Supp. 2d at 791. Unlike here, the defendants in Perkins and Fraley were using their users’ names and likeness to advertise a separate product or service, namely, the LinkedIn platform in Perkins and the third-party advertisers’ products in Fraley. The use of a person’s name and likeness to promote a product (other than that which pertains to the person themselves) is the essence of an “appropriation” of one’s name or likeness. No such appropriation is alleged here; unlike Perkins and Fraley, Plaintiffs’ name or likeness in this case were not sent to unsuspecting services; they were sent only to CLEAR subscribers who deliberately paid Thomson Reuters to receive information about them. This case is more akin to In re Facebook, Inc., Consumer Privacy User Profile Litigation (“In re Facebook”), where Judge Chhabria dismissed plaintiffs’ right of publicity claim because “[t]he allegations about how Facebook shared the plaintiffs’ information with third parties is categorically different from the type of conduct made unlawful by this tort, such as using a plaintiff’s face or name to promote a product or service.” 402 F. Supp. 3d 767, 803 (N.D. Cal. 2019). In that case, like here, the plaintiffs alleged Facebook made their sensitive personal information available to third parties, including Cambridge Analytica (a British political consulting firm), application developers, whitelisted applications, and Facebook’s business partners, and failed to prevent those third parties from selling or otherwise misusing the information. Id. at 779–82. This Court agrees with In re Facebook that the injury Plaintiffs suffered here—although deeply concerning and perhaps a violation of their privacy—is not a violation of their right of publicity because their name or likeness is not being “appropriated” and used to advertise a separate product or service. Cambridge Analytica, and the other third parties in In re Facebook, paid Facebook specifically to obtain its users’ personal information. The same is true here. In sum, the Court agrees with Thomson Reuters that Plaintiffs have failed to state a claim for a violation of the tight of publicity because Thomson Reuters did not appropriate their name or likeness.3 B. UCL Claims The UCL “prohibits, and provides civil remedies for, unfair competition, which it defines as ‘any unlawful, unfair or fraudulent business act or practice.’” Kwikset Corp. v. Super. Ct., 246 P.3d 877, 883 (Cal. 2011) (quoting Cal. Bus. & Prof. Code § 17200). Here, Plaintiffs allege that Thomson Reuters engaged in unlawful and unfair (but not fraudulent) business practices. Compl.

3 Because the Court finds that Plaintiffs have failed to state right of publicity claims, it need not ¶¶ 90–104 (monetary relief), 111–18 (injunctive relief). Thomson Reuters challenges Plaintiffs’ claims under both prongs. It also argues that Plaintiffs are precluded from obtaining equitable relief under the UCL because they have an adequate remedy at law. The Court will address each of these arguments in turn. 1. Unlawful Plaintiffs’ claims under the unlawful prong of the UCL are entirely predicated on their common law and statutory right of publicity claims. See id. ⁋⁋ 93, 94–110. Because Plaintiffs failed to properly plead those predicate claims, see supra Part III.A, they have also failed to plausibly plead their claim under the unlawful prong of the UCL. 2. Unfair According to Thomson Reuters, its conduct is not “unfair” under the UCL because it is (1) expressly permitted by the California Consumer Privacy Act (CCPA), Cal Civ. Code §§ 1798.100–1798.199.95, and (2) does not meet any of the tests used by California courts for unfair conduct. This Court disagrees. a. CCPA Defense Under the CCPA, “[a] consumer4 shall have the right, at any time, to direct a business that sells personal information about the consumer to third parties not to sell the consumer’s personal information. This right may be referred to as the right to opt-out.” Cal Civ. Code § 1798.20. Relying on this statutory language, Thomson Reuters argues its conduct cannot be unfair because the CCPA expressly allows it to sell Plaintiffs’ personal information if it provides Plaintiffs a mechanism to opt out of such sale. Mot. at 15–16 (citing Compl. ⁋⁋ 46–47, 57). This is a meritless argument for multiple reasons. As an initial matter, Thomson Reuters does not cite a single case where the court dismissed a plaintiff’s claim that the dissemination of their personal information is unfair under the UCL simply because the defendant provided an adequate opt-out mechanism under the CCPA.

4 Although Plaintiffs are not purchasers or users of Thomson Reuters’s products, they qualify as Moreover, several provisions of the CCPA clearly state that the law is not meant to curtail other privacy statutes. For example, the CCPA explains that the private right of action it creates under section 17980.50 for the “unauthorized access and exfiltration, theft, or disclosure [of consumer’s personal information] . . . shall not be construed to relieve any party from any duties or obligations imposed under other law or the United States or California Constitutions.” Cal. Civ. Code § 1798.50(a)(1), (c). More broadly, section 1798.175 explains that the CCPA “is intended to further the constitutional right of privacy and to supplement existing laws relating to consumers’ personal information,” and that, “[w]herever possible, law relating to consumers’ personal information should be construed to harmonize with the provisions of this title.” Id. § 1798.175 (emphasis added). The statute goes further: “in the event of a conflict between other laws and the provisions of [the CCPA] the provisions of the law that afford the greatest protection for the right of privacy for consumers shall control.” Id. Here, the Court can easily harmonize the CCPA’s right to opt-out with Plaintiffs’ claim under the unfair prong of the UCL by concluding that CLEAR’s opt-out mechanism does not necessarily mean Thomson Reuters’s unauthorized sale of Plaintiffs’ personal information is fair under the UCL as a matter of law. The UCL fairness prong may provide broader protection than specific statutes such as the CCPA. This interpretation of both statutes controls because it “afford[s] the greatest protection for the right of privacy for consumers.” Id. Even if providing an opt-out mechanism under the CCPA was a defense, there is a question of fact as to whether CLEAR’s opt-out mechanism complies with the CCPA. To actualize the “right to opt-out” in section 1798.120,

[a] business . . . shall, in a form that is reasonably accessible to consumers: (1) Provide a clear and conspicuous link on the business’s Internet homepage, titled “Do Not Sell My Personal Information,” to an Internet Web page that enables a consumer, or a person authorized by the consumer, to opt-out of the sale of the consumer’s personal information. Cal Civ. Code §§ 1798.135(a)(1) (emphases added). Similarly, the regulations that implement the A business’s methods for submitting request to opt-out shall be easy for consumers to execute and shall require minimal steps to allow the consumer to opt-out. A business shall not use a method that is designed with the purpose or has the substantial effect of subverting or impairing a consumer’s choice to opt-out. Cal. Code Regs. tit. 11, § 999.315(h) (emphasis added). The regulations also prohibit an opt-out mechanism that “require[]s the consumer to provide personal information that is not necessary to implement the request.” Id. § 999.315(h)(4). The complaint here alleges that Thomson Reuters places a “tiny link” at the bottom of its CLEAR homepage and “provides no notice to consumers that the link exists. Nor does the company enable consumers who happen to find out about the link to easily make use of it.” Compl. ⁋⁋ 46–48. It also alleges that when both named Plaintiffs attempted to opt out by clicking on the small link at the bottom of the CLEAR website, “Thomson Reuters required that [they] provide a photograph of [their] government-issued identification card as well as a separate picture of [their] face.” Compl. ⁋⁋ 49, 57. Taking these allegations as true and drawing every inference in Plaintiffs’ favor, the Court cannot determine as a matter of law that CLEAR’s opt-out mechanism complies with the CCPA and its implementing regulations. In the words of the statute, CLEAR’s opt-out mechanism—as alleged in the complaint—is not “reasonably accessible to consumers” or “clear and conspicuous.” Cal Civ. Code §§ 1798.135(a)(1). Nor is it “easy for consumers” to opt-out using “minimal steps.” Cal. Code Regs. tit. 11, § 999.315(h). In fact, plaintiff alleges that CLEAR required Plaintiffs’ photo identifications and faces to opt out. If true, those allegations could easily lead a reasonable trier of fact to conclude that CLEAR’s opt-out mechanism, itself, is unfair under the UCL. Accordingly, compliance with the CCPA is not a defense to Plaintiffs’ claims that the sale of their personal information is an unfair business practice under the UCL. At the very least, there is a serious question of material fact as to whether Thomson Reuters’s opt-out mechanism even complies with the CCPA. b. Unfairness Allegations Thomson Reuters also argues that the complaint’s allegations are insufficient to state a business practice under the UCL. Mot. at 16–18. An “unfair business act or practice” is one that “offends an established public policy or when the practice is immoral, unethical, oppressive, unscrupulous or substantially injurious to consumers.” Cel-Tech Commc’ns, Inc. v. L.A. Cellular Tel. Co., 973 P.2d 527, 543 (Cal. 1999) (quoting State Farm Fire & Cas. Co. v. Sup. Ct., 53 Cal. Rptr. 2d 229, 235 (Ct. App. 1996)). In evaluating “unfair” claims, California courts apply two tests: the balancing test and the tethering test. See Lozano v. AT & T Wireless Servs., Inc., 504 F.3d 718, 735 (9th Cir. 2007).5 Thomson Reuters’s conduct, as plausibly alleged in Plaintiffs’ complaint, is unfair under either test. i. The Balancing Test Under the balancing test—also known as the South Bay test—courts weigh “the harm to the consumer against the utility of the defendant’s practice.” See Id. (citing S. Bay Chevrolet v. Gen. Motors Acceptance Corp., 85 Cal. Rptr. 2d 301, 316 (Ct. App. 1999)). To start, the South Bay balancing test requires an in-depth evaluation of the facts that is not suitable for the pleading stage. See In re Anthem, Inc. Data Breach Litig. (“In re Anthem”), 162 F. Supp. 3d 953, 990 (N.D. Cal. 2016) (“Whether Defendants’ public policy violation is outweighed by the utility of their conduct under the balancing test is a question to be resolved at a later stage in this litigation. Thus, based on the balancing test alone, the Court DENIES Defendants’ motion to dismiss Plaintiffs’ UCL claim under the unfair prong.”); In re Carrier IQ, Inc., 78 F. Supp. 3d 1051, 1117 (N.D. Cal. 2015) (“The cost-benefit analysis this test calls for is not properly suited for resolution at the pealing stage.”); McKell v. Washington Mut., Inc., 49 Cal. Rptr. 3d 227, 240 (Ct. App. 2006) (“As with the determination whether a practice is fraudulent, the determination whether it is unfair is one of fact which requires a review of the evidence from both parties.”). The Court declines Thomson Reuters’s invitation to perform the balancing test before discovery at this early pleading stage. Moreover, even if the Court were to apply the balancing test based solely on the

5 Thomson Reuters urges this Court to apply a third test—the “FTC test”—which is inapplicable allegations in the complaint—as it must at this stage—the complaint plausible alleges the harm caused by the unauthorized dissemination of Plaintiffs’ most private and personal information clearly outweighs the utility of that sale. On the one hand, the harm to Plaintiffs is tremendous: an all-encompassing invasion of Plaintiffs’ privacy, whereby virtually everything about them—including their contact information, partially redacted social security number, criminal history, family history, and even whether they got an abortion, to name just a few—is transmitted to strangers without their knowledge, let alone their consent. Compl. ⁋⁋ 2–4, 26–30, 33, 35, 87, 102–04, 115. The Supreme Court has long recognized, in no uncertain terms, that “both the common law and the literal understandings of privacy encompass the individual’s control of information concerning his or her person.” U.S. Dep’t of Just. v. Reps. Comm. For Freedom of Press, 489 U.S. 749, 763 (1989). The California Supreme Court has likewise underlined how deeply pernicious it is to lose one’s privacy due to forced disclosure:

Privacy rights also have psychological foundations emanating from personal needs to establish and maintain identity and self-esteem by controlling self-disclosure: “In a society in which multiple, often conflicting role performances are demanded of each individual, the original etymological meaning of the word ‘person’—mask—has taken on new meaning. [People] fear exposure not only to those closest to them; much of the outrage underlying the asserted right to privacy is a reaction to exposure to persons known only through business or other secondary relationships. The claim is not so much one of total secrecy as it is of the right to define one’s circle of intimacy—to choose who shall see beneath the quotidian mask. Loss of control over which ‘face’ one puts on may result in literal loss of self-identity, and is humiliating beneath the gaze of those whose curiosity treats a human being as an object.” Hill v. Nat’l Collegiate Athletic Ass’n., 865 P.2d 633, 647 (Cal. 1994) (In Bank) (emphasis added) (quoting Briscoe v. Reader’s Digest Ass’n, Inc., 483 P.2d 34, 37 (Cal. 1971)). CLEAR dossiers may deeply damage Plaintiffs by directly contravening their right to keep private their most intimate and personal information. Thomson Reuters tries to minimize this harm by pointing out that its dossiers are mere compilations of publicly available information. Mot. at 17. According to the complaint, however, information about Plaintiffs that is “not ascertainable via public records or traditional search engine queries,” “facts hidden online,” and “key proprietary and public records.” Compl. ⁋⁋ 18– 20. Indeed, the complaint alleges that the company also pulls “information from third-party data brokers and law enforcement agencies that are not available to the general public, including live cell phone records, location data from billions of license plate detections, real-time booking information from thousands of facilities, and millions of historical arrest records and intake photos.” Id. ⁋ 2. In other contexts, the Supreme Court has found that the unauthorized dissemination of this and other similar personal information is a significant invasion of privacy. See e.g., U.S. Dep’t of Def. v. Fed. Lab. Rels. Auth., 510 U.S. 487, 501 (1994) (employees “have some nontrivial privacy interest in nondisclosure [of their home addresses]”); Reps. Comm. For Freedom of Press, 489 U.S. at 749–50, 764 (unauthorized dissemination of “rap sheets” to third parties constitutes “an unwarranted invasion of privacy”); U.S. Dep’t of State v. Ray, 502 U.S. 164, 175–76 (1991) (unauthorized dissemination of “highly personal information regarding marital and employment status, children, living conditions and attempts to enter the United States” constitutes an “invasion of privacy . . . significant when the personal information is linked to particular [persons]”). The California Constitution also expressly enshrines the right to privacy. See Cal. Const. art. 1, § 1 (“All people are by nature free and independent and have inalienable rights. Among these [is] . . . obtaining . . . privacy.”). See Pioneer Elecs. (USA), Inc. v. Sup. Ct., 150 P.3d 198, 204 (Cal. 2007) ([“W]e have explained that the right of privacy protects the individual's reasonable expectation of privacy against a serious invasion; Am. Acad. of Pediatrics v. Lungren, 940 P.2d 797, 808 (Cal. 1997) (“The California Constitution, by contrast [to the U.S. Constitution], contains in article I, section 1, an explicit guarantee of the right of “privacy.”); Hill, 865 P.2d at 644 (Cal. 1994)(“[T]he Privacy Initiative in article I, section 1 of the California Constitution creates a right of action against private as well as government entities.”); Leonel v. Am. Airlines, Inc., 400 F.3d 702, 711 (9th Cir. 2005), opinion amended on denial of reh'g, No. 03- 15890, 2005 WL 976985 (9th Cir. Apr. 28, 2005) (“Article I, section 1 of the California Constitution declares privacy an inalienable right of the people of California. The right, in many of their privacy not only by state actors but also by private parties.” (citation omitted)). The unauthorized dissemination of virtually every piece of Plaintiffs’ personal information on the CLEAR platform may constitute a severe invasion of privacy. Even assuming everything in the dossiers was otherwise publicly available, “[a]n individual’s interest in controlling the dissemination of information regarding personal matters does not dissolve simply because that information may be available to the public in some form.” Fed. Lab. Rels. Auth., 510 U.S. at 500. The Supreme Court has held that compiling disparate pieces of information about a person into a single dossier, even if the individual pieces of information are publicly available, constitutes a significant invasion of privacy. Reps. Comm. For Freedom of Press, 489 U.S. at 763. In fact, the Supreme Court in Reporters Committee for Freedom of Press noted that there was a “distinction, in terms of personal privacy, between scattered disclosure of the bits of information contained in a rap sheet and revelation of the rap sheet as a whole.” 489 U.S. at 763. The Court underlined that “there is a vast difference between the public records that might be found after a diligent search of courthouse files, county archives, and local police stations throughout the country and a computerized summary located in a single clearinghouse of information.” Id. at 764. Here, too, compiling bits of Plaintiffs’ personal information scattered throughout the internet (and allegedly in non-public sources) into a dossier is a significant invasion of privacy because it is much easier to access that information in one place. Otherwise why would CLEAR subscribers pay to access the dossiers? That some of Plaintiffs’ personal information on the CLEAR dossiers comes from publicly available sources does not diminish the significant harm Plaintiffs suffer from the sale of that compiled information to whomever is willing to pay for it. Thomson Reuters cites Cox Broadcasting Corp. v. Cohn for the proposition that “interests in privacy fade when the information involved appears on the public record.” 420 U.S. 469, 494– 95 (1975). In that case, the Court held that the State of Georgia could not impose civil liability on a journalist for publishing the name of a sexual assault survivor obtained from court records. Id. at 496–97. The central reasoning of Cox Broadcasting was that “[p]ublic records by their very benefit is performed by the reporting of the true contents of the records by the media.” Id. at 495. Here, by contrast, Thomson Reuters is not a journalist performing a “public benefit” by making Plaintiffs’ personal information available to the public. Rather, the company’s dissemination of this information only benefits the private parties who purchase the CLEAR dossiers. All the other cases cited by Thomson Reuters to suggest that there is no privacy right in speech derived from public records are similarly inapposite because they involve journalists disclosing publicly available information to the general public. See e.g., Bartnicki v. Vopper, 532 U.S. 514 (2001) (media defendants broadcasting cellular telephone conversation taped and given to them without the speakers’ consent); The Fla. Star v. B.J.F., 491 U.S. 524 (1989) (newspaper publishing sexual assault survivor’s name from a publicly released police report); Smith v. Daily Mail Pub. Co., 443 U.S. 97 (1979) (newspaper publishing name of minor charged as a juvenile offender); Okla. Publ’g Co. v. Dist. Ct. In & For Okla. Cnty, 430 U.S. 308 (1977) (newspapers publishing name or picture of minor child involved in juvenile proceeding). Moreover, none of these cases involve the compilation and aggregation of information on the scale alleged here. Against this well-pleaded substantial harm to Plaintiffs, Thomson Reuters simply states in conclusory fashion that the utility of its unauthorized sale of Plaintiffs’ personal information is “substantial.” Mot. 17. Without more, the Court has no basis for finding as a matter of law that this sale has any utility, much less that its utility outweighs the gravity of the alleged harm to Plaintiffs. Accordingly, Thomson Reuters’s sale of Plaintiffs’ most private and personal information states a claim under the unfair prong of the UCL. ii. The Tethering Test Under the tethering test—also known as the Cel-Tech test—“the unfairness must ‘be tethered to some legislatively declared policy.’” Lozano, 504 F.3d at 736 (quoting Cel-Tech, 973 P.2d at 544). This test is easily satisfied here because numerous California statutes—including the CCPA—“reflect ‘California’s public policy of protecting consumer data.’” In re Anthem, 162 F. Supp. 3d at 990 (quoting In re Adobe Sys., Inc. Priv. Litig. (“In re Adobe”), 66 F. Supp. 3d 1197, independent and have inalienable rights. Among these [is] . . . obtaining . . . privacy”); Cal. Civ. Code § 1798.1 (“The Legislature declares that . . . all individuals have a right of privacy in information pertaining to them . . The increasing use of computers . . . has greatly magnified the potential risk to individual privacy that can occur from the maintenance of personal information.”); Cal. Civ. Code § 1798.81.5(a) (“It is the intent of the Legislature to ensure that personal information about California residents is protected.”); Cal. Bus. & Prof. Code § 22578 (explaining that the Legislature’s intent was to have a uniform policy state-wide regarding privacy policies on the Internet). Hence, there are ample examples of the California legislature’s intent to protect Plaintiffs’ personal information and consumer data from being disseminated online, such that Thomson Reuters’s sale of this information “is comparable to a violation of law.” In re Adobe, 66 F. Supp. 3d at 1227. Accordingly, the Court concludes that, applying either test, Plaintiffs have plausibly pled a claim that Thomson Reuters’s unauthorized sale of their personal information on the CLEAR platform is an unfair business practice under the UCL. 3. Equitable Relief Finally, Thomson Reuters argues that Plaintiffs are precluded from obtaining equitable relief under the UCL because they “also seek monetary damages” as compensation for their right of publicity and unjust enrichment claims, and therefore have an adequate remedy at law. Mot. at 18. Indeed, the Ninth Circuit recently held in Sonner v. Premier Nutrition Corp. that a plaintiff “must establish that she lacks an adequate remedy at law before securing equitable restitution for past harm under the UCL and CLRA.” 971 F.3d. 834, 884 (9th Cir. 2020) (emphasis added). Even though the Court is dismissing their right of publicity claims under the first cause of action, see supra Part III.A., Plaintiffs’ unjust enrichment claim under the third cause of action survives, see infra Part III.C., and is “an adequate remedy at law” for which Plaintiffs are seeking “equitable relief including restitution and disgorgement of all revenues, earnings, and profits that Thomson Reuters obtained as a result of its unlawful and wrongful conduct.” Compl. ¶ 109. In other words, Plaintiffs seek “the same amount of money for the same harm” in their unjust enrichment and Plaintiffs’ second cause of action for monetary relief under the UCL. Id. ¶¶ 90–104. However, in their fourth cause of action, Plaintiffs are also seeking equitable relief in the form of an injunction under the UCL. Id. ¶¶ 111–118. This Court has explained that “equitable relief can come in different forms—for example, injunctive relief or restitution.” See Julian v. TTE Tech., Inc., No. 20-CV-02857-EMC, 2020 WL 6743912, at *4 (N.D. Cal. Nov. 17, 2020). The holding in Sonner applies only to “equitable restitution for past harm under the UCL,” not to an injunction for future harm. 971 F.3d. at 884 (emphasis added). Therefore, Plaintiffs are not barred from seeking equitable relief in the form of an injunction under the UCL. Admittedly, one court in this district and several courts in California have applied Sonner to injunctive relief claims under the UCL, typically in cases where monetary damages can compensate for the harm suffered, such as overpayment for defective or falsely advertised products. See, e.g., Zaback v. Kellogg Sales Co., No. 3:20-cv-00268-BEN-MSB, 2020 WL 6381987, *4 (S.D. Cal. Oct. 29, 2020) (dismissing a UCL claim for injunctive relief because the plaintiff failed to allege that there was no adequate remedy at law); In re MacBook Keyboard Litig., No. 5:18-cv-02813-EJD, 2020 WL 6047253, at *2-3 (N.D. Cal. Oct. 13, 2020) (“Courts generally hold that monetary damages are an adequate remedy for claims based on an alleged product defect, and reject the argument that injunctive relief requiring repair or replacement is appropriate.”); Gibson v. Jaguar Land Rover N. Am., LLC, No. CV 20-00769 CJC (GJSx), 2020 WL 5492990, at *3-4 (C.D. Cal. Sept. 9, 2020) (dismissing UCL claims for injunction and restitution based on Sonner); Teresa Adams v. Cole Haan, LLC, No. Sacv 20-913 JVS (DFMx), 2020 WL 5648605, at *2 (C.D. Cal. Sept. 3, 2020) (finding, under the reasoning of Sonner, that there is no “exception for injunctions as opposed to other forms of equitable relief”); Schertz v. Ford Motor Co., No. CV 20-03221 TJH (PVCx), 2020 WL 5919731, at *2 (C.D. Cal. July 27, 2020) (dismissing UCL claims for injunction and restitution where the plaintiff failed to allege that there was no adequate remedy at law). More recently, however, other courts have declined to apply Sonner to bar UCL claims for injunctive relief, recognizing that the prospect of paying damages is sometimes insufficient to See Zeiger v. WellPet LLC, No. 3:17-CV-04056-WHO, 2021 WL 756109, at *21 (N.D. Cal. Feb. 26, 2021) (“Assuming that Sonner applies to injunctive relief, Zeiger has shown that monetary damages for past harm are an inadequate remedy for . . . future harm. . . . Damages would compensate Zeiger for his past purchases. An injunction would ensure that he (and other consumers) can rely on WellPet’s representations in the future.”); Andino v. Apple, Inc., No. 2:20- CV-01628-JAM-AC, 2021 WL 1549667, at *5 (E.D. Cal. Apr. 20, 2021) (“Sonner does not warrant dismissal of [the plaintiff’s] request for injunctive relief. Money damages are an inadequate remedy for future harm, as they will not prevent Defendant from continuing the allegedly deceptive practice.”). Without an injunction, as in Zeiger and Andino, there is no way the Court can ensure that Thomson Reuters will stop selling Plaintiffs’ personal information without their consent. Damages for past sales are not likely to dissuade Thomson Reuters from continuing this behavior in the future. More importantly, the instant case is fundamentally different from typical UCL cases involving defective products or false advertising because the injury here is an invasion of privacy that can never be fully remedied through damages. See Meyer v. Portfolio Recovery Assocs., LLC, 707 F.3d 1036, 1045 (9th Cir. 2012) (violation of privacy is “irreparable harm”); Ne. Fla. Chapter of Ass’n of Gen. Contractors of Am. v. City of Jacksonville, 896 F.2d 1283, 1285 (11th Cir. 1990) (“[I]nvasions of privacy, because of their intangible nature, could not be compensated for by monetary damages[.]”); Maxcrest Ltd. v. United States, No. 15-MC-80270-JST, 2016 WL 6599463, at *4 (N.D. Cal. Nov. 7, 2016) (“[A]ny harm to Maxcrest’s privacy interests would be irreparable because ‘there is nothing a court can do to withdraw all knowledge or information that IRS agents may have acquired by examination of the [the requested information]’ once that information has already been divulged.” (quoting Church of Scientology of Cal. v. United States, 506 U.S. 9, 13 (1992))). Even if Plaintiffs could obtain damages the unauthorized sale of their personal information to third parties, that amount will not compensate them adequately for the irreparable loss of their privacy. Accordingly, the Court concludes that Plaintiffs can seek equitable relief in the form of an C. Unjust Enrichment Claim The Court rejects Thomson Reuters’s argument that unjust enrichment is not a standalone cause of action and thus cannot be asserted, because that argument is based on outdated law. Mot. at 18 (citing Low v. LinkedIn Corp., 900 F. Supp. 2d 1010, 1031 (N.D. Cal. 2012)). The Ninth Circuit has allowed a claim for unjust enrichment “as an independent cause of action or a quasi- contract claim for restitution.” ESG Capital Partners, LP v. Stratos, 828 F.3d 1023, 1038 (9th Cir. 2016). In doing so, the court recognized that “[s]ome California courts allow a plaintiff to state a cause of action for unjust enrichment, while others have maintained that California has no such cause of action.” Id. More recently, albeit in an unpublished order, the Ninth Circuit explained that “California’s case law on whether unjust enrichment could be sustained as a standalone cause of action was uncertain and inconsistent. But [in 2015], the California Supreme Court . . . clarified California law, allowing an independent claim for unjust enrichment to proceed in an insurance dispute.” Bruton v. Gerber Prod. Co., 703 F. App’x 468, 470 (9th Cir. 2017). Indeed, the California Supreme Court held in Hartford Casualty Insurance Co. v. J.R. Marketing, L.L.C. that an insurer could bring a standalone unjust enrichment claim against its insured’s legal counsel for “‘padd[ing]’ their bills by charging fees that were, in part, excessive, unreasonable, and unnecessary.” 353 P.3d 319, 322 (Cal. 2015). District courts in the Ninth Circuit have since routinely recognized standalone unjust enrichment claims. See e.g., Hart v. TWC Prod. & Tech. LLC, No. 20-CV-03842-JST, 2021 WL 1032354, at *8 (N.D. Cal. Mar. 17, 2021) (“Even though the Court earlier concluded that Hart ‘suffered no economic loss from the disclosure of [his] information, [he] may proceed at this stage on a claim for unjust enrichment to recover the gains that [TWC] realized from its allegedly improper conduct.’” (quoting In re Facebook, 402 F. Supp. 3d at 893)); Wu v. Sunrider Corp., No. CV 17-4825 DSF (SSX), 2017 WL 6880087, at *4 (C.D. Cal. Oct. 10, 2017) (“Defendants rely on outdated precedent. As the Ninth Circuit noted, the California Supreme Court has recently clarified that unjust enrichment may be sustained as a stand-alone cause of action.”). Bruton is persuasive precedent, this Court concludes that Plaintiffs can raise a standalone unjust enrichment claim. D. The Communications Decency Act The Communications Decency Act of 1996 (CDA), 47 U.S.C. § 230, provides, in relevant part, (1) Treatment of publisher or speaker No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider. (2) Civil liability No provider or user of an interactive computer service shall be held liable on account of—

(A) any action voluntarily taken in good faith to restrict access to or availability of material that the provider or user considers to be obscene, lewd, lascivious, filthy, excessively violent, harassing, or otherwise objectionable, whether or not such material is constitutionally protected. 47 U.S.C. § 230(c). Thus, the CDA immunizes providers of an “interactive computer service”6 (i.e. Facebook, Twitter, LinkedIn, etc.) from liability for content independently created or developed by third-party “information content providers”7 (i.e., users), unless the interactive computer service created or developed part of that content. Accordingly, “any activity that can be boiled down to deciding whether to exclude material that third parties seek to post online is perforce immune under section 230.” Fair Housing Council of San Fernando Valley v. Roommates.com, LLC, 521 F.3d 1157, 1170–71 (9th Cir.2008) (en banc). The CDA allows websites like Facebook or Twitter to take down objectionable content posted by their users without becoming liable either for the content they do not take down, 47 U.S.C. § 230(c)(1), or for taking down content in good faith, id. § 230(c)(2)(A). 6 An “interactive computer service” is defined as “any information service, system, or access software provider that provides or enables computer access by multiple users to a computer server, including specifically a service or system that provides access to the Internet and such systems operated or services offered by libraries or educational institutions.” Id. § 230(f)(2).

7 An “information content provider” is defined as “any person or entity that is responsible, in The Court is not persuaded by Thomson Reuters’s contention that the CDA immunizes it from civil liability stemming from the unauthorized sale of Plaintiffs’ personal information. Mot. at 19–23. In the Ninth Circuit, §230(c)(1) only immunizes “(1) a provider or user of an interactive computer service (2) whom a plaintiff seeks to treat, under a state law cause of action, as a publisher or speaker (3) of information provided by another information content provider.” HomeAway.com, Inc. v. City of Santa Monica, 918 F.3d 676, 681 (9th Cir. 2019) (quoting Barnes v. Yahoo!, Inc., 570 F.3d 1096, 1100–01 (9th Cir. 2009)). Thomson Reuters fails to meet the second and third requirements of this test. First, the Ninth Circuit has been very clear that a plaintiff seeks to treat an interactive computer service as a “publisher or speaker” under § 230(c)(1) only when it is asking that service to “review[], edit[], and decid[e] whether to publish or withdraw from publication third-party content.” Id. (quoting Barnes, 570 F.3d at 1102). Here, Plaintiffs are not seeking to hold Thomson Reuters liable “as the publisher or speaker” because they are not asking it to monitor third-party content; they are asking to moderate its own content. Second, and relatedly, the “information” at issue here—the dossiers with Plaintiffs’ personal information—is not “provided by another information content provider.” 47 U.S.C. § 230(c)(1). In Roomates.com, the panel explained that § 230 was passed by Congress to “immunize[] providers of interactive computer services against liability arising from content created by third parties.” 521 F.3d at 1162 (emphasis added). The whole point was to allow those providers to “perform some editing on user-generated content without thereby becoming liable for all defamatory or otherwise unlawful messages that they didn’t edit or delete. In other words, Congress sought to immunize the removal of user-generated content, not the creation of content.” Id. at 1163 (emphases added). Here, there is no user-generated content—Thomson Reuters generates all the dossiers with Plaintiffs’ personal information that is posted on the CLEAR platform. See Compl. ⁋⁋ 1–3. In other words, Thomson Reuter is the “information content provider” of the CLEAR dossiers because it is “responsible, in whole or in part, for the creation or development of” those dossiers. 47 U.S.C. § 230(f)(3). It is nothing like the paradigm Furthermore, the Ninth Circuit has repeatedly rejected arguments like Thomson Reuters’s contention that its dossiers are covered by § 230(c)(1) because it creates those dossiers from data contained in third-party content. See, e.g., Doe v. Internet Brands, 824 F.3d 846, 852–53 (“We have already held that the CDA does not declare ‘a general immunity from liability deriving from third-party content.’” (quoting Barnes, 570 F.3d at 1100)); Roommates.com, 521 F.3d at 1171 (“Providing immunity every time a website uses data initially obtained from third parties would eviscerate the exception to section 230 for ‘develop[ing]’ unlawful content ‘in whole or in part.’” (quoting 47 U.S.C. § 230(f))). Section 230 is therefore inapplicable. E. California’s Anti-SLAPP Statute Section 425.16 of the California Civil Code, also known as California’s Strategic Lawsuit Against Public Participation (“anti-SLAPP”) statute, provides

[a] cause of action against a person arising from any act of that person in furtherance of the person’s right of petition or free speech under the United States Constitution or the California Constitution in connection with a public issue shall be subject to a special motion to strike, unless the court determines that the plaintiff has established that there is a probability that the plaintiff will prevail on the claim. Cal. Civ. Proc. Code § 425.16(b)(1). To adjudicate an anti-SLAPP claim, the Court must apply a two-step burden-shifting test. At step one, the defendant must show that the plaintiff’s action arises from “an act in furtherance of the person’s right of petition or free speech.” Id. If the defendant satisfies step one, “the burden then shifts to the Plaintiff . . . to establish a reasonable probability that it will prevail on its claim in order for the claim to survive dismissal.” Makaeff v. Trump Univ., LLC, 715 F.3d 254, 261 (9th Cir. 2013). Thomson Reuters’s anti-SLAPP motion fails at step one. To satisfy its burden at step one, Thomson Reuters must establish that the basis of this lawsuit is one of the following acts in furtherance of its right of free speech:

(1) any written or oral statement or writing made before a legislative, executive, or judicial proceeding, or any other official proceeding authorized by law, an issue under consideration or review by a legislative, executive, or judicial body, or any other official proceeding authorized by law,

(3) any written or oral statement or writing made in a place open to the public or a public forum in connection with an issue of public interest, or

(4) any other conduct in furtherance of the exercise of the constitutional right of petition or the constitutional right of free speech in connection with a public issue or an issue of public interest. Cal. Civ. Proc. Code § 425.16(e). According to Thomson Reuters, Plaintiffs’ claims arise from its right of free speech pursuant to section 425.16(e)(3) because its unauthorized sale of Plaintiffs’ personal information (1) involves “a public forum,” i.e., the CLEAR platform; and (2) is “in connection with an issue of public interest” pursuant to section 425.16(e)(3). Mot. at 23–24. First, the CLEAR platform is arguably not a “public forum” because only “[w]eb sites accessible to the public, . . . are ‘public forums’ for purposes of the anti-SLAPP statute.” Barrett v. Rosenthal, 146 P.3d 510, 514 n.4 (Cal. 2006) (emphasis added); see also Huntingdon Life Scis., Inc. v. Stop Huntingdon Animal Cruelty USA, Inc., 129 Cal. Rptr. 3d 521, 536 (Ct. App. 2005) (website is accessible to the public because it is “accessible to anyone who chooses to visit the site”). CLEAR is not accessible to “anyone who chooses to visit the site;” it requires payment. On the other hand, anyone who pays for the service can presumably have access to it, much like anyone who pays cover to enter a bar or a ticket to see a theater show would have access to enter those public fora. Therefore, it is unclear whether the CLEAR platform is a public forum or not. However, even if the CLEAR platform is a public forum, Thomson Reuters fails to explain how the dossiers it posts on the CLEAR platform are “in connection with an issue of public interest.” Cal. Civ. Proc. Code § 425.16(e)(3). It merely extolls, in conclusory fashion, that “Plaintiffs’ claims arise from conduct in connection with an issue of public interest because Thomson Reuters’ CLEAR platform provides access to current and historical factual information.” Mot. at 24. These conclusory allegations are insufficient to satisfy Thomson Reuters’s burden at step one because the unauthorized sale of people’s most personal and private information is not a matter of public interest, particularly when the information pertains to any individual regardless of The Supreme Court has long explained that “not all speech is of equal First Amendment importance. It is speech on ‘matters of public concern’ that is ‘at the heart of the First Amendment protection.’” Dun & Bradstreet, Inc. v. Greenmoss Builders, Inc., 472 U.S. 749, 758–59 (1985) (quoting First Nat. Bank of Boston v. Bellotti, 435 U.S. 765, 776 (1978)). Conversely, “speech on matters of purely private concern is of less First Amendment concern” because “[t]here is no threat to the free and robust debate of public issues; there is no potential interference with a meaningful dialogue of ideas concerning self-government; and there is no threat of liability causing a reaction of self-censorship by the press.” Id. at 759–60 (quoting Connick v. Myers, 461 U.S. 138, 145 (1983)); Snyder v. Phelps, 562 U.S. 443, 452 (2011) (“[N]ot all speech is of equal First Amendment importance, . . . and where matters of purely private significance are at issue, First Amendment protections are often less rigorous.”) (quoting Hustler Mag., Inc. v. Falwell, 485 U.S. 46, 56 (1988)). More recently, the Court explained in Snyder that courts are to look at “content, form, and context” to determine if speech is of public concern. 562 U.S. at 453. As to “content,” the Court explained that “[s]peech deals with matters of public concern when it can ‘be fairly considered as relating to any matter of political, social, or other concern to the community,’ or when it ‘is a subject of legitimate news interest; that is, a subject of general interest and of value and concern to the public.’” Id. (first quoting Connick, 461 U.S. at 156; then quoting City of San Diego v. Roe, 543 U.S. 77, 83–84 (2004)). Speech of private concern—like Plaintiffs’ personal and private information—does not “seek to communicate to the public or to advance a political or social point of view.” Borough of Duryea v. Guarnieri, 564 U.S. 379, 398 (2011). The public does not have a particular cognizable interest in the “speech” at issue here—the dissemination of Plaintiffs’ personal information—because that information is purely a matter of private concern, does not relate to any matter of “political” or “social” concern, and does they seek to communicate a political or social point of view. To the contrary, like the credit report at issue in Dun & Bradstreet, CLEAR dossiers with Plaintiffs’ personal information “concern[] no public issue” because “[they are] speech solely in the individual interest of the speaker [i.e. Thomson Whitepages Inc., No. 19 C 4871, 2020 WL 6287369, at *6 (N.D. Ill. Oct. 27, 2020) (“[B]ackground reports are properly characterized as private concern, not public concern, speech.”). Also, that Thomson Reuters only shares Plaintiffs’ personal information with its CLEAR subscribers who specifically pay for it, and not with the general public, cuts heavily against concluding that Thomson Reuters’s conduct is of public concern. Dun & Bradstreet, 472 U.S. at 762 (“[S]ince the credit report was made available to only five subscribers, who, under the terms of the subscription agreement, could not disseminate it further, it cannot be said that the report involves any ‘strong interest in the free flow of commercial information.’” (quoting Va. Pharmacy Bd. v. Va. Citizens Consumer Council, Inc., 425 U.S. 748, 764 (1976))); Cf. IMDb.com Inc. v. Becerra, 962 F.3d 1111, 1124–25 (9th Cir. 2020) (“[T]he ‘speech’ at issue—the sale of data—was itself an inherently private exchange between private parties. Here, in contrast, IMDb posts the information on its website free of charge for the public to review. This fact alone imparts an inherently public character to the speech at issue.”). If anything, as the District of Columbia Circuit correctly pointed out in Trans Union Corp. v. FTC, the “speech” at issue here is less of the public’s concern than the credit report in Dunn & Bradstreet because it involves the personal information “of private individuals, not incorporated businesses like the respondent in Dun & Bradstreet.” 267 F.3d 1138, 1140 (D.C. Cir. 2001) (“[T]he particular information at issue in this case—people’s names, addresses, and financial circumstances—is less public than the same information about companies whose articles of incorporation and financial statements are generally available for inspection.”). The Court therefore concludes that Thomson Reuters’s private and unauthorized sale of Plaintiffs’ personal information is “an inherently private exchange between private parties,” not a matter of public concern. IMDb.com Inc., 962 F.3d at 1124–25. Thomson Reuters’s attempt to characterize its unauthorized sale of Plaintiffs’ personal information on the CLEAR platform as “[t]he dissemination of news and information about current and historical events” is unpersuasive. Mot. at 10. The complaint alleges only that Thomson Reuters “aggregates both public and non-public information about millions of people” into “dossiers on each person” that it then sells to its customers via the CLEAR platform. Compl. context, commentary, opinion, or in any way editorializes this information.8 More importantly, it does not use this information in “reporting about public events,” Downing, 265 F.3d at 1001 (quoting Eastwood, 198 Cal. Rptr. at 350), or “in connection with any news, public affairs, or sports broadcast or account, or any political campaign,” Cal Civ. Code § 3344(d). See also Lukis, 2020 WL 6287369, at *6 (“The background reports do not relate to ‘political’ or ‘social’ issues; rather, they list information like phone numbers, current and past addresses, and possible relatives.”); Fraley, 830 F. Supp. at 805 (“Because Facebook’s publication of Plaintiffs’ ‘Likes’ is alleged to be for commercial advertising purposes and not part of ‘any news, public affairs, or sports broadcast or account, or any political campaign,’ the Court does not find it appropriate to dismiss the claim under the newsworthiness exception provided in § 3344(d)”). In other words, the sale of Plaintiffs’ personal information cannot be fairly characterized as journalistic. It is hard to conceive how the public has any interest—let alone a compelling interest protected by the First Amendment—in the raw personal information of every California resident, especially where it is not connected to a matter of public interest. Thomson Reuters also contends that the public has a strong interest in the named Plaintiffs’ personal information because they “are in the public eye due to their role as activists, actors, and journalists.” Mot. at 15 (citing Compl. ⁋⁋ 41, 50). The problem with this argument is that most of the Plaintiffs in the proposed class will not be famous or notorious people who “create a legitimate and widespread attention to their activities” because they are in the public eye. Downing, 265 F.3d at 1001 (quoting Eastwood, 198 Cal. Rptr. at 350). Accordingly, because Thomson Reuters’s anti-SLAPP motion does not make it past step one, the Court need not consider whether it satisfies step two. Moreover, even if Thomson Reuters had satisfied its burden at step one, Plaintiffs have, for the reasons discussed above in parts III.B through III.C, c met their burden of showing that they have a reasonable probability of 8 According to Thomson Reuters, it provides “opinion” about consumers in the form of “risk scores” where it purports to measure the riskiness of extending credit to a consumer. Mot. at 12. But Plaintiffs do not challenge the risk scores themselves, only Thomson Reuters’s sale of their personal information. Even if the First Amendment gave Thomson Reuters a right to sell its risk succeeding on their UCL and unjust enrichment claims.9 See Planned Parenthood Fed’n of Am., Inc. v. Ctr. for Med. Progress, 890 F.3d 828, 834 (9th Cir.), amended, 897 F.3d 1224 (9th Cir. 2018) (“[W]hen an anti-SLAPP motion to strike challenges only the legal sufficiency of a claim, a district court should apply the Federal Rule of Civil Procedure 12(b)(6) standard and consider whether a claim is properly stated.”). For the foregoing reasons, the Court GRANTS in part and DENIES in part Thomson Reuters’s motion to dismiss. The Court also DENIES as moot Thomson Reuter’s motion to stay discovery pending resolution of the instant motion. This order disposes of Docket Nos. 28 and 37. Dated: August 16, 2021 ______________________________________ EDWARD M. CHEN United States District Judge

9 Because Thomson Reuters’s anti-SLAPP motion is meritless, the Court does not reach Plaintiffs’