D'Angelo v. Penney OpCo, LLC

• Court: District Court, S.D. California
• Decided: October 24, 2023
• Docket: 3:23-cv-00981
• Status: Unknown

Opinion

1 2 3 4 5 6 7 8 UNITED STATES DISTRICT COURT 9 SOUTHERN DISTRICT OF CALIFORNIA 10 11 NOELLE D’ANGELO and ANTHONY Case No. 23-cv-0981-BAS-DDL D’ANGELO, individually and on behalf of 12 all others similarly situated, ORDER GRANTING IN PART AND 13 DENYING IN PART DEFENDANT’S Plaintiffs, MOTION TO DISMISS (ECF No. 9) 14 v. 15 PENNY OPCO, LLC, d/b/a JCPENNEY, 16 Defendant. 17

18 19 This action is one in a series of consumer privacy actions sweeping California as 20 advocates attempt to crack down on consumer privacy issues brought on by today’s 21 digital age. Plaintiffs Noelle D’Angelo and Anthony D’Angelo (collectively, 22 “Plaintiffs”) commenced this lawsuit against Penney OpCo, LLC (“JC Penney” or 23 “Defendant”) pursuant to California statutory and common-law privacy claims. Plaintiffs 24 allege, on behalf of themselves and a putative class, that Defendant violated state law by 25 permitting at least one third party, Vergic, to intercept and analyze Plaintiffs’ and class 26 members’ online chats with Defendant’s customer service representatives via the 27 Defendant’s website. 28 1 Plaintiffs’ suit brings claims against Defendant for violations of Sections 631(a) 2 and 632.7 of the California Invasion of Privacy Act (“CIPA”), Cal. Penal Code §§ 630– 3 38, California’s Unfair Competition Law (“UCL”), Cal. Bus. & Prof. Code § 17200 et 4 seq., and the California Constitution, Cal. Const. art. I, § 1. 5 Presently before the Court is Defendant’s motion to dismiss Plaintiffs’ Complaint. 6 (Mot., ECF No. 9.) Defendant bases its motion on Plaintiffs’ lack of standing and failure 7 to state a claim. (Id.) JC Penney argues that Plaintiffs do not allege an injury sufficient 8 to show standing and do not plausibly allege a claim upon which relief may be granted. 9 (Id.) Plaintiffs oppose. (Resp., ECF No. 11.) 10 The Court finds this motion suitable for determination on the papers submitted and 11 without oral argument. See Fed. R. Civ. P. 78(b); Civ. L.R. 7.1(d)(1). For the reasons 12 that follow, the Court GRANTS IN PART and DENIES IN PART Defendant’s motion 13 to dismiss for lack of standing and failure to state a claim. 14 I. BACKGROUND1 15 JC Penney, a Texas-based retailer, owns and operates www.JCPenney.com (the 16 “Website”), on which it sells products. (Compl., ECF No. 1, at 1:5.) Embedded in the 17 code of the Website is a code written by third-party Vergic, which “automatically records 18 and creates transcripts of all” conversations users have on Defendant’s Website chat 19 feature. (Compl., ECF No. 1, ¶12.) 20 Allegedly, this code “directs [chat] communications to be routed directly to 21 Vergic” because “Vergic’s chat service is an Application Programming Interface . . . that 22 is ‘plugged into’ the Website.” (Compl., ECF No. 1, ¶13.) Even though “the chat 23 function is run from Vergic’s servers [it] allows for chat functionality on the Website. In 24 other words, Vergic runs the chat service from its own servers, but consumers interact 25

26 1 The facts are taken from Plaintiffs’ Complaint (ECF No. 1), to which the presumption of truth attaches for the instant Motion. See, e.g., Manzarek v. St. Paul Fire & Marine Ins. Co., 519 F.3d 1025, 1031 (9th 27 Cir. 2008) (holding that in evaluating a complaint on a motion to dismiss, the court “accept[s] factual allegations in the complaint as true and construe[s] the pleadings in the light most favorable to the 28 1 with the chat service on Defendant’s Website, so it appears they are only communicating 2 with a company representative of Defendant.” (Compl., ECF No. 1, ¶ 13.) 3 Therefore, when chatting with a Defendant customer service representative via the 4 Website chat feature, each message sent by a user “is first routed through Vergic’s 5 server” where Vergic may “analyze, interpret, and collect customer-support agent 6 interactions in real time to create live transcripts of communications as they occur.” 7 (Compl., ECF No. 1, ¶ 14.) Vergic “analyze[s], interpret[s], and collect[s] customer- 8 support agent interactions,” (Id.), using the data to “enable [businesses and public 9 organizations] to proactively and in realtime [sic] create valuable connections with their 10 online visitors through personalized and relevant dialogues which boosts online sales, 11 reduces service costs, increases customer satisfaction and exceeds the customer’s 12 expectations,” (Id. ¶ 17). 13 At some point during the statute of limitations period, Plaintiffs, who are residents 14 and citizens of California (Compl., ECF No. 1, ¶ 4), visited the Website (Id. ¶ 23). 15 Allegedly, they did so using “smart phones . . . and/or wifi-enabled tablets and laptops.” 16 (Id.) In visiting the Website, Plaintiffs allege they “engaged with the ‘chat’ feature . . . to 17 communicate with Defendant.” (Id.) Plaintiffs do not share the nature or content of their 18 messages on the chat feature; yet, they allege that “[g]iven the nature of Defendant’s 19 business, visitors often share highly sensitive personal data with Defendant via the 20 Website’s chat feature.” (Id. ¶ 21.) 21 Users of the Website chat feature, such as Plaintiffs, are not aware of Defendant’s 22 practice of routing all chats through Vergic. This is because Defendant does not disclose 23 Vergic’s, or any other third party’s, listening in on or recording of communications users 24 have with Defendant’s customer service representatives via the Website chat feature. (Id. 25 ¶¶ 15, 25–27.) Moreover, users do not have the opportunity to, nor did Plaintiffs in this 26 case, expressly consent to this practice. (Id. ¶¶ 15, 28, 47.) 27 28 1 II. LEGAL STANDARDS 2 A. Standing 3 To bring a case in federal court, Plaintiffs must show they have standing. This 4 requirement ensures the court is hearing an actual case or controversy, as required by 5 Article III of the United States Constitution. Spokeo, Inc. v. Robins, 578 U.S. 330, 337– 6 38 (2016). In a putative class action at the motion-to-dismiss phase, such as in the instant 7 case, the court examines the standing of the putative class representatives. Id. at 338 n.6. 8 To successfully plead standing, Plaintiffs must show a number of things, In re 9 Zappos.com, Inc., 888 F.3d 1020, 1024 (9th Cir. 2018), but only one is at issue here: 10 whether Plaintiffs have suffered an injury in fact. To allege an injury in fact, the injury 11 must be “an invasion of a legally protected interest which is (a) concrete and 12 particularized, . . . and (b) actual or imminent, not conjectural or hypothetical.” Lujan v. 13 Defs. of Wildlife, 504 U.S. 555, 560 (1992) (citations omitted). “The most obvious 14 [concrete injuries] are traditional tangible harms, such as physical harms and monetary 15 harms.” TransUnion LLC v. Ramirez, 141 S. Ct. 2190, 2204 (2021). Violation of the 16 right to privacy serves as one of these traditional tangible harms because it has “long 17 been actionable at common law.” Eichenberger v. ESPN, 876 F.3d 979, 983 (9th Cir. 18 2017). 19 B. Rule 12(b)(6) Motion to Dismiss 20 Pursuant to Rule 12(b)(6), a defendant may move to dismiss an action for failure to 21 allege sufficient factual allegations to “state a claim to relief that is plausible on its face.” 22 Bell Atlantic v. Twombly, 550 U.S. 544, 570 (2007) (citations omitted). In evaluating the 23 sufficiency of these factual allegations, the court “accept[s] factual allegations in the 24 complaint as true and construe[s] the pleadings in the light most favorable to the 25 nonmoving party.” Manzarek v. St. Paul Fire & Marine Ins. Co., 519 F.3d 1025, 1031 26 (9th Cir. 2008). 27 However, the court is not required to “assume the truth of legal conclusions merely 28 because they are cast in the form of factual allegations.” Fayer v. Vaughn, 649 F.3d 1 1061, 1064 (9th Cir. 2011) (citations omitted). Mere “conclusory allegations of law and 2 unwarranted inferences are insufficient to defeat a motion to dismiss.” Adams v. 3 Johnson, 355 F.3d 1179, 1183 (9th Cir. 2004) (internal citations omitted); accord 4 Ashcroft v. Iqbal, 556 U.S. 662, 663–64 (2009). 5 III. ANALYSIS 6 A. Standing 7 In evaluating the pleadings at the motion-to-dismiss stage to determine whether a 8 plaintiff has alleged an injury sufficient to confer standing, the court must first determine 9 if the attack on standing is a facial or a factual one. See Safe Air for Everyone v. Meyer, 10 373 F.3d 1035, 1039 (9th Cir. 2004). Here, Defendant has raised a facial attack because 11 it “asserts that the allegations contained in [the] complaint are insufficient on their face to 12 invoke federal jurisdiction” as opposed to disputing “the truth of the allegations 13 themselves.” Id. In a facial attack, the court applies the same analysis as for a motion to 14 dismiss under Rule 12(b)(6): “Accepting the plaintiff’s allegations as true and drawing all 15 reasonable inferences in the plaintiff’s favor, the court determines whether the allegations 16 are sufficient as a legal matter to invoke the court’s jurisdiction.” Leite v. Crane Co., 749 17 F.3d 1117, 1121 (9th Cir. 2014) (citations omitted). 18 For three of the four claims, Plaintiffs assert one type of harm: invasion of privacy. 19 For this, they seek three types of remedy: declarative relief, injunctive relief, and 20 damages. Claim Three, brought under the UCL, contains its own standing requirements, 21 which the Court addresses below. 22 1. Nature of the Harm: Invasion of Privacy 23 Plaintiffs root their standing in a harm to privacy. Defendant responds that 24 Plaintiffs’ harm is not sufficiently concrete to confer standing because Plaintiffs “do not 25 allege that they suffered any harm as a result of the alleged recording; do not allege that 26 they disclosed any sensitive information to JC Penney; or identify any specific personal 27 information they disclosed.” (Mot., ECF No. 9, at 5:23–28.) Therefore, the Court 28 1 addresses whether the alleged invasion of privacy is a sufficiently concrete harm that may 2 confer standing under Article III. 3 Certain torts, like the “disclosure of private information,” result in “intangible” but 4 concrete harms. Transunion, 141 S. Ct. at 2204. However, standing for privacy rights 5 may vary depending on whether the statute at issue codifies substantive or procedural 6 privacy rights. Where a statute codifies procedural rights, their violation “would not 7 invariably injure a concrete interest.” Eichenberger, 876 F.3d at 982 (citing Robins v. 8 Spokeo, Inc., 867 F.3d 1108, 1114 (9th Cir. 2017)). In contrast, violation of a statute that 9 codifies a “substantive right to privacy” constitutes a concrete harm. See 876 F.3d at 983. 10 In such a case, the violation of the statue itself makes a defendant liable. Id. 11 To determine whether a statute codifies a substantive or procedural right to 12 privacy, and thus whether an injury is sufficiently concrete, courts are “guided in 13 determining concreteness by both history and the judgment of Congress, or the legislature 14 that enacted the statute.” Campbell v. Facebook, Inc., 951 F.3d 1106, 1116 (9th Cir. 15 2020) (citations omitted). The Ninth Circuit has found that CIPA and the California 16 Constitution’s right to privacy codify substantive rights to privacy. In re Facebook, Inc. 17 Internet Tracking Litig., 956 F.3d 589, 598 (9th Cir. 2020); Campbell, 951 F.3d at 1117– 18 18. Therefore, Plaintiffs have Article III standing for Claims One, Two, and Four if they 19 sufficiently allege Defendant violated CIPA and the California Constitution’s right to 20 privacy. 21 2. Nature of the Remedy 22 Having found Plaintiffs allege a concrete injury, the Court examines if they also 23 plead sufficient facts for relief. 24 Declarative and Injunctive Relief. Plaintiffs seek injunctive relief, specifically, an 25 order “enjoining Defendant’s conduct as alleged herein.” (Compl. at 15:4.) Plaintiffs 26 also seek declarative relief. (Id. at 15:1.) To establish standing for prospective injunctive 27 relief, a plaintiff must demonstrate “continuing, present adverse effects.” City of Los 28 Angeles v. Lyons, 461 U.S. 95, 102 (1983) (citations omitted). Similarly, to establish 1 standing for declarative relief, “Plaintiff must establish an ongoing or future injury that is 2 certainly impending.” Ctr. for Biological Diversity v. Bernhardt, 442 F. Supp. 3d 97, 111 3 (D.D.C. 2020) (citations omitted), aff’d sub nom. Ctr. for Biological Diversity v. 4 Haaland, 849 F. App’x 2 (D.C. Cir. 2021). To show these “continuing, present adverse 5 effects,” a plaintiff must show that he “‘has sustained or is immediately in danger of 6 sustaining some direct injury’ as the result of the challenged official conduct and the 7 injury or threat of injury must be both ‘real and immediate,’ not ‘conjectural’ or 8 ‘hypothetical.’” Lyons, 461 U.S. at 101–02 (citations omitted). 9 While Plaintiffs sufficiently allege past injury (which entitles them to damages), 10 they do not allege a real and immediate threat of future injury, nor an ongoing injury, so 11 as to make a case for declaratory and injunctive relief. Plaintiffs do not allege they intend 12 to continue to use the Website and thus, as in Lujan, there is no threat of imminent future 13 injury. Compare Lujan, 504 U.S. at 564 (holding that, without alleging concrete plans to 14 visit an area endangered by the challenged policy, the plaintiffs did not successfully 15 allege an imminent injury) with (Compl., ECF No. 1 (including no allegation that 16 Plaintiffs have plans to use the JC Penney Website chat feature in the future).) Therefore, 17 Plaintiffs do not sufficiently allege standing for declaratory and injunctive relief. 18 Damages. The California legislature has created statutory damages for each 19 violation of CIPA, with “no separate showing of injury aside from a violation of the 20 privacy rights protected by CIPA” required. Ades v. Omni Hotels Mgmt. Corp., 46 F. 21 Supp. 3d 999, 1018 (C.D. Cal. 2014). Therefore, if Plaintiffs plausibly allege at this stage 22 that Defendant has violated provisions of CIPA, Plaintiffs plausibly allege standing for 23 damages. 24 Similarly, a court may award damages for violation of the California Constitution, 25 Article I, Section 1. See Sanchez-Scott v. Alza Pharms., 103 Cal. Rptr. 2d 410, 417 (Cal. 26 Ct. App. 2001). Therefore, if Plaintiffs plausibly allege Defendant violated the California 27 Constitution, they plausibly allege standing for damages for that violation. 28 1 3. Standing under the UCL 2 Standing under the UCL is “substantially narrower than federal standing under 3 Article III, Section 2 of the United States Constitution, which may be predicated on a 4 broader range of injuries.” Kwikset Corp. v. Superior Ct., 51 Cal. 4th 310, 324 (Cal. 5 2011). Section 17204 of California’s UCL grants standing to bring suits under the UCL 6 by “a person who has suffered injury in fact and has lost money or property as a result of 7 the unfair competition.” Cal. Bus. & Prof. Code § 17204. A UCL plaintiff must “(1) 8 establish a loss or deprivation of money or property sufficient to qualify as injury in fact, 9 i.e., economic injury, and (2) show that economic injury was the result of, i.e., caused by, 10 the unfair business practice or false advertising that is the gravamen of the claim.” 11 Kwikset, 246 P.3d at 885. 12 In In re Facebook, Inc. Internet Tracking Litigation, the Ninth Circuit held that the 13 plaintiffs had sufficiently alleged users’ browsing histories carried financial value and 14 thus users were entitled to Facebook’s profits from users’ personal data. 956 F.3d 589, 15 600–01 (9th Cir. 2020). In that case, the plaintiffs pointed to “the existence of a study 16 that values users’ browsing histories at $52 per year, as well as research panels that pay 17 participants for access to their browsing histories” to support their claims of economic 18 injury. Id. at 600. 19 Here, Plaintiffs do not include similarly sufficient factual allegations in their 20 Complaint. Plaintiffs do not sufficiently allege that they lost money or property as a 21 result of Defendant’s unfair competition, as required under the UCL. See Cal. Bus. & 22 Prof. Code § 17204. Plaintiffs argue that the “economic value” of their harvested data is 23 “inherent in the fact that they allege that Defendant and Vergic harvested and 24 ‘exploit[ed]’ their data ‘for financial gain.’” (Resp., ECF No. 11, at 22:5–7 (citing to the 25 Complaint).) Contrary to Plaintiffs’ arguments, the economic value of their customer 26 service chat transcripts is not inherent upon the facts Plaintiffs allege in the Complaint. 27 The factual allegations in the Complaint show that Vergic “analyze[s], interpret[s], and 28 collect[s] customer-support agent interactions,” (Compl., ECF No. 1, ¶ 14), and that it 1 “uses [that data] for a variety of its own purposes,” (Id. ¶ 15). The Complaint alleges 2 Vergic also uses the data to “enable [businesses and public organizations] to proactively 3 and in realtime [sic] create valuable connections with their online visitors through 4 personalized and relevant dialogues.” (Id. ¶ 17.) None of these allegations points to how 5 these data are economically valuable to Plaintiffs, and therefore Plaintiffs fail to plausibly 6 plead an economic injury. 7 For the foregoing reasons, Plaintiffs have failed to establish they have suffered an 8 economic injury and thus they do not have standing to bring a claim under the UCL. The 9 motion to dismiss as to the claim under the UCL (Claim Three) is granted with leave to 10 amend. 11 B. Rule 12(b)(6) Motion to Dismiss 12 Finding standing for Claims One, Two, and Four, contingent upon whether 13 Plaintiffs sufficiently plead these claims, the Court considers the sufficiency of the 14 Complaint in pleading claims under Section 631(a) of CIPA and under the California 15 Constitution. 16 1. Section 631(a) of CIPA 17 CIPA is California’s anti-wiretapping and anti-eavesdropping statute that prohibits 18 unauthorized interceptions of communications in order “to protect the right of privacy.” 19 Cal. Penal Code § 630. The California Legislature enacted CIPA in 1967 in response to 20 “advances in science and technology [that] have led to the development of new devices 21 and techniques for the purpose of eavesdropping upon private communications[.]” Id. 22 As explained in Swarts v. The Home Depot, Inc., Section 631(a) of CIPA may be 23 broken into four clauses: 24 (1) where a person by means of any machine, instrument, or contrivance, or in any other manner, intentionally taps, or makes any unauthorized 25 connection with any telegraph or telephone wire, line, cable, or instrument; 26 (2) where a person willfully and without consent of all parties to the communication, or in any unauthorized manner, reads, or attempts to read, 27 or to learn the contents or meaning of any message, report, or 28 communication while the same is in transit; 1 (3) where a person uses, or attempts to use, in any manner, or for any purpose, or to communicate in any way, any information so obtained; and 2 (4) where a person aids, agrees with, employs, or conspires with any person 3 or persons to unlawfully do, or permit, or cause to be done any of the acts or things mentioned above. 4 5 No. 23-cv-0995-JST, 2023 WL 5615453, at *5 (N.D. Cal. Aug. 30, 2023) (citations 6 omitted). Here, Plaintiffs bring claims under all four Clauses. Plaintiffs allege that JC 7 Penney aided and abetted Vergic, a third party, to violate Clauses One through Three of 8 Section 631. JC Penney contends there are multiple issues with both the factual 9 allegations in the Complaint and Plaintiffs’ legal theories of liability that render any 10 proposed amendment futile as to each clause of Section 631. 11 i. Clause One of Section 631(a) 12 Based on the statutory language of Clause One, courts have consistently held that 13 Clause One applies only to “telegraph and telephone” wires, lines, cables, or 14 instruments,” and not to internet connections. See, e.g., In re Google Inc., No. 13-MD- 15 2430-LHK, 2013 WL 5423918, at *20 (N.D. Cal. Sept. 26, 2013); see also Williams v. 16 What If Holdings, LLC, No. C 22-03780 WHA, 2022 WL 17869275, at *2 (N.D. Cal. 17 Dec. 22, 2022) (“[T]he first clause of Section 631(a) concerns telephonic wiretapping 18 specifically and does not apply to the context of the internet.”); see also Javier v. 19 Assurance IQ, LLC, No. 20-cv-02860-CRB, 2023 WL 114225, at *4 n.3 (N.D. Cal. Jan. 20 5, 2023) (“As Defendants correctly argue, the first prong of Section 631 does not apply to 21 internet communications.” (citations omitted)). This Court has adopted this interpretation 22 in a previous ruling. See Greenley v. Kochava, Inc., No. 22-cv-1327-BAS-AHG, 2023 23 WL 4833466, at *16 (S.D. Cal. July 27, 2023). 24 Because Clause One does not apply to internet connections, prospective plaintiffs 25 who allege their communications were intercepted when using their smartphones as 26 computers (for example, to access and browse the internet) are foreclosed from stating a 27 claim under Clause One of Section 631. See Mastel v. Miniclip SA, 549 F. Supp. 3d, 28 1129, 1135 (E.D. Cal. July 15, 2021) (holding that “[a]lthough [smartphones] contain the 1 word ‘phone’ in their name, and have the capability of performing telephonic functions, 2 they are, in reality, small computers”); see also Licea v. Am. Eagle Outfitters, Inc., No. 3 EDCV 22-1702-MWF (JPR), 2023 WL 2469630, at *5 (C.D. Cal. Mar. 7, 2023) 4 (rejecting the argument that Clause One of Section 631 applies to smartphones). 5 Here, Plaintiffs allege they “used smart phones (cellular telephones with integrated 6 computers to enable web browsing) and/or wifi-enabled tablets and laptops that use a 7 combination of cellular and landline telephony” to engage with the “‘chat’ feature of the 8 Website to communicate with Defendant.” (Compl., ECF No. 1, ¶ 23.) The lone 9 reasonable inference that arises from this allegation is that Plaintiffs used smartphones, 10 tablets, and/or computers to access the Website over the internet. Hence, the 11 communications that traversed between their mobile devices and JC Penney’s servers fall 12 outside the realm of Clause One of Section 631. See, e.g., Swarts, 2023 WL 5615453, at 13 *6 (dismissing a Clause One claim where the plaintiff alleged he “visited Defendants’ 14 website” via “his cellular telephone”). Plaintiffs seemingly concede that Clause One 15 does not apply to smartphones. (See generally Resp., ECF No. 11 (containing arguments 16 for claims under Clauses Two and Three but no arguments for a claim under Clause 17 One).) 18 Accordingly, the Court finds that Plaintiffs’ admission that they utilized cellular 19 phones to access the Website renders futile any amendment of any Section 631 claim 20 premised upon an alleged violation of Clause One. See Airs Aromatics, LLC v. Victoria’s 21 Secret Stores Brand Mgmt., Inc., 744 F.3d 595, 600 (9th Cir. 2014) (“A party cannot 22 amend pleadings to directly contradict an earlier assertion made in the same 23 proceeding.”) (citations omitted). 24 ii. Clause Two of Section 631(a) 25 “[C]ourts have applied Section 631(a) via the language of its second clause to the 26 internet browsing context.” What If Holdings, 2022 WL 17869275, at *2. This Court 27 finds persuasive the analytical structure in Valenzuela v. Keurig Green Mountain, Inc., 28 which breaks Clause Two down into three elements: “(1) absence of consent; (2) the 1 party exception; and (3) the ‘while . . . in transit’ requirement.” No. 22-cv-09042-JSC, 2 2023 WL 3707181, at *3 (N.D. Cal. May 24, 2023) (citing to Cal. Penal Code § 631(a)). 3 Absence of consent. Plaintiffs meet their burden to plead lack of consent. The 4 statute prohibits eavesdropping “without consent of all parties to the communication.” 5 Cal. Penal Code § 631(a). Plaintiffs allege they were not informed of the chat recording 6 or interception when they used the Website to chat with a JC Penney customer service 7 representative. (Compl., ECF No. 1, ¶¶ 23, 25–27.) Plaintiffs further allege they did not 8 give their express or implied consent to allow Vergic to learn of their communications 9 with JC Penney. (Id., ¶ 28.) That is sufficient at this stage. See Javier, 2022 WL 10 1744107, at *2 (finding there was no prior consent when the complaint pled that neither 11 party to the communication requested the plaintiff’s “consent prior to his filling out the 12 insurance questionnaire.”). Accordingly, this element is satisfied. 13 The Party Exception. The parties here do not dispute that JC Penney falls under 14 this exception as a party to the communication. However, Plaintiffs successfully allege 15 the party exception does not apply to Vergic. 16 CIPA contains an exemption from liability for a person who was a “party” to a 17 communication. See Warden v. Kahn, 160 Cal. Rptr. 471 (Cal. Ct. App. 1979) 18 (“[S]ection 631 . . . has been held to apply only to eavesdropping by a third party and not 19 to recording by a participant to a conversation.”); see also Javier, 2023 WL 114225, at 20 *4. The question here, then, is whether Vergic is a third-party eavesdropper or the 21 equivalent of a tape-recorder in Defendant’s control. Compare Rogers v. Ulrich, 125 22 Cal. Rptr. 306 (Cal. Ct. App. 1975) (holding that a tape recorder jack installed in a 23 telephone, used to record a conversation, then played back to a third party later, did not 24 create liability under CIPA) with Ribas v. Clark, 696 P.2d 637 (Cal. 1985) (holding that 25 allowing a friend to listen in on a phone conversation via an extension created liability 26 under CIPA). So, is Vergic the tape recorder or is Vergic the friend listening in? 27 The answer turns on whether there is a “use” requirement in Clause Two; that is, 28 whether Plaintiffs must show Vergic used the data for its own ends. Plaintiffs cite to 1 Javier, which held that “reading a use requirement into the second [clause] would add 2 requirements that are not present (and swallow the third [clause] in the process).” 2023 3 WL 114225, at *6. This Court finds the reasoning in Javier persuasive. A use 4 requirement is more appropriate in a Clause Three, not Clause Two, analysis, which the 5 Court examines below. See infra Section III.B.1.iii. 6 This conclusion is bolstered by the Ninth Circuit’s reasoning in In re Facebook, 7 Inc. Internet Tracking Litigation. In that case, the court held that surreptitious 8 duplication of an electronic transmission between two parties does fall within CIPA and 9 is not subject to the “party” exemption. 956 F.3d at 608. In reaching this conclusion, the 10 court cited to legislative history evincing an “intent to prevent the acquisition of the 11 contents of a message by an unauthorized third-party or ‘an unseen auditor.’” Id. (citing 12 S. REP. NO. 90-0197, reprinted in 1986 U.S.C.C.A.N. 2112, 2154, 2182). 13 Here, Plaintiffs sufficiently allege Defendant allowed Vergic to 14 contemporaneously duplicate their chat conversations with Defendant as they occurred, 15 thereby reading them. To plausibly allege a violation of Clause Two, they need not 16 allege that Vergic did so for its own use. Therefore, Plaintiffs successfully allege, at this 17 stage, that JC Penney may be liable for violating Clause Two of CIPA, by aiding and 18 abetting Vergic. 19 The “While in Transit” Requirement. Plaintiffs sufficiently allege their 20 communications with Defendant were intercepted while in transit to Defendant. Liability 21 under Clause Two arises when the purported CIPA violator “reads, or attempts to read, a 22 communication that is ‘in transit or passing over any wire, line, or cable, or is being sent 23 from, or received at any place within’ California.” Mastel, 549 F. Supp. 3d at 1135 24 (quoting Cal. Penal Code § 631(a)). Some courts have held that, at the motion to dismiss 25 stage, a plaintiff is not expected to prove or even know how and when its 26 communications were captured. See, e.g., In re Vizio, Inc. Consumer Priv. Litig., 238 F. 27 Supp. 3d 1204, 1228 (C.D. Cal. 2017). Indeed, a pleading standard to the contrary would 28 require the CIPA plaintiff to engage in a one-sided guessing game because the relevant 1 information about data capture typically resides uniquely in the custody and control of 2 the CIPA defendant and its third-party recorder. Still, a CIPA plaintiff “must provide fair 3 notice to [d]efendant” of how and when she “believe[s]” the defendant or the conspiring 4 third party intercepts her communications. Id.; see also Licea, 2023 WL 2469630, at *9 5 (“Plaintiffs must provide more than conclusory allegations that messages were 6 intercepted during transmission in real time.”). 7 Plaintiffs successfully plead that Vergic intercepted Plaintiffs’ chats with JC 8 Penney. Plaintiffs allege that the JC Penney Website chat feature operates through 9 Vergic’s servers, allowing real-time interception of the communication. (See Compl., 10 ECF No. 1, ¶ 13 (“[T]he chat function is run from Vergic’s servers but allows for chat 11 functionality on the Website. In other words, Vergic runs the chat service from its own 12 servers, but consumers interact with the chat service on Defendant’s Website, so it 13 appears they are only communicating with a company representative of Defendant.”); 14 (see also id. ¶ 14 (“[W]henever a chat message is sent from a member of the Class to 15 Defendant, it is first routed through Vergic’s server.”).) The reasonable inference here, 16 because Vergic apparently receives the chat messages either before or simultaneously 17 with JC Penney, is that Vergic intercepts these messages. 18 JC Penney’s argument that Plaintiffs do not allege the “how or when” of the 19 eavesdrop necessarily fails. Plaintiffs do indeed allege with sufficient specificity the how 20 and when of Vergic’s interception of Plaintiffs’ chat communications with JC Penney. 21 (See Mot., ECF No. 9, at 15:22–16:5.) 22 Ultimately, Plaintiffs plausibly allege that JC Penney has violated CIPA Clause 23 Two, by aiding and abetting Vergic, in allowing Vergic to “listen in” on chats between 24 Website users and JC Penney customer service representatives. 25 iii. Clause Three of Section 631(a) 26 Plaintiffs do not plausibly allege that Defendant violated Clause Three. Clause 27 Three creates liability under CIPA for any party “who uses, or attempts to use, in any 28 manner, or for any purpose, or to communicate in any way, any information [as laid out 1 in Clauses One and Two].” Cal. Penal Code § 631(a). However, unlike Clause Two, 2 Clause Three specifically includes a use requirement. See supra Section III.A.B.1.ii. 3 (analyzing how a use requirement makes more sense in the plain language of Clause 4 Three, rather than inferred from the text of Clause Two). 5 JC Penney persuasively argues that Plaintiffs do not sufficiently plead that Vergic 6 uses their chat data for its own purposes.2 Plaintiffs aver in their Response that Vergic is 7 using “the information obtained from those conversations for Vergic’s own purposes.” 8 (ECF No. 11, at 13:3–4.) This is a conclusory allegation without a supporting factual 9 allegation in the Complaint. In contrast, the specific factual allegations of the Complaint 10 contradict Plaintiffs’ argument. Repeatedly, the Complaint states Vergic “exhaustively 11 analyze[s]” visitor conversations, or Vergic “allow[s] brands & organisations to engage 12 with customers through . . . supported messaging and collaboration tools.” (Compl., ECF 13 No. 1, ¶¶ 1–17.) These uses all point to Vergic acting as a tool for companies like 14 Defendant, and not as a user of the customers’ chat transcripts for Vergic’s own ends. 15 Therefore, Plaintiffs do not successfully plead JC Penney has violated CIPA under 16 Clause Three because they do not sufficiently allege Vergic, or any other third party, uses 17 the chat data for its own purposes. 18 2. Section 632.7 of CIPA 19 Plaintiffs have failed to plausibly allege a claim for violating Section 632.7 of 20 CIPA. “[C]ourts applying § 632.7 have characterized the statute as prohibiting the 21 intentional recording of any communication without the consent of all parties where one 22 of the parties is using a cellular or cordless phone.” McCabe v. Six Continents Hotels, 23 Inc., No. 12-cv-4818 NC, 2014 WL 465750, at *3 (N.D. Cal. Feb. 3, 2014). Section 24 632.7(a) states:

25 2 Plaintiffs attempted to shoehorn in an additional factual allegation in their Response when they stated, 26 “On information and belief, Vergic analyzes and uses the chat conversations it intercepts and records to, inter alia, improve its SaaS platform, including proprietary machine learning for its chatbots and related 27 technologies.” (Resp., ECF No. 11, at 13:11–13.) This Court cannot consider this as a factual allegation because a Rule 12(b)(6) motion is based on the insufficiency of the pleadings and a response to a motion 28 1 Every person who, without the consent of all the parties to a communication, intercepts or receives and intentionally records, or assists in the interception 2 or reception and intentional recordation of, a communication transmitted 3 between two cellular radio telephones, a cellular radio telephone and a land telephone, two cordless telephones and a landline telephone, or a cordless 4 telephone and a cellular radio telephone, shall be punished by a fine 5 Cal. Penal Code § 632.7. 6 Defendant contends that Plaintiffs’ Section 632.7 claim falls because Plaintiffs 7 admit they used cellular devices to access the Website, and communications originating 8 from smartphones are not covered by Section 632.7. (ECF No. 9, at 17:26–18:19.) The 9 Court agrees and adopts the reasoning in Cinmar and Mastel that when a consumer uses a 10 phone to access a website over the internet, the phone functions as a computer, not a 11 phone. See Mastel, 549 F. Supp. 3d at 1135; see also Licea v. Cinmar, No. CV 22-6454- 12 MWF (JEM), 2023 WL 2415592, at *2 (C.D. Cal. Mar. 7, 2023). If Section 632.7 is to 13 apply to newer technologies, like cell phones that operate as hand-held computers, it must 14 be because California’s Legislature amended the statute to incorporate such technologies. 15 See Smith v. LoanMe, Inc., 11 Cal. 5th 183, 202 n.10 (Cal. 2021). Accordingly, the Court 16 finds Plaintiffs’ admission they used “smart phones . . . and/or wifi-enabled tablets and 17 laptops,” (Compl., ECF No. 1, ¶ 23), to access the Website renders amendment of their 18 Section 632.7 claim futile, see Airs Aromatics, 744 F.3d at 600. 19 3. The UCL 20 Because Plaintiffs do not sufficiently allege facts so as to have standing to bring 21 this claim, the Court will not address the 12(b)(6) motion to dismiss this claim. See supra 22 Section III.A.2.iii. 23 4. Invasion of Privacy under the California Constitution 24 To bring a claim for invasion of privacy under the California Constitution, 25 “Plaintiffs must show “(1) there exists a reasonable expectation of privacy, and (2) the 26 intrusion was highly offensive.” In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 27 at 601. 28 1 i. Reasonable Expectation of Privacy 2 The relevant question here is whether, in chatting with a customer service 3 representative on Defendant’s website, a user would reasonably expect that Defendant 4 would monitor and record those chats. A reasonable expectation of privacy is an 5 “objective entitlement founded on broadly based and widely accepted community 6 norms.” Hill v. Nat’l Collegiate Athletic Ass’n, 865 P.2d 633, 655 (Cal. 1994). Courts 7 analyzing this entitlement question “must take into account any ‘accepted community 8 norms,’ advance notice to [the plaintiff] . . . , and whether [the plaintiff] had the 9 opportunity to consent to or reject the very thing that constitutes the invasion.” TBG Ins. 10 Servs. Corp. v. Superior Crt., 96 Cal. App. 4th 443, 450 (Cal. 2002). 11 Accepted community norms. The “community norms” aspect of the “reasonable 12 expectation of privacy” element means “‘[t]he protection afforded to the plaintiff’s 13 interest in his privacy must be relative to the customs of the time and place, to the 14 occupation of the plaintiff and to the habits of his neighbors and fellow citizens.’” Id. 15 In the instant case, Plaintiffs’ chats did not take place in an online space where one 16 may reasonably expect privacy, such as in a private chat with a therapist or clinician. 17 Rather, Plaintiffs’ chats took place on a public website owned and operated by a private 18 company. It would not be reasonable for a consumer to expect privacy in such a 19 situation, given the common practice that companies monitor customer service phone 20 lines, and Plaintiffs’ online chats in the instant case were with customer service 21 representatives. 22 Courts have recognized this reasoning. For instance, where customers “voluntarily 23 sent [the defendant] all the internet usage information at issue,” the Third Circuit did not 24 find an invasion of privacy. In re Google Inc. Cookie Placement Consumer Priv. Litig., 25 806 F.3d 125, 150 (3d Cir. 2015). Similarly, in California, routine commercial behavior 26 is not considered an “egregious breach of social norms.” Folgelstrom v. Lamps Plus, 27 Inc., 195 Cal. App. 4th 986, 992 (2011). Here, a company recording the chats a 28 1 consumer has with a customer service representative falls under the umbrella of “routine 2 commercial behavior.” See id. 3 Advance notice to Plaintiffs. Plaintiffs successfully plead they did not receive 4 advance notice from Defendant that a third party storing the chat history was listening in. 5 “Vergic runs the chat service from its own servers, but consumers interact with the chat 6 service on Defendant’s Website, so it appears they are only communicating with a 7 company representative of Defendant.” (Compl., ECF No. 1, ¶ 13.) It is reasonable to 8 infer from allegations such as these that Plaintiffs did not have advance notice that 9 Defendant or a third party may have recorded the chats Plaintiffs had on Defendant’s 10 website. 11 Consent. To successfully plead an invasion of privacy, the plaintiffs must have 12 conducted themselves in a manner consistent with an actual expectation of privacy, 13 meaning they must not have manifested by their conduct a voluntary consent to the 14 invasive actions of defendant. Hill, 865 P.2d at 633. As analyzed above, Plaintiffs 15 successfully plead they did not consent to the recording of their chats with Defendant. 16 See supra Section III.B.1.ii. 17 In summary, applying the TBG factors as a balancing test, this Court finds that 18 although Plaintiffs did not have advance notice and did not consent to Defendant 19 allowing Vergic to listen in on the chats and store the transcripts, accepted community 20 norms around conversations in this type of space (a commercial website for selling 21 merchandise) point away from a reasonable expectation of privacy. See 96 Cal. App. 4th 22 at 450. Thus, Plaintiffs did not have a reasonable expectation of privacy in their chats 23 with customer service representatives on Defendant’s website and therefore this element 24 of an invasion of privacy claim is not met. 25 ii. Serious Invasion of Privacy Interest. 26 Further, “[a]ctionable invasions of privacy must be sufficiently serious in their 27 nature, scope, and actual or potential impact to constitute an egregious breach of the 28 social norms underlying the privacy right. Thus, the extent and gravity of the invasion is 1 an indispensable consideration in assessing an alleged invasion of privacy.” Hill, 865 2 P.2d at 633. However, determinations of the egregiousness of the privacy intrusion are 3 not usually resolved at the pleading stage. See In re Facebook, Inc. Tracking Litig., 956 4 F.3d at 606 (“The ultimate question of whether Facebook’s tracking and collection 5 practices could highly offend a reasonable individual is an issue that cannot be resolved 6 at the pleading stage.”); see also In re Facebook, Inc., Consumer Priv. User Profile 7 Litig., 402 F. Supp. 3d 767, 797 (N.D. Cal. 2019) (“Under California law, courts must be 8 reluctant to reach a conclusion at the pleading stage about how offensive or serious the 9 privacy intrusion is.”). 10 Therefore, the Court will not resolve this particular question at this stage in the 11 litigation. However, the motion to dismiss this cause of action will be granted, with leave 12 to amend, on the grounds that Plaintiffs do not allege facts sufficient to establish a 13 reasonable expectation of privacy in their chats with customer service representatives on 14 Defendant’s website. 15 C. Leave to Amend 16 Under Rule 15(a)(2), granting leave to amend rests within the trial court’s sound 17 discretion. Swanson v. U.S. Forest Serv., 87 F.3d 339, 343 (9th Cir. 1996). The Ninth 18 Circuit has held that leave to amend should be freely granted. See Morongo Band of 19 Mission Indians v. Rose, 893 F.2d 1073, 1079 (9th Cir. 1990). 20 Therefore, leave to amend is hereby granted for each cause of action dismissed, 21 except for any allegation brought under CIPA Section 631(a), Clause One, and Section 22 632.7, as analyzed above. See supra Sections III.B.1.i, III.B.2. Leave to amend is also 23 granted as to Plaintiffs’ requests for declaratory and injunctive relief. 24 IV. CONCLUSION 25 Accordingly, the Court rules as follows on Defendant’s Motion to Dismiss 26 Plaintiffs’ Complaint (ECF No. 9): 27 28 1. Section 631(a) of CIPA 2 a. GRANTED with prejudice, as to Clause One, for failure to state a claim. 3 b. DENIED as to Clause Two. 4 c. GRANTED without prejudice, as to Clause Three, for failure to state a 5 claim and lack of standing. 6 2. GRANTED with prejudice, as to Section 632.7 of CIPA, for failure to state a 7 claim. 8 3. GRANTED without prejudice, as to the UCL, for lack of standing. 9 4. GRANTED without prejudice, as to invasion of privacy under the California 10 Constitution, for failure to state a claim and lack of standing. 11 5. GRANTED without prejudice, as to Plaintiffs’ pleas for declaratory and 12 injunctive relief for the surviving claim, for lack of standing. 13 6. DENIED as to Plaintiffs’ plea for damages for the surviving claim. 14 If Plaintiffs wish to amend, they must do so on or before November 7, 2023. If 15 || Plaintiffs fail to amend by November 7, 2023, Defendant is ordered to file a response by 16 || November 14, 2023. 17 IT IS SO ORDERED. 18 A , 19 | DATED: October 24, 2023 Lin A (Lyphaa. 6 20 United States District Judge 21 22 23 24 25 26 27 28 an.