Davis v. HDR Incorporated

• Court: District Court, D. Arizona
• Decided: January 25, 2023
• Docket: 2:21-cv-01903
• Status: Unknown

Opinion

1 WO 2 3 4 5 6 IN THE UNITED STATES DISTRICT COURT 7 FOR THE DISTRICT OF ARIZONA

9 Carol Davis, No. CV-21-01903-PHX-ROS

10 Plaintiff, ORDER

11 v.

12 HDR Incorporated,

13 Defendant. 14 15 In her First Amended Complaint, Plaintiff Carol Davis alleges Defendant HDR 16 Incorporated unlawfully collected electronic communications of private Facebook groups 17 in violation of the Federal Wiretap Act, 18 U.S.C. §§ 2510, et seq., the Stored 18 Communications Act, 18 U.S.C. §§ 2701, et seq., and the common law right to privacy. 19 (Doc. 18). Defendant moved to dismiss Plaintiff’s original complaint based primarily on 20 the fact that the communications Plaintiff alleges Defendant collected were not private, but 21 instead were “readily accessible to the public.” The Court agreed and dismissed Plaintiff’s 22 complaint with leave to amend. Plaintiff amended her complaint, but Defendant now 23 argues Plaintiff failed to remedy that basic flaw. For the reasons below, the Court agrees, 24 and the Motion to Dismiss will be granted. 25 I. BACKGROUND 26 The factual background in this case is set forth in detail in the previous Order. See 27 Davis v. HDR Incorporated, --- F. Supp. 3d ---, 2022 WL 2063231, *1 (D. Ariz. June 8, 28 2022) (summarizing facts of this case). The Court briefly recites the facts as alleged in the 1 First Amended Complaint. 2 Defendant is an architecture and design firm that has designed over 275 jails and 3 prisons. (Doc. 18 at ¶ 3). Defendant also offers various strategic communications services, 4 including helping clients to “leverage web, video, and social networking” in order to 5 “manage the social and political risk associated with infrastructure development.” (Doc. 6 18 at ¶ 14). These services include “STRATA,” a 24/7 surveillance or “social listening 7 service” that gathers social media data in order to “determine trends, specify key 8 influencers and mitigate or identify risk.” (Doc. 18 at ¶¶ 17, 24). In other words, Defendant 9 monitors social media accounts in an attempt to anticipate, and potentially frustrate, 10 opposition to its clients’ projects. 11 This case involves two “private” Facebook groups. The first, “Ahwatukee411,” is a 12 private Facebook group formed in 2014 with approximately 32,400 members. (Doc. 18 at 13 ¶ 31). Ahwatukee411 is a forum where residents of the Ahwatukee Foothills area can 14 discuss issues concerning the community. (Id.) In order to join Ahwatukee411, a 15 prospective member must fill out a questionnaire explaining their involvement in the 16 community and their interest in joining the group. (Doc. 18 at ¶ 32). The second group, 17 Protecting Arizona’s Resources & Children (PARC), was formed to protest the 18 construction of a highway that cuts through the Moahdak Do’ag Mountain. (Doc. 18 at ¶ 19 33). PARC has approximately 930 members. (Id.) There is also a “screening process” 20 required to join PARC. (Doc. 18 at ¶ 34). 21 Plaintiff has been a member of Ahwatukee411 since 2015, and a member of PARC 22 since 2016. (Doc. 18 at ¶¶ 47, 49). She alleges she privately communicated in each of these 23 groups about topics such as recommendations for services and debates over local issues, 24 including the construction of a local highway, potential political corruption, and the 25 environmental impact of the highway. (Doc. 18 at ¶¶ 48, 50). Plaintiff alleges Defendant 26 infiltrated both groups in 2016 and has undertaken tracking, reading, intercepting, and 27 analyzing the posts of Plaintiff and of other group members. (Doc. 18 at ¶ 54). While 28 Plaintiff alleges it “is unknown how Defendant infiltrated these Private Facebook Groups,” 1 she alleges that based on the questionnaire screening required for both, the “clear inference 2 is that Defendant used deceitful and untruthful answers to the screening process” in order 3 to join. (Doc. 18 at ¶¶ 40-41). 4 Plaintiff brought suit in November 2021 against Defendant on behalf of herself and 5 two purported classes of members of the Groups. (See Doc. 18 at ¶¶ 57-64). The Court 6 granted Defendant’s motion to dismiss in June of 2022, and Plaintiff filed her First 7 Amended Complaint that same month. Defendant’s motion to dismiss followed. 8 A. The Court’s Reasoning in Dismissing the Initial Complaint 9 The Federal Wiretap Act and the Stored Communications Act prohibit intercepting 10 or collecting certain electronic communications. However, the statute makes clear “it shall 11 not be unlawful . . . for any person (i) to intercept or access an electronic communication 12 made through an electronic communication system that is configured so that such 13 electronic communication is readily accessible to the general public.” 18 U.S.C. § 14 2511(2)(g); Davis, 2022 WL 2063231, at *3 (quoting 18 U.S.C. § 2511(2)(g)(i)) 15 (“[e]lectronic communications which are ‘readily accessible to the general public’ are 16 explicitly exempted from protection under the Wiretap Act and the [Stored 17 Communications Act].”).1 Therefore, to state a plausible claim under either Act, Plaintiff 18 must allege sufficient facts establishing her communications were not, in fact, “readily 19 accessible to the general public.” See Davis, 2022 WL 2063231, at *4 (citing Snow, 450 20 F.3d at 1321) (“the readily accessible issue concerns a ‘material and essential’ element of 21 [Wiretap Act and Stored Communications Act] claim[s] that must be sufficiently pleaded 22 to in the complaint.”). 23 In dismissing Plaintiff’s original complaint, the Court held Plaintiff failed to 24 plausibly allege facts showing Plaintiff’s posts in the two Facebook groups were 25 1 The Electronic Communications Privacy Act encompasses both the Wiretap Act and the 26 Stored Communications Act. Davis, 2022 WL 2063231, at *3. The Wiretap Act protects communications in transit, while the Stored Communications Act protects stored 27 communications. Id. While the interplay of these two statutes is “complex,” see id. at *3, n.3 (quoting Konop, 302 F.3d at 874), for the purposes of this Order, there is a single 28 relevant inquiry. Both statutes exempt electronic communications which are “readily accessible to the general public.” 18 U.S.C. § 2511(2)(g)(i). 1 “configured in some way so as to limit ready access by the general public.” Id., at *9 2 (quoting Snow v. DirecTV, 450 F.3d 1314, 1322 (11th Cir. 2006)). The Court adopted two 3 interconnected rationales for this conclusion. The first involved the lack of control Plaintiff 4 retained over her communications while the second involved the relatively simple steps 5 anyone could pursue to obtain access to Plaintiff’s communications. 6 The Court’s first rationale was Plaintiff did not “actively restrict[] the public from 7 accessing the information,” but instead did “just the opposite” by “posting in a place where 8 she had no ability to restrict access.” Id. at *7 (quoting Ehling v. Monmouth-Ocean Hosp. 9 Serv. Corp., 961 F. Supp. 2d 659, 668 (D.N.J. 2013)). Because the group administrators 10 determined access to the private groups, and not Plaintiff, the Court explained, Plaintiff’s 11 posts in the groups were “readily accessible to the general public.” 12 The Court’s second rationale was that though the Facebook groups were labeled as 13 “private,” they did not require any meaningful effort to join. That is, “any person can 14 become a member of the Groups, provided that they assert some unspecified level of 15 involvement and interest in the community.” Id., at *5. The ease by which someone could 16 join the groups meant the groups were “readily accessible to the public.” 17 In adopting these rationales, the Court noted the Ninth Circuit had not addressed the 18 question specifically. Id. at *3. Thus, the Court reasoned primarily from two cases: Konop 19 v. Hawaiian Airlines, Inc., 302 F.3d 868 (9th Cir. 2002) and Snow, 450 F.3d 1314 (11th 20 Cir. 2006). In Konop, the plaintiff created and maintained a restricted website; he created 21 a discrete list of individuals who were eligible to access a website, and he controlled access 22 to his site by requiring users to log in by entering the name of an eligible person and 23 creating a password. 302 F.3d at 872. After the defendant gained access to the website by 24 impersonating an authorized individual, the plaintiff sued. The Ninth Circuit did not 25 address the requirement that the communications not be readily accessible to the public, 26 but implicit in the Konop opinion’s analysis is the conclusion that the website at issue was 27 sufficiently private such that it was not readily accessible to the public. 28 The Court concluded Konop did not apply to this case because of materially 1 different facts. In particular, Plaintiff did not control access to her communications, but the 2 administrators of the private groups did; additionally, the list of eligible users in Konop 3 was itself non-public, whereas here, the information required to join Ahwatukee411 and 4 PARC was in the public domain. 5 Instead of analogizing to Konop, the Court explained the facts alleged in the original 6 complaint were more analogous to those in Snow. Davis, 2022 WL 2063231, at *6. In 7 Snow, the plaintiff maintained an electronic bulletin board regarding his contentious 8 dealings with DirecTV. The plaintiff’s bulletin board allowed anyone to use the site by 9 registering and creating a password, as long as the registrant clicked a button to agree to 10 the terms of use and to “affirm his non-association with DirecTV.” 450 F.3d at 1321. After 11 DirecTV accessed the website, the plaintiff sued under the Stored Communications Act. 12 The Eleventh Circuit concluded the Stored Communications Act did not apply because 13 “[n]othing inherent in any of [the steps required to access the website] prompts us to infer 14 that access by the general public was restricted.” Id. at 1321-1322. Rather, the Eleventh 15 Circuit found the website’s admission requirement to be “in essence, a self-screening 16 methodology by which those who are not the website’s intended users would voluntarily 17 excuse themselves.” Id. at 1322. 18 Tracking the reasoning in Snow, the Court in this case reasoned Plaintiff’s 19 allegations about the private Facebook groups established they operated on a similar “self- 20 screening” requirement, because anyone could become a member of the private groups 21 “provided that they assert some unspecified level of involvement and interest in the 22 community.” Davis, 2022 WL 2063231, at *5. The Court further explained that those who 23 lack involvement or interest in the Ahwatukee community are unlikely to seek admission 24 in the group, but even so, the information required to be admitted to the group is publicly 25 available. Davis, 2022 WL 2063231, at *5. 26 Accordingly, the Court dismissed Plaintiff’s claims under the Wiretap Act and the 27 Stored Communications Act (Counts I-III) because she failed to plausibly allege that her 28 posts were not readily accessible by the general public. Id. at *9. The Court granted leave 1 to amend but did not specify the type of additional allegations that might be sufficient to 2 state claims. 3 B. First Amended Complaint: Private Facebook Groups 4 To frame the current discussion, the Court begins by reciting in detail the facts about 5 the two private Facebook groups as alleged by Plaintiff in her First Amended Complaint. 6 Some of these facts were in the previous complaint while some of them were added when 7 Plaintiff amended. 8 Facebook allows users to create and join two different types of groups: private and 9 public. (Doc. 18 at ¶ 25). In private groups, only members can see the identity of other 10 group members and what they post within the group. (Id.) Once a private group is created, 11 the group administrators cannot change the group to “public.” (Doc. 18 at ¶ 26). The only 12 change the administrators can make is to allow the group to be searchable by non-members 13 (i.e., visible) or not (i.e., hidden). (Id.) Members of a private Facebook group can access 14 the names of all the other members within the group, and they can also see when the number 15 of members increases or decreases. (Doc. 18 at ¶ 27). Plaintiff alleges “a member of a 16 private Facebook group could investigate the names of group members and determine 17 whether he or she feels comfortable continuing to post in the private Facebook group in 18 light of the current membership.” (Id.) 19 As mentioned above, both groups relevant to this litigation are private Facebook 20 Groups; Ahwatukee411 has about 32,400 members, and PARC has about 930 members. 21 (Doc. 18 at ¶¶ 31, 33). Plaintiff alleges prospective members of Ahwatukee411 must fill 22 out a questionnaire “discussing their involvement in the Ahwatukee community and their 23 interest in joining the group as it relates to the community.” (Doc. 18 at ¶ 32). Plaintiff 24 alleges prospective members of PARC must similarly “undergo a screening process.” (Doc. 25 18 at ¶ 34). Plaintiff asserts the purpose of keeping both groups private is to “ensure that 26 only residents” (in the case of Ahwatukee411) or “largely only residents” (in the case of 27 PARC) are able to join the group and see the posts. (Doc. 18 at ¶¶ 32, 34). 28 Plaintiff alleges the screening process required to join these two private Facebook 1 groups is “more sophisticated than simply clicking a button to state they are interested in 2 joining.” (Doc. 18 at ¶ 36). According to Plaintiff, while all of the information needed to 3 gain admission to the private groups is public, prospective members would need to devote 4 resources and time to gathering the information needed to pass the screening process. (Doc. 5 18 at ¶ 37). Plaintiff alleges the questionnaire requires: (i) knowing about and researching 6 “the existence of the Ahwatukee community and the issues surrounding the community”; 7 (ii) having “substantial knowledge” of issues facing the community, including construction 8 of the highway, and (iii) drafting “answers to the screening questions discussing the 9 prospective member’s interest in the community based on” that research, “as well as stating 10 where the prospective group member resides.” (Doc. 18 at ¶ 36). Plaintiff alleges gathering 11 this information is “not something a member of the ‘general public’ would ever do in 12 practice,” and that only a true member of the Ahwatukee community or a “sophisticated 13 social media listening company that specializes in exactly this type of research” would do 14 so. (Doc. 18 at ¶ 37). 15 Plaintiff does not allege any additional facts, such as the questions required by the 16 questionnaire or the number, if any, of applications to join the group that were denied based 17 on insufficient questionnaire answers. Plaintiff does, however, allege “the clear inference 18 is that Defendant used deceitful and untruthful answers to the screening process” in order 19 to gain membership. (Doc. 18 at ¶ 41). Plaintiff alleges that if Defendant had been truthful 20 in its answers, it would not have been admitted to the private groups, or that even if the 21 administrators did admit Defendant upon reading its truthful answers, she and other 22 members would have seen that Defendant had been added to the group and could have 23 investigated Defendant and potentially opted not to post anymore. (Doc. 18 at ¶ 42). 24 Plaintiff instead alleges she did not know, nor “have reason to know, that her 25 communications were being surveilled by unconsented-to third-party actors who were 26 neither Ahwatukee residents nor persons whose interests were not aligned with the PARC 27 organization’s goals.” (Doc. 18 at ¶ 53). 28 // 1 II. LEGAL STANDARD 2 Pursuant to Rule 12(b)(6), a complaint may be dismissed for failure to state a claim 3 for which relief can be granted. Fed. R. Civ. P. 12(b)(6). “[A] complaint must contain 4 sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its 5 face.’” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 6 550 U.S. 544, 570 (2007)). “The purpose of a motion to dismiss under Rule 12(b)(6) is to 7 test the legal sufficiency of the complaint.” N. Star Int’l v. Ariz. Corp. Comm’n, 720 F.2d 8 578 581 (9th Cir. 1983). A claim is facially plausible when it contains “factual content that 9 allows the court to draw the reasonable inference” that the moving party is liable. Ashcroft, 10 556 U.S. at 678, 129 S. Ct. 1937. In reviewing a motion to dismiss, the Court takes “all 11 allegations of material fact as true and construe[s] them in the light most favorable to the 12 non-moving party.” Parks Sch. of Bus. v. Symington, 51 F.3d 1480, 1484 (9th Cir. 1995). 13 A complaint does not suffice “if it tenders ‘naked assertion[s]’ devoid of ‘further factual 14 enhancement.’” Ashcroft, 556 U.S. at 678 (quoting Twombly, 550 U.S. at 557)). 15 III. ANALYSIS 16 A. Claims under the Federal Wiretap Act and the Stored Communications Act 17 (Counts I-III) 18 Other than the previous Order in this case, there is no case directly on point. 19 However, in her response to the pending motion to dismiss, Plaintiff argues the Court’s 20 prior Order was inappropriately strict and a better reading of the relevant case law supports 21 the conclusion that the private Facebook groups were not “readily accessible to the general 22 public.” The Court’s rationale that Plaintiff’s lack of control over her communications was 23 meaningful was likely an overstatement. However, the Court’s view that the Facebook 24 groups effectively were readily accessible to the general public remains accurate. 25 In attempting to show the Facebook groups were not, in fact, readily accessible to 26 the general public, Plaintiff relies on Joffe v. Google, Inc., 729 F.3d 1262 (9th Cir. 2013). 27 In that case, Google’s Street View cars gathered and stored data sent over unencrypted Wi- 28 Fi networks in the houses they drove past. Id. at 1264. The Ninth Circuit initially held those 1 Wi-Fi communications, though unencrypted, were not readily accessible to the general 2 public, because the data was only accessible within a few hundred feet of the Wi-Fi source 3 and “most of the general public lacks the expertise to intercept and decode payload data 4 transmitted over a Wi-Fi network.” Id. at 1278-79. Plaintiff argues that gathering the 5 information required to pass the questionnaires for admission to the private Facebook 6 groups here is analogous to those sophisticated collection methods used by Google. 7 However, as Defendant points out, the initial opinion in Joffe was amended and 8 superseded on rehearing. Joffe v. Google, Inc., 746 F.3d 920 (9th Cir. 2013). The 9 superseding opinion did not include this section of analysis at all. Regardless, even under 10 the analysis and facts of the first Joffe opinion, Plaintiff’s argument overstates the 11 similarities. To gain admission to the private Facebook groups, prospective members must 12 fill out a questionnaire; Plaintiff admits in her First Amended Complaint that all of the 13 information required for the questionnaires is publicly available. (Doc. 18 at ¶ 37). Plaintiff 14 alleges that the “time, effort, and knowledge one would have to accrue or devote to research 15 to pass the screening process” means a member of the general public would never, in 16 practice, undertake the process. (Id.) But conducting some basic online research is not the 17 same in degree or in kind as the type of “sophisticated hardware and software” combined 18 with geographic proximity that Google utilized in Joffe. 19 Plaintiff’s additional case law analyzes confidentiality and privacy under other 20 statutes. For example, in a breach of confidentiality case, Tori Belle Cosmetics, LLC v. 21 Meek, No. 21-0066, 2022 WL 670923 (W.D. Wa. Mar. 7, 2022), the plaintiff alleged the 22 defendants used confidential trade secrets, including training materials, customer and 23 contact lists, plans, and financials to create a competing cosmetic line. Id. at *5. The 24 defendants argued the materials were not kept in confidence, because they were posted to 25 a private Facebook group with thousands of members. Id. The court agreed with the 26 plaintiff, finding that the private Facebook group at issue was only used for training, was 27 only open to Tori Belle affiliates, and that each affiliate had to agree to keep the material 28 shared in the group confidential. Id. 1 Unfortunately, the decision does not explain how individuals were admitted to the 2 group or the ease by which a member of the general public might impersonate someone 3 and gain access. But the Plaintiff’s allegations are sufficiently different from Tori Belle 4 Cosmetics. Here, the private group was not limited to affiliates of a certain corporation or 5 entity, but to anyone with a self-identified interest in the Ahwatukee community; Plaintiff 6 did not allege that there was any agreement to maintain confidentiality or privacy among 7 the members or between the members and the administrators; and Plaintiff did not control 8 or oversee access to the private groups. 9 The Plaintiff next cites Greenburg v. Wray, No. CV-22-00122-PHX-DLR, 2022 10 WL 2176499 (D. Ariz. June 16, 2022). In that case, brought under the Computer Fraud and 11 Abuse Act, the plaintiff alleged the defendants found a URL to plaintiff’s Google Drive 12 and publicly disclosed its contents. Id. at *1. The Google Drive was not password 13 protected, but it was not indexed to be searchable by any search engine, so it was only 14 available to anyone who could type in the exact 68-character URL. Id. at *2. The Court 15 found it was a “close call,” but denied the motion to dismiss and found that the Google 16 Drive was sufficiently private to state a claim under that statute. The Drive was not 17 password protected; however, the fact that the Drive was not searchable, so someone would 18 need the exact 68-character URL to access it, made it plausible that the Drive was not 19 “readily accessible” to the general public.2 But see Orin S. Kerr, Norms of Computer 20 Trespass, 116 Colum. L. Rev. 1143, 1164–65 (2016) (“A hard-to-guess URL is still a URL, 21 and the information posted at that address is still posted and accessible to the world.”). 22 Importantly, here, Defendant (or any prospective member of the two private groups) did 23 not need any information that was not readily publicly available, like a long URL, see 24 Greenburg, 2022 WL 2176499, at *2, or a name from a private list, see Konop, 302 F.3d 25 at 872. Instead, prospective members needed only to indicate their interest in the

26 2 Here, it is worth noting, while Plaintiff alleges the two groups at issue here are private, she does not allege whether or not they were “hidden” (i.e., not searchable by the general 27 public) or “visible” (i.e., indexed and searchable). (See Doc. 18 at ¶ 26). There is a difference between finding and exploiting an inadvertently revealed 68-character URL and 28 searching for “Ahwatukee” on Google or Facebook and seeking entrance to a private group that pops up as a result. 1 Ahwatukee community and the issues affecting the community, all of which was easily 2 and publicly available. (Doc. 18 at ¶ 36-37). 3 Plaintiff points to hiQ Labs, Inc. v. LinkedIn Corp., 31 F.4th 1180 (9th Cir. 2022), 4 a case the Ninth Circuit considered under the Computer Fraud and Abuse Act (“CFAA”), 5 a statute very similar to the Stored Communications Act. Id. at 1200. In that case, the 6 plaintiff alleged the defendant had violated CFAA by “scraping” information that users 7 included on their individual, publicly accessible LinkedIn profiles. Id. at 1187. The relevant 8 question was whether that “scraping” constituted accessing LinkedIn’s computers “without 9 authorization.” Id. at 1195. The Ninth Circuit’s discussion of that question contains broad 10 language that Plaintiff point to in support of her claims. 11 According to the Ninth Circuit, the CFAA should be viewed as an “anti-intrusion 12 statute,” because it targets conduct “analogous to ‘breaking and entering.’” Id. at 1197. 13 Thus, liability under the “CFAA is premised on a distinction between information 14 presumptively accessible to the general public and information for which authorization is 15 generally required.” Id. at 1199-1200. The Ninth Circuit held the CFAA only addresses the 16 latter. That understanding was described as “consistent” with the Ninth Circuit’s 17 interpretation of the Stored Communications Act. In particular, the Stored 18 Communications Act distinguishes “between public websites and non-public or ‘restricted’ 19 websites, such as websites that are password-protected . . . or require the user to purchase 20 access by entering a credit card number.” Id. at 1200. The legislative history of the Stored 21 Communications Act indicates “[a] person may reasonably conclude that a communication 22 is readily accessible to the general public if the . . . means of access are widely known, and 23 if a person does not, in the course of gaining access, encounter any warnings, encryptions, 24 password requests, or other indicia of intended privacy.” Id. Communications where there 25 is an attempt to retain privacy “would be protected, while the statute would impose no 26 liability for access to features configured to be readily accessible to the general public.” Id. 27 Plaintiff points to this broad language and emphasizes the role of the restrictions in 28 the private Facebook groups. But the present complaint fails to include sufficient facts 1 regarding the type of authentication that was required to render Plaintiff’s claims plausible. 2 Again, the complaint does not contain the questions that had to be answered, nor does it 3 explain whether the application process was meaningful in that applicants were routinely 4 denied. Put in the language of hiQ Labs, the “means of access” may have been “widely 5 known.” Plaintiff alleges the information required by the questionnaires was so detailed 6 that no “member of the ‘general public’ would ever” gather that information. (Doc. 18 at 7 11). But no details regarding that information is provided. In addition, while the number of 8 members of the groups is not dispositive, the fact that over 32,400 individuals were 9 members of one of the groups indicates it may have been simple to join. 10 It is undisputed that these private Facebook groups had at least some “indicia of 11 intended privacy,” because they were identified as “private” and required permission to 12 become a member. Moreover, if Plaintiff is correct and Defendant knowingly falsified 13 information to gain access to the groups, Defendant must have known it was on thin ice by 14 obtaining access to information under false pretenses. At least with respect to the much 15 smaller PARC group, it appears to be plausible that requiring a questionnaire is sufficient 16 indication that it was limited to a select few, and there were attempts to retain 17 confidentiality. However, Plaintiff’s new allegations are not enough to create plausible 18 claims for relief. 19 Plaintiff raises a smattering of other arguments regarding the private nature of 20 Facebook groups, none of which is persuasive. The Court does not find much significance 21 in Plaintiff’s repeated assertion that once a Facebook group is created as “private,” it can 22 never be transformed to be “public.” (Doc. 18 at ¶ 26). The nominal designation of the 23 group does not determine whether the communications are readily accessible to the general 24 public. Indeed, the administrators of these two private groups could presumably change the 25 entry criteria; for example, they could make the requirements much more stringent, or they 26 could reduce them to a check box reminiscent of the facts in Snow. See 450 F.3d at 1321. 27 Plaintiff urges the Court to consider only the privacy status of the groups at the time of her 28 postings, not the risk that such status may change; however, the legal question is not what 1 her expectation of privacy was when posting, but rather, whether her communications 2 were, in fact, “readily accessible to the public.” See In re Innovatio IP Ventures, LLC 3 Patent Litig., 886 F. Supp. 2d 888, 894 (N.D. Ill. 2012) (“the public’s expectation of 4 privacy in a particular communication is irrelevant to the application of the Wiretap Act as 5 currently written.”).3 Plaintiff may have wanted her posts to be seen only by the members 6 of these two private groups (32,400 members of Ahwatukee411 and 930 of PARC); but 7 that is irrelevant to the question of whether her posts were, in fact, readily accessible to the 8 general public. 9 Plaintiff also points the Court to a recent FTC Settlement with Facebook, under 10 which Facebook was prohibited from disclosing “nonpublic user information” to third 11 parties without meeting certain requirements not relevant here. (Doc. 18 at ¶ 30). The FTC 12 defined “nonpublic user information” as “any user profile information . . . or user- 13 generated content . . . that is restricted by one or more Privacy Setting(s).” (Id.) Plaintiff 14 argues her posts were “nonpublic user information” under this definition and urges the 15 Court to import that definition to the analysis here. However, as an initial matter, the FTC 16 Settlement terms are irrelevant to the question of whether Plaintiff’s communications were 17 readily accessible to the general public.4 Moreover, the FTC definition actually serves to 18 highlight the weakness in Plaintiff’s allegations: Plaintiff did not allege that she restricted 19 any of her content to certain users (for example, through any of her own privacy settings), 20 but instead alleged that she posted in a group with a membership she did not control or 21 oversee—a membership which could (and did) change without her permission or 22 knowledge. See Ehling, 961 F. Supp. 2d at 668 (“Cases interpreting the [Wiretap Act and 23 Stored Communications Act] confirm that information is protectable as long as the 24 communicator actively restricts the public from accessing the information.”). While the 25 3 The statute does include an analysis of the speaker’s expectation of privacy when an oral 26 communication is at issue. 18 U.S.C. § 2510(2). However, “there is no comparable requirement for electronic communications.” Lane v. Brocq, No. 15-C-6177, 2016 WL 27 1271051, at *7 (N.D. Ill. Mar. 28, 2016) (citing 18 U.S.C. § 2510(12)). 4 Additionally, while it may be true that Defendant’s conduct violated Facebook’s terms 28 and policies against scraping data, that likewise does not necessarily impact whether or not Plaintiff’s posts were “readily accessible to the general public.” 1 number of users who can access the information may not be dispositive, see id., it is at least 2 relevant that Plaintiff purposefully posted her content to a group with over 32,400 members 3 in one case and over 930 in another. See Margolies v. Rudolph, No. 21-CV-2447-SJB, 2022 4 WL 2062460, at *7 (E.D.N.Y. June 6, 2022) (a private Facebook group with over 14,000 5 members “has the character of ‘a place open to the public,’ because it has no meaningful 6 barriers to entry—to join one need only agree to the rules of the group—and its members 7 appear to be free to speak online about any subject openly”).5 8 Accepting as true all the facts alleged by Plaintiff in her First Amended Complaint, 9 a question of the extent of privacy is raised. On the one hand, the Facebook groups were 10 nominally private and had entry requirements that included a questionnaire asking for 11 detailed information about the prospective member’s interest in the community. On the 12 other hand, Plaintiff had no control over whom the administrators allowed into the groups, 13 or whether they would change their entrance criteria at any point to be more or less 14 stringent. The groups had vast membership (over 32,400 members in Ahwatukee411, and 15 over 930 in PARC). And while the questionnaire, as alleged, presented a higher barrier to 16 entry here than there was in Snow (which required acknowledging a potential member had 17 no affiliation with DirecTV) or Margolies (which required agreeing to the rules of the 18 group), the current allegations appear to show that anyone, anywhere, with an internet 19 connection and an interest in the community, could join the groups, unlike the non-public 20 communications in Konop and Tori-Belle Cosmetics. 21 For these reasons, Plaintiff has failed to plausibly allege that her electronic 22 communications posted into the private Facebook groups were not readily accessible by 23 the general public. Accordingly, Plaintiff’s claims under the Wiretap Act and the Stored 24 Communications Act (Claims I-III) will be dismissed with one final opportunity to amend. 25 Should Plaintiff choose to amend, she should allege the information that was elicited by 26 the questionnaires and, if possible, whether any individuals were denied entry after filling 27 5 Margolies did not arise under the Wiretap Act or Stored Communications Act but was 28 analyzing a Facebook group in the context of a defamation claim. 2022 WL 2062460, at *4-7. 1 out the questionnaires. 2 B. Invasion of Privacy Claim (Count IV) 3 Plaintiff’s fourth claim is for common law invasion of privacy or intrusion on 4 seclusion. (Doc. 18 at ¶¶ 96-107). A claim for intrusion upon seclusion or invasion of 5 privacy requires the Plaintiff to prove: (i) an intentional intrusion, physically or otherwise, 6 upon the solitude or seclusion of another or his private affairs or concerns; and (ii) that the 7 intrusion would be highly offensive to a reasonable person. Hart v. Seven Resorts, Inc., 8 190 Ariz. 272, 279 (Ct. App. 1997) (citing Restatement (Second) of Torts § 652B). The 9 first element requires “(a) an actual, subjective expectation of seclusion or solitude in the 10 place, conversation, or matter, and (b) that the expectation was objectively reasonable.” 11 Med. Lab’y Mgmt. Consultants v. Am. Broad. Cos., Inc., 306 F.3d 806, 812 (9th Cir. 2002). 12 Plaintiff alleges she had a subjective expectation of privacy in her posts in the 13 private groups. (Doc. 18 at ¶¶ 99, 102). She alleges she believed the posts would only be 14 seen by other (genuine) members of the private groups, not by a company pretending to be 15 such a member. (See id.) Regardless of her subjective expectation, the Court has little 16 trouble concluding that any such expectation was not objectively reasonable. As an initial 17 matter, as discussed extensively above, Plaintiff herself has not alleged that she took any 18 steps to maintain “a private seclusion” around her “person or affairs.” Restatement 19 (Second) of Torts § 652B cmt. c (1977). Rather, she posted her communications in a 20 Facebook group of over 32,400 people and in another group of over 930 people, both of 21 which were administered by third parties she did not control or oversee. Plaintiff argues 22 her expectation of privacy was reasonable because: (i) the groups were designated as 23 “private” and required filling out a questionnaire to be admitted; (ii) the FTC settlement’s 24 definition of “nonpublic user information” arguably covers the private groups; and (iii) and 25 Defendant’s alleged conduct violated Facebook’s terms and conditions. None of those 26 factors, nor all three combined, however, renders her expectation of privacy in these groups 27 objectively reasonable. Indeed, Plaintiff’s first amended complaint acknowledges that 28 Facebook’s Frequently Asked Questions includes a warning that “[u]nauthorized scraping 1 is often done in a way that disguises the activity so that it blends in with ordinary usage.” 2 (Doc. 18 at ¶ 29). That could be read as a statement that Plaintiff should have expected 3 “scraping” and further distribution of her posts. Thus, if anything, Plaintiff and other users 4 should have been on notice that posting in a group with a large membership, even if 5 nominally identified as private, was not a sphere of seclusion, but instead a forum where 6 hundreds or thousands of people could interact based on entry criteria set by a third party 7 that could change at any time. These private groups were not places of seclusion “thrown 8 about” or maintained by Plaintiff. See id. Compare Restatement (Second) of Torts § 652B 9 cmt. b (1977) (listing examples of intrusion on seclusion, such as looking into one’s 10 window with binoculars, tapping telephone wires, opening private mail, searching his safe 11 or wallet, examining his private bank account, etc.). 12 Thus, this claim must also be dismissed. And it appears unlikely Plaintiff will able 13 to allege additional facts that would render her expectation of privacy was objectively 14 reasonable. However, in an abundance of caution the Court will allow Plaintiff to amend 15 this claim as well. 16 IV. CONCLUSION 17 For the reasons above, the Court finds Plaintiff’s claims under the Federal Wiretap 18 Act and the Stored Communications Act must be dismissed. The communications in the 19 two private Facebook groups here were not protected by those statutes. Additionally, 20 Plaintiff’s claim for invasion of privacy must also be dismissed. 21 Accordingly, 22 … 23 … 24 … 25 … 26 … 27 … 28 … 1 IT IS ORDERED Defendant’s motion to dismiss (Doc. 20) is GRANTED. 2|| Plaintiffs clams are DISMISSED WITH LEAVE TO AMEND. Plaintiff shall file an 3 || amended complaint no later than thirty days from this order. The Clerk of Court is directed to enter judgment in favor of Defendant if no amended complaint is filed by that date. 5 Dated this 24th day of January, 2023. 6 fo . 7 ‘ —— .

9 Senior United States District Judge 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

-17-