1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 7 ELENA LEANOS, Case No. 25-cv-07893-EMC
8 Plaintiff, ORDER GRANTING MOTION TO 9 v. DISMISS
10 BETTER HOME & FINANCE HOLDING COMPANY, Docket No. 17 11 Defendant. 12 13 14 Plaintiff Elena Leanos brings a putative class action against Defendant Better Home & 15 Finance Holding Company for alleged violations of federal and state privacy laws. Plaintiff 16 alleges her communications with Defendant through its website to apply for a home loan were 17 illegally intercepted by LinkedIn and Google (not named as defendants). Defendant moves to 18 dismiss on all counts for untimeliness, lack of Article III standing, and failure to state a claim. 19 Having considered the parties’ briefs and oral arguments, the Court hereby GRANTS 20 Defendant’s Motion to Dismiss. 21 22 I. BACKGROUND 23 A. Facts 24 Defendant owns and operates a website through which consumers can apply for mortgage 25 financing and related services. Compl. ¶ 2 (Dkt. 1). To apply for Defendant’s financial products, 26 such as “mortgages, loans, and insurance quotes,” consumers must visit the Website’s home page, 27 which contains links to the application. Id.; Jonsson Decl. ISO MTD ¶ 5 (Dkt. 34). ] included a link to Defendant’s Privacy Policy, located at the bottom right corner of the Website’s 2 || footer, directly under a bold heading labeled “Legal.” Jonsson Decl. {§ 6, 9 (Dkt. 34); Fraietta 3 Decl. § 5 (Dkt. 35). The phrase “Privacy Policy” appeared in gray text, and when a user hovered 4 || their cursor over the text, the text became underlined, “indicating that it was a hyperlink” that the 5 || user could click to view the operative Privacy Policy. Jonsson Decl. 4§ 6, 7 (Dkt. 34). 6 7 Better Contact Us Company Lega!
jy Heo st ovens sendin 10 2a 1] _
12 Plaintiff created an account on the Website using her Gmail account around January, 2022. 13 Compl. 5. She filled out and submitted a loan application to “[g]et cash from [her] home.” /d. 14 || 490 at Fig. 4. In her application, she provided the address of the property she planned to borrow 15 || based off of, that this property was an investment property and a condo, and that her credit score 16 was in the range of 700-719. /d. at Fig. 7,9, 11, 13. 17 During the time Plaintiff used the Website, she had accounts with LinkedIn and Google, Zz 18 || under her “full name.” /d. § 6. She accessed the Website and applied for a loan with Defendant 19 || using the same device and browser used to access her Gmail and LinkedIn accounts. /d. Plaintiff 20 || alleges that unbeknownst to her, Defendant integrated LinkedIn Insight Tag, Google Analytics, 21 and DoubleClick (collectively “Tracking Technologies”) into the Website. /d. § 31. 22 Specifically, Plaintiff claims that these Tracking Technologies, which are “JavaScript- 23 based” codes, are embedded into the Website’s Source Code, which “is a set of instructions that 24 || commands the website visitor’s browser to take certain actions when the web page first loads or 25 || when a specified event triggers the code.” Jd. 43, 59, 69. Because Source Code “may also 26 || command a web browser to send data transmissions to third parties in the form of HTTP Requests 27 || quietly executed in the background without notifying the web browser’s user,” Plaintiff claims 28 || that “Defendant is essentially handing its users a tapped device” that “intercepts” communications
1 “intended only for the Defendant and transmits those communications” to LinkedIn and Google. 2 Id. ¶¶ 60, 71. 3 These Tracking Technologies collect, inter alia, a user’s IP address and device 4 information, allowing LinkedIn and Google “to know the identities of specific individuals as well 5 as information related to the financial services they are receiving.” Id. ¶¶ 75, 92. In particular, 6 Plaintiff claims that these Technologies collected the information she supplied to Defendant for 7 her loan application, including the address of the property she planned to borrow based off of, that 8 this property was an investment property and a condo, and her credit score range of 700-719. Id. 9 at Fig. 7, 9, 11, 13. LinkedIn, Google, and the Defendant allegedly “profit from this information 10 for targeted advertising purposes.” Id. ¶ 92. Plaintiff alleges that the information collected 11 “lead[s] to harassing targeted advertising.” Id. ¶ 99. Plaintiff does not allege if she herself 12 received targeted advertising, and if so, when. 13 14 B. Claims 15 Plaintiff brings four causes of action under the Electronic Communications Privacy Act 16 (“ECPA”), the California Invasion of Privacy Act (“CIPA”), and the California Constitution. In 17 Count One, Plaintiff alleges that Defendant violated the ECPA by intentionally intercepting 18 Plaintiff’s communications “in real time” and using her confidential information for targeted 19 advertising purposes. Id. ¶¶ 129–131. In Count Two, Plaintiff alleges that Defendant violated 20 CIPA Section 631(a) by, willfully and without the Plaintiff’s consent, aiding LinkedIn and Google 21 to read Plaintiff’s communications with Defendant while in transit. Id. ¶¶ 146–151. In Count 22 Three, Plaintiff alleges that Defendant violated CIPA Section 632 by intentionally and without her 23 consent, using “an electronic amplifying or recording device,” which are Google and LinkedIn’s 24 “Tracking Technologies,” to record Plaintiff’s “confidential communications” with Defendant. 25 Id. ¶¶ 156, 161–165. In Count Four, Plaintiff alleges that Defendant violated their duty to keep 26 Plaintiff’s financial and personal information confidential, resulting in an invasion of privacy 27 under the California Constitution. Id. ¶¶ 171–174. 1 ¶ 109. The Nationwide Class includes all “natural persons in the United States with LinkedIn 2 and/or Google accounts” who “accessed the Website and applied for one of Defendant’s financial 3 products” through the Website during an undefined class period. Id. The California Subclass 4 includes all “natural persons in the State of California with LinkedIn and/or Google accounts” 5 who “accessed the Website and applied for one of Defendant’s financial products” through the 6 Website during an undefined class period. Id. 7 Defendant has moved to dismiss on all four counts for failure to state a claim, as well as 8 for lack of Article III standing and untimeliness. MTD (Dkt. 17). Defendant also filed a Request 9 for Judicial Notice of Exhibits A–C. Req. Judicial Notice (“RJN”) (Dkt. 17-1). 10 11 II. LEGAL STANDARD 12 To overcome a Rule 12(b)(6) Motion to Dismiss after the Supreme Court’s decisions in 13 Ashcroft v. Iqbal, 556 U.S. 662 (2009) (Iqbal) and Bell Atlantic Corporation v. Twombly, 550 U.S. 14 544 (2007) (Twombly), a plaintiff’s “factual allegations [in the complaint] ‘must . . . suggest that 15 the claim has at least a plausible chance of success.’” Levitt v. Yelp! Inc., 765 F.3d 1123, 1135 16 (9th Cir. 2014). The court “accept[s] factual allegations in the complaint as true and construe[s] 17 the pleadings in the light most favorable to the nonmoving party.” Manzarek v. St. Paul Fire & 18 Marine Ins. Co., 519 F.3d 1025, 1031 (9th Cir. 2008) (Manzarek). But “allegations in a complaint 19 . . . may not simply recite the elements of a cause of action [and] must contain sufficient 20 allegations of underlying facts to give fair notice and to enable the opposing party to defend itself 21 effectively.” Levitt, 765 F.3d at 1135 (quoting Eclectic Props. E., LLC v. Marcus & Millichap 22 Co., 751 F.3d 990, 996 (9th Cir. 2014)).
Free access — add to your briefcase to read the full text and ask questions with AI
1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 7 ELENA LEANOS, Case No. 25-cv-07893-EMC
8 Plaintiff, ORDER GRANTING MOTION TO 9 v. DISMISS
10 BETTER HOME & FINANCE HOLDING COMPANY, Docket No. 17 11 Defendant. 12 13 14 Plaintiff Elena Leanos brings a putative class action against Defendant Better Home & 15 Finance Holding Company for alleged violations of federal and state privacy laws. Plaintiff 16 alleges her communications with Defendant through its website to apply for a home loan were 17 illegally intercepted by LinkedIn and Google (not named as defendants). Defendant moves to 18 dismiss on all counts for untimeliness, lack of Article III standing, and failure to state a claim. 19 Having considered the parties’ briefs and oral arguments, the Court hereby GRANTS 20 Defendant’s Motion to Dismiss. 21 22 I. BACKGROUND 23 A. Facts 24 Defendant owns and operates a website through which consumers can apply for mortgage 25 financing and related services. Compl. ¶ 2 (Dkt. 1). To apply for Defendant’s financial products, 26 such as “mortgages, loans, and insurance quotes,” consumers must visit the Website’s home page, 27 which contains links to the application. Id.; Jonsson Decl. ISO MTD ¶ 5 (Dkt. 34). ] included a link to Defendant’s Privacy Policy, located at the bottom right corner of the Website’s 2 || footer, directly under a bold heading labeled “Legal.” Jonsson Decl. {§ 6, 9 (Dkt. 34); Fraietta 3 Decl. § 5 (Dkt. 35). The phrase “Privacy Policy” appeared in gray text, and when a user hovered 4 || their cursor over the text, the text became underlined, “indicating that it was a hyperlink” that the 5 || user could click to view the operative Privacy Policy. Jonsson Decl. 4§ 6, 7 (Dkt. 34). 6 7 Better Contact Us Company Lega!
jy Heo st ovens sendin 10 2a 1] _
12 Plaintiff created an account on the Website using her Gmail account around January, 2022. 13 Compl. 5. She filled out and submitted a loan application to “[g]et cash from [her] home.” /d. 14 || 490 at Fig. 4. In her application, she provided the address of the property she planned to borrow 15 || based off of, that this property was an investment property and a condo, and that her credit score 16 was in the range of 700-719. /d. at Fig. 7,9, 11, 13. 17 During the time Plaintiff used the Website, she had accounts with LinkedIn and Google, Zz 18 || under her “full name.” /d. § 6. She accessed the Website and applied for a loan with Defendant 19 || using the same device and browser used to access her Gmail and LinkedIn accounts. /d. Plaintiff 20 || alleges that unbeknownst to her, Defendant integrated LinkedIn Insight Tag, Google Analytics, 21 and DoubleClick (collectively “Tracking Technologies”) into the Website. /d. § 31. 22 Specifically, Plaintiff claims that these Tracking Technologies, which are “JavaScript- 23 based” codes, are embedded into the Website’s Source Code, which “is a set of instructions that 24 || commands the website visitor’s browser to take certain actions when the web page first loads or 25 || when a specified event triggers the code.” Jd. 43, 59, 69. Because Source Code “may also 26 || command a web browser to send data transmissions to third parties in the form of HTTP Requests 27 || quietly executed in the background without notifying the web browser’s user,” Plaintiff claims 28 || that “Defendant is essentially handing its users a tapped device” that “intercepts” communications
1 “intended only for the Defendant and transmits those communications” to LinkedIn and Google. 2 Id. ¶¶ 60, 71. 3 These Tracking Technologies collect, inter alia, a user’s IP address and device 4 information, allowing LinkedIn and Google “to know the identities of specific individuals as well 5 as information related to the financial services they are receiving.” Id. ¶¶ 75, 92. In particular, 6 Plaintiff claims that these Technologies collected the information she supplied to Defendant for 7 her loan application, including the address of the property she planned to borrow based off of, that 8 this property was an investment property and a condo, and her credit score range of 700-719. Id. 9 at Fig. 7, 9, 11, 13. LinkedIn, Google, and the Defendant allegedly “profit from this information 10 for targeted advertising purposes.” Id. ¶ 92. Plaintiff alleges that the information collected 11 “lead[s] to harassing targeted advertising.” Id. ¶ 99. Plaintiff does not allege if she herself 12 received targeted advertising, and if so, when. 13 14 B. Claims 15 Plaintiff brings four causes of action under the Electronic Communications Privacy Act 16 (“ECPA”), the California Invasion of Privacy Act (“CIPA”), and the California Constitution. In 17 Count One, Plaintiff alleges that Defendant violated the ECPA by intentionally intercepting 18 Plaintiff’s communications “in real time” and using her confidential information for targeted 19 advertising purposes. Id. ¶¶ 129–131. In Count Two, Plaintiff alleges that Defendant violated 20 CIPA Section 631(a) by, willfully and without the Plaintiff’s consent, aiding LinkedIn and Google 21 to read Plaintiff’s communications with Defendant while in transit. Id. ¶¶ 146–151. In Count 22 Three, Plaintiff alleges that Defendant violated CIPA Section 632 by intentionally and without her 23 consent, using “an electronic amplifying or recording device,” which are Google and LinkedIn’s 24 “Tracking Technologies,” to record Plaintiff’s “confidential communications” with Defendant. 25 Id. ¶¶ 156, 161–165. In Count Four, Plaintiff alleges that Defendant violated their duty to keep 26 Plaintiff’s financial and personal information confidential, resulting in an invasion of privacy 27 under the California Constitution. Id. ¶¶ 171–174. 1 ¶ 109. The Nationwide Class includes all “natural persons in the United States with LinkedIn 2 and/or Google accounts” who “accessed the Website and applied for one of Defendant’s financial 3 products” through the Website during an undefined class period. Id. The California Subclass 4 includes all “natural persons in the State of California with LinkedIn and/or Google accounts” 5 who “accessed the Website and applied for one of Defendant’s financial products” through the 6 Website during an undefined class period. Id. 7 Defendant has moved to dismiss on all four counts for failure to state a claim, as well as 8 for lack of Article III standing and untimeliness. MTD (Dkt. 17). Defendant also filed a Request 9 for Judicial Notice of Exhibits A–C. Req. Judicial Notice (“RJN”) (Dkt. 17-1). 10 11 II. LEGAL STANDARD 12 To overcome a Rule 12(b)(6) Motion to Dismiss after the Supreme Court’s decisions in 13 Ashcroft v. Iqbal, 556 U.S. 662 (2009) (Iqbal) and Bell Atlantic Corporation v. Twombly, 550 U.S. 14 544 (2007) (Twombly), a plaintiff’s “factual allegations [in the complaint] ‘must . . . suggest that 15 the claim has at least a plausible chance of success.’” Levitt v. Yelp! Inc., 765 F.3d 1123, 1135 16 (9th Cir. 2014). The court “accept[s] factual allegations in the complaint as true and construe[s] 17 the pleadings in the light most favorable to the nonmoving party.” Manzarek v. St. Paul Fire & 18 Marine Ins. Co., 519 F.3d 1025, 1031 (9th Cir. 2008) (Manzarek). But “allegations in a complaint 19 . . . may not simply recite the elements of a cause of action [and] must contain sufficient 20 allegations of underlying facts to give fair notice and to enable the opposing party to defend itself 21 effectively.” Levitt, 765 F.3d at 1135 (quoting Eclectic Props. E., LLC v. Marcus & Millichap 22 Co., 751 F.3d 990, 996 (9th Cir. 2014)). “A claim has facial plausibility when the Plaintiff pleads 23 factual content that allows the court to draw the reasonable inference that the Defendant is liable 24 for the misconduct alleged.” Iqbal, 556 U.S. at 678. “The plausibility standard is not akin to a 25 ‘probability requirement,’ but it asks for more than a sheer possibility that a defendant has acted 26 unlawfully.” Id. (quoting Twombly, 550 U.S. at 556).
27 1 III. DISCUSSION 2 A. Request for Judicial Notice 3 Defendant seeks judicial notice of Exhibits A–C. RJN at 1 (Dkt. 17-1). 4 • Exhibit A (Dk. 18-1): Property Appraiser Report prepared by Miami-Dade County 5 for the following address: 50 SW 10th Street, Miami, Florida, 33130, which is cited 6 in Figure 7 of the Complaint. 7 • Exhibit B (Dkt. 18-2): The LinkedIn Ads Agreement Terms and Conditions, as 8 they appeared publicly on LinkedIn’s website in and around January, 2022, which 9 states that LinkedIn “processes” personal data on Defendant’s behalf “subject to” 10 Defendant’s “instructions,” including to improve marketing services and find 11 “LinkedIn members probabilistically across devices.” 12 • Exhibit C (Dkt. 18-3): Better’s Privacy Policy, as it appeared publicly on 13 Defendant’s website in and around January, 2022. Defendant accessed the 14 submitted page through the Internet Archive’s Wayback Machine. Brandon Reilly 15 Decl. ¶ 4 (Dkt. 18). The first page of the Privacy Policy includes a section labeled 16 Information We Collect, which states: 17 When you use the Website, we and/or our subsidiaries (collectively 18 referred to herein as “we”, “us” or “our”) may collect personal information about you, such as your name, address, Social Security 19 number, telephone number, email address, asset information, income information, or any other information that you submit on applications 20 or other forms made available through the Website.
21 We may also collect personal information about you from third party sources, which we may combine with information that you provided 22 to us or we previously collected. For example, we may receive information from a social media service about you if you use a social 23 media account to log into the Website.
24 We also automatically collect certain information related to you and your activities on the Website when you visit the Website. This 25 information includes information such as your IP address, your internet browser and operating system type, the date and time of your 26 visit, and the website that referred you to us.
27 1 Federal Rule of Evidence 201(b)(2) allows a court to notice a fact that is “not subject to 2 reasonable dispute” because it “can be accurately and readily determined from sources whose 3 accuracy cannot reasonably be questioned.” Fed. R. Evid. 201(b)(2); see also Tellabs, Inc. v. 4 Makor Issues & Rts., Ltd., 551 U.S. 308, 322 (2007) (courts may consider judicially noticeable 5 documents at the motion to dismiss stage). “Just because the document itself is susceptible to 6 judicial notice does not mean that every assertion of fact within that document is judicially 7 noticeable for its truth.” Khoja v. Orexigen Therapeutics, Inc., 899 F.3d 988, 999 (9th Cir. 2018). 8 “If a court takes judicial notice of a document, it must identify the specific fact or facts it is 9 noticing from the document.” Turner v. Nuance Commc’ns, Inc., 735 F. Supp. 3d 1169, 1179 10 (N.D. Cal. 2024). 11 Exhibit A is a state government record subject to judicial notice for its existence and 12 content, but not for its truth. See Disabled Rts. Action Comm. v. Las Vegas Events Inc., 375 F.3d 13 861, 866 n.1 (9th Cir. 2004) (holding that a court “may take judicial notice of the records of state 14 agencies and other undisputed matters of public record”); see also Coal. for a Sustainable Delta v. 15 McCamman, 725 F. Supp. 2d 1162, 1183–84 (E.D. Cal. 2010) (finding that public records “are 16 subject to judicial notice under Federal Rule of Evidence 201 to prove their existence and content, 17 but not for the truth of the matters asserted therein”). Exhibits B and C are subject to limited 18 judicial notice as public webpages, the authenticity of which is not disputed, which were archived 19 through the Internet Archive’s Wayback Machine. The Court takes judicial notice of the existence 20 of these webpages and of the content publicly appearing on these pages as of January, 2022, but 21 not the truth of the content therein. See Children’s Health Def. v. Meta Platforms, Inc., 112 F.4th 22 742, 757 (9th Cir. 2024) (finding it proper for a court to take judicial notice of the fact that the 23 documents exist); see also Robinson v. Binello, 771 F. Supp. 3d 1114, 1127 (N.D. Cal. 2025) 24 (“Although the Court can take judicial notice of the webpages’ existence and content, it cannot 25 take judicial notice of the truth of any representations therein.”); Wang v. Zymergen Inc., 744 F. 26 Supp. 3d 995, 1006 (N.D. Cal. 2024) (“This request [for judicial notice] is granted, but only as to 27 the existence of the page and its contents and the fact that the page was saved by the Internet 1 B. Statute of Limitations 2 Plaintiff visited Defendant’s website in January, 2022 but did not file suit until September, 3 2025, more than three years later. All the causes of action asserted in this action have limitations 4 periods of two years or fewer. See 18 U.S.C. § 2520(e) (two-year limitations period for ECPA 5 claim); Cal. Civ. Proc. Code § 340(a) (one-year limitations period for CIPA claim); Cal. Civ. Proc. 6 Code § 335.1 (two-year limitations period for a California Constitution claim for an injury to an 7 individual “caused by the wrongful act” of another); see also Hart v. TWC Prod. & Tech. LLC, 8 526 F. Supp. 3d 592, 598–99 (N.D. Cal. 2021) (finding that a two-year statute of limitation applies 9 to a California constitutional invasion of privacy claim). Plaintiff’s claims are therefore time- 10 barred on their face unless a tolling doctrine applies. Plaintiff argues that the delayed discovery 11 doctrine applies to toll the limitations period.1 12 California’s discovery rule “postpones accrual of a cause of action until the plaintiff 13 discovers, or has reason to discover, the cause of action.” Fox v. Ethicon Endo-Surgery, Inc., 110 14 P.3d 914, 919 (Cal. 2005). A plaintiff has reason to discover a cause of action when he or she 15 “has reason at least to suspect a factual basis for its elements,” but the plaintiff “need not be aware 16 of the specific ‘facts’ necessary to establish the claim.” Id. (citing Norgart v. Upjohn Co., 981 17 P.2d 79, 88 (Cal. 1999)); accord Jolly v. Eli Lilly & Co., 751 P.2d 923, 928 (Cal. 1988). “The 18 discovery rule only delays accrual until the plaintiff has, or should have, inquiry notice of the 19 cause of action.” Fox, 110 P.3d at 920. This occurs “when a party discovered or should have 20 discovered that his or her injury had a wrongful cause.” Id. 21 “The discovery rule does not encourage dilatory tactics because plaintiffs are charged with 22 presumptive knowledge of an injury if they have ‘information of circumstances to put [them] on 23 inquiry’ or if they have ‘the opportunity to obtain knowledge from sources open to [their] 24
25 1 In the Complaint, Plaintiff asserted that any “applicable statutes of limitations have been tolled by Defendant’s knowing and active concealment of the Tracking Technologies into its Website.” 26 Compl. ¶ 100. While Defendant responded to this fraudulent concealment theory in their Motion to Dismiss, Plaintiff’s opposition only argued that the delayed discovery doctrine applies. Plaintiff 27 has thus waived a fraudulent concealment tolling theory. MTD, at 10–13 (Dkt. 17); Reply ISO 1 investigation.’” Id. (quoting Sanchez v. S. Hoover Hosp., 553 P.2d 1129, 1135 (Cal. 1976)); 2 accord Jolly, 751 P.2d at 927 (“A plaintiff is held to her actual knowledge as well as knowledge 3 that could reasonably be discovered through investigation of sources open to her.”). Charging 4 plaintiffs “with presumptive knowledge of the wrongful cause of an injury” is consistent with the 5 California legislature’s requirement that plaintiffs “pursue their claims diligently.” Fox, 110 P.3d 6 at 920. 7 To invoke the delayed discovery doctrine, a plaintiff must “specifically plead facts to show 8 (1) the time and manner of discovery and (2) the inability to have made earlier discovery despite 9 reasonable diligence.” Id. at 921 (citations omitted) (emphasis in original). “Formal averments or 10 general conclusions to the effect that the facts were not discovered until a stated date, and that 11 plaintiff could not reasonably have made an earlier discovery, are useless.” Bradler v. Craig, 79 12 Cal. Rptr. 401, 405 (Cal. Ct. App. 1969). It is the “plaintiff’s burden to establish ‘facts showing 13 that he was not negligent in failing to make the discovery sooner and that he had no actual or 14 presumptive knowledge of facts sufficient to put him on inquiry.’” Apr. Enters., Inc. v. KTTV, 195 15 Cal. Rptr. 421, 437 (Cal. Ct. App. 1983) (quoting Hobart v. Hobart Est. Co., 159 P.2d 958, 972 16 (Cal. 1945)). “In order to adequately allege facts supporting a theory of delayed discovery, the 17 plaintiff must plead that, despite diligent investigation of the circumstances [and fact] of the 18 injury, he or she could not have reasonably discovered facts supporting the cause of action within 19 the applicable statute of limitations period.” Fox, 110 P.3d at 920–21. Conclusory allegations of 20 diligence do not suffice; the plaintiff must “show diligence.” Id. at 921 (citations omitted). “The 21 question when a plaintiff actually discovered or reasonably should have discovered the facts for 22 purposes of the delayed discovery rule is a question of fact unless the evidence can only support 23 one reasonable conclusion.” Ovando v. County of Los Angeles, 71 Cal. Rptr. 3d 415, 429 (Cal. Ct. 24 App. 2008). 25 In online wiretapping cases involving third-party tracking technologies that are invisible to 26 a website user, courts typically find that a plaintiff’s reasonable diligence would not have revealed 27 the injury earlier if the defendant’s privacy policy actively misrepresented what personal 1 1255–56 (N.D. Cal. 2024) (holding that the defendant’s privacy policy could not “as a matter of 2 law, preclude application of the discovery rule” because the policy indicated “that the type of 3 personal and healthcare information at issue here would not be shared with third parties”) 4 (emphasis in original); Gaige v. Exer Holding Co., LLC, No. 2:24-cv-06099-AH-(AJRX), 2025 5 WL 559719, at *1, *3 (C.D. Cal. 2025) (finding plaintiff sufficiently alleged tolling as defendant’s 6 privacy policy “promised patients that it would keep patients’ personal information confidential,” 7 thereby keeping “secret” defendant’s disclosures to third parties). On the other hand, where the 8 privacy policy discloses the possibility of sharing information with third parties, courts have found 9 the delayed discovery rule inapplicable. See e.g., Saedi v. SPD Swiss Precision Diagnostics 10 GmbH, No. 2:24-cv-06525-WLH-E, 2025 WL 1141168, at *9–10 (C.D. Cal. Feb. 27, 2025) 11 (holding that where defendant’s privacy policy disclosed “the possibility that information may be 12 shared” with third parties, plaintiff could not invoke the delayed discovery doctrine). 13 At least one district court has suggested that plaintiffs have “inquiry notice” of their 14 injuries from third-party tracking technologies simply because they recognized that a website 15 collected their information. Javier v. Assurance IQ, LLC, 649 F. Supp. 3d 891, 902–03 (N.D. Cal. 16 2023) (“If [Plaintiff], by his own admission, was aware Assurance’s collection of his information 17 in January 2019, he also had constructive notice of the Privacy Policy.”) (sic). This suggests a 18 presumption that any time a user inputs information into a website, the user is placed on notice 19 that the website could be sharing their information, whether or not the website discloses such. 20 This Court declines to adopt such an expansive understanding of inquiry notice. The reasonable 21 diligence standard is a question of fact that should be analyzed on a case-by-case basis, not on 22 overbroad presumptions. The Court thus examines what “knowledge [] could reasonably be 23 discovered through investigation of sources open to [Plaintiff].” Jolly, 751 P.2d at 927. 24 Here, Defendant’s Privacy Policy states that Defendant “may collect personal 25 information,” such as “name, address, Social Security number, telephone number, email address, 26 asset information, income information, or any other information” submitted “on applications or 27 other forms made available through the Website.” Reilly Decl. ISO MTD, Ex. C at 2, (Dkt. 18-3). 1 be linked, directly or indirectly, with a particular consumer or device,” such as the “IP address,” 2 “[b]rowsing history,” and “search history”; (2) Defendant collects personal information “from 3 third party sources,” such as “a social media service” used “to log into the Website,” which 4 Defendant “may combine with information that you provided to us or we previously collected”; 5 (3) that Defendant uses “third-party cookies to serve targeted advertisements on both the Website 6 and on third-party websites,”; (4) that Defendant uses “personal information” for its “marketing 7 efforts.” Id. at 2–10. The Privacy Policy expressly discloses that Defendant “may share personal 8 information” with “partners with which we have marketing arrangements or to others that may 9 want to provide information to you about the products and services that they offer.” Id. at 4. 10 These disclosures in Defendant’s Privacy Policy encompass the very conduct that forms 11 the basis for Plaintiff’s claims — Defendant’s use of LinkedIn and Google’s Tracking 12 Technologies. Unlike in Doe and Gaige, where the defendant’s privacy policy either concealed or 13 actively misrepresented its collection and sharing of information, Defendant’s Privacy Policy here 14 contained information that would have put Plaintiff on notice as to her claims, as in Saedi. The 15 Privacy Policy was thus a source that would have revealed Plaintiff’s injury. The only remaining 16 question is whether this source was one that could “reasonably be discovered,” such that 17 California law attributes that knowledge to Plaintiff. Jolly, 751 P.2d at 927. 18 It is undisputed from the parties’ declarations that in order to fill out a loan application on 19 Defendant’s website, Plaintiff would have had to first visit the website’s homepage, where the 20 Privacy Policy was available as a link at the bottom of the page. Jonsson Decl. ¶¶ 6, 7, 9 (Dkt. 21 34); Fraietta Decl. ¶ 5 (Dkt. 35). Though the link to the Privacy Policy was in the same readable 22 size and color as the other links in the footer (such as “About Us,” “FAQ,” and “Careers”) and not 23 denoted in, e.g. blue font, which would have made it particularly conspicuous, the link was 24 identifiable as a hyperlink through hovertext. Jonsson Decl. ¶ 7 (Dkt. 34); id. Ex. A (Dkt. 34-1). 25 The fact that it was a hyperlink would have been obvious to the typical website visitor. Further, it 26 was located next to information such as “About Us” and “FAQ” which likely would have been of 27 interest to the website user. Furthermore, the link to the Privacy Policy appears at the bottom of 1 discoverable by Plaintiff in the exercise of due diligence, such that Plaintiff was chargeable with 2 presumptive knowledge of its contents when she visited the Website in 2022. See Fox, 110 P.3d 3 at 920. 4 In arguing otherwise, Plaintiff relies on circuit law regarding contract formation in online 5 arbitration agreements. Opp’n MTD, at 6–7 (Dkt. 25). Contract formation under California law 6 requires both “reasonable notice of the terms” and “a reasonable manifestation of assent to those 7 terms.” Oberstein v. Live Nation Ent., Inc., 60 F.4th 505, 512–13 (9th Cir. 2023) (emphasis 8 added) (citations omitted). The burden of showing such is placed on the party seeking to enforce 9 the contract/arbitration agreement. Id. at 513. In evaluating manifestations of assent, the Ninth 10 Circuit has disfavored “browsewraps” — wherein terms “are disclosed only through a hyperlink 11 and the user supposedly manifests assent to those terms simply by continuing to use the website,” 12 without having to click the hyperlink. Berman v. Freedom Fin. Network, LLC, 30 F.4th 849, 856 13 (9th Cir. 2022); see Nguyen v. Barnes & Noble, Inc., 763 F.3d 1171, 1176 (9th Cir. 2014). In 14 contrast, “clickwrap” agreements — where users must check a box explicitly stating ‘I agree’ to 15 terms in order to proceed — represent “the clearest manifestations of assent.” Oberstein, 60 F.4th 16 at 514 (citations omitted). 17 While this case presents circumstances which resemble more a browsewrap than a 18 clickwrap, such that the hyperlink would likely fail the conspicuous notice test for online 19 agreements to be contractually binding, that standard does not apply here. Defendant does not 20 seek to enforce a binding agreement against Plaintiff; rather, the issue is whether Plaintiff (in order 21 to avoid the statute of limitations bar) has demonstrated that even with the exercise of due 22 diligence, she would not have learned about Defendant’s Privacy Policy, which discloses that it 23 shares user information with third parties. The Court must determine whether the Privacy Policy 24 was reasonably discoverable by Plaintiff, not whether it was sufficiently conspicuous such that 25 Plaintiff should be contractually bound by its contents. Compare Jolly, 751 P.2d at 927 with 26 Berman, 30 F.4th at 856. To be sure, there are limits even in this context: a Privacy Policy could 27 be so hidden, inaccessible, or buried in prolix that it could not be considered reasonably ] was visible on each page Plaintiff visited in readable font, that is not the case here. 2 Plaintiff has failed to establish that she would not have learned about Defendant’s 3 disclosures about its user data sharing had she exercised reasonable diligence. See Fox, 110 P.3d 4 |} at 920-21. She cites no case where a court has applied the delayed discovery doctrine in 5 circumstances comparable to the case at bar. She thus cannot invoke the delayed discovery 6 || doctrine and her claims are untimely under all of the applicable statutes of limitation. 7 8 IV. CONCLUSION 9 The Court GRANTS Defendant’s Motion to Dismiss for untimeliness on all claims. 10 || Dismissal is with leave to amend. Any amended complaint shall be filed in 21 days. 1] %L IT IS SO ORDERED.
|) Dated: 4/9/2026
16 Ce EDWA® M. CHEN 17 United States District Judge 18 19 20 21 22 23 24 25 26 27 28