Elena Leanos v. Better Home & Finance Holding Company

Opinion

ELENA LEANOS, Case No. 25-cv-07893-EMC

Plaintiff, ORDER GRANTING MOTION TO v. DISMISS

COMPANY, Docket No. 17 Defendant. Plaintiff Elena Leanos brings a putative class action against Defendant Better Home & Finance Holding Company for alleged violations of federal and state privacy laws. Plaintiff alleges her communications with Defendant through its website to apply for a home loan were illegally intercepted by LinkedIn and Google (not named as defendants). Defendant moves to dismiss on all counts for untimeliness, lack of Article III standing, and failure to state a claim. Having considered the parties’ briefs and oral arguments, the Court hereby GRANTS Defendant’s Motion to Dismiss. A. Facts Defendant owns and operates a website through which consumers can apply for mortgage financing and related services. Compl. ¶ 2 (Dkt. 1). To apply for Defendant’s financial products, such as “mortgages, loans, and insurance quotes,” consumers must visit the Website’s home page, which contains links to the application. Id.; Jonsson Decl. ISO MTD ¶ 5 (Dkt. 34). ] included a link to Defendant’s Privacy Policy, located at the bottom right corner of the Website’s 2 footer, directly under a bold heading labeled “Legal.” Jonsson Decl. {§ 6, 9 (Dkt. 34); Fraietta 3 Decl. § 5 (Dkt. 35). The phrase “Privacy Policy” appeared in gray text, and when a user hovered 4 their cursor over the text, the text became underlined, “indicating that it was a hyperlink” that the 5 user could click to view the operative Privacy Policy. Jonsson Decl. 4§ 6, 7 (Dkt. 34). 6 7 Better Contact Us Company Lega!

jy Heo st ovens sendin 10 2a 1] _

12 Plaintiff created an account on the Website using her Gmail account around January, 2022. 13 Compl. 5. She filled out and submitted a loan application to “[g]et cash from [her] home.” /d. 14 490 at Fig. 4. In her application, she provided the address of the property she planned to borrow 15 based off of, that this property was an investment property and a condo, and that her credit score 16 was in the range of 700-719. /d. at Fig. 7,9, 11, 13. 17 During the time Plaintiff used the Website, she had accounts with LinkedIn and Google, Zz 18 || under her “full name.” /d. § 6. She accessed the Website and applied for a loan with Defendant 19 using the same device and browser used to access her Gmail and LinkedIn accounts. /d. Plaintiff 20 alleges that unbeknownst to her, Defendant integrated LinkedIn Insight Tag, Google Analytics, 21 and DoubleClick (collectively “Tracking Technologies”) into the Website. /d. § 31. 22 Specifically, Plaintiff claims that these Tracking Technologies, which are “JavaScript- 23 based” codes, are embedded into the Website’s Source Code, which “is a set of instructions that 24 commands the website visitor’s browser to take certain actions when the web page first loads or 25 when a specified event triggers the code.” Jd. 43, 59, 69. Because Source Code “may also 26 command a web browser to send data transmissions to third parties in the form of HTTP Requests 27 quietly executed in the background without notifying the web browser’s user,” Plaintiff claims 28 that “Defendant is essentially handing its users a tapped device” that “intercepts” communications

“intended only for the Defendant and transmits those communications” to LinkedIn and Google. Id. ¶¶ 60, 71. These Tracking Technologies collect, inter alia, a user’s IP address and device information, allowing LinkedIn and Google “to know the identities of specific individuals as well as information related to the financial services they are receiving.” Id. ¶¶ 75, 92. In particular, Plaintiff claims that these Technologies collected the information she supplied to Defendant for her loan application, including the address of the property she planned to borrow based off of, that this property was an investment property and a condo, and her credit score range of 700-719. Id. at Fig. 7, 9, 11, 13. LinkedIn, Google, and the Defendant allegedly “profit from this information for targeted advertising purposes.” Id. ¶ 92. Plaintiff alleges that the information collected “lead[s] to harassing targeted advertising.” Id. ¶ 99. Plaintiff does not allege if she herself received targeted advertising, and if so, when. B. Claims Plaintiff brings four causes of action under the Electronic Communications Privacy Act (“ECPA”), the California Invasion of Privacy Act (“CIPA”), and the California Constitution. In Count One, Plaintiff alleges that Defendant violated the ECPA by intentionally intercepting Plaintiff’s communications “in real time” and using her confidential information for targeted advertising purposes. Id. ¶¶ 129–131. In Count Two, Plaintiff alleges that Defendant violated CIPA Section 631(a) by, willfully and without the Plaintiff’s consent, aiding LinkedIn and Google to read Plaintiff’s communications with Defendant while in transit. Id. ¶¶ 146–151. In Count Three, Plaintiff alleges that Defendant violated CIPA Section 632 by intentionally and without her consent, using “an electronic amplifying or recording device,” which are Google and LinkedIn’s “Tracking Technologies,” to record Plaintiff’s “confidential communications” with Defendant. Id. ¶¶ 156, 161–165. In Count Four, Plaintiff alleges that Defendant violated their duty to keep Plaintiff’s financial and personal information confidential, resulting in an invasion of privacy under the California Constitution. Id. ¶¶ 171–174. ¶ 109. The Nationwide Class includes all “natural persons in the United States with LinkedIn and/or Google accounts” who “accessed the Website and applied for one of Defendant’s financial products” through the Website during an undefined class period. Id. The California Subclass includes all “natural persons in the State of California with LinkedIn and/or Google accounts” who “accessed the Website and applied for one of Defendant’s financial products” through the Website during an undefined class period. Id. Defendant has moved to dismiss on all four counts for failure to state a claim, as well as for lack of Article III standing and untimeliness. MTD (Dkt. 17). Defendant also filed a Request for Judicial Notice of Exhibits A–C. Req. Judicial Notice (“RJN”) (Dkt. 17-1). To overcome a Rule 12(b)(6) Motion to Dismiss after the Supreme Court’s decisions in Ashcroft v. Iqbal, 556 U.S. 662 (2009) (Iqbal) and Bell Atlantic Corporation v. Twombly, 550 U.S. 544 (2007) (Twombly), a plaintiff’s “factual allegations [in the complaint] ‘must . . . suggest that the claim has at least a plausible chance of success.’” Levitt v. Yelp! Inc., 765 F.3d 1123, 1135 (9th Cir. 2014). The court “accept[s] factual allegations in the complaint as true and construe[s] the pleadings in the light most favorable to the nonmoving party.” Manzarek v. St. Paul Fire & Marine Ins. Co., 519 F.3d 1025, 1031 (9th Cir. 2008) (Manzarek). But “allegations in a complaint . . . may not simply recite the elements of a cause of action [and] must contain sufficient allegations of underlying facts to give fair notice and to enable the opposing party to defend itself effectively.” Levitt, 765 F.3d at 1135 (quoting Eclectic Props. E., LLC v. Marcus & Millichap Co., 751 F.3d 990, 996 (9th Cir. 2014)). “A claim has facial plausibility when the Plaintiff pleads factual content that allows the court to draw the reasonable inference that the Defendant is liable for the misconduct alleged.” Iqbal, 556 U.S. at 678. “The plausibility standard is not akin to a ‘probability requirement,’ but it asks for more than a sheer possibility that a defendant has acted unlawfully.” Id. (quoting Twombly, 550 U.S. at 556).

A. Request for Judicial Notice Defendant seeks judicial notice of Exhibits A–C. RJN at 1 (Dkt. 17-1). • Exhibit A (Dk. 18-1): Property Appraiser Report prepared by Miami-Dade County for the following address: 50 SW 10th Street, Miami, Florida, 33130, which is cited in Figure 7 of the Complaint. • Exhibit B (Dkt. 18-2): The LinkedIn Ads Agreement Terms and Conditions, as they appeared publicly on LinkedIn’s website in and around January, 2022, which states that LinkedIn “processes” personal data on Defendant’s behalf “subject to” Defendant’s “instructions,” including to improve marketing services and find “LinkedIn members probabilistically across devices.” • Exhibit C (Dkt. 18-3): Better’s Privacy Policy, as it appeared publicly on Defendant’s website in and around January, 2022. Defendant accessed the submitted page through the Internet Archive’s Wayback Machine. Brandon Reilly Decl. ¶ 4 (Dkt. 18). The first page of the Privacy Policy includes a section labeled Information We Collect, which states: When you use the Website, we and/or our subsidiaries (collectively referred to herein as “we”, “us” or “our”) may collect personal information about you, such as your name, address, Social Security number, telephone number, email address, asset information, income information, or any other information that you submit on applications or other forms made available through the Website.

We may also collect personal information about you from third party sources, which we may combine with information that you provided to us or we previously collected. For example, we may receive information from a social media service about you if you use a social media account to log into the Website.

We also automatically collect certain information related to you and your activities on the Website when you visit the Website. This information includes information such as your IP address, your internet browser and operating system type, the date and time of your visit, and the website that referred you to us.

Federal Rule of Evidence 201(b)(2) allows a court to notice a fact that is “not subject to reasonable dispute” because it “can be accurately and readily determined from sources whose accuracy cannot reasonably be questioned.” Fed. R. Evid. 201(b)(2); see also Tellabs, Inc. v. Makor Issues & Rts., Ltd., 551 U.S. 308, 322 (2007) (courts may consider judicially noticeable documents at the motion to dismiss stage). “Just because the document itself is susceptible to judicial notice does not mean that every assertion of fact within that document is judicially noticeable for its truth.” Khoja v. Orexigen Therapeutics, Inc., 899 F.3d 988, 999 (9th Cir. 2018). “If a court takes judicial notice of a document, it must identify the specific fact or facts it is noticing from the document.” Turner v. Nuance Commc’ns, Inc., 735 F. Supp. 3d 1169, 1179 (N.D. Cal. 2024). Exhibit A is a state government record subject to judicial notice for its existence and content, but not for its truth. See Disabled Rts. Action Comm. v. Las Vegas Events Inc., 375 F.3d 861, 866 n.1 (9th Cir. 2004) (holding that a court “may take judicial notice of the records of state agencies and other undisputed matters of public record”); see also Coal. for a Sustainable Delta v. McCamman, 725 F. Supp. 2d 1162, 1183–84 (E.D. Cal. 2010) (finding that public records “are subject to judicial notice under Federal Rule of Evidence 201 to prove their existence and content, but not for the truth of the matters asserted therein”). Exhibits B and C are subject to limited judicial notice as public webpages, the authenticity of which is not disputed, which were archived through the Internet Archive’s Wayback Machine. The Court takes judicial notice of the existence of these webpages and of the content publicly appearing on these pages as of January, 2022, but not the truth of the content therein. See Children’s Health Def. v. Meta Platforms, Inc., 112 F.4th 742, 757 (9th Cir. 2024) (finding it proper for a court to take judicial notice of the fact that the documents exist); see also Robinson v. Binello, 771 F. Supp. 3d 1114, 1127 (N.D. Cal. 2025) (“Although the Court can take judicial notice of the webpages’ existence and content, it cannot take judicial notice of the truth of any representations therein.”); Wang v. Zymergen Inc., 744 F. Supp. 3d 995, 1006 (N.D. Cal. 2024) (“This request [for judicial notice] is granted, but only as to the existence of the page and its contents and the fact that the page was saved by the Internet B. Statute of Limitations Plaintiff visited Defendant’s website in January, 2022 but did not file suit until September, 2025, more than three years later. All the causes of action asserted in this action have limitations periods of two years or fewer. See 18 U.S.C. § 2520(e) (two-year limitations period for ECPA claim); Cal. Civ. Proc. Code § 340(a) (one-year limitations period for CIPA claim); Cal. Civ. Proc. Code § 335.1 (two-year limitations period for a California Constitution claim for an injury to an individual “caused by the wrongful act” of another); see also Hart v. TWC Prod. & Tech. LLC, 526 F. Supp. 3d 592, 598–99 (N.D. Cal. 2021) (finding that a two-year statute of limitation applies to a California constitutional invasion of privacy claim). Plaintiff’s claims are therefore time- barred on their face unless a tolling doctrine applies. Plaintiff argues that the delayed discovery doctrine applies to toll the limitations period.1 California’s discovery rule “postpones accrual of a cause of action until the plaintiff discovers, or has reason to discover, the cause of action.” Fox v. Ethicon Endo-Surgery, Inc., 110 P.3d 914, 919 (Cal. 2005). A plaintiff has reason to discover a cause of action when he or she “has reason at least to suspect a factual basis for its elements,” but the plaintiff “need not be aware of the specific ‘facts’ necessary to establish the claim.” Id. (citing Norgart v. Upjohn Co., 981 P.2d 79, 88 (Cal. 1999)); accord Jolly v. Eli Lilly & Co., 751 P.2d 923, 928 (Cal. 1988). “The discovery rule only delays accrual until the plaintiff has, or should have, inquiry notice of the cause of action.” Fox, 110 P.3d at 920. This occurs “when a party discovered or should have discovered that his or her injury had a wrongful cause.” Id. “The discovery rule does not encourage dilatory tactics because plaintiffs are charged with presumptive knowledge of an injury if they have ‘information of circumstances to put [them] on inquiry’ or if they have ‘the opportunity to obtain knowledge from sources open to [their]

1 In the Complaint, Plaintiff asserted that any “applicable statutes of limitations have been tolled by Defendant’s knowing and active concealment of the Tracking Technologies into its Website.” Compl. ¶ 100. While Defendant responded to this fraudulent concealment theory in their Motion to Dismiss, Plaintiff’s opposition only argued that the delayed discovery doctrine applies. Plaintiff has thus waived a fraudulent concealment tolling theory. MTD, at 10–13 (Dkt. 17); Reply ISO investigation.’” Id. (quoting Sanchez v. S. Hoover Hosp., 553 P.2d 1129, 1135 (Cal. 1976)); accord Jolly, 751 P.2d at 927 (“A plaintiff is held to her actual knowledge as well as knowledge that could reasonably be discovered through investigation of sources open to her.”). Charging plaintiffs “with presumptive knowledge of the wrongful cause of an injury” is consistent with the California legislature’s requirement that plaintiffs “pursue their claims diligently.” Fox, 110 P.3d at 920. To invoke the delayed discovery doctrine, a plaintiff must “specifically plead facts to show (1) the time and manner of discovery and (2) the inability to have made earlier discovery despite reasonable diligence.” Id. at 921 (citations omitted) (emphasis in original). “Formal averments or general conclusions to the effect that the facts were not discovered until a stated date, and that plaintiff could not reasonably have made an earlier discovery, are useless.” Bradler v. Craig, 79 Cal. Rptr. 401, 405 (Cal. Ct. App. 1969). It is the “plaintiff’s burden to establish ‘facts showing that he was not negligent in failing to make the discovery sooner and that he had no actual or presumptive knowledge of facts sufficient to put him on inquiry.’” Apr. Enters., Inc. v. KTTV, 195 Cal. Rptr. 421, 437 (Cal. Ct. App. 1983) (quoting Hobart v. Hobart Est. Co., 159 P.2d 958, 972 (Cal. 1945)). “In order to adequately allege facts supporting a theory of delayed discovery, the plaintiff must plead that, despite diligent investigation of the circumstances [and fact] of the injury, he or she could not have reasonably discovered facts supporting the cause of action within the applicable statute of limitations period.” Fox, 110 P.3d at 920–21. Conclusory allegations of diligence do not suffice; the plaintiff must “show diligence.” Id. at 921 (citations omitted). “The question when a plaintiff actually discovered or reasonably should have discovered the facts for purposes of the delayed discovery rule is a question of fact unless the evidence can only support one reasonable conclusion.” Ovando v. County of Los Angeles, 71 Cal. Rptr. 3d 415, 429 (Cal. Ct. App. 2008). In online wiretapping cases involving third-party tracking technologies that are invisible to a website user, courts typically find that a plaintiff’s reasonable diligence would not have revealed the injury earlier if the defendant’s privacy policy actively misrepresented what personal 1255–56 (N.D. Cal. 2024) (holding that the defendant’s privacy policy could not “as a matter of law, preclude application of the discovery rule” because the policy indicated “that the type of personal and healthcare information at issue here would not be shared with third parties”) (emphasis in original); Gaige v. Exer Holding Co., LLC, No. 2:24-cv-06099-AH-(AJRX), 2025 WL 559719, at *1, *3 (C.D. Cal. 2025) (finding plaintiff sufficiently alleged tolling as defendant’s privacy policy “promised patients that it would keep patients’ personal information confidential,” thereby keeping “secret” defendant’s disclosures to third parties). On the other hand, where the privacy policy discloses the possibility of sharing information with third parties, courts have found the delayed discovery rule inapplicable. See e.g., Saedi v. SPD Swiss Precision Diagnostics GmbH, No. 2:24-cv-06525-WLH-E, 2025 WL 1141168, at *9–10 (C.D. Cal. Feb. 27, 2025) (holding that where defendant’s privacy policy disclosed “the possibility that information may be shared” with third parties, plaintiff could not invoke the delayed discovery doctrine). At least one district court has suggested that plaintiffs have “inquiry notice” of their injuries from third-party tracking technologies simply because they recognized that a website collected their information. Javier v. Assurance IQ, LLC, 649 F. Supp. 3d 891, 902–03 (N.D. Cal. 2023) (“If [Plaintiff], by his own admission, was aware Assurance’s collection of his information in January 2019, he also had constructive notice of the Privacy Policy.”) (sic). This suggests a presumption that any time a user inputs information into a website, the user is placed on notice that the website could be sharing their information, whether or not the website discloses such. This Court declines to adopt such an expansive understanding of inquiry notice. The reasonable diligence standard is a question of fact that should be analyzed on a case-by-case basis, not on overbroad presumptions. The Court thus examines what “knowledge [] could reasonably be discovered through investigation of sources open to [Plaintiff].” Jolly, 751 P.2d at 927. Here, Defendant’s Privacy Policy states that Defendant “may collect personal information,” such as “name, address, Social Security number, telephone number, email address, asset information, income information, or any other information” submitted “on applications or other forms made available through the Website.” Reilly Decl. ISO MTD, Ex. C at 2, (Dkt. 18-3). be linked, directly or indirectly, with a particular consumer or device,” such as the “IP address,” “[b]rowsing history,” and “search history”; (2) Defendant collects personal information “from third party sources,” such as “a social media service” used “to log into the Website,” which Defendant “may combine with information that you provided to us or we previously collected”; (3) that Defendant uses “third-party cookies to serve targeted advertisements on both the Website and on third-party websites,”; (4) that Defendant uses “personal information” for its “marketing efforts.” Id. at 2–10. The Privacy Policy expressly discloses that Defendant “may share personal information” with “partners with which we have marketing arrangements or to others that may want to provide information to you about the products and services that they offer.” Id. at 4. These disclosures in Defendant’s Privacy Policy encompass the very conduct that forms the basis for Plaintiff’s claims — Defendant’s use of LinkedIn and Google’s Tracking Technologies. Unlike in Doe and Gaige, where the defendant’s privacy policy either concealed or actively misrepresented its collection and sharing of information, Defendant’s Privacy Policy here contained information that would have put Plaintiff on notice as to her claims, as in Saedi. The Privacy Policy was thus a source that would have revealed Plaintiff’s injury. The only remaining question is whether this source was one that could “reasonably be discovered,” such that California law attributes that knowledge to Plaintiff. Jolly, 751 P.2d at 927. It is undisputed from the parties’ declarations that in order to fill out a loan application on Defendant’s website, Plaintiff would have had to first visit the website’s homepage, where the Privacy Policy was available as a link at the bottom of the page. Jonsson Decl. ¶¶ 6, 7, 9 (Dkt. 34); Fraietta Decl. ¶ 5 (Dkt. 35). Though the link to the Privacy Policy was in the same readable size and color as the other links in the footer (such as “About Us,” “FAQ,” and “Careers”) and not denoted in, e.g. blue font, which would have made it particularly conspicuous, the link was identifiable as a hyperlink through hovertext. Jonsson Decl. ¶ 7 (Dkt. 34); id. Ex. A (Dkt. 34-1). The fact that it was a hyperlink would have been obvious to the typical website visitor. Further, it was located next to information such as “About Us” and “FAQ” which likely would have been of interest to the website user. Furthermore, the link to the Privacy Policy appears at the bottom of discoverable by Plaintiff in the exercise of due diligence, such that Plaintiff was chargeable with presumptive knowledge of its contents when she visited the Website in 2022. See Fox, 110 P.3d at 920. In arguing otherwise, Plaintiff relies on circuit law regarding contract formation in online arbitration agreements. Opp’n MTD, at 6–7 (Dkt. 25). Contract formation under California law requires both “reasonable notice of the terms” and “a reasonable manifestation of assent to those terms.” Oberstein v. Live Nation Ent., Inc., 60 F.4th 505, 512–13 (9th Cir. 2023) (emphasis added) (citations omitted). The burden of showing such is placed on the party seeking to enforce the contract/arbitration agreement. Id. at 513. In evaluating manifestations of assent, the Ninth Circuit has disfavored “browsewraps” — wherein terms “are disclosed only through a hyperlink and the user supposedly manifests assent to those terms simply by continuing to use the website,” without having to click the hyperlink. Berman v. Freedom Fin. Network, LLC, 30 F.4th 849, 856 (9th Cir. 2022); see Nguyen v. Barnes & Noble, Inc., 763 F.3d 1171, 1176 (9th Cir. 2014). In contrast, “clickwrap” agreements — where users must check a box explicitly stating ‘I agree’ to terms in order to proceed — represent “the clearest manifestations of assent.” Oberstein, 60 F.4th at 514 (citations omitted). While this case presents circumstances which resemble more a browsewrap than a clickwrap, such that the hyperlink would likely fail the conspicuous notice test for online agreements to be contractually binding, that standard does not apply here. Defendant does not seek to enforce a binding agreement against Plaintiff; rather, the issue is whether Plaintiff (in order to avoid the statute of limitations bar) has demonstrated that even with the exercise of due diligence, she would not have learned about Defendant’s Privacy Policy, which discloses that it shares user information with third parties. The Court must determine whether the Privacy Policy was reasonably discoverable by Plaintiff, not whether it was sufficiently conspicuous such that Plaintiff should be contractually bound by its contents. Compare Jolly, 751 P.2d at 927 with Berman, 30 F.4th at 856. To be sure, there are limits even in this context: a Privacy Policy could be so hidden, inaccessible, or buried in prolix that it could not be considered reasonably ] was visible on each page Plaintiff visited in readable font, that is not the case here. 2 Plaintiff has failed to establish that she would not have learned about Defendant’s 3 disclosures about its user data sharing had she exercised reasonable diligence. See Fox, 110 P.3d 4 } at 920-21. She cites no case where a court has applied the delayed discovery doctrine in 5 circumstances comparable to the case at bar. She thus cannot invoke the delayed discovery 6 doctrine and her claims are untimely under all of the applicable statutes of limitation. 7 9 The Court GRANTS Defendant’s Motion to Dismiss for untimeliness on all claims. 10 Dismissal is with leave to amend. Any amended complaint shall be filed in 21 days. 1] %L IT IS SO ORDERED.

) Dated: 4/9/2026

16 Ce EDWA® M. CHEN 17 United States District Judge 18 19 20 21 22 23 24 25 26 27 28