1 2 3 4 5 6 7 8 UNITED STATES DISTRICT COURT 9 NORTHERN DISTRICT OF CALIFORNIA 10 San Francisco Division 11 AUDRA GRAHAM and STACY MOISE, Case No. 20-cv-06903-LB individually and on behalf of all others 12 similarly situated, ORDER GRANTING DEFENDANTS’ MOTIONS TO DISMISS 13 Plaintiffs, Re: ECF No. 35, 36 14 v.
15 NOOM, INC., and FULLSTORY, INC., 16 Defendants.
17 INTRODUCTION 18 Noom is a web application that helps its users lose weight and lead healthier lifestyles. Noom 19 uses FullStory’s software (called “session replay”) to record what visitors are doing on the Noom 20 website, such as their keystrokes, mouse clicks, and page scrolling, thereby allowing a full picture 21 of the user’s website interactions.1 Noom contends that the software improves its website design 22 and the user’s experience. The plaintiffs — on behalf of a putative California class — claim that 23 FullStory is illegally wiretapping their communications with Noom (and Noom is aiding and 24 25 26
27 1 First Am. Compl. (FAC) – ECF No. 27 at 2 (¶ 1 & n.1 (citing NOOM, https://www.noom.com)), 5–11 (¶¶ 18–32, 38). Citations refer to material in the Electronic Case File (ECF); pinpoint citations are to the 1 abetting that eavesdropping) in violation of their right to privacy under California’s Invasion of 2 Privacy Act (CIPA) and the California Constitution.2 3 Noom and FullStory moved to dismiss the claims, in part on the ground that FullStory — as 4 Noom’s vendor for analyzing its website traffic — was a party to the communication (and not an 5 eavesdropper). FullStory also contends that the court lacks personal jurisdiction because it has no 6 forum-related conduct.3 The plaintiffs do not plausibly plead that FullStory eavesdropped on their 7 communications with Noom and instead plead only that FullStory is Noom’s vendor for software 8 services. They thus do not meet their prima facie burden to establish specific jurisdiction over 9 FullStory, and they do not plausibly plead wiretapping in violation of California law. 10 11 STATEMENT 12 The next sections describe how FullStory’s software works, how the plaintiffs used Noom’s 13 website (and what information FullStory’s software captured), and the case’s procedural history. 14 15 1. FullStory’s Software 16 FullStory is a Delaware corporation headquartered in Atlanta, Georgia.4 It provides software to 17 its clients (including Noom) to capture and analyze data so that the clients can see how visitors are 18 using their websites.5 The clients put FullStory’s code on their websites to capture the data, and 19 then they can review the data, which is stored in the cloud on FullStory’s servers.6 The software 20 records visitor data such as keystrokes, mouse clicks, and page scrolling. Through a function 21 22 23 2 Id. at 2 (¶¶ 1–2), 5 (¶ 18), 11 (¶ 45), 16–21 (¶¶ 64–93); Mot. – ECF No. 36 at 8 (citing id. at 5 (¶ 18)). 24 3 Mots. – ECF Nos. 35 & 36. 25 4 FAC – ECF No. 27 at 3–4 (¶ 10). 26 5 Id. at 5 (¶ 18), 11 (¶ 39). 6 Id. at 4 (¶ 11) (FullStory is a “marketing software-as-a-service” company), 8 (¶ 29) (FullStory 27 records information locally in the user’s browser in real time, transmits the information to FullStory’s servers every few seconds, and “makes the information available to its clients”), 11 (¶ 38) (Noom pays 1 called Session Replay, FullStory’s clients can see a “playback” of any visitor’s session. If the 2 visitor is still on the site, the clients can see the session live.7 3 A video example of a session is on FullStory’s website and shows a fictional user “flipping 4 through” FullStory’s Definitive Guide to Session Replay. The accompanying marketing materials 5 say, “Notice how you can see interactions, mouse movements, clicks, interactions with overlays, 6 and more — and everything is listed in order in a stream at the right side of the replay. This is 7 what a session replay looks like in a FullStory app.”8 8 9 2. The Plaintiffs’ Use of Noom’s Website 10 The plaintiffs are California citizens and residents, and Noom is a Delaware company 11 headquartered in New York, New York. The plaintiffs browsed Noom’s website (from California) 12 to investigate Noom’s “diet offerings.”9 FullStory’s Session Replay function “created a video 13 capturing [their] keystrokes and mouse clicks on the website . . . and also captured the date and 14 time of their visits, the duration of the visits, [their] IP addresses, their locations at the time of the 15 visits, their browser types, and the operating system on their devices.”10 16 “When users access [] Noom’s website, they fill out a form and enter PII [personally 17 identifiable information] and PHI [protected health information],” and FullStory’s software 18 “captures these electronic communications . . . [e]ven if users do not complete the form.” The 19 captured PII and PHI includes — in addition to the information in the last paragraph — height, 20 weight, gender, age, diet and exercise habits, some medical information, and email addresses.11 21 22 23 24
25 7 Id. at 8 (¶¶ 26–30). 26 8 Id. at 5–6 (¶¶ 21–23) (emphasis omitted). 9 Id. at 2–3 (¶¶ 4–6). 27 10 Id. at 11 (¶ 43). 1 3. Procedural History 2 The plaintiffs’ amended complaint has three claims: (1) wiretapping, in violation of Cal. Penal 3 Code § 631(a); (2) the sale of eavesdropping software, in violation of Cal. Penal Code § 635(a); and 4 (3) invasion of privacy under California’s Constitution.12 The putative class is “all California 5 residents who visited Noom.com, and whose electronic communications were intercepted or recorded 6 by FullStory.”13 All parties consented to magistrate jurisdiction.14 The parties do not dispute that 7 there is subject-matter jurisdiction under the Class Action Fairness Act, 28 U.S.C. § 1332(d)(2)(A).15 8 Noom and FullStory moved to dismiss the case.16 The court held a hearing on April 8, 2021. 9 10 STANDARDS OF REVIEW 11 1. Rule 12(b)(1) 12 A complaint must contain a short and plain statement of the ground for the court’s jurisdiction. 13 Fed. R. Civ. P. 8(a)(1). The plaintiffs have the burden of establishing jurisdiction. Kokkonen v. 14 Guardian Life Ins. Co. of Am., 511 U.S. 375, 377 (1994); Farmers Ins. Exch. v. Portage La 15 Prairie Mut. Ins. Co., 907 F.2d 911, 912 (9th Cir. 1990). 16 A defendant’s Rule 12(b)(1) jurisdictional attack can be either facial or factual. White v. Lee, 227 17 F.3d 1214, 1242 (9th Cir. 2000). “A ‘facial’ attack asserts that a complaint’s allegations are 18 themselves insufficient to invoke jurisdiction, while a ‘factual’ attack asserts that the complaint’s 19 allegations, though adequate on their face to invoke jurisdiction, are untrue.” Courthouse News Serv. 20 v. Planet, 750 F.3d 776, 780 n.3 (9th Cir. 2014). This is a facial attack.17 The court thus “accept[s] all 21 allegations of fact in the complaint as true and construe[s] them in the light most favorable to the 22 plaintiff[].” Warren v. Fox Family Worldwide, Inc., 328 F.3d 1136, 1139 (9th Cir. 2003). 23
24 12 Id. at 16–21 (¶¶ 64–93). 25 13 Id. at 15 (¶ 57). 26 14 Consents – ECF Nos. 6, 16, 24. 15 FAC – ECF No. 27 at 4 (¶ 13). 27 16 Mots. – ECF Nos. 35–36. 1 The defendants contend that the plaintiffs lack standing. Standing pertains to the court’s subject- 2 matter jurisdiction and thus is properly raised in a Rule 12(b)(1) motion to dismiss. Chandler v. 3 State Farm Mut. Auto. Ins. Co., 598 F.3d 1115, 1121–22 (9th Cir. 2010) (citation omitted). 4 A court should dismiss a complaint without leave to amend only if the jurisdictional defect cannot 5 be cured by amendment. Eminence Capital, LLC v. Aspeon, Inc., 316 F.3d 1048, 1052 (9th Cir. 2003). 6 7 2. Rule 12(b)(2) 8 “In opposing a defendant’s motion to dismiss for lack of personal jurisdiction, the plaintiff 9 bears the burden of establishing that jurisdiction is proper.” Ranza v. Nike, Inc., 793 F.3d 1059, 10 1068 (9th Cir. 2015) (cleaned up and quotation omitted). The parties may submit, and the court 11 may consider, declarations and other evidence outside the pleadings in determining whether it has 12 personal jurisdiction. Doe v. Unocal Corp., 248 F.3d 915, 922 (9th Cir. 2001), abrogated on other 13 grounds as recognized in Williams v. Yamaha Motor Co., 851 F.3d 1015, 1024 (9th Cir. 2001). 14 “Where, as here, the defendant’s motion is based on written materials rather than an 15 evidentiary hearing, the plaintiff need only make a prima facie showing of jurisdictional facts to 16 withstand the motion to dismiss.” Ranza, 793 F.3d at 1068 (cleaned up and quotation omitted). 17 “Uncontroverted allegations must be taken as true, and conflicts between parties over statements 18 contained in affidavits must be resolved in the plaintiff’s favor.” Id. (cleaned up and quotation 19 omitted). But courts “may not assume the truth of allegations in a pleading which are contradicted 20 by affidavit[.]” Mavrix Photo, Inc. v. Brand Techs., Inc., 647 F.3d 1218, 1223 (9th Cir. 2011) 21 (cleaned up and quotation omitted); accord Ranza, 793 F.3d at 1068 (“A plaintiff may not simply 22 rest on the bare allegations of the complaint.”) (cleaned up and quotation omitted). 23 24 3. Rule 12(b)(6) 25 A complaint must contain a “short and plain statement of the claim showing that the pleader is 26 entitled to relief” to give the defendant “fair notice” of what the claims are and the grounds upon 27 which they rest. Fed. R. Civ. P. 8(a)(2); Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007). A 1 grounds of his entitlement to relief requires more than labels and conclusions, and a formulaic 2 recitation of the elements of a cause of action will not do. Factual allegations must be enough to 3 raise a claim for relief above the speculative level.” Twombly, 550 U.S. at 555 (cleaned up). 4 To survive a motion to dismiss, a complaint must contain sufficient factual allegations, which 5 when accepted as true, “state a claim to relief that is plausible on its face.” Ashcroft v. Iqbal, 556 6 U.S. 662, 678 (2009) (quoting Twombly, 550 U.S. at 570). “A claim has facial plausibility when 7 the plaintiff pleads factual content that allows the court to draw the reasonable inference that the 8 defendant is liable for the misconduct alleged.” Id. “The plausibility standard is not akin to a 9 ‘probability requirement,’ but it asks for more than a sheer possibility that a defendant has acted 10 unlawfully.” Id. (citing Twombly, 550 U.S. at 557). “Where a complaint pleads facts that are 11 merely consistent with a defendant’s liability, it stops short of the line between possibility and 12 plausibility of ‘entitlement to relief.’” Id. (cleaned up) (quoting Twombly, 550 U.S. at 557). 13 A court should dismiss a complaint with leave to amend unless the “pleading could not possibly 14 be cured by the allegation of other facts.” United States v. United Healthcare Ins. Co., 848 F.3d 1161, 15 1182 (9th Cir. 2016) (cleaned up). 16 ANALYSIS 17 Both defendants contend that the plaintiffs do not state statutory or constitutional claims for 18 invasion of their privacy. There are three invasion-of-privacy claims: (1) eavesdropping in violation 19 of CIPA, Cal. Penal Code § 631(a); (2) sale of eavesdropping software, in violation of CIPA, Cal. 20 Penal Code § 635(a); and (3) invasion of privacy in violation of California’s Constitution. In addition, 21 Noom contends that the plaintiffs lack standing to pursue injunctive relief, and FullStory contends 22 that it has no forum-related contacts (and there thus is no personal jurisdiction). Because the plaintiffs 23 do not plausibly plead FullStory’s wiretapping, the court dismisses the claims, holds that they did not 24 meet their prima facie burden to establish specific personal jurisdiction over FullStory, and dismisses 25 the claim for injunctive relief. 26 27 1. Section 631(a) Claim Any person [1] who, by means of any machine, instrument, or contrivance, or in any other 1 manner, intentionally taps, or makes any unauthorized connection . . . with any telegraph 2 or telephone wire, line, cable, or instrument, . . . or [2] who willfully and without consent of all parties to the communication, or in any unauthorized manner, reads, or attempts to 3 read, or to learn the contents or meaning of any message, report, or communication while the same is in transit or passing over any wire, line, or cable, or is being sent from, or 4 received at any place within this state, or [3] who uses, or attempts to use, in any manner, or for any purpose, or to communicate in any way, any information so obtained, or [4] who 5 aids, agrees with, employs, or conspires with any person or persons to unlawfully do, or 6 permit, or cause to be done any of the acts or things mentioned above . . . . 7 Cal. Penal Code § 631(a). The defendants moved to dismiss the claim on three grounds: (1) there is 8 no wrongful eavesdropping; (2) the claim rests in part on the collection of information that is not 9 protected content; and (3) Noom’s privacy policy discloses the data collection. 10 1.1 Eavesdropping 11 Under section 631(a), if a person secretly listens to another’s conversation, the person is liable. 12 Ribas v. Clark, 38 Cal. 3d 355, 359 (1985). Only a third party can listen to a conversation secretly. 13 Rogers v. Ulrich, 52 Cal. App. 3d 894, 899 (1975). By contrast, a party to a communication can 14 record it (and is not eavesdropping when it does). Id. at 897–99; In re Facebook, Inc. Internet 15 Tracking Litig., 956 F.3d 589, 607 (9th Cir. 2020), cert. denied, No. 20-727 (U.S. Mar. 22, 2021). 16 The parties do not dispute that if Noom and Noom users were the only parties to the 17 communications, then Noom would not be liable under section 631(a). But the plaintiffs contend 18 that FullStory is not a party to the communications and thus is liable for recording them, and Noom 19 is liable for aiding and abetting that eavesdropping.18 20 In another case in this district, the plaintiffs’ counsel predicated a section 631(a) claim on the 21 same theory. Revitch v. New Moosejaw, LLC, No. 18-cv-06827-VC, 2019 WL 5485330, at *1 (N.D. 22 Cal. Oct. 23, 2019). The Moosejaw plaintiff was a California resident and citizen who browsed 23 defendant Moosejaw’s website, where Moosejaw sells outdoor gear. Moosejaw imbedded defendant 24 NaviStone’s code in its website, enabling NaviStone — “an online marketing company and data 25 broker that deals in U.S. consumer data” — to collect visitor data such as keystrokes, mouse clicks, 26 27 18 Mot. – ECF No. 35 at 17–19; Mot. – ECF No. 36 at 12–13; Opp’n – ECF No. 39 at 9–12; Opp’n – 1 and page scrolling. NaviStone captured the data, de-anonymized it, and matched it with other 2 databases, thereby creating marketing databases of identified website visitors.19 3 The district court held that the allegations plausibly pleaded a section 631(a) claim that 4 NaviStone was a third-party eavesdropper. It rejected NaviStone’s contention that it received the 5 communications directly and therefore was a party to them: “it cannot be that anyone who receives 6 a direct signal escapes liability by becoming a party to the communication. Someone who presses 7 up against a door to listen to a conversation is no less an eavesdropper just because the sound waves 8 from the next room reach his ears directly.” And it held Moosejaw liable as an aider and abettor of 9 NaviStone’s wrongdoing. Id. at *1–2. 10 The plaintiffs contend that, applying Moosejaw, FullStory is not a party, it instead is a third 11 party that is liable for eavesdropping, and its contract with Noom does not make it any less of an 12 eavesdropper. As a result, they contend, Noom is liable for FullStory’s wrongdoing.20 But the 13 allegations about FullStory are different than the acts that courts hold plausibly support a claim of 14 surreptitious wiretapping by a third party. 15 In Moosejaw, for example, NaviStone was a marketing company that partnered with e- 16 commerce sites to intercept visitor data and create marketing databases of consumer information. In 17 Facebook, Facebook tracked its users to third-party websites (through Facebook’s code on the 18 websites) — even when its users were not signed into Facebook, and then it sold that data to 19 advertisers. 956 F.3d at 596, 607–08. NaviStone and Facebook were independent parties who mined 20 information from other websites and sold it: NaviStone through its code on participating e- 21 commerce sites and Facebook through its plug-ins on third-party sites. 22 By contrast, FullStory is a vendor that provides a software service that captures its clients’ data, 23 hosts it on FullStory’s servers, and allows the clients to analyze their data. Unlike NaviStone’s and 24 Facebook’s aggregation of data for resale, there are no allegations here that FullStory intercepted and 25 26 27 19 Revitch v. New Moosejaw, LLC, No. 18-cv-06827-VC, Second Am. Compl. – ECF No. 43 at 2 (¶ 1), 4–17 (¶¶ 9–46). 1 used the data itself. Instead, as a service provider, FullStory is an extension of Noom.21 It provides a 2 tool — like the tape recorder in Rogers — that allows Noom to record and analyze its own data in aid 3 of Noom’s business.22 See 52 Cal. App. 3d at 897–99. It is not a third-party eavesdropper. 4 As a result, Noom is not liable for aiding and abetting FullStory’s wrongdoing because there is 5 no wrongdoing. Cf. Moosejaw, 2019 WL 5485330 at *2. Moosejaw deserves emphasis here. In 6 holding Moosejaw plausibly liable for aiding and abetting NaviStone’s misconduct, the court 7 recognized that Moosejaw “cannot be liable for eavesdropping on its own communications” or 8 recording its own communications and sending them to NaviStone (because sharing a record is not 9 eavesdropping). Id. (citing Rogers, 52 Cal. App. 3d at 898; Ribas, 38 Cal. 3d at 360–61). But it 10 could be liable if it allowed the equivalent of permitting “an outsider to tap his telephone or listen in 11 on the call”). Id. (quoting Ribas, 38 Cal. 3d at 363). There is no equivalent of a wiretap here, which 12 supports the conclusion that FullStory is not a third-party eavesdropper. 13 1.2 Protected Content 14 The defendants also moved to dismiss on the ground that section 631(a) prohibits only the 15 unauthorized access of the content of communications, and the plaintiffs predicate their claim in 16 part on information — such as IP addresses, locations, browser types, and operating systems — 17 that is not content.23 The plaintiffs did not dispute that this information is not content but contend 18 that other website interactions are content.24 19 Section 631(a) prohibits the unauthorized access of the contents of any communications. Cal. 20 Penal Code § 631(a); Brodsky v. Apple Inc., 445 F. Supp. 3d 110, 127 (N.D. Cal. 2020). The 21 “contents” of a communication under CIPA and the federal Wiretap Act are the same. Brodsky, 445 22 23 21 Mot. – ECF No. 35 at 18 (making this argument); Reply – ECF No. 41 at 11 (same). 22 FullStory cites Javier v. Assurance IQ to support its argument. Reply – ECF No. 41 at 14 (citing No. 24 20-cv-02860-JSW, 2021 WL 940319, at *4 n.5 (N.D. Cal. Mar. 9, 2021)). The two Javier defendants were an online platform for insurance quotes and its software provider, which had a product that 25 allowed analysis of data (like the analysis here). 2021 WL 940319 at *1. The allegations did not plausibly plead a section 631(a) claim because “the complaint never alleges that [software provider] 26 ActiveProspect itself ever[] recorded or received his data, only that it provided a product by which Assurance did so.” Id. at *4 n.5. By contrast, here, FullStory transmitted the data to its servers. 27 23 Mot. – ECF No. 35 at 20; Mot. – ECF No. 36 at 15 n.2; Reply – ECF No. 41 at 14–16. 1 F. Supp. 3d at 127 (citation omitted). The “content” of a communication is “the intended message 2 conveyed by the communication.” In re Zynga Priv. Litig., 750 F.3d 1098, 1106 (9th Cir. 2014). It 3 does not include “record information regarding the characteristics of the message that is generated in 4 the course of the communication” such as “the name, address and subscriber number or identity of a 5 subscriber or customer.” Id. (cleaned up). Similarly, the origin, length, and time of a call, or 6 geolocation data are not content. United States v. Reed, 575 F.3d 900, 914–17 (9th Cir. 2009); S.D. v. 7 Hytto Ltd., No. 18-cv-00688-JSW, 2019 WL 8333519, at *6 (N.D. Cal. May 15, 2019). 8 Given the plaintiffs’ concessions, the court dismisses the claim to the extent that it is predicated 9 on non-content information. See Hytto, 2019 WL 8333519 at *7 (dismissing federal wiretapping 10 claim “to the extent the allegations concern the interception of date and time information”). In any 11 amended complaint, the plaintiffs can delineate content from non-content records. 12 1.3 Privacy Policy 13 FullStory also contends that Noom’s privacy policy discloses the possibility of data collection 14 and analysis.25 The plaintiffs counter that they could not consent to wiretapping that happened 15 when they accessed the website and before they could read the policy, notice was insufficient, and 16 the policy in any event did not disclose wiretapping.26 17 The privacy policy discloses that Noom “may use various methods and technologies” to store 18 or collect usage information, such as tracking technologies (that alter settings and configurations 19 on the user’s device), cookies, web beacons, and embedded scripts. 20 An embedded script is programming code that is designed to collect information about User’s interactions with the Website, Mobile App and Services, such as the links User 21 clicks on. The code is temporarily downloaded onto User’s Device from Noom’s web server and/or Mobile App or a third party service provider, is active only while User is 22 connected to the Website and/or Mobile App, and is deactivated or deleted thereafter.27 23 24 25 25 Mot. – ECF No. 35 at 21–22; Reply – ECF No. 41 at 17. 26 26 Opp’n – ECF No. 40 at 24–29. 27 27 Privacy Policy, Ex. A to Zhang Decl. – ECF No. 45-1 at 6. The court considers the privacy policy under the incorporation-by-reference doctrine. Knievel v. ESPN, 393 F.3d 1068, 1076 (9th Cir. 2005); 1 The privacy policy is available via a link at the bottom of Noom’s homepage and is in “small, 2 non-contrasting font (i.e. light grey against a white background). . . .” 3 Visitors to the website are given no notice and are not prompted to take any affirmative action to demonstrate assent. Visitors are not required to read or acknowledge the Privacy 4 Policy to use the website. In any event, by the time a website user visited the Privacy Policy, the [software] on Noom’s website will have already deployed.28 5 6 The parties largely talk past each other in their briefs. FullStory’s main argument is that to be 7 liable, its acts must be surreptitious, and given the policy’s disclosures, the plaintiffs did not plausibly 8 plead its surreptitious acts.29 The plaintiffs mainly argue traditional principles of consent (although 9 they also contend that the policy does not disclose wiretapping).30 FullStory counters that it never 10 argued traditional consent (although it points out in its reply that retroactive consent can be valid).31 11 The parties’ arguments about consent do not permit resolution of the issue. As to the adequacy 12 of the privacy policy’s disclosures, FullStory made a practical argument but did not cite cases to 13 support it. (Perhaps there are none.) Given the court’s holding that there is no wiretapping, the 14 issues — consent and the policy’s alleged failure to disclose wiretapping — are moot. On this 15 round of motions, the privacy policy is not a separate ground to dismiss the claim. 16 * * * 17 The court dismisses the section 631(a) claim with leave to amend. 18 19 2. Section 635(a) Claim 20 Section 635(a) defines the following behavior as a crime: 21 Every person who manufactures, assembles, sells, offers for sale, advertises for sale, possesses, transports, imports, or furnishes to another any device which is primarily or 22 exclusively designed or intended for eavesdropping upon the communication of another . . . shall be punished. . . . 23 24 Cal. Penal Code § 635(a). 25 26 28 FAC – ECF No. 27 at 12 (¶ 48). 29 Mot. – ECF No. 35 at 21–22. 27 30 Opp’n – ECF No. 40 at 24–29. 1 The defendants moved to dismiss on two grounds: (1) the plaintiffs were not injured and thus 2 do not have a private right of action under section 635(a) or Article III standing; and (2) 3 FullStory’s code is not a device designed primarily or exclusively for eavesdropping.32 4 First, the plaintiffs do not have a private right of action and lack Article III standing. 5 CIPA creates a private right of action for “any person who has been injured by a violation of this 6 chapter. . . .” Cal. Penal Code § 637.2(a). “It is not a necessary prerequisite to an action pursuant to 7 this section that the plaintiff has suffered, or be threatened with, actual damages.” Id. § 637.2(c). 8 The plaintiffs “do not base their standing on mere possession of a wiretapping device, but on 9 FullStory’s knowledge and active involvement in using that device to monitor [their] 10 communications.”33 Because there is no eavesdropping, there is no violation of CIPA. The plaintiffs 11 thus suffered no injury, and they have no private right of action. Id. § 637.2(a). 12 That means that they lack Article III standing too. If FullStory had eavesdropped on them, then 13 there would be concrete injury. Moosejaw, 2019 WL 5485330 at *1. But there is no plausible 14 eavesdropping, and thus there is “(1) [no] injury in fact, (2) that is fairly traceable to the challenged 15 conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.” 16 Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 1547 (2016) (citation omitted). 17 Second, at least one court assumed the truth of allegations that session-replay code is a “device 18 . . . is primarily or exclusively designed or intended for eavesdropping upon the communication of 19 another.” Cal. Penal Code § 635(a); Moosejaw, 2019 WL 5485330 at *3. Given the lack of a 20 private right of action or Article III standing, the court does not address the issue further. 21 22 23 24 25 26
27 32 Mot. – ECF No. 35 at 23–25; Mot. – ECF No. 36 at 15–18. 1 3. Invasion of Privacy Under California’s Constitution 2 The plaintiffs claim that the defendants intentionally invaded their privacy rights under the 3 California Constitution “by implementing FullStory’s wiretaps on Noom’s Website.”34 Because 4 there is no wiretap, the plaintiffs did not plausibly plead a legally protected privacy interest. 5 The elements of a claim for invasion of privacy under the California Constitution are “(1) the 6 [plaintiffs] possess a legally protected privacy interest, (2) they maintain a reasonable expectation 7 of privacy, and (3) the intrusion is ‘so serious as to constitute an egregious breach of social norms’ 8 such that the breach is ‘highly offensive.’” Facebook, 956 F.3d at 601 (quoting Hernandez v. 9 Hillsides, Inc., 47 Cal. 4th 272, 287 (2009)); Hill v. Nat’l Collegiate Athletic Ass’n, 7 Cal. 4th 1, 10 35–37 (1994). The first prong — “[w]hether a legally recognized privacy interest is present in a 11 given case [—] is a question of law to be decided by the court.” Hill, 7 Cal. 4th at 40. The second 12 and third prongs are “mixed questions of law and fact.” Id. 13 The plaintiffs do not complain that providing the information to Noom violates their privacy 14 rights. Their claim rests on their allegations that “[u]sers are never told that their electronic 15 communications are being wiretapped by FullStory.”35 They “allege [that] FullStory, with Noom’s 16 consent and participation, surreptitiously collected and stored highly sensitive PII and PHI in real 17 time.”36 They oppose the motion to dismiss the claim because “[t]his is a wiretapping case, and 18 Plaintiffs sufficiently allege that they did not know that a third party — FullStory — was secretly 19 recording their interactions with Noom’s website without Plaintiffs’ consent.”37 Because there was 20 no plausible wiretapping by FullStory, the plaintiffs did not plausibly plead that they possess a 21 legally protected privacy interest. Facebook, 956 F.3d at 601; Hernandez, 47 Cal. 4th at 287; Hill, 22 7 Cal. 4th at 35, 40. The court grants the motion to dismiss. 23 24 25 26 34 FAC – ECF No. 27 at 21 (¶¶ 88–89). 35 Opp’n – ECF No. 40 at 32 (quoting FAC – ECF No. 27 at 12 (¶ 47) and citing id. at 14 (¶ 53)). 27 36 Opp’n – ECF No. 39 at 17 (citing FAC – ECF No. 27 at 2 (¶ 1) & 11 (¶ 45)). 1 4. Standing to Seek Injunctive Relief 2 Noom moved to dismiss the claims for injunctive relief because the plaintiffs did not plead their 3 intent to use Noom’s platform in the future.38 The plaintiffs countered that Ms. Moise’s intent “is 4 reasonably inferred” and can be cured through amendment (and abandoned Ms. Graham’s claim).39 5 The court dismisses Ms. Graham’s claim with prejudice and Ms. Moise’s claim with leave to amend. 6 7 5. Personal Jurisdiction over FullStory 8 The plaintiffs have not met their prima facie burden to establish specific jurisdiction. 9 In diversity cases, “federal courts ordinarily follow state law in determining the bounds of their 10 jurisdiction over persons.” Picot v. Weston, 780 F.3d 1206, 1211 (9th Cir. 2015) (cleaned up). “The 11 general rule is that personal jurisdiction is proper if permitted by a long-arm statute and if the 12 exercise of that jurisdiction does not violate federal due process.” Pebble Beach v. Caddy, 453 F.3d 13 1151, 1154–55 (9th Cir. 2006) (analyzing California and federal long-arm statutes). “Because 14 California’s long-arm statute allows the exercise of personal jurisdiction to the full extent 15 permissible under the U.S. Constitution, a court’s inquiry centers on whether exercising jurisdiction 16 comports with due process.” Picot, 780 F.3d at 1211 (cleaned up and quotation omitted). The due- 17 process inquiry is whether the defendant has sufficient minimum contacts with the forum such that 18 the assertion of jurisdiction in the forum “‘does not offend traditional notions of fair play and 19 substantial justice.’” Pebble Beach, 453 F.3d at 1154–55 (quoting Int’l Shoe Co. v. Washington, 326 20 U.S. 310, 315 (1945)). 21 There are two types of personal jurisdiction: general and specific. Bristol-Myers Squibb Co. v. 22 Super. Ct., 137 S. Ct. 1773, 1779–80 (2017). The plaintiffs assert specific personal jurisdiction.40 “In 23 order for a state court to exercise specific jurisdiction, the suit must arise out of or relate to the 24 defendant’s contacts with the forum.” Id. at 1780 (cleaned up). “In other words, there must be an 25 26 38 Mot. – ECF No. 36 at 24–25. 27 39 Opp’n – ECF No. 39 at 22–23. 1 affiliation between the forum and the underlying controversy, principally, an activity or an 2 occurrence that takes place in the forum State and is therefore subject to the State’s regulation.” Id. 3 “For this reason, specific jurisdiction is confined to adjudication of issues deriving from, or 4 connected with, the very controversy that establishes jurisdiction.” Id. The Ninth Circuit employs a 5 three-prong test to assess whether a defendant has sufficient contacts with the forum to be subject to 6 specific personal jurisdiction: 7 (1) The non-resident defendant must purposefully direct his activities or consummate some transaction with the forum or resident thereof; or perform some act by which he purposefully 8 avails himself of the privilege of conducting activities in the forum, thereby invoking the benefits and protections of its laws; 9 (2) the claim must be one which arises out of or relates to the defendant’s forum-related 10 activities; and 11 (3) the exercise of jurisdiction must comport with fair play and substantial justice, i.e. it must be reasonable. 12 13 Picot, 780 F.3d at 1211. “The plaintiff has the burden of proving the first two prongs.” Id. at 1211– 14 12. “If he does so, the burden shifts to the defendant to set forth a compelling case that the exercise of 15 jurisdiction would not be reasonable.” Id. at 1212 (cleaned up). With respect to the first prong, courts 16 apply a “purposeful availment” analysis in suits sounding in contract and a “purposeful direction” 17 analysis (also known as the effects test) in suits sounding in tort. Schwarzenegger v. Fred Martin 18 Motor Co., 374 F.3d 797, 802 (9th Cir. 2004). The purposeful-direction test applies here.41 19 Under the Calder effects test, purposeful direction exists when a defendant commits an act 20 outside the forum that was intended to and does in fact cause injury in the forum, meaning, the 21 defendant must (1) commit an intentional act (2) expressly aimed at the forum (3) that causes harm 22 that the defendant knows is likely to be suffered in the forum. Calder v. Jones, 465 U.S. 783, 788– 23 89 (1984); Washington Shoe Co. v. A–Z Sporting Goods Inc., 704 F.3d 668, 673 (9th Cir. 2012) 24 (quoting Mavrix, 657 F.3d at 1228), abrogated on other grounds as recognized in Axiom Foods, 25 Inc. v. Acerchem Int’l, Inc., 874 F.3d 1064, 1069 (9th Cir. 2017). The effects test focuses on “the 26 forum in which the defendant’s acts were felt, whether or not the actions themselves occurred 27 1 within the forum.” Mavrix, 647 F.3d at 1228. “However, referring to the Ca/der test as an effects 2 || test can be misleading. For this reason, we have warned courts not to focus too narrowly on the 3 || test’s third prong — the effects prong — holding that something more is needed in addition to a 4 || mere foreseeable effect.” Pebble Beach, 453 F.3d at 1156 (cleaned up). 5 The allegations in the complaint establish only that FullStory is Noom’s vendor for a software 6 || service that Noom uses to analyze its data. A vendor’s selling a product to Noom — even if Noom 7 || has substantial business here and the vendor knew it — does not establish specific personal 8 || jurisdiction over the vendor.” The plaintiffs do not contest this point. Instead, they predicate 9 || jurisdiction on FullStory’s wiretapping. They allege that (1) “Defendants knew that a significant 10 || number of Californians would visit Noom’s website, because they form a significant portion of 11 Noom’s customer base,” and (2) “[b]y intercepting the transmissions of Noom website users, 12 || Defendants targeted their wrongful conduct at customers, some of whom Defendants knew, at least E 13 constructively, were residents of California,” thus causing harm in California. Their basis for 14 || jurisdiction is the wiretapping of those customers: “At least three courts have held the ‘intentional 3 15 act’ standard is easily satisfied where plaintiff alleges wiretapping claims.”*4 Because they did not 16 || plausibly plead wiretapping, the plaintiffs have not met their prima facie burden to establish specifi i 17 || personal jurisdiction. 18 CONCLUSION 19 The court dismisses the complaint with leave to amend within 21 days (except it dismisses Ms. 20 || Graham’s claim for injunctive relief with prejudice). Any amended complaint must attach a blackli 21 comparison between the current complaint and the amended complaint. 22 IT IS SO ORDERED. LAS 23 Dated: April 8, 2021 LAUREL BEELER 24 United States Magistrate Judge 25 || 42 FAC — ECF No. 27 at 3 (48), 4-5 ( 15). 27 43 ig at 4-5 (§ 15). 28 || * Opp’n—- ECF No. 40 at 11 (citing Hytto, 2019 WL 8333519 at *4, and two other cases).