Greenley v. Kochava, Inc.

• Court: District Court, S.D. California
• Decided: July 27, 2023
• Docket: 3:22-cv-01327
• Status: Unknown

Opinion

1 2 3 4 5 6 7 8 UNITED STATES DISTRICT COURT 9 SOUTHERN DISTRICT OF CALIFORNIA 10 11 DAVID GREENLEY, Case No. 22-cv-01327-BAS-AHG

12 Plaintiff, ORDER: 13 v. 1. GRANTING IN PART AND 14 KOCHAVA, INC., DENYING IN PART 15 Defendant. DEFENDANT’S MOTION TO DISMISS (ECF No. 11); AND 16

17 2. DENYING DEFENDANT’S MOTION FOR VENUE 18 TRANSFER (ECF No. 21) 19 20 21 Pending before the Court are two motions. First, Defendant moves to dismiss the 22 action pursuant to Federal Rule of Civil Procedure (“Rule”) 12(b)(1), asserting a lack of 23 standing, and Rule 12(b)(6), asserting a failure to state a claim upon which relief may be 24 granted. (MTD, ECF No. 11.) Second, Defendant moves to transfer venue pursuant to 28 25 U.S.C. § 1404(a). (Mot. Venue, ECF No. 21.) Having considered the parties’ filings, the 26 Court GRANTS IN PART and DENIES IN PART Defendant’s Motion to Dismiss 27 (ECF No. 11) and DENIES Defendant’s Motion for Venue Transfer (ECF No. 21). 28 1 BACKGROUND 2 I. Factual Background 3 Defendant is a “data broker[]” that provides a software developer kit (“SDK”) to 4 software application (“app”) developers “to assist them in developing their apps.” (Am. 5 Compl. ¶ 6, ECF No. 10.)1 In return, the app developers allow Defendant to 6 “surreptitiously intercept location data” from an app user (“user”) via its SDK. (Id.) 7 Defendant then sells “customized data feeds to its clients”—such as Airbnb, Disney+, 8 and Kroger—to “assist in advertising and analyzing foot traffic at stores or other 9 locations.” (Id. ¶¶ 7, 83.) In other words, Defendant coded its SDK for data collection 10 and embedded it in third-party apps; the SDK secretly collected app users’ data; and then 11 Defendant packaged that data and sold it to clients for advertising purposes. 12 Defendant is “able to deliver targeted advertising . . . by in essence ‘fingerprinting’ 13 each unique device and user, as well as connecting users across devices and devices 14 across users.” (Id. ¶ 75.) The data links longitude and latitude coordinates with these 15 fingerprints, which can be “easily de-anonymized.” (Id. ¶¶ 7–8.) In addition to 16 geolocation, Defendant collects “search terms, click choices, purchase decisions and/or 17 payment methods.” (Id. ¶ 125.) This data collection allows Defendant to deliver “targeted 18 advertising . . . while tracking [users’] locations, spending habits, and personal 19 characteristics” and share this “rich personal data simultaneously with untold numbers of 20 third-party companies.” (Id. ¶ 75.) 21 Plaintiff is a California resident filing a putative class action suit on behalf of 22 similarly situated California residents. (Id. ¶¶ 1, 35.) Plaintiff has installed and used apps 23 that have integrated Defendant’s SDK. (Id. ¶¶ 36–37.) As a result, Defendant has 24 collected “personal information,” geolocation data, and communications from his cellular 25 telephone. (Id. ¶ 23.) This geolocation data includes visits to “sensitive locations.” (Id. 26

27 1 These facts are taken from the Amended Complaint. The Court accepts as true all nonconclusory allegations set forth therein for the purpose of the Motion to Dismiss. See Safe Air for 28 1 ¶ 24.) Other data includes advertisement clicks; “specific communications from [] SDK- 2 installed apps such as consumer’s usernames, customer emails and customer IDs on their 3 Apple or Android cellular telephone devices”; “search terms used by a device user”; and 4 “a user’s activities within an app after it has been installed.” (Id. ¶¶ 76, 78–80.) 5 Plaintiff avers Defendant’s own conduct and statements demonstrate its 6 wrongdoing. In response to pressure from the Federal Trade Commission (“FTC”), 7 Defendant announced a “new feature that allegedly now blocks the gathering of private, 8 sensitive, location data related to health care facilities.” (Id. ¶ 105.) This “Privacy Block” 9 removes “health services location data from the Kochava Collective marketplace.” (Id.) 10 Plaintiff claims this new feature evidences that “Defendant recognizes the damage it has 11 done to California consumers.” (Id.) 12 In addition, Plaintiff alleges that Defendant has circumvented attempts to safeguard 13 users’ privacy. (Id. ¶¶ 71–73.) For example, Apple, Inc. (“Apple”), in response to 14 growing privacy concerns, created a framework that requires users to “affirmatively opt- 15 in to allowing Defendant and others to track their device unique identification number for 16 advertisers on their iPhones.” (Id. ¶¶ 68–69.) After Apple implemented this framework, 17 Defendant advertised that it collects identifying data “even after a consumer thinks [he 18 has] disabled all tracking by apps on an iPhone.” (Id. ¶ 73.) 19 II. Litigation Background 20 On August 12, 2022, Defendant filed a federal lawsuit against the FTC in the 21 District of Idaho. (Ex. A to Mariam Decl., ECF No. 21-4.) Defendant sought declaratory 22 relief that it did not violate any laws. (Id.) On August 29, 2022, the FTC filed a 23 Complaint against Defendant also in the District of Idaho. (Ex. B to Mariam Decl., ECF 24 No 21-5.) One week later, Plaintiff filed this lawsuit against Defendant. (ECF No. 1.) 25 Plaintiff alleges violations of the California Constitution, California Computer Data 26 Access and Fraud Act (“CDAFA”), California Invasion of Privacy Act (“CIPA”), 27 California Unfair Competition Law (“UCL”), and common law principles of unjust 28 enrichment. (Am. Compl.) Defendant then filed the present Motion to Dismiss. (MTD.) 1 Five months after Plaintiff filed his Complaint in this district, Cindy Murphy, a 2 Washington resident, filed a putative class action against Defendant in the District of 3 Idaho alleging unjust enrichment and violations of the Washington Consumer Protection 4 Act. (Ex. C to Mariam Decl., ECF No. 21-6.) After Ms. Murphy filed her lawsuit, 5 Defendant filed the present Motion to Change Venue in this action. (Mot. Venue.) 6 STANDING 7 I. Legal Standard 8 Article III of the Constitution limits federal courts’ jurisdiction to the “resolution 9 of ‘Cases’ and ‘Controversies.’” TransUnion LLC v. Ramirez, 141 S. Ct. 2190, 2203 10 (2021). This limitation means the plaintiff must have standing to sue. Id. A plaintiff 11 establishes standing by showing (i) that he suffered an injury in fact that is concrete, 12 particularized, and actual or imminent; (ii) that the injury was likely caused by the 13 defendant; and (iii) that the injury would likely be redressed by judicial relief. Id. (citing 14 Lujan v. Defenders of Wildlife, 504 U.S. 555, 560–61 (1992)). 15 Under Rule 12(b)(1), a party may move to dismiss a claim based on lack of subject 16 matter jurisdiction, including the absence of standing. Chandler v. State Farm Mut. Auto. 17 Ins. Co., 598 F.3d 1115, 1123 (9th Cir. 2010). A Rule 12(b)(1) challenge to jurisdiction 18 may be facial or factual. Safe Air for Everyone v. Meyer, 373 F.3d 1035, 1039 (9th Cir. 19 2004). Defendant’s Motion to Dismiss is facial, positing the allegations in the complaint 20 itself are insufficient to invoke federal jurisdiction. See id. at 1039; (MTD.) As a result, 21 the presumption of truthfulness attaches to the allegations in the complaint, and the court 22 is limited to the four corners of the pleading in determining whether it has jurisdiction 23 over the matter. Thornhill Publ’g Co. v. Gen. Tel. Elec., 594 F.2d 730, 733 (9th Cir. 24 1979). To survive a Rule 12(b)(1) facial challenge, “the plaintiff must ‘clearly . . . allege 25 facts demonstrating’ each element [of standing].” Spokeo, Inc. v. Robins, 578 U.S. 330, 26 338 (2016) (quoting Warth v. Seldin, 422 U.S. 490, 518 (1975)). 27 28 1 II. Analysis 2 Defendant asserts Plaintiff fails to plausibly allege any of the standing 3 requirements—injury in fact, causation, and redressability. The Court analyzes each 4 prong and concludes that Plaintiff has adequately pled all three. 5 A. Injury in Fact 6 “To establish injury in fact, a plaintiff must show that he or she suffered ‘an 7 invasion of a legally protected interest’ that is ‘concrete and particularized’ and ‘actual or 8 imminent, not conjectural or hypothetical.’” Spokeo, 578 U.S. at 339 (quoting Lujan, 504 9 U.S. at 560). A “concrete” injury “must be ‘de facto’; that is, it must actually exist.” Id. at 10 340 (citing Black’s Law Dictionary 479 (9th ed. 2009)). Although “the most obvious” 11 concrete harms are tangible—e.g., physical or monetary, “various intangible harms can 12 also be concrete.” TransUnion, 141 S. Ct. at 2204. These include injuries “with a close 13 relationship to harms traditionally recognized as providing a basis for lawsuits in 14 American courts,” such as “reputational harms, disclosure of private information, and 15 intrusion upon seclusion.” Id. 16 “A right to privacy ‘encompass[es] the individual’s control of information 17 concerning his or her person.’” In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 18 589, 598 (9th Cir. 2020) (quoting Eichenberger v. ESPN, Inc., 876 F.3d 979, 983 (9th 19 Cir. 2017)). Violations of this right fall into the category of traditionally recognized 20 harms. Patel v. Facebook, Inc., 932 F.3d 1264, 1272 (9th Cir. 2019) (recognizing the 21 “common law roots of the right to privacy”). As a result, intrusions into privacy can 22 constitute an injury in fact. 23 The Ninth Circuit’s recent opinion in In re Facebook is instructive. 956 F.3d 589. 24 The issue was whether Facebook-users had standing to sue Facebook, Inc. (“Facebook”) 25 for tracking their browsing histories after they had logged out of Facebook. Id. at 595–96. 26 The Ninth Circuit reasoned that Facebook’s practices enable it to “amass a great degree 27 of personalized information . . . without affording users a meaningful opportunity to 28 control or prevent the unauthorized exploration of their private lives.” Id. at 599. Quoting 1 the Third Circuit, the Ninth Circuit conclusively rejected the argument that the collection 2 of private data is not an injury in fact: “In an era when millions of Americans conduct 3 their affairs increasingly through electronic devices, the assertion . . . that federal courts 4 are powerless to provide a remedy when an internet company surreptitiously collected 5 private data . . . is untenable.” Id. (quoting In re: Google Inc. Cookie Placement 6 Consumer Priv. Litig., 934 F.3d 316, 325 (3d Cir. 2019)). For this reason, the Ninth 7 Circuit upheld standing. Id. at 598–99. 8 Here, Plaintiff alleges Defendant collected his personal information in violation of 9 the California Constitution and various California statutes. (Am. Compl. ¶ 1.) Among the 10 collected data are his “geolocation, . . . communications related to his personal 11 characteristics, mode of living, purchase decisions, personal choices, app selections, 12 spending habits, and click choices.” (Id. ¶ 38.) As in In re Facebook, Plaintiff’s inability 13 to “control or prevent the unauthorized exploration” of his private affairs is the root of the 14 alleged injury. See 959 F.3d at 599. Thus, on first blush, the Court finds no pleading 15 deficiencies. 16 Defendant counters with three arguments: the Amended Complaint fails to allege 17 (1) that Defendant’s actions affected Plaintiff in particular, (2) that the collection of data 18 diminished the economic value of Plaintiff’s data, and (3) that there was a lack of consent 19 to data collection. (MTD 19–23.) None is persuasive. 20 First, the Complaint plausibly alleges Defendant collected Plaintiff’s data. To be 21 sure, Plaintiff’s injury must be “specific to [him].” See Gaos v. Google Inc., No. 5:10-cv- 22 4809 EJD, 2012 WL 1094646, at *3 (N.D. Cal. Mar. 29, 2012). There is, in other words, 23 no standing if Plaintiff fails to allege that Defendant collected his data. But in this case, 24 the Complaint adequately pleads an injury specific to him. The Complaint alleges, 25 “Defendant openly acknowledges that its software development kit (SDK), made 26 available to and inserted by other companies as a plug-in to their own smartphone 27 applications, intercepts and reads massive amounts of consumer data using its technology 28 in order to identify unique consumers and report on their travel and habits for marketing, 1 verification, and other purposes.” (Am. Compl. ¶ 67.) Plaintiff further alleges that he 2 “owns, carries, and regularly uses a cellular device that contains Defendant’s Kochava 3 monitoring and intercepting SDK” embedded in apps (id. ¶ 36); “regularly uses his cell 4 phone to access these application(s) in which Defendant utilizes its embedded SDK to 5 track his geolocation, and to monitor and intercept communications” (id. ¶ 38); and “did 6 not know until recently that his purchase decisions, his movements, and his locations, 7 were being tracked by Defendant to market, sell, and advertise to him” (id. ¶ 40). This is 8 enough for the Court to reasonably infer that Defendant collected and sold Plaintiff’s 9 data. 10 Second, there is no constitutional requirement that Plaintiff demonstrate lost 11 economic value. Indeed, the Ninth Circuit explicitly rejected this argument in In re 12 Facebook, reversing the lower court’s holding to the contrary. 959 F.3d at 599. The Ninth 13 Circuit reasoned, “California law recognizes a right to disgorgement of profits resulting 14 from unjust enrichment, even where an individual has not suffered a corresponding loss.” 15 Id. Because California law recognizes “an entitlement to unjustly earned profits,” to 16 establish standing, plaintiffs must only establish a stake in the profits garnered from their 17 personal data and that it is unjust for the defendant to retain those profits. Id. at 600. 18 Plaintiff here does so. The Amended Complaint alleges, “Plaintiff and members of the 19 Class conferred a benefit on Defendant through the use and dissemination of Plaintiff’s 20 and Class members’ personal information, geolocation data, and communications . . . 21 which Defendant used and disseminated for its own monetary benefit.” (Am. Compl. ¶¶ 22 237–38.) Thus, under Ninth Circuit precedent, Plaintiff has carried his pleading burden.2 23

24 2 Some of Plaintiff’s claims may require an economic injury as an element of the claim, but such 25 a “statutory standing” requirement does not eliminate constitutional standing. See Salmon Spawning & Recovery All. v. Gutierrez, 545 F.3d 1220, 1225 (9th Cir. 2008) (“If a plaintiff has shown sufficient 26 injury to satisfy Article III, but has not been granted statutory standing, the suit must be dismissed under 27 Federal Rule of Civil Procedure 12(b)(6), because the plaintiff cannot state a claim upon which relief can be granted.”). As a result, statutory standing elements are not relevant to Defendant’s Rule 12(b)(1) 28 1 Third, Plaintiff alleges he did not consent to Defendant’s collection of his data. 2 Defendant argues that users consented to its data practices in two ways: (1) they 3 consented to sharing their location with a third-party app developer when they 4 downloaded the application and (2) they failed to opt-out by contacting Defendant and 5 requesting data deletion. (MTD 18, 23.) Neither constitutes consent. 6 To begin, Defendant’s argument requires the Court to make inferences in its favor. 7 The Amended Complaint does not directly allege that Plaintiff consented to sharing his 8 location with a third-party app developer or that he had the opportunity to opt out of 9 location sharing. Rather, Plaintiff copies and pastes FAQ-type information from 10 Defendant’s website into the Amended Complaint: 11 Can data be deleted upon request? User data may be deleted from Kochava, so long as the request comes 12 directly from the user. 13 14 (Id. ¶ 67.) And Plaintiff includes a section of Defendant’s complaint against the FTC: 15 Even if an injury to the consumer did indeed occur, it is reasonably avoidable by the consumer themselves by way the opt-out provision to allow 16 the data collection. In other words, the consumer agreed to share its location 17 data with an app developer. As such, the consumer should reasonably expect that this data will contain the consumer’s locations, even locations which the 18 consumer deems is sensitive. 19 (Id. ¶ 104.) On a facial challenge to standing, the Court must draw all reasonable 20 inferences in favor of the non-moving party. See Wolfe v. Strankman, 392 F.3d 358, 362 21 22 23

26 points out that CIPA allows “[a]ny person who has been injured” to recover damages and suggests that 27 this language requires economic loss. (MTD 20.) But Defendant cherry-picks the language. The statute specifically provides, “It is not a necessary prerequisite to an action pursuant to this section that the 28 1 (9th Cir. 2004). Thus, the Court accepts that, as alleged in the Amended Complaint, 2 Defendant made these statements; but the Court cannot rely on the substance of the 3 statements to grant a facial standing challenge.3 4 Even if the Court accepts that Plaintiff consented to a third-party app developer 5 collecting his data and that he could have contacted Defendant to request the deletion of 6 his data, Defendant’s argument is still deficient. “Consent is . . . generally limited to the 7 specific conduct authorized.” Javier v. Assurance IQ, LLC, No. 4:20-cv-02860-JSW, 8 2021 WL 940319, at *2 (N.D. Cal. Mar. 9, 2021); see also In re Google Assistant Priv. 9 Litig., 457 F. Supp. 3d 797, 824 (N.D. Cal. 2020) (finding that consent to data collection 10 does not extend to data disclosure). Plaintiff gave consent for data collection to app 11 developers, but not to Defendant. Defendant then “surreptitiously intercepts and collects 12 Plaintiff’s and Class Members’ activity while using smartphone applications that have 13 installed its SDK.” (Am. Compl. ¶ 76.) Even if Plaintiff gave full consent to third-party 14 app developers to collect his data, consent to that specific conduct does not extend to 15 Defendant’s collection of Plaintiff’s data through backdoors built into apps or to 16 Defendant’s dissemination of that information for profit. 17 Likewise, the failure to opt-out does not demonstrate consent, particularly when 18 users are unaware of the data collection practices. Again, the Amended Complaint quotes 19 from Defendant’s own statements that it deletes user data “so long as the request comes 20 directly from the user.” (Id. ¶ 67.) Defendant latches onto this allegation to argue that 21 Plaintiff’s failure to request the deletion of his data constitutes consent. But the SDK 22 siphons data “unbeknownst to consumers,” who have “no way of discovering that 23 Defendant intercepted and recorded [their] telephonic digital communications without 24 Class Members’ knowledge or consent.” (Id. ¶¶ 5, 148.) In short, without disclosure, the 25 26

27 3 Based on the Court’s experience and common sense, it may assume that third-party apps included privacy policies or terms of service, but it will not assume the content of those policies or 28 1 opportunity to opt-out cannot create consent. Here, Plaintiff was not only unaware of his 2 ability to opt-out, but also unaware of Defendant’s data collection altogether. 3 Thus, Defendant’s arguments are unavailing, and the Court finds that Plaintiff 4 plausibly pleads an injury in fact. 5 B. Causation 6 To establish standing, plaintiffs must also show “a causal connection between the 7 injury and the conduct complained of—the injury has to be ‘fairly . . . trace[able] to the 8 challenged action of the defendant, and not . . . th[e] result [of] the independent action of 9 some third party not before the court.” Lujan, 504 U.S. at 560 (quoting Simon v. E. Ky. 10 Welfare Rts. Org., 426 U.S. 26, 40–42 (1976)). The Ninth Circuit has instructed that the 11 “Article III causation threshold” is “less rigorous” than proximate causation. Canyon 12 Cnty. v. Syngenta Seeds, Inc., 519 F.3d 969, 974 n.7 (9th Cir. 2008). Plaintiff need not 13 demonstrate that Defendants were the “sole source” of his injury. Barnum Timber Co. v. 14 E.P.A., 633 F.3d 894, 901 (9th Cir. 2011). Rather, he must only “establish a line of 15 causation’ between [D]efendants’ action and [his] alleged harm that is more than 16 ‘attenuated.’” See Maya v. Centex Corp., 658 F.3d 1060, 1070 (9th Cir. 2011). 17 Defendant suggests it is third-party app developers’ actions, and not Defendant’s 18 actions, that caused Plaintiff’s alleged injury. (MTD 23.) But it is Defendant’s 19 interception, packaging, and reselling of Plaintiff’s data that constitute the privacy 20 violations in this case. Third-party apps are merely the vessel for Defendant’s SDK to 21 collect data. (Am. Compl. ¶ 5 (“App developers embed SDKs into their app [] and may 22 not know the full extent and functions of the code in the SDK.”).) Moreover, even if 23 third-party app developers were the primary cause of the collection of data, Defendant is 24 the sole cause of the repackaging and sale of the data. (Id. ¶ 170.) Thus, the third-party 25 app developers’ actions do not sever the causal connection between Defendant’s actions 26 and Plaintiff’s alleged injury. 27 28 1 C. Redressability 2 Finally, a plaintiff must sufficiently plead a likelihood that the injury will be 3 “redressed by a favorable decision.” Simon, 426 U.S. at 38. Plaintiff has done so here. He 4 alleges Defendant’s data collection practices are ongoing and consumers are “unable to 5 take reasonable steps to avoid” the resulting intrusions to privacy. (Am. Compl. ¶ 102.) 6 The data collection is “opaque to consumers, who typically do not know who has 7 collected their data and how it is being used,” and Defendant sells the data to companies 8 with which the consumers have never interacted. (Id. ¶¶ 101–102.) 9 Defendant argues that injunctive relief cannot redress the alleged harm because 10 Defendant’s own actions have already provided relief. (MTD 23–24.) Defendant 11 introduced a new “Privacy Block” capability, “which removes health services location 12 data from the Kochava Collective marketplace.” (Am. Compl. ¶ 105.) Generally, a 13 defendant’s “voluntary cessation” of the challenged conduct does not moot the case or 14 eliminate standing. See Friends of the Earth, Inc. v. Laidlaw Environmental Servs. 15 (TOC), Inc., 528 U.S. 167, 189 (2000) (explaining justification of voluntary cessation 16 doctrine). As a result, the “Privacy Block” does not necessarily shield Defendant from 17 suit. Moreover, even if this new capability partially redressed the harm, its coverage is 18 limited. The “Privacy Block” protects only health services location data. Plaintiff 19 complains of a broader injury, including tracking consumers to “sensitive locations,” like 20 places of worship, domestic abuse shelters, temporary housing shelters, and “places 21 inferring LGBTQ+ identification.” (Id. ¶ 86.) Therefore, the “Privacy Block” does not 22 eliminate redressability. 23 For these reasons, the Court concludes Plaintiff plausibly alleges standing and 24 accordingly DENIES Defendant’s Motion to Dismiss pursuant to Rule 12(b)(1). 25 VENUE TRANSFER 26 Defendant also moves to transfer this action to the United States District Court for 27 the District of Idaho, Northern Division, under 28 U.S.C. § 1404(a). 28 1 I. Legal Standard 2 “For the convenience of parties and witnesses, in the interest of justice, a district 3 court may transfer any civil action to any other district . . . where it might have been 4 brought[.]” 28 U.S.C. § 1404(a). Section 1404 “place[s] discretion on the district court to 5 adjudicate motions for transfer according to an individualized, case-by-case consideration 6 of convenience and fairness.” Stewart Org., Inc. v. Ricoh Corp., 487 U.S. 22, 29 (1988). 7 District courts employ a two-step framework to resolve a transfer motion. A court first 8 asks whether the plaintiff could have originally brought the action in the proposed 9 transferee forum. See Hoffman v. Blaski, 363 U.S. 335, 344 (1960). If the action could 10 have been brought there, then the court weighs “a number of case-specific factors” based 11 in convenience and fairness. Stewart Org., 487 U.S. at 29–30. 12 II. Analysis 13 A. Availability of Alternative Forum 14 The parties do not dispute that this action “might have been brought” in the District 15 of Idaho, but the Court must nonetheless address the issue. See In re Bozic, 888 F.3d 16 1048, 1053 (9th Cir. 2018) (requiring courts to consider the issue sua sponte). “The 17 phrase where an action ‘could have been brought’ is interpreted to mean that the 18 proposed transferee court would have subject matter jurisdiction, proper venue, and 19 personal jurisdiction.” Peregrine Semiconductor Corp. v. RF Micro Devices, Inc., No. 20 12-cv-911-IEG-WMC, 2012 WL 2068728, at *2 (S.D. Cal. June 8, 2012). 21 Subject Matter Jurisdiction: The Class Action Fairness Act (“CAFA”), 28 U.S.C. 22 § 1332(d)(2), provides the Court with subject matter jurisdiction. CAFA requires that the 23 “matter in controversy exceeds the sum or value of $5,000,000, exclusive of interest and 24 costs” and that at least one member of the class is “a citizen of a State different from any 25 defendant.” Id. Plaintiff’s allegations account for an amount in controversy exceeding 26 $5,000,000 (Am. Compl. ¶ 31), and Plaintiff is a citizen of California, while Defendant is 27 a citizen of Idaho and Delaware (id. ¶ 30). Thus, based on the pleadings, the federal court 28 in the District of Idaho has subject matter jurisdiction. 1 Venue: Venue is proper in “a judicial district in which any defendant resides, if all 2 defendants are residents of the State in which the district is located.” 28 U.S.C. 3 § 1391(b)(1). Here, there is only one Defendant, and its principal place of business and 4 registered agent are in Idaho. (Am. Compl. ¶¶ 40–41.) Therefore, venue is proper in the 5 District of Idaho. 6 Personal Jurisdiction: Idaho courts have personal jurisdiction over this matter. For 7 corporations, general jurisdiction exists where the Defendant’s principal place of business 8 sits. See Daimler AG v. Bauman, 571 U.S. 117, 137 (2014) (“With respect to a 9 corporation, the place of incorporation and principal place of business are ‘paradig[m] . . . 10 bases for general jurisdiction.’” (quoting Goodyear Dunlop Tires Operations, S.A. v. 11 Brown, 564 U.S. 915, 924 (2011))). Because Defendant’s principal place of business sits 12 in Idaho, the Idaho courts have personal jurisdiction over the matter. 13 Accordingly, the transfer rests on the case-specific factors and the Court’s 14 discretion. 15 B. Convenience and Fairness Factors 16 When an action could have been brought in the potential transferee court, a district 17 court must decide whether transfer is appropriate. Williams v. Bowman, 157 F. Supp. 2d 18 1103, 1105–06 (N.D. Cal. 2001). Section 1404(a) expressly identifies the following 19 considerations: “convenience of the parties,” “convenience of . . . witnesses,” and “the 20 interest of justice.” 28 U.S.C. § 1404(a). Although the statute identifies only these 21 factors, courts deem “forum non conveniens considerations [to be] helpful in deciding a 22 § 1404 transfer motion.” Decker Coal Co. v. Commonwealth Edison Co., 805 F.2d 834, 23 843 (9th Cir. 1986). District courts, therefore, consider the following factors to decide a 24 transfer motion: (1) the plaintiff’s choice of forum, (2) convenience of the parties, 25 (3) convenience of the witnesses, (4) ease of access to the evidence, (5) familiarity of 26 each forum with the applicable law, (6) feasibility of consolidation of other claims, 27 (7) any local interest in the controversy, and (8) relative court congestion and time to trial 28 in each forum. See Jones v. GNC Franchising, Inc., 211 F.3d 495, 498–99 (9th Cir. 1 2000); Barnes & Noble, Inc. v LSI Corp., 823 F. Supp. 2d 980, 993 (N.D. Cal. 2011). 2 “This list is non-exclusive, and courts may consider other factors, or only those factors 3 which are pertinent to the case at hand.” Martin v. Glob. Tel*Link Corp., No. 15-cv- 4 00449-YGR, 2015 WL 2124379, at *2 (N.D. Cal. May 6, 2015). 5 1. Plaintiff’s Choice of Forum 6 A court may afford “great weight” to the plaintiff’s choice of forum, especially 7 “when the plaintiff has chosen to file the lawsuit in its home forum.” Lou v. Belzberg, 8 834 F.2d 730, 739 (9th Cir. 1987). The deference to the plaintiff’s choice is reduced 9 (1) in a class action spanning multiple states and (2) when the plaintiff does not reside in 10 or have significant connections to the forum. See id. at 739 (class action); Llevat v. True 11 N. Brands, LLC, No. 21-cv-656-BAS-AGS, 2021 WL 5449033, at *7 (S.D. Cal. Nov. 22, 12 2021) (plaintiff’s out-of-forum residence); Heredia v. Sunrise Senior Living LLC, No. 18- 13 cv-00616-HSG, 2018 WL 5734617, at *5 (N.D. Cal. Oct. 31, 2018) (significant 14 connections). Finally, when there is no evidence of forum-shopping, courts generally 15 afford at least some deference to the plaintiffs’ choice of forum. See Urista v. Wells 16 Fargo & Co., No. 20-cv-01689-H-AHG, 2020 WL 7385847, at *2–3 (S.D. Cal. Dec. 16, 17 2020) (“[E]ven though this is a class action, [the plaintiff’s] choice is entitled to 18 deference because there is no evidence that [the plaintiff] engaged in forum shopping and 19 both [the plaintiff] and [the defendants] have significant contacts with the [forum], 20 including those that gave rise to this action.”). 21 Here, Plaintiff and all putative Class Members reside in California, and a 22 substantial part of the injury occurred in the Southern District of California. (Am. Compl. 23 ¶¶ 35, 138.) Although Plaintiff does not reside in this district, on balance, the Court does 24 not discern evidence of forum shopping. As such, Plaintiff’s choice of forum deserves 25 significant weight, only slightly reduced by the class action status and Plaintiff’s out-of- 26 district residence. 27 28 1 2. Convenience of the Witnesses 2 “In determining the convenience of the witnesses, the Court must examine the 3 materiality and importance of the anticipated witnesses’ testimony and then determine 4 their accessibility and convenience to the forum.” Gherebi v. Bush, 352 F.3d 1278, 1304 5 n.33 (9th Cir. 2003), vacated on other grounds, 542 U.S. 952 (2004). In considering the 6 convenience factor, courts should consider “not only the number of witnesses located in 7 the respective districts, but also the nature and quality of their testimony in relationship to 8 the issues in the case.” Kannar v. Alticor, Inc., No. C-08-5505 MMC, 2009 WL 975426, 9 at *2 (N.D. Cal. Apr. 9, 2009). Indeed, “to show inconvenience to witnesses, the moving 10 party should state the witnesses’ identities, locations, and content and relevance of their 11 testimony.” Meyer Mfg. Co. v. Telebrands Corp., No. CIV. S-11-3153 LKK/DAD, 2012 12 WL 1189765, at *6 (E.D. Cal. Apr. 9, 2012) (citing Florens Container v. Cho Yang 13 Shipping, 245 F. Supp. 2d 1086, 1092–93 (N.D. Cal. 2002)); see also Cochran v. NYP 14 Holdings, Inc., 58 F. Supp. 2d 1113, 1119 (C.D. Cal. 1998). Further, not all witnesses are 15 treated equal: “[I]n balancing the convenience of the witnesses, primary consideration is 16 given to third part[ies], as opposed to employee witnesses.” Hawkins v. Gerber Prod. 17 Co., 924 F. Supp. 2d 1208, 1215 (S.D. Cal. 2013) (quoting Kannar, 2009 WL 975426, at 18 *2). 19 Here, Defendant, the moving party, fails to provide the “witnesses’ identities, 20 locations, and content and relevance of their testimony.” See Meyer Mfg. Co., 2012 WL 21 1189765, at *6. The Court accepts the contention that the “majority” of Defendant’s 22 officers and employers are “based and/or located in Sandpoint, Idaho.” (Manning Decl. 23 ¶ 9, ECF No. 21-2.) But Defendant also has offices in Dublin, Ireland and Portland, 24 Oregon. (Id. ¶ 6.) It is not clear how many witnesses are in Idaho or what the “nature and 25 quality” of their testimony would be. See Kannar, 2009 WL 975426, at *2. Moreover, 26 Defendant does not name or indicate any inconvenience to third-party witnesses, and it is 27 not Plaintiff’s burden to do so. As a result, the Court discerns no inconvenience to non- 28 1 party witnesses, and Defendant does not provide enough information for the Court to 2 estimate the inconvenience to employee-witnesses. 3 Accordingly, Defendant has not carried its burden to establish this factor weighs in 4 favor of transfer. 5 3. Familiarity of Each Forum with Applicable Law 6 Plaintiff alleges violations of California law. Although courts within the District of 7 Idaho are competent to apply California law, “[a] California district court is more familiar 8 with California law than district courts in other states.” In re Ferrero Litig., 768 F. Supp 9 2d 1074, 1081 (S.D. Cal. 2011). In some cases, the application of law is “not especially 10 complex or specialized.” See Barnstormers, Inc. v. Wing Walkers, LLC, No. 09-cv-2367 11 BEN (RBB), 2010 WL 2754249, *3 (S.D. Cal. July 9, 2010). But the Court cannot 12 conclude that California’s data privacy statutory regime is “not especially complex or 13 specialized.” As demonstrated in the analysis below on Defendant’s Motion to Dismiss 14 pursuant to Rule 12(b)(6), the issues are a tangle of law and fact. This factor, therefore, 15 weighs against transfer. 16 4. Local Interest in the Controversy 17 “[T]his factor takes into account the current and transferee forum’s interest ‘in 18 having localized controversies decided at home[.]’” Hangzhou Chic Intelligent Tech. Co. 19 v. Swagway, LLC, No. 16-cv-04804-HSG, 2017 WL 1425915, at *4 (N.D. Cal. Apr. 21, 20 2017) (quoting Decker Coal Co., 805 F.2d at 843). 21 California has a demonstrated interest in the privacy of its residents. To begin, 22 Article I, Section 1 of the California Constitution provides: “All people are by nature free 23 and independent and have inalienable rights. Among these are enjoying and defending 24 life and liberty, acquiring, possessing, and protecting property, and pursuing and 25 obtaining safety, happiness, and privacy.” Cal. Const. art. I, § 1 (emphasis added). The 26 words “and privacy” were added by California voters via ballot initiative on November 7, 27 1972. See Hill v. Nat’l Collegiate Athletic Ass’n, 7 Cal. 4th 1, 15 (1994). With respect to 28 the amendment, the California Supreme Court concluded: “The principal focus of the 1 Privacy Initiative is readily discernible. The Ballot Argument warns of unnecessary 2 information gathering, use, and dissemination by public and private entities—images of 3 ‘government snooping,’ computer stored and generated ‘dossiers’ and ‘“cradle-to-grave” 4 profiles on every American’ dominate the framers’ appeal to the voters.” Id. at 21. The 5 initiative’s “primary purpose” was “to afford individuals some measure of protection 6 against this most modern threat to personal privacy.” Id.4 7 Moreover, the California Legislature has demonstrated the forum’s interest in 8 consumer protection and data privacy. California’s privacy statutes have both breadth and 9 depth. Indeed, the statutes at issue in this case exemplify this complex regime. For 10 instance, California’s UCL, a consumer protection statute, has expansive scope: 11 [T]he Legislature . . . intended by this sweeping language to permit tribunals to enjoin on-going wrongful business conduct in whatever context such 12 activity might occur. Indeed, . . . the section was intentionally framed in its 13 broad, sweeping language, precisely to enable judicial tribunals to deal with the innumerable new schemes which the fertility of man’s invention would 14 contrive. 15 16 Cel-Tech Commc’ns, Inc. v. L.A. Cellular Tel. Co., 20 Cal. 4th 163, 181 (1999) (internal 17 quotation marks omitted). Other statutes are narrower but carry a bigger stick. For 18 instance, CDAFA applies only to “computers, computer systems, and computer data,” but 19 allows for compensatory damages, punitive damages, and attorneys’ fees. Cal. Penal 20 Code § 502(a), (e). Even more severe, persons injured by, inter alia, the electronic 21 collection of confidential communications are entitled to $5,000 per violation or treble 22 damages (if any actual damages were sustained). Cal. Penal Code §§ 632, 637.2(a). These 23 statutes evidence California’s serious concern with consumer protection and data 24 privacy.5 25 26 4 By contrast, a constitutional amendment adding a “right to privacy” was rejected by Idaho 27 voters in 1970. See Planned Parenthood Great Nw. v. State, 522 P.3d 1132, 1148 (Idaho 2023). 5 Other statutes further highlight the forum’s interest. In 2018, California passed “the nation’s 28 1 Thus, California’s strong interest in these issues is readily apparent, and the local 2 interests in the controversy weigh against transfer. 3 5. Feasibility of Consolidation of Other Claims 4 The main countervailing weight against transfer is judicial economy. “An 5 important consideration in determining whether the interests of justice dictate a transfer 6 of venue is the pendency of a related case in the transferee forum.” Hawkins, 924 F. 7 Supp. 2d at 1214 (quoting Callaway Golf Co. v. Corp. Trade, Inc., No. 09-cv-384 8 L(POR), 2010 WL 743829, at *7 (S.D. Cal. Mar. 1, 2010)). In such cases, transfer is 9 preferable because of “the positive effects it might have in possible consolidation of 10 discovery and convenience to witnesses and parties.” Id. (quoting Callaway Golf, 2010 11 WL 743829, at *7). 12 A court in the District of Idaho is hearing three related cases: Defendant’s suit 13 against the FTC, the FTC’s suit against Defendant, and Washington residents’ class 14 action against Defendant. (Mariam Decl. ¶¶ 4–6.) Although the FTC cases may be 15 distinguishable by their administrative nature, the Washington residents’ class action 16 largely resembles the issues here. The Court acknowledges that judicial economy may be 17 served by consolidating discovery in these cases. Although the governing law at issue is 18 distinct, the factual issues will largely overlap. 19 Several considerations, however, detract from the weight of this factor. First, 20 Plaintiff filed his case before the Washington class action commenced. In the cases cited 21 by Defendant, the transferee court transferred the later-filed case to the court with the 22 first-to-file plaintiffs. (Mot. Venue 13.) Second, the Court cannot be certain that the later- 23

27 Sanford Shatz & Susan E. Chylik, The California Consumer Privacy Act of 2018: A Sea Change in the 28 1 filed class action will reach discovery or that the FTC suits can feasibly be consolidated. 2 Third, the risk of inconsistent judgments is low. The Court has ruled on Defendant’s 3 standing challenge—a necessary step to continuing to exercise jurisdiction. All other 4 judgments will be specific to the claims at issue, which almost exclusively fall under 5 California law. The Idaho court, by contrast, will be applying Washington law and 6 federal regulations and statutes. As a result, differing judgments would be less 7 inconsistent than distinguishable. Thus, this factor favors transfer but has diminished 8 weight. 9 6. Other Factors 10 The Court finds the other factors to be neutral or insignificant in this case. The 11 convenience of the parties cancels—Idaho is more convenient for Defendant, while 12 California is more convenient for Plaintiff and Class Members. The evidence likely is 13 predominantly electronic and, therefore, easily transported. And finally, the relative court 14 congestion and time of trial in each forum does not significantly move the needle. 15 16 * * * 17 18 In conclusion, the Court gives significant credence to argument for judicial 19 economy but ultimately finds that the fairness and public policy arguments win the day. 20 The Plaintiff’s choice of forum, this Court’s familiarity with California law, and 21 California’s interest in data privacy and consumer protection outweigh the potential 22 convenience of consolidating the cases in the District of Idaho. Accordingly, the Court 23 DENIES Defendant’s Motion for Transfer. 24 FAILURE TO STATE A CLAIM 25 I. Legal Standard 26 A motion to dismiss pursuant to Rule 12(b)(6) tests the legal sufficiency of the 27 claims asserted in the complaint. Navarro v. Block, 250 F.3d 729, 731 (9th Cir. 2001). “A 28 Rule 12(b)(6) dismissal may be based on either a ‘lack of cognizable legal theory’ or ‘the 1 absence of sufficient facts alleged under a cognizable legal theory.’” Johnson v. Riverside 2 Healthcare Sys., LP, 534 F.3d 1116, 1121 (9th Cir. 2008) (quoting Balistreri v. Pacifica 3 Police Dep’t, 901 F.2d 696, 699 (9th Cir. 1990)). 4 A complaint must plead sufficient factual allegations to “state a claim to relief that 5 is plausible on its face.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (cleaned up). The 6 court must accept all factual allegations pleaded in the complaint as true and must 7 construe them and draw all reasonable inferences in favor of the nonmoving party. Cahill 8 v. Liberty Mut. Ins. Co., 80 F.3d 336, 337–38 (9th Cir. 1996). The court, however, need 9 not accept conclusory allegations as true. Rather, it must “examine whether conclusory 10 allegations follow from the description of facts as alleged by the plaintiff.” Holden v. 11 Hagopian, 978 F.2d 1115, 1121 (9th Cir. 1992) (citations omitted). “A claim has facial 12 plausibility when the plaintiff pleads factual content that allows the court to draw the 13 reasonable inference that the defendant is liable for the misconduct alleged.” Iqbal, 556 14 U.S. at 678. 15 II. Analysis 16 The Amended Complaint alleges violations of the California Constitution, 17 CDAFA, CIPA, UCL, and common law principles of unjust enrichment. Defendant now 18 moves to dismiss each of these causes of action. 19 A. Invasion of Privacy 20 Plaintiff’s first cause of action alleges invasion of privacy, inter alia, under the 21 California Constitution. Defendant argues Plaintiff’s allegations do not sustain the cause 22 of action—that is, they do not amount to a “sufficiently serious” invasion of privacy “to 23 constitute an egregious breach of the social norms underlying the privacy right.” See Hill, 24 7 Cal. 4th at 37. Plaintiff counters that the seriousness of the invasion is a question for the 25 finder of fact, not appropriate for the pleadings stage. The Court agrees with Plaintiff. 26 The right to privacy is neither static nor objective. “[A]dvances in technology can 27 increase the potential for unreasonable intrusions into personal privacy.” Patel v. 28 Facebook, Inc., 932 F.3d 1264, 1272 (9th Cir. 2019). In this way, the right is dynamic 1 against new threats to privacy. It is also measured against the social norms of the day: 2 “questions of whether conduct is ‘egregious,’ ‘offensive,’ or violates ‘social norms’ tend 3 by their very nature to be subjective determinations about which reasonable jurists may 4 differ.” See Mastel v. Miniclip SA, 549 F. Supp. 3d 1129, 1139 (E.D. Cal. 2021). 5 Intrusions on privacy exist on a spectrum: “Courts have been hesitant to extend the 6 tort of invasion of privacy to the routine collection of personally identifiable information 7 as part of electronic communications. . . . By contrast, collection of intimate or sensitive 8 personally identifiable information may amount to a highly offensive intrusion.” In re 9 Vizio, Inc., Consumer Priv. Litig., 238 F. Supp. 3d 1204, 1233 (C.D. Cal. 2017). The 10 seriousness of a privacy invasion “requires a holistic consideration of factors such as the 11 likelihood of serious harm to the victim, the degree and setting of the intrusion, the 12 intruder’s motives and objectives, and whether countervailing interests or social norms 13 render the intrusion inoffensive.” In re Facebook, 956 F.3d at 606. For this reason, courts 14 hesitate to decide the issue at the pleadings stage. See id. (“The ultimate question of 15 whether Facebook’s tracking and collection practices could highly offend a reasonable 16 individual is an issue that cannot be resolved at the pleading stage.”); Mastel, 549 F. 17 Supp. 3d at 1139 (“[T]hese questions are typically more appropriately resolved by a 18 jury.”). 19 Here, the Court finds an egregious breach plausible. Far from the “routine 20 collection of personally identifiable information,” Plaintiff alleges the surreptitious 21 collection information that could reveal, for instance, a person’s religious affiliation, 22 sexual orientation, and medical condition. (Am. Compl. ¶ 11.) The Ninth Circuit’s 23 decision in In re Facebook is, again, instructive. The In re Facebook plaintiffs were 24 Facebook users alleging common law and statutory privacy violations.6 956 F.3d at 596. 25

26 6 In re Facebook primarily examines common law invasion of privacy. The common law tort of invasion of privacy is distinct from invasion of privacy under the California Constitution. But in 27 articulating the test for invasion of privacy under the California Constitution, the California Supreme Court borrowed from common law to define “serious violations” of the expectation of privacy. See Hill, 28 1 They alleged that Facebook surreptitiously “tracked their browsing histories after they 2 had logged out of the Facebook application.” Id. Facebook collected the Uniform 3 Resource Locator (“URL”) accessed by the users and the search terms used to find the 4 URL. Id. The Ninth Circuit emphasized, “Facebook’s tracking practices allow it to amass 5 a great degree of personalized information.” Id. at 599. 6 Similarly, in this case, the Amended Complaint outlines a data collection system 7 that compiles “rich personal data,” including the “[i]dentification of sensitive and private 8 characteristics of consumers from the location data sold.” (Am. Compl. ¶¶ 75, 99.) In 9 both cases, the defendants “fingerprinted” users and correlated a vast amount of personal 10 information without users’ knowledge. (Id. ¶ 75 (“Defendant is able to deliver targeted 11 advertising . . . by in essence ‘fingerprinting’ each unique device and user, as well as 12 connecting users across devices and devices across users.”)); In re Facebook, 956 F.3d at 13 599 (“Facebook gained a cradle-to-grave profile without users’ consent.”). Thus, the type 14 of information amassed is similarly revealing, and the method is similarly secretive. 15 These factors allow the Court to plausibly infer Defendant’s data-collection practices 16 amount to an egregious breach of social norms. 17 At this stage, Plaintiff has alleged enough to survive the Motion to Dismiss. 18 Accordingly, the Court DENIES Defendant’s Motion to Dismiss with respect to 19 Plaintiff’s invasion of privacy claim. 20 B. CDAFA 21 Under CDAFA, a person who knowingly accesses a computer system or computer 22 data may be guilty of a public offense. Section 502(c) states in relevant part: 23

27 956 F.3d at 601. Thus, the logic of In re Facebook extends to both common law invasion of privacy and 28 1 [A]ny person who commits any of the following acts is guilty of a public offense: 2

3 (1) Knowingly accesses and without permission . . . uses any data, computer, computer system, or computer network in order to . . . wrongfully 4 control or obtain money, property, or data. 5 (2) Knowingly accesses and without permission takes, copies, or makes use 6 of any data from a computer, computer system, or computer network, or 7 takes or copies any supporting documentation, whether existing or residing internal or external to a computer, computer system, or computer network. 8

9 * * *

10 (7) Knowingly and without permission accesses or causes to be accessed any 11 computer, computer system, or computer network.

12 Cal. Penal Code § 502(c)(1)–(2), (7). 13 Each of these subsections requires a plaintiff to demonstrate that the defendant 14 acted “without permission.” Defendant argues the Amended Complaint fails to do so in 15 two ways: (i) Plaintiff and Class Members consented to Defendant’s data collection and 16 (ii) “without permission” means the circumvention of a computer’s barrier to access, 17 which is not alleged. (MTD 17–19.) The Court disagrees. 18 First, Plaintiff and Class Members did not “consent” to Defendant’s data collection 19 so as to grant “permission” under CDAFA. Defendant argues that Plaintiff consented 20 through voluntarily installing the SDK-embedded third-party apps on their phones, 21 receiving a “disclaimer or warning,” and bypassing the opportunity to opt-out of data 22 collection. Just as Defendant’s standing consent argument failed, its CDAFA consent 23 argument likewise fails. Defendant’s consent argument rests on allegations in the 24 Amended Complaint which quote from Defendant’s own statements. Like a facial 25 challenge under Rule 12(b)(1), a Rule 12(b)(6) challenges requires the Court to make all 26 reasonable inferences in Plaintiff’s favor. Cahill, 80 F.3d at 337–38. As a result, the 27 Court cannot assume that the content of Defendant’s quotes is true. 28 1 Moreover, the Defendant carries the ultimate burden of proving a consent defense. 2 Brown v. Google LLC, 525 F. Supp. 3d 1049, 1063 (N.D. Cal. 2021). To establish 3 consent under CDAFA, a defendant must “explicitly notify users of the practice at issue.” 4 Id. As a result, consent is limited to the specific disclosures provided to the user, and the 5 disclosures must have “only one plausibly interpretation for a finding of consent.” Id. In 6 other words, if the disclosure does not specifically and unambiguously inform the user of 7 the data collection practices, then the consent defense fails. 8 Even if the Court assumes that the “consumer agreed to share its location data with 9 an app developer,” (MTD 27 (quoting Am. Compl. ¶ 104)), the limitations of the 10 disclosures are fatal to Defendant’s argument. Nowhere does the Amended Complaint 11 suggest that consumers were aware of Defendant’s involvement, when they purportedly 12 consented to data collection. Indeed, Plaintiff alleges the opposite: “Plaintiff and Class 13 members were not aware and could not have reasonably expected that [an] unknown third 14 party would install software on their mobile devices that would track and transmit their 15 physical location and communications, and share Plaintiff’s and Class members’ personal 16 information with other parties.” (Am. Compl. ¶ 157.) To reiterate, “[c]onsent is . . . 17 generally limited to the specific conduct authorized.” Javier, 2021 WL 940319, at *2. As 18 such, a user’s consent to a third-party app developer collecting location data does not 19 extend to Defendant’s undisclosed collection of data. 20 To be clear, Defendant is not arguing that (1) Plaintiff consented to third-party app 21 developers collecting and disseminating his data and (2) Defendant received the data 22 from the third-party app developers. Nor could it. The Amended Complaint specifically 23 alleges that Defendant’s hidden software collected Plaintiff’s data directly, skipping the 24 middleman. Indeed, the app developers “may not know the full extent and functions of 25 the code in the SDK.” (Am. Compl. ¶ 5.) Thus, consent to third-party app developers 26 does not confer consent to Defendant. From these allegations, Plaintiff has plausibly 27 stated a lack of consent. 28 1 Second, the phrase “without permission” is not limited to conduct that circumvents 2 a device barrier or “hacks” a computer system. Defendant relies on Facebook, Inc. v. 3 Power Ventures, Inc. to support its narrow reading of “without permission.” No. C08- 4 05780 JW, 2010 WL 3291750, at *11 (N.D. Cal. July 20, 2010). But California courts 5 have more recently broadened their interpretation of “without permission”: “Nothing in 6 the Power Ventures decision held that overcoming ‘technical or code-based barriers’ 7 designed to prevent access was the only way to establish that the Defendant acted without 8 permission.” In re Carrier IQ, Inc., 78 F. Supp. 3d 1051, 1099 (N.D. Cal. 2015) 9 (emphasis in original); see also Synopsys, Inc. v. Ubiquiti Networks, Inc., 313 F. Supp. 3d 10 1056, 1073 (N.D. Cal. 2018). The In re Carrier IQ, Inc. court reasoned that the plain 11 meaning of “without permission” should govern a consent defense and rejected the 12 Power Ventures court’s narrower reading of the statute. 78 F. Supp. 3d at 1099. The 13 Court is persuaded by the reasoning of In re Carrier IQ. The plain meaning of “without 14 permission” does not require the circumvention of computer barriers. Code hidden in 15 embedded software may plausibly use or take computer data “without permission.” 16 Moreover, even if the narrower interpretation of “without permission” did apply, 17 the Amended Complaint plausibly alleges the circumvention of a device barrier. Apple, 18 Inc. introduced an iPhone Application Tracking Transparency (ATT) framework, which 19 allows an iPhone user to turn off tracking. (Am. Compl ¶¶ 68, 69, 71.) But Defendant 20 boasts an end-run around Apple’s privacy framework: it “actively collects [device 21 tracking data], even after a consumer thinks [he has] disabled all tracking by apps on an 22 iPhone.” (Id. ¶ 73.) Plaintiff is himself an iPhone user. (Id. ¶ 72.) At this stage, the Court 23 can plausibly infer that this end-run constitutes “access that circumvents technical or 24 code-based barriers.” See Power Ventures, 2010 WL 3291750, at *12. Thus, even under 25 Defendant’s preferred statutory construction, Plaintiff has carried his pleading burden. 26 Accordingly, the Court DENIES Defendant’s Motion to Dismiss with respect to 27 Plaintiff’s CDAFA claim. 28 1 C. CIPA 2 Plaintiff alleges violations of three provisions under CIPA. The Court analyzes 3 each below. 4 As a preliminary matter, Defendant argues that all CIPA claims fail because 5 Plaintiff fails to identify a specific “communication” that was intercepted. But Defendant 6 misunderstands Plaintiff’s pleading burden. To survive a 12(b)(6) motion, a plaintiff must 7 plead factual content that “allows the court to draw the reasonable inference that the 8 defendant is liable for the misconduct alleged.” Iqbal, 556 U.S. at 678. Therefore, 9 pleading a CIPA violation does not require identifying a specific communication that was 10 intercepted. Such an inference is reasonable given the detailed allegations of Defendant’s 11 practices and Plaintiff’s alleged use of SDK-embedded apps. 12 1. Section 638.51 13 California law prohibits the installation of a pen register without first obtaining a 14 court order. Cal. Penal Code § 638.51 (“Section 638.51”). The statute defines a “pen 15 register” as “a device or process that records or decodes dialing, routing, addressing, or 16 signaling information transmitted by an instrument or facility from which a wire or 17 electronic communication is transmitted, but not the contents of a communication.” Id. 18 § 638.50(b). 19 Defendant argues that its SDK is not a “pen register” but provides no caselaw in 20 support. Indeed, it seems no court has interpreted this provision of CIPA. Traditionally, 21 law enforcement used “pen registers” in investigations to record all numbers called from 22 a particular telephone, and “pen registers” required physical machines. Today, pen 23 registers take the form of software.7 As a result, private companies and persons have the 24 ability to hack into a person’s telephone and gather the same information as law 25

26 7 See In re Order Authorizing Prospective & Continuous Release of Cell Site Location Recs., 31 27 F. Supp. 3d 889, 898 n.46 (S.D. Tex. 2014) (citing Susan Freiwald, Uncertain Privacy: Communication Attributes After the Digital Telephony Act, 69 S. Cal. L. Rev. 949, 982–89 (1996) (describing the 28 1 enforcement. Perhaps for this reason, the California legislature does not limit its 2 prohibition on installing pen registers to law enforcement. Compare Cal. Penal Code 3 § 638.51 (“[A] person may not install or use a pen register . . .” (emphasis added)), with 4 id. § 638.52 (“A peace officer may make an application to a magistrate for an order . . . 5 authorizing . . . the installation and use of a pen register . . .” (emphasis added)). 6 Moreover, the Court cannot ignore the expansive language in the California 7 Legislature’s chosen definition. The definition is specific as to the type of data a pen 8 register collects—“dialing, routing, addressing, or signaling information transmitted by 9 an instrument or facility from which a wire or electronic communication is transmitted,” 10 but it is vague and inclusive as to the form of the collection tool—“a device or process.” 11 See Cal. Penal Code § 538.50(b). This indicates courts should focus less on the form of 12 the data collector and more on the result. Thus, the Court applies the plain meaning of a 13 “process” to the statute. A process can take many forms. Surely among them is software 14 that identifies consumers, gathers data, and correlates that data through unique 15 “fingerprinting.” (Am. Compl. ¶¶ 67, 74.) Thus, the Court rejects the contention that a 16 private company’s surreptitiously embedded software installed in a telephone cannot 17 constitute a “pen register.” 18 The Court is perplexed by Defendant’s second argument. Defendant argues, 19 “Plaintiff fails to show that the type of data purportedly collected by Kochava requires a 20 court order or a warrant.” (MTD 32.) Defendant then cites to In re Zynga Privacy 21 Litigation to show that email and IP addresses are often collected without a warrant. (Id.) 22 But Defendant misunderstands the elements of Plaintiff’s claim. CIPA extends civil 23 liability to the installation of a pen register without a court order. Cal. Penal Code 24 § 638.51. Plaintiff has alleged each necessary element of this claim: Defendant installed a 25 pen register without a court order. The fact that law enforcement can install a warrantless 26 pen register without offending the Fourth Amendment is immaterial. See In re Zynga 27 Priv. Litig., 750 F.3d 1098, 1108 (9th Cir. 2014) (“[W]arrantless installation of pen 28 1 registers, which capture only the telephone numbers that are dialed and not the calls 2 themselves, does not violate the Fourth Amendment.”). 3 As such, Plaintiff has alleged enough to survive the Motion to Dismiss. 4 Accordingly, the Court DENIES Defendant’s Motion to Dismiss with respect to 5 Plaintiff’s Section 638.51 claim. 6 2. Section 631 7 Another CIPA subsection, titled the Wiretapping Act, prohibits surreptitious 8 eavesdropping. It reads: 9 Any person who, by means of any machine, instrument, or contrivance, or in any other manner, intentionally taps, or makes any unauthorized 10 connection . . . with any telegraph or telephone wire, line, cable, or 11 instrument, or who willfully and without the consent of all parties to the communication, or in any unauthorized manner, reads, or attempts to read, 12 or to learn the contents or meaning of any . . . communication while the 13 same is in transit or passing over any wire, line, or cable . . . is punishable [by fine or imprisonment]. 14

15 Cal. Penal Code § 631(a) (“Section 631”). 16 Section 631 has two clauses: It punishes (1) persons who tap telegraph or 17 telephone wires, lines, cables, and instruments and (2) persons who attempt to learn in an 18 unauthorized manner the contents of communications passing over any wires, lines, and 19 cables. See id.; In re Google Inc., No. 13-MD-02430-LHK, 2013 WL 5423918, at *20 20 (N.D. Cal. Sept. 26, 2013). The first clause applies only to “telegraph and telephone” 21 wires, lines, cables or instruments, while the second clause applies to “any wire, line, or 22 cable.” As a result, courts have concluded that the first clause does not apply to internet 23 connections, while the second clause does. See Licea v. Am. Eagle Outfitters, Inc., No. 24 EDCV 22-1702-MWF (JPR), 2023 WL 2469630, at *5 (C.D. Cal. Mar. 7, 2023) 25 (rejecting the argument that the first clause of Section 631 applies to smart phones); In re 26 Google, 2013 WL 5423918, at *20 (“[T]he Court finds no reason to conclude that the 27 limitation of ‘telegraphic or telephone’ on ‘wire, line, cable, or instrument’ in the first 28 clause of the statute should be imported to the second clause of the statute.”). Because 1 Plaintiff’s claim relates to data collected from smartphone apps, only the second clause 2 can sustain the cause of action. With respect to the second clause, Defendant’s only 3 argument is that Plaintiff fails to allege that Defendant obtained the “contents” of a 4 communication. 5 The statute does not provide clarity on the definition of “contents,” and so courts 6 have penciled in a dividing line. On one hand, courts have found that the contact 7 information of the communicating parties and the geolocation of the communicating 8 parties are not the “contents” of a communication under Section 631. See People v. Suite, 9 101 Cal. App. 3d 680, 686 (Cal. Ct. App. 1980) (finding the trapping of police 10 emergency lines did not reveal the content of any communication, but “instead only 11 disclosed the telephone numbers of the callers”); cf. In re iPhone Application Litig., 844 12 F. Supp. 2d 1040, 1061 (N.D. Cal. 2012) (finding that mere geolocation data is not the 13 “contents” of a communication under the federal Wiretap Act). On the other hand, 14 information about particular activity conducted and search terms used on an app qualify 15 as the “contents” of communication. See Hammerling v. Google LLC, No. 21-cv-09004- 16 CRB, 2022 WL 17365255, at *10 (N.D. Cal. Dec. 1, 2022) (finding information 17 regarding “when and how often [users] interact” with third-party apps is not “contents” of 18 communication, but “particular activity on those apps, including products they searched 19 for and services they used within the application,” is the “contents” of communication); 20 In re Meta Pixel Healthcare Litig., No. 22-cv-03580-WHO, 2022 WL 17869218, at *11 21 (N.D. Cal. Dec. 22, 2022) (finding that search terms entered into a website constitute the 22 “contents” of a communication). 23 The allegations in this case fall on the “contents” of communication side of the 24 line. Plaintiff alleges that Defendant “monitor[s] and intercept[s] communications related 25 to his personal characteristics, mode of living, purchase decisions, personal choices, app 26 selections, spending habits, and click choices, amongst others.” (Am. Compl. ¶ 38.) 27 Defendant collects users’ “activity while using smartphone applications” (id. ¶ 76), 28 “search terms used by a device user which resulted in that user clicking on a particular 1 advertisement” (id. ¶ 78), and “a list of all interactions that user took within the app” (id. 2 ¶ 80). Based on these allegations, this case aligns better with Hammerling and In re Meta 3 than Suite and In re iPhone Application Litigation. Thus, Plaintiff has adequately pled 4 that Defendant intercepted the “contents” of a communication. 5 Accordingly, the Court DENIES Defendant’s Motion to Dismiss with respect to 6 Plaintiff’s Section 631 claim. 7 3. Section 632 8 “A person who, intentionally and without the consent of all parties to a confidential 9 communication, uses an electronic amplifying or recording device to eavesdrop upon or 10 record the confidential communication, whether the communication is carried on among 11 the parties in the presence of one another or by means of a telegraph, telephone, or other 12 device” violates California Penal Code § 632 (“Section 632”). In other words, to prevail 13 on a Section 632 claim, “a plaintiff must prove (1) an electronic recording of or 14 eavesdropping on (2) a ‘confidential communication’ (3) to which all parties did not 15 consent.” In re Google Inc., 2013 WL 5423918, at *22. 16 Defendant contends Plaintiff fails to allege the second element—the existence of a 17 “confidential” communication. The statute defines a “confidential communication” as a 18 communication “carried on in circumstances as may reasonably indicate that any party to 19 the communication desires it to be confined to the parties thereto . . . .” Cal. Penal Code 20 § 632(c). The California Supreme Court has further clarified, “[A] conversation is 21 confidential if a party to that conversation has an objectively reasonable expectation that 22 the conversation is not being overheard or recorded.” Flanagan v. Flanagan, 27 Cal. 4th 23 766, 768 (2002). The statutes “protects against intentional, nonconsensual recording of 24 telephone conversations regardless of the content of the conversation or the type of 25 telephone involved.” Id. at 776. As such, the plaintiff need not show an “additional belief 26 that the information would not be divulged at a later time to third parties.” Mirkarimi v. 27 Nevada Prop. 1 LLC, No. 12-cv-2160-BTM-DHB, 2013 WL 3761530, at *2 (S.D. Cal. 28 July 15, 2013). 1 California courts have generally applied “a presumption that Internet 2 communications do not reasonably give rise to” an objectively reasonable expectation 3 that the conversation is not being overheard or recorded. See Revitch v. New Moosejaw, 4 LLC, No. 18-cv-06827-VC, 2019 WL 5485330, *3 (N.D. Cal. Oct. 23, 2019); see also 5 Rodriguez v. Google LLC, No. 20-cv-04688-RS, 2021 WL 2026726, at *7 (N.D. Cal. 6 May 21, 2021) (applying the same presumption and noting “plaintiffs must plead unique, 7 definite circumstances rebutting California’s presumption against online 8 confidentiality”). Moreover, the Ninth Circuit has noted in dicta, “Analogously, e-mail 9 and Internet users have no expectation of privacy in the to/from addresses of their 10 messages or the IP addresses of the websites they visit because they should know that this 11 information is provided to and used by Internet service providers for the specific purpose 12 of directing the routing of information.” United States v. Forrester, 512 F.3d 500, 510 13 (9th Cir. 2008). 14 One court, however, has pushed back on this presumption. Brown v. Google LLC 15 concerned Google’s alleged collection of data while plaintiffs used their browsers in 16 “private browsing mode.” 525 F. Supp. 3d 1049, 1055 (N.D. Cal. 2021). The court 17 pointed out that the presumption rested on cases concerning internet messaging services 18 or emails. Id. at 1074. It distinguished these cases for two reasons. First, browsing 19 information “does not involve messages going to another person, who could share the 20 communication with others.” Id. And second, whereas the defendant’s policies in 21 previous cases disclosed that messages could be shared, Google’s policies did not. Id. 22 Therefore, the Court applied no presumption and concluded that the communications at 23 issue were confidential. 24 Brown, however, is distinguishable in part. Similar to the Brown-plaintiffs, 25 Plaintiff here alleges Defendant collected his “search terms” and other communications. 26 (Am. Compl. ¶ 78.) But unlike the Brown-plaintiffs, Plaintiff here fails to allege any 27 representations that his search terms would be kept private. In Brown, the defendant 28 indicated to users that searches in “incognito” or “private” mode would be protected. 525 1 F. Supp. 3d at 1057. For instance, the defendant’s privacy notice advised users concerned 2 with data collection to browse the web “privately using Chrome in Incognito mode” to 3 “manage your privacy.” Id. at 1058. No such allegations exist in this case. Thus, Brown is 4 distinguishable. 5 The Amended Complaint does not allow the Court to infer that Plaintiff had an 6 objectively reasonable expectation of privacy, and therefore, the Court cannot conclude 7 Plaintiff has plausibly stated a claim. Accordingly, the Court GRANTS Defendant’s 8 Motion to Dismiss with respect to Plaintiff’s Section 632 claim and GRANTS Plaintiff 9 leave to amend. 10 D. UCL 11 Under the UCL, civil remedies are available to any “person who has suffered 12 injury in fact and has lost money or property as a result of the unfair competition.” Cal. 13 Bus. & Prof. Code § 17204. Defendant argues Plaintiff fails to allege a cognizable injury 14 under the UCL. The Court agrees.8 15 In essence, the UCL stipulates two injury requirements: (1) an injury in fact and 16 (2) lost money or property. The first injury requirement is coextensive with the 17 constitutional minimum for standing. See Kwikset Corp. v. Superior Ct., 51 Cal. 4th 310, 18 323 (2011). The second demands more: a plaintiff must show “economic injury.” Id. 19 Thus, the UCL narrows the class of plaintiffs who may sue to those who suffered 20 economic injury. 21 To establish “economic injury,” a plaintiff may “(1) surrender in a transaction 22 more, or acquire in a transaction less, than he or she otherwise would have; (2) have a 23 present or future property interest diminished; (3) be deprived of money or property to 24 which he or she has a cognizable claim; or (4) be required to enter into a transaction, 25 costing money or property, that would otherwise have been unnecessary.” Id. In his 26 Opposition, Plaintiff offers three theories of economic loss: the value of his personal data, 27 8 Because the Court concludes Plaintiff failed to allege a UCL injury, it does not reach 28 1 the future value of his personal data, and the surrender of more in a transaction. (ECF No. 2 16 at 26–30.) None is persuasive. 3 First, Plaintiff “is claiming the economic value of the information that was 4 intercepted by Defendant.” (Id. at 26.) This economic value, he argues, satisfies the injury 5 requirement. But this argument misses the mark. Courts have consistently found that 6 alleging the economic value of data is not enough, if a plaintiff fails to allege the 7 economic value to him. See Bass v. Facebook, Inc., 394 F. Supp. 3d 1024, 1040 (N.D. 8 Cal. 2019) (finding that “to merely say the information was taken and therefore it has lost 9 value” does not confer UCL standing); Ji v. Naver Corp., No. 21-cv-05143-HSG, 2022 10 WL 4624898, at *9 (N.D. Cal. Sept. 30, 2022) (“Courts in this District have held that to 11 proceed on an economic injury theory, data privacy plaintiffs must allege the existence of 12 a market for their data and the impairment of the ability to participate in that market.”). 13 The relevant inquiry is not whether Defendants can profit from Plaintiff’s personal 14 information, but whether Plaintiff himself can profit from his own data. The Amended 15 Complaint does not allege any opportunity through which Plaintiff might do so. See Hart 16 v. TWC Prod. & Tech. LLC, 526 F. Supp. 3d 592, 603 n.4 (N.D. Cal. 2021) (noting that 17 the plaintiff’s “location data may have economic value to others but not to him,” which 18 “reflects a peculiar feature of the current information economy”). 19 Plaintiff cites only one case to support his theory: Brown v. Google LLC. But 20 Brown is distinguishable. The plaintiffs in Brown alleged not only that the value of the 21 data collected could be “quantified,” but also that there was “an active market for such 22 data.” 2021 WL 6064009, *15. Indeed, the complaint in Brown alleged the defendant, 23 Google, paid internet users “up to $3 per week to add a browser extension that shares 24 with Google the sites they visit and how they use them.” Id. (internal quotation marks 25 omitted). By contrast, the Amended Complaint here includes no such allegations. 26 Plaintiff contends Defendant’s conduct was “more outrageous” than the defendant in 27 Brown, but the outrageousness of a defendant’s conduct is immaterial to whether Plaintiff 28 1 could have profited from his collected data. Without plausibly alleging that the data 2 Defendant collected had value to Plaintiff, the theory fails. 3 Second, Plaintiff argues that he lost “future property interests.” (ECF No. 16 at 28.) 4 For the same reasons that Plaintiff’s first theory failed, his second theory likewise fails. 5 Whether alleging present or future economic loss, Plaintiff must allege how his data is 6 economically profitable to him. 7 Third, Plaintiff posits losing the “benefit of the bargain”—acquiring less in the 8 transaction than he otherwise would have—satisfies the UCL’s economic injury element. 9 To be sure, “[c]ourts in California have consistently held that benefit of the bargain 10 damages represents economic injury for purposes of the UCL.” In re Solara Med. 11 Supplies, LLC Customer Data Sec. Breach Litig., No. 3:19-cv-2284-H-KSC, 2020 WL 12 2214152, at *9 (S.D. Cal. May 7, 2020). But this theory of UCL injury requires the 13 parties to have transacted. When a plaintiff never transacted with a defendant, there can 14 be no benefit-of-the-bargain injury under the UCL. See In re Google Assistant Priv. 15 Litig., 546 F. Supp. 3d at 971 (finding that plaintiffs who did not directly transact with the 16 defendant Google, but rather interacted with non-Google smartphones, did not have a 17 benefit-of-the-bargain injury under the UCL). 18 Courts are split as to whether plaintiffs must have paid money to a defendant to 19 sustain their benefit of the bargain theory. Compare id. (concluding that when a plaintiff 20 “fail[s] to allege that [he] paid any money” to defendants, he “cannot have been injured 21 by overpayment”), and Cottle v. Plaid Inc., 536 F. Supp. 3d 461, 484 (N.D. Cal. 2021) 22 (similar), with Brown, 2021 WL 6064009, at *17 (“A party who has provided goods or 23 services in a transaction and has not been paid the fair value of those goods or services 24 has suffered an economic injury even though the party has received money instead of 25 paying money.”), and Calhoun v. Google LLC, 526 F. Supp. 3d 605, 636 (N.D. Cal. 26 2021) (similar). 27 But the Court need not to resolve this split today. In this case, Plaintiff did not 28 transact with Defendant at all. Indeed, the Amended Complaint emphasizes the | ||“surreptitious” nature of Defendant’s data collection. (Am. Compl. J§ 6, 8, 12.) By 2 contrast, Brown, on which Defendant relies entirely, was a dispute between Google users 3 |jand Google. 2021 WL 6064009, at *17. Thus, the facts in the Brown case are 4 || distinguishable from those alleged in this case. 5 In sum, Plaintiff has “failed to demonstrate how such privacy violation translates 6 ||into a loss of money or property.” Archer v. United Rentals, Inc., 195 Cal. App. 4th 807, 7 (Cal. Ct. App. 2011). Accordingly, the Court GRANTS Defendant’s Motion to 8 Dismiss with respect to Plaintiff's two UCL claims and GRANTS Plaintiff leave to 9 |}amend. 10 E. Unjust Enrichment 11 Plaintiff's final cause of action is for “unjust enrichment,” which is not a stand- 12 ||alone cause of action. See Hill v. Roll Internat. Corp., 195 Cal. App. 4th 1295, 1307 13 }}(2011) (Unjust enrichment is not a cause of action, just a restitution claim.”). 14 Accordingly, the Court GRANTS Defendant’s Motion to Dismiss with respect to 15 || Plaintiff's unjust enrichment claim. 16 CONCLUSION 17 For the reasons stated, Defendant’s Motion for Transfer (ECF No. 21) is DENIED. 18 || Defendant’s Motion to Dismiss (ECF No. 11) is GRANTED IN PART and DENIED 19 || IN PART. The Court dismisses Plaintiffs fifth, sixth, seventh, and eighth causes of 20 |jaction. The Court GRANTS Plaintiff leave to amend. If Plaintiff wishes to file an 21 Amended Complaint, he must do so on or before August 11, 2023. If Plaintiff elects not 22 ||to amend by August 11, 2023, Defendant’s response to the remaining counts shall be due 23 or before September 1, 2023. 24 IT IS SO ORDERED. 25 , / □□ 26 || DATED: July 27, 2023 (ypillg (Haphan 6 27 United States District Judge 28 Qa]