Heeger v. Facebook, Inc.

Opinion

BRETT HEEGER, Case No. 18-cv-06399-JD

Plaintiff, ORDER RE MOTION TO DISMISS v. Re: Dkt. No. 26 Defendant.

This is a privacy class action lawsuit brought by plaintiff Brett Heeger against defendant Facebook, Inc., on behalf of a putative class of Facebook users who turned off Facebook’s “Location History” feature. Heeger alleges that Facebook continued to “track, log, and store” their private location information “regardless of users’ choices” to deactivate that feature. Dkt. No. 1 ¶¶ 1, 43. Facebook has moved to dismiss plaintiff’s complaint under Federal Rules of Civil Procedure 12(b)(1) and 12(b)(6). Dkt. No. 26. The motion is granted and denied in part, with leave to amend. Facebook’s unopposed request for judicial notice, Dkt. Nos. 27, 32, is granted, and plaintiff’s fifth claim under California’s Consumer Legal Remedies Act, Cal. Civ. Code § 1750 et seq., is dismissed because plaintiff has abandoned that claim to “streamline the case.” Dkt. No. 33 at 15 n.12. That leaves four claims: (1) violation of the California Invasion of Privacy Act (“CIPA”), Cal. Pen. Code § 630 et seq.; (2) violation of California’s constitutional right of privacy; (3) intrusion upon seclusion; and (4) violation of the Stored Communications Act (“SCA”), 18 U.S.C. § 2701 et seq. Dkt. No. 1 ¶¶ 52-86. Facebook says that Heeger lacks Article III standing for all of the claims because he has not alleged a concrete and specific injury in fact. Dkt. No. 26 at 6-9. Heeger originally filed this lawsuit in federal court, and so he bears the burden of establishing Article III jurisdiction. Patel v. Facebook, Inc., 932 F.3d 1264, 1270 (9th Cir. 2019). “[G]eneral factual allegations of injury resulting from the defendant’s conduct may suffice, and we presume that general allegations embrace those specific facts that are necessary to support the claim.” Id. (quotations omitted). The question is whether the intangible harm to privacy that Heeger alleges under federal and state statutes is a concrete injury in fact for Article III purposes. Patel v. Facebook Inc., 290 F. Supp. 3d 948, 952 (N.D. Cal. 2018). To determine whether the violation of a statute creates a concrete injury, the Court considers “(1) whether the statutory provisions at issue were established to protect [the plaintiff’s] concrete interests (as opposed to purely procedural rights), and if so, (2) whether the specific procedural violations alleged in this case actually harm, or present a material risk of harm to, such interests.” Patel, 932 F.3d at 1270-71 (quoting Robins v. Spokeo, Inc., 867 F.3d 1108, 1103 (9th Cir. 2017)). History and legislative judgments “play important roles” in the analysis. Patel, 290 F. Supp. 3d at 952. “History is instructive because an intangible harm is likely to be concrete for standing purposes when it bears ‘a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit.’” Id. The legislative judgments of Congress and state legislatures are also “‘instructive and important’ to our standing inquiry.” Patel, 932 F.3d at 1273. The complaint alleges that “Facebook systematically and covertly tracks, collects, and stores users’ private location information even after users have affirmatively opted not to share their location history,” Dkt. No. 1 ¶ 9, and that Facebook uses this information “to provide third party companies with targeted advertising” for its own corporate profits. Id. ¶ 34. That is the factual platform for the intrusion upon seclusion claim, and the violations of the California Constitution, CIPA and SCA. These allegations amply establish a concrete injury under Article III. To start with the solitude, seclusion, and private affairs by continuing to track, build and store detailed location histories without their knowledge and consent,” Dkt. No. 1 ¶ 71, and that Facebook exploited that information for its own financial gain. Heeger also alleges a “reasonable expectation[] of privacy in [his] mobile device[] and online behavior generally, including [his] physical locations.” Id. ¶ 69. Such “[p]rivacy rights have long been regarded ‘as providing a basis for a lawsuit in English or American courts.’” Patel, 932 F.3d at 1271 (quoting Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 1549 (2016)). “The Supreme Court has likewise recognized the common law roots of the right to privacy,” and “[b]oth the common law and the literal understandings of privacy encompass the individual’s control of information concerning his or her person.” Id. at 1272-73. Consequently, Heeger has adequately alleged an actual and concrete invasion of his privacy rights that is actionable in federal court under Article III. So too for Heeger’s privacy claim under the California Constitution. The California Supreme Court has stated that the “principal focus” for Article I, section 1 is “readily discernible,” and the ballot argument for its passage warned “of unnecessary information gathering, use, and dissemination by public and private entities.” Hill v. Nat’l Collegiate Athletic Ass’n, 7 Cal. 4th 1, 21 (1994). “Informational privacy is the core value furthered by the Privacy Initiative,” and the “California constitutional right of privacy ‘prevents government and business interests from (1) collecting and stockpiling unnecessary information about us and from (2) misusing information gathered for one purpose in order to serve other purposes or to embarrass us.’” Id. at 35. Heeger has alleged facts sufficient to state a concrete harm in light of these factors. The injuries for the CIPA and SCA claims are also actual and concrete. “In enacting [CIPA], the Legislature declared in broad terms its intent ‘to protect the right of privacy of the people of this state’ from what it perceived as ‘a serious threat to the free exercise of personal liberties [that] cannot be tolerated in a free and civilized society.’ (Pen. Code, § 630.) This philosophy appears to lie at the heart of virtually all the decisions construing the Privacy Act.” Ribas v. Clark, 38 Cal. 3d 355, 359 (1985). And for the Stored Communications Act, our circuit has held that “[b]ecause the plaintiffs allege that Facebook and Zynga are violating statutes that grant persons in the plaintiffs’ position the right to judicial relief, we conclude they have standing to bring this claim.” In re Zynga Privacy Litigation, 750 F.3d 1098, 1105 n.5 (9th Cir. 2014). Consequently, there is no doubt that Heeger has the right to bring this case in federal court. Facebook makes a last effort to avert this conclusion by saying that the SCA and CIPA “do[] not apply” to plaintiff’s allegations. Dkt. No. 26 at 8. The point is not well taken. That is in effect a merits argument, and the jurisdictional and merits inquiries are independent. Patel, 290 F. Supp. 3d at 952, 956 (“dispositive disputes on the merits should be decided on summary judgment or at trial, and not in the Rule 12(b)(1) jurisdictional context”) (citing Safe Air for Everyone v. Meyer, 373 F.3d 1035, 1039 (9th Cir. 2004)). The only issue in play at this stage of this case is whether Heeger may sue in federal court. He can. Whether he will prevail is an entirely different question. Although Heeger has a perfect right to be before the Court, the individual counts are not sufficiently developed to go forward. For the CIPA claim, Heeger says that Facebook illegally used an “electronic tracking device to determine the location or movement of a person” in violation of California Penal Code § 637.7(a). Dkt. No. 1 ¶ 54. The problem with this proposition is that the plain language of the CIPA does not accommodate technology like a mobile app on a digital device, and plaintiff does not persuasively show otherwise. Section 637.7 became law in the late 1990s, and was expressly directed to banning the use of an “electronic tracking device,” which is defined by subsection (d) as “any device attached to a vehicle or other movable thing that reveals its location or movement by the transmission of electronic signals.” This language contemplates things like a freestanding GPS unit hidden on a car, but not a downloaded Facebook app of the sort in dispute here. In effect, the fast pace of developments in digital technology has rendered the CIPA a poor fit for the world we live in today, a problem that besets many privacy- related statutes. It may be possible for Heeger to provide additional facts that might address this issue, but the complaint’s current allegations do not sufficiently allege an “electronic tracking device” for a CIPA claim. allege that the “contents” of a communication that were in electronic storage were divulged by Facebook to third parties in violation of 18 U.S.C. § 2702(a)(1). The word “contents” means “information concerning the substance, purport, or meaning of [the] communication,” and does not include “data that is incidental to the use of a communication device.” United States v. Reed, 575 F.3d 900, 914-17 (9th Cir. 2009). “Congress intended the word ‘contents’ to mean a person’s intended message to another (i.e., the ‘essential part’ of the communication, the ‘meaning conveyed,’ and the ‘thing one intends to convey’),” and it does not include “record information about a user’s communication,” as opposed to “the communication itself.” Zynga, 750 F.3d at 1106-07. Heeger’s allegations fall short because he alleges only that Facebook collected users’ location “data,” and not the contents of communications, even assuming Facebook “divulged” that data to third parties. IV. THE INTRUSION UPON SECLUSION CLAIM AND THE PRIVACY CLAIM UNDER CALIFORNIA CONSTITUTION ART. I, SEC. 1 Heeger has brought a combination of claims for intrusion upon seclusion and a violation of Article I, section 1 of the California Constitution. Dkt. No. 1 ¶¶ 59-75. Strictly speaking, these are distinct claims with different elements. When brought together on the same factual basis, as Heeger has done, “it is appropriate to assess the two claims together and examine ‘the largely parallel elements’ of these two claims which call on the Court to consider ‘(1) the nature of any intrusion upon reasonable expectations of privacy, and (2) the offensiveness or seriousness of the intrusion, including any justification and other relevant interests.’” McDonald v. Kiloo ApS, 385 F. Supp. 3d 1022, 1031-37 (N.D. Cal. 2019) (quoting Hernandez v. Hillsides, Inc., 47 Cal. 4th 272, 288 (2009)). The context-specific nature of the inquiry has been emphasized repeatedly by the California Supreme Court. In Hill v. Nat’l Collegiate Athletic Ass’n, 7 Cal. 4th 1, 31, 36 (1994), the court stated that “privacy interests and accompanying legal standards are best viewed flexibly and in context,” and “[t]he extent of a privacy interest is not independent of the circumstances.” A “plaintiff’s expectation of privacy in a specific context must be objectively reasonable under the the element of offensiveness, “California tort law provides no bright line” and “each case must be taken on its facts.” Shulman v. Group W. Prods., Inc., 18 Cal. 4th 200, 237 (1998). See also Hernandez, 47 Cal. 4th at 289 (“There are degrees and nuances to societal recognition of our expectations of privacy.”). As currently alleged, the complaint does not provide enough facts to undertake the context- specific inquiry into the plausibility of the privacy expectation or the offensiveness of the intrusion. For example, the complaint does not state the precision of the location data Facebook is alleged to have collected after users turned off “Location History.” This is important because a generalized location, such as one that locates a user no more precisely than within several city blocks, may not implicate much in the way of privacy concerns. Highly specific location data, on the other hand, that identifies a user’s pinpoint comings and goings would likely present substantially greater concerns. The complaint does not clearly say what level of location data Facebook is alleged to have collected after the “Location History” feature was turned off. It says only that the granularity of the data is controlled by “Location Services,” not “Location History,” and that when “Location Services” is turned off, Facebook “may still understand your location using things like check-ins, events, and information about your internet connection.” Dkt. No. 1 ¶¶ 22, 31; see also id. ¶ 26 (“Location-related information can be based on things like precise device location (if you’ve allowed us to collect it), IP addresses, and information from your and others’ use of Facebook Products (such as check-ins or events you attend).”). Heeger alleges only that Facebook collected his “private” location data, id. ¶ 84, and on that bareboned and vague allegation, the Court cannot say that he has plausibly pleaded a privacy claim. To be sure, the potentially deceptive conduct Heeger alludes to -- Facebook’s use of confusingly similar location feature names, whose functional differences are hard to understand, and reliance on finely parsed disclosures as notice -- gives considerable pause. If the question at hand were only whether a reasonable consumer would have been confused or misled in these circumstances, the Court may well have found a plausible claim. That is because deceit can be a 1 privacy intrusion especially offensive.” McDonald, 385 F. Supp. 3d 1036. The problem for 2 Heeger is that pleading the “plus” factor alone is not enough to carry the day, and the complaint 3 says too little in the way of facts tied specifically to the core elements of the two privacy counts. 4 There are other pleading flaws. It is not clear that Heeger used the Facebook app during 5 the relevant time period. He says that he “accessed his Facebook through a web browser on his 6 smart phone and through web browsers on both laptop and desktop computers,” and that he “has 7 not used the Facebook app since 2016.” Dkt. No. 1] 10. It is also unclear how often Facebook 8 tracked users. Heeger says that “Facebook continued to track and store his private location 9 information... even when [he] did not use the Facebook app or tag his location in posts.” Dkt. 10 No. 1910. But he also suggests that location collection was limited to “every time [users] use[d] 11 Facebook.” Id. 29; see also id. | 5 (Facebook “tracks, collects, and stores information about 12 where users have logged in and used Facebook”). 13 Overall, plaintiff's allegations fail to meet the requirement of a “short and plain statement” 14 under Federal Rule of Civil Procedure Rule 8 or to plausibly state intrusion upon seclusion and 3 15 California constitutional privacy claims under Rules 8 and 12(b)(6). The claims are dismissed. a 16 CONCLUSION 3 17 Facebook’s motion to dismiss is denied under Rule 12(b)(1), but granted under Rules 8 and S 18 12(b)(6). Heeger may file an amended complaint by January 27, 2020, if he so chooses. Failure 19 to meet that deadline will result in dismissal with prejudice under Rule 41(b). 21 Dated: December 27, 2019 22 23 JAMES/#PONATO 24 United States District Judge 25 26 27 28