1 2 3 4 5 6 UNITED STATES DISTRICT COURT 7 NORTHERN DISTRICT OF CALIFORNIA 8 9 BRETT HEEGER et al., Case No. 18-cv-06399-JD
10 Plaintiffs, ORDER RE MOTIONS TO DISMISS v. 11 Re: Dkt. No. 76 12 FACEBOOK, INC., Defendant. 13
14 BRENDAN LUNDY et al., Case No. 18-cv-06793-JD Plaintiffs, Re: Dkt. No. 82 15 v. 16
17 FACEBOOK, INC., Defendant. 18
19 These cases are related putative class actions by Facebook users, who challenge Facebook, 20 Inc.’s collection of personal location data. Facebook’s motion to dismiss in Heeger, Case No. 18- 21 6399, is granted, and its motion to dismiss in Lundy, Case No. 18-6793, is granted and denied in 22 part. 23 BACKGROUND 24 In both cases, the first amended class action complaints are the operative pleadings. See 25 Case No. 18-6399, Dkt. No. 74 (“Heeger FAC”); Case No. 18-6793, Dkt. No. 80 (“Lundy FAC”). 26 While the allegations in the complaints overlap to a considerable degree, Lundy presents some 27 material variations that warrant a different outcome for the motion. Facebook is the sole named 1 The Heeger FAC added three named plaintiffs -- Zachary Henderson, Caleb Rappaport, 2 and Elizabeth Pomiak -- to plaintiff Brett Heeger, who filed the original complaint. Heeger FAC 3 ¶¶ 14-17. As alleged in the FAC, Facebook “describ[es]” the “Location History” feature in its 4 mobile app, and the “Location Services” setting on users’ cell phones, as “settings through which 5 Facebook users can purportedly control location tracking.” Id. ¶¶ 4-5. But Facebook “collects 6 users’ location data without those users’ consent, regardless of their settings.” Id. ¶ 5. Facebook 7 then “highlights the detail and specificity of that data” to its advertisers, and “uses th[e] data to 8 precisely target its advertiser customers’ advertisements to Facebook users.” Id. The FAC alleges 9 California state law claims on behalf of a putative class of “[a]ll Facebook users in the United 10 States who turned off ‘Location History’ or ‘Location Services’ or both, during the applicable 11 limitations period,” for: (1) violation of the California Invasion of Privacy Act, Cal. Pen. Code 12 § 630 et seq. (“CIPA”); (2) violation of California’s constitutional right of privacy; (3) intrusion 13 upon seclusion; and (4) unjust enrichment. Id. ¶¶ 67, 81-107. 14 The Lundy FAC was brought by two plaintiffs: Brendan Lundy and Myriah Watkins. 15 Lundy FAC ¶¶ 10-19. The FAC alleges that they “never granted Facebook permission to access 16 [their] location data through [their] Location Services or Facebook App settings,” and that they 17 specifically had their “Location History” Facebook app setting turned to “off.” Id. ¶¶ 11, 16. 18 Plaintiffs allege that “[c]ontrary to plaintiffs’ device settings selections, and contrary to 19 Facebook’s Privacy Policy in effect during the relevant time period, Facebook tracked plaintiffs’ 20 locations using their IP addresses and enhanced location determination techniques.” Id. ¶ 5. 21 Facebook is said to have “bundled this location information with plaintiffs’ other personal 22 information,” and then “monetized these bundled packages . . . for targeted advertising purposes, 23 thus enriching itself” in the amount of “hundreds of millions of dollars from increased advertising 24 revenue.” Id. 25 Unlike Heeger, the Lundy plaintiffs limit their claims to the time period before April 19, 26 2018. See id. ¶ 99 (alleging the lawsuit is brought on behalf of persons “who were users of 27 Facebook prior to April 19, 2018 who did not give Facebook permission to collect and use their 1 privacy policy” which disclosed “that Facebook will collect location data using IP addresses, even 2 without user permission.” Id. ¶¶ 25-26. The Lundy FAC quotes the revised policy, which 3 expressly advised users that “[y]ou can control whether your device shares precise location 4 information with Facebook Company Products via Location Services,” but also that “[w]e may 5 still understand your location using things like check-ins, events, and information about your 6 internet connection.” Id. ¶ 26. It agrees that this revised policy, unlike the prior version, “advises 7 users that it will collect their location information, including location information derived from IP 8 addresses without user consent, and bundle this location information, with ‘information about 9 [their] interests, actions and connections,’ to deliver personalized advertising and sponsored 10 content.” Id. ¶ 27. 11 The complaint in Lundy also differs from Heeger in the claims alleged against Facebook. 12 The Lundy plaintiffs make claims for: (1) violation of article I, section 1 of the California 13 constitution; (2) intrusion upon seclusion; (3) intentional misrepresentation and omission; 14 (4) deceit by concealment or omission, Cal. Civ. §§ 1709 & 1710; (5) breach of contract; 15 (6) breach of implied covenant of good faith and fair dealing; (7) negligent misrepresentation; and 16 (8) unjust enrichment. Id. ¶¶ 108-96. 17 Facebook has moved to dismiss both amended complaints under Rules 12(b)(1) and 18 12(b)(6) of the Federal Rules of Civil Procedure. Heeger Dkt. No. 76; Lundy Dkt. No. 82.1 19 DISCUSSION 20 I. FACEBOOK’S MOTION TO DISMISS IN HEEGER 21 This is the second round of pleadings motions in Heeger. The Court granted Facebook’s 22 initial motion to dismiss, with leave to amend. Dkt. No. 70. In that order, the Court concluded 23 that plaintiff Heeger had established Article III standing to sue on the privacy and other claims. 24 Id. at 2-4. On substantive grounds, the CIPA claim was dismissed because the complaint did not 25 plausibly allege the use of an “electronic tracking device” as required by California Penal Code 26 § 637.7(a). Id. at 4. The privacy claims for intrusion upon seclusion and violation of the 27 1 California constitutional right to privacy were dismissed because the complaint did not “provide 2 enough facts to undertake the context-specific inquiry into the plausibility of the privacy 3 expectation or the offensiveness of the intrusion.” Id. at 5-6. The Court determined that the 4 complaint “does not state the precision of the location data Facebook is alleged to have collected 5 after users turned off ‘Location History.’” Id. at 6. The Court underscored that “[t]his is 6 important because a generalized location, such as one that locates a user no more precisely than 7 within several city blocks, may not implicate much in the way of privacy concerns,” whereas 8 “[h]ighly specific location data . . . that identifies a user’s pinpoint comings and goings would 9 likely present substantially greater concerns.” Id. 10 Plaintiffs amended the complaint, but with scant improvement. The Heeger FAC now 11 reads like a book report that simply summarizes third-party news stories about Facebook’s 12 ostensible capacity to “discern precise locations” from user data. See, e.g., Heeger FAC ¶¶ 8, 48- 13 50, 53 & nn.4-5, 29-31.2 Few facts are alleged without the caveat of “on information or belief,” or 14 without hedging on whether Facebook actually does what Heeger accuses, or simply has the 15 ability to do it. See, e.g., id. ¶ 49 (alleging that “Facebook can also match IP addresses taken from 16 users who have turned Location Services and Location History off with IP address information 17 taken from users who have not limited Facebook’s ability to access their location and who have 18 given Facebook access to extremely precise location data, like Wifi access points or GPS”) (first 19 emphasis added); id. & n.29 (citing an article entitled, How Others Compromise Your Location 20 Privacy: The Case of Shared Public IPs at Hotspots, and alleging “upon information and belief, 21 Facebook does this in order to obtain precise location data about all its users, without disclosing 22 this practice.”). 23 These allegations did nothing to fill in the substantive gaps in the original complaint. They 24 did little more than parrot internet musings about things Facebook may or may not be doing, and 25 which plaintiffs may or may not have experienced themselves. When these fillers are stripped 26 2 The degree to which plaintiffs’ cited articles and materials actually support the associated FAC 27 allegations is not germane to the Court’s analysis. The Court consequently declines to take 1 away, all that the Heeger FAC alleges is that Facebook collected plaintiffs’ IP addresses. See id. 2 ¶ 41 (“At a minimum, Facebook tracks its users’ IP addresses regardless of whether they have 3 affirmatively sought to limit Facebook’s ability to track their locations by turning Location 4 History and Location Services ‘off.’”); ¶ 42 (“Facebook . . . continues to track users’ approximate 5 location using IP addresses”); n.24 (Facebook’s statements do not “make clear that Facebook is 6 collecting IP address information even in cases where users have chosen to limit Facebook’s 7 access to their location data”); ¶ 45 (“turning Location History ‘off’ has no impact on Facebook’s 8 collection of location information -- at a minimum IP address information”); ¶ 46 (Facebook’s 9 representations obscure the fact that “Facebook continues collecting IP address information (and 10 in some cases other location information)”). In addition, the primary and sole factual allegation 11 made about location data actually collected from the plaintiffs is that plaintiff Heeger “discovered 12 104 pages of IP addresses showing locations where he accessed his Facebook account spanning 13 from 2014 through August 2018.” Id. ¶ 14. 14 Consequently, the Heeger FAC plausibly alleges only that Facebook collected plaintiffs’ 15 IP addresses and even then, only when they were using the Facebook app or were visiting 16 Facebook’s website. Id. ¶ 41. This creates an Article III standing problem for plaintiffs. As 17 Article III of the United States Constitution states, federal courts have the “power to decide legal 18 questions only in the presence of an actual ‘Cas[e]’ or ‘Controvers[y].’” Wittman v. 19 Personhuballah, 136 S.Ct. 1732, 1736 (2016). The party invoking a federal court’s jurisdiction 20 must demonstrate standing by showing that she has “suffered an ‘injury in fact,’ that the injury is 21 ‘fairly traceable’ to the conduct being challenged, and that the injury will likely be ‘redressed’ by 22 a favorable decision.” Id. (quoting Lujan v. Defenders of Wildlife, 504 U.S. 555, 560-61 (1992)). 23 Standing is an ongoing inquiry, and “[t]he need to satisfy these three [Article III standing] 24 requirements persists throughout the life of the lawsuit.” Id. (citation omitted). The Court has an 25 independent duty to be vigilant about standing, and Facebook has renewed its Article III standing 26 challenge by invoking Federal Rule of Civil Procedure Rule 12(b)(1) as a basis for the motion to 27 dismiss, and by asserting “that the FAC fails adequately to allege ‘injury in fact’ for purposes of 1 As Facebook suggests, it is the injury in fact prong that requires the closest examination 2 here. To establish injury in fact, a plaintiff must show that he or she suffered “an invasion of a 3 legally protected interest which is (a) concrete and particularized, and (b) actual or imminent, not 4 conjectural or hypothetical.” Lujan, 504 U.S. at 560 (quotations and citations omitted). Article III 5 standing is “not dispensed in gross,” Lewis v. Casey, 518 U.S. 343, 358 n.6 (1996), and must be 6 demonstrated “for each claim plaintiff[s] seek[] to press” and “for each form of relief” that is 7 sought. DaimlerChrysler Corp. v. Cuno, 547 U.S. 332, 352 (2006) (quotations and citations 8 omitted). “Where standing is raised in connection with a motion to dismiss, the court is to accept 9 as true all material allegations of the complaint, and . . . construe the complaint in favor of the 10 complaining party.” In re Facebook, Inc. Internet Tracking Litigation, 956 F.3d 589, 597 (9th Cir. 11 2020) (quotations omitted). 12 Although the Court found that plaintiff Heeger had Article III standing based on the 13 allegations in his original complaint, Dkt. No. 70, that conclusion must be reconsidered in light of 14 the pleading amendments. The amended allegations show that plaintiffs do not have standing to 15 bring claims for intrusion upon seclusion, violation of the California constitution, article I, section 16 1, or for a violation of CIPA, because they have not plausibly alleged any privacy injuries. See In 17 re Facebook, 956 F.3d at 598. Plaintiffs do not plausibly allege anything more than the collection 18 of IP addresses, and there is no legally protected privacy interest in IP addresses. That is because 19 “every computer or server connected to the Internet has a unique IP address,” United States v. 20 Forrester, 512 F.3d 500, 510 n.5 (9th Cir. 2008), and “[a]n ‘IP address’ is a numerical identifier 21 for each computer or network connected to the Internet.” In re Facebook, 956 F.3d at 596 n.2. 22 “Internet users have no expectation of privacy in . . . IP addresses of the websites they visit 23 because they should know that this information is provided to and used by Internet service 24 providers for the specific purpose of directing the routing of information.” Forrester, 512 F.3d at 25 510. IP addresses “are voluntarily turned over in order to direct the third party’s servers,” id., and 26 so no reasonable expectation of privacy attaches to them. 27 The fact that the IP addresses at issue here are assigned to cell phones does not lead to a 1 138 S.Ct. 2206, 2218-20 (2018), that cell phones have become “almost a ‘feature of human 2 anatomy,’” and uniquely offer a highly effective means of “achiev[ing] near perfect surveillance,” 3 these observations were expressly limited to the context of the cell-site location information 4 (CSLI) data that was before the Court. That is a key point of distinction because cell-site location 5 information data and IP addresses are apples and oranges for privacy purposes. CSLI data is much 6 more sticky and persistent, as it is generated “several times a minute whenever [a cell phone’s] 7 signal is on, even if the owner is not using one of the phone’s features.” Id. at 2211. Carpenter 8 indicates that it also more exact in pinpointing a location than an IP address, but the full degree of 9 that is difficult to gauge here because the Heeger plaintiffs provided no meaningful descriptions of 10 how precise their IP address data was. 11 In addition, the number of cell sites has mushroomed in response to rising cell phone data 12 traffic in the United States, which has led to “increasingly compact coverage areas, especially in 13 urban areas.” Id. at 2211-12. In Carpenter, the CSLI data was described as placing defendant 14 “within a wedge-shaped sector ranging from one-eighth to four square miles,” and the government 15 highlighted it as some of its best evidence showing “he was at the site of the robberies.” Id. at 16 2218. The total lack of any similar allegations about IP addresses in the Heeger FAC, as well as 17 the general understanding of IP addresses the Court has from other cases, indicates IP address data 18 is far less finely detailed. 19 In effect, the allegation that Facebook collected “IP addresses showing locations where 20 [plaintiff Heeger] accessed his Facebook account,” Dkt. No. 74 ¶ 14, describes a practice akin to a 21 pen register recording the outgoing phone numbers dialed on a landline telephone. Carpenter, 138 22 S.Ct. at 2216. That will not do for a privacy injury. “Telephone subscribers know, after all, that 23 the numbers are used by the telephone company ‘for a variety of legitimate business purposes,’ 24 including routing calls,” and it is doubtful that “people in general entertain any actual expectation 25 of privacy in the numbers they dial.” Id. So too for an IP address. Device “users ‘should know 26 that [IP address] information is provided to and used by Internet service providers for the specific 27 purposes of directing the routing information.” In re Facebook, 956 F.3d at 604 (quoting 1 Forrester, 512 F.3d at 510).3 Significantly, plaintiffs acknowledge this truth about IP addresses 2 by prefacing allegations with statements like “[e]ven if it is inevitable that Facebook learns a 3 user’s IP address because the user is connected to the internet . . . .” Dkt. No. 74 ¶ 47. To be sure, 4 a voluntary sharing alone does not in itself necessarily negate a legally protected privacy interest. 5 Carpenter made that clear. See 138 S.Ct. at 2216 (CSLI data is generated from an “individual 6 continuously reveal[ing] his location to his wireless carrier”). But while Carpenter declined to 7 extend the “third-party doctrine,” which “stems from the notion that an individual has a reduced 8 expectation of privacy in information knowingly shared with another,” to “the collection of 9 CSLI,” it was careful to underscore that the “decision today is a narrow one” and does not 10 “express a view on matters not before us.” Id. at 2219-20. 11 The collection of IP addresses is a country mile from the CSLI data collected in Carpenter, 12 and plaintiffs do not argue otherwise. There is no legally protected privacy interest in IP addresses 13 alone, which is the only interest plaintiffs concretely allege. Consequently, they cannot be injured 14 from the collection of IP addresses, and so lack Article III standing for the privacy claims under 15 California common law, the California constitution, and CIPA that are premised on that ostensible 16 injury. 17 This conclusion is entirely consonant with the Court’s ongoing duty to police standing. 18 Standing was established in the original complaint on the basis of Heeger’s allegation that 19 “Facebook systematically and covertly tracks, collects, and stores users’ private location 20 information even after users have affirmatively opted not to share their location history,” as well 21 as that Facebook tracked and stored users’ “detailed location histories without their knowledge 22 and consent.” Dkt. No. 70 at 2-3 (quoting Dkt. No. 1 (Complaint) ¶¶ 9, 71). But after the Court 23 required plaintiffs to put a finer point on the facts in an amended complaint, plaintiffs made clear 24 that all that they were alleging was the collection of IP addresses. In effect, plaintiffs planted their 25
26 3 In re Facebook also noted that while “the Fourth Amendment imposes higher standards on the government than those on private, civil litigants, . . . we have nonetheless found analogies to 27 Fourth Amendment cases applicable when deciding issues of privacy related to technology.” 956 1 flag in quicksand. The Court has not hesitated to find Article III standing in other cases alleging 2 intangible privacy harms, see, e.g., Patel v. Facebook Inc., 290 F. Supp. 3d 948 (N.D. Cal. 2018), 3 but the FAC here forestalls a similar outcome. 4 Plaintiffs also lack Article III standing for the unjust enrichment claim because they have 5 failed to make any allegation that “they retain a stake in the profits garnered from” the collection 6 of their IP addresses. In re Facebook, 956 F.3d at 600. It seems doubtful they could ever 7 plausibly allege such a claim. Article III standing for this claim is also undercut by the scarcity of 8 facts plausibly demonstrating how Facebook’s profits were unjustly earned, id. at 601, given that 9 the only factual allegations are that Facebook collected, stored, and used plaintiffs’ IP address 10 information, as to which they had no legally protected privacy interest. 11 The Heeger FAC is dismissed in its entirety for lack of Article III standing. Plaintiffs may, 12 if they wish, attempt to cure these deficiencies by filing an amended complaint, which will likely 13 constitute plaintiffs’ final opportunity to amend. 14 II. FACEBOOK’S MOTION TO DISMISS IN LUNDY 15 Facebook’s prior motion to dismiss the Lundy complaint was mooted when plaintiffs 16 elected to voluntarily amend. Dkt. Nos. 48, 76. Among other amendments, plaintiffs voluntarily 17 dismissed some defendants and filed the FAC against Facebook only. Dkt. Nos. 77, 80. This is 18 the Court’s first decision with respect to the pleading allegations in Lundy. 19 A. Article III Standing 20 Facebook again says that plaintiffs have “fail[ed] to plead adequately the ‘injury in fact’ 21 necessary to demonstrate Article III standing.” Dkt. No. 82 at 6. The principles and analysis in 22 the Heeger discussion apply here with equal force. 23 For the intrusion upon seclusion, California constitutional privacy, breach of contract, and 24 breach of implied covenant of good faith and fair dealing claims, the salient question is whether 25 plaintiffs have plausibly alleged privacy injuries, see In re Facebook, 956 F.3d at 598, and 26 specifically, whether they alleged more than the collection of IP addresses. They have. The 27 Lundy FAC expressly alleges for both plaintiffs that a Facebook folder entitled, “Security and 1 location by IP address, latitude and longitude at specific dates and times from 2014 through the 2 present.” Dkt. No. 80 ¶¶ 12, 17. The FAC adds that “[t]hese files contained the IP addresses 3 assigned by plaintiffs’ respective Internet Service Providers (‘ISP’) to their devices when they 4 logged into the Facebook App, along with the precise longitude and latitude of the IP address.” 5 Id. ¶ 48. The FAC gives this example of what was collected: 6 Estimated location inferred from IP 32.584, -97.168 Created Dec 16, 2017 2:32 pm 7 Id. 8 Plaintiffs allege that “[t]he ‘Login Protection Data’ and ‘Where You’re Logged In’ 9 subfiles, located under the obscurely labeled ‘Security and Login Information’ file, contain precise 10 longitude and latitude coordinates inferred from IP addresses,” as discussed above. Id. ¶ 51. They 11 also say that “Facebook then further refined plaintiffs’ location derived from the IP addresses 12 using enhanced location tracking methodologies.” Id. “For purposes of illustration,” plaintiffs 13 allege that Facebook logged plaintiff Lundy’s IP address on August 31, 2018, at 6:38 p.m., as 14 “71.209.176.35.” Id. ¶ 53. Inputting that IP address into “IP location service providers’ websites 15 for free to determine the location based on that IP address,” returned results showing Lundy might 16 have been in Phoenix, Gilbert, or Mesa, Arizona. Id. ¶ 54. Facebook’s log, however, included not 17 just Lundy’s IP address but also his geocoordinates of “34.6, latitude, -112.28 longitude,” 18 “show[ing] that Mr. Lundy was in Prescott, Arizona at that date and time. Id. ¶ 53. Given that 19 “[t]he various IP location providers result in geocoordinate locations for the same IP address more 20 than 100 miles away in the Phoenix, Arizona metropolitan area,” plaintiffs say “[t]hese differences 21 indicate that Facebook used an enhanced location determination technique based on data collected 22 from other users instead of, or in addition to, simply plotting plaintiff Lundy’s IP address location 23 in order to more precisely pinpoint the location of the IP address.” Id. ¶ 55. 24 This alleges considerably more than the collection of IP addresses. Plaintiffs have made 25 specific, factual allegations pointing to “enhanced” geocoordinate location information. As the 26 Court said in the first motion to dismiss order in Heeger, “[b]oth the common law and the literal 27 understandings of privacy encompass the individual’s control of information concerning his or her 1 was also “the core value furthered by the Privacy Initiative,” which added a right of privacy to the 2 California constitution. Id. (quoting Hill v. Nat’l Collegiate Athletic Ass’n, 7 Cal. 4th 1, 21 3 (1994)). Plaintiffs have plausibly alleged harm to these privacy interests, and so have standing to 4 pursue their California constitutional privacy claim, intrusion upon seclusion claim, “as well as 5 their claims for breach of contract and breach of the implied covenant of good faith and fair 6 dealing.” In re Facebook, 956 F.3d at 599. 7 To have standing to pursue the fraud claims, plaintiffs must demonstrate that they suffered 8 an economic injury. See id. & n.4 (“[f]raud . . . requires damages”). And for their unjust 9 enrichment claim, plaintiffs “must allege they retain a stake in the profits garnered from” the 10 location data collected from plaintiffs “because the circumstances are such that, as between the 11 two parties, it is unjust for Facebook to retain it.” Id. at 599-600 (quotations and alterations 12 omitted). “Under California law, this stake in unjustly earned profits exists regardless of whether 13 an individual planned to sell his or her data or whether the individual’s data is made less 14 valuable.” Id. at 600. 15 Here, as in In re Facebook, plaintiffs have alleged that the location data collected from 16 them “carry financial value.” Id. They say that “[l]ocation data presents one of the most valuable 17 forms of data that Facebook collects about its users for its advertisers,” and that “[t]he location 18 data bundled with plaintiffs’ personal information is . . . worth $1.72” per individual. Dkt. No. 80 19 ¶ 77. They also point to a 2015 survey in which U.S. respondents, “on average, believe[d] that 20 their physical location is worth $16.1, and their home address is worth $12.9.” Id. ¶ 78. Plaintiffs 21 add that Facebook “targeting advertisers for its mobile users has become the Company’s focus for 22 generating advertising revenue,” and “[a]s of 2018, over 90% of Facebook’s advertising revenue 23 came from mobile users.” Id. ¶¶ 79-81. Plaintiffs also allege that Facebook “collected users’ IP 24 addresses, identified the users’ locations through their IP addresses, then bundled that location 25 information with other user information and monetized it by selling it for targeted advertising 26 purposes.” Id. ¶ 3. 27 All of these allegations are “sufficient at the pleading stage to demonstrate that these 1 interest whose violation constitutes an injury sufficient to establish standing to bring their claims 2 for . . . fraud” as well as for unjust enrichment. In re Facebook, 956 F.3d at 601. 3 B. Intrusion Upon Seclusion and California Constitutional Privacy Claims 4 While plaintiffs have made out standing to sue, the substantive facts alleged for their 5 causes of action need work. To state a claim for intrusion upon seclusion under California 6 common law, a plaintiff must plead that “(1) a defendant ‘intentionally intruded into a place, 7 conversation, or matter as to which the plaintiff has a reasonable expectation of privacy,’ and 8 (2) the intrusion ‘occurred in a manner highly offensive to a reasonable person.’” In re Facebook, 9 956 F.3d at 601 (quoting Hernandez v. Hillsides, Inc., 47 Cal. 4th 272, 286 (2009)). To state a 10 claim for invasion of privacy under the California constitution, plaintiffs must show: “(1) a 11 legally protected privacy interest; (2) a reasonable expectation of privacy in the circumstances; 12 and (3) conduct by defendant constituting a serious invasion of privacy.” McDonald v. Kiloo ApS, 13 385 F. Supp. 3d 1022, 1032 (N.D. Cal. 2019) (quoting Hill, 7 Cal. 4th at 39-40). For the last 14 element, the invasion of privacy must be sufficiently serious in “nature, scope, and actual or 15 potential impact to constitute an egregious breach of the social norms underlying the privacy 16 right.” Id. (quoting Hill, 7 Cal. 4th at 37). When alleged together, the Court “asses[es] the two 17 claims together and examine[s] the largely parallel elements of these two claims which call on the 18 Court to consider (1) the nature of any intrusion upon reasonable expectations of privacy, and 19 (2) the offensiveness or seriousness of the intrusion, including any justification and other relevant 20 interests.” Heeger Dkt. No. 70 at 5 (quotations and citations omitted). 21 “The existence of a reasonable expectation of privacy, given the circumstances of each 22 case, is a mixed question of law and fact.” In re Facebook, 956 F.3d at 601 (citing Hill, 7 Cal. 4th 23 at 40). What a user would reasonably expect in light of Facebook’s disclosures is a relevant 24 question, but so is “the amount of data allegedly collected.” Id. at 602-03. And, “[t]he nature of 25 the allegedly collected data is also important.” Id. at 603. In In re Facebook, the circuit stated, 26 “[t]he question is not necessarily whether plaintiffs maintained a reasonable expectation of privacy 27 in the information in and of itself. Rather, we must examine whether the data itself is sensitive 1 and whether the manner in which it was collected -- after users had logged out -- violates social 2 norms.” Id. at 603. 3 The Court cannot conclude that there is a factual question as to whether the location data 4 Facebook allegedly collected here might be sensitive and confidential. At most, plaintiffs have 5 alleged that Facebook “pinned” plaintiff Lundy down to a city and state. As the Court determined 6 in Heeger, “a generalized location, such as one that locates a user no more precisely than within 7 several city blocks, may not implicate much in the way of privacy concerns.” Heeger Dkt. No. 70 8 at 6. The city-level tracking alleged in Lundy is substantially more general and imprecise, and 9 plaintiffs have not provided any factual allegations to show otherwise. Plaintiffs also do not allege 10 that Facebook tracked this city data after users had logged out. Facebook is said to have collected 11 it only while plaintiffs were using the app. Lundy FAC ¶ 47. 12 Consequently, plaintiffs have not plausibly alleged a reasonable expectation of privacy in 13 the location data collected by Facebook. The Court has doubts about the seriousness of the 14 alleged invasion as well, but does not need to decide that now. The two privacy claims are 15 dismissed with leave to amend. 16 C. Intentional Misrepresentation and Omission, Deceit by Concealment or 17 Omission, and Negligent Misrepresentation 18 In their complaint, plaintiffs asserted claims for intentional misrepresentation and 19 omission; deceit by concealment or omission, Cal. Civ. Code §§ 1709, 1710; and negligent 20 misrepresentation. Both sides discuss these claims together in their motion papers. See Dkt. 21 No. 82 at 9-13; Dkt. No. 83 at 9-12. Plaintiffs do not dispute Facebook’s statement that all three 22 claims require “(1) a misrepresentation or omission of material fact; (2) knowledge of falsity; 23 (3) intent to defraud or to induce reliance; (4) justifiable reliance; and (5) resulting damage. 24 Negligent misrepresentation relaxes only the intent element.” Dkt. No. 82 at 9-10. 25 Plaintiffs have plausibly alleged a misrepresentation or omission. The complaint cites 26 these statements in the Facebook Data Policy that was in effect during the relevant time period: 27 We collect information from or about the computers, phones, or 1 other devices where you install or access our Services, depending on the permissions you’ve granted. . . . Here are some examples of the 2 device information we collect: 3 . . .
4 • Device locations, including specific geographic locations, 5 such as through GPS, Bluetooth, or WiFi signals.
6 • Connection information such as the name of your mobile operator or ISP, browser type, language and time zone, 7 mobile phone number and IP address. 8 Dkt. No. 80 ¶ 24; Dkt. No. 80-1 at ECF p.3. A typical user would reasonably conclude from these 9 statements that Facebook would not collect device locations or IP address without user consent. 10 Otherwise, the phrase “depending on the permissions you’ve granted” would be misleading in 11 itself. Plaintiffs have also plausibly alleged that Facebook failed to disclose that it uses “enhanced 12 location determination techniques to more accurately pinpoint IP address locations.” Dkt. No. 80 13 ¶ 58. 14 The reliance allegations are less sound. Plaintiffs say they “specifically allege[d] . . . that 15 they adjusted their devices and app settings to turn off permission to access their location data in 16 2013 and 2014.” Dkt. No. 83 at 11 (citing Lundy FAC ¶¶ 10, 11, 15, 16, 48, 143, 151). But those 17 allegations do not adequately establish reliance, especially in light of Facebook’s assertion in reply 18 that the Data Policy at issue became effective on September 29, 2016. Dkt. No. 85 at 7. Plaintiffs 19 have also failed to explain how their continued use of Facebook even after discovery of this issue 20 does not defeat any alleged reliance on their part. 21 The fraud claims are consequently dismissed with leave to amend. 22 D. Breach of Contract and Breach of Implied Covenant of Good Faith and Fair 23 Dealing 24 “In order to establish a contract breach, plaintiffs must allege: (1) the existence of a 25 contract with Facebook, (2) their performance under that contract, (3) Facebook breached that 26 contract, and (4) they suffered damages.” In re Facebook, 956 F.3d at 610. 27 Neither side gave the breach of contract and implied covenant of good faith and fair 1 in the FAC are thin, and the scant argument for them by plaintiffs did not justify keeping these 2 claims alive. Plaintiffs need to do more to establish the existence of a contract, especially in light 3 of the fact that the strongest language in their favor appears in the Data Policy, and in In re 4 Facebook, the circuit held that the Data Use Policy at issue in that case did “not constitute a 5 separate contract.” 956 F.3d at 611. The Court also has doubts about plaintiffs’ damages 6 allegations. 7 For the implied covenant of good faith and fair dealing, as in In re Facebook, plaintiffs’ 8 implied covenant allegations do not appear to “go beyond the breach of contract theories asserted 9 by plaintiffs.” 956 F.3d at 611. The breach of contract and breach of implied covenant of good 10 faith and fair dealing claims are dismissed with leave to amend. 11 E. Unjust Enrichment 12 Facebook moved to dismiss plaintiffs’ unjust enrichment claim because “in California, 13 there is not a standalone cause of action for unjust enrichment”; a quasi-contract claim is barred 14 where, as here, “an enforceable, binding agreement exists defining the rights of the parties”; and 15 plaintiffs “fail to plead any misrepresentation or unfair action by Facebook.” Dkt. No. 82 at 15. 16 Plaintiffs did not provide a clear response to these challenges, and said only that “[c]ontrary to 17 Facebook’s argument, plaintiffs properly plead unjust enrichment along with its breach of contract 18 claim.” Dkt. No. 83 at 15. Why this might be so is left unexplained. In effect, plaintiffs failed to 19 oppose dismissal of the unjust enrichment claim, and it is dismissed for that reason with leave to 20 amend. 21 CONCLUSION 22 Facebook’s motion to dismiss the Heeger FAC is granted, and its motion to dismiss the 23 Lundy FAC is denied in part and granted in part. In both cases, plaintiffs are granted leave to 24 amend, and any amended complaints must be filed by January 21, 2021. 25 // 26 // 27 // 1 No new claims or defendants may be added without express leave of Court. 2 IT IS SO ORDERED. 3 Dated: December 24, 2020 4 5 JAMES MPONATO 6 United pftates District Judge 7 8 9 10 11 12
Z 18 19 20 21 22 23 24 25 26 27 28