Hernandez v. Noom, Inc.

• Court: District Court, D. Maryland
• Decided: December 27, 2023
• Docket: 1:23-cv-00641
• Status: Unknown

Opinion

IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF MARYLAND

MARILYN HERNANDEZ, individually and on behalf of all others similarly * situated, * Plaintiff, Case No. 1:23-cv-00641-JRR * v. * NOOM, INC., * Defendant. *

* * * * * * * * * * * * *

MEMORANDUM OPINION This matter comes before the court on Defendant Noom, Inc.’s Motion to Dismiss Plaintiff’s Complaint. (ECF No. 18; the “Motion.”) The parties’ submissions have been reviewed and no hearing is necessary. Local Rule 105.6 (D. Md. 2023). For the reasons that follow, by accompanying order, the Motion will be granted. I. BACKGROUND1 Plaintiff Marilyn Hernandez, individually and on behalf of all others similarly situated, brings this action against Defendant for allegedly wiretapping the electronic communications of visitors to its website, www.noom.com, in violation of Maryland statutory and common law.2 (ECF No. 1.) Plaintiff is citizen and resident of the State of Maryland. Id. ¶ 5.

1 For purposes of this memorandum, the court accepts as true the well-pled facts set forth in the Complaint. (ECF No. 1, titled “Complaint – Class Action” and referred to herein as the “Complaint.”) 2 Plaintiff brings this action pursuant to Federal Rule of Civil Procedure 23 and alleges numerosity, commonality, typicality, adequacy of representation, superiority for certification, predominance, and ascertainability. (ECF No. 1 ¶¶ 63-71.) At this stage of the litigation, the court need not address the factors set forth in Rule 23. Defendant is a Delaware corporation with its principal place of business in New York, New York. Id. ¶ 6. Defendant is a digital health and wellness platform, and operates the website www.noom.com and all of its subpages. Id. ¶ 42. Plaintiff alleges that the court has personal jurisdiction over Defendant because it directed purposeful and tortious acts towards Maryland

citizens. Id. ¶ 8. Plaintiff further alleges that “Defendant chose to avail itself of the business opportunities of marketing and selling its services in Maryland and collecting real-time data from website visit sessions initiated by Maryland citizens while located in Maryland.” Id According to Plaintiff, Defendant procures third-party vendors to embed computer code (“Session Replay Code”) which enables Noom to intercept and record website visitors’ electronic communications with Noom’s website, including “mouse movements, clicks, keystrokes (such as text being entered into an information field or text box), URLs of web pages visited, and/or other electronic communications in real-time.” (ECF No. 1 ¶¶ 1, 25.) Website operators can then access the recordings and view a visual reenactment of the user’s visit through the Session Reply Provider. Id. ¶ 27. Plaintiff alleges that Defendant does not notify users that Defendant utilizes Session

Replay Code or that users’ electronic interactions with the website are recorded. Id. ¶ 60. On March 8, 2022, Plaintiff filed the Complaint, which sets forth two counts: (1) Violation of the Maryland Wiretapping and Electronic Surveillance Act (“MWESA”), MD. CODE ANN., CTS. & JUD. PROC. §§ 10-401, et seq. (Count I); and (2) Invasion of Privacy — Intrusion Upon Seclusion (Count II). (ECF No. 1 at 18–22.) The prayer for relief seeks an order: (i) certifying the Class and appointing Plaintiff as the Class representative; (ii) appointing Plaintiff’s counsel as class counsel; (iii) declaring that Defendant’s alleged past conduct was unlawful; (iv) declaring Defendant’s alleged ongoing conduct is unlawful; (v) enjoining Defendant from continuing the alleged unlawful practices, and awarding such injunctive and other equitable relief as the court deems just and proper; (vi) awarding Plaintiff and the Class members statutory, actual, compensatory, consequential, punitive, and nominal damages, as well as restitution and/or disgorgement of profits allegedly unlawfully obtained; (vii) awarding Plaintiff and the Class members pre-judgment and post-judgment interest; (viii) awarding Plaintiff and the Class members reasonable attorneys’ fees,

costs, and expenses; and (ix) granting such other relief as the court deems just and proper. Id. at 22–23. Defendant moves to dismiss the Complaint on several grounds: (1) Plaintiff fails to allege facts that allow the court to exercise personal jurisdiction over Defendant; (2) Plaintiff fails to sufficiently allege that she suffered an injury-in-fact for Article III standing; and (3) Plaintiff fails to state a claim under MWESA and for common law intrusion upon seclusion. (ECF No. 18-1 at 9-32.) II. LEGAL STANDARDS A. Federal Rule of Civil Procedure 12(b)(1) “Rule 12(b)(1) governs motions to dismiss for mootness and for lack of standing, which

pertain to subject matter jurisdiction.” Stone v. Trump, 400 F. Supp. 3d 317, 333 (D. Md. 2019); see Barnett v. United States, 193 F. Supp. 3d 515, 518 (D. Md. 2016) (“Rule 12(b)(1) of the Federal Rules of Civil Procedure authorizes dismissal for lack of subject matter jurisdiction.”). “The plaintiff bears the burden of proving, by a preponderance of evidence, the existence of subject matter jurisdiction.” Mayor & City Council of Balt. v. Trump, 416 F. Supp. 3d 452, 479 (D. Md. 2019). Subject matter jurisdiction challenges may proceed in two ways: a facial challenge or a factual challenge. Id. A facial challenge asserts “that the allegations pleaded in the complaint are insufficient to establish subject matter jurisdiction.” Id. A factual challenge asserts “that the jurisdictional allegations of the complaint [are] not true.” Id. (quoting Kerns v. United States, 585 F.3d 187, 192 (4th Cir. 2009)). “In a facial challenge, ‘the facts alleged in the complaint are taken as true, and the motion must be denied if the complaint alleges sufficient facts to invoke subject matter jurisdiction.’” Trump, 416 F. Supp. 3d at 479 (quoting Kerns, 585 F.3d at 192 (instructing that in a facial challenge to subject matter jurisdiction the plaintiff enjoys “the same procedural

protection as . . . under a Rule 12(b)(6) consideration.”)). “[I]n a factual challenge, ‘the district court is entitled to decide disputed issues of fact with respect to subject matter jurisdiction.’” Id. Defendant’s 12(b)(1) arguments attack Plaintiff’s pleadings (a facial challenge) and do not present a factual challenge to subject matter jurisdiction. (ECF No. 18-1 at 12-15.) Accordingly, Defendant’s 12(b)(1)-based challenge will be evaluated in accordance with the procedural protections afforded under Rule 12(b)(6), which is to say that the facts alleged in the Complaint will be taken as true per Trump and Kerns. B. Federal Rule of Civil Procedure 12(b)(2) “When a court’s power to exercise personal jurisdiction over a nonresident defendant is challenged by a motion under Federal Rule of Civil Procedure 12(b)(2), ‘the jurisdictional question

is to be resolved by the judge, with the burden on the plaintiff ultimately to prove grounds for jurisdiction by a preponderance of the evidence.’” CoStar Realty Info., Inc. v. Meissner, 604 F. Supp. 2d 757, 763 (D. Md. 2009) (quoting Carefirst of Md., Inc. v. Carefirst Pregnancy Ctrs., Inc., 334 F.3d 390, 396 (4th Cir. 2003)) (citations omitted). “The plaintiff’s burden in establishing jurisdiction varies according to the posture of a case and the evidence that has been presented to the court.” Grayson v. Anderson, 816 F.3d 262, 268 (4th Cir. 2016). “[W]hen the court addresses the personal jurisdiction question by reviewing only the parties’ motion papers, affidavits attached to the motion, supporting legal memoranda, and the allegations in the complaint, a plaintiff need only make a prima facie showing of personal jurisdiction to survive the jurisdictional challenge.” Id. “[I]f a court requires the plaintiff to establish facts supporting personal jurisdiction by a preponderance of the evidence prior to trial, it must conduct an ‘evidentiary hearing’” or, at the very least, “afford the parties a fair opportunity to present both the relevant jurisdictional evidence and their legal arguments, using procedures

that provide the parties with a fair opportunity to present to the court the relevant facts[.]” Id. (citing New Wellington Fin. Corp. v. Flagship Resort Dev. Corp., 416 F.3d 290, 294 n.5 (4th Cir. 2005)); Sec. and Exch. Comm’n v. Receiver for Rex Ventures Group, LLC, 730 F. App’x 133, 136 (4th Cir. 2018) (internal citations and quotation marks omitted). The parties have not engaged in full discovery. Accordingly, Plaintiff need only make a prima facie showing of personal jurisdiction. “In deciding whether the plaintiff has proved a prima facie case of personal jurisdiction, the district court must draw all reasonable inferences arising from the proof, and resolve all factual disputes, in the plaintiff’s favor.” Mylan Labs., Inc. v. Akzo, N.V., 2 F.3d 56, 60 (4th Cir. 1993). “In considering whether a plaintiff has met this burden, a court may look beyond the complaint to affidavits and exhibits in order to assure itself of personal

jurisdiction.” UMG Recordings, Inc. v. Kurbanov, 963 F.3d 344, 350 (4th Cir. 2020). C. Federal Rules of Civil Procedure 8(a) and 12(b)(6) Pursuant to Rule 8(a), “[a] pleading that states a claim for relief must contain . . . a short and plain statement of the claim showing that the pleader is entitled to relief.” FED. R. CIV. P. 8(a). “In 2007, the Supreme Court of the United States set forth a new standard to be applied in assessing whether, under Rule 8(a)(2), a claim was articulated sufficiently to permit a court to conclude that, if its allegations were proved, relief could be granted. In so doing, the Supreme Court retired the standard of sufficiency under Rule 8(a)(2) that was set in Conley v. Gibson, 355 U.S. 41, [] (1957).” Macronix Int’l Co., Ltd. v. Spansion, Inc., 4 F. Supp. 3d. 797, 799 (E.D. Va. 2014). The Conley Court explained the requirements for a legally sufficient complaint as follows: The decisive answer to this is that the Federal Rules of Civil Procedure do not require a claimant to set out in detail the facts upon which he bases his claim. To the contrary, all the Rules require is ‘a short and plain statement of the claim’ [citing Rule 8(a)(2)] that will give the defendant fair notice of what the plaintiff’s claim is and the grounds upon which it rests. The illustrative forms appended to the Rules plainly demonstrate this.

Conley v. Gibson, 355 U.S. at 48. “In Twombly,3 the Court changed significantly how the legal sufficiency of a claim is to be measured when it is attacked under Rule 12(b)(6). As one eminent scholar of federal civil procedure has said of Twombly: ‘Notice pleading is dead. Say hello to plausibility pleading.’” Macronix, 4 F. Supp. 3d at 799-800 (quoting A. Benjamin Spencer, Plausibility Pleading, 49 B.C. L. REV. 431, 431-32 (2008)). The “liberal pleading standard of Federal Rule of Civil Procedure 8(a)(2) has been decidedly tightened (if not discarded) in favor of a stricter standard requiring the pleading of facts painting a ‘plausible’ picture of liability.” Id.; see also Nemet Chevrolet, Ltd. v. Consumeraffairs.com, Inc., 591 F.3d 250, 262 (4th Cir. 2009) (Jones, J., concurring in part, dissenting in part, and remarking that “Twombly and Iqbal4 announce a new, stricter pleading standard.”) Rule 8 “does not require ‘detailed factual allegations,’ but it demands more than an unadorned, the-defendant-unlawfully-harmed-me accusation.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp., v. Twombly, 550 U.S. 544, 555 (2007)). “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Id. (citing Twombly, 550 U.S.

3 Bell Atl. Corp., v. Twombly, 550 U.S. 544 (2007). 4Ashcroft v. Iqbal, 556 U.S. 662 (2009). at 556). “The plausibility standard is not akin to a ‘probability requirement,’ but it asks for more than a sheer possibility that a defendant has acted unlawfully.” Id. (citing Twombly, 550 U.S. at 556). “Determining whether a complaint states a plausible claim for relief will, as the Court of Appeals observed, be a context-specific task that requires the reviewing court to draw on its

judicial experience and common sense.” Id. at 679. “But where the well-pleaded facts do not permit the court to infer more than the mere possibility of misconduct, the complaint has alleged— but it has not show[n]—that the pleader is entitled to relief.” Id. (citing FED. R. CIV. P. 8(a)(2)). “The purpose of Rule 12(b)(6) is to test the sufficiency of a complaint’ and not to ‘resolve contests surrounding the facts, the merits of a claim, or the applicability of defenses.’” Presley v. Charlottesville, 464 F.3d 480, 483 (4th Cir. 2006) (quoting Edwards v. Goldsboro, 178 F.3d 231, 243 (4th Cir. 1999)). Accordingly, a “Rule 12(b)(6) motion should only be granted if, after accepting all well-pleaded allegations in the plaintiff’s complaint as true and drawing all reasonable factual inferences from those facts in the plaintiff’s favor, it appears certain that the plaintiff cannot prove any set of facts in support of his claim entitling him to relief.” Edwards, 178

F.3d at 244 (citing Republican Party v. Martin, 980 F.2d 943, 952 (4th Cir. 1992)). The court, however, is “. . . not required to accept as true the legal conclusions set forth in a plaintiff’s complaint.” Id. (citing District 26, United Mine Workers of Am., Inc. v. Wellmore Coal Corp., 609 F.2d 1083, 1085 (4th Cir. 1979)). III. ANALYSIS A. Subject Matter Jurisdiction Defendant argues that Plaintiff lacks Article III standing to bring her claims because she fails to allege that she suffered an injury-in-fact. (ECF No. 18-1 at 11.) Article III of the Constitution “confines the federal judicial power to the resolution of ‘Cases’ and ‘Controversies.’” TransUnion LLC v. Ramirez, 141 S. Ct. 2190, 2203 (2021). “For there to be a case or controversy under Article III, the plaintiff must have a personal stake in the case—in other words, standing.” Id. Standing consists of three elements: “[t]he plaintiff must

have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.” Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016). A plaintiff bears the burden of establishing these three elements. Id. The first element, injury-in-fact, requires “a plaintiff [to] show that he or she suffered ‘an invasion of a legally protected interest’ that is ‘concrete and particularized’ and ‘actual or imminent, not conjectural or hypothetical.’” Spokeo, 578 U.S. at 339 (quoting Lujan, 504 U.S. at 560). In Spokeo, the Supreme Court made clear that a plaintiff may not “allege a bare procedural violation, divorced from any concrete harm, and satisfy the injury-in-fact requirement of Article III.” 578 U.S. at 341. Rather, “‘Article III standing requires a concrete injury even in the context

of a statutory violation.’” TransUnion, 141 S. Ct. at 2205 (quoting Spokeo, 578 U.S. at 341). “[C]ertain harms readily qualify as concrete injuries under Article III.” Id. at 2204. “The most obvious are traditional tangible harms, such as physical harms and monetary harms.” Id. “Various intangible harms can also be concrete.” Id. “Chief among them are injuries with a close relationship to harms traditionally recognized as providing a basis for lawsuits in American courts[,] . . . for example, reputational harms, disclosure of private information, and intrusion upon seclusion.” Id. Plaintiff argues that she alleges “both an intangible concrete harm resulting from Noom’s unlawful conduct (i.e., an invasion of her privacy) and a tangible one (i.e., an increased risk of identity theft, online scams, and other privacy threats).” (ECF No. 21 at 9.) 1. Intangible Harm

Defendant argues that Plaintiff’s allegation of a violation of MWESA, alone, is insufficient to satisfy injury-in-fact. (ECF No. 18-1 at 11.) In response, Plaintiff relies on Garey v. James S. Farrin P.C., 35 F.4th 917 (4th Cir. 2022). (ECF No. 21 at 8.) Plaintiff asserts that “[e]very MWESA violation results in a concrete privacy harm permitting a plaintiff to bring suit.” Id. Plaintiff compares MWESA to a traditional common law privacy tort and, in doing so, argues that alleging such a violation satisfies the injury element essential to survive a standing challenge. Id. Plaintiff’s reliance on Garey v. James S. Farrin, P.C. is misplaced. 35 F.4th 917 (4th Cir. 2022). There, the defendants were personal injury lawyers who obtained car accident reports from law enforcement agencies and private data brokers. Id. at 919. These reports included names and addresses of drivers involved in accidents; the defendants used the personal information to mail

unsolicited attorney advertising materials to some of the drivers. Id. The plaintiffs, two groups of drivers who received the attorneys’ materials, filed suit for monetary and injunctive relief alleging that the defendants’ actions violated the Driver’s Privacy Protection Act (“DPPA”). Id. at 919-20. The defendants challenged the plaintiffs’ standing. Garey, 35 F.4th at 921. In analyzing the plaintiffs’ standing, the Fourth Circuit explained: Plaintiffs who do not have a legally cognizable injury lack standing to bring suit in federal court. Congress may, of course, “elevat[e] to the status of legally cognizable injuries concrete, de facto injuries that were previously inadequate in law.” Lujan v. Defs. of Wildlife, 504 U.S. 555, 578, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992). But as the Defendants correctly point out, plaintiffs cannot establish a cognizable injury simply by pleading a statutory violation. See Spokeo, Inc. v. Robins, 578 U.S. 330, 341, 136 S.Ct. 1540, 194 L.Ed.2d 635 (2016) (“Article III standing requires a concrete injury even in the context of a statutory violation.”).

Balancing these two rules has in the past caused some confusion, but the Supreme Court recently clarified when a statutory cause of action identifies an injury sufficient for standing purposes. In TransUnion LLC v. Ramirez, the Court explained that plaintiffs proceeding under a statutory cause of action can establish a cognizable injury by “identif[ying] a close historical or common- law analogue for their asserted injury” for which courts have “traditionally” provided a remedy. ––– U.S. ––––, 141 S. Ct. 2190, 2204, 210 L.Ed.2d 568 (2021) (citing Spokeo, 578 U.S. at 341, 136 S.Ct. 1540). A plaintiff who does so has standing even if the precise injury would not, absent the statute, be sufficient for Article III standing purposes.

Consistent with TransUnion, the district court here found standing because “[p]laintiffs’ alleged harms are closely related to the invasion of privacy, which has long provided a basis for recovery at common law.” We agree. Indeed, following Spokeo and foreshadowing TransUnion, we recently rebuffed a nearly identical standing challenge in a case arising under the Telephone Consumer Protection Act (“TCPA”), another consumer privacy statute that, like the DPPA, provides a private right of action against offenders. See Krakauer v. Dish Network, LLC, 925 F.3d 643, 652–54 (4th Cir. 2019).

In Krakauer, we explained that by enacting the TCPA, “Congress responded to the harms of actual people by creating a cause of action that protects their particular and concrete privacy interests.” Id. at 653. And we noted that injuries to personal privacy have long been “recognized in tort law and redressable through private litigation.” Id. We acknowledged that although the TCPA provides claims that differ from common law privacy torts, Spokeo does not require us to “import the elements of common law torts, piece by piece, into any scheme Congress may devise.” Id. Rather, we concluded that our inquiry “focuse[s] on types of harms protected at common law, not the precise point at which those harms become actionable.” Id. at 654. Therefore, we held that the TCPA’s “private right of action . . . plainly satisfies the demands of Article III.” Id. at 653.

Applying the same analysis as Krakauer, we reach the same result. The Plaintiffs have alleged a legally cognizable privacy injury. See, e.g., Garey Second Am. Compl. ¶ 127 (“[E]ach [Plaintiff] sustained actual damages by having his or her privacy invaded by Defendants’ knowingly obtaining his or her name and address from a motor vehicle record for an impermissible purpose in violation of law.”). The Defendants point out some differences between the common law privacy torts and the DPPA, but our inquiry “does not require an exact duplicate in American history and tradition.” TransUnion, 141 S. Ct. at 2204. At bottom, the DPPA is aimed squarely at “the right of the plaintiff, in the phrase coined by Judge Cooley, ‘to be let alone.’” William L. Prosser, Privacy, 48 CALIF. L. REV. 383, 389 (1960) (footnote omitted). See generally Samuel D. Warren & Louis D. Brandeis, The Right to Privacy, 4 HARV. L. REV. 193 (1890). Therefore, the Plaintiffs have Article III standing to pursue claims for damages.

35 F.4th 917, 921-23 (4th Cir. 2022). Relying on Garey, Plaintiff argues that the alleged MWESA violation is sufficient to establish Article III standing because “MWESA was designed to protect people’s privacy.” (ECF No. 21 at 8.) The court disagrees. MWESA “‘was designed with a two-fold purpose: 1) to be a useful tool in crime detection and 2) to assure that interception of private communications is limited.’” Agnew v. State, 461 Md. 672, 681 (2018) (quoting State v. Maddox, 69 Md. App. 296, 300 (1986)). “[T]he [Maryland] Court of Special Appeals expounded on this articulation of the purpose, stating that ‘[t]he clear purpose of [MWESA] is to prohibit secret recordings of private oral communications, without regard to which device may be used to accomplish that task.’” Id. (quoting Holmes v. State, 236 Md. App. 636, 653 (2018)). In contrast to the right at issue in Garey – DPPA’s right “to be let alone” – MWESA is aimed at crime detection and limiting the interception of private communications. See Straubmuller v. Jetblue Airways Corporation, No. CV DKC 23-384, 2023 WL 5671615, at *3 (D. Md. Sept. 1, 2023) (“Assisting crime detection and limiting the interception of private communications – which suggest that interception in certain circumstances may be acceptable – is distinguishable from the DPPA’s right ‘to be let alone’ entirely from attorney advertisers using personal information from car accident reports to send unsolicited mail”). Plaintiff does not provide any authority to support the conclusion that “establishing a violation of privacy-protective statutes such as MWESA are sufficient to establish a concrete, albeit intangible, injury to privacy sufficient to confer standing under Article III.” (ECF No. 21 at 8.) Indeed, courts have reached the opposite conclusion – “there is no consensus that MWESA

violations alone give rise to an injury in fact.” See Straubmuller, 2023 WL 5671615, at *3 (concluding that alleging a violation of MWESA, without additional concrete harm, cannot satisfy Article III standing); see Sprye v. Ace Motor Acceptance Corp., No. 16-cv-03064-PX, 2017 WL 1684619, at *6 (D. Md. May 3, 2017) (holding that the plaintiff failed to allege an injury sufficient to establish standing where the plaintiff alleged that the defendant’s recording phone calls with the plaintiff “constitute[d] numerous and multiple violations of the [MWESA]”). Allegation that Defendant violated MWESA, alone, does not satisfy the “injury-in-fact” element of Article III standing. Plaintiff urges that she satisfies Article III standing by alleging that, upon typing in her personal information on Defendant’s website, Defendant uses Session Replay Code to monitor and

collect Plaintiff’s website communications/actions. (ECF No. 21 at 9-10, citations to the Complaint omitted.) In Straubmuller v. Jetblue Airways Corporation, however, Judge Chasanow explained: While the substantive right to privacy indeed “encompass[es] the individual’s control of information concerning his or her person,” U.S. Dept. of Just. v. Reporters Comm. for Freedom of Press, 489 U.S. 749, 763-64 (1989), the Complaint does not allege that Plaintiff disclosed any personal information while interacting with Defendant’s website. The Complaint merely states, “Plaintiff visited www.jetblue.com on his computer while in Maryland.” (ECF No. 1 ¶ 44). Plaintiff states that during his visit to Defendant’s website, his “electronic communications,” such as mouse movements, clicks, and keystrokes, were captured and sent to various Session Replay Providers. (ECF No. 1 ¶ 1). Plaintiff further describes various types of “highly sensitive” personal information that could be captured by Session Replay Code, including personally identifying information and credit card details. (ECF No. 1 ¶¶ 28, 31). Here, it is dispositive that Plaintiff only alleges that Session Replay Code could capture personal information, not that it actually captured Plaintiff’s personal information. Because the Complaint says nothing about the kinds of interactions Plaintiff had with Defendant’s website, much less the specific kinds of captured personal information implicating a substantive privacy interest, Plaintiff has not alleged that his personal information was intercepted and recorded by Defendant.

2023 WL 5671615, at *4. The Straubmuller court noted that “[o[ther courts have found that violations tantamount to a substantive privacy injury require disclosure of specific personal information.” Id. at *4 n.4 (citing Byars v. Sterling Jewelers, Inc., No. 5:22-cv-01456-SB-SP, 2023 WL 2996686, at *3 (C.D. Cal. Apr. 5, 2023) (“Plaintiff does not allege that she disclosed any sensitive information to Defendant, much less identify any specific personal information she disclosed that implicates a protectable privacy interest. She therefore has not identified any harm to her privacy.”); see also Mikulsky v. Noom, Inc., No. 3:23-CV-00285-H-MSB, 2023 WL 4567096, at *5 (S.D. Cal. July 17, 2023) (holding that the plaintiff’s claims that she suffered concrete harm arising from inputting her personal information in text fields fails to establish standing because she did not identify the specific personal information disclosed); Massie v. Gen. Motors, LLC, No. 21-787-RGA, 2022 WL 534468, at *4 (D. Del. Feb. 17, 2022) (finding that “Plaintiffs have not alleged any disclosure of any of their private information. Insofar as Plaintiffs have alleged GM disclosed their non- private information to Decibel, they have not alleged that Decibel used that information in any way, let alone in a way that harmed or would likely harm Plaintiffs.”); Lightoller v. Jetblue Airways Corp., No. 23-cv-00361-H-KSC, 2023 WL 3963823, at *4 (S.D. Cal. June 12, 2023) (finding allegations that the defendant intercepted the plaintiff’s communications with the defendant’s website, without alleging disclosure of any specific personal information, fail to assert a concrete privacy harm)). Mikulsky v. Noom, Inc., supra, provides additional guidance. The facts of the instant case are nearly identical to the facts in Mikulsky. There, the plaintiff argued “that she has adequately

alleged a concrete harm as a result of inputting her personal information in text fields.” Id. at *5. Specifically, because the plaintiff typed her personal information into the defendant’s website, the plaintiff maintained that she “alleged an intangible concrete harm, namely, an invasion of her privacy.” Id. (internal quotation marks omitted). Rejecting this argument, the Mikulsky court explained: Plaintiff’s conclusory allegation that she disclosed “personal information” does not allow the Court to determine whether Plaintiff has a protectable privacy interest in that information. See Roberts v. Corrothers, 812 F.2d 1173, 1177 (9th Cir. 1987) (A court need not “assume the truth of legal conclusions merely because they are cast in the form of factual allegations”) (citation omitted). For example, if Plaintiff disclosed her basic contact information, such as her email address or phone number, courts have found that type of information does not bear a close relationship to harms traditionally recognized as providing a basis for lawsuits in American courts. See, e.g., I.C. v. Zynga, Inc., 600 F. Supp. 3d 1034, 1049–50 (N.D. Cal. 2022). Without more, the Court is unable to determine whether the “personal information” Plaintiff inputted is protected or whether it was merely information akin to basic contact information that would not trigger a protectable privacy interest. Accordingly, Plaintiff’s allegation is insufficient to allege a concrete harm that is required for Article III standing. See e.g., Byars, 2023 WL 2996686, at *3 (granting motion to dismiss because “[p]laintiff does not allege that she disclosed any sensitive information to Defendant, much less identify any specific personal information she disclosed that implicates a protectable privacy interest. She therefore has not identified any harm to her privacy.”); Armstrong v. Allied Insurance Co., No. 14-cv-0424-JGB, 2014 WL 12591844, at *6-7 (C.D. Cal. Aug. 19, 2014) (granting motion to dismiss because the plaintiff did not identify the specific type of personal information that the defendants allegedly accessed).

2023 WL 4567096, at *5. Here, Plaintiff alleges: Plaintiff has visited www.noom.com and certain of its subpages on her computer while in Maryland prior to filing this action.

While visiting Noom’s website, Plaintiff fell victim to Defendant’s unlawful monitoring, recording, and collection of Plaintiff’s Website Communications with www.noom.com.

***

During a visit by Plaintiff to www.noom.com and its subpages, Plaintiff browsed for different products for sale and signed up for a trial membership. Plaintiff communicated with Noom’s website by using her mouse to hover and click on certain products and services and by typing her personal information in text fields.

The Session Replay Code instantaneously captured her Website Communications throughout her visit. Indeed, through Noom’s procurement of Session Replay Code, Plaintiff’s Website Communications were automatically and secretly intercepted while using Noom’s website. Further, without her consent, Noom procured Session Replay Providers to obtain certain information about her device, browser, and create a unique ID and profile for her.

During the website visit, Plaintiff’s Website Communications were captured by Session Replay Code and sent to various Session Replay Providers.

(ECF No. 1 ¶¶ 48-49, 51-53.) While Plaintiff alleges that “a variety of highly sensitive information can be captured in event responses from website visitors, including medical conditions, credit card details, and other personal information displayed or entered on webpages” (ECF No. 1 ¶ 28), she does not allege that the Session Replay Code actually captured her specific sensitive personal information. Rather, Plaintiff alleges when she typed her personal information in text fields, her “Website Communications” (generally defined in the Complaint at paragraph 1 as “mouse movements, clicks, keystrokes . . . URLs of web pages visited, and/or other electronic communications”) – were captured by Session Replay Code and then sent to Session Replay Providers. Id. ¶¶ 1, 51, 53. Absent allegations regarding “the specific kinds of captured personal information implicating a substantive privacy interest,” Plaintiff fails to adequately allege that she suffered an intangible injury (i.e., invasion of her privacy) – specifically that her personal information was intercepted

and recorded by Defendant. See Straubmuller and Mikulsky, supra. 2. Tangible Injury Plaintiff also argues that Defendant’s disclosure of her communications to Session Replay Providers exposes website visitors to identity theft, online scams, and other privacy threats. (ECF No. 21 at 10.) Defendant argues that Plaintiff fails to allege a personal or specific future risk of identity theft. (ECF No. 22 at 7.) Straubmuller v. Jetblue Airways Corporation, supra, is again instructive. 2023 WL 5671615 (D. Md. Sept. 1, 2023). There, the plaintiff argued that the defendant’s “disclosure of his electronic communications to Session Replay Providers gives rise to a plausible risk of enhanced privacy threats, such as identity theft, constituting a concrete tangible harm.” Id. at *5. The

Straubmuller court rejected this argument: A threatened injury constitutes an injury in fact when it is certainly impending. Clapper v. Amnesty Int’l USA, 568 U.S. 398, 409 (2013). Sufficiently imminent injuries in fact cannot be premised on a “highly attenuated chain of possibilities.” Id. at 410. The Fourth Circuit has interpreted Clapper to require targeting or misuse before a future risk of identity theft qualifies as an injury in fact. See Beck v. McDonald, 848 F.3d 262, 274 (4th Cir. 2017) (holding that without evidence of misuse or deliberate targeting by data thieves, an enhanced risk of identity theft as a result of a data breach is too speculative to constitute an injury in fact); Hutton v. Nat’l Bd. of Examiner in Optometry, Inc., 892 F.3d 613, 622 (4th Cir. 2018) (holding that data breach victims who had already experienced identity theft and credit card fraud sufficiently alleged an injury in fact); O’Leary v. TrustedID, 60 F.4th 240 (4th Cir. 2023) (holding that a plaintiff who cannot connect the alleged statutory violation to an increased risk of identity theft without a “Rube Goldberg-type chain reaction” lacks standing).

Here, Plaintiff has not alleged facts establishing targeting or misuse of his personal information. In fact, as Defendant states, “[Plaintiff] does not allege that he provided any information to JetBlue that could be used to commit the ‘identity theft, online scams, and other privacy threats’ he allegedly fears.” (ECF No. 19 at 12). While Plaintiff argues that being a visitor to Defendant’s website subject to Session Replay Code results in non-conjectural privacy risks, (ECF No. 14 at 17-18), for identity theft to materialize, Defendant’s Session Replay providers must suffer a data breach, the breach must compromise Plaintiff’s sensitive personal information, and an identity thief must misuse that information to harm Plaintiff – the very kind of chain reaction Clapper has deemed too speculative.

2023 WL 5671615, at *5. Like the Sraubmuller plaintiff, Plaintiff here does not adequately allege facts of targeting or misuse of her personal data; nor does Plaintiff allege facts to suggest that her Website Communications could be, or will be, used to steal her identity. As discussed above, outside of a broad category, not unique to Plaintiff, defined generally to include “mouse movements, clicks, keystrokes . . . URLs of web pages visited, and/or other electronic communications,” Plaintiff does not identify specific personal information she disclosed on Defendant’s website and that Defendant intercepted and misused. See Section III.A.1., supra. Plaintiff alleges: In addition to the privacy invasions caused by the diversion of user communications with websites to third-party Session Replay Providers, Session Replay Code also exposes website visitors to identity theft, online scams, and other privacy threats. Indeed, “[t]he more copies of sensitive information that exist, the broader the attack surface, and when data is being collected [ ] it may not be stored properly or have standard protections” increasing “the overall risk that data will someday publicly leak or be breached.”

(ECF No. 1 ¶ 36.) Plaintiff’s allegations, broadly and reasonably construed, are insufficient to plead a tangible injury. Plaintiff’s theory of standing “relies on a highly attenuated chain of possibilities” and fails to connect the alleged statutory violation to an increased risk of identity theft. Clapper v. Amnesty Intern. USA, 568 U.S. 398, 410 (2013); see Straubmuller, 2023 WL 5671615, at *5 (noting that “for identity theft to materialize, Defendant’s Session Replay providers must suffer a data breach, the breach must compromise Plaintiff’s sensitive personal information, and an identity thief must misuse that information to harm Plaintiff”).

IV. CONCLUSION For the reasons set forth above, the court lacks subject matter jurisdiction over Plaintiff’s claims, and will not, therefore, address Defendant’s alternative arguments. By separate order, the Motion (ECF No. 18) will be granted and the Complaint will be dismissed.

/S/ ___________________ Julie R. Rubin United States District Judge December 27, 2023