Hubbard v. Google LLC

Opinion

1 2 3 UNITED STATES DISTRICT COURT 4 NORTHERN DISTRICT OF CALIFORNIA 5 SAN JOSE DIVISION 6 7 NICHOLE HUBBARD, et al., Case No. 19-cv-07016-BLF

8 Plaintiffs, ORDER GRANTING MOTION TO 9 v. DISMISS WITH LEAVE TO AMEND

10 GOOGLE LLC, et al., [Re: ECF 125] 11 Defendants.

12 13 For the second time, this Court must decide whether Plaintiffs in this action have alleged 14 illegal behavior on the part of Defendants that goes beyond what Congress has regulated under the 15 Children’s Online Privacy Protection Act, 15 U.S.C. §§ 6501–6506 (“COPPA”). For the second 16 time, this Court finds that they have not. 17 Minor Plaintiffs C.H., by and through their guardian ad litem Nichole Hubbard; E.J., N.J., 18 A.J., and L.J., by and through their guardian ad litem Cara Jones; J.A.E. and J.R.E., by and 19 through their guardian ad litem Justin Efros; M.W., by and through their guardian ad litem Renee 20 Gilmore; A.G., by and through their guardian ad litem Jay Goodwin; and C.D., by and through 21 their guardian ad litem Bobbi Dishman, (“Plaintiffs”) bring this suit against Defendants Google 22 LLC and YouTube LLC (collectively “Google”) and Cartoon Network, Inc., Cartoon Network 23 Studios, Inc., ChuChu TV Studios, DreamWorks Animation LLC, DreamWorks Animation 24 Television, LLC, Hasbro, Inc., Hasbro Studios LLC, Mattel, Inc., Remka, Inc., RTR Production, 25 LLC, RFR Entertainment, Inc., and Pocketwatch, Inc. (collectively “Channel Owners”). Plaintiffs 26 allege Defendants unlawfully violated the right to privacy and reasonable expectation of privacy 27 of their children, who are all under thirteen years of age and subject to COPPA’s protections. See 1 Defendants. Id. 2 On December 21, 2020, this Court granted Defendants’ motion to dismiss and held that 3 Plaintiffs’ claims were preempted under COPPA. See Order (“Prior Order”) ECF 117. Now, 4 Defendants have filed another motion to dismiss, maintaining that the claims in Plaintiffs’ third 5 amended complaint are still preempted by COPPA. See Mot., ECF 125. Plaintiffs oppose, arguing 6 that they have sufficiently alleged deceptive conduct on the part of Defendants that goes beyond 7 the conduct regulated by COPPA. See Opp’n, ECF 127. The Court agrees with Defendants and 8 finds Plaintiffs’ claims remain preempted by COPPA. Accordingly, the Court GRANTS 9 Defendants’ motion. As further explained below, because Plaintiffs could potentially cure the 10 defects in their complaint with named plaintiffs in the 13-16 age range, the Court dismisses the 11 complaint with leave to amend. 12 13 I. BACKGROUND 14 Google operates the video sharing-platform YouTube (“YouTube platform”). 3AC ¶ 2. 15 The YouTube platform is accessible as a website, mobile application, or via an application on a 16 set-top streaming device that can connect to a television. Id. Any individual or organization 17 registered with YouTube, through a Google account, may upload videos they have created. Id. 18 These videos are uploaded to that individual’s or organization’s “channel.” Id. Individuals do not 19 have to register or sign in to view videos uploaded to the YouTube platform. Id. There is no age 20 verification required to view videos. Id. 21 The YouTube platform is “the #1 website regularly visited by kids.” 3AC ¶ 4. Defendants 22 Mattel and Hasbro, classic toy brands, are among the Channel Owners who maintain and create 23 content aimed at children. Id. Other Channel Owners do the same: for example, Defendant 24 ChuChuTV’s channel features cartoons and nursery rhymes. Id. ¶ 101. Defendants Remka, RTR 25 Production, RFR Entertainment, and Pocketwatch together operate a channel, Ryan’s World, 26 featuring a nine-year-old boy unboxing toys and other children’s products. Id. ¶ 106. This is the 27 second-most popular YouTube channel, with approximately 22.5 million subscribers and over 33 1 billion views. Id. ¶ 107. Plaintiffs detail the child-aimed content of the other Channel Owner 2 Defendants as well. Id. ¶¶ 112-13; 119, 122, 126, 130-31. 3 Google and the Channel Owners generate revenue from the YouTube platform through 4 advertising, with Google placing ads on the channels and keeping 45% of the ad revenue. 3AC ¶ 5 5. The Channel Owners retain 55% of the ad revenue. Id. Plaintiffs allege that Google, with the 6 authorization and consent of the channel owners, impermissibly “knowingly and purposefully 7 tracked, profiled, and targeted minors on the YouTube Platform for advertising revenue.” Id. ¶ 81. 8 Plaintiffs allege that Google tracked Plaintiffs’ personal data and information, such as internet 9 protocol addresses and device serial numbers, and that allowed Google to develop profiles of 10 individuals over time by tracking their activities across multiple websites. Id. ¶ 9. While Google 11 maintained in the YouTube terms of service and the Google Privacy Policy that the YouTube 12 Platform was not for children under thirteen, id. at ¶ 85, the Channel Owners intentionally created 13 content aimed at children under thirteen so that Google could target and track young children for 14 ad revenue, id. ¶ 99. 15 Through COPPA, Congress has regulated the amount of data Google is legally able to 16 collect from children without parental consent. TAC ¶ 72. COPPA provides, in pertinent part, that, 17 It is unlawful for an operator of a website or online service directed to children, or any 18 operator that has actual knowledge that it is collecting personal information from a child, 19 to collect personal information from a child in a manner that violates the regulations prescribed [by the Federal Trade Commission]. 20 21 15 U.S.C. § 6502(a). TAC ¶ 72. COPPA applies to any operator of a commercial website or online 22 service directed to children under thirteen years of age that collects, uses, and/or discloses personal 23 information from children. Id. ¶ 73. The Federal Trade Commission (“FTC”) has interpreted 24 COPPA’s definition of “website or online service” to include individual channels on a general 25 audience platform—according to the FTC, “content creators and channel owners” are both 26 “standalone ‘operators’ under COPPA, subject to strict liability for COPPA violations.” Id.; 27 Statement of Joseph J. Simons & Christine S. Wilson, Federal Trade Commission, Regarding FTC 1 https://www.ftc.gov/system/files/documents/public_statements/1542922/simons_wilson_google_y 2 outube_statement.pdf. The FTC also considers third parties with actual knowledge that they are 3 collecting personal information from users of a child-directed site or service as operators under 4 COPPA. Id. ¶ 73. 5 In order to determine whether a website or online service is “directed to children” the FTC 6 is to: [C]onsider [the website’s or online service’s] subject matter, visual content, use of 7 animated characters or child-oriented activities and incentives, music or other audio 8 content, age of models, presence of child celebrities or celebrities who appeal to children, language or other characteristics of the Web site or online service, as well as whether 9 advertising promoting or appearing on the Web site or online service is directed to children. 10 16 CFR § 312.2. TAC ¶ 74. COPPA defines a “child” as an individual under the age of thirteen. 11 15 U.S.C. § 6501(a). TAC ¶ 76. The FTC regulations require an operator to disclose information 12 collection practices and “obtain verifiable parental consent for [any] collection, use, or disclosure 13 of personal information from children.” 15 U.S.C. § 6502(b)(1)(A); 16 C.F.R. § 312.5(a); TAC ¶ 14 76. Among the types of personal information under COPPA that may only be collected from 15 children with parental consent are “persistent identifier[s] that can be used to recognize a user over 16 time and across different sites, including a cookie number, an IP address, a processor or device 17 serial number, or a unique device identifier.” TAC ¶ 77. 18 Google has been subject to COPPA enforcement previously. TAC ¶ 66. In Fall 2019, 19 Google reached a settlement with the FTC and New York Attorney General, and Google 20 announced it would start treating data from anyone watching children’s content on the YouTube 21 Platform as coming from a child, regardless of the age of the user, which brought it into 22 compliance with COPPA. Id. 23 Plaintiffs allege that Google did its tracking, profiling, and targeting of children while 24 feigning compliance with applicable federal and state laws. 3AC ¶¶ 81, 164. Plaintiffs cite 25 Google’s then-Code of Conduct, which read, in relevant part: 26

27 “Don’t be evil.” Googlers generally apply those words to how we serve our users. But “Don’t can. But it’s also about doing the right thing more generally – following the law, acting 1 honorably and treating co-workers with courtesy and respect. 2 3AC ¶ 164. Plaintiffs also cite Google’s then-Privacy Policy (“Our goal is to be clear about what 3 information we collect, so that you can make meaningful choices about how it is used”) and Terms 4 of Service (“We want to maintain a respectful environment for everyone, which means you must 5 follow these basic rules of conduct” including “comply[ing] with applicable laws”) and allege that 6 these corporate policies created an expectation of privacy with respect to the YouTube Platform. 7 Id. ¶¶ 161-167. Despite this alleged expectation of privacy, Google tracked and collected the 8 personal information of children under the allegedly false pretense that Google would be 9 “transparent” with parents about what information was being collected from child viewers and 10 compliant with applicable legal requirements and prohibitions, including COPPA. Id. ¶ 166. 11 Plaintiffs further allege that Google’s Privacy Policy deceptively conceals that the purpose of its 12 tracking and assimilating information from the YouTube Platform is to enable it to target the 13 vulnerabilities of children through behavioral advertising for profit. Id. ¶ 9. 14 Plaintiffs also acknowledge that Google’s Privacy Policy discloses that it collects personal 15 information from individuals who access the YouTube Platform, including persistent identifiers 16 such as a user’s IP address. TAC ¶ 55. Plaintiffs also allege that Google discloses that it tracks any 17 individuals’ activity on any webpage that uses Google’s advertising services, and this tracking 18 activity allows Google to deliver more relevant search results and ads to YouTube video viewers. 19 TAC ¶¶ 62-63. 20 Plaintiffs also allege deception on Google’s part through the creation of the YouTube Kids 21 application, which they allege was “guise to generate content for children on the YouTube 22 Platform. TAC ¶ 89. Google did not track users or serve targeted behavior ads on the YouTube 23 Kids app. Id. ¶ 90 Every video available on the YouTube Kids app was also uploaded to the 24 YouTube Platform. Id. ¶ 89. The YouTube Kids app was only available as a mobile application 25 until 2019, so when children searched for their favorite show on a web browser, they would be 26 shown links to child-directed content hosted on the YouTube Platform and not the YouTube Kids 27 app, which allowed Google to employ its tracking and behavioral advertising scheme on the 1 In this lawsuit, Plaintiffs, who are all under the age of thirteen, TAC ¶¶ 26-31, purport to 2 represent “all persons . . . who were sixteen or younger when they used YouTube,” TAC ¶¶ 224- 3 231. Plaintiffs allege violations of the following claims: intrusion upon seclusion; California’s 4 Unfair Competition Law; unjust enrichment under the laws of California, Colorado, Indiana, 5 Massachusetts, New Jersey, and Tennessee; the consumer protection acts of Massachusetts, 6 Colorado, Indiana, New Jersey, and Tennessee; and the California constitutional right to privacy. 7 SAC ¶¶ 204-356. Defendants bring this motion to dismiss on several grounds, with preemption as 8 a threshold issue. See Mot. 9 10 II. LEGAL STANDARD 11 “To survive a motion to dismiss, a complaint must contain sufficient factual matter, 12 accepted as true, to ‘state a claim to relief that is plausible on its face.’” Ashcroft v. Iqbal, 556 U.S. 13 662, 678 (2009) (quoting Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 570 (2007)). When 14 considering such a motion, the Court “accept[s] factual allegations in the complaint as true and 15 construe[s] the pleadings in the light most favorable to the nonmoving party.” Manzarek v. St. 16 Paul Fire & Marine Ins. Co., 519 F.3d 1025, 1031 (9th Cir. 2008). However, the Court need not 17 “accept as true allegations that contradict matters properly subject to judicial notice” or 18 “allegations that are merely conclusory, unwarranted deductions of fact, or unreasonable 19 inferences.” In re Gilead Scis. Sec. Litig., 536 F.3d 1049, 1055 (9th Cir. 2008) (internal quotation 20 marks and citations omitted). “Threadbare recitals of the elements of a cause of action, supported 21 by mere conclusory statements, do not suffice.” Iqbal, 556 U.S. at 678 (citing Twombly, 550 U.S. 22 at 555). 23 24 III. DISCUSSION 25 Defendants argue that, just as the Court found last time, Plaintiffs’ claims are preempted 26 by COPPA. Mot. 4-10. Plaintiffs argue that they have alleged deceptive conduct that goes beyond 27 what COPPA regulates, just like the Third Circuit found in In re Nickelodeon Consumer Privacy 1 plausibly alleged deceptive conduct, as Plaintiffs admit they did not view any of the disclosures 2 they allege are deceptive, making allegations that these disclosures created a false expectation of 3 privacy implausible. 4 As the Court detailed in its prior order, COPPA contains the following clause: 5 No State or local government may impose any liability for commercial activities or actions 6 by operators in interstate or foreign commerce in connection with an activity or action 7 described in this chapter that is inconsistent with the treatment of those activities or actions under this section. 8 15 U.S.C. § 6502(d). (emphasis added). Congress specified the FTC would have enforcement 9 authority, 15 U.S.C. §§ 6502(c), 6505(d), with certain other federal agencies retaining authority 10 over entities they oversee, id. §§ 6505(a), (b). Congress also gave an enforcement role to states via 11 parens patriae actions brought by their attorneys general, 15 U.S.C. § 6504(a)(1). Before 12 proceeding with any such lawsuits, a state attorney general must give the FTC notice, 15 U.S.C. § 13 6504(a)(2), and the FTC has a statutory right to intervene, id. § 6504(b). If the FTC has already 14 instituted an action, no State may institute a second action against the same Defendants while the 15 first action is pending, 15 U.S.C. § 6504(d). Congress did not include a private right of action in 16 the statute. 17 The Court found that the plain text of the statute clearly indicates Congress’s desire to 18 expressly preempt Plaintiffs’ state law claims. Prior Order 9-12. Allowing private plaintiffs to 19 bring suits for violations of conduct regulated by COPPA, even styled in the form of state law 20 claims, with no obligation to cooperate with the FTC, is inconsistent with the treatment of COPPA 21 violations as outlined in the COPPA statute. Prior Order 10 (citing Howard v. Blue Ridge Bank, 22 371 F. Supp. 2d 1139, 1143-44 (N.D. Cal. 2005) (rejecting argument that state law claim is not 23 inconsistent with the Fair Credit Reporting Act (“FCRA”) and simply provides an additional state 24 remedy for the unlawful conduct giving rise to the FCRA claim)). 25 Plaintiffs core allegations, and state law causes of action, remain the same in the third 26 amended complaint: Google, together with the Channel Owners, knowingly and purposely 27 tracked, profiled, and targeted minors on the YouTube platform for advertising revenue through 1 deceptive collection of personal information; Google did this while feigning compliance with the 2 law; Google did not disclose the full extent of the information it collected from the children; 3 Google used this information to manipulate and exploit children by extending their time on the 4 YouTube platform, which increased the number of targeted advertisements shown to them, which 5 increased the revenue earned by Google and the Channel Owners. See Prior Order 5; TAC ¶¶ 8-9, 6 81-82, 86, 142-43, 158, 164. The Court advised Plaintiffs in its prior order that they had not 7 alleged deceptive behavior beyond what was regulated by COPPA—the allegations failed to 8 “explain what is deceptive about Google’s collecting of data or grapple with whether Google’s 9 data collection policies have been properly disclosed.” Prior Order 13. The Court finds that 10 Plaintiffs have still failed to allege deception beyond what is regulated by COPPA. 11 In attempt to plead deceptive conduct that falls outside of COPPA regulation, Plaintiffs 12 argue that “Google publicly created the impression of adhering with societal expectations 13 regarding children’s privacy as well as with related laws and guidelines such as COPPA through 14 its Privacy Policy for the YouTube platform.” Opp’n 4-5; see also TAC ¶¶ 166-67. Plaintiffs also 15 highlight Google’s previous Code of Conduct, which stated “Don’t be evil” and “Obey the Law: 16 Google takes its responsibilities to comply with laws and regulations very seriously and each of us 17 is expected to comply with applicable legal requirements and prohibitions.” Opp’n 5; see also 18 TAC ¶¶ 168-69. This, according to Plaintiffs, created an expectation of privacy for children 19 viewing of the Channel Owners’ child-directed content on the YouTube Platform. Opp’n 5; see 20 also TAC ¶ 16. According to Plaintiffs, Google tracked and collected personal information from 21 children “under the alleged false pretense that that it would be ‘transparent’ with parents about 22 what information was being collected from child viewers, and would comply with applicable legal 23 requirements and prohibitions—including COPPA—in doing so.” Opp’n 5; see also TAC ¶ 16. 24 Critically, Plaintiffs also allege that Google’s Privacy Policy discloses that it collects the following 25 types of information from YouTube users: videos watched; browsing history; activity on third- 26 party sites and apps that use Google services, which includes Google’s advertising services; GPS; 27 IP address; and unique identifiers such as cookies and device IDs. TAC ¶ 52. Plaintiffs do not 1 Conduct. See Opp’n 18-19 (“Plaintiffs allege that Defendants’ conduct was deceptive, they do not, 2 as Defendants note, claim that their parents read or saw purported misrepresentations or claim that 3 the Channel Owners made any misrepresentations to them. They also do not allege that their 4 parents would have stopped them from using YouTube with different disclosures.”) (internal 5 citation omitted). 6 With regards to the Plaintiffs in this case—all children under thirteen years old—the Court 7 finds this alleged conduct squarely covered, and preempted, by COPPA and its exclusive remedial 8 scheme that vests enforcement authority in the FTC and state attorneys general. See 15 U.S.C. §§ 9 6502(a)-(d), 6505(a)-(d); 16 C.F.R. § 312.5(a). Plaintiffs invite the Court to reconsider its prior 10 ruling on preemption, arguing that preemption should only apply in situations where the state law 11 claims are “inconsistent” with COPPA. Opp’n 2. However, as explained previously, the Court 12 must read the rest of that sentence in the statute, which establishes that state laws are preempted if 13 they impose liability “inconsistent with the treatment of those activities or actions under this 14 section.” 15 U.S.C. § 6502(d). The treatment Congress has provided for COPPA violations is 15 enforcement by the FTC and state attorneys general, and Plaintiffs’ attempt to run an end-around 16 the scheme with state law liability is “inconsistent with the treatment” and thus preempted. 17 The only new case Plaintiffs cite in support of their preemption argument is In re Zoom 18 Video Communications Inc. Privacy Litig., No. 20-CV-02155-LHK, 2021 WL 930623, *23-24 19 (N.D. Cal. Mar. 11, 2021).1 Opp’n 1. In re Zoom is a 58-page opinion that references COPPA in 20 one paragraph and does not address preemption at all. 2021 WL 930623 at *23. The Court finds 21 Plaintiffs’ description of In re Zoom as having “declined to dismiss actions based on preemption 22 grounds” a gross mischaracterization. 23 Plaintiffs argue that they have alleged deceptive conduct like the plaintiffs in Nickelodeon. 24

25 1 The Court reiterates is previous opinion distinguishing New Mexico ex rel. Balderas v. Tiny Lab Prods., 457 F. Supp. 3d 1103, 1121, 1127 (D.N.M. 2020), on reconsideration, 2021 WL 354003 26 (D.N.M. Feb. 2, 2021): “The Court finds Tiny Lab distinguishable from this case because Tiny Lab was brought by the New Mexico Attorney General, who can enforce violations of COPPA 27 under the statute’s remedial scheme. Further, while not the basis of the preemption decision, it 1 Opp’n 1-3. Not so. In Nickelodeon, the registration form for defendants’ child-focused website 2 included the message, “HEY GROWN-UPS: We don’t collect ANY personal information about 3 your kids. Which means we couldn’t share it even if we wanted to!” and this apparently was not 4 true. Nickelodeon, 827 F.3d at 268-69, 291. The court applied a presumption against preemption 5 under Third Circuit law and found that the plaintiffs’ intrusion upon seclusion claim was not 6 preempted by COPPA, and the court rested its finding on the fact that “the wrong at the heart of 7 the plaintiffs’ intrusion claim is not that Viacom and Google collected children’s personal 8 information, or even that they disclosed it. Rather, it is that Viacom created an expectation of 9 privacy on its websites and then obtained the plaintiffs’ personal information under false 10 pretenses.” Nickelodeon, 827 F.3d at 292. “Understood this way,” the Third Circuit stated, “there 11 is no conflict between the plaintiffs’ intrusion claim and COPPA.” Id. 12 The disclosure in this case is quite different. Most notably, while Viacom lied about 13 collecting data, Google disclosed the fact that it collected data from YouTube users. TAC ¶ 52. A 14 user of the Viacom website could not miss the HEY GROWN-UPS disclosure; here, Plaintiffs 15 concede that they did not see the purported misrepresentations. Opp’n 18-19. Statements such as 16 “Don’t do evil” and “Obey the Law” are not actionable. See Veal v. LendingClub Corp., 423 F. 17 Supp. 3d 785, 804 (N.D. Cal. 2019) (“The Court agrees with Defendants that the statements 18 touting LendingClub's focus on compliance, building trust with various stakeholders, and 19 transparency are examples of corporate optimism and puffery.”), Allergan USA Inc. v. Imprimis 20 Pharm., Inc., 2018 WL 5919210, at *7 (C.D. Cal. Apr. 30, 2018) (statement about “complying 21 with all applicable laws and regulations” not actionable). It is unclear what type of disclosure 22 Plaintiffs would view as adequate—HEY GROWN-UPS: We are collecting personal information 23 about your kids to MANIPULATE them! —but it is clear that Plaintiffs have not adequately 24 alleged deceptive conduct that places Defendants’ behavior outside of what is regulated by 25 COPPA. 26 Plaintiffs attempt to expand their proposed classes to “all persons . . . who were sixteen or 27 younger when they used YouTube,” TAC ¶¶ 224-231. The Court does find adding persons in the 1 Proper Am., ECF 119 (“Plaintiffs have only been granted leave to amend the existing claims of 2 the current parties”). Since all named Plaintiffs are under thirteen, and their claims are thus 3 preempted by COPPA, they cannot seek relief on behalf of a proposed class when they are not 4 eligible to bring the claim in their own right. Sandoval v. Ali, 34 F. Supp. 3d 1031, 1039 (N.D. 5 Cal. 2014) (“in short, a predicate to a plaintiff’s right to represent a class is his eligibility to sue in 6 his own right; what he may not achieve himself, he may not accomplish as a representative of a 7 class”). The Court will grant Plaintiffs leave to amend their complaint if they can substitute proper 8 plaintiffs to represent persons in the 13-16 age range. See Intri-Plex Techs., Inc. v. Crest Group, 9 Inc., 499 F.3d 1048, 1056 (9th Cir. 2007) (finding dismissal without leave to amend proper only if 10 it is clear that “the complaint could not be saved by any amendment”). 11 The Court also notes the following for Plaintiffs’ potentially forthcoming fourth amended 12 complaint. Plaintiffs’ consumer protection claims sound in fraud and therefore need to meet the 13 heightened Rule 9(b) pleading standard for fraud. See Vess v. Ciba-Geigy Corp. USA, 317 F.3d 14 1097, 1103 (“Fraud can be averred by specifically alleging fraud, or by alleging facts that 15 necessarily constitute fraud (even if the word ‘fraud’ is not used)). Under the Rule 9(b) pleading 16 standard, claims of fraud must be accompanied by the “who, what, when, where, and how” of the 17 misconduct alleged. Cooper v. Pickett, 137 F.3d 616, 627 (9th Cir. 1997), superseded by statute 18 on other grounds (internal citation omitted). For the complaint to go forward, these deficiencies 19 must be addressed. 20 The Channel Owners have advanced separate arguments regarding why they should be 21 dismissed from this case, which relate to the underlying merits of Plaintiffs’ claims. Mot. 22-25. 22 Because the Court has found all of Plaintiffs’ claims preempted and granted leave to amend, the 23 Court finds it premature to dismiss the Channel Owners at this time. 24 // 25 // 26 // 27 // IV. ORDER For the foregoing reasons, IT IS HEREBY ORDERED that Defendants’ motion to dismiss is 2 GRANTED with leave to amend. Plaintiffs shall file an amended complaint no later than 30 days 3 after the filing of this order 4 5 IT IS SO ORDERED. 6 7 Dated: July 1, 2021 én) fom Ln ham 9 BETH LABSON FREEMAN 10 United States District Judge 11 12

15 16

= 17

Z 18 19 20 21 22 23 24 25 26 27 28