Hubbard v. Google LLC

Opinion

NICHOLE HUBBARD, et al., Case No. 19-cv-07016-BLF

Plaintiffs, ORDER GRANTING MOTION TO v. DISMISS WITH LEAVE TO AMEND

GOOGLE LLC, et al., [Re: ECF 125] Defendants.

For the second time, this Court must decide whether Plaintiffs in this action have alleged illegal behavior on the part of Defendants that goes beyond what Congress has regulated under the Children’s Online Privacy Protection Act, 15 U.S.C. §§ 6501–6506 (“COPPA”). For the second time, this Court finds that they have not. Minor Plaintiffs C.H., by and through their guardian ad litem Nichole Hubbard; E.J., N.J., A.J., and L.J., by and through their guardian ad litem Cara Jones; J.A.E. and J.R.E., by and through their guardian ad litem Justin Efros; M.W., by and through their guardian ad litem Renee Gilmore; A.G., by and through their guardian ad litem Jay Goodwin; and C.D., by and through their guardian ad litem Bobbi Dishman, (“Plaintiffs”) bring this suit against Defendants Google LLC and YouTube LLC (collectively “Google”) and Cartoon Network, Inc., Cartoon Network Studios, Inc., ChuChu TV Studios, DreamWorks Animation LLC, DreamWorks Animation Television, LLC, Hasbro, Inc., Hasbro Studios LLC, Mattel, Inc., Remka, Inc., RTR Production, LLC, RFR Entertainment, Inc., and Pocketwatch, Inc. (collectively “Channel Owners”). Plaintiffs allege Defendants unlawfully violated the right to privacy and reasonable expectation of privacy of their children, who are all under thirteen years of age and subject to COPPA’s protections. See Defendants. Id. On December 21, 2020, this Court granted Defendants’ motion to dismiss and held that Plaintiffs’ claims were preempted under COPPA. See Order (“Prior Order”) ECF 117. Now, Defendants have filed another motion to dismiss, maintaining that the claims in Plaintiffs’ third amended complaint are still preempted by COPPA. See Mot., ECF 125. Plaintiffs oppose, arguing that they have sufficiently alleged deceptive conduct on the part of Defendants that goes beyond the conduct regulated by COPPA. See Opp’n, ECF 127. The Court agrees with Defendants and finds Plaintiffs’ claims remain preempted by COPPA. Accordingly, the Court GRANTS Defendants’ motion. As further explained below, because Plaintiffs could potentially cure the defects in their complaint with named plaintiffs in the 13-16 age range, the Court dismisses the complaint with leave to amend. Google operates the video sharing-platform YouTube (“YouTube platform”). 3AC ¶ 2. The YouTube platform is accessible as a website, mobile application, or via an application on a set-top streaming device that can connect to a television. Id. Any individual or organization registered with YouTube, through a Google account, may upload videos they have created. Id. These videos are uploaded to that individual’s or organization’s “channel.” Id. Individuals do not have to register or sign in to view videos uploaded to the YouTube platform. Id. There is no age verification required to view videos. Id. The YouTube platform is “the #1 website regularly visited by kids.” 3AC ¶ 4. Defendants Mattel and Hasbro, classic toy brands, are among the Channel Owners who maintain and create content aimed at children. Id. Other Channel Owners do the same: for example, Defendant ChuChuTV’s channel features cartoons and nursery rhymes. Id. ¶ 101. Defendants Remka, RTR Production, RFR Entertainment, and Pocketwatch together operate a channel, Ryan’s World, featuring a nine-year-old boy unboxing toys and other children’s products. Id. ¶ 106. This is the second-most popular YouTube channel, with approximately 22.5 million subscribers and over 33 billion views. Id. ¶ 107. Plaintiffs detail the child-aimed content of the other Channel Owner Defendants as well. Id. ¶¶ 112-13; 119, 122, 126, 130-31. Google and the Channel Owners generate revenue from the YouTube platform through advertising, with Google placing ads on the channels and keeping 45% of the ad revenue. 3AC ¶ 5. The Channel Owners retain 55% of the ad revenue. Id. Plaintiffs allege that Google, with the authorization and consent of the channel owners, impermissibly “knowingly and purposefully tracked, profiled, and targeted minors on the YouTube Platform for advertising revenue.” Id. ¶ 81. Plaintiffs allege that Google tracked Plaintiffs’ personal data and information, such as internet protocol addresses and device serial numbers, and that allowed Google to develop profiles of individuals over time by tracking their activities across multiple websites. Id. ¶ 9. While Google maintained in the YouTube terms of service and the Google Privacy Policy that the YouTube Platform was not for children under thirteen, id. at ¶ 85, the Channel Owners intentionally created content aimed at children under thirteen so that Google could target and track young children for ad revenue, id. ¶ 99. Through COPPA, Congress has regulated the amount of data Google is legally able to collect from children without parental consent. TAC ¶ 72. COPPA provides, in pertinent part, that, It is unlawful for an operator of a website or online service directed to children, or any operator that has actual knowledge that it is collecting personal information from a child, to collect personal information from a child in a manner that violates the regulations prescribed [by the Federal Trade Commission]. 15 U.S.C. § 6502(a). TAC ¶ 72. COPPA applies to any operator of a commercial website or online service directed to children under thirteen years of age that collects, uses, and/or discloses personal information from children. Id. ¶ 73. The Federal Trade Commission (“FTC”) has interpreted COPPA’s definition of “website or online service” to include individual channels on a general audience platform—according to the FTC, “content creators and channel owners” are both “standalone ‘operators’ under COPPA, subject to strict liability for COPPA violations.” Id.; Statement of Joseph J. Simons & Christine S. Wilson, Federal Trade Commission, Regarding FTC https://www.ftc.gov/system/files/documents/public_statements/1542922/simons_wilson_google_y outube_statement.pdf. The FTC also considers third parties with actual knowledge that they are collecting personal information from users of a child-directed site or service as operators under COPPA. Id. ¶ 73. In order to determine whether a website or online service is “directed to children” the FTC is to: [C]onsider [the website’s or online service’s] subject matter, visual content, use of animated characters or child-oriented activities and incentives, music or other audio content, age of models, presence of child celebrities or celebrities who appeal to children, language or other characteristics of the Web site or online service, as well as whether advertising promoting or appearing on the Web site or online service is directed to children. 16 CFR § 312.2. TAC ¶ 74. COPPA defines a “child” as an individual under the age of thirteen. 15 U.S.C. § 6501(a). TAC ¶ 76. The FTC regulations require an operator to disclose information collection practices and “obtain verifiable parental consent for [any] collection, use, or disclosure of personal information from children.” 15 U.S.C. § 6502(b)(1)(A); 16 C.F.R. § 312.5(a); TAC ¶ 76. Among the types of personal information under COPPA that may only be collected from children with parental consent are “persistent identifier[s] that can be used to recognize a user over time and across different sites, including a cookie number, an IP address, a processor or device serial number, or a unique device identifier.” TAC ¶ 77. Google has been subject to COPPA enforcement previously. TAC ¶ 66. In Fall 2019, Google reached a settlement with the FTC and New York Attorney General, and Google announced it would start treating data from anyone watching children’s content on the YouTube Platform as coming from a child, regardless of the age of the user, which brought it into compliance with COPPA. Id. Plaintiffs allege that Google did its tracking, profiling, and targeting of children while feigning compliance with applicable federal and state laws. 3AC ¶¶ 81, 164. Plaintiffs cite Google’s then-Code of Conduct, which read, in relevant part:

“Don’t be evil.” Googlers generally apply those words to how we serve our users. But “Don’t can. But it’s also about doing the right thing more generally – following the law, acting honorably and treating co-workers with courtesy and respect. 3AC ¶ 164. Plaintiffs also cite Google’s then-Privacy Policy (“Our goal is to be clear about what information we collect, so that you can make meaningful choices about how it is used”) and Terms of Service (“We want to maintain a respectful environment for everyone, which means you must follow these basic rules of conduct” including “comply[ing] with applicable laws”) and allege that these corporate policies created an expectation of privacy with respect to the YouTube Platform. Id. ¶¶ 161-167. Despite this alleged expectation of privacy, Google tracked and collected the personal information of children under the allegedly false pretense that Google would be “transparent” with parents about what information was being collected from child viewers and compliant with applicable legal requirements and prohibitions, including COPPA. Id. ¶ 166. Plaintiffs further allege that Google’s Privacy Policy deceptively conceals that the purpose of its tracking and assimilating information from the YouTube Platform is to enable it to target the vulnerabilities of children through behavioral advertising for profit. Id. ¶ 9. Plaintiffs also acknowledge that Google’s Privacy Policy discloses that it collects personal information from individuals who access the YouTube Platform, including persistent identifiers such as a user’s IP address. TAC ¶ 55. Plaintiffs also allege that Google discloses that it tracks any individuals’ activity on any webpage that uses Google’s advertising services, and this tracking activity allows Google to deliver more relevant search results and ads to YouTube video viewers. TAC ¶¶ 62-63. Plaintiffs also allege deception on Google’s part through the creation of the YouTube Kids application, which they allege was “guise to generate content for children on the YouTube Platform. TAC ¶ 89. Google did not track users or serve targeted behavior ads on the YouTube Kids app. Id. ¶ 90 Every video available on the YouTube Kids app was also uploaded to the YouTube Platform. Id. ¶ 89. The YouTube Kids app was only available as a mobile application until 2019, so when children searched for their favorite show on a web browser, they would be shown links to child-directed content hosted on the YouTube Platform and not the YouTube Kids app, which allowed Google to employ its tracking and behavioral advertising scheme on the In this lawsuit, Plaintiffs, who are all under the age of thirteen, TAC ¶¶ 26-31, purport to represent “all persons . . . who were sixteen or younger when they used YouTube,” TAC ¶¶ 224- 231. Plaintiffs allege violations of the following claims: intrusion upon seclusion; California’s Unfair Competition Law; unjust enrichment under the laws of California, Colorado, Indiana, Massachusetts, New Jersey, and Tennessee; the consumer protection acts of Massachusetts, Colorado, Indiana, New Jersey, and Tennessee; and the California constitutional right to privacy. SAC ¶¶ 204-356. Defendants bring this motion to dismiss on several grounds, with preemption as a threshold issue. See Mot. “To survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 570 (2007)). When considering such a motion, the Court “accept[s] factual allegations in the complaint as true and construe[s] the pleadings in the light most favorable to the nonmoving party.” Manzarek v. St. Paul Fire & Marine Ins. Co., 519 F.3d 1025, 1031 (9th Cir. 2008). However, the Court need not “accept as true allegations that contradict matters properly subject to judicial notice” or “allegations that are merely conclusory, unwarranted deductions of fact, or unreasonable inferences.” In re Gilead Scis. Sec. Litig., 536 F.3d 1049, 1055 (9th Cir. 2008) (internal quotation marks and citations omitted). “Threadbare recitals of the elements of a cause of action, supported by mere conclusory statements, do not suffice.” Iqbal, 556 U.S. at 678 (citing Twombly, 550 U.S. at 555). Defendants argue that, just as the Court found last time, Plaintiffs’ claims are preempted by COPPA. Mot. 4-10. Plaintiffs argue that they have alleged deceptive conduct that goes beyond what COPPA regulates, just like the Third Circuit found in In re Nickelodeon Consumer Privacy plausibly alleged deceptive conduct, as Plaintiffs admit they did not view any of the disclosures they allege are deceptive, making allegations that these disclosures created a false expectation of privacy implausible. As the Court detailed in its prior order, COPPA contains the following clause: No State or local government may impose any liability for commercial activities or actions by operators in interstate or foreign commerce in connection with an activity or action described in this chapter that is inconsistent with the treatment of those activities or actions under this section. 15 U.S.C. § 6502(d). (emphasis added). Congress specified the FTC would have enforcement authority, 15 U.S.C. §§ 6502(c), 6505(d), with certain other federal agencies retaining authority over entities they oversee, id. §§ 6505(a), (b). Congress also gave an enforcement role to states via parens patriae actions brought by their attorneys general, 15 U.S.C. § 6504(a)(1). Before proceeding with any such lawsuits, a state attorney general must give the FTC notice, 15 U.S.C. § 6504(a)(2), and the FTC has a statutory right to intervene, id. § 6504(b). If the FTC has already instituted an action, no State may institute a second action against the same Defendants while the first action is pending, 15 U.S.C. § 6504(d). Congress did not include a private right of action in the statute. The Court found that the plain text of the statute clearly indicates Congress’s desire to expressly preempt Plaintiffs’ state law claims. Prior Order 9-12. Allowing private plaintiffs to bring suits for violations of conduct regulated by COPPA, even styled in the form of state law claims, with no obligation to cooperate with the FTC, is inconsistent with the treatment of COPPA violations as outlined in the COPPA statute. Prior Order 10 (citing Howard v. Blue Ridge Bank, 371 F. Supp. 2d 1139, 1143-44 (N.D. Cal. 2005) (rejecting argument that state law claim is not inconsistent with the Fair Credit Reporting Act (“FCRA”) and simply provides an additional state remedy for the unlawful conduct giving rise to the FCRA claim)). Plaintiffs core allegations, and state law causes of action, remain the same in the third amended complaint: Google, together with the Channel Owners, knowingly and purposely tracked, profiled, and targeted minors on the YouTube platform for advertising revenue through deceptive collection of personal information; Google did this while feigning compliance with the law; Google did not disclose the full extent of the information it collected from the children; Google used this information to manipulate and exploit children by extending their time on the YouTube platform, which increased the number of targeted advertisements shown to them, which increased the revenue earned by Google and the Channel Owners. See Prior Order 5; TAC ¶¶ 8-9, 81-82, 86, 142-43, 158, 164. The Court advised Plaintiffs in its prior order that they had not alleged deceptive behavior beyond what was regulated by COPPA—the allegations failed to “explain what is deceptive about Google’s collecting of data or grapple with whether Google’s data collection policies have been properly disclosed.” Prior Order 13. The Court finds that Plaintiffs have still failed to allege deception beyond what is regulated by COPPA. In attempt to plead deceptive conduct that falls outside of COPPA regulation, Plaintiffs argue that “Google publicly created the impression of adhering with societal expectations regarding children’s privacy as well as with related laws and guidelines such as COPPA through its Privacy Policy for the YouTube platform.” Opp’n 4-5; see also TAC ¶¶ 166-67. Plaintiffs also highlight Google’s previous Code of Conduct, which stated “Don’t be evil” and “Obey the Law: Google takes its responsibilities to comply with laws and regulations very seriously and each of us is expected to comply with applicable legal requirements and prohibitions.” Opp’n 5; see also TAC ¶¶ 168-69. This, according to Plaintiffs, created an expectation of privacy for children viewing of the Channel Owners’ child-directed content on the YouTube Platform. Opp’n 5; see also TAC ¶ 16. According to Plaintiffs, Google tracked and collected personal information from children “under the alleged false pretense that that it would be ‘transparent’ with parents about what information was being collected from child viewers, and would comply with applicable legal requirements and prohibitions—including COPPA—in doing so.” Opp’n 5; see also TAC ¶ 16. Critically, Plaintiffs also allege that Google’s Privacy Policy discloses that it collects the following types of information from YouTube users: videos watched; browsing history; activity on third- party sites and apps that use Google services, which includes Google’s advertising services; GPS; IP address; and unique identifiers such as cookies and device IDs. TAC ¶ 52. Plaintiffs do not Conduct. See Opp’n 18-19 (“Plaintiffs allege that Defendants’ conduct was deceptive, they do not, as Defendants note, claim that their parents read or saw purported misrepresentations or claim that the Channel Owners made any misrepresentations to them. They also do not allege that their parents would have stopped them from using YouTube with different disclosures.”) (internal citation omitted). With regards to the Plaintiffs in this case—all children under thirteen years old—the Court finds this alleged conduct squarely covered, and preempted, by COPPA and its exclusive remedial scheme that vests enforcement authority in the FTC and state attorneys general. See 15 U.S.C. §§ 6502(a)-(d), 6505(a)-(d); 16 C.F.R. § 312.5(a). Plaintiffs invite the Court to reconsider its prior ruling on preemption, arguing that preemption should only apply in situations where the state law claims are “inconsistent” with COPPA. Opp’n 2. However, as explained previously, the Court must read the rest of that sentence in the statute, which establishes that state laws are preempted if they impose liability “inconsistent with the treatment of those activities or actions under this section.” 15 U.S.C. § 6502(d). The treatment Congress has provided for COPPA violations is enforcement by the FTC and state attorneys general, and Plaintiffs’ attempt to run an end-around the scheme with state law liability is “inconsistent with the treatment” and thus preempted. The only new case Plaintiffs cite in support of their preemption argument is In re Zoom Video Communications Inc. Privacy Litig., No. 20-CV-02155-LHK, 2021 WL 930623, *23-24 (N.D. Cal. Mar. 11, 2021).1 Opp’n 1. In re Zoom is a 58-page opinion that references COPPA in one paragraph and does not address preemption at all. 2021 WL 930623 at *23. The Court finds Plaintiffs’ description of In re Zoom as having “declined to dismiss actions based on preemption grounds” a gross mischaracterization. Plaintiffs argue that they have alleged deceptive conduct like the plaintiffs in Nickelodeon.

1 The Court reiterates is previous opinion distinguishing New Mexico ex rel. Balderas v. Tiny Lab Prods., 457 F. Supp. 3d 1103, 1121, 1127 (D.N.M. 2020), on reconsideration, 2021 WL 354003 (D.N.M. Feb. 2, 2021): “The Court finds Tiny Lab distinguishable from this case because Tiny Lab was brought by the New Mexico Attorney General, who can enforce violations of COPPA under the statute’s remedial scheme. Further, while not the basis of the preemption decision, it Opp’n 1-3. Not so. In Nickelodeon, the registration form for defendants’ child-focused website included the message, “HEY GROWN-UPS: We don’t collect ANY personal information about your kids. Which means we couldn’t share it even if we wanted to!” and this apparently was not true. Nickelodeon, 827 F.3d at 268-69, 291. The court applied a presumption against preemption under Third Circuit law and found that the plaintiffs’ intrusion upon seclusion claim was not preempted by COPPA, and the court rested its finding on the fact that “the wrong at the heart of the plaintiffs’ intrusion claim is not that Viacom and Google collected children’s personal information, or even that they disclosed it. Rather, it is that Viacom created an expectation of privacy on its websites and then obtained the plaintiffs’ personal information under false pretenses.” Nickelodeon, 827 F.3d at 292. “Understood this way,” the Third Circuit stated, “there is no conflict between the plaintiffs’ intrusion claim and COPPA.” Id. The disclosure in this case is quite different. Most notably, while Viacom lied about collecting data, Google disclosed the fact that it collected data from YouTube users. TAC ¶ 52. A user of the Viacom website could not miss the HEY GROWN-UPS disclosure; here, Plaintiffs concede that they did not see the purported misrepresentations. Opp’n 18-19. Statements such as “Don’t do evil” and “Obey the Law” are not actionable. See Veal v. LendingClub Corp., 423 F. Supp. 3d 785, 804 (N.D. Cal. 2019) (“The Court agrees with Defendants that the statements touting LendingClub's focus on compliance, building trust with various stakeholders, and transparency are examples of corporate optimism and puffery.”), Allergan USA Inc. v. Imprimis Pharm., Inc., 2018 WL 5919210, at *7 (C.D. Cal. Apr. 30, 2018) (statement about “complying with all applicable laws and regulations” not actionable). It is unclear what type of disclosure Plaintiffs would view as adequate—HEY GROWN-UPS: We are collecting personal information about your kids to MANIPULATE them! —but it is clear that Plaintiffs have not adequately alleged deceptive conduct that places Defendants’ behavior outside of what is regulated by Plaintiffs attempt to expand their proposed classes to “all persons . . . who were sixteen or younger when they used YouTube,” TAC ¶¶ 224-231. The Court does find adding persons in the Proper Am., ECF 119 (“Plaintiffs have only been granted leave to amend the existing claims of the current parties”). Since all named Plaintiffs are under thirteen, and their claims are thus preempted by COPPA, they cannot seek relief on behalf of a proposed class when they are not eligible to bring the claim in their own right. Sandoval v. Ali, 34 F. Supp. 3d 1031, 1039 (N.D. Cal. 2014) (“in short, a predicate to a plaintiff’s right to represent a class is his eligibility to sue in his own right; what he may not achieve himself, he may not accomplish as a representative of a class”). The Court will grant Plaintiffs leave to amend their complaint if they can substitute proper plaintiffs to represent persons in the 13-16 age range. See Intri-Plex Techs., Inc. v. Crest Group, Inc., 499 F.3d 1048, 1056 (9th Cir. 2007) (finding dismissal without leave to amend proper only if it is clear that “the complaint could not be saved by any amendment”). The Court also notes the following for Plaintiffs’ potentially forthcoming fourth amended complaint. Plaintiffs’ consumer protection claims sound in fraud and therefore need to meet the heightened Rule 9(b) pleading standard for fraud. See Vess v. Ciba-Geigy Corp. USA, 317 F.3d 1097, 1103 (“Fraud can be averred by specifically alleging fraud, or by alleging facts that necessarily constitute fraud (even if the word ‘fraud’ is not used)). Under the Rule 9(b) pleading standard, claims of fraud must be accompanied by the “who, what, when, where, and how” of the misconduct alleged. Cooper v. Pickett, 137 F.3d 616, 627 (9th Cir. 1997), superseded by statute on other grounds (internal citation omitted). For the complaint to go forward, these deficiencies must be addressed. The Channel Owners have advanced separate arguments regarding why they should be dismissed from this case, which relate to the underlying merits of Plaintiffs’ claims. Mot. 22-25. Because the Court has found all of Plaintiffs’ claims preempted and granted leave to amend, the Court finds it premature to dismiss the Channel Owners at this time. // // // // IV. ORDER For the foregoing reasons, IT IS HEREBY ORDERED that Defendants’ motion to dismiss is 2 GRANTED with leave to amend. Plaintiffs shall file an amended complaint no later than 30 days 3 after the filing of this order 4 5 IT IS SO ORDERED. 6 7 Dated: July 1, 2021 én) fom Ln ham 9 BETH LABSON FREEMAN 10 United States District Judge 11 12

15 16

= 17

Z 18 19 20 21 22 23 24 25 26 27 28