Hubbard v. Google LLC

Opinion

1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 7 NICHOLE HUBBARD, et al., Case No. 19-cv-07016-SVK

8 Plaintiffs, ORDER GRANTING 9 v. MOTION TO DISMISS WITH LIMITED LEAVE TO AMEND 10 GOOGLE LLC, et al., Re: Dkt. No. 203 11 Defendants.

12 Defendants Google LLC and YouTube, LLC (collectively, “Google”) operate a video- 13 sharing website (also called “YouTube”) where users may post videos on their “channels” and 14 view videos posted by others free of charge. “Free products are not, however, truly free.” In re 15 Google, Inc. Priv. Pol’y Litig., 12-cv-01382-PSG, 2015 WL 4317479, at *2 (N.D. Cal. July 15, 16 2015). Google collects data from YouTube users, which it uses to generate advertising revenue 17 for both itself and those who own some of the more-popular channels. Plaintiffs—minor children 18 represented by their parents and legal guardians—commenced this putative class action against 19 Google and the owners of certain YouTube channels to remedy the harm they allegedly suffered 20 as a result of Google’s collection of their data. 21 Defendants now move to dismiss Plaintiffs’ claims. See Dkt. 203 (the “Motion”). 22 Plaintiffs oppose the Motion. See Dkt. 213 (the “Opposition”). Defendants filed a reply. See Dkt. 23 219. The Parties appeared for a hearing on the Motion before the Honorable Beth Labson 24 Freeman on February 22, 2024. See Dkt. 256-1 (“Hr’g Tr.”). Judge Freeman subsequently 25 recused herself from this action, and the Parties later consented to the jurisdiction of the 26 undersigned. See Dkts. 249, 259, 276. The Court then permitted the Parties to submit 27 supplemental briefing on the Motion. See Dkts. 262, 267-68. After considering the Parties’ 1 before Judge Freeman), and for the reasons that follow, the Court GRANTS the Motion 2 and DISMISSES all of Plaintiffs’ claims WITH LIMITED LEAVE TO AMEND. 3 I. BACKGROUND 4 The following discussion of background facts is based on the allegations contained in the 5 fifth amended complaint (the “FAC” at Dkt. 275), the truth of which the Court accepts for 6 purposes of resolving the Motion.1 See Boquist v. Courtney, 32 F.4th 764, 772 (9th Cir. 2022). 7 A. Google’s Collection Of Plaintiffs’ Data 8 Google operates YouTube, a website where anyone can post and watch user-created videos 9 for free. See FAC ¶¶ 3, 66-68, 70. Although it does not charge for access to YouTube, Google 10 does leverage the website as a revenue source; it partners with advertisers and the owners of 11 popular YouTube channels to show advertising on certain videos, with Google and the channel 12 owners splitting the payments received from the advertisers. See id. ¶ 87. 13 How Google selects which advertisements to show varies at the election of each channel 14 owner. See id. ¶ 88. Some choose the “contextual” approach, under which Google presents 15 advertisements based on the “central theme” of the channel. See id. ¶ 85. For example, Google 16 may show a user watching a cooking channel an advertisement for kitchen supplies. The 17 “preferred” and “most lucrative” approach (both for Google and the channel owners), however, is 18 the “behavioral” approach. See id. ¶ 84. Under that approach, Google presents advertisements 19 based on the information it possesses about a user, which it passes through an algorithm in an 20 effort to “infer[] which types of advertisements [are] likely to have the greatest impact on the user 21 . . . (i.e., most likely to be clicked).” See id. ¶ 83. 22 But how does Google obtain information about YouTube’s users? Quite simply—it 23 collects it. When an individual visits a Google-affiliated website (such as YouTube), Google 24 1 Defendants’ Motion implicates the fourth amended complaint. Upon Plaintiffs’ request, the 25 Court permitted Plaintiffs to amend that pleading to add some Plaintiffs and remove others, and those amendments did not substantively change any of Plaintiffs’ allegations. See Dkt. 274 at 2-5. 26 Consequently, the Court determined that the newly filed FAC would not moot the Motion and that Defendants did not need to file a new motion to dismiss. See id. at 4-5. The Court nevertheless 27 permitted Defendants an opportunity to seek leave to file a new motion to dismiss for good cause; 1 “stores some unique identifiers in a text file” called “cookies.” See id. ¶¶ 71, 73. Cookies allow 2 Google to determine which “websites the user has previously visited, the duration of website 3 visits, videos viewed, advertisements viewed, duration of video views, and advertisements clicked, 4 among other information.” See id. ¶ 73. Google also collects users’ “persistent identifiers,” i.e., 5 data points that users may not “easily delete[] or reset” and that stick with them as they browse the 6 internet. See id. ¶¶ 74, 76. Examples include users’ IP addresses and International Mobile 7 Equipment Identity numbers.2 See id. ¶ 75. Together, cookies and persistent identifiers allow 8 Google to “track[] individuals over 80% of the internet.” See id. ¶ 76 (emphasis and citation 9 omitted). The information collected about them includes, inter alia, “searches run, videos 10 watched, views and interactions with content and ads, voice and audio information, purchase 11 activity, people with whom a user communicated, browsing history, [] activity on third-party sites 12 and apps that used Google services[,] . . . GPS, . . . device sensor data, [] data from devices located 13 near a user [and] . . . advertising ID.”3 See id. ¶ 72. 14 Enter Plaintiffs. During the relevant period (July 1, 2013 through April 1, 2020), they 15 were children under the age of 13 who watched YouTube videos. See id. ¶¶ 1, 208-327. Google 16 collected their data without their parents’ consent, and they now seek to recover for the harm they 17 allegedly suffered as a result of Google’s non-consensual collection of their data. See id. ¶ 1. 18 Specifically, they allege that they “can no longer realize the full economic value of their Personal 19 Information because their Personal Information has already been collected, analyzed, acted upon, 20 and monetized by Defendants.” See id. ¶ 175. In addition to Google, they also name as 21 Defendants the owners of some of the most-popular YouTube channels for children. See id. ¶¶ 22 122-57. 23 /// 24

25 2 “An IP address is a numerical label assigned to each device connected to a computer network, such as the internet. . . . Every mobile phone and smartphone is assigned a unique [International 26 Mobile Equipment Identity number] that cannot be changed.” FAC ¶ 75. 27 3 Plaintiffs do not explain what they mean by “voice and audio information,” “device sensor data” B. Google’s History Of Collecting Children’s Data 1 The Children’s Online Privacy Protection Act (the “COPPA”) “regulate[s] the online 2 collection of personal identifying information about children under the age of 13.” Jones v. 3 Google LLC, 73 F.4th 636, 639 (9th Cir. 2023); see also FAC ¶ 13. It does not contain a private 4 right of action; rather, only the Federal Trade Commission (the “FTC”) and state attorneys general 5 may sue to enforce the statute. See Jones, 73 F.4th at 641. Pursuant to that enforcement authority, 6 the FTC and the New York Attorney General jointly commenced an action against Google in 2019 7 for alleged violations of the COPPA in connection with its collection of data of children who 8 watch YouTube videos. See FAC ¶ 16; FTC v. Google LLC, No. 19-cv-02642-BAH, Dkt. 1 9 (D.D.C. Sept. 4, 2019). The parties settled, with Google stipulating to an injunction prohibiting it 10 “from [d]isclosing, using, or benefitting from” the information collected. See FTC v. Google LLC, 11 No. 19-cv-02642-BAH, Dkt. 5 (D.D.C Sept. 10, 2019) (the “FTC Order”) at 12. 12 C. Relevant Procedural History 13 Judge Freeman dismissed two of Plaintiffs’ earlier complaints with leave to amend on the 14 basis that the COPPA preempted their claims. See Dkts. 117, 146. The Ninth Circuit reversed the 15 second dismissal order, holding that the COPPA “does not bar state-law causes of action that are 16 parallel to, or proscribe the same conduct forbidden by,” the COPPA. Jones, 73 F.4th at 644. 17 This Order, therefore, presents the Court’s first analysis of the merits of Plaintiffs’ claims. 18 II. LEGAL STANDARD 19 Under Federal Rule of Civil Procedure 12(b)(6), a court must dismiss a complaint if it 20 “fail[s] to state a claim upon which relief can be granted.”4 To survive a Rule 12(b)(6) motion, a 21 plaintiff must allege “enough facts to state a claim to relief that is plausible on its face.” See Bell 22 Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). This facial-plausibility standard requires a 23 plaintiff to allege facts resulting in “more than a sheer possibility that a defendant has acted 24 unlawfully.” See Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (citation omitted). 25 26

27 4 Defendants also move to dismiss under Rule 12(b)(1). See Motion at Notice of Motion. Because the Court dismisses all of Plaintiffs’ claims under Rule 12(b)(6), it does not discuss the Rule 1 In ruling on a motion to dismiss, a court may consider only “the complaint, materials 2 incorporated into the complaint by reference, and matters [subject to] judicial notice.” See UFCW 3 Loc. 1500 Pension Fund v. Mayer, 895 F.3d 695, 698 (9th Cir. 2018) (citation omitted). A court 4 must also presume the truth of a plaintiff’s allegations and draw all reasonable inferences in their 5 favor. See Boquist, 32 F.4th at 773. However, a court need not accept as true “allegations that are 6 merely conclusory, unwarranted deductions of fact, or unreasonable inferences.” See Khoja v. 7 Orexigen Therapeutics, Inc., 899 F.3d 988, 1008 (9th Cir. 2018) (citation omitted). 8 If a court grants a motion to dismiss, it may exercise discretion to grant or deny leave to 9 amend the complaint, and it “acts within its discretion to deny leave to amend when amendment 10 would be futile, when it would cause undue prejudice to the defendant, or when it is sought in bad 11 faith.” See Nat’l Funding, Inc. v. Com. Credit Counseling Servs., Inc., 817 F. App’x 380, 383 (9th 12 Cir. 2020) (citation omitted). 13 III. DISCUSSION 14 Plaintiffs bring 50 causes of action under the laws of 20 states. See FAC ¶¶ 368-1017; see 15 also Appendix A (chart of claims on state-by-state basis). Broadly speaking, their claims fall into 16 three categories: 17  Unjust enrichment. 18  Intrusion upon seclusion. 19  Violations of consumer-protection statutes. 20 They seek to obtain damages and equitable relief. See FAC at 178. As discussed below, neither 21 their claims nor their requests for equitable relief survive scrutiny under Rule 12(b)(6). 22 /// 23 /// 24 /// 25 /// 26 /// 27 /// A. Plaintiffs May Not Pursue Equitable Relief Or 1 Their Claims For Unjust Enrichment Because They Do Not Sufficiently Allege That They Lack An Adequate Remedy At Law 2 In the FAC, Plaintiffs do not expressly describe all the equitable relief that they seek in 3 their Prayer for Relief. Instead, they simply request that the Court issue a “judgment awarding 4 any and all equitable[ and] injunctive . . . relief as may be appropriate, including orders of 5 disgorgement of Defendants’ unlawful gains, and restitution.” See id. However, throughout their 6 charging allegations, they describe three categories of equitable relief that they seek (see, e.g., 7 FAC ¶¶ 427, 445, 472): 8  An injunction requiring deletion, destruction or sequestration of the information 9 Defendants collected without parental consent. 10  The provision of an audit and accounting of Defendants’ uses of the information collected. 11  Financial relief in the forms of restitution, disgorgement of profits and creation of a trust to 12 recover ill-gotten gains. 13 Plaintiffs also seek equitable relief through unjust-enrichment claims under the laws of 19 states. 14 To obtain any equitable relief in federal court, a plaintiff must allege that they lack an 15 adequate remedy at law. See Sonner v. Premier Nutrition Corp., 971 F.3d 834, 844 (9th Cir. 16 2020). Yet Plaintiffs’ allegations of harm focus on economic injuries already suffered. See FAC 17 ¶¶ 173-76. The legal remedy of damages should serve as an adequate form of retrospective relief 18 for such harm, and Plaintiffs do seek damages to remedy their harm. See Sharma v. Volkswagen 19 AG, 524 F. Supp. 3d 891, 908 (N.D. Cal. 2021) (damages serve as sufficient legal remedy to 20 adequately compensate for past loss of money or loss in value). Plaintiffs nevertheless insist that 21 “the FAC repeatedly alleges that Plaintiffs have no ‘adequate remedy at law,’ and it further alleges 22 facts that plausibly show that is the case.” Opposition at 22 (citations omitted). To the contrary, 23 however, Plaintiffs provide only conclusory allegations that they lack an adequate remedy at law. 24 See, e.g., FAC ¶¶ 384, 427. That will not do at the pleading stage. 25 Plaintiffs counter that Sonner and its requirement that Plaintiffs allege they lack an 26 adequate remedy at law “has limited applicability at the pleading stage.” See Opposition at 22; see 27 also Murphy v. Olly Pub. Benefit Corp., 651 F. Supp. 3d 1111, 1129 (N.D. Cal. 2023) (“A number 1 of district court cases since Sonner have concluded that it has minimal application at the pleading 2 stage.”). But whatever Sonner requires at the pleading stage, conclusory allegations will not 3 suffice. See Phillips v. Brooklyn Bedding LLC, No. 23-cv-03781-RFL, 2024 WL 2830663, at *1 4 (N.D. Cal. Mar. 28, 2024) (“[The plaintiff’s] factual allegations must provide a plausible basis to 5 conclude that ‘the same amount of money for the exact same harm is inadequate or incomplete.’” 6 (citations omitted)); Lair v. Bank of Am., N.A., No. 23-cv-01345-WLH, 2024 WL 943945, at *6 7 (C.D. Cal. Jan. 26, 2024) (“Since Sonner, courts in this circuit have held that a plaintiff facing 8 dismissal ‘must, at a minimum, plead that she lacks adequate remedies at law if she seeks 9 equitable relief.’ That is, plaintiffs must include in the complaint ‘substantive allegations that they 10 lack an adequate legal remedy.’” (citations omitted)); see, e.g., Watkins v. MGA Ent., Inc., 550 F. 11 Supp. 3d 815, 838 (N.D. Cal. 2021) (dismissing requests for equitable relief where, inter alia, 12 “Plaintiffs have not alleged any facts establishing that their remedies at law are inadequate”); 13 Blain v. Liberty Mut. Fire Ins. Co., No. 22-cv-00970-AJB, 2023 WL 3612390, at *3 (S.D. Cal. 14 May 22, 2023) (“In the present case, Plaintiff does not point to any facts in support of an 15 allegation that there is no adequate remedy at law. Relying only on conclusory and conditional 16 statements, Plaintiff’s claim does not pass the pleading standards established by Iqbal and 17 Twombly . . . .” (citations omitted)). 18 Plaintiffs offer four other arguments in opposition to dismissing their requests for equitable 19 relief under Sonner, but the Court rejects them all. 20 First, Plaintiffs argue that Sonner does not apply to requests for injunctive relief. See 21 Opposition at 21-22. But “numerous” district courts in the Ninth Circuit disagree. See In re Cal. 22 Gasoline Spot Mkt. Antitrust Litig., No. 20-cv-03131-JSC, 2021 WL 1176645, at *8 (N.D. Cal. 23 Mar. 29, 2021). Even if the Court accepted that Sonner does not apply to requests for injunctive 24 relief it would still require Plaintiffs to plead that they lack an adequate remedy at law, because an 25 injunction may issue only where a plaintiff lacks an adequate remedy at law. See Epic Games, 26 Inc. v. Apple, Inc., 67 F.4th 946, 1002 (9th Cir. 2023). Indeed, before the Ninth Circuit issued its 27 decision in Sonner, district courts dismissed requests for injunctive relief at the pleading stage for 1 Inc., No. 16-cv-05591-LHK, 2017 WL 1330602, at *5 (N.D. Cal. Apr. 11, 2017); Silvercrest 2 Realty, Inc. v. Great Am. E&S Ins. Co., No. 11-cv-01197-CJC, 2012 WL 13028094, at *3 (C.D. 3 Cal. Apr. 4, 2012). 4 Second, Plaintiffs argue that calculating the amount of any financial recovery will require 5 factual determinations such that “it is impossible to fully assess the adequacy of [their] legal 6 remedies” at the pleading stage. See Opposition at 22. That argument conflates the amount of any 7 legal remedy with the adequacy of that remedy. Plaintiffs may very well not know at this early 8 stage the amount of damages as a legal remedy necessary to compensate them for the alleged harm 9 they suffered, but that does not implicate whether damages are an adequate remedy in the first 10 place.5 Thus, Plaintiffs’ understandable inability to precisely state the amount of their requested 11 relief does not excuse their failure to plead with particularity that they lack an adequate legal 12 remedy. 13 Third, Plaintiffs argue that they “can never be fully compensated as long as Google retains 14 their” information. See id. But Plaintiffs do not explain why that is the case. To the extent they 15 believe Google’s retention of their information may lead to non-economic injuries in the future 16 (e.g., public disclosure of their information following a data breach), they do not articulate that 17 concern in either the Opposition or the FAC. Indeed, as explained above, Plaintiffs describe the 18 harm they allegedly suffered as economic in nature, which suggests that money damages would 19 provide them a full recovery (i.e., a recovery independent of whether Google retains their 20 information).6 Plaintiffs also do not convincingly explain why the FTC Order, which enjoins 21 Google from using the misappropriated information, does not neuter their position that they cannot 22

23 5 The Ninth Circuit has explained that an injunction may issue “where the underlying injury does not readily lend itself to calculable money damages.” See Epic, 67 F.4th at 1003 (citation 24 omitted). But Plaintiffs do not argue that they will struggle to calculate their damages. They simply acknowledge that they cannot perform that calculation “[w]ithout further factual 25 development.” See Opposition at 22. 26 6 Plaintiffs do offer conclusory allegations of “mental and emotional distress caused by Defendants’ invasions of privacy” (see, e.g., FAC ¶ 445), but the Court does not accept conclusory 27 allegations under Rule 12(b)(6), and, as discussed below, Plaintiffs fail to state a privacy claim. Accordingly, these allegations of non-economic harm do not support Plaintiffs’ requests for 1 receive adequate recovery while Google retains their information. See FTC Order at 12. Instead, 2 they simply state that their request that Google destroy or sequester their information “is key to 3 protecting [their] privacy concerns.” See Opposition at 21; see also Hr’g Tr. at 46:20-47:1 (“For 4 some reason, and we don’t understand it, the injunction that was issued in the FTC Action, while it 5 precluded Google from using or disclosing the information, it allowed Google to maintain it, it 6 allowed Google to hold onto it, and we think that’s not a good idea, we think that we have a right 7 to have that information destroyed.”). To be sure, Plaintiffs do allege that Google may be 8 continuing to collect their (and other children’s) data in violation of the FTC Order (see FAC ¶¶ 9 200-07), but they do not describe any non-economic harm that may stem from such violation that 10 cannot be remedied by damages. To the extent they believe that the continued collection of their 11 data is itself a non-economic harm, they do not offer allegations to that effect, and their focus on 12 the economic harm inflicted by such collection in the past belies any suggestion that the collection 13 is itself a non-economic harm. 14 Fourth, Plaintiffs argue that disgorgement of profits (an equitable remedy they seek) 15 remains distinct from damages that would compensate them for the economic injuries they 16 suffered (a legal remedy they seek).7 See Hr’g Tr. at 39:18-40:11. Consequently, according to 17 Plaintiffs, their requested legal remedy is necessarily inadequate. See id. But Plaintiffs’ 18 distinction merely highlights two different remedies for a singular injury: the harm Plaintiffs 19 suffered as a result of Defendants’ misappropriation of their information. That Defendants earned 20 profits in the process of inflicting that harm renders neither damages for the harm a per se 21 inadequate legal remedy nor the earning of those profits a distinct harm for which Plaintiffs may 22 also recover. See In re Ford Tailgate Litig., No. 11-cv-02953-RS, 2014 WL 1007066, at *5 (N.D. 23 Cal. Mar. 12, 2014) (“[W]here the unjust enrichment claim relies upon the same factual predicates 24 as a plaintiff’s legal causes of action, it is not a true alternative theory of relief but rather is 25 duplicative of those legal causes of action.” (citations omitted)); see, e.g., Cepelak v. HP Inc., No. 26

27 7 Plaintiffs acknowledge that their request for disgorgement of profits mirrors the relief they seek 1 20-cv-02450-VC, 2021 WL 5298022, at *3 (N.D. Cal. Nov. 15, 2021) (“[T]he plaintiffs have not 2 alleged the inadequacy of a remedy at law with respect to their claims for equitable monetary 3 relief. All of the plaintiffs’ claims for such relief are ‘rooted in the same theory and factual 4 allegations’ as their claims for damages . . . .” (citation omitted)); see also Ketayi v. Health 5 Enrollment Grp., No. 20-cv-01198-GPC, 2021 WL 2864481, at *10 (S.D. Cal. July 8, 2021) 6 (“Plaintiffs are correct that the measure of restitution would be calculated differently than 7 damages; however, this would almost always be the case because equitable and legal relief are 8 different avenues of making injured parties whole. But an adequate legal remedy need not be an 9 identical legal remedy. It would be anomalous for Sommer’s [sic] rule to be avoidable merely 10 because of the reality that claims for restitution and damages often will result in different 11 recoveries.” (emphasis added) (citations omitted)). 12 Accordingly, the Court will dismiss all of Plaintiffs’ requests for equitable relief and all of 13 their claims for unjust enrichment. The Court will therefore analyze Plaintiffs’ remaining claims 14 only to the extent that Plaintiffs seek legal relief. 15 B. Plaintiffs’ Privacy Claims Fail Because Defendants Did Not Allegedly Engage In A Highly Offensive Intrusion 16 “As it has developed in the courts, the invasion of the right of privacy has been a complex 17 of four distinct wrongs . . . .” Restatement (Second) of Torts § 625A cmt. B (Am. L. Inst. 1977). 18 Plaintiffs assert that Defendants committed the specific privacy wrong of intrusion upon seclusion. 19 They also assert that Defendants violated the right to privacy guaranteed by the constitution of 20 California, a violation which parallels intrusion upon seclusion. See Hernandez v. Hillsides, Inc., 21 47 Cal. 4th 272, 285-88 (2009). Under the laws of the 12 states in question, analysis of these 22 alleged violations requires the Court to consider whether Defendants’ conduct constituted a highly 23 offensive intrusion into an area where Plaintiffs maintained a reasonable expectation of privacy.8 24

25 8 See Doe v. Roe, 638 So. 2d 826, 827-28 (Ala. 1994); Hogin v. Cottingham, 533 So. 2d 525, 531 (Ala. 1988); Hart v. Seven Resorts Inc., 190 Ariz. 272, 279 (Ct. App. Div. 1 Dep’t C 1997); Reed 26 v. Kirk, No. 1 CA-CV 09-0686, 2012 WL 1057567, at *6 (Ariz. Ct. App. Div. 1 Dep’t B Mar. 27, 2012); Hernandez, 47 Cal. 4th at 286; Pearson v. Kancilia, 70 P.3d 594, 599 (Colo. Ct. App. Div. 27 III 2003); Johnson v. Northshore Univ. Judge Presiding Healthsystem, No. 1-10-0399, 2011 WL 1 This standard presents a “high bar” for Plaintiffs to satisfy. See Belluomini v. Citigroup Inc., No. 2 13-cv-01743-CRB, 2013 WL 5645168, at *3 (N.D. Cal. Oct. 16, 2013). The FAC does not meet 3 it. 4 “Determining whether a defendant’s actions were ‘highly offensive to a reasonable person’ 5 requires a holistic consideration of factors such as the likelihood of serious harm to the victim, the 6 degree and setting of the intrusion, the intruder’s motives and objectives, and whether 7 countervailing interests or social norms render the intrusion inoffensive.” In re Facebook, Inc. 8 Internet Tracking Litig., 956 F.3d 589, 606 (9th Cir. 2020) (citations omitted). Assessing the 9 degree of offensiveness thus presents a policy question that often evades resolution at the pleading 10 stage. See id. But as a matter of policy, and, as a matter of law, the Court cannot conclude that 11 the data collection alleged here comprises highly offensive behavior. See Boring v. Google Inc., 12 362 F. App’x 273, 279 (3d Cir. 2010) (“Courts do in fact, decide the ‘highly offensive’ issue as a 13 matter of law at the pleading stage when appropriate.” (citation omitted)). 14 Contemporary internet browsing involves the collection of users’ data, including by 15 tracking users across the internet, and a reasonable user should expect as much. Cf. United States 16 v. Forrester, 512 F.3d 500, 510 (9th Cir. 2008) (“[E]-mail and Internet users have no expectation 17 of privacy in the to/from addresses of their messages or the IP addresses of the websites they visit 18 because they should know that this information is provided to and used by Internet service 19 providers . . . .”); Hammerling v. Google LLC, 615 F. Supp. 3d 1069, 1089 (N.D. Cal. July 18, 20 2022) (considering “users’ common-sense expectation[s]” in evaluating whether users maintained 21 reasonable expectation of privacy concerning data collection). Indeed, Plaintiffs themselves 22

23 Werbin, 219 Kan. 461, 464 (1976); Houck v. Corrections Corp., of Am., No. 15-cv-09586-JAR, 24 2017 WL 747847, at *2 (D. Kan. Feb. 27, 2017); Sofka v. Thal, 662 S.W.2d 502, 510 (Mo. 1983); Cooper v. Hutcheson, 472 F. Supp. 3d 509, 515-16 (E.D. Mo. 2020); Karch v. BayBank FSB, 147 25 N.H. 525, 534-35 (2002); Remsburg v. Docusearch, Inc., 149 N.H. 148, 156 (2003); Friedman v. Martinez, 242 N.J. 449, 466, 470 (2020); Guilbeau v. Durant H.M.A., LLC, 533 P.3d 764, 771 26 (Okla. 2023); Murphy v. Spring, No. 13-cv-00096-TCK, 2013 WL 5172951, at *10 (N.D. Okla. Sept. 12, 2023); Pro Golf Mfg., Inc. v. Trib. Rev. Newspaper Co., 570 Pa. 242, 248 (2002); 27 Tagouma v. Investigative Consultant Servs., Inc., 4 A.3d 170, 175-78 (Pa. Super. Ct. 2010); Mark v. Seattle Times, 96 Wash. 2d 473, 497 (1981); Mancini v. City of Tacoma, No. 71044-3-I, 2015 1 recognize the commonplace collection and sale of such data. See FAC ¶ 174. That proves fatal to 2 their privacy claims because “data collection and disclosure to third parties that is ‘routine 3 commercial behavior’ is not a ‘highly offensive’ intrusion of privacy.” Hammerling, 615 F. Supp. 4 3d at 1090 (citations omitted); see, e.g., In re iPhone Application Litig., 844 F. Supp. 2d 1040, 5 1063 (N.D. Cal. 2012) (“Here, the information allegedly disclosed to third parties included the 6 unique device identifier number, personal data, and geolocation information from Plaintiffs’ 7 iDevices. Even assuming this information was transmitted without Plaintiffs’ knowledge and 8 consent, a fact disputed by Defendants, such disclosure does not constitute an egregious breach of 9 social norms.” (citation omitted)); see also In re Nickelodeon Consumer Priv. Litig., 827 F.3d 262, 10 294 (3d Cir. 2016) (“[C]ourts have long understood that tracking cookies can serve legitimate 11 commercial purposes.” (citation omitted)). 12 Plaintiffs do not sufficiently allege that Defendants did more than engage in such routine 13 behavior. This is not a case involving secret or deceptive data collection, and Plaintiffs’ 14 authorities (see Opposition at 8-10; Dkt. 279) are distinguishable on that basis.9 See Facebook, 15 956 F.3d at 606 (allegations of “surreptitious data collection”); Turner v. Google LLC, No. 23-cv- 16 03101-PCP, 2024 WL 3052969, at *9 (N.D. Cal. June 18, 2024) (defendants “surreptitiously 17 collect[ed] data from minors”); McDonald v. Kiloo ApS, 385 F. Supp. 3d 1022, 1035 (N.D. Cal. 18 2019) (“Plaintiffs state in detail what data was secretly collected . . . .”). Nor is this a case where 19 Plaintiffs browsed the internet using “incognito mode” or where the misappropriation of data 20 stemmed from a data breach. See, e.g., Brown v. Google LLC, 525 F. Supp. 3d 1049, 1079 (N.D. 21 Cal. 2021); Doe v. N. Cal. Fertility Med. Ctr., No. 22-cv-01861-DAD, 2024 WL 246178, at *6 22 (E.D. Cal. Jan. 23, 2024). Without any such “plus factors” (see Heeger v. Facebook, Inc., No. 18- 23 cv-06399-JD, 2019 WL 7282477, at *4 (N.D. Cal. Dec. 27, 2019)) to elevate Defendants’ conduct 24 beyond the level of routine commercial behavior, Plaintiffs effectively ask the Court to 25

26 9 Plaintiffs offer only conclusory allegations of surreptitious data collection (see, e.g., FAC ¶ 429), and in light of the Court’s view that reasonable users should expect the collection of their internet- 27 browsing data, the Court cannot infer that Defendants’ collection occurred in secret without particularized allegations to that effect. Plaintiffs also removed allegations of deceptive conduct 1 characterize an entire industry as founded on tortious conduct. The Court cannot sanction that 2 result. 3 Plaintiffs also point to Google’s collection of children’s data as a plus factor sufficient to 4 classify its data collection as highly offensive. In support of this argument, Plaintiffs rely on 5 survey data indicating concern for children’s online privacy. See Opposition at 9. But the cited 6 surveys polled parents when asking questions about children. See FAC ¶¶ 187-92. Parents 7 understandably express concern for children’s online privacy, but the Court cannot infer that the 8 views of parents regarding their children (or children in general) fairly represent the views of the 9 “reasonable person” at large, and the “highly offensive” inquiry requires the Court to conduct a 10 holistic analysis of public policy. See Facebook, 956 F.3d at 606. 11 Plaintiffs extend this argument with an implicit suggestion that Defendants’ collection of 12 children’s data necessarily constitutes highly offensive behavior as an alleged violation of the 13 COPPA. See Opposition at 8; Hr’g Tr. at 34:15-35:15; see, e.g., Turner, 2024 WL 3052969, at *9 14 (“A violation of federal law is generally considered egregious, and because COPPA prohibits such 15 data collection from minors to protect their privacy, plaintiffs have adequately pleaded an 16 egregious intrusion into the minors’ expectation of privacy.” (citation omitted)). The Court does 17 not agree because violations of law do not necessarily represent highly offensive behavior.10 See, 18 e.g., Manigault-Johnson v. Google, LLC, No. 18-cv-01032-BHH, 2019 WL 3006646, at *6 19 (D.S.C. Mar. 31, 2019) (dismissing intrusion-upon seclusion claim that plaintiffs “based on 20 nothing more than alleged violations of COPPA”); see also Hayter v. PHH Mortg. Corp., No. 15- 21 cv-03332-LB, 2016 WL 3902483, at *4 (N.D. Cal. July 19, 2016) (where “no independent facts 22 (as opposed to other, loosely related, alleged legal consequences) impugn” defendant’s conduct, 23 plaintiffs “cannot jury-rig an intrusion claim by tacking on other alleged statutory failures”). 24 Further, routine behavior, including the collection of internet-browsing data and persistent 25 identifiers, does not obtain a more-offensive status merely because the behavior happened to 26

27 10 For example, a jurisdiction may prohibit publicly carrying an open container of beer, but that 1 involve a child in a particular instance. See, e.g., Nickelodeon, 827 F.3d at 294-95 (“[The 2 plaintiffs argue] that the use of cookies to track children is particularly odious. We are not so sure. 3 Google used third-party cookies on Nick.com in the same way that it deploys cookies on myriad 4 other[] websites. Its decision to do so here does not strike us as sufficiently offensive, standing 5 alone, to survive a motion to dismiss.”); see also McDonald, 385 F. Supp. 3d at 1036 (“This Court 6 agrees with Nickelodeon that the status of game users as minors is not a main driver of the privacy 7 analysis . . . .” (citations omitted)). After all, an intrusion into someone’s privacy is an intrusion 8 into someone’s privacy regardless of whether the someone is an adult or a child. 9 Ultimately, “privacy expectations are developing, to say the least, with respect to . . . 10 whether a commercial entity that secretly harvests [a user’s data] commits a highly offensive or 11 egregious act.” McDonald, 385 F. Supp. 3d at 1035. Where, as here, a defendant does not employ 12 secrecy or deception or some other “bad act” in connection with data collection, and instead 13 engages in ubiquitous, commercial behavior, the Court concludes, as a matter of law, that such 14 behavior does not rise to the level of highly offensive. The Court will therefore dismiss Plaintiffs’ 15 privacy claims. 16 C. Plaintiffs’ Consumer-Protection Claims Fail Because They Do Not Sufficiently Allege That They Suffered A Loss 17 Plaintiffs allege that Defendants violated the consumer-protection statutes of 14 states 18 when they appropriated Plaintiffs’ information without parental consent. Under each statute in 19 question, a plaintiff may recover damages only after experiencing a loss, injury or damages.11 In 20 the Opposition, Plaintiffs confirm that the sole loss they allege stems from the diminution in value 21

22 11 See Nataros v. Fine Arts Gallery of Scottsdale, Inc., 126 Ariz. 44, 48 (Ct. App. Div. 1 Dep’t C 23 1980); Kwikset Corp. v. Superior Ct., 51 Cal. 4th 310, 323 (2011); Stewart Agency, Inc. v. Arrigo Enters., 266 So. 3d 207, 212-14 (Fla. Dist. Ct. App. 4th Dist. 2019); Oliveira v. Amoco Oil Co., 24 201 Ill. 2d 134, 148-49 (2002); Anderson v. O’Leary Paint Co., No. 10-cv-00269-JTM, 2011 WL 4529364, at *6 (N.D. Ind. Sept. 28, 2011); Iannacchino v. Ford Motor Co., 451 Mass. 623, 629 25 (2008); Chapman v. Alawi, No. 331750, 2018 WL 472211, at *3-4 (Mich. Ct. App. Jan. 18, 2018); Watson Lab’ys, Inc. v. State, 241 So. 3d 573, 592 (Miss. 2018); Hess v. Chase Manhattan Bank, 26 USA, N.A., 220 S.W.3d 758, 773 (Mo. 2007); State v. Hynes, 159 N.H. 187, 196 (2009); Thiedemann v. Mercedes-Benz USA, LLC, 183 N.J. 234, 246 (2005); Gregg v. Ameriprise Fin., 27 Inc., 664 Pa. 567, 582 (2021); Tucker v. Sierra Builders, 180 S.W.3d 109, 115 (Tenn. Ct. App. 2005); Indoor Billboard/Wash., Inc. v. Integra Telecom of Wash., Inc., 162 Wash. 2d 59, 74 1 of their information caused by Defendants’ misappropriation of that information. See Opposition 2 at 15 (“Plaintiffs’ injury is not that their [information] no longer ‘belongs to them’—they have 3 been injured because their [information] has now been misappropriated and exploited by 4 Defendants, and, therefore, effectively ‘belongs’ to Defendants, too, decreasing its value.”). 5 But Plaintiffs do not allege sufficient facts from which the Court may reasonably infer that 6 Defendants’ misappropriation reduced the value of Plaintiffs’ information. Instead, they merely 7 allege that “there is a market for consumers to monetize Personal Information,” that “published 8 analyses and studies have placed a value in excess of $200 on an individual’s Personal 9 Information” and that Defendants’ “usurped” Plaintiffs’ information without parental consent. See 10 FAC ¶¶ 173-76. Plaintiffs do not, however, allege facts explaining how Defendants’ collection 11 and use of their information reduces the value of that information, and an explanation as to how 12 does not appear so obvious that the Court may simply infer one. See, e.g., Pruchnicki v. Envision 13 Healthcare Corp., 845 F. App’x 613, 614-15 (9th Cir. 2021) (“Pruchnicki submits that she 14 adequately alleged diminution of the value of her personal information. We disagree. Although 15 the studies cited by Pruchnicki establish that personal information may have value in general, 16 Pruchnicki failed to adequately allege that her personal information actually lost value.”); In re 17 Facebook Priv. Litig., 572 F. App’x 494, 494 (9th Cir. 2014) (where plaintiffs allege “that they 18 were harmed both by the dissemination of their personal information and by losing the sales value 19 of that information,” affirming dismissal of California consumer-protection claim for failure to 20 sufficiently allege loss); cf. LaCourt v. Specific Media, Inc., No. 10-cv-01256-GW, 2011 WL 21 1661532, at *5 (C.D. Cal. Apr. 28, 2011) (in rejecting allegations of injury for purposes of Article 22 III-standing analysis, explaining that “Plaintiffs do not explain how they were ‘deprived’ of the 23 economic value of their personal information simply because their unspecified personal 24 information was purportedly collected by a third party”). In the absence of such facts, the Court 25 must dismiss Plaintiffs’ consumer-protection claims for failure to sufficiently allege that Plaintiffs 26 suffered a loss. 27 Plaintiffs oppose this conclusion by analogizing to trade-secret misappropriation and 1 necessarily lose value once published, as they derive value, in part, by remaining unknown. 2 Plaintiffs’ information, however, could still prove just as valuable as it did prior to Defendants’ 3 misappropriation, and Plaintiffs do not offer any allegations to the contrary; Judge Freeman 4 recognized as much at the February 22 hearing. See Hr’g Tr. at 45:17-46:12. As for infringement 5 of publicity rights, damages for that tort typically flow from a defendant’s unjust enrichment as 6 opposed to from a plaintiff’s loss. See J. Thomas McCarthy & Roger E. Schechter, The Rights of 7 Publicity & Privacy § 3:5, Westlaw (database updated April 2024). But just because Defendants 8 received a gain does not mean Plaintiffs suffered a loss. See, e.g., In re Google Assistant Priv. 9 Litig., 457 F. Supp. 3d 797, 839-41 (N.D. Cal. 2020) (plaintiff insufficiently alleged California 10 consumer-protection claim because court cannot infer economic loss based merely on defendant’s 11 economic gain). 12 Plaintiffs’ cited authorities do not compel a different result (see Opposition at 14-17): 13  In In re Yahoo! Inc. Customer Data Security Breach Litigation, No. 16-MD-02752-LHK, 14 2017 WL 3727318 (N.D. Cal. Aug. 30, 2017), the plaintiffs alleged that hackers stole 15 information that would enable access to the plaintiffs’ email accounts and the private 16 information contained therein. See id. at *13-14. That concern does not apply here. The 17 court did also credit allegations of lost value based on the potential use of the stolen 18 information for targeted advertising (see id. at *14), but as explained above, the Court 19 cannot infer diminution in value simply because the misappropriated information has 20 value. 21  In In re Anthem, Inc. Data Breach Litigation, No. 15-MD-02617-LHK, 2016 WL 3029783 22 (N.D. Cal. May 27, 2016), the court recognized alleged losses stemming from the 23 plaintiffs’ failure to receive the benefit of their bargain with the defendants, the plaintiffs’ 24 reliance on a contract, the difficulty in calculating damages for those losses and the 25 plaintiff’s out-of-pocket expenses. See id. at *42-43. These concerns do not apply here. 26  In In re Experian Data Breach Litigation, No. 15-cv-01592-AG, 2016 WL 7973595 (C.D. 27 Cal. Dec. 29, 2016), the court recognized alleged losses stemming from the time the 1 misappropriation of their information. See id. at *5. That concern does not apply here. 2  In In re Marriott International, Inc., Customer Data Security Breach Litigation, 440 F. 3 Supp. 3d 447 (D. Md. 2020), the Court found that allegations of a risk of identity theft, 4 time and money spent addressing the data breach that resulted in misappropriation of the 5 plaintiffs’ information and the plaintiffs’ overpayment to the defendants constituted 6 sufficient allegations of injury. See id. at 457-460, 462-66. The court also recognized a 7 loss in the value of the stolen information based on allegations that the plaintiffs “suffered 8 lower credit scores as a result of the data breach[,] that fraudulent accounts and tax returns 9 were filed in their names” and that the value of the information stemmed in part from “the 10 expectation that its integrity has not been compromised.” See id. at 460-62. These 11 concerns do not apply here. 12  In Calhoun v. Google LLC, 526 F. Supp. 3d 605 (N.D. Cal. 2021), the court relied on the 13 decisions in Yahoo, Anthem and Marriot, and this Court has already distinguished those 14 decisions. See id. at 636. The Calhoun court also relied on the Ninth Circuit’s decision in 15 Facebook Privacy, but there, the Ninth Circuit affirmed dismissal of a California 16 consumer-protection claim where the plaintiffs alleged “that they were harmed both by the 17 dissemination of their personal information and by losing the sales value of that 18 information.” See 572 F. App’x at 494. 19  In Klein v. Facebook, Inc., 580 F. Supp. 3d 743 (N.D. Cal. 2022), the plaintiffs alleged that 20 Facebook obtained their “information and attention,” which they could have monetized in 21 the absence of Facebook’s monopolization of the social-media market. See id. at 802-804. 22 But Plaintiffs do not allege that Defendants monopolized the market for their information 23 such that they now lack a buyer in light of Defendants’ misappropriation of their 24 information. 25  In Brown v. Google LLC, 685 F. Supp. 3d 909 (N.D. Cal. 2023), the court found at the 26 summary-judgment stage that “[s]ufficient evidence exists” to show that “Google’s alleged 27 surreptitious collection of [the plaintiffs’] data inhibited [the] plaintiffs’ ability to 1 Plaintiffs to provide evidence at the pleading stage, it does require sufficient allegations, 2 and Plaintiffs have not alleged facts supporting the conclusion that Defendants’ conduct 3 inhibited Plaintiffs’ ability to participate in the market for their information. 4  In Del Vecchio v. Amazon.com, Inc., No. 11-cv-00366-RSL, 2012 WL 1997697 (W.D. 5 Wash. June 1, 2012), the court did not, as Plaintiffs suggest, accept Defendants’ 6 misappropriation as a sufficient allegation of injury; rather, the court converted the motion 7 to dismiss on the issue of injury into a motion for summary judgment and suggested that 8 the parties should engage in discovery. See id. at *6-7. 9  In In re Mednax Services, Inc., Customer Data Security Breach litigation, 603 F. Supp. 3d 10 1183 (S.D. Fla. 2022), the court recognized as sufficient allegations of damage to the 11 Plaintiffs’ credit stemming from misappropriation of their information via a data breach. 12 See id. at 1204, 1217-1218. That concern does not apply here. 13  In Tyler v. Michaels Stores, Inc., 464 Mass. 492 (2013), the court explained that a 14 merchant’s provision of unwanted marketing materials following its collection of a 15 customer’s information and a merchant’s sale of a customer’s information to a third party 16 for profit (both in violation of a statute concerning credit cards not at issue here) constitute 17 injuries under the Massachusetts consumer-protection statute at issue here. See id. at 504. 18 But Plaintiffs do not allege that Defendants sent them unwanted marketing materials or 19 sold their information to third parties. 20  In Opris v. Sincera Reproductive Medicine, No. 21-cv-03072-JHS, 2022 WL 1639417 21 (E.D. Pa. May 24, 2022), the court recognized alleged losses stemming from “costs 22 associated with the data breach [that caused the misappropriation of the plaintiffs’ 23 information], such as purchasing credit monitoring and identity theft detection services.” 24 See id. at *12-13. That concern does not apply here. The court also relied on the decisions 25 in Marriott, Experian and Calhoun, and this Court has already distinguished those 26 decisions. See id. at *8. 27 At the February 22 hearing, Plaintiffs appeared to identify another harm that they allegedly 1 rendering it valueless. See Hr’g Tr. at 44:6-12. To the extent this constitutes a harm distinct from 2 the diminution in value of the misappropriated information, the Court again finds Plaintiffs’ 3 allegations lacking. As Judge Freeman explained at the hearing, Plaintiffs do not allege any facts 4 from which the Court can reasonably infer that Defendants’ use of Plaintiffs’ information prevents 5 Plaintiffs from using the information themselves. See Hr’g Tr. at 45:17-46:12. Even if the Court 6 accepted that Plaintiffs could no longer sell their information, it would still reject that inability as a 7 sufficiently alleged harm because Plaintiffs do not allege that they actually intended to sell that 8 information. Information about an individual’s internet use belies classification as an ordinary 9 commodity which one could easily go out to sell at a market (e.g., a farm selling produce at a local 10 farmers market). To be sure, Plaintiffs do allege that a market for such information exists (see 11 FAC ¶ 174), but the Court cannot reasonably infer from the existence of such a market that a 12 consumer (and a child under the age of 13, no less) could realistically participate in that market. 13 At the very least, Plaintiffs must allege that they actually intended to sell the misappropriated 14 information or must describe facts from which the Court can reasonably infer such intention (e.g., 15 that Plaintiffs have sold their information in the past, that participating in such an information 16 market is easy or common for consumers). 17 D. The Court Will Grant Plaintiffs Limited Leave To Amend 18 Although Plaintiffs have now filed six complaints, this Order presents the Court’s first 19 evaluation of the merits of Plaintiffs’ claims. The Court therefore cannot conclude that the sheer 20 number of pleadings filed indicates that further amendment would be futile. Indeed, Plaintiffs 21 could potentially cure the defects identified in this Order in a further pleading, and the Court will 22 give them an opportunity to do so as follows: 23  Equitable Relief And Unjust Enrichment. As discussed above, Plaintiffs allege that 24 they suffered economic harm, and damages serve as an adequate legal remedy for that 25 harm. To the extent Plaintiffs can allege in good faith that they have suffered or will suffer 26 non-economic harm not remediable by damages, they must include such allegations in 27 their amended pleading. 1 above that routine commercial behavior, in the absence of plus factors, does not, as a 2 matter of law, rise to the level of highly offensive. To the extent Plaintiffs can allege in 3 good faith that sufficient plus factors accompanied Defendants’ conduct, they must include 4 such allegations in their amended pleading. 5  Violations Of Consumer-Protection Statutes. The Court described above the specific 6 alleged facts missing from the FAC whose absence prevents the Court from inferring that 7 Plaintiffs suffered a loss. To the extent Plaintiffs can allege in good faith those facts (or 8 similar facts), they must include such allegations in their amended pleading. 9  No Other Substantive Changes. Plaintiffs may amend their pleading to address the 10 deficiencies identified in this Order as discussed in this Section. They may do no more; 11 they may not add new parties or claims, and they may not otherwise add new substantive 12 allegations. 13 IV. CONCLUSION 14 For the foregoing reasons, the Court GRANTS the Motion and DISMISSES12 all of 15 Plaintiff’s claims WITH LIMITED LEAVE TO AMEND as explained above and as follows: 16  The Court DISMISSES all of Plaintiffs’ requests for equitable relief and their claims of 17 unjust enrichment WITH LEAVE TO AMEND. 18  The Court DISMISSES all of Plaintiffs’ intrusion-upon-seclusion claims and their claim 19 for violation of the right to privacy guaranteed by the constitution of California WITH 20 LEAVE TO AMEND. 21  The Court DISMISSES all of Plaintiff state consumer-protection law claims WITH 22 LEAVE TO AMEND. 23 Plaintiffs must file an amended complaint by July 22, 2024. If Plaintiffs file an amended 24 complaint, then for the convenience of the Court, they shall include with that filing a redline 25 indicating all changes made between the FAC and the new complaint. The Court will dismiss this 26

27 12 The Parties raised many arguments in their briefing. The Court expresses no opinion as to those ] action if Plaintiffs fail to file an amended complaint by the deadline. 2 SO ORDERED. 3 Dated: July 1, 2024 4 5 Stam eG SUSAN VAN KEULEN 6 United States Magistrate Judge 7 8 9 10 1] 12

16 Z 18 19 20 21 22 23 24 25 26 27 28

Case 5:19-cv-07016-SVK Document 281 Filed 07/01/24 Page 22 of 25

APPENDIX A

State Claim Intrusion Upon Seclusion Alabama Unjust Enrichment Intrusion Upon Seclusion Violation of the Arizona Consumer Fraud Act Arizona (Ariz. Rev. Stat. § 44-1521 et seq.) Unjust Enrichment Violation of Constitutional Right to Privacy Intrusion Upon Seclusion California Violation of the Unfair Competition Law (Cal. Bus. & Prof. Code § 17200 et seq.) Intrusion Upon Seclusion Colorado Unjust Enrichment Violation of the Deceptive and Unfair Trade Practices Act Florida (Fla. Stat. § 501.201 et seq.) Unjust Enrichment Illinois Intrusion Upon Seclusion Case 5:19-cv-07016-SVK Document 281 Filed 07/01/24 Page 23 of 25

State Claim Violation of the Consumer Fraud and Deceptive Business Practices Act (815 Ill. Comp. Stat. 505/1 et seq.) Unjust Enrichment Violation of the Deceptive Consumer Sales Indiana Act (Ind. Code § 24-5-0.5-0.1 et seq.) Unjust Enrichment Intrusion Upon Seclusion Kansas Unjust Enrichment Violation of the Consumer Protection Act Massachusetts (Mass. Gen. Laws ch. 93A et seq.) Unjust Enrichment Violation of the Consumer Protection Act Michigan (Mich. Comp. Laws § 445.901 et seq.) Unjust Enrichment Violation of the Consumer Protection Act Mississippi (Miss. Code Ann. § 75-24-1 et seq.) Unjust Enrichment Missouri Intrusion Upon Seclusion Case 5:19-cv-07016-SVK Document 281 Filed 07/01/24 Page 24 of 25

State Claim Violation of the Merchandising Practices Act (Mo. Rev. Stat. § 407.005 et seq.) Unjust Enrichment Intrusion Upon Seclusion Violation of the Consumer Protection Act New Hampshire (N.H. Rev. Stat. Ann. § 358-A:1 et seq.) Unjust Enrichment Intrusion Upon Seclusion Violation of the Consumer Fraud Act New Jersey (N.J. Stat. Ann. § 56:8-1 et seq.) Unjust Enrichment New York Unjust Enrichment Intrusion Upon Seclusion Oklahoma Unjust Enrichment Intrusion Upon Seclusion Violation of the Unfair Trade Practices and Consumer Protection Pennsylvania Law (73 Pa. Cons. Stat. § 201-1 et seq.) Unjust Enrichment Case 5:19-cv-07016-SVK Document 281 Filed 07/01/24 Page 25 of 25

State Claim Violation of the Consumer Protection Act Tennessee (Tenn. Code Ann. § 47-18-101 et seq.) Unjust Enrichment Virginia Unjust Enrichment Intrusion Upon Seclusion Violation of the Consumer Protection Act Washington (Wash. Rev. Code § 19.86.010 et seq.) Unjust Enrichment