Hubbard v. Google LLC

Opinion

NICHOLE HUBBARD, et al., Case No. 19-cv-07016-SVK

Plaintiffs, ORDER GRANTING v. MOTION TO DISMISS WITH LIMITED LEAVE TO AMEND GOOGLE LLC, et al., Re: Dkt. No. 203 Defendants.

Defendants Google LLC and YouTube, LLC (collectively, “Google”) operate a video- sharing website (also called “YouTube”) where users may post videos on their “channels” and view videos posted by others free of charge. “Free products are not, however, truly free.” In re Google, Inc. Priv. Pol’y Litig., 12-cv-01382-PSG, 2015 WL 4317479, at *2 (N.D. Cal. July 15, 2015). Google collects data from YouTube users, which it uses to generate advertising revenue for both itself and those who own some of the more-popular channels. Plaintiffs—minor children represented by their parents and legal guardians—commenced this putative class action against Google and the owners of certain YouTube channels to remedy the harm they allegedly suffered as a result of Google’s collection of their data. Defendants now move to dismiss Plaintiffs’ claims. See Dkt. 203 (the “Motion”). Plaintiffs oppose the Motion. See Dkt. 213 (the “Opposition”). Defendants filed a reply. See Dkt. 219. The Parties appeared for a hearing on the Motion before the Honorable Beth Labson Freeman on February 22, 2024. See Dkt. 256-1 (“Hr’g Tr.”). Judge Freeman subsequently recused herself from this action, and the Parties later consented to the jurisdiction of the undersigned. See Dkts. 249, 259, 276. The Court then permitted the Parties to submit supplemental briefing on the Motion. See Dkts. 262, 267-68. After considering the Parties’ before Judge Freeman), and for the reasons that follow, the Court GRANTS the Motion and DISMISSES all of Plaintiffs’ claims WITH LIMITED LEAVE TO AMEND. The following discussion of background facts is based on the allegations contained in the fifth amended complaint (the “FAC” at Dkt. 275), the truth of which the Court accepts for purposes of resolving the Motion.1 See Boquist v. Courtney, 32 F.4th 764, 772 (9th Cir. 2022). A. Google’s Collection Of Plaintiffs’ Data Google operates YouTube, a website where anyone can post and watch user-created videos for free. See FAC ¶¶ 3, 66-68, 70. Although it does not charge for access to YouTube, Google does leverage the website as a revenue source; it partners with advertisers and the owners of popular YouTube channels to show advertising on certain videos, with Google and the channel owners splitting the payments received from the advertisers. See id. ¶ 87. How Google selects which advertisements to show varies at the election of each channel owner. See id. ¶ 88. Some choose the “contextual” approach, under which Google presents advertisements based on the “central theme” of the channel. See id. ¶ 85. For example, Google may show a user watching a cooking channel an advertisement for kitchen supplies. The “preferred” and “most lucrative” approach (both for Google and the channel owners), however, is the “behavioral” approach. See id. ¶ 84. Under that approach, Google presents advertisements based on the information it possesses about a user, which it passes through an algorithm in an effort to “infer[] which types of advertisements [are] likely to have the greatest impact on the user . . . (i.e., most likely to be clicked).” See id. ¶ 83. But how does Google obtain information about YouTube’s users? Quite simply—it collects it. When an individual visits a Google-affiliated website (such as YouTube), Google 1 Defendants’ Motion implicates the fourth amended complaint. Upon Plaintiffs’ request, the Court permitted Plaintiffs to amend that pleading to add some Plaintiffs and remove others, and those amendments did not substantively change any of Plaintiffs’ allegations. See Dkt. 274 at 2-5. Consequently, the Court determined that the newly filed FAC would not moot the Motion and that Defendants did not need to file a new motion to dismiss. See id. at 4-5. The Court nevertheless permitted Defendants an opportunity to seek leave to file a new motion to dismiss for good cause; “stores some unique identifiers in a text file” called “cookies.” See id. ¶¶ 71, 73. Cookies allow Google to determine which “websites the user has previously visited, the duration of website visits, videos viewed, advertisements viewed, duration of video views, and advertisements clicked, among other information.” See id. ¶ 73. Google also collects users’ “persistent identifiers,” i.e., data points that users may not “easily delete[] or reset” and that stick with them as they browse the internet. See id. ¶¶ 74, 76. Examples include users’ IP addresses and International Mobile Equipment Identity numbers.2 See id. ¶ 75. Together, cookies and persistent identifiers allow Google to “track[] individuals over 80% of the internet.” See id. ¶ 76 (emphasis and citation omitted). The information collected about them includes, inter alia, “searches run, videos watched, views and interactions with content and ads, voice and audio information, purchase activity, people with whom a user communicated, browsing history, [] activity on third-party sites and apps that used Google services[,] . . . GPS, . . . device sensor data, [] data from devices located near a user [and] . . . advertising ID.”3 See id. ¶ 72. Enter Plaintiffs. During the relevant period (July 1, 2013 through April 1, 2020), they were children under the age of 13 who watched YouTube videos. See id. ¶¶ 1, 208-327. Google collected their data without their parents’ consent, and they now seek to recover for the harm they allegedly suffered as a result of Google’s non-consensual collection of their data. See id. ¶ 1. Specifically, they allege that they “can no longer realize the full economic value of their Personal Information because their Personal Information has already been collected, analyzed, acted upon, and monetized by Defendants.” See id. ¶ 175. In addition to Google, they also name as Defendants the owners of some of the most-popular YouTube channels for children. See id. ¶¶ 122-57. ///

2 “An IP address is a numerical label assigned to each device connected to a computer network, such as the internet. . . . Every mobile phone and smartphone is assigned a unique [International Mobile Equipment Identity number] that cannot be changed.” FAC ¶ 75. 3 Plaintiffs do not explain what they mean by “voice and audio information,” “device sensor data” B. Google’s History Of Collecting Children’s Data The Children’s Online Privacy Protection Act (the “COPPA”) “regulate[s] the online collection of personal identifying information about children under the age of 13.” Jones v. Google LLC, 73 F.4th 636, 639 (9th Cir. 2023); see also FAC ¶ 13. It does not contain a private right of action; rather, only the Federal Trade Commission (the “FTC”) and state attorneys general may sue to enforce the statute. See Jones, 73 F.4th at 641. Pursuant to that enforcement authority, the FTC and the New York Attorney General jointly commenced an action against Google in 2019 for alleged violations of the COPPA in connection with its collection of data of children who watch YouTube videos. See FAC ¶ 16; FTC v. Google LLC, No. 19-cv-02642-BAH, Dkt. 1 (D.D.C. Sept. 4, 2019). The parties settled, with Google stipulating to an injunction prohibiting it “from [d]isclosing, using, or benefitting from” the information collected. See FTC v. Google LLC, No. 19-cv-02642-BAH, Dkt. 5 (D.D.C Sept. 10, 2019) (the “FTC Order”) at 12. C. Relevant Procedural History Judge Freeman dismissed two of Plaintiffs’ earlier complaints with leave to amend on the basis that the COPPA preempted their claims. See Dkts. 117, 146. The Ninth Circuit reversed the second dismissal order, holding that the COPPA “does not bar state-law causes of action that are parallel to, or proscribe the same conduct forbidden by,” the COPPA. Jones, 73 F.4th at 644. This Order, therefore, presents the Court’s first analysis of the merits of Plaintiffs’ claims. II. LEGAL STANDARD Under Federal Rule of Civil Procedure 12(b)(6), a court must dismiss a complaint if it “fail[s] to state a claim upon which relief can be granted.”4 To survive a Rule 12(b)(6) motion, a plaintiff must allege “enough facts to state a claim to relief that is plausible on its face.” See Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). This facial-plausibility standard requires a plaintiff to allege facts resulting in “more than a sheer possibility that a defendant has acted unlawfully.” See Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (citation omitted).

4 Defendants also move to dismiss under Rule 12(b)(1). See Motion at Notice of Motion. Because the Court dismisses all of Plaintiffs’ claims under Rule 12(b)(6), it does not discuss the Rule In ruling on a motion to dismiss, a court may consider only “the complaint, materials incorporated into the complaint by reference, and matters [subject to] judicial notice.” See UFCW Loc. 1500 Pension Fund v. Mayer, 895 F.3d 695, 698 (9th Cir. 2018) (citation omitted). A court must also presume the truth of a plaintiff’s allegations and draw all reasonable inferences in their favor. See Boquist, 32 F.4th at 773. However, a court need not accept as true “allegations that are merely conclusory, unwarranted deductions of fact, or unreasonable inferences.” See Khoja v. Orexigen Therapeutics, Inc., 899 F.3d 988, 1008 (9th Cir. 2018) (citation omitted). If a court grants a motion to dismiss, it may exercise discretion to grant or deny leave to amend the complaint, and it “acts within its discretion to deny leave to amend when amendment would be futile, when it would cause undue prejudice to the defendant, or when it is sought in bad faith.” See Nat’l Funding, Inc. v. Com. Credit Counseling Servs., Inc., 817 F. App’x 380, 383 (9th Cir. 2020) (citation omitted). Plaintiffs bring 50 causes of action under the laws of 20 states. See FAC ¶¶ 368-1017; see also Appendix A (chart of claims on state-by-state basis). Broadly speaking, their claims fall into three categories:  Unjust enrichment.  Intrusion upon seclusion.  Violations of consumer-protection statutes. They seek to obtain damages and equitable relief. See FAC at 178. As discussed below, neither their claims nor their requests for equitable relief survive scrutiny under Rule 12(b)(6). /// /// /// /// /// /// A. Plaintiffs May Not Pursue Equitable Relief Or Their Claims For Unjust Enrichment Because They Do Not Sufficiently Allege That They Lack An Adequate Remedy At Law In the FAC, Plaintiffs do not expressly describe all the equitable relief that they seek in their Prayer for Relief. Instead, they simply request that the Court issue a “judgment awarding any and all equitable[ and] injunctive . . . relief as may be appropriate, including orders of disgorgement of Defendants’ unlawful gains, and restitution.” See id. However, throughout their charging allegations, they describe three categories of equitable relief that they seek (see, e.g., FAC ¶¶ 427, 445, 472):  An injunction requiring deletion, destruction or sequestration of the information Defendants collected without parental consent.  The provision of an audit and accounting of Defendants’ uses of the information collected.  Financial relief in the forms of restitution, disgorgement of profits and creation of a trust to recover ill-gotten gains. Plaintiffs also seek equitable relief through unjust-enrichment claims under the laws of 19 states. To obtain any equitable relief in federal court, a plaintiff must allege that they lack an adequate remedy at law. See Sonner v. Premier Nutrition Corp., 971 F.3d 834, 844 (9th Cir. 2020). Yet Plaintiffs’ allegations of harm focus on economic injuries already suffered. See FAC ¶¶ 173-76. The legal remedy of damages should serve as an adequate form of retrospective relief for such harm, and Plaintiffs do seek damages to remedy their harm. See Sharma v. Volkswagen AG, 524 F. Supp. 3d 891, 908 (N.D. Cal. 2021) (damages serve as sufficient legal remedy to adequately compensate for past loss of money or loss in value). Plaintiffs nevertheless insist that “the FAC repeatedly alleges that Plaintiffs have no ‘adequate remedy at law,’ and it further alleges facts that plausibly show that is the case.” Opposition at 22 (citations omitted). To the contrary, however, Plaintiffs provide only conclusory allegations that they lack an adequate remedy at law. See, e.g., FAC ¶¶ 384, 427. That will not do at the pleading stage. Plaintiffs counter that Sonner and its requirement that Plaintiffs allege they lack an adequate remedy at law “has limited applicability at the pleading stage.” See Opposition at 22; see also Murphy v. Olly Pub. Benefit Corp., 651 F. Supp. 3d 1111, 1129 (N.D. Cal. 2023) (“A number of district court cases since Sonner have concluded that it has minimal application at the pleading stage.”). But whatever Sonner requires at the pleading stage, conclusory allegations will not suffice. See Phillips v. Brooklyn Bedding LLC, No. 23-cv-03781-RFL, 2024 WL 2830663, at *1 (N.D. Cal. Mar. 28, 2024) (“[The plaintiff’s] factual allegations must provide a plausible basis to conclude that ‘the same amount of money for the exact same harm is inadequate or incomplete.’” (citations omitted)); Lair v. Bank of Am., N.A., No. 23-cv-01345-WLH, 2024 WL 943945, at *6 (C.D. Cal. Jan. 26, 2024) (“Since Sonner, courts in this circuit have held that a plaintiff facing dismissal ‘must, at a minimum, plead that she lacks adequate remedies at law if she seeks equitable relief.’ That is, plaintiffs must include in the complaint ‘substantive allegations that they lack an adequate legal remedy.’” (citations omitted)); see, e.g., Watkins v. MGA Ent., Inc., 550 F. Supp. 3d 815, 838 (N.D. Cal. 2021) (dismissing requests for equitable relief where, inter alia, “Plaintiffs have not alleged any facts establishing that their remedies at law are inadequate”); Blain v. Liberty Mut. Fire Ins. Co., No. 22-cv-00970-AJB, 2023 WL 3612390, at *3 (S.D. Cal. May 22, 2023) (“In the present case, Plaintiff does not point to any facts in support of an allegation that there is no adequate remedy at law. Relying only on conclusory and conditional statements, Plaintiff’s claim does not pass the pleading standards established by Iqbal and Twombly . . . .” (citations omitted)). Plaintiffs offer four other arguments in opposition to dismissing their requests for equitable relief under Sonner, but the Court rejects them all. First, Plaintiffs argue that Sonner does not apply to requests for injunctive relief. See Opposition at 21-22. But “numerous” district courts in the Ninth Circuit disagree. See In re Cal. Gasoline Spot Mkt. Antitrust Litig., No. 20-cv-03131-JSC, 2021 WL 1176645, at *8 (N.D. Cal. Mar. 29, 2021). Even if the Court accepted that Sonner does not apply to requests for injunctive relief it would still require Plaintiffs to plead that they lack an adequate remedy at law, because an injunction may issue only where a plaintiff lacks an adequate remedy at law. See Epic Games, Inc. v. Apple, Inc., 67 F.4th 946, 1002 (9th Cir. 2023). Indeed, before the Ninth Circuit issued its decision in Sonner, district courts dismissed requests for injunctive relief at the pleading stage for Inc., No. 16-cv-05591-LHK, 2017 WL 1330602, at *5 (N.D. Cal. Apr. 11, 2017); Silvercrest Realty, Inc. v. Great Am. E&S Ins. Co., No. 11-cv-01197-CJC, 2012 WL 13028094, at *3 (C.D. Cal. Apr. 4, 2012). Second, Plaintiffs argue that calculating the amount of any financial recovery will require factual determinations such that “it is impossible to fully assess the adequacy of [their] legal remedies” at the pleading stage. See Opposition at 22. That argument conflates the amount of any legal remedy with the adequacy of that remedy. Plaintiffs may very well not know at this early stage the amount of damages as a legal remedy necessary to compensate them for the alleged harm they suffered, but that does not implicate whether damages are an adequate remedy in the first place.5 Thus, Plaintiffs’ understandable inability to precisely state the amount of their requested relief does not excuse their failure to plead with particularity that they lack an adequate legal remedy. Third, Plaintiffs argue that they “can never be fully compensated as long as Google retains their” information. See id. But Plaintiffs do not explain why that is the case. To the extent they believe Google’s retention of their information may lead to non-economic injuries in the future (e.g., public disclosure of their information following a data breach), they do not articulate that concern in either the Opposition or the FAC. Indeed, as explained above, Plaintiffs describe the harm they allegedly suffered as economic in nature, which suggests that money damages would provide them a full recovery (i.e., a recovery independent of whether Google retains their information).6 Plaintiffs also do not convincingly explain why the FTC Order, which enjoins Google from using the misappropriated information, does not neuter their position that they cannot

5 The Ninth Circuit has explained that an injunction may issue “where the underlying injury does not readily lend itself to calculable money damages.” See Epic, 67 F.4th at 1003 (citation omitted). But Plaintiffs do not argue that they will struggle to calculate their damages. They simply acknowledge that they cannot perform that calculation “[w]ithout further factual development.” See Opposition at 22. 6 Plaintiffs do offer conclusory allegations of “mental and emotional distress caused by Defendants’ invasions of privacy” (see, e.g., FAC ¶ 445), but the Court does not accept conclusory allegations under Rule 12(b)(6), and, as discussed below, Plaintiffs fail to state a privacy claim. Accordingly, these allegations of non-economic harm do not support Plaintiffs’ requests for receive adequate recovery while Google retains their information. See FTC Order at 12. Instead, they simply state that their request that Google destroy or sequester their information “is key to protecting [their] privacy concerns.” See Opposition at 21; see also Hr’g Tr. at 46:20-47:1 (“For some reason, and we don’t understand it, the injunction that was issued in the FTC Action, while it precluded Google from using or disclosing the information, it allowed Google to maintain it, it allowed Google to hold onto it, and we think that’s not a good idea, we think that we have a right to have that information destroyed.”). To be sure, Plaintiffs do allege that Google may be continuing to collect their (and other children’s) data in violation of the FTC Order (see FAC ¶¶ 200-07), but they do not describe any non-economic harm that may stem from such violation that cannot be remedied by damages. To the extent they believe that the continued collection of their data is itself a non-economic harm, they do not offer allegations to that effect, and their focus on the economic harm inflicted by such collection in the past belies any suggestion that the collection is itself a non-economic harm. Fourth, Plaintiffs argue that disgorgement of profits (an equitable remedy they seek) remains distinct from damages that would compensate them for the economic injuries they suffered (a legal remedy they seek).7 See Hr’g Tr. at 39:18-40:11. Consequently, according to Plaintiffs, their requested legal remedy is necessarily inadequate. See id. But Plaintiffs’ distinction merely highlights two different remedies for a singular injury: the harm Plaintiffs suffered as a result of Defendants’ misappropriation of their information. That Defendants earned profits in the process of inflicting that harm renders neither damages for the harm a per se inadequate legal remedy nor the earning of those profits a distinct harm for which Plaintiffs may also recover. See In re Ford Tailgate Litig., No. 11-cv-02953-RS, 2014 WL 1007066, at *5 (N.D. Cal. Mar. 12, 2014) (“[W]here the unjust enrichment claim relies upon the same factual predicates as a plaintiff’s legal causes of action, it is not a true alternative theory of relief but rather is duplicative of those legal causes of action.” (citations omitted)); see, e.g., Cepelak v. HP Inc., No.

7 Plaintiffs acknowledge that their request for disgorgement of profits mirrors the relief they seek 20-cv-02450-VC, 2021 WL 5298022, at *3 (N.D. Cal. Nov. 15, 2021) (“[T]he plaintiffs have not alleged the inadequacy of a remedy at law with respect to their claims for equitable monetary relief. All of the plaintiffs’ claims for such relief are ‘rooted in the same theory and factual allegations’ as their claims for damages . . . .” (citation omitted)); see also Ketayi v. Health Enrollment Grp., No. 20-cv-01198-GPC, 2021 WL 2864481, at *10 (S.D. Cal. July 8, 2021) (“Plaintiffs are correct that the measure of restitution would be calculated differently than damages; however, this would almost always be the case because equitable and legal relief are different avenues of making injured parties whole. But an adequate legal remedy need not be an identical legal remedy. It would be anomalous for Sommer’s [sic] rule to be avoidable merely because of the reality that claims for restitution and damages often will result in different recoveries.” (emphasis added) (citations omitted)). Accordingly, the Court will dismiss all of Plaintiffs’ requests for equitable relief and all of their claims for unjust enrichment. The Court will therefore analyze Plaintiffs’ remaining claims only to the extent that Plaintiffs seek legal relief. B. Plaintiffs’ Privacy Claims Fail Because Defendants Did Not Allegedly Engage In A Highly Offensive Intrusion “As it has developed in the courts, the invasion of the right of privacy has been a complex of four distinct wrongs . . . .” Restatement (Second) of Torts § 625A cmt. B (Am. L. Inst. 1977). Plaintiffs assert that Defendants committed the specific privacy wrong of intrusion upon seclusion. They also assert that Defendants violated the right to privacy guaranteed by the constitution of California, a violation which parallels intrusion upon seclusion. See Hernandez v. Hillsides, Inc., 47 Cal. 4th 272, 285-88 (2009). Under the laws of the 12 states in question, analysis of these alleged violations requires the Court to consider whether Defendants’ conduct constituted a highly offensive intrusion into an area where Plaintiffs maintained a reasonable expectation of privacy.8

8 See Doe v. Roe, 638 So. 2d 826, 827-28 (Ala. 1994); Hogin v. Cottingham, 533 So. 2d 525, 531 (Ala. 1988); Hart v. Seven Resorts Inc., 190 Ariz. 272, 279 (Ct. App. Div. 1 Dep’t C 1997); Reed v. Kirk, No. 1 CA-CV 09-0686, 2012 WL 1057567, at *6 (Ariz. Ct. App. Div. 1 Dep’t B Mar. 27, 2012); Hernandez, 47 Cal. 4th at 286; Pearson v. Kancilia, 70 P.3d 594, 599 (Colo. Ct. App. Div. III 2003); Johnson v. Northshore Univ. Judge Presiding Healthsystem, No. 1-10-0399, 2011 WL This standard presents a “high bar” for Plaintiffs to satisfy. See Belluomini v. Citigroup Inc., No. 13-cv-01743-CRB, 2013 WL 5645168, at *3 (N.D. Cal. Oct. 16, 2013). The FAC does not meet it. “Determining whether a defendant’s actions were ‘highly offensive to a reasonable person’ requires a holistic consideration of factors such as the likelihood of serious harm to the victim, the degree and setting of the intrusion, the intruder’s motives and objectives, and whether countervailing interests or social norms render the intrusion inoffensive.” In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 606 (9th Cir. 2020) (citations omitted). Assessing the degree of offensiveness thus presents a policy question that often evades resolution at the pleading stage. See id. But as a matter of policy, and, as a matter of law, the Court cannot conclude that the data collection alleged here comprises highly offensive behavior. See Boring v. Google Inc., 362 F. App’x 273, 279 (3d Cir. 2010) (“Courts do in fact, decide the ‘highly offensive’ issue as a matter of law at the pleading stage when appropriate.” (citation omitted)). Contemporary internet browsing involves the collection of users’ data, including by tracking users across the internet, and a reasonable user should expect as much. Cf. United States v. Forrester, 512 F.3d 500, 510 (9th Cir. 2008) (“[E]-mail and Internet users have no expectation of privacy in the to/from addresses of their messages or the IP addresses of the websites they visit because they should know that this information is provided to and used by Internet service providers . . . .”); Hammerling v. Google LLC, 615 F. Supp. 3d 1069, 1089 (N.D. Cal. July 18, 2022) (considering “users’ common-sense expectation[s]” in evaluating whether users maintained reasonable expectation of privacy concerning data collection). Indeed, Plaintiffs themselves

Werbin, 219 Kan. 461, 464 (1976); Houck v. Corrections Corp., of Am., No. 15-cv-09586-JAR, 2017 WL 747847, at *2 (D. Kan. Feb. 27, 2017); Sofka v. Thal, 662 S.W.2d 502, 510 (Mo. 1983); Cooper v. Hutcheson, 472 F. Supp. 3d 509, 515-16 (E.D. Mo. 2020); Karch v. BayBank FSB, 147 N.H. 525, 534-35 (2002); Remsburg v. Docusearch, Inc., 149 N.H. 148, 156 (2003); Friedman v. Martinez, 242 N.J. 449, 466, 470 (2020); Guilbeau v. Durant H.M.A., LLC, 533 P.3d 764, 771 (Okla. 2023); Murphy v. Spring, No. 13-cv-00096-TCK, 2013 WL 5172951, at *10 (N.D. Okla. Sept. 12, 2023); Pro Golf Mfg., Inc. v. Trib. Rev. Newspaper Co., 570 Pa. 242, 248 (2002); Tagouma v. Investigative Consultant Servs., Inc., 4 A.3d 170, 175-78 (Pa. Super. Ct. 2010); Mark v. Seattle Times, 96 Wash. 2d 473, 497 (1981); Mancini v. City of Tacoma, No. 71044-3-I, 2015 recognize the commonplace collection and sale of such data. See FAC ¶ 174. That proves fatal to their privacy claims because “data collection and disclosure to third parties that is ‘routine commercial behavior’ is not a ‘highly offensive’ intrusion of privacy.” Hammerling, 615 F. Supp. 3d at 1090 (citations omitted); see, e.g., In re iPhone Application Litig., 844 F. Supp. 2d 1040, 1063 (N.D. Cal. 2012) (“Here, the information allegedly disclosed to third parties included the unique device identifier number, personal data, and geolocation information from Plaintiffs’ iDevices. Even assuming this information was transmitted without Plaintiffs’ knowledge and consent, a fact disputed by Defendants, such disclosure does not constitute an egregious breach of social norms.” (citation omitted)); see also In re Nickelodeon Consumer Priv. Litig., 827 F.3d 262, 294 (3d Cir. 2016) (“[C]ourts have long understood that tracking cookies can serve legitimate commercial purposes.” (citation omitted)). Plaintiffs do not sufficiently allege that Defendants did more than engage in such routine behavior. This is not a case involving secret or deceptive data collection, and Plaintiffs’ authorities (see Opposition at 8-10; Dkt. 279) are distinguishable on that basis.9 See Facebook, 956 F.3d at 606 (allegations of “surreptitious data collection”); Turner v. Google LLC, No. 23-cv- 03101-PCP, 2024 WL 3052969, at *9 (N.D. Cal. June 18, 2024) (defendants “surreptitiously collect[ed] data from minors”); McDonald v. Kiloo ApS, 385 F. Supp. 3d 1022, 1035 (N.D. Cal. 2019) (“Plaintiffs state in detail what data was secretly collected . . . .”). Nor is this a case where Plaintiffs browsed the internet using “incognito mode” or where the misappropriation of data stemmed from a data breach. See, e.g., Brown v. Google LLC, 525 F. Supp. 3d 1049, 1079 (N.D. Cal. 2021); Doe v. N. Cal. Fertility Med. Ctr., No. 22-cv-01861-DAD, 2024 WL 246178, at *6 (E.D. Cal. Jan. 23, 2024). Without any such “plus factors” (see Heeger v. Facebook, Inc., No. 18- cv-06399-JD, 2019 WL 7282477, at *4 (N.D. Cal. Dec. 27, 2019)) to elevate Defendants’ conduct beyond the level of routine commercial behavior, Plaintiffs effectively ask the Court to

9 Plaintiffs offer only conclusory allegations of surreptitious data collection (see, e.g., FAC ¶ 429), and in light of the Court’s view that reasonable users should expect the collection of their internet- browsing data, the Court cannot infer that Defendants’ collection occurred in secret without particularized allegations to that effect. Plaintiffs also removed allegations of deceptive conduct characterize an entire industry as founded on tortious conduct. The Court cannot sanction that result. Plaintiffs also point to Google’s collection of children’s data as a plus factor sufficient to classify its data collection as highly offensive. In support of this argument, Plaintiffs rely on survey data indicating concern for children’s online privacy. See Opposition at 9. But the cited surveys polled parents when asking questions about children. See FAC ¶¶ 187-92. Parents understandably express concern for children’s online privacy, but the Court cannot infer that the views of parents regarding their children (or children in general) fairly represent the views of the “reasonable person” at large, and the “highly offensive” inquiry requires the Court to conduct a holistic analysis of public policy. See Facebook, 956 F.3d at 606. Plaintiffs extend this argument with an implicit suggestion that Defendants’ collection of children’s data necessarily constitutes highly offensive behavior as an alleged violation of the COPPA. See Opposition at 8; Hr’g Tr. at 34:15-35:15; see, e.g., Turner, 2024 WL 3052969, at *9 (“A violation of federal law is generally considered egregious, and because COPPA prohibits such data collection from minors to protect their privacy, plaintiffs have adequately pleaded an egregious intrusion into the minors’ expectation of privacy.” (citation omitted)). The Court does not agree because violations of law do not necessarily represent highly offensive behavior.10 See, e.g., Manigault-Johnson v. Google, LLC, No. 18-cv-01032-BHH, 2019 WL 3006646, at *6 (D.S.C. Mar. 31, 2019) (dismissing intrusion-upon seclusion claim that plaintiffs “based on nothing more than alleged violations of COPPA”); see also Hayter v. PHH Mortg. Corp., No. 15- cv-03332-LB, 2016 WL 3902483, at *4 (N.D. Cal. July 19, 2016) (where “no independent facts (as opposed to other, loosely related, alleged legal consequences) impugn” defendant’s conduct, plaintiffs “cannot jury-rig an intrusion claim by tacking on other alleged statutory failures”). Further, routine behavior, including the collection of internet-browsing data and persistent identifiers, does not obtain a more-offensive status merely because the behavior happened to

10 For example, a jurisdiction may prohibit publicly carrying an open container of beer, but that involve a child in a particular instance. See, e.g., Nickelodeon, 827 F.3d at 294-95 (“[The plaintiffs argue] that the use of cookies to track children is particularly odious. We are not so sure. Google used third-party cookies on Nick.com in the same way that it deploys cookies on myriad other[] websites. Its decision to do so here does not strike us as sufficiently offensive, standing alone, to survive a motion to dismiss.”); see also McDonald, 385 F. Supp. 3d at 1036 (“This Court agrees with Nickelodeon that the status of game users as minors is not a main driver of the privacy analysis . . . .” (citations omitted)). After all, an intrusion into someone’s privacy is an intrusion into someone’s privacy regardless of whether the someone is an adult or a child. Ultimately, “privacy expectations are developing, to say the least, with respect to . . . whether a commercial entity that secretly harvests [a user’s data] commits a highly offensive or egregious act.” McDonald, 385 F. Supp. 3d at 1035. Where, as here, a defendant does not employ secrecy or deception or some other “bad act” in connection with data collection, and instead engages in ubiquitous, commercial behavior, the Court concludes, as a matter of law, that such behavior does not rise to the level of highly offensive. The Court will therefore dismiss Plaintiffs’ privacy claims. C. Plaintiffs’ Consumer-Protection Claims Fail Because They Do Not Sufficiently Allege That They Suffered A Loss Plaintiffs allege that Defendants violated the consumer-protection statutes of 14 states when they appropriated Plaintiffs’ information without parental consent. Under each statute in question, a plaintiff may recover damages only after experiencing a loss, injury or damages.11 In the Opposition, Plaintiffs confirm that the sole loss they allege stems from the diminution in value

11 See Nataros v. Fine Arts Gallery of Scottsdale, Inc., 126 Ariz. 44, 48 (Ct. App. Div. 1 Dep’t C 1980); Kwikset Corp. v. Superior Ct., 51 Cal. 4th 310, 323 (2011); Stewart Agency, Inc. v. Arrigo Enters., 266 So. 3d 207, 212-14 (Fla. Dist. Ct. App. 4th Dist. 2019); Oliveira v. Amoco Oil Co., 201 Ill. 2d 134, 148-49 (2002); Anderson v. O’Leary Paint Co., No. 10-cv-00269-JTM, 2011 WL 4529364, at *6 (N.D. Ind. Sept. 28, 2011); Iannacchino v. Ford Motor Co., 451 Mass. 623, 629 (2008); Chapman v. Alawi, No. 331750, 2018 WL 472211, at *3-4 (Mich. Ct. App. Jan. 18, 2018); Watson Lab’ys, Inc. v. State, 241 So. 3d 573, 592 (Miss. 2018); Hess v. Chase Manhattan Bank, USA, N.A., 220 S.W.3d 758, 773 (Mo. 2007); State v. Hynes, 159 N.H. 187, 196 (2009); Thiedemann v. Mercedes-Benz USA, LLC, 183 N.J. 234, 246 (2005); Gregg v. Ameriprise Fin., Inc., 664 Pa. 567, 582 (2021); Tucker v. Sierra Builders, 180 S.W.3d 109, 115 (Tenn. Ct. App. 2005); Indoor Billboard/Wash., Inc. v. Integra Telecom of Wash., Inc., 162 Wash. 2d 59, 74 of their information caused by Defendants’ misappropriation of that information. See Opposition at 15 (“Plaintiffs’ injury is not that their [information] no longer ‘belongs to them’—they have been injured because their [information] has now been misappropriated and exploited by Defendants, and, therefore, effectively ‘belongs’ to Defendants, too, decreasing its value.”). But Plaintiffs do not allege sufficient facts from which the Court may reasonably infer that Defendants’ misappropriation reduced the value of Plaintiffs’ information. Instead, they merely allege that “there is a market for consumers to monetize Personal Information,” that “published analyses and studies have placed a value in excess of $200 on an individual’s Personal Information” and that Defendants’ “usurped” Plaintiffs’ information without parental consent. See FAC ¶¶ 173-76. Plaintiffs do not, however, allege facts explaining how Defendants’ collection and use of their information reduces the value of that information, and an explanation as to how does not appear so obvious that the Court may simply infer one. See, e.g., Pruchnicki v. Envision Healthcare Corp., 845 F. App’x 613, 614-15 (9th Cir. 2021) (“Pruchnicki submits that she adequately alleged diminution of the value of her personal information. We disagree. Although the studies cited by Pruchnicki establish that personal information may have value in general, Pruchnicki failed to adequately allege that her personal information actually lost value.”); In re Facebook Priv. Litig., 572 F. App’x 494, 494 (9th Cir. 2014) (where plaintiffs allege “that they were harmed both by the dissemination of their personal information and by losing the sales value of that information,” affirming dismissal of California consumer-protection claim for failure to sufficiently allege loss); cf. LaCourt v. Specific Media, Inc., No. 10-cv-01256-GW, 2011 WL 1661532, at *5 (C.D. Cal. Apr. 28, 2011) (in rejecting allegations of injury for purposes of Article III-standing analysis, explaining that “Plaintiffs do not explain how they were ‘deprived’ of the economic value of their personal information simply because their unspecified personal information was purportedly collected by a third party”). In the absence of such facts, the Court must dismiss Plaintiffs’ consumer-protection claims for failure to sufficiently allege that Plaintiffs suffered a loss. Plaintiffs oppose this conclusion by analogizing to trade-secret misappropriation and necessarily lose value once published, as they derive value, in part, by remaining unknown. Plaintiffs’ information, however, could still prove just as valuable as it did prior to Defendants’ misappropriation, and Plaintiffs do not offer any allegations to the contrary; Judge Freeman recognized as much at the February 22 hearing. See Hr’g Tr. at 45:17-46:12. As for infringement of publicity rights, damages for that tort typically flow from a defendant’s unjust enrichment as opposed to from a plaintiff’s loss. See J. Thomas McCarthy & Roger E. Schechter, The Rights of Publicity & Privacy § 3:5, Westlaw (database updated April 2024). But just because Defendants received a gain does not mean Plaintiffs suffered a loss. See, e.g., In re Google Assistant Priv. Litig., 457 F. Supp. 3d 797, 839-41 (N.D. Cal. 2020) (plaintiff insufficiently alleged California consumer-protection claim because court cannot infer economic loss based merely on defendant’s economic gain). Plaintiffs’ cited authorities do not compel a different result (see Opposition at 14-17):  In In re Yahoo! Inc. Customer Data Security Breach Litigation, No. 16-MD-02752-LHK, 2017 WL 3727318 (N.D. Cal. Aug. 30, 2017), the plaintiffs alleged that hackers stole information that would enable access to the plaintiffs’ email accounts and the private information contained therein. See id. at *13-14. That concern does not apply here. The court did also credit allegations of lost value based on the potential use of the stolen information for targeted advertising (see id. at *14), but as explained above, the Court cannot infer diminution in value simply because the misappropriated information has value.  In In re Anthem, Inc. Data Breach Litigation, No. 15-MD-02617-LHK, 2016 WL 3029783 (N.D. Cal. May 27, 2016), the court recognized alleged losses stemming from the plaintiffs’ failure to receive the benefit of their bargain with the defendants, the plaintiffs’ reliance on a contract, the difficulty in calculating damages for those losses and the plaintiff’s out-of-pocket expenses. See id. at *42-43. These concerns do not apply here.  In In re Experian Data Breach Litigation, No. 15-cv-01592-AG, 2016 WL 7973595 (C.D. Cal. Dec. 29, 2016), the court recognized alleged losses stemming from the time the misappropriation of their information. See id. at *5. That concern does not apply here.  In In re Marriott International, Inc., Customer Data Security Breach Litigation, 440 F. Supp. 3d 447 (D. Md. 2020), the Court found that allegations of a risk of identity theft, time and money spent addressing the data breach that resulted in misappropriation of the plaintiffs’ information and the plaintiffs’ overpayment to the defendants constituted sufficient allegations of injury. See id. at 457-460, 462-66. The court also recognized a loss in the value of the stolen information based on allegations that the plaintiffs “suffered lower credit scores as a result of the data breach[,] that fraudulent accounts and tax returns were filed in their names” and that the value of the information stemmed in part from “the expectation that its integrity has not been compromised.” See id. at 460-62. These concerns do not apply here.  In Calhoun v. Google LLC, 526 F. Supp. 3d 605 (N.D. Cal. 2021), the court relied on the decisions in Yahoo, Anthem and Marriot, and this Court has already distinguished those decisions. See id. at 636. The Calhoun court also relied on the Ninth Circuit’s decision in Facebook Privacy, but there, the Ninth Circuit affirmed dismissal of a California consumer-protection claim where the plaintiffs alleged “that they were harmed both by the dissemination of their personal information and by losing the sales value of that information.” See 572 F. App’x at 494.  In Klein v. Facebook, Inc., 580 F. Supp. 3d 743 (N.D. Cal. 2022), the plaintiffs alleged that Facebook obtained their “information and attention,” which they could have monetized in the absence of Facebook’s monopolization of the social-media market. See id. at 802-804. But Plaintiffs do not allege that Defendants monopolized the market for their information such that they now lack a buyer in light of Defendants’ misappropriation of their information.  In Brown v. Google LLC, 685 F. Supp. 3d 909 (N.D. Cal. 2023), the court found at the summary-judgment stage that “[s]ufficient evidence exists” to show that “Google’s alleged surreptitious collection of [the plaintiffs’] data inhibited [the] plaintiffs’ ability to Plaintiffs to provide evidence at the pleading stage, it does require sufficient allegations, and Plaintiffs have not alleged facts supporting the conclusion that Defendants’ conduct inhibited Plaintiffs’ ability to participate in the market for their information.  In Del Vecchio v. Amazon.com, Inc., No. 11-cv-00366-RSL, 2012 WL 1997697 (W.D. Wash. June 1, 2012), the court did not, as Plaintiffs suggest, accept Defendants’ misappropriation as a sufficient allegation of injury; rather, the court converted the motion to dismiss on the issue of injury into a motion for summary judgment and suggested that the parties should engage in discovery. See id. at *6-7.  In In re Mednax Services, Inc., Customer Data Security Breach litigation, 603 F. Supp. 3d 1183 (S.D. Fla. 2022), the court recognized as sufficient allegations of damage to the Plaintiffs’ credit stemming from misappropriation of their information via a data breach. See id. at 1204, 1217-1218. That concern does not apply here.  In Tyler v. Michaels Stores, Inc., 464 Mass. 492 (2013), the court explained that a merchant’s provision of unwanted marketing materials following its collection of a customer’s information and a merchant’s sale of a customer’s information to a third party for profit (both in violation of a statute concerning credit cards not at issue here) constitute injuries under the Massachusetts consumer-protection statute at issue here. See id. at 504. But Plaintiffs do not allege that Defendants sent them unwanted marketing materials or sold their information to third parties.  In Opris v. Sincera Reproductive Medicine, No. 21-cv-03072-JHS, 2022 WL 1639417 (E.D. Pa. May 24, 2022), the court recognized alleged losses stemming from “costs associated with the data breach [that caused the misappropriation of the plaintiffs’ information], such as purchasing credit monitoring and identity theft detection services.” See id. at *12-13. That concern does not apply here. The court also relied on the decisions in Marriott, Experian and Calhoun, and this Court has already distinguished those decisions. See id. at *8. At the February 22 hearing, Plaintiffs appeared to identify another harm that they allegedly rendering it valueless. See Hr’g Tr. at 44:6-12. To the extent this constitutes a harm distinct from the diminution in value of the misappropriated information, the Court again finds Plaintiffs’ allegations lacking. As Judge Freeman explained at the hearing, Plaintiffs do not allege any facts from which the Court can reasonably infer that Defendants’ use of Plaintiffs’ information prevents Plaintiffs from using the information themselves. See Hr’g Tr. at 45:17-46:12. Even if the Court accepted that Plaintiffs could no longer sell their information, it would still reject that inability as a sufficiently alleged harm because Plaintiffs do not allege that they actually intended to sell that information. Information about an individual’s internet use belies classification as an ordinary commodity which one could easily go out to sell at a market (e.g., a farm selling produce at a local farmers market). To be sure, Plaintiffs do allege that a market for such information exists (see FAC ¶ 174), but the Court cannot reasonably infer from the existence of such a market that a consumer (and a child under the age of 13, no less) could realistically participate in that market. At the very least, Plaintiffs must allege that they actually intended to sell the misappropriated information or must describe facts from which the Court can reasonably infer such intention (e.g., that Plaintiffs have sold their information in the past, that participating in such an information market is easy or common for consumers). D. The Court Will Grant Plaintiffs Limited Leave To Amend Although Plaintiffs have now filed six complaints, this Order presents the Court’s first evaluation of the merits of Plaintiffs’ claims. The Court therefore cannot conclude that the sheer number of pleadings filed indicates that further amendment would be futile. Indeed, Plaintiffs could potentially cure the defects identified in this Order in a further pleading, and the Court will give them an opportunity to do so as follows:  Equitable Relief And Unjust Enrichment. As discussed above, Plaintiffs allege that they suffered economic harm, and damages serve as an adequate legal remedy for that harm. To the extent Plaintiffs can allege in good faith that they have suffered or will suffer non-economic harm not remediable by damages, they must include such allegations in their amended pleading. above that routine commercial behavior, in the absence of plus factors, does not, as a matter of law, rise to the level of highly offensive. To the extent Plaintiffs can allege in good faith that sufficient plus factors accompanied Defendants’ conduct, they must include such allegations in their amended pleading.  Violations Of Consumer-Protection Statutes. The Court described above the specific alleged facts missing from the FAC whose absence prevents the Court from inferring that Plaintiffs suffered a loss. To the extent Plaintiffs can allege in good faith those facts (or similar facts), they must include such allegations in their amended pleading.  No Other Substantive Changes. Plaintiffs may amend their pleading to address the deficiencies identified in this Order as discussed in this Section. They may do no more; they may not add new parties or claims, and they may not otherwise add new substantive allegations. For the foregoing reasons, the Court GRANTS the Motion and DISMISSES12 all of Plaintiff’s claims WITH LIMITED LEAVE TO AMEND as explained above and as follows:  The Court DISMISSES all of Plaintiffs’ requests for equitable relief and their claims of unjust enrichment WITH LEAVE TO AMEND.  The Court DISMISSES all of Plaintiffs’ intrusion-upon-seclusion claims and their claim for violation of the right to privacy guaranteed by the constitution of California WITH  The Court DISMISSES all of Plaintiff state consumer-protection law claims WITH Plaintiffs must file an amended complaint by July 22, 2024. If Plaintiffs file an amended complaint, then for the convenience of the Court, they shall include with that filing a redline indicating all changes made between the FAC and the new complaint. The Court will dismiss this

12 The Parties raised many arguments in their briefing. The Court expresses no opinion as to those ] action if Plaintiffs fail to file an amended complaint by the deadline. 3 Dated: July 1, 2024 4 5 Stam eG SUSAN VAN KEULEN 6 United States Magistrate Judge 7 8 9 10 1] 12

16 Z 18 19 20 21 22 23 24 25 26 27 28

Case 5:19-cv-07016-SVK Document 281 Filed 07/01/24 Page 22 of 25

APPENDIX A

State Claim Intrusion Upon Seclusion Alabama Unjust Enrichment Intrusion Upon Seclusion Violation of the Arizona Consumer Fraud Act Arizona (Ariz. Rev. Stat. § 44-1521 et seq.) Unjust Enrichment Violation of Constitutional Right to Privacy Intrusion Upon Seclusion California Violation of the Unfair Competition Law (Cal. Bus. & Prof. Code § 17200 et seq.) Intrusion Upon Seclusion Colorado Unjust Enrichment Violation of the Deceptive and Unfair Trade Practices Act Florida (Fla. Stat. § 501.201 et seq.) Unjust Enrichment Illinois Intrusion Upon Seclusion Case 5:19-cv-07016-SVK Document 281 Filed 07/01/24 Page 23 of 25

State Claim Violation of the Consumer Fraud and Deceptive Business Practices Act (815 Ill. Comp. Stat. 505/1 et seq.) Unjust Enrichment Violation of the Deceptive Consumer Sales Indiana Act (Ind. Code § 24-5-0.5-0.1 et seq.) Unjust Enrichment Intrusion Upon Seclusion Kansas Unjust Enrichment Violation of the Consumer Protection Act Massachusetts (Mass. Gen. Laws ch. 93A et seq.) Unjust Enrichment Violation of the Consumer Protection Act Michigan (Mich. Comp. Laws § 445.901 et seq.) Unjust Enrichment Violation of the Consumer Protection Act Mississippi (Miss. Code Ann. § 75-24-1 et seq.) Unjust Enrichment Missouri Intrusion Upon Seclusion Case 5:19-cv-07016-SVK Document 281 Filed 07/01/24 Page 24 of 25

State Claim Violation of the Merchandising Practices Act (Mo. Rev. Stat. § 407.005 et seq.) Unjust Enrichment Intrusion Upon Seclusion Violation of the Consumer Protection Act New Hampshire (N.H. Rev. Stat. Ann. § 358-A:1 et seq.) Unjust Enrichment Intrusion Upon Seclusion Violation of the Consumer Fraud Act New Jersey (N.J. Stat. Ann. § 56:8-1 et seq.) Unjust Enrichment New York Unjust Enrichment Intrusion Upon Seclusion Oklahoma Unjust Enrichment Intrusion Upon Seclusion Violation of the Unfair Trade Practices and Consumer Protection Pennsylvania Law (73 Pa. Cons. Stat. § 201-1 et seq.) Unjust Enrichment Case 5:19-cv-07016-SVK Document 281 Filed 07/01/24 Page 25 of 25

State Claim Violation of the Consumer Protection Act Tennessee (Tenn. Code Ann. § 47-18-101 et seq.) Unjust Enrichment Virginia Unjust Enrichment Intrusion Upon Seclusion Violation of the Consumer Protection Act Washington (Wash. Rev. Code § 19.86.010 et seq.) Unjust Enrichment