Jackson v. LinkedIn Corporation

Opinion

JACQUELINE JACKSON, Case No. 24-cv-00812-PCP

Plaintiff, ORDER GRANTING MOTION TO v. DISMISS IN PART

LINKEDIN CORPORATION, Re: Dkt. No. 19 Defendant.

Plaintiff Jacqueline Jackson brings this class action data privacy lawsuit against defendant LinkedIn Corporation alleging that LinkedIn used its Insight Tag (also known as the LinkedIn Pixel) to unlawfully obtain and use personal disability information from LinkedIn users visiting the California Department of Motor Vehicles (DMV) website. LinkedIn moves to dismiss the case under Federal Rule of Civil Procedure 12(b)(7) for failure to join the DMV as a necessary party and under Federal Rule of Civil Procedure 12(b)(6) for failure to state a claim. For the following reasons, the Court denies the Rule 12(b)(7) motion but grants the Rule 12(b)(6) motion in part and with leave to amend. Jackson is a California resident who has been a registered LinkedIn user for at least 10 years. She has had a disability placard issued by the DMV since approximately 2009. In 2023, Jackson used her mobile phone to renew her disability placard through the DMV’s website, which required that she provide her first and last name, date of birth, disability information, and email address. She alleges that in January 2024, she discovered that LinkedIn was using its Insight Tag to obtain her personal information from her motor vehicle record on the DMV’s website and to LinkedIn’s Insight Tag is used to gather information across websites to support marketing services that LinkedIn offers to its customers, including targeted advertising. Customers like the DMV can install the Insight Tag on their own webpages to track a user’s actions on their website. These forms of personal information and private communications are allegedly embedded within URLs that are then transmitted to LinkedIn, incorporated into the user’s LinkedIn profile, and employed for targeted advertising. Jackson alleges that LinkedIn used the information it received from the DMV “to generate substantial revenue from advertising and marketing services.” Dkt. No. 1, at 2. Before advertising through LinkedIn’s marketing services, advertisers like the DMV must agree to LinkedIn’s Ads Agreement, which warns advertisers not to send personal or sensitive information to LinkedIn via the Insight Tag. It states: “You will [] not transfer to LinkedIn any data that you know or reasonably should know … constitutes Sensitive Data, including by way of installing the Insight Tag on a page that collects medical, financial, or other Sensitive Data about identified or identifiable individuals.” Dkt. No. 19, at 11. Jackson alleges that LinkedIn’s conduct violates the Driver’s Privacy Protection Act, 18 U.S.C. § 2721 (DPPA), and the California Invasion of Privacy Act, Cal. Pen. Code § 630 (CIPA). LinkedIn moves to dismiss the case, arguing under Rule 12(b)(7) that the complaint fails to join the DMV as a necessary party and under Rule 12(b)(6) that Jackson fails to state a claim. A Rule 12(b)(7) motion alleges that the plaintiff has failed to join a party deemed necessary under Federal Rule of Civil Procedure 19. Rule 19 generally requires the joinder of a person if “in that person’s absence, the court cannot accord complete relief among existing parties” or if “that person claims an interest relating to the subject of the action and is so situated that disposing of the action in the person’s absence may: (i) as a practical matter impair or impede the person’s ability to protect the interest; or (ii) leave an existing party subject to a substantial risk of incurring double, multiple, or otherwise inconsistent obligations because of the interest.” Fed. R. Civ. P. 19(a)(1)(A)–(B). If these requirements are satisfied, the person “must be joined” so long “If a person who is required to be joined if feasible cannot be joined”—for example, because doing so would eliminate the Court’s subject matter jurisdiction—“the court must determine whether, in equity and good conscience, the action should proceed among the existing parties or should be dismissed.” Fed. R. Civ. P. 19(b). The Court can consider matters outside the complaint on a Rule 12(b)(7) motion. White v. Univ. of Calif., 2012 WL 12335354, at *5 (N.D. Cal. Oct. 9, 2012), aff’d, 765 F.3d 1010 (9th Cir. 2014). The Federal Rules require a complaint to include only a “short and plain statement of the claim showing that the pleader is entitled to relief.” Fed. R. Civ. P. 8(a)(2). In considering a Rule 12(b)(6) motion contending that a complaint fails to state a claim, the Court must “accept all factual allegations in the complaint as true and construe the pleadings in the light most favorable” to the non-moving party. Rowe v. Educ. Credit Mgmt. Corp., 559 F.3d 1028, 1029 (9th Cir. 2009). Dismissal is required if the plaintiff fails to allege facts allowing the Court to “draw the reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 663 (2009). While legal conclusions “can provide the complaint’s framework,” the Court will not assume they are correct unless adequately “supported by factual allegations.” Id. at 664. I. The DMV Is Not a Necessary Party. LinkedIn argues that the DMV is a necessary party to this lawsuit under Rule 19 but that the DMV cannot be feasibly joined because the Eleventh Amendment prohibits joinder of nonconsenting state agencies in federal court. Hibbs v. Dep’t of Hum. Res., 273 F.3d 844, 850 (9th Cir. 2001), aff’d sub nom. Nev. Dep’t of Hum. Res. v. Hibbs, 538 U.S. 721, 723 (2003). Because joinder is not feasible, LinkedIn suggests that the lawsuit should be dismissed. See Fed. R. Civ. P. 19(b) (“[T]he court must determine whether, in equity and good conscience, the action should proceed among the existing parties or should be dismissed” when a necessary party cannot feasibly be joined). In support of its position that the DMV is a necessary party, LinkedIn first argues that Jackson’s purported harm cannot be fully remedied unless the DMV is joined to the lawsuit for Jackson’s injury. See Fed. R. Civ. P. 19(a)(1)(A); Pit River Home & Agric. Coop. Ass’n v. United States, 30 F.3d 1088, 1099 (9th Cir. 1994) (finding absent party was required because “even if the [plaintiff] obtained its requested relief [against the government], it would not have complete relief, since judgment” would not bind the absent party). In LinkedIn’s view, absent joinder, the DMV could continue to gather and share Jackson’s information by using another analytics provider to perform the same functions as LinkedIn’s Insight Tag. Contrary to LinkedIn’s argument, there is no obvious reason why Jackson could not recover damages sufficient to compensate for the injuries resulting from the use of LinkedIn’s own technology from LinkedIn alone. See Force MOS Tech. Co. v. Lin, 2024 WL 1199017, at *2 (N.D. Cal. Mar. 19, 2024) (citing A.D. v. Cal. Highway Patrol, 2009 WL 773872, at *2 (N.D. Cal. Mar. 17, 2009)) (holding that a plaintiff need not join an absent party if plaintiff can “recover damages sufficient to compensate for his or her injuries from the defendants already in the action”). LinkedIn’s argument that the DMV might continue to gather Jackson’s personal information from another third-party analytics provider does not require the DMV’s joinder in this lawsuit focusing on LinkedIn’s own tracking technology. Jackson asserts claims against LinkedIn alleging that it unlawfully used her sensitive disability information obtained from the DMV through the Insight Tag. The lawfulness of the DMV’s use of the Insight Tag (or any other technology) to obtain Jackson’s personal information and transmit it to third parties is not at issue here, because Jackson is not asserting any privacy claims against the DMV. Jackson can therefore obtain complete relief from LinkedIn for LinkedIn’s own conduct—which is all that Jackson seeks in this lawsuit—in the DMV’s absence. LinkedIn also contends that Jackson cannot obtain “complete relief” under Rule 19(a)(1)(A) in the DMV’s absence because if the Court were to find LinkedIn liable, LinkedIn may be contractually entitled to indemnification from the DMV.1 Contending that the DMV violated the provision of the Ads Agreement that prohibits the sharing of personal and sensitive 1 The indemnification provision in the Ads Agreement between LinkedIn and the DMV states, “[Y]ou agree to indemnify LinkedIn and hold LinkedIn harmless from any damages, losses and Insight Tag data, LinkedIn argues that “[i]t would be profoundly unfair if [it] could not seek indemnification from the [DMV].” E.E.O.C. v. Peabody W. Coal Co., 610 F.3d 1070, 1081 (9th Cir. 2010) (finding absent party was required under Rule 19(a) because in the event defendant was found liable, it “w[ould] not be able to seek indemnification from the Secretary”). But LinkedIn is free to assert an indemnification claim against the DMV in a separate lawsuit under a breach-of- contract theory (assuming it complies with the requirements for pursuing such a claim against a California government entity). See, e.g., Loehr v. Ventura Cnty. Cmty. Coll. Dist., 147 Cal. App. 3d 1071, 1079–80 (1983) (discussing statutory scheme for recovering contractual damages from California public entities). That fact distinguishes this case from E.E.O.C. v. Peabody W. Coal Co., in which there was no underlying contract between the absent party and the defendant. 610 F.3d at 1082. LinkedIn further argues that because this lawsuit directly implicates a contractual agreement in which the DMV has an interest (the Ads Agreement), the DMV has a claim to “an interest relating to the subject of the action” and its “absence may as a practical matter impair or impede [its] ability to protect the interest.” Fed. R. Civ. P. 19(a)(1)(B). LinkedIn contends that the DMV’s interest is concrete because a finding that LinkedIn is liable would necessarily mean that the DMV breached its contractual obligations under the Ads Agreement. See Dawavendewa v. Salt River Project Agric. Improvement & Power Dist., 276 F.3d 1150, 1157 (9th Cir. 2002) (holding that an absent party was necessary where the “instant litigation threatens to impair [its] contractual interests, and thus, its fundamental economic relationship with” the present party). LinkedIn also argues that a judgment in Jackson’s favor may impair the DMV’s ability to perform its key functions as a state entity, including procuring advertising services. Id. at 1155 (finding that a judgement rendered in [the state’s] absence would impair its “sovereign capacity to negotiate contracts” and undermine the state’s ability to govern effectively). To require joinder under Rule 19, an absent party’s interest must “be more than a financial stake, and more than speculation about a future event.” Iconlab Inc. v. Bausch Health Companies Inc., 2019 WL 12521292, at *4 (C.D. Cal. May 15, 2019); Shermoen v. United States, 982 F.2d standard. Contrary to LinkedIn’s contentions, an adverse ruling would not necessarily require a finding that the DMV breached the Ads Agreement. Dkt. No. 25, at 14. Jackson alleges that LinkedIn unlawfully obtained and used her sensitive disability information in violation of the DPPA and CIPA. Whether the DMV’s collection and transmission of Jackson’s personal information was unlawful or a breach of the Ads Agreement is not before this Court. Rather, Jackson is alleging only that LinkedIn’s receipt and use of that private data violated the DPPA and CIPA. The Court can plausibly find LinkedIn liable without finding any breach by the DMV, meaning that the DMV’s contractual interest would not be impeded by this action. For the same reasons, LinkedIn has not sufficiently demonstrated that the DMV’s absence from this lawsuit would impair its sovereign capacity to negotiate contracts. LinkedIn’s potential liability can be assessed independently from whether the DMV breached the Ads Agreement (which Jackson is not alleging in her complaint), and LinkedIn has not identified any concrete manner in which the DMV’s ability to enter into contracts for advertising or other purposes would be impaired by a holding that third parties like LinkedIn cannot receive and use sensitive information in violation of the DPPA or CIPA. Finally, LinkedIn suggests that the DMV’s absence puts LinkedIn in an untenable position because a ruling for Jackson would prohibit it from receiving personal information from the DMV while the DMV retains ultimate control over its Insight Tag and what information is sent to LinkedIn. But LinkedIn’s argument that it has no control over what information the Insight Tag on the DMV’s website sends to LinkedIn is implausible. After all, the Insight Tag is also known as the LinkedIn Pixel, and LinkedIn has not provided evidence showing that it cannot modify whether and how third-party website data is transmitted to LinkedIn. In arguing that the DMV is a necessary party, LinkedIn relies heavily on Downing v. Globe Direct LLC, 806 F. Supp. 2d 461, 470 (D. Mass. 2011), aff’d on other grounds, 682 F.3d 18, 19 (1st Cir. 2012). In Downing, the Massachusetts Registry of Motor Vehicles (RMV) retained an outside vendor to print and mail registration renewal notices to motor vehicle owners on behalf of the state, and the vendor obtained owners’ name and address information from the RMV in order advertisers and insert their advertising into the notices. After plaintiffs sued the vendor for privacy violations, the Court held that the state-run RMV was a necessary party to the lawsuit and dismissed the case on Eleventh Amendment grounds. Id. at 470. Downing is distinguishable from the factual circumstances here. As LinkedIn admits, the RMV in Downing hired the outside vendor to mail registration renewal notices and third-party advertisements “on behalf of the RMV.” Dkt. No. 19, at 14 (emphasis added). All of the vendor’s challenged conduct was undertaken for the RMV under the binding terms of its contract with the RMV. There was therefore no question that the RMV had a contractual interest in both providing the vendor with information from its records and having advertisements included in the notices sent on its behalf. By contrast, LinkedIn has not suggested that the transmission of sensitive disability information from the DMV’s website to LinkedIn was a condition placed upon LinkedIn’s contractual relationship with the DMV by the DMV or was necessary for the DMV to receive the desired services from LinkedIn. Indeed, LinkedIn alleges that the contract instead prohibited such transmissions. These circumstances make this case nothing like Downing. For all of these reasons, the DMV is not a necessary party to this lawsuit under Rule 19. LinkedIn’s Rule 12(b)(7) motion is therefore denied. II. Jackson Fails to Adequately Plead a DPPA Claim. A violation of the DPPA requires that the defendant: (1) knowingly took some affirmative action to obtain, disclose, or use personal information, (2) from a record maintained by the DMV pertaining to a driver’s operating permit, title, registration, or identification card, (3) for an impermissible purpose. See Senne v. Village of Palatine, Illinois, 695 F.3d 597, 603 (7th Cir. 2012); Andrews v. Sirius XM Radio Inc., 932 F.3d 1253 (9th Cir. 2019). Jackson fails to adequately plead a claim under the DPPA because she does not sufficiently allege that the information LinkedIn purportedly obtained and used was from a “motor vehicle record.” 18 U.S.C. § 2725(1) (defining motor vehicle record as “any record that pertains to a motor vehicle operator’s permit, motor vehicle title, motor vehicle registration, or identification sensitive information that she inputted when renewing her disability placard on the DMV’s website. This information was purportedly collected via the Insight Tag from the DMV’s webpages and then transmitted to LinkedIn in the form of URLs. But Jackson does not explain how such disability information embedded within URLs qualifies as a motor vehicle record. See Keogh v. Meta Platforms Inc., 680 F. Supp. 3d 601, 609–10 (D.S.C. 2023) (holding that personal information stored on the South Carolina DMV’s public-facing website was not a “record” within the meaning of the DPPA). In Andrews v. Sirius XM Radio Inc., the Ninth Circuit held that a DMV website alone cannot be a motor vehicle record because a record must consist of “information about an individual that is maintained by an agency.” 932 F.3d at 1260. As pleaded, the information transmitted to LinkedIn consisted only of public-facing URLs and the information that Jackson herself entered into the DMV’s website, rather than any information maintained by the DMV in its own records. In contending that the information here was maintained in the DMV’s records, Jackson relies on Gershzon v. Meta Platforms Inc., 2023 WL 5420234 (N.D. Cal. Aug. 22, 2023). In Gershzon, the plaintiff asserted DPPA and CIPA claims under similar factual circumstances involving the Meta Pixel, and the Court denied Meta’s motion to dismiss in part because it found that information transmitted from the DMV to Meta was from a motor vehicle record. Id. at *8. But in Gershzon, the personal information from the plaintiff’s disability placard application was contained within the plaintiff’s “MyDMV” account. By contrast, there are no allegations by Jackson here that her disability information was contained within any such account that might qualify as a motor vehicle record. In contrast to the DMV’s website or specific webpages, a user’s MyDMV account is at least arguably “maintained by an agency” for the purposes of the DPPA. Andrews, 932 F.3d at 1260. In the absence of sufficient factual allegations that Jackson’s disability information was stored within a motor vehicle record, the Court must grant LinkedIn’s motion to dismiss the DPPA claim. See, e.g., Davis v. Meta Platforms, Inc., Case No. 23-01352 (D. Nev. July 3, 2024) (holding that plaintiff failed to plausibly allege that the Nevada DMV’s website is a motor vehicle record); from the New Jersey Motor Vehicle Commission are not records as defined by the DPPA). III. Jackson Adequately Pleads a CIPA Claim. CIPA prohibits both reading or learning the contents of any message, report, or communication in transit over any wire, line, or cable without authorization (“interception”) and using or communicating any information so obtained (“use”). Cal. Pen. Code § 631. A plaintiff who sufficiently alleges either interception or use by the defendant adequately pleads a CIPA violation. Javier v. Assurance IQ, LLC, 649 F. Supp. 3d 891, 900 (N.D. Cal. Jan. 5, 2023). Section 631 applies to “new technologies” such as computers, email, and the Internet. See, e.g., Matera v. Google Inc., 2016 WL 8200619, at *20 (N.D. Cal. Aug. 12, 2016). LinkedIn argues that Section 631 applies “only to eavesdropping by a third-party and not to recording by a participant to a conversation.” In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 607 (9th Cir. 2020) (citing Warden v. Kahn, 99 Cal. App. 3d 805, 811 (1979)). LinkedIn contends that the Insight Tag was not used to eavesdrop, but was instead used by the DMV itself to “record” its website interactions with Jackson. In LinkedIn’s view, it was merely the third-party vendor of a recording service that “that capture[d the DMV’s] data … and allow[ed] the [DMV] to analyze their data.” Graham v. Noom, 533 F. Supp. 3d 832, 832 (N.D. Cal. 2021). LinkedIn’s argument fails because Jackson alleges not only that the DMV collected her personal information using the Insight Tag, but also that LinkedIn received this sensitive data and read and used it for its own marketing services. Her complaint contains a plethora of allegations that LinkedIn read and used the data it acquired from the DMV for its own marketing services. See, e.g., Dkt. No. 1, at 11 (“LinkedIn’s Marketing Services monetizes the collected data through the sale of [ads].”); id. at 23 (“LinkedIn is also learning the contents of communications between website users and the DMV. This enables advertisers to target users with relevant content or advertisement[s] using the personal information and data that LinkedIn harvested.”). This purported acquisition and review of the disability information by LinkedIn for advertising purposes qualifies as interception under CIPA. In re Meta Pixel Healthcare Litig., 647 F. Supp. 3d 778, 795 (N.D. Cal. 2022) (noting that “the Ninth Circuit has construed the term [intercept] Smith v. Google, LLC, 2024 WL 2808270 (N.D. Cal. June 3, 2024), is instructive. In that case, the Court found that “[w]hether or not a third-party service incapable of using the data it collects might avoid liability under Section 631, the complaint alleges that Google does read and use Google Analytics data.” Id. at *4. The Court held that “[p]laintiffs’ allegations, which must be taken as true, suggest that Google is not simply a vendor of a tool that websites can use to ‘record’ their own users’ interactions on their websites, but rather that Google read or used the data collected about these users.” Id. With analogous allegations here about LinkedIn’s receipt and potential use of Jackson’s information for advertising purposes, Jackson plausibly alleges that LinkedIn was a third-party eavesdropper who intercepted her communications with the DMV. LinkedIn separately argues that even if Jackson adequately pleads that LinkedIn “read” her personal information, she fails to allege that LinkedIn “used” this data in any way. As LinkedIn notes, Jackson provides numerous generalized allegations about LinkedIn’s marketing services and its Insight Tag, but does not specify what personal information of hers was sent from the DMV to LinkedIn via the Insight Tag or explain how LinkedIn used this particular information for its marketing services. See, e.g., Dkt. No. 1, at 7 (“The personal information and communications obtained by LinkedIn are used to fuel various services offered via LinkedIn’s Marketing Solutions including Ad Targeting, Lookalike Targeting, Audience Expansion, Matched Audiences, LinkedIn Audience Network, and Meet the LinkedIn Member.”); id. at 11 (“LinkedIn feeds the vast quantities of personal data obtained from the LinkedIn Pixel into its Marketing Solutions advertising systems to identify, characterize, and categorize users’ for targeted advertising purposes.”). Jackson does not allege, for example, that she received a targeted advertisement related to her disability status. In the absence of such facts, Jackson’s allegations may very well be insufficient to plausibly suggest LinkedIn’s use of the disability information transmitted to it by the DMV’s website. But Jackson’s factual allegations regarding the manner in which the Insight Tag operates are sufficient to plausibly allege that LinkedIn at least “read” or “learned” the information so transmitted. Because that is sufficient to state a claim under Section 631, LinkedIn’s motion to 2 For the foregoing reasons, the Court denies LinkedIn’s Rule 12(b)(7) motion and denies its 3 Rule 12(b)(6) motion to dismiss the CIPA claim but grants with leave to amend LinkedIn’s Rule 4 12(b)(6) motion to dismiss the DPPA claim. If she so chooses, Jackson must submit an amended 5 } complaint within 21 days of this order. 6 8 Dated: August 13, 2024 A bem~ 10 P. Casey Fitts I United States District Judge 12

15 16

= 17

Z 18 19 20 21 22 23 24 25 26 27 28