Jackson v. LinkedIn Corporation

Opinion

1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 7 JACQUELINE JACKSON, Case No. 24-cv-00812-PCP

8 Plaintiff, ORDER GRANTING MOTION TO 9 v. DISMISS IN PART

10 LINKEDIN CORPORATION, Re: Dkt. No. 19 Defendant. 11

12 13 Plaintiff Jacqueline Jackson brings this class action data privacy lawsuit against defendant 14 LinkedIn Corporation alleging that LinkedIn used its Insight Tag (also known as the LinkedIn 15 Pixel) to unlawfully obtain and use personal disability information from LinkedIn users visiting 16 the California Department of Motor Vehicles (DMV) website. LinkedIn moves to dismiss the case 17 under Federal Rule of Civil Procedure 12(b)(7) for failure to join the DMV as a necessary party 18 and under Federal Rule of Civil Procedure 12(b)(6) for failure to state a claim. For the following 19 reasons, the Court denies the Rule 12(b)(7) motion but grants the Rule 12(b)(6) motion in part and 20 with leave to amend. 21 BACKGROUND 22 Jackson is a California resident who has been a registered LinkedIn user for at least 10 23 years. She has had a disability placard issued by the DMV since approximately 2009. In 2023, 24 Jackson used her mobile phone to renew her disability placard through the DMV’s website, which 25 required that she provide her first and last name, date of birth, disability information, and email 26 address. She alleges that in January 2024, she discovered that LinkedIn was using its Insight Tag 27 to obtain her personal information from her motor vehicle record on the DMV’s website and to 1 LinkedIn’s Insight Tag is used to gather information across websites to support marketing 2 services that LinkedIn offers to its customers, including targeted advertising. Customers like the 3 DMV can install the Insight Tag on their own webpages to track a user’s actions on their website. 4 These forms of personal information and private communications are allegedly embedded within 5 URLs that are then transmitted to LinkedIn, incorporated into the user’s LinkedIn profile, and 6 employed for targeted advertising. Jackson alleges that LinkedIn used the information it received 7 from the DMV “to generate substantial revenue from advertising and marketing services.” Dkt. 8 No. 1, at 2. 9 Before advertising through LinkedIn’s marketing services, advertisers like the DMV must 10 agree to LinkedIn’s Ads Agreement, which warns advertisers not to send personal or sensitive 11 information to LinkedIn via the Insight Tag. It states: “You will [] not transfer to LinkedIn any 12 data that you know or reasonably should know … constitutes Sensitive Data, including by way of 13 installing the Insight Tag on a page that collects medical, financial, or other Sensitive Data about 14 identified or identifiable individuals.” Dkt. No. 19, at 11. 15 Jackson alleges that LinkedIn’s conduct violates the Driver’s Privacy Protection Act, 18 16 U.S.C. § 2721 (DPPA), and the California Invasion of Privacy Act, Cal. Pen. Code § 630 (CIPA). 17 LinkedIn moves to dismiss the case, arguing under Rule 12(b)(7) that the complaint fails to join 18 the DMV as a necessary party and under Rule 12(b)(6) that Jackson fails to state a claim. 19 LEGAL STANDARDS 20 A Rule 12(b)(7) motion alleges that the plaintiff has failed to join a party deemed 21 necessary under Federal Rule of Civil Procedure 19. Rule 19 generally requires the joinder of a 22 person if “in that person’s absence, the court cannot accord complete relief among existing 23 parties” or if “that person claims an interest relating to the subject of the action and is so situated 24 that disposing of the action in the person’s absence may: (i) as a practical matter impair or impede 25 the person’s ability to protect the interest; or (ii) leave an existing party subject to a substantial risk 26 of incurring double, multiple, or otherwise inconsistent obligations because of the interest.” Fed. 27 R. Civ. P. 19(a)(1)(A)–(B). If these requirements are satisfied, the person “must be joined” so long 1 “If a person who is required to be joined if feasible cannot be joined”—for example, 2 because doing so would eliminate the Court’s subject matter jurisdiction—“the court must 3 determine whether, in equity and good conscience, the action should proceed among the existing 4 parties or should be dismissed.” Fed. R. Civ. P. 19(b). The Court can consider matters outside the 5 complaint on a Rule 12(b)(7) motion. White v. Univ. of Calif., 2012 WL 12335354, at *5 (N.D. 6 Cal. Oct. 9, 2012), aff’d, 765 F.3d 1010 (9th Cir. 2014). 7 The Federal Rules require a complaint to include only a “short and plain statement of the 8 claim showing that the pleader is entitled to relief.” Fed. R. Civ. P. 8(a)(2). In considering a Rule 9 12(b)(6) motion contending that a complaint fails to state a claim, the Court must “accept all 10 factual allegations in the complaint as true and construe the pleadings in the light most favorable” 11 to the non-moving party. Rowe v. Educ. Credit Mgmt. Corp., 559 F.3d 1028, 1029 (9th Cir. 2009). 12 Dismissal is required if the plaintiff fails to allege facts allowing the Court to “draw the reasonable 13 inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 14 663 (2009). While legal conclusions “can provide the complaint’s framework,” the Court will not 15 assume they are correct unless adequately “supported by factual allegations.” Id. at 664. 16 ANALYSIS 17 I. The DMV Is Not a Necessary Party. 18 LinkedIn argues that the DMV is a necessary party to this lawsuit under Rule 19 but that 19 the DMV cannot be feasibly joined because the Eleventh Amendment prohibits joinder of 20 nonconsenting state agencies in federal court. Hibbs v. Dep’t of Hum. Res., 273 F.3d 844, 850 (9th 21 Cir. 2001), aff’d sub nom. Nev. Dep’t of Hum. Res. v. Hibbs, 538 U.S. 721, 723 (2003). Because 22 joinder is not feasible, LinkedIn suggests that the lawsuit should be dismissed. See Fed. R. Civ. P. 23 19(b) (“[T]he court must determine whether, in equity and good conscience, the action should 24 proceed among the existing parties or should be dismissed” when a necessary party cannot 25 feasibly be joined). 26 In support of its position that the DMV is a necessary party, LinkedIn first argues that 27 Jackson’s purported harm cannot be fully remedied unless the DMV is joined to the lawsuit 1 for Jackson’s injury. See Fed. R. Civ. P. 19(a)(1)(A); Pit River Home & Agric. Coop. Ass’n v. 2 United States, 30 F.3d 1088, 1099 (9th Cir. 1994) (finding absent party was required because 3 “even if the [plaintiff] obtained its requested relief [against the government], it would not have 4 complete relief, since judgment” would not bind the absent party). In LinkedIn’s view, absent 5 joinder, the DMV could continue to gather and share Jackson’s information by using another 6 analytics provider to perform the same functions as LinkedIn’s Insight Tag. 7 Contrary to LinkedIn’s argument, there is no obvious reason why Jackson could not 8 recover damages sufficient to compensate for the injuries resulting from the use of LinkedIn’s own 9 technology from LinkedIn alone. See Force MOS Tech. Co. v. Lin, 2024 WL 1199017, at *2 (N.D. 10 Cal. Mar. 19, 2024) (citing A.D. v. Cal. Highway Patrol, 2009 WL 773872, at *2 (N.D. Cal. Mar. 11 17, 2009)) (holding that a plaintiff need not join an absent party if plaintiff can “recover damages 12 sufficient to compensate for his or her injuries from the defendants already in the action”). 13 LinkedIn’s argument that the DMV might continue to gather Jackson’s personal information from 14 another third-party analytics provider does not require the DMV’s joinder in this lawsuit focusing 15 on LinkedIn’s own tracking technology. Jackson asserts claims against LinkedIn alleging that it 16 unlawfully used her sensitive disability information obtained from the DMV through the Insight 17 Tag. The lawfulness of the DMV’s use of the Insight Tag (or any other technology) to obtain 18 Jackson’s personal information and transmit it to third parties is not at issue here, because Jackson 19 is not asserting any privacy claims against the DMV. Jackson can therefore obtain complete relief 20 from LinkedIn for LinkedIn’s own conduct—which is all that Jackson seeks in this lawsuit—in 21 the DMV’s absence. 22 LinkedIn also contends that Jackson cannot obtain “complete relief” under Rule 23 19(a)(1)(A) in the DMV’s absence because if the Court were to find LinkedIn liable, LinkedIn 24 may be contractually entitled to indemnification from the DMV.1 Contending that the DMV 25 violated the provision of the Ads Agreement that prohibits the sharing of personal and sensitive 26 1 The indemnification provision in the Ads Agreement between LinkedIn and the DMV states, 27 “[Y]ou agree to indemnify LinkedIn and hold LinkedIn harmless from any damages, losses and 1 Insight Tag data, LinkedIn argues that “[i]t would be profoundly unfair if [it] could not seek 2 indemnification from the [DMV].” E.E.O.C. v. Peabody W. Coal Co., 610 F.3d 1070, 1081 (9th 3 Cir. 2010) (finding absent party was required under Rule 19(a) because in the event defendant was 4 found liable, it “w[ould] not be able to seek indemnification from the Secretary”). But LinkedIn is 5 free to assert an indemnification claim against the DMV in a separate lawsuit under a breach-of- 6 contract theory (assuming it complies with the requirements for pursuing such a claim against a 7 California government entity). See, e.g., Loehr v. Ventura Cnty. Cmty. Coll. Dist., 147 Cal. App. 8 3d 1071, 1079–80 (1983) (discussing statutory scheme for recovering contractual damages from 9 California public entities). That fact distinguishes this case from E.E.O.C. v. Peabody W. Coal 10 Co., in which there was no underlying contract between the absent party and the defendant. 610 11 F.3d at 1082. 12 LinkedIn further argues that because this lawsuit directly implicates a contractual 13 agreement in which the DMV has an interest (the Ads Agreement), the DMV has a claim to “an 14 interest relating to the subject of the action” and its “absence may as a practical matter impair or 15 impede [its] ability to protect the interest.” Fed. R. Civ. P. 19(a)(1)(B). LinkedIn contends that the 16 DMV’s interest is concrete because a finding that LinkedIn is liable would necessarily mean that 17 the DMV breached its contractual obligations under the Ads Agreement. See Dawavendewa v. Salt 18 River Project Agric. Improvement & Power Dist., 276 F.3d 1150, 1157 (9th Cir. 2002) (holding 19 that an absent party was necessary where the “instant litigation threatens to impair [its] contractual 20 interests, and thus, its fundamental economic relationship with” the present party). LinkedIn also 21 argues that a judgment in Jackson’s favor may impair the DMV’s ability to perform its key 22 functions as a state entity, including procuring advertising services. Id. at 1155 (finding that a 23 judgement rendered in [the state’s] absence would impair its “sovereign capacity to negotiate 24 contracts” and undermine the state’s ability to govern effectively). 25 To require joinder under Rule 19, an absent party’s interest must “be more than a financial 26 stake, and more than speculation about a future event.” Iconlab Inc. v. Bausch Health Companies 27 Inc., 2019 WL 12521292, at *4 (C.D. Cal. May 15, 2019); Shermoen v. United States, 982 F.2d 1 standard. Contrary to LinkedIn’s contentions, an adverse ruling would not necessarily require a 2 finding that the DMV breached the Ads Agreement. Dkt. No. 25, at 14. Jackson alleges that 3 LinkedIn unlawfully obtained and used her sensitive disability information in violation of the 4 DPPA and CIPA. Whether the DMV’s collection and transmission of Jackson’s personal 5 information was unlawful or a breach of the Ads Agreement is not before this Court. Rather, 6 Jackson is alleging only that LinkedIn’s receipt and use of that private data violated the DPPA and 7 CIPA. The Court can plausibly find LinkedIn liable without finding any breach by the DMV, 8 meaning that the DMV’s contractual interest would not be impeded by this action. 9 For the same reasons, LinkedIn has not sufficiently demonstrated that the DMV’s absence 10 from this lawsuit would impair its sovereign capacity to negotiate contracts. LinkedIn’s potential 11 liability can be assessed independently from whether the DMV breached the Ads Agreement 12 (which Jackson is not alleging in her complaint), and LinkedIn has not identified any concrete 13 manner in which the DMV’s ability to enter into contracts for advertising or other purposes would 14 be impaired by a holding that third parties like LinkedIn cannot receive and use sensitive 15 information in violation of the DPPA or CIPA. 16 Finally, LinkedIn suggests that the DMV’s absence puts LinkedIn in an untenable position 17 because a ruling for Jackson would prohibit it from receiving personal information from the DMV 18 while the DMV retains ultimate control over its Insight Tag and what information is sent to 19 LinkedIn. But LinkedIn’s argument that it has no control over what information the Insight Tag on 20 the DMV’s website sends to LinkedIn is implausible. After all, the Insight Tag is also known as 21 the LinkedIn Pixel, and LinkedIn has not provided evidence showing that it cannot modify 22 whether and how third-party website data is transmitted to LinkedIn. 23 In arguing that the DMV is a necessary party, LinkedIn relies heavily on Downing v. Globe 24 Direct LLC, 806 F. Supp. 2d 461, 470 (D. Mass. 2011), aff’d on other grounds, 682 F.3d 18, 19 25 (1st Cir. 2012). In Downing, the Massachusetts Registry of Motor Vehicles (RMV) retained an 26 outside vendor to print and mail registration renewal notices to motor vehicle owners on behalf of 27 the state, and the vendor obtained owners’ name and address information from the RMV in order 1 advertisers and insert their advertising into the notices. After plaintiffs sued the vendor for privacy 2 violations, the Court held that the state-run RMV was a necessary party to the lawsuit and 3 dismissed the case on Eleventh Amendment grounds. Id. at 470. 4 Downing is distinguishable from the factual circumstances here. As LinkedIn admits, the 5 RMV in Downing hired the outside vendor to mail registration renewal notices and third-party 6 advertisements “on behalf of the RMV.” Dkt. No. 19, at 14 (emphasis added). All of the vendor’s 7 challenged conduct was undertaken for the RMV under the binding terms of its contract with the 8 RMV. There was therefore no question that the RMV had a contractual interest in both providing 9 the vendor with information from its records and having advertisements included in the notices 10 sent on its behalf. 11 By contrast, LinkedIn has not suggested that the transmission of sensitive disability 12 information from the DMV’s website to LinkedIn was a condition placed upon LinkedIn’s 13 contractual relationship with the DMV by the DMV or was necessary for the DMV to receive the 14 desired services from LinkedIn. Indeed, LinkedIn alleges that the contract instead prohibited such 15 transmissions. These circumstances make this case nothing like Downing. 16 For all of these reasons, the DMV is not a necessary party to this lawsuit under Rule 19. 17 LinkedIn’s Rule 12(b)(7) motion is therefore denied. 18 II. Jackson Fails to Adequately Plead a DPPA Claim. 19 A violation of the DPPA requires that the defendant: (1) knowingly took some affirmative 20 action to obtain, disclose, or use personal information, (2) from a record maintained by the DMV 21 pertaining to a driver’s operating permit, title, registration, or identification card, (3) for an 22 impermissible purpose. See Senne v. Village of Palatine, Illinois, 695 F.3d 597, 603 (7th Cir. 23 2012); Andrews v. Sirius XM Radio Inc., 932 F.3d 1253 (9th Cir. 2019). 24 Jackson fails to adequately plead a claim under the DPPA because she does not sufficiently 25 allege that the information LinkedIn purportedly obtained and used was from a “motor vehicle 26 record.” 18 U.S.C. § 2725(1) (defining motor vehicle record as “any record that pertains to a 27 motor vehicle operator’s permit, motor vehicle title, motor vehicle registration, or identification 1 sensitive information that she inputted when renewing her disability placard on the DMV’s 2 website. This information was purportedly collected via the Insight Tag from the DMV’s 3 webpages and then transmitted to LinkedIn in the form of URLs. But Jackson does not explain 4 how such disability information embedded within URLs qualifies as a motor vehicle record. See 5 Keogh v. Meta Platforms Inc., 680 F. Supp. 3d 601, 609–10 (D.S.C. 2023) (holding that personal 6 information stored on the South Carolina DMV’s public-facing website was not a “record” within 7 the meaning of the DPPA). In Andrews v. Sirius XM Radio Inc., the Ninth Circuit held that a 8 DMV website alone cannot be a motor vehicle record because a record must consist of 9 “information about an individual that is maintained by an agency.” 932 F.3d at 1260. As pleaded, 10 the information transmitted to LinkedIn consisted only of public-facing URLs and the information 11 that Jackson herself entered into the DMV’s website, rather than any information maintained by 12 the DMV in its own records. 13 In contending that the information here was maintained in the DMV’s records, Jackson 14 relies on Gershzon v. Meta Platforms Inc., 2023 WL 5420234 (N.D. Cal. Aug. 22, 2023). In 15 Gershzon, the plaintiff asserted DPPA and CIPA claims under similar factual circumstances 16 involving the Meta Pixel, and the Court denied Meta’s motion to dismiss in part because it found 17 that information transmitted from the DMV to Meta was from a motor vehicle record. Id. at *8. 18 But in Gershzon, the personal information from the plaintiff’s disability placard application was 19 contained within the plaintiff’s “MyDMV” account. By contrast, there are no allegations by 20 Jackson here that her disability information was contained within any such account that might 21 qualify as a motor vehicle record. In contrast to the DMV’s website or specific webpages, a user’s 22 MyDMV account is at least arguably “maintained by an agency” for the purposes of the DPPA. 23 Andrews, 932 F.3d at 1260. 24 In the absence of sufficient factual allegations that Jackson’s disability information was 25 stored within a motor vehicle record, the Court must grant LinkedIn’s motion to dismiss the DPPA 26 claim. See, e.g., Davis v. Meta Platforms, Inc., Case No. 23-01352 (D. Nev. July 3, 2024) (holding 27 that plaintiff failed to plausibly allege that the Nevada DMV’s website is a motor vehicle record); 1 from the New Jersey Motor Vehicle Commission are not records as defined by the DPPA). 2 III. Jackson Adequately Pleads a CIPA Claim. 3 CIPA prohibits both reading or learning the contents of any message, report, or 4 communication in transit over any wire, line, or cable without authorization (“interception”) and 5 using or communicating any information so obtained (“use”). Cal. Pen. Code § 631. A plaintiff 6 who sufficiently alleges either interception or use by the defendant adequately pleads a CIPA 7 violation. Javier v. Assurance IQ, LLC, 649 F. Supp. 3d 891, 900 (N.D. Cal. Jan. 5, 2023). Section 8 631 applies to “new technologies” such as computers, email, and the Internet. See, e.g., Matera v. 9 Google Inc., 2016 WL 8200619, at *20 (N.D. Cal. Aug. 12, 2016). 10 LinkedIn argues that Section 631 applies “only to eavesdropping by a third-party and not 11 to recording by a participant to a conversation.” In re Facebook, Inc. Internet Tracking Litig., 956 12 F.3d 589, 607 (9th Cir. 2020) (citing Warden v. Kahn, 99 Cal. App. 3d 805, 811 (1979)). LinkedIn 13 contends that the Insight Tag was not used to eavesdrop, but was instead used by the DMV itself 14 to “record” its website interactions with Jackson. In LinkedIn’s view, it was merely the third-party 15 vendor of a recording service that “that capture[d the DMV’s] data … and allow[ed] the [DMV] to 16 analyze their data.” Graham v. Noom, 533 F. Supp. 3d 832, 832 (N.D. Cal. 2021). 17 LinkedIn’s argument fails because Jackson alleges not only that the DMV collected her 18 personal information using the Insight Tag, but also that LinkedIn received this sensitive data and 19 read and used it for its own marketing services. Her complaint contains a plethora of allegations 20 that LinkedIn read and used the data it acquired from the DMV for its own marketing services. 21 See, e.g., Dkt. No. 1, at 11 (“LinkedIn’s Marketing Services monetizes the collected data through 22 the sale of [ads].”); id. at 23 (“LinkedIn is also learning the contents of communications between 23 website users and the DMV. This enables advertisers to target users with relevant content or 24 advertisement[s] using the personal information and data that LinkedIn harvested.”). This 25 purported acquisition and review of the disability information by LinkedIn for advertising 26 purposes qualifies as interception under CIPA. In re Meta Pixel Healthcare Litig., 647 F. Supp. 3d 27 778, 795 (N.D. Cal. 2022) (noting that “the Ninth Circuit has construed the term [intercept] 1 Smith v. Google, LLC, 2024 WL 2808270 (N.D. Cal. June 3, 2024), is instructive. In that 2 case, the Court found that “[w]hether or not a third-party service incapable of using the data it 3 collects might avoid liability under Section 631, the complaint alleges that Google does read and 4 use Google Analytics data.” Id. at *4. The Court held that “[p]laintiffs’ allegations, which must be 5 taken as true, suggest that Google is not simply a vendor of a tool that websites can use to ‘record’ 6 their own users’ interactions on their websites, but rather that Google read or used the data 7 collected about these users.” Id. With analogous allegations here about LinkedIn’s receipt and 8 potential use of Jackson’s information for advertising purposes, Jackson plausibly alleges that 9 LinkedIn was a third-party eavesdropper who intercepted her communications with the DMV. 10 LinkedIn separately argues that even if Jackson adequately pleads that LinkedIn “read” her 11 personal information, she fails to allege that LinkedIn “used” this data in any way. As LinkedIn 12 notes, Jackson provides numerous generalized allegations about LinkedIn’s marketing services 13 and its Insight Tag, but does not specify what personal information of hers was sent from the 14 DMV to LinkedIn via the Insight Tag or explain how LinkedIn used this particular information for 15 its marketing services. See, e.g., Dkt. No. 1, at 7 (“The personal information and communications 16 obtained by LinkedIn are used to fuel various services offered via LinkedIn’s Marketing Solutions 17 including Ad Targeting, Lookalike Targeting, Audience Expansion, Matched Audiences, LinkedIn 18 Audience Network, and Meet the LinkedIn Member.”); id. at 11 (“LinkedIn feeds the vast 19 quantities of personal data obtained from the LinkedIn Pixel into its Marketing Solutions 20 advertising systems to identify, characterize, and categorize users’ for targeted advertising 21 purposes.”). Jackson does not allege, for example, that she received a targeted advertisement 22 related to her disability status. 23 In the absence of such facts, Jackson’s allegations may very well be insufficient to 24 plausibly suggest LinkedIn’s use of the disability information transmitted to it by the DMV’s 25 website. But Jackson’s factual allegations regarding the manner in which the Insight Tag operates 26 are sufficient to plausibly allege that LinkedIn at least “read” or “learned” the information so 27 transmitted. Because that is sufficient to state a claim under Section 631, LinkedIn’s motion to 1 CONCLUSION 2 For the foregoing reasons, the Court denies LinkedIn’s Rule 12(b)(7) motion and denies its 3 Rule 12(b)(6) motion to dismiss the CIPA claim but grants with leave to amend LinkedIn’s Rule 4 12(b)(6) motion to dismiss the DPPA claim. If she so chooses, Jackson must submit an amended 5 |} complaint within 21 days of this order. 6 7 IT IS SO ORDERED. 8 Dated: August 13, 2024 A bem~ 10 P. Casey Fitts I United States District Judge 12

15 16

= 17

Z 18 19 20 21 22 23 24 25 26 27 28