Jackson v. LinkedIn Corporation

Opinion

JACQUELINE JACKSON, Case No. 5:24-cv-00812-PCP

Plaintiff, ORDER GRANTING MOTION TO v. DISMISS

LINKEDIN CORPORATION, Re: Dkt. No. 60 Defendant.

Plaintiff Jacqueline Jackson brings this putative class action against defendant LinkedIn Corporation, alleging that LinkedIn used its Insight Tag to unlawfully obtain and use personal information from LinkedIn users visiting the California Department of Motor Vehicles website. LinkedIn moves to dismiss Jackson’s claim under the federal Drivers’ Privacy Protection Act (DPPA) for failure to state a claim, and argues that, if the Court dismisses that claim, it should decline to exercise supplemental jurisdiction over her state law claims. For the following reasons, the Court grants LinkedIn’s motion to dismiss the DPPA claim with prejudice and orders the parties to show cause why Jackson’s state law claims should or should not be dismissed without prejudice in the absence of any remaining federal question. Jackson is a California resident who has been a registered LinkedIn user for at least 10 years.1 Jackson has an online account with the DMV, called a “MyDMV” account. Jackson submitted personal information, including her name, phone number, and email address, to the DMV in order to create her MyDMV account. Jackson has had a disability parking placard issued by the DMV since approximately 2009. In 2023, Jackson used her mobile phone to renew her placard through the DMV’s website, which required that she provide her first and last name, date of birth, disability information, and email address. She was signed into her MyDMV account throughout the process of renewing her placard. She alleges that in January 2024, she discovered that LinkedIn was using its Insight Tag to obtain her personal information from her MyDMV account and to learn the contents of her communications with the DMV in connection with her placard renewal. LinkedIn’s Insight Tag is used to gather information across websites to support marketing services that LinkedIn offers to its customers, including targeted advertising. Customers like the DMV can install the Insight Tag on their own webpages to track a user’s actions on their website. Jackson alleges that personal information and private communications are transmitted to LinkedIn, incorporated into the user’s LinkedIn profile, and employed for targeted advertising. Jackson alleges that LinkedIn used the information it received from the DMV “to generate substantial revenue from advertising and marketing services.” In her original complaint, Jackson alleged that LinkedIn’s conduct violates the DPPA and the California Invasion of Privacy Act (CIPA), Cal. Pen. Code § 630. LinkedIn moved to dismiss the case, arguing under Rule 12(b)(7) that the complaint failed to join the DMV as a necessary party and under Rule 12(b)(6) that Jackson failed to state a valid claim. On August 13, 2024, the Court granted LinkedIn’s motion to dismiss in part. The Court denied the 12(b)(7) motion and denied the 12(b)(6) motion as to the CIPA claim but granted it as to the DPPA claim. The Court concluded that Jackson had failed to plausibly allege that the personal information LinkedIn purportedly obtained through the Insight Tag came from a motor vehicle record. On September 3, 2024, Jackson filed a first amended complaint asserting the same claims. Federal Rule of Civil Procedure 8(a)(2) requires a complaint to include a “short and plain statement of the claim showing that the pleader is entitled to relief.” If the complaint does not do so, the defendant may move to dismiss the complaint under Federal Rule of Civil Procedure reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). “Dismissal under Rule 12(b)(6) is appropriate only where the complaint lacks a cognizable legal theory or sufficient facts to support a cognizable legal theory.” Mendiondo v. Centinela Hosp. Med. Ctr., 521 F.3d 1097, 1104 (9th Cir. 2008). To survive a Rule 12(b)(6) motion, a plaintiff need only plead “enough facts to state a claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). In considering a Rule 12(b)(6) motion, the Court must “accept all factual allegations in the complaint as true and construe the pleadings in the light most favorable” to the non-moving party. Rowe v. Educ. Credit Mgmt. Corp., 559 F.3d 1028, 1029–30 (9th Cir. 2009). While legal conclusions “can provide the [complaint’s] framework,” the Court will not assume they are correct unless adequately “supported by factual allegations.” Iqbal, 556 U.S. at 679. Courts do not “accept as true allegations that are merely conclusory, unwarranted deductions of fact, or unreasonable inferences.” In re Gilead Scis. Secs. Litig., 536 F.3d 1049, 1055 (9th Cir. 2008) (quoting Sprewell v. Golden State Warriors, 266 F.3d 979, 988 (9th Cir. 2001)). I. Jackson fails to state a claim under the DPPA. To establish a potential violation of the DPPA, a plaintiff must plausibly allege that the defendant: (1) knowingly took some affirmative action to obtain, disclose, or use personal information (2) from a motor vehicle record (3) for an impermissible purpose. 18 U.S.C. § 2721; Andrews v. Sirius XM Radio Inc., 932 F.3d 1253, 1259 (9th Cir. 2019). Personal information is information that “identifies an individual, including an individual’s photograph, social security number, driver identification number, name, address (but not the 5-digit zip code), telephone number, and medical or disability information.” 18 U.S.C. § 2725(3). A motor vehicle record is a record maintained by the DMV pertaining to a driver’s operating permit, title, registration, or identification card. 18 U.S.C. § 2725(1). Accordingly, in order to state a DPPA claim, Jackson must allege that the information transmitted to LinkedIn via the Insight Tag was personal information, as defined by 18 U.S.C. § Insight Tag transmitted personal information to LinkedIn, she does not allege facts sufficient to show that the information came from a motor vehicle record. A. Personal information Much of the information that the Insight Tag purportedly transmits from the California DMV website to LinkedIn is not personal information within the meaning of 18 U.S.C. § 2725(3). Jackson alleges the Insight Tag transmits URLs, the fact that a particular button has been clicked, and browser cookies that match website user interactions with LinkedIn members. Most URLs and buttons do not contain personal information, which is defined as information that identifies an individual. Jackson alleges, for example, that when a MyDMV user changes their phone number, the Insight Tag transmits to LinkedIn the fact that a “Change Phone Number” button has been clicked and that the user has visited the URL “https://www.dmv.ca.gov/portal/update-your-phone- number/.” Neither of those pieces of information is personal information because neither identifies the user. Nevertheless, some of the information that the Insight Tag allegedly transmits does fall within the definition of personal information under 18 U.S.C. § 2725(3). Jackson alleges that when she renewed her disability parking placard, the Insight Tag transmitted the full text of a URL revealing that she was going through the placard renewal process (thus disclosing her disability). Disability information is expressly defined as personal information under 18 U.S.C. § 2725(3). Likewise, Jackson alleges that the Insight Tag transmitted her email address to LinkedIn, and “email addresses fall within the ordinary meaning of information that identifies an individual because they can prove or establish the identity of an individual and … often expressly include the account holder’s name, affiliated organization, or other identifying information.” Gershzon v. Meta Platforms, Inc., No. 23-CV-00083-SI, 2023 WL 5420234 at *5 (N.D. Cal. Aug. 22, 2023) (cleaned up) (quoting United States v. Hastie, 854 F.3d 1298, 1303 (11th Cir. 2017)). Accordingly, Jackson has adequately alleged that the Insight Tag transmitted her personal information to LinkedIn. B. From a motor vehicle record LinkedIn via the Insight Tag, she has not adequately alleged that this personal information came from a motor vehicle record. Nearly all of the personal information that Jackson alleges was transmitted to LinkedIn came from Jackson herself, and, as the Court held in its prior order granting in part LinkedIn’s motion to dismiss, information that Jackson herself entered into the DMV’s website is not a motor vehicle record. While the personal information that was purportedly transmitted may have been identical to information contained in a motor vehicle record, it did not come from that motor vehicle record. “[W]here, as here, the initial source of personal information is a record in the possession of an individual, rather than a state DMV, then use or disclosure of that information does not violate the DPPA.” Andrews, 932 F.3d at 1260. Andrews is illustrative. In that case, Sirius XM Radio obtained the plaintiff’s name and address from a car dealer, who obtained that information from the plaintiff’s driver’s license. The Court held that a driver’s license is not a motor vehicle record within the meaning of the DPPA because “though issued by the DMV, [it] becomes the possession of an individual, not the DMV that issued it.” Id. The Court concluded that obtaining information that is also contained in a motor vehicle record from an independent source does not violate the DPPA. As the court explained, construing the scope of the DPPA as limited to information taken directly from a motor vehicle record is consistent with the statute’s purpose to prevent DMVs from releasing and selling drivers’ personal information. Id. at 1259–61. Jackson alleges that, in order to apply for a disability parking placard on the DMV website, an individual must click a “Start Application” button, which takes them to a webpage containing forms they must complete. She alleges that the URL of this webpage, which contains the text “dpp-application-form,” is transmitted to LinkedIn by the Insight Tag. Jackson alleges that “similar information” was transmitted when she renewed her placard. While the text “dpp- application-form” indicates that an individual is seeking to obtain a disability parking placard, and thus constitutes disability information (which is personal information under 18 U.S.C. § 2725(3)), the URL allegedly transmitted when Jackson renewed her placard came from Jackson’s interactions with the DMV website, not a DMV motor vehicle record. confirmation email from the DMV containing a “status checker” button. When an applicant clicks that button, they are allegedly prompted to enter their email address and case number.2 They are then allegedly redirected to a DMV webpage, and a URL containing their email address is transmitted to LinkedIn. Once again, however, the email address in that URL is generated through the applicant’s interactions with the webpage and the information they enter themselves. Just as Andrews held that obtaining personal information from a driver’s license that was also stored in the DMV’s records did not constitute obtaining information from a motor vehicle record, obtaining information that Jackson herself entered on the DMV website does not constitute obtaining information from a motor vehicle record, whether or not that information also “exist[s] in the DMV’s database,” as Jackson puts it. The only personal information allegedly transmitted via the Insight Tag that came from the DMV itself rather than from Jackson and her interactions with the DMV website was her first name, which appeared on a button on the DMV website after she created and logged into her MyDMV account.3 Jackson alleges that after an individual creates a MyDMV account, the DMV uses their first name, as listed in a DMV database, on the button used to access the MyDMV portal. When a MyDMV user clicks that button, their first name is allegedly transmitted to LinkedIn. 2 Although Jackson alleges generally that placard applicants receive confirmation emails containing “status checker” buttons, she does not allege that she ever received such an email or clicked the button. 3 LinkedIn argues that a first name is not personal information for purposes of the DPPA even though the statute defines personal information to include a “name” and a first name is undoubtedly a “name.” While the Court need not resolve this question definitively given its holding that Jackson has not alleged that LinkedIn received her first name from a motor vehicle record, the Court notes that multiple other courts have held that similarly nonspecific information, such as height, weight, hair color, and eye color, falls within the definition of personal information under 18 U.S.C. § 2725(3). See Gershzon, 2023 WL 5420234, at *6; Dahlstrom v. Sun-Times Media, LLC, 777 F.3d 937 (7th Cir. 2015). Medical and disability information are also expressly covered by the DPPA even though they are not particularly specific. As the court explained in Gershzon, an expansive reading of “personal information” serves the public safety purpose of the DPPA because “although a potential stalker would likely require information beyond hair and eye color to positively identify his victims, details regarding any pertinent physical feature would make such identification easier.” 2023 WL 5420234, at *6; see also United States v. Hastie, 854 F.3d 1298, 1304 (11th Cir. 2017) (“The term ‘personal information’ should be read naturally to This Court previously explained that information on a public-facing DMV website cannot be a motor vehicle record because a record consists of “information about an individual that is maintained by an agency,” but it noted that a MyDMV account is at least arguably maintained by an agency for the purposes of the DPPA. But while maintenance by an agency is a necessary condition for any DPPA claim, it is not sufficient because not all information maintained by an agency falls within the definition of motor vehicle record. For the purposes of the DPPA, motor vehicle records include only records pertaining to a driver’s operating permit, title, registration, or identification card. 18 U.S.C. § 2725(1). It is certainly possible that records within a user’s MyDMV account might fall within this definition.4 Jackson, however, has not adequately alleged that her first name, as maintained by the DMV in connection with her MyDMV account, specifically pertains to a driver’s operating permit, title, registration, or identification card. To the contrary, Jackson alleges that she provided her first name to the DMV in order to establish that account and access the MyDMV portal. Notably, any internet user with an email address and phone number can create a MyDMV account, whether or not they ever intend to apply for an operating permit, title, registration, or identification card.5 Jackson’s first name as displayed on the button on the DMV website came from a record maintained by the DMV for the purposes of allowing website access, not in relation to any license, placard, or vehicle title it issued to her. Jackson notes that the DMV “advises individuals to ‘use the name that will appear on your driver’s license or identification card’” when they create their MyDMV account. As a result, the first name on the button associated with their account is likely to be the same as the first name on 4 If the MyDMV portal displayed information taken directly from the DMV’s database of licensed drivers or vehicle titles, for example, that information might be obtained “from a motor vehicle record” for DPPA purposes. 5 The Court takes judicial notice of the existence and contents of the California DMV website and the MyDMV registration process. See Am. Fed’n of Tchrs. v. DeVos, 484 F. Supp. 3d 731, 739 (N.D. Cal. 2020); Fed. R. Evid. 201 (permitting judicial notice of “a fact that is not subject to reasonable dispute” because the fact is “generally known” or “can be accurately and readily determined from sources whose accuracy cannot reasonably be questioned”). their driver’s license or identification card. But, as explained above, information that is merely the same as information contained within a motor vehicle record is not information that comes from a motor vehicle record for DPPA purposes. The DPPA applies only where a defendant has obtained personal information from a motor vehicle record, and Jackson again fails to allege that any personal information transmitted to LinkedIn via the Insight Tag—whether from her MyDMV account or otherwise—was obtained from such a record. Accordingly, the Court grants LinkedIn’s motion to dismiss Jackson’s amended DPPA claim. Because Jackson has already had an opportunity to amend her complaint to address this deficiency but has failed to do so, the Court’s dismissal of that claim is with prejudice and without leave to amend. II. The parties are ordered to show cause why the Court has or does not have CAFA jurisdiction over Jackson’s CIPA claim. LinkedIn argues that, if Jackson’s federal claim is dismissed, the Court should decline to exercise supplemental jurisdiction over her remaining state law claim under the California Invasion of Privacy Act. Jackson, however, contends both that the Court should exercise its supplemental jurisdiction notwithstanding the absence of a federal claim and that this Court has jurisdiction over her CIPA claim under the Class Action Fairness Act (CAFA), 28 U.S.C. § 1332(d)(2). There is no question that this Court initially had federal question jurisdiction over this lawsuit under 28 U.S.C. § 1331 because Jackson was pursuing a claim under a federal statute. Without the DPPA claim, only her state law CIPA claim remains. The Court nonetheless retains supplemental jurisdiction over her state law claim under 28 U.S.C. § 1367(a) because the “state and federal claims … derive from a common nucleus of operative fact.” See Gibbs, 383 U.S. at 725. Whether to exercise that jurisdiction is a discretionary matter. Satey v. JPMorgan Chase & Co., 521 F.3d 1087, 1091 (9th Cir. 2008); 28 U.S.C. § 1367(c)(3) (“The district courts may decline to exercise supplemental jurisdiction over a claim … if … the district court has dismissed all claims over which it has original jurisdiction.”). stage of the litigation, the values of judicial economy, convenience, fairness, and comity.’” Lenk v. Monolithic Power Sys., Inc., 2017 WL 4586832, at *2 (N.D. Cal. June 1, 2017) (quoting Gibbs, 383 U.S. at 726). The stage of the litigation is a central consideration in weighing these values. “[J]udicial economy and convenience … weigh less heavily early in a case.” Gastelum v. TJX Companies, Inc., No. 21-CV-06714-VKD, 2023 WL 2224432, at *2 (N.D. Cal. Feb. 24, 2023). “[A] district court should generally decline the exercise of supplemental jurisdiction and dismiss a case without prejudice when ‘the federal-law claims have dropped out of the lawsuit in its early stages and only state law claims remain.’” Lenk, 2017 WL 4586832, at *2 (quoting Carnegie- Mellon Univ. v. Cohill, 484 U.S. 343, 348 (1988)); see also Wren v. Sletten Constr. Co., 654 F.2d 529, 536 (9th Cir. 1981) (“When … all federal claims are dismissed before trial, the proper exercise of discretion requires dismissal of the state claim.”). Here, the case remains in its early stages. Although the parties have engaged in some discovery, the case has not proceeded past the pleadings and it is still nearly two years away from trial.6 It would not be especially burdensome for a state court to familiarize itself with the facts here. Thus, while judicial economy and convenience slightly disfavor dismissal simply because these proceedings are already underway, these two factors carry minimal weight. Fairness considerations weigh neither in favor of nor against dismissal. Both Jackson and LinkedIn are California residents equally able to litigate in state or federal court, and Jackson has not identified any prejudice that would result from having to refile her claims in state court. While fairness is neutral and judicial economy and convenience only very slightly favor exercising supplemental jurisdiction, comity concerns strongly weigh against doing so. Declining to exercise this Court’s supplemental jurisdiction would allow the California state courts to interpret and apply state law and to resolve a novel state law claim involving a class likely composed primarily of Californians. In defining the limits of this Court’s diversity jurisdiction, Congress demonstrated its intent for such claims to be pursued in state rather than federal court in

6 At the hearing on LinkedIn’s motion, LinkedIn suggested a willingness to allow the discovery most instances, and this Court generally must respect that judgment. Because these comity concerns strongly outweigh any of the other relevant factors, it would be inappropriate for this Court to exercise supplemental jurisdiction over Jackson’s CIPA claim in the absence of some other basis for jurisdiction. Jackson contends that the Class Action Fairness Act (CAFA), 28 U.S.C. § 1332(d)(2), provides that alternative basis. CAFA provides that district courts have diversity jurisdiction over class actions where the class has at least 100 class members, at least one plaintiff is a citizen of a different state from at least one defendant, and the amount in controversy is greater than $5,000,000. In her amended complaint, Jackson specifically alleges that at least one class member is a citizen of a state where LinkedIn is not a citizen, that the class includes more than 100 members, and that the amount in controversy exceeds $5,000,000. Although Jackson has pleaded the existence of CAFA jurisdiction, the Court has serious concerns that CAFA’s “home state” exception precludes this Court from exercising CAFA jurisdiction over Jackson’s CIPA claim. The home state exception provides that “a district court shall decline to exercise jurisdiction … over a class action in which … greater than two thirds of the members of all proposed plaintiff classes in the aggregate are citizens of the State in which the action was originally filed.” 28 U.S.C. § 1332(d)(4). In this case, the putative class is defined as LinkedIn members who applied for, renewed, or checked the status of a California disability parking placard on the California DMV website. Under these circumstances, it seems likely that the class is composed overwhelmingly of California citizens. Even if some putative class members were never California citizens and some have the left the state and are no longer California citizens, it seems unlikely that those individuals constitute over one third of the class. Unfortunately, the existing evidentiary record is inadequate for the Court to make a final determination as to whether the home state exception applies to Jackson’s CIPA claim. Because this presents a threshold issue that should be resolved as early as possible in the litigation, the Court orders the parties to file, within 21 days, supplemental briefs of no more than 10 pages, along with any supporting evidence, addressing whether CAFA’s “home state” exception applies 2 For the foregoing reasons, the Court grants LinkedIn’s motion to dismiss Jackson’s DPPA 3 claim. That claim is dismissed with prejudice and without leave to amend. The parties shall file 4 supplemental briefs and supporting evidence regarding CAFA’s home state exception within 21 5 days of this Order. 6 8 Dated: January 3, 2025 Ay 10 P. Casey Fitts I United States District Judge 12

Z 18 19 20 21 22 23 24 25 26 27 28