Jones v. Peloton Interactive, Inc.

Opinion

JULIE JONES, et al., Case No.: 23-cv-1082-L-BGS

Plaintiff, ORDER DENYING DEFENDANT’S v. MOTION TO DISMISS THE FIRST AMENDED COMPLAINT [ECF NO. 20.] Defendant.

Pending before the Court in this putative class action asserting violations of California privacy laws is Defendant Peloton’s Motion to Dismiss the First Amended Complaint. [ECF No. 20.] The Court decides the matter on the papers submitted and without oral argument. See Civ. L. R. 7.1(d.1). For the reasons stated below, the Court denies the Motion to Dismiss. I. FACTUAL BACKGROUND1 Plaintiff brings this putative class action against Peloton as the owner and operator of the website https://www.onepeloton.com (“Website”) for violations of the California Invasion of Privacy Act, Cal. Penal Code § 631(a), Clause Four. (First Amended Complaint “FAC” at 11). Plaintiff’s claim arises from Defendant’s use of the third-party software called Drift which was embedded into the Website chat feature. Chat communications with the Website are automatically intercepted and recorded by Drift which creates transcripts of the conversations. Drift receives the communications while they are in transit because the imbedded code routes the communications directly to Drift. Website users are not informed that Drift is intercepting the communications but instead consumers believe they are interacting only with a Peloton representative. Drift allegedly harvests data from the chat transcripts it intercepts, and then interprets, analyzes, stores, and uses the data for a variety purposes. Information collected includes the full transcript of the conversation, the date and time the conversation began, the IP address of the visitor, the web browser they used to access the Website, the device used and which words triggered the Drift software to route the visitor to a particular Peloton representative. According to Plaintiff, visitors to the Website often share personal information on the chat due to the nature of Peloton’s business. Plaintiff and other class members visited the Website within the class period using smart phones, and/or wifi- enabled tablets and laptops. On June 9, 2023, Plaintiff filed a Complaint asserting violations of CIPA, the UCL and California Constitution in relation to the unauthorized interception, collection, recording, and dissemination of Plaintiff’s and Class Members’ communications and data. [ECF No. 1.] On August 16, 2023, Defendant a motion to dismiss which the Court granted on March 12, 2024. [ECF No. 18.] Plaintiff filed a First Amended Complaint containing a single CIPA Section 631(a) claim on March 15, 2024. [ECF No. 19.] On March 29, 2024, Defendant filed the present Motion to Dismiss the First Amended Complaint. [ECF No. 20.] On April 15, 2024, Plaintiff filed a response in Opposition. [ECF No. 21.] On April 22, 2024, Defendant filed a Reply. [ECF No. 22.] // // Defendant seeks dismissal of this action pursuant to Federal Rule of Civil Procedure 12(b)(6) for failure to state a claim. A. Failure to State a Claim A 12(b)(6) motion to dismiss tests the sufficiency of the complaint. Navarro v. Block, 250 F.3d 729, 732 (9th Cir. 2001). A pleading must contain, in part, “a short and plain statement of the claim showing that the pleader is entitled to relief.” Fed. R. Civ. P. 8(a)(2). But plaintiffs must also plead “enough facts to state a claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007); see also Fed. R. Civ. P. 12(b)(6). The plausibility standard demands more than “a formulaic recitation of the elements of a cause of action,” or “‘naked assertions’ devoid of ‘further factual enhancement.’” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Twombly, 550 U.S. at 557). Instead, the complaint “must contain allegations of underlying facts sufficient to give fair notice and to enable the opposing party to defend itself effectively.” Starr v. Baca, 652 F.3d 1202, 1216 (9th Cir. 2011). In reviewing a 12(b)(6) motion to dismiss, “[a]ll allegations of material fact are taken as true and construed in the light most favorable to the nonmoving party.” Cahill v. Liberty Mut. Ins. Co., 80 F.3d 336, 337–38 (9th Cir. 1996). However, a court need not take legal conclusions as true merely because they are cast in the form of factual allegations. See Roberts v. Corrothers, 812 F.2d 1173, 1177 (9th Cir. 1987). Similarly, “conclusory allegations of law and unwarranted inferences are not sufficient to defeat a motion to dismiss.” Pareto v. FDIC, 139 F.3d 696, 699 (9th Cir. 1998). 1. Violation of the California Invasion of Privacy Act, Cal Penal Code § 631 Section 631(a) of the California Penal Code imposes civil and criminal liability on “any person who by means of any machine, instrument, or contrivance, or in any other manner: [1] intentionally taps, or makes any unauthorized connection, whether physically, electrically, acoustically, inductively, or otherwise, with any telegraph or telephone wire, line, cable, or instrument, including the wire, line, cable, or instrument of any internal telephonic communication system, or [2] who willfully and without the consent of all parties to the communication, or in any unauthorized manner, reads, or attempts to read, or to learn the contents or meaning of any message, report, or communication while the same is in transit or passing over any wire, line, or cable, or is being sent from, or received at any place within this state; or [3] who uses, or attempts to use, in any manner, or for any purpose, or to communicate in any way, any information so obtained, or [4] who aids, agrees with, employs, or conspires with any person or persons to unlawfully do, or permit, or cause to be done any of the acts or things mentioned above in this section[.] Cal. Penal Code § 631(a)(subsections added and formatted for clarity). The California Supreme Court has explained that Section 631(a) consists of three main clauses which cover “three distinct and mutually independent patterns of conduct”: (1) “intentional wiretapping,” (2) “willfully attempting to learn the contents or meaning of a communication in transit over a wire,” and (3) “attempting to use or communicate information obtained as a result of engaging in either of the two previous activities.” Tavernetti v. Superior Court, 22 Cal. 3d 187, 192 (1978). The fourth basis for liability in Section 631(a) imposes liability for aiding and abetting on any person or persons who “unlawfully do, or permit, or cause to be done any of the’ other three bases for liability.” Mastel v. Miniclip SA, 549 F.Supp.3d 1129, 1134 (E.D. Cal. 2021)(quoting Cal. Penal Code § 631(a)). In the FAC, Plaintiff alleges that Peloton “aids and abets Drift to commit both unlawful interception [Clause Two] and unlawful use [Clause Three] under Section 631(a), surreptitiously and as a matter of course.” (FAC ¶ 41). Plaintiff makes no allegations regarding Clause One. // // a. Section 631(a) Clause Two- Unlawful Interception To establish liability under the second clause of section 631(a), Plaintiff must allege that Drift “willfully and without the consent of all parties to the communication, or in any unauthorized manner, reads, or attempts to read, or to learn the contents or meaning of any message.” Cal. Penal Code § 631(a). “[C]ourts have applied Section 631(a) via the language of its second clause to the internet browsing context.” Williams v. What If Holdings, 2022 WL 17869275, at *2 (N.D. Cal. 2022). Under this clause, a person is liable if he or she secretly listens to another's conversation. Ribas v. Clark, 38 Cal. 3d 355, 359 (1985). Only a third party can “eavesdrop” on a conversation, therefore a party to the communication is exempt from liability under section 631. See In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 607 (9th Cir. 2020); Warden v. Kahn, 99 Cal.App.3d 805, 811 (Ct. App. 1979). There is no definition for the term “party” in CIPA, therefore, courts have looked to the technical processes and context of the interception when considering who qualifies as a third-party eavesdropper. Facebook, 956 F.3d at 607. Defendant argues that the party exemption applies because Plaintiff’s factual allegations establish that Drift provides a tool that allows Peloton to record and analyze its own data in aid of its business which means it functions as an extension of Peloton rather than as a third-party eavesdropper. (Mot. at 9). According to Peloton, Plaintiff’s claim that Drift is a third-party because it uses the intercepted data to improve its AI chatbot is insufficient to show that the data is aggregated, re-distributed or sold to other vendors as required to be considered a third-party eavesdropper. (Id. at 7-8). In addition, Plaintiff did not specifically allege that she interacted with Drift’s AI chat feature when she allegedly visited the Website, but instead it appears her communications were intercepted by a traditional “rule-based” chatbot. (Id. at 8-9). In response, Plaintiff argues that Drift functions as a third-party eavesdropper because it uses the intercepted data for its own purposes including to improve the technological function and capabilities of its patented AI software assets for the exclusive purpose of increasing the value of Drift’s shareholders equity in the company. (Oppo. at 4). According to Plaintiff, these uses go “beyond simply supplying this information back to Defendant,” making Drift a third-party. (Id. at 5). Plaintiff argues it is immaterial whether Plaintiff alleged she used the AI chatbot because the FAC alleges that Drift uses all chat conversations, not just those intercepted from the AI chatbots, to improve its SaaS platform. (Id.) To answer the question whether a service provider like Drift is more akin to a party or a third-party eavesdropper for purposes of the party exception, courts look to the “technical context of the case.” Facebook, 956 F.3d at 607. Two lines of district court cases have emerged in California addressing whether the party exemption can apply to software providers. See Javier v. Assurance, 649 F.Supp.3d 891, 899-901 (N.D. Cal. 2023) (discussing two lines of cases). In the first line of cases, a software provider can be held liable under the second prong of section 631(a) if that entity listens in on a conversation between the participants, even if one of the participants consents to the additional party’s presence, and the entity uses the collected data for its own commercial purposes. Ribas, 38 Cal. 3d at 361-62. For instance, an independent party that captures data from a hosting website to sell to advertisers to generate revenue has been considered an eavesdropper. Facebook, 956 F.3d at 607-608 (Facebook used embedded software to track its users to third-party websites even when its users were not signed into Facebook, and then sold that data to advertisers); see also Revitch v. New Moosejaw, 2019 WL 5485330, *2 (N.D. Cal. 2019) (marketing company and data broker NaviStone operated as a third party because they used intercepted data to “create marketing databases of identified website visitors” and sold the information.) In the second line of cases, if the software provider merely collects, refines, and relays the information obtained on the company website back to the company “in aid of [defendant’s] business” then it functions as a tool and not as a third-party. Graham v. Noom, 533 F.Supp.3d 831, 832-833 (N.D. Cal. Apr. 8, 2021) (tracking service provider was a participant in the conversation under § 631(a) because that defendant only stored user’s data and did not use or resell that data). Some district courts have cautioned against considering the use a technical partner makes of the data, finding that doing so reads a use requirement into the second clause and usurps the use inquiry that is contained in the third clause. Javier, 649 F.Supp.3d at 900 (“reading a use requirement into the second prong would add requirements that are not present (and swallow the third prong in the process)).” However, the inquiry focuses on the technical processes by which the data is gathered and manipulated, a question which is often intertwined with the use of that data. Noom, 533 F.Supp.3d at 832. Therefore, the Court considers the technical aspect along with the use made by Drift of the surreptitiously gathered information. In the FAC, Plaintiff describes the technical manner in which Drift accesses customer’s information and explains: Chat communications on the Website are intercepted by Drift while those communications are in transit, and this is accomplished because the imbedded code directs those communications to be routed directly to Drift. Drift’s chat service is an Application Programming Interface (API) that is “plugged into” the Website. The chat function is run from Drift’s servers but allows for chat functionality on the Website. In other words, Drift runs the chat service from its own servers, but consumers interact with the chat service on Defendant’s Website, so it appears they are only communicating with a company representative of Defendant. (FAC ¶ 13). After accessing customers’ communications in this manner, . . . Drift analyzes and uses the chat conversations it intercepts and records to, inter alia, improve its SaaS platform, including proprietary machine learning for its chatbots and related technologies, all of which independently benefits and serves the profit-driven equity interests of Drift’s shareholders. In other words, Drift uses the content of the conversations that Plaintiff and Class Members have with Defendant—without Plaintiff’s or Class Members’ consent—to improve the technological function and capabilities of its proprietary, patented artificial intelligence software assets for the exclusive purpose and benefit of increasing the value of Drift shareholders’ equity in the company and its technologies. (FAC. ¶ 17)(emphasis in original). The FAC alleges, “Drift’s exploitation, modernization, use of, and interaction with the data it gathers through the chat feature in real time makes it more than a mere ‘extension’ of Defendant.” (FAC ¶ 19). Taking these allegations as true for purposes of the present motion, the Court finds Plaintiff has sufficiently alleged that Drift’s software surreptitiously intercepts the data entered by Peloton’s customers through the embedded API and uses “the data for their own benefit and not for the sole benefit of the party to the communication [Peloton],” therefore Drift functions as a third-party eavesdropper within the meaning of section 631(a). Javier, 649 F.Supp.3d at 899; Esparza v. UAG Escondido AI Inc., 2024 WL 559241, at *7 (S.D. Cal. 2024) (allegations that a chat service provider “profit[s] from secretly exploiting” the ability to identify individuals who visited Defendant's website led to a plausible inference that the chat service provider is using the information for its own purposes.) For these reasons, the Court finds that the party exemption does not apply and Plaintiff has sufficiently stated a claim under clause two of § 631(a). Accordingly, Defendant’s motion to dismiss is denied on this ground. (b) Section 631(a) Clause Three “Use” Claim and Clause Four “Aiding and Abetting” Maintaining a claim under the third clause of § 631 requires “attempting to use or communicate information obtained as a result of engaging in either of the two previous activities” i.e. intentional wiretapping (clause one) or willfully attempting to learn the contents of a communication in transit over a wire (clause two). Tavernetti, 22 Cal. 3d at 192. As noted above, Plaintiff has sufficiently alleged a claim under clause two because she asserts that Drift uses intercepted communications to improve its SaaS platform, including its proprietary machine learning software, which yields a monetary benefit to Drift. In response, Defendant argues only that Plaintiff fails to state claim for clause one or two, therefore her claim under clause three also fails. Plaintiff has stated a claim under clause three of Section 631 because she has maintained a claim under clause two. Cahill, 80 F.3d at 337-38 (9th Cir. 1996). For the same reasons, Plaintiff asserts a plausible claim for relief under clause four for aiding and abetting. Cal Penal Code § 631(a). In light of the above, Defendant’s motion to dismiss is denied as to these claims. A. Injunctive Relief Plaintiff has chosen to withdraw her claim for injunctive relief (Oppo. at 13), therefore, the Court dismisses the injunctive relief claim with prejudice. Hipschman v. Cnty. Of San Diego, No. 22-CV-00903, 2023 WL 5734907, at * 9 (S.D. Cal. Sept. 5, 2023) (dismissing abandoned claim without leave to amend). Defendant’s motion to dismiss is denied as moot to this claim. For the forgoing reasons, Defendant’s motion to dismiss is DENIED. Dated: July 5, 2024 fee ep H . James Lorenz United States District Judge