1 2 3 4 5 6 7 UNITED STATES DISTRICT COURT 8 NORTHERN DISTRICT OF CALIFORNIA 9 MICHAEL KATZ-LACABE, et al., 10 Case No. 22-cv-04792-RS Plaintiffs, 11 v. ORDER GRANTING IN PART AND 12 DENYING IN PART MOTION TO ORACLE AMERICA, INC., DISMISS 13 Defendant. 14
15 I. INTRODUCTION 16 Three individual plaintiffs bring this putative class action against Oracle America, Inc. 17 (“Defendant” or “Oracle”), alleging the company violates internet users’ right to privacy, as 18 provided under the California Constitution and various state and federal privacy statutes. 19 Defendant moves to dismiss under Federal Rules of Civil Procedure 12(b)(1) and 12(b)(6) for lack 20 of standing and failure to state a claim, as well as failure to comply with Federal Rule of Civil 21 Procedure 8. In addition, Oracle moves for an order striking portions of the Complaint pursuant to 22 Federal Rule of Civil Procedure 12(f), as well as for judicial notice of several documents in 23 support of its motion to dismiss. For the reasons that follow, the request for judicial notice is 24 granted in part and denied in part; the motion to dismiss is granted in part and denied in part; and 25 the motion to strike is denied. 26 II. BACKGROUND1 27 1 The factual background is based on the well-pled allegations in the complaint, which are taken as 1 Plaintiffs in this case are three named individuals—Michael Katz-Lacabe, a resident of San 2 Leandro, California; Dr. Jennifer Golbeck, a resident of Sugarloaf Key, Florida; and Dr. Johnny 3 Ryan, a resident of Dublin, Ireland—who purportedly represent five separate classes of individuals 4 in a suit against Oracle. Plaintiffs’ Complaint alleges that, “despite taking precautions to keep 5 [their] personal information” private, Plaintiffs received a document from Oracle indicating that 6 the company had tracked, compiled, and analyzed their web browsing and other activity, thereby 7 creating an “electronic profile” on them. Dkt. 1 at 2-4. 8 Plaintiffs take issue with Oracle’s extensive data brokering business—and in particular, 9 two key features of Defendant’s data management platform (BlueKai Data Management 10 Platform): (1) the Oracle Data Marketplace, allegedly one of the world’s largest commercial data 11 exchanges; and (2) the Oracle ID Graph, a product designed to “match[] individual customer 12 identities . . . and combin[e] them into a single consistent and accurate customer profile.” Dkt. 1 at 13 7. According to Plaintiffs, Defendant’s business model proceeds as follows: first, it collects as 14 many types of personal information from internet users as possible. Then Defendant synchronizes 15 that data to create individual profiles, and ultimately sells that data—bolstered by data made 16 available by its partners—on its Data Marketplace. 17 A. Oracle’s Alleged Data Collection 18 As Plaintiffs explain, Defendant’s vast data accumulation is made possible by both 19 Defendant’s own technologies and the acquisition of data from other parties. In the former 20 category, Defendant employs seven technologies, including: (1) cookies (pieces of software code 21 stored on web browsers that collect users’ data, like IP addresses); (2) the javascript code “bk- 22 coretag.js” (proprietary code which copies and sends to Oracle what information users are 23 requesting from a website server, such as a URL, date and time of visit, and webpage keywords); 24 (3) tracking pixels (code embedded into webpages that track information whenever the webpage is 25 opened); (4) device identification; (5) cross-device tracking; (6) AddThis widgets; and (7) 26 Datalogix (an information broker specializing in profiles built from brick and mortar purchases). 27 Allegedly “ubiquitous throughout the Internet,” this data collection requires no relationship 1 between the internet user and Oracle to occur. Given this lack of privity, users “may not know 2 Oracle is amassing data about them.” Dkt. 1 at 12. 3 Defendant next uses its Oracle ID Graph to aggregate and synchronize the collected data to 4 perform “identity resolution.” This process takes three steps: (1) filtering and combining data from 5 its various sources to identify and establish “a single, universal view of identity” for each user, 6 across devices and marketing channels; (2) applying analytics to that raw data to develop insights 7 about users and create segments along dimensions such as life events (e.g., marriage), education, 8 purchase history, or even health and wellness (e.g., weight, sleep habits, and categories like 9 “Aging & Geriatrics” and “Pain Relief”); and (3) matching data provided by customers to existing 10 profiles that Defendant has developed and maintains in its Oracle Data Cloud, which helps “knit 11 together” information from Defendant’s own data sources. 12 Finally, Plaintiffs allege that Defendant’s Data marketplace “is an online store owned and 13 operated by Oracle where Oracle facilitates the buying and selling of data and data-derived 14 services by Oracle” and its partners. Dkt. 1 at 26. This Marketplace trades in personal data Oracle 15 collects itself, personal data that private companies collect from their own users and sell directly to 16 Oracle’s clients, and personal data that other third-party data brokers collect and sell to Oracle 17 clients on the Marketplace. Defendant partners with over sixty-five “major brokers of third party 18 data” in the Database, which allows it to profit from the sale of allegedly sensitive personal 19 information including race, location, politics, and medical information. Id. at 33. With all of the 20 available data, Defendant’s products allow its clients to “analyze, segment, and target” users based 21 on the information, including the categories of sensitive information outlined above. 22 B. Defendant’s Privacy Policies & Plaintiffs’ Lack of Consent 23 Plaintiffs further allege that neither Oracle’s privacy policies, nor the policies of internet 24 publishers, could provide any basis for Plaintiffs to have consented to the extensive data collection 25 and profiling scheme described. Oracle’s website leads to seven different privacy policies, which 26 Plaintiffs describe as “convoluted, opaque, and not reasonably comprehensible to the average 27 Internet user,” Dkt. 1 at 43, and which Plaintiffs attack as failing to disclose what Oracle does with 1 internet users’ information in any meaningful way. By way of example, Plaintiffs point to the 2 Oracle Advertising Privacy Policy, which states that “Oracle does not create any online interest 3 segments that reflect personal information that is sensitive,” and includes in the category of 4 sensitive information “certain aspects linked to personal life, such as racial or ethnic, religious, 5 political, citizenship, immigration status, or sexual orientation.” Dkt. 1 at 44; Oracle Advertising 6 Privacy Policy, https://www.oracle.com/legal/privacy/advertising-privacy-policy.html. Plaintiffs 7 allege that Defendant’s practices are actually contrary to the reasonable reader’s inference, from 8 reading the policy, that Oracle would not facilitate the sale of their political views. 9 III. LEGAL STANDARD 10 Article III of the U.S. Constitution authorizes the judiciary to adjudicate only “cases” and 11 “controversies.” The doctrine of standing is “an essential and unchanging part of the case-or- 12 controversy requirement of Article III.” Lujan v. Defs. of Wildlife, 504 U.S. 555, 560 (1992). 13 Defendant moves to dismiss on the basis that Plaintiffs lack standing under Rule 12(b)(1) of the 14 Federal Rules of Civil Procedure. A 12(b)(1) motion to dismiss a complaint challenges the court’s 15 subject matter jurisdiction over the asserted claims. It is the plaintiff’s burden to prove jurisdiction 16 at the time the action is commenced. Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016). 17 “A Rule 12(b)(1) jurisdictional attack may be facial or factual.” Safe Air for Everyone v. 18 Meyer, 373 F.3d 1035, 1039 (9th Cir. 2004). “In a facial attack, the challenger asserts that the 19 allegations contained in the complaint are insufficient on their face to invoke federal jurisdiction.” 20 Id. Accordingly, when considering this type of challenge, the court is required to “accept as true 21 the allegations of the complaint.” U.S. ex rel. Lujan v. Hughes Aircraft Co., 243 F.3d 1181, 1189 22 (9th Cir. 2001). However, “the district court is not restricted to the pleadings, but may review any 23 evidence, such as affidavits and testimony, to resolve factual disputes concerning the existence of 24 jurisdiction.” McCarthy v. United States, 850 F.2d 558, 560 (9th Cir. 1988). 25 Defendant also alleges that Plaintiffs fail to state a claim. A complaint must contain “a 26 short and plain statement of the claim showing that the pleader is entitled to relief.” Fed. R. Civ. P. 27 8(a)(2). While “detailed factual allegations” are not required, a complaint must have sufficient 1 factual allegations to state a claim that is “plausible on its face.” Ashcroft v. Iqbal, 556 U.S. 662, 2 678 (2009) (citing Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555, 570 (2007)). A claim is facially 3 plausible “when the plaintiff pleads factual content that allows the court to draw the reasonable 4 inference that the defendant is liable for the misconduct alleged.” Id. (citing Twombly, 550 U.S. at 5 556). This standard asks for “more than a sheer possibility that a defendant has acted unlawfully.” 6 Id. The determination is a context-specific task requiring the court “to draw on its judicial 7 experience and common sense.” Id. at 679. 8 A Rule 12(b)(6) motion to dismiss tests the sufficiency of the claims alleged in the 9 complaint. Dismissal under Rule 12(b)(6) may be based on either the “lack of a cognizable legal 10 theory” or on “the absence of sufficient facts alleged under a cognizable legal theory.” See 11 Conservation Force v. Salazar, 646 F.3d 1240, 1242 (9th Cir. 2011) (internal quotation marks and 12 citation omitted). When evaluating such a motion, the court must accept all material allegations in 13 the complaint as true and construe them in the light most favorable to the non-moving party. In re 14 Quality Sys., Inc. Sec. Litig., 865 F.3d 1130, 1140 (9th Cir. 2017). It must also “draw all 15 reasonable inferences in favor of the nonmoving party.” Usher v. City of Los Angeles, 828 F.2d 16 556, 561 (9th Cir. 1987). 17 IV. DISCUSSION 18 Plaintiffs claim to represent five different potential classes of plaintiffs: the Worldwide 19 Class,2 the United States Sub-Class,3 the California Sub-Class,4 the CIPA Sub-Class,5 and the 20 2 “All natural persons whose personal information, or data derived from their personal 21 information, was used to create a profile and made available for sale or use through Oracle’s ID 22 Graph or Data Marketplace.” 3 “All natural persons located in the United States whose personal information, or data derived 23 from their personal information, was used to create a profile and made available for sale or use through Oracle’s ID Graph or Data Marketplace.” 24 4 “All natural persons located in California whose personal information, or data derived from their 25 personal information, was used to create a profile and made available for sale or use through Oracle’s ID Graph or Data Marketplace.” 26 5 “All members of the California Sub-Class whose contents of their electronic communications 27 were intercepted by the use of Oracle’s bk-coretag.js functionality.” 1 ECPA Sub-Class.6 On behalf of these classes, the Complaint alleges seven causes of action: (1) 2 Invasion of Privacy under the California Constitution (for the California Sub-Class); (2) Intrusion 3 Upon Seclusion under California Common Law (on behalf of all classes); (3) Violation of the 4 Unfair Competition Law under Cal. Bus. & Prof Code § 17200 et seq. (on behalf of all classes); 5 (4) Violation of the California Invasion of Privacy Act (on behalf of the CIPA Sub-Class); (5) 6 Violation of the Federal Wiretap Act, under 18 U.S.C. § 2510; (6) Unjust Enrichment (on behalf 7 of all classes); and (7) Declaratory Judgment and Injunctive Relief (on behalf of all classes). 8 Defendant moves to dismiss all of the claims under 12(b)(1) and 12(b)(6). In addition to its 9 substantive arguments, Defendant has also moved for certain paragraphs be stricken from the 10 Complaint, and requests judicial notice of several documents. 11 A. Judicial Notice 12 Defendant requests judicial notice of twelve different documents, arguing Plaintiffs either 13 refer to them extensively in the Complaint, or rely on them as a basis for their claims. Three of 14 these are customer-facing company policies and agreements (Exhibit B: Oracle Advertising’s 15 Online Data Agreement; Exhibit H: AddThis Privacy Policy; and Exhibit J: Oracle Advertising 16 Privacy Policy); the rest are Oracle web pages or press releases hosted on Oracle’s own website. 17 There are two exceptions to the general rule that “district courts may not consider material 18 outside the pleadings when assessing the sufficiency of a complaint under Rule 12(b)(6)”: judicial 19 notice and incorporation by reference. Khoja v. Orexigen Therapeutics, Inc., 899 F.3d 988, 998 20 (9th Cir. 2018). Courts may take judicial notice of matters that are either (1) generally known 21 within the trial court’s territorial jurisdiction or (2) capable of accurate and ready determination by 22 resort to sources whose accuracy cannot reasonably be questioned. Fed. R. Evid. 201(b). As an 23 alternative, the “incorporation by reference” doctrine is “a judicially created doctrine that treats 24 certain documents as though they are part of the complaint itself,” in order to “prevent[] plaintiffs 25 26 6 “All members of the United States Sub-Class whose contents of their electronic communications 27 were intercepted by the use of Oracle’s bk-coretag.js functionality.” 1 from selecting only portions of documents that support their claims, while omitting portions of 2 those very documents that weaken—or doom—their claims.” Khoja, 899 F.3d at 1002. 3 As Defendant correctly identifies, Plaintiffs make copious reference to Defendant’s 4 websites in the Complaint, and specifically hyperlink two of the requested documents (Exhibits J 5 and H) in a footnote. At the same time, there is reason to “be cautious before taking judicial notice 6 of documents . . . published on a website,” “particularly . . . when a party seeks to introduce 7 documents it created and posted on its own website,” as is the case here. Rollins v. Dignity Health, 8 338 F. Supp. 3d 1025, 1033 (N.D. Cal. 2018). Likewise, the Ninth Circuit has warned that 9 “incorporation by reference” is “improper” if used “to resolve factual disputes against the 10 plaintiff’s well-pled allegations in the complaint.” Khoja, 899 F.3d at 1014 (“The incorporation- 11 by-reference doctrine does not override the fundamental rule that courts must interpret the 12 allegations and factual disputes in favor of the plaintiff at the pleading stage.”). A document 13 should not be incorporated if the defendant seeks its incorporation “merely [to] create[] a defense 14 to the well-pled allegations in the complaint,” as “[o]therwise, defendants could use the doctrine to 15 insert their own version of events into the complaint to defeat otherwise cognizable claims.” Id. at 16 1002. 17 Though Plaintiffs notably do not dispute the authenticity of the documents, judicially 18 noticing all of the information contained on Oracle’s own webpages is improper and unnecessary, 19 as it would serve no purpose other than exactly what the Ninth Circuit warned against: crafting an 20 alternative version of events. For the same reasons, Defendant’s request to incorporate the 21 documents by reference is denied, except as to Exhibits J and H, which are clearly referenced in 22 Plaintiffs’ allegations both by name and by link.7 23 24
25 7 Although Exhibit B is generally referenced in the Complaint, see, e.g., Dkt. 1 ¶ 38 (“Oracle has 26 agreements with numerous high-traffic websites like the New York Times, ESPN, and Amazon to place cookies and/or pixels on their websites.”), it is not used by Plaintiffs to the same degree as 27 Exhibits J and H. As a result, it is inappropriate to find the document incorporated by reference. 1 B. Article III Standing (All Causes of Action) 2 Defendant first argues that the case must be dismissed, because Plaintiffs have failed to 3 allege two of the three elements that make up the “irreducible constitutional minimum” of Article 4 III standing under Lujan: (1) a concrete and particularized injury, that (2) is fairly traceable to 5 Defendant’s conduct. 504 U.S. at 560. 6 “‘[A]n injury in fact’ is ‘an invasion of a legally protected interest’ that is ‘concrete and 7 particularized’ and ‘actual or imminent, not conjectural or hypothetical.’” Novak v. United States, 8 795 F.3d 1012, 1018 (9th Cir. 2015) (quoting Lujan, 504 U.S. at 560) (alternation in original). 9 Causation, the second element, requires a “causal connection between the injury and the conduct 10 complained of.” Novak, 795 F.3d at 1018 (9th Cir. 2015) (citing Lujan, 504 U.S. at 560). This 11 element is concerned with ensuring that the injury is “fairly . . . trace[able] to the challenged action 12 of the defendant, and not . . . th[e] result [of] the independent action of some third party not before 13 the court.” Lujan, 504 U.S. at 560 (citing Simon v. Eastern Ky. Welfare Rts. Org., 426 U.S. 26, 14 41–42 (1976)) (alternations in original). 15 While Plaintiffs’ Complaint extensively quotes news articles and other outside sources 16 painting a dramatic picture of Defendant’s data brokerage business, it contains scarce specific 17 allegations regarding the named Plaintiffs. In its claim that the Plaintiffs have not sufficiently 18 pointed to a concrete and particularized harm, Defendant specifically argues that Plaintiffs have 19 not alleged the profiles “were actually sold or made available for sale by Oracle to anyone,” Dkt. 20 23 at 6. Defendant further argues that any harm is not fairly traceable to Oracle, because Plaintiffs 21 fail to allege that “Oracle tracked, profiled, or sold any of Plaintiffs’ personal information,” Dkt. 22 23 at 8, and because there are “numerous third parties that made independent decisions leading to 23 the alleged harm,” which breaks the causal link. Dkt. 23 at 9. 24 Although the Complaint would indeed be much better served by the inclusion of more 25 allegations specifically tying their general allegations of the “financial, dignitary, reputational, and 26 relational harms [Defendant] has caused” to the named Plaintiffs, the Complaint is not so devoid 27 of allegations that Plaintiffs’ suit must be dismissed. Plaintiffs allege that Katz-Lacabe “received a 1 document from Oracle indicating Oracle had tracked, compiled, and analyzed his web browsing 2 and other activity and thereby created an electronic profile on him,” and that “Oracle continues to 3 track [his] internet and offline activity, enrich the profile of him as described below, and make his 4 personal information available to third parties without his consent.” Dkt. 1 at 2. The Complaint 5 provides similar but varied allegations for Plaintiffs Golbeck and Ryan, adding for the former that 6 she “discovered Oracle tracking devices on multiple of her computers that she regularly uses for 7 internet browsing and other activities,” Dkt. 1 at 3, and asserting the allegations for Plaintiff Ryan 8 on information and belief. As to all Plaintiffs, the Complaint’s use of “as described below”—when 9 construed in the light most favorable to them—references Defendant’s data collection methods 10 and attendant dangers generally described in the body of the Complaint, such as Oracle’s ability to 11 amass “vast amounts of personal data” for the purpose of “identify[ing] individuals and 12 aggregat[ing] their many identifiers,” Dkt. 1 at 7, the result of which is the creation of a “cradle-to- 13 grave” profile[] of Class members.” Dkt. 1 at 50. Such profiles are effectively dossiers which “can 14 be used to further invade Plaintiffs’ privacy” by “allowing third parties to learn intimate details of 15 [Plaintiffs’] lives, and target them for advertising, political, and other purposes,” ultimately 16 “harming them through the abrogation of their autonomy and their ability to control dissemination 17 and use of information about them.” Dkt. 1 at 52. Altogether, these allegations are in line with 18 those found in other cases in the Circuit and sufficiently allege harm to the Plaintiffs for Article III 19 standing. See, e.g, In re Facebook, Inc. Internet Tracking Litig. (“Facebook Tracking”), 956 F.3d 20 589, 601 (9th Cir. 2020). 21 Defendant’s other arguments about Plaintiffs’ allegedly inadequate pleading of harm— 22 including its attempts to distinguish relevant cases—are similarly unpersuasive. As the Ninth 23 Circuit has recognized, invasion of privacy can be a harm in and of itself, see Eichenberger v. 24 ESPN, Inc., 876 F.3d 979, 983 (9th Cir. 2017). Plaintiffs’ case is not merely about a risk or 25 inference of future harm. The letters that Plaintiffs received from Oracle indicate that Plaintiffs’ 26 data had been collected. The other inferences that Plaintiffs seek—including the harm that results 27 from such data collection—are not altogether unreasonable, and must be accepted for the purposes 1 of the motion. Plaintiffs are not yet required to make specific allegations as to what particular 2 information was purportedly sold. See Maya v. Centex Corp., 658 F.3d 1060, 1068 (9th Cir. 2011) 3 (“At the pleading stage, general factual allegations of injury resulting from the defendant’s 4 conduct may suffice, for on a motion to dismiss we ‘presum[e] that general allegations embrace 5 those specific facts that are necessary to support the claim.’”) (quoting Lujan, 504 U.S at 561). 6 Defendant’s argument that the string of causation is broken because of “numerous third 7 parties” who made “independent decisions” misapprehends the law—a conclusion apparent from 8 the cases to which it attempts to appeal. As the Ninth Circuit explains in Maya: “[t]o survive a 9 motion to dismiss for lack of constitutional standing,” plaintiffs are not required to show that the 10 defendant’s actions are the “‘proximate cause’ of plaintiffs’ injuries”; instead, “plaintiffs must 11 establish a ‘line of causation’ between defendants’ action and their alleged harm that is more than 12 ‘attenuated.’” 658 F.3d at 1070 (citing Allen v. Wright, 468 U.S. 737, 757 (1984)). In fact, Maya 13 counsels that “[a] causation chain does not fail simply because it has several ‘links,’ provided 14 those links are ‘not hypothetical or tenuous’ and remain ‘plausib[le].’” Id. (citations omitted). 15 Here, Plaintiffs allege that Oracle’s products, implemented by numerous websites, lead to the 16 collection of vast amounts of data which, when “synchronized” altogether, lead to personal 17 identification and purported invasions of privacy. That is, in fact, the very outcome that Oracle 18 wishes—and markets to its customers. Plaintiffs’ allegations simply do not hinge on hypothetical 19 or tenuous links of causation the way that allegations of predatory lending to high-risk mortgagees 20 necessarily result in decreased home values, Maya, 658 F. 3d at 1072, or that federal tax 21 exemptions to racially discriminatory private schools impair school desegregation. Wright, 468 22 U.S. at 758-59 (“The chain of causation is even weaker in this case. It involves numerous third 23 parties (officials of racially discriminatory schools receiving tax exemptions and the parents of 24 children attending such schools) who may not even exist in respondents’ communities and whose 25 independent decisions may not collectively have a significant effect on the ability of public school 26 students to receive a desegregated education.”). Plaintiffs thus have alleged harm that fairly could 27 be ascribed to Defendant, and they have Article III standing to maintain the present action. 1 C. First & Second Causes of Action: Invasion of Privacy (California Constitution) & 2 Intrusion Upon Seclusion 3 The tests for an invasion of privacy under the California Constitution and intrusion upon 4 seclusion under California common law “involve[] similar elements”—as a result, “courts 5 consider the claims together” with one test, “and ask whether: (1) there exists a reasonable 6 expectation of privacy, and (2) the intrusion was highly offensive.” Facebook Tracking, 956 F.3d 7 at 601 (citing Hernandez v. Hillsides, Inc., 47 Cal. 4th 272, 287 (2009)). 8 A reasonable expectation of privacy can exist where a defendant gains “unwanted access to 9 data by electronic or other covert means, in violation of the law or social norms.” Facebook 10 Tracking, 956 F.3d at 601-02 (quoting Hernandez, 47 Cal 4th at 286). This determination entails a 11 consideration of the customs, practices, and circumstances surrounding the data collection, such as “the amount of data collected, the sensitivity of data collected, the manner of data collection, and 12 the defendant’s representations to its customers.” Hammerling v. Google LLC, No. 21-cv-09004- 13 CRB, 2022 WL 2812188, at *10 (N.D. Cal. July 18, 2022) (citations omitted). 14 Evaluating whether Defendant’s actions were “highly offensive” necessitates a “holistic 15 consideration of factors such as the likelihood of serious harm to the victim, the degree and setting 16 of the intrusion, the intruder’s motives and objectives, and whether countervailing interests or 17 social norms render the intrusion inoffensive.” Facebook Tracking, 956 F.3d at 606 (quoting 18 Hernandez, 47 Cal 4th at 287). This inquiry also “focuses on the degree to which the intrusion is 19 unacceptable as a matter of public policy.” Id. 20 Defendant invokes Low v. LinkedIn Corp., 900 F. Supp. 2d 1010 (N.D. Cal. 2012) and 21 cases cited therein to argue that California’s constitution and common law “set a high bar for an 22 invasion of privacy claim,” id. at 1025, and to explain that even disclosure of social security 23 numbers would not constitute an “egregious breach of social norms.” Id. (citing cases). As the data 24 allegedly collected was not sensitive in nature, and the company’s data collection practices were 25 publicly disclosed, Defendant argues, Plaintiffs could not have had a reasonable expectation of 26 privacy, and Defendant’s conduct was neither highly offensive nor egregious. 27 1 Plaintiffs’ strongest argument lies in its allegation that Oracle’s accumulation of a “vast 2 repository of personal data,” Dkt. 30 at 11—from compiling Plaintiffs’ browsing activity, online 3 communications, and offline activity—is what contravenes the reasonable expectation of privacy. 4 This is in line with the analysis provided in Facebook Tracking. Explaining that technological advances, such as the “use of cookies to track and compile internet browsing histories,” enable 5 “access to a category of information otherwise unknowable and implicate privacy concerns,” 6 Facebook Tracking, 956 F.3d at 603, the Ninth Circuit found a reasonable expectation of privacy 7 from “allegations that Facebook allegedly compiled highly personalized profiles from sensitive 8 browsing histories and habits.” Id. at 604; see also Hammerling, 2022 WL 2812188, at *11 9 (finding a reasonable expectation of privacy where Google collected a “large amount of personal 10 information from users’ smartphones”). 11 Indeed, in differentiating Facebook Tracking from the analysis in United States v. 12 Forrester, 512 F.3d 500, 510 n.6 (9th Cir. 2008) (where the Ninth Circuit expressed, in a footnote, 13 that URLs might be constitutionally problematic due to the information it reveals about people’s 14 internet activity) and In re Zynga Priv. Litig., 750 F.3d 1098, 1108-09 (9th Cir. 2014) (where the 15 Ninth Circuit declined to find a reasonable expectation of privacy in referral headers containing 16 URLs), the Ninth Circuit explained that in Facebook Tracking, the search terms and URLs at issue 17 “could divulge a user’s personal interests, queries, and habits on third-party websites operating 18 outside of Facebook’s platform.” Facebook Tracking, 956 F.3d at 605. 19 Here, Plaintiffs allegations extend to “sensitive health and personal safety information,” 20 Dkt. 1 at 14-15, 27 (“Oracle’s Health and Wellness segments reveal sensitive, health-related types 21 of personal information Oracle collects on Class members.”), and race and politics, see Dkt. 1 at 22 31-32, 44. While these are alleged generally and it is a close question as to whether Oracle 23 plausibly did collect and aggregate information to reveal such insights, viewing the allegations in 24 the light most favorable to Plaintiffs, such allegations of data collection would go well beyond the 25 “routine commercial behavior” of collecting contact information for sending advertisements. Dkt. 26 23 at 17 (citing Folgelstrom v. Lamps Plus, Inc., 195 Cal. App. 4th 986, 992 (2011)). 27 Finally, determinations of the egregiousness of the privacy intrusion are not usually 1 resolved at the pleading stage. See Facebook Tracking, 956 F.3d at 606 (“The ultimate question of 2 whether Facebook’s tracking and collection practices could highly offend a reasonable individual 3 is an issue that cannot be resolved at the pleading stage.”); In re Facebook, Inc., Consumer Priv. 4 User Profile Litig. (“Facebook Consumer Privacy”), 402 F. Supp. 3d 767, 797 (N.D. Cal. 2019) 5 (“Under California law, courts must be reluctant to reach a conclusion at the pleading stage about 6 how offensive or serious the privacy intrusion is.”). Accordingly, Plaintiffs have alleged enough in 7 the Complaint for these claims to withstand dismissal. 8 D. Third Cause of Action: UCL 9 The UCL provides a cause of action to challenge any “unlawful, unfair or fraudulent 10 business act or practice.” Cal. Bus. & Prof. Code § 17200. While Plaintiffs allege that Defendant 11 violated the first two (the unfair and unlawful prongs), both of these claims fail for lack of 12 standing. Over and above the demands of Article III, the UCL limits standing to those who have 13 “suffered injury in fact and ha[ve] lost money or property as a result of . . . unfair competition.” 14 Cal. Bus. & Prof. Code § 17204. Thus, “[t]o satisfy the narrower standing requirements imposed 15 by [§ 17204], a party must . . . (1) establish a loss or deprivation of money or property sufficient to 16 qualify as injury in fact . . . and (2) show that the economic injury was the result of, i.e., caused by, 17 the unfair business practice . . . that is the gravamen of the claim.” Kwikset Corp. v. Superior Ct., 18 51 Cal. 4th 310, 322 (2011) (emphasis in original). 19 Here, Plaintiffs fail to show they have an economic injury. Plaintiffs do identify some 20 support for the idea that personal information without consent constitutes economic injury. See 21 Calhoun v. Google LLC, 526 F. Supp. 3d 605, 636 (N.D. Cal. 2021) (“[T]he Ninth Circuit and a 22 number of district courts, including this Court, have concluded that plaintiffs who suffered a loss 23 of their personal information suffered economic injury and had standing.”) (citing cases, including 24 In re Facebook Privacy Litig. (“Facebook Privacy”), 572 F. App’x 494, 494 (9th Cir. 2014); and 25 In re Yahoo! Inc. Cust. Data Sec. Breach Litig., No. 16-MD-02752-LHK, 2017 WL 3727318, at 26 *13 (N.D. Cal. Aug. 30, 2017)). The weight of the authority in the district and the state, however, 27 point in the opposite direction: that “the ‘mere misappropriation of personal information’ does not 1 establish compensable damages.” Pruchnicki v. Envision Healthcare Corp., 845 F. App’x 613, 2 615 (9th Cir. 2021); see also Moore v. Centrelake Med. Grp., Inc., 83 Cal. App. 5th 515, 540-41 3 & n.13 (2022) (noting that “[t]he scant California authority cited by Facebook Privacy did not 4 address the value of PII, much less any deprivation thereof” and finding Facebook Privacy and district court cases following Facebook Privacy “unpersuasive.”); Facebook Consumer Privacy, 5 402 F. Supp. 3d at 804 (distinguishing a company’s gain of money through sharing or use of 6 Plaintiffs’ information from a claim that Plaintiffs actually lost money and dismissing Plaintiffs’ 7 theory of economic loss as “purely hypothetical”); Gonzales v. Uber Techs., Inc., 305 F. Supp. 3d 8 1078, 1093 (N.D. Cal. 2018) (“However, the sharing of names, user IDs, location and other 9 personal information does not constitute lost money or property for UCL standing purposes.”) 10 (citing Campbell v. Facebook, 77 F. Supp. 3d 836, 849 (N.D. Cal. 2014); Svenson v. Google Inc., 11 65 F. Supp. 3d 717, 730 (N.D. Cal. 2014) (finding that Plaintiff could not proceed with UCL claim 12 because she had “not alleged any facts showing that Defendants’ business practice—disclosing 13 users’ Contact Information to third-party App vendors—changed her economic position at all”)). 14 Because Plaintiffs have not alleged a specific monetary or economic loss, Plaintiffs lack standing 15 to maintain their UCL claims. 16 E. Fourth and Fifth Causes of Action: CIPA & ECPA (Federal Wiretap Act) 17 Defendant raises three defenses to Plaintiffs’ wiretapping claims: (1) Defendant is exempt 18 from liability as a party to Plaintiffs’ alleged communications; (2) Plaintiffs fail to plead the 19 interception of “contents” as defined under the relevant statutes; and (3) Oracle’s customers’ 20 consent satisfies one-party consent under the ECPA. 21 With respect to the first argument, Plaintiffs are correct that the weight of the authority in 22 this Circuit teaches that Defendant is not a party to Plaintiffs’ alleged communications. Defendant 23 invokes Graham v. Noom, Inc., 533 F. Supp. 3d 823 (N.D. Cal. 2021) to argue that it is simply “an 24 extension” of the website operators, rather than an outsider. Yet such application ignores the 25 analysis provided in Noom itself, which explains that the third-party “is a vendor that provides a 26 software service that captures its clients’ data, hosts it on [its own] servers, and allows the clients 27 1 to analyze their data.” Id. at 832. Importantly, there were “no allegations . . . that [the vendor] 2 intercepted and used the data itself,” which rendered it altogether different from companies which 3 “mined information from other websites and sold it.” Id. In this analysis, Noom specifically 4 distinguished Facebook Tracking—where “Facebook tracked its users to third-party websites 5 (through Facebook’s code on the websites) . . . and then it sold that data to advertisers,” Noom, 6 533 F. Supp. 3d at 832—and Revitch v. New Moosejaw, LLC, 2019 WL 5485330 (N.D. Cal. Oct. 7 23, 2019)—where “NaviStone was a marketing company that partnered with e-commerce sites to 8 intercept visitor data and create marketing databases of consumer information.” Noom, 533 F. 9 Supp. 3d at 832. The situation at bar is far more analogous to those at issue in Facebook Tracking 10 and Revitch8—and as such, Defendant is not a party to the communications. 11 With respect to Defendant’s second argument, the definition of “contents” is similar under 12 both the CIPA and the ECPA. In re Google RTB Consumer Priv. Litig., 21-cv-2155-YGR, 2022 13 WL 2165489, at *11 (N.D. Cal. June 13, 2022) (citing Brodsky v. Apple Inc., 445 F. Supp. 3d 110, 14 127 (N.D. Cal. 2020)). The Ninth Circuit has held that, under the ECPA, “‘contents’ refers to the 15 intended message conveyed by the communication, and does not include record information 16 regarding the characteristics of the message that is generated in the course of the communication.” 17 Zynga, 750 F.3d at 1106. Of the nine types of information that Plaintiffs allege was captured by 18 Defendant’s bk-coretag.js code, then, only two are mainly at issue9: (1) referrer URLs; and (2) 19 data entered into forms. Though Plaintiffs suggest that URLs “can also constitute contents of 20 communications,” Dkt. 30 at 18, Defendant argues that Plaintiffs fail to identify whether the URLs 21 at issue here include elements that would render their collection problematic, such as search terms 22
23 8 Defendant attempts to distinguish those cases, but as Plaintiffs have alleged that Oracle combines 24 and sells information in its Data Marketplace, it appears that Defendant’s products cannot be properly analogized to the tools in Noom. 25 9 Defendant is correct that the other seven pieces of information, which include webpage titles, webpage keywords, the date and times of website visits, IP addresses, page visits, purchase intent 26 signals, and add-to-cart actions, are conceded to be record information that does not constitute “content” under the ECPA. See Zynga, 750 F.3d at 1106 (“[R]ecord information . . . includes the 27 ‘name,’ ‘address,’ and ‘subscriber number or identity’ of a subscriber or customer.”). 1 which would reveal the content a user searched for, see Zynga, 750 F.3d at 1108, or full-string 2 detailed URLs that might contain folder and file names. Facebook Tracking, 956 F.3d at 605. 3 While Plaintiffs’ lack of specificity makes this a close call, the allegation about the data entered 4 into forms resolves the question in their favor. Though Defendant correctly notes the absence of a 5 blanket rule that all entries in a web form are content, its suggestion that In re Pharmatrak, Inc., 6 329 F.3d 9 (1st Cir. 2003) only found disclosure of contents because Plaintiffs entered personal 7 medical information into a web form reads the decision too narrowly. Instead, the First Circuit 8 explained that the definition of contents “encompasses personally identifiable information such as 9 a party’s name, date of birth, and medical condition.” Id. at 18. For both of these pieces of 10 information, when the allegations are construed in the light most favorable to Plaintiffs, they have 11 pled just barely enough to withstand dismissal at this juncture. 12 Finally, Defendant is correct that the federal Wiretap Act is a one-party consent statute, 13 pursuant to 18 U.S.C. § 2511(2)(d). As Defendant’s customers must have chosen to deploy 14 Oracle’s tools on their websites, it necessarily follows that “one of the parties to the 15 communication”—the websites themselves—gave “prior consent to such interception.” Id; see 16 also Rodriguez v. Google LLC, No. 20-cv-04688-RS, 2021 WL 2026726, at *6 (N.D. Cal. May 17 21, 2021); In re Yahoo Mail Litig., 7 F. Supp. 3d 1016, 1026 (N.D. Cal. 2014) (“[T]he consent of 18 one party is a complete defense to a Wiretap Act claim.”). Plaintiffs’ attempt to invoke the crime- 19 tort exception, requiring them to plead sufficient facts to show that “the primary motivation or a 20 determining factor in the interceptor’s actions has been to injure plaintiffs tortiously,” does not 21 apply to a case such as this, where Defendant’s “purpose has plainly not been to perpetuate torts 22 on millions of Internet users, but to make money.” Rodriguez, 2021 WL 2026726 at *6 n.8 (citing 23 In re Google Inc. Gmail Litigation, No. 13-MD-02430-LHK, 2014 WL 1102660, at *18 n.13 24 (N.D. Cal. Mar. 18, 2014). As a result, Plaintiffs’ Wiretap Act claim must be dismissed on this 25 basis while their CIPA claim survives. 26 F. Sixth Cause of Action: Unjust Enrichment 27 Defendant next seeks to dismiss Plaintiffs’ unjust enrichment claim, explaining that no 1 such standalone cause of action exists in California law and that Plaintiffs have failed to allege 2 mistake, fraud or coercion, or that a benefit was conferred on Oracle that would be unjust for it to 3 retain. 4 Though “in California, there is not a standalone cause of action for ‘unjust enrichment,’” 5 Astiana v. Hain Celestial Grp., Inc., 783 F.3d 753, 762 (9th Cir. 2015), “[w]hen a plaintiff alleges 6 unjust enrichment, a court may ‘construe the cause of action as a quasi-contract claim seeking 7 restitution.’” Id. (quoting Rutherford Holdings, LLC v. Plaza Del Rey, 223 Cal. App. 4th 221, 231 8 (2014)). “To allege unjust enrichment as an independent cause of action, a plaintiff must show that 9 the defendant received and unjustly retained a benefit at the plaintiff’s expense.” ESG Cap. 10 Partners, LP v. Stratos, 828 F.3d 1023, 1038 (9th Cir. 2016).10 11 Plaintiffs do not demonstrate that Defendant has unjustly retained a benefit at Plaintiffs’ 12 expense. While they argue “a right to disgorgement of profits resulting from unjust enrichment,” 13 Plaintiffs’ appeal to Facebook Tracking misses the opinion’s full context: “California law requires 14 disgorgement of unjustly earned profits regardless of whether a defendant's actions caused a 15 plaintiff to directly expend his or her own financial resources or whether a defendant’s actions 16 directly caused the plaintiff’s property to become less valuable.” Facebook Tracking, 956 F.3d at 17 600. Here, Plaintiffs and putative class members have neither directly expended their own 18 resources, nor shown that their property has become less valuable. Unlike the Plaintiffs in Hart v. 19 TWC Prod. & Tech. LLC, 526 F. Supp. 3d 592 (N.D. Cal. 2021), Plaintiffs here were at no time in 20 direct privity with Oracle. As a result, Defendant did not collect information from Plaintiffs in a 21 manner contrary to expectations created by the consent process. See id. at 597 (noting users’ 22 10 Plaintiffs are mistaken that Astiana, which continues to be applied in this Circuit, is no longer 23 good law. See, e.g., Hillori Graham v. Central Garden & Pet Co., No. 22-CV-06507-JSC, 2023 WL 2744391, at *3 n.2 (N.D. Cal. Mar. 30, 2023); Day v. Advanced Micro Devices, Inc., No. 22- 24 CV-04305-VC, 2023 WL 2347421, at *1 n.1 (N.D. Cal. Mar. 2, 2023). Moreover, “[t]he argument that California law does not recognize a cause of action for unjust enrichment is for all intents and 25 purposes a nonstarter,” as “California law recognizes, at a minimum, a quasi-contract claim based on an unjust-enrichment theory.” Day, 2023 WL 2347421 at *1 n.1 (citing both Astiana, 783 F.3d 26 at 762 and ESG Cap. Partners, 828 F.3d at 1038). Litigants’ appeal to semantics is therefore resisted, and the unjust enrichment claim will be construed in accordance with the direction from 27 the Ninth Circuit, as conveyed in Astiana and ESG Capital Partners. 1 information was tracked even when the application was not open, and that “[n]owhere in the 2 consent process was the user confronted with the information that their minute-by-minute 3 geolocation data [would] be broadly disseminated by [Defendant] and that [Defendant] would 4 make millions disseminating users' geolocation data”).11 Without more, Plaintiffs have not stated a 5 claim for unjust enrichment. 6 G. Choice of Law 7 Defendant takes issue with Plaintiffs’ assertion of California state claims on behalf of non- 8 California residents—both named Plaintiffs Golbeck and Ryan (residents of Florida and Ireland, 9 respectively), as well as the classes that include non-residents (e.g., the nationwide and worldwide 10 classes)—and seek dismissal of those claims on this basis. As this order dismisses the UCL, ECPA 11 and unjust enrichment claims, the only remaining claim at issue is Plaintiffs’ intrusion upon 12 seclusion claim alleged under California common law. 13 Both parties are in agreement that “[a] federal court sitting in diversity must look to the 14 forum state's choice of law rules,” thus requiring the court to apply California’s “governmental 15 interest approach” to determine questions of choice of law. Zinser v. Accufix Rsch. Inst., Inc., 253 16 F.3d 1180, 1187 (9th Cir. 2001). This is a three-step process. The first task is to determine whether 17 the laws of the affected jurisdictions are “the same or different.” Mazza v. American Honda Motor 18 Co., Inc., 666 F.3d 581, 590 (9th Cir. 2012) (quoting McCann v. Foster Wheeler LLC, 48 Cal. 4th 19 68, 81-82 (2010)). If the laws are different, the second step requires an examination of “each 20 jurisdiction’s interest in the application of its own law” to determine whether a true conflict 21 exists. Id. If it does, then the final step involves analyzing “which state’s interest would be more 22 impaired if its policy were subordinated to the policy of the other state.” Id. 23 Applying this analysis, Defendant explains that significant differences exist between 24 California’s law that of Florida and the GDPR that render it inappropriate to apply California law 25 11 To the extent Defendant has data, moreover, it was received and/or collected with permission 26 from the third-party websites. If Plaintiffs challenge unjust enrichment based on the monetization of that data, they must explain why the access they received to those websites would not defeat the 27 unjust enrichment claim. 1 to the latter two. In response, Plaintiffs contend that Defendant’s choice of law analysis is too 2 sparse to fulfill its burden of displacing California law, and, in the alternative, that such analysis is 3 premature at the pleadings stage. 4 Plaintiffs are correct that district courts in this Circuit have often deferred choice-of-law 5 issues until the class certification stage. See, e.g., Wallace v. SharkNinja Operating, LLC, No. 18- 6 cv-05221-BLF, 2020 WL 1139649, at *15 (N.D. Cal. Mar. 9, 2020). However, “whether a choice- 7 of-law analysis can be properly conducted at the motion to dismiss stage depends on the individual 8 case.” Bartel v. Tokyo Elec. Power Co., Inc., 371 F. Supp. 3d 769, 790 (S.D. Cal. 2019). “To 9 determine whether the choice-of-law analysis should occur on the pleadings or at class 10 certification, courts generally look to whether discovery would be a meaningful aid to that 11 inquiry.” Anderson v. Apple Inc., 500 F. Supp. 3d 993, 1010 (N.D. Cal. 2020) (collecting cases). 12 When it is unlikely that further fact development would materially impact the choice of law 13 determination, that determination need not be deferred. Frenzel v. AliphCom, 76 F. Supp. 3d 999, 14 1007–08 (N.D. Cal. 2014) (dismissing individual and class claims at the motion to dismiss stage 15 where named plaintiff was “a nonresident who did not purchase the defendant’s product in 16 California”). 17 That is the case here. With respect to Florida, Defendant notes it specifically requires a 18 plaintiff to show an intrusion into a private quarter. Hammer v. Sorensen, 824 F. App’x 689, 695 19 (11th Cir. 2020) (plaintiffs are required “to show an intrusion into a private place and not merely a 20 private activity”) (citing Allstate Ins. Co. v. Ginsberg, 863 So. 2d 156, 161 n.3, 162 (Fla. 2003)). Plaintiffs insist Defendant’s analysis is not “rigorous,” in that it only identifies “superficial 21 differences in . . . language,” which are minimal, as both Florida and California rely on the 22 Restatement of Torts (Second) to define intrusion upon seclusion. Dkt. 30 at 8. These general 23 arguments are not themselves an answer, however, to the differences that Defendant has raised. 24 The requirement of a private quarter is an element of the claim in Florida that is not an explicit 25 requirement in California. As California requires a plaintiff to show only that there exists a 26 reasonable expectation of privacy, and that whatever intrusion on plaintiff’s privacy was “highly 27 1 offensive,” Facebook Tracking, 956 F.3d at 601, which in turn necessitates consideration of legal 2 and social norms and circumstances surrounding the data collection and intrusion, there is indeed a 3 possibility that a successful claim under California law would fail to be meritorious under the law 4 of Florida. Indeed, such a conclusion, particularly for cases like the one at bar, is bolstered by Defendant’s explanation that “Florida’s laws have not stretched to reach” claims premised on the 5 collection of online data, Dkt. 35 at 5, as well as Florida’s failure to enact consumer privacy 6 legislation conferring substantive data privacy rights in the way that California has done. See Dkt. 7 35 at 5 n.8 (comparing H.B. 9, 2022 Fla. Leg., Reg. Sess. (Fla. 2022) (unenacted) and S.B. 1864, 8 2022 Fla. Leg., Reg. Sess. (Fla 2022) (unenacted) with Cal. Civ. Code §§ 1798.100, et seq.). 9 Moreover, even though Florida relies on the Restatement, the Eleventh Circuit has noted, 10 specifically with respect to the private quarter requirement, that “the Supreme Court of Florida has 11 construed the tort of intrusion upon seclusion even more narrowly than the Restatement provides.” 12 Hammer, 824 F. App’x at 695 (citing Allstate, 863 So. 2d at 161 n.3, 162). 13 Because this difference is neither “trivial [n]or wholly immaterial,” each state’s interest in 14 applying its law must be analyzed. Mazza, 666 F.3d at 591. California recognizes that “with 15 respect to regulating or affecting conduct within its borders, the place of the wrong has the 16 predominant interest,” id. at 593 (citing Hernandez v. Burger, 102 Cal. App. 3d 795, 802 (1980)), 17 where the “place of the wrong” is defined as “the state where the last event necessary to make the 18 actor liable occurred.” Id. (citing McCann, 48 Cal. 4th at 94 n.12 (geographic location of an 19 omission is the place of the transaction where it should have been disclosed) and Zinn v. Ex–Cell– 20 O Corp., 148 Cal. App. 2d 56, 80 n.6 (1957) (concluding in a fraud case that the place of the 21 wrong was the state where the misrepresentations were communicated to the plaintiffs, not the 22 state where the intention to misrepresent was formed or where the misrepresented acts took 23 place)). Additionally, “California’s interest in applying its law to residents of foreign states is 24 attenuated,” id. at 594 (citing Edgar v. MITE Corp., 457 U.S. 624, 644 (1982)), particularly where 25 “the claims of foreign residents concern[] acts that took place in other states.” Id. 26 27 1 Here, although Oracle is headquartered in California,12 Plaintiffs interactions with the 2 third-party websites do not necessarily take place in California—and presumably do not, when 3 considering Plaintiffs Golbeck and Ryan. Therefore, even if some of the challenged conduct 4 allegedly emanated from California, it is not enough to establish California’s interest, particularly where the “last event[s]” involved in the collection and interception of data (e.g., the third-party 5 websites’ decision to use Oracle’s services) were made possible by an intermediary that may or 6 may not be located in the state. See Mazza, 666 F.3d at 594 (“[T]he last events necessary for 7 liability as to the foreign class members—communication of the advertisements to the claimants 8 and their reliance thereon in purchasing vehicles—took place in the various foreign states, not in 9 California. These foreign states have a strong interest in the application of their laws to 10 transactions between their citizens and corporations doing business within their state.”) Reliant on 11 tests requiring courts to assess whether expectations about privacy are reasonable or data 12 collection is egregious, privacy is an evolving area of law that is inherently tied to community 13 standards. In light of this and the apparent differences in the legal framework among states, 14 Plaintiffs have failed to show that the law of California should be applied nationwide. 15 The even greater legal differences between intrusion upon seclusion under California’s 16 laws and the GDPR leads to a similar conclusion for Plaintiffs’ Worldwide class. Defendant raises 17 several differences that would impact the present matter, including that the GDPR: lacks an 18 “evaluation of contemporary social norms,” Dkt. 23 at 10, provides a “comprehensive policy 19 framework” that clearly describes the legal requirements, Dkt. 35 at 6,13 and requires 20
21 12 During the hearing, Defendant raised the factual issue that Oracle moved its headquarters out of California. Although this choice of law analysis proceeds on the assumption that Oracle was 22 headquartered in California, it is noted that this issue would be relevant for determining class definitions (such as timelines), and would only present additional hurdles in the choice of law 23 analysis for selecting California as the law to apply nationally and globally. 24 13 Compare, e.g., Facebook Tracking, 956 F.3d at 601 (describing the tests for an invasion of privacy under both the California Constitution and intrusion upon seclusion as an inquiry of two 25 elements—“whether: (1) there exists a reasonable expectation of privacy, and (2) the intrusion was highly offensive”), with, GDPR Art. 4(11) (“‘[C]onsent’ of the data subject means any freely 26 given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of 27 personal data relating to him or her.”) and id. Art. 6(1)(a) (“Processing shall be lawful only if and to the extent that at least one of the following applies: the data subject has given consent to the 1 intermediaries for consumers to bring class actions (i.e., consumers cannot do so directly). 2 Because such legal differences are significant and Plaintiffs have not explained what evidence 3 additional discovery could adduce, the choice of law analysis can be made at this juncture. 4 Accordingly, the intrusion upon seclusion claim (applying California common law) for Plaintiffs’ nationwide and global classes cannot stand. 5 H. Seventh Cause of Action: Declaratory Judgment 6 Plaintiffs’ declaratory judgment claim will rise and fall with its other claims: if Plaintiffs 7 fail to allege facts sufficient to state a claim under any other cause of action, the claim for 8 declaratory judgment will be dismissed. As not all of Plaintiffs’ claims have been dismissed, the 9 declaratory judgment claim survives to that extent. 10 I. Equitable Relief 11 Defendant cites Sonner v. Premier Nutrition Corp. for the proposition that a plaintiff 12 cannot seek equitable relief “for past harm under the UCL and CLRA” unless she first “establish 13 that she lacks an adequate remedy at law.” 971 F.3d 834, 844 (9th Cir. 2020). Under Sonner, 14 Defendant argues, Plaintiffs’ equitable claims should be dismissed, because Plaintiffs have not 15 shown they lack an adequate remedy at law. Plaintiffs respond that Sonner does not apply to their 16 request for prospective injunctive relief, nor does it bar remedies that “go beyond” damages, Dkt. 17 30 at 24, or equitable relief asserted in the alternative. 18 “[T]he import of Sonner at the pleading stage is an unsettled question of law and has given 19 rise to an intra-circuit split.” Yeomans v. World Fin. Grp. Ins. Agency, Inc., No. 19-cv-00792- 20 EMC, 2022 WL 844152, at *7 (N.D. Cal. Mar. 22, 2022) (collecting cases). Plaintiffs are correct 21 that “Sonner does not preclude a plaintiff from pleading equitable remedies in the alternative.” Id. 22 at *8. Notably, some courts have found that “Sonner has limited applicability to the pleading stage 23 because it pertained to circumstances in which a plaintiff dropped all damages claims on the eve of 24 trial,” Jeong v. Nexo Fin. LLC, No. 21-cv-02392-BLF, 2022 WL 174236, at *27 (N.D. Cal. Jan. 25 19, 2022), circumstances which do not even remotely exist here. See Yeomans, 2022 WL 844152, 26
27 processing of his or her personal data for one or more specific purposes. . . .”). 1 at *7 (“Sonner teaches that a plaintiff, on the eve of trial, cannot create an inadequacy of a legal 2 remedy by eliminating its availability by taking volitional action.”). Because the cases are 3 distinguishable, and because “[t]he issue of Plaintiff’s entitlement to seek the equitable remedy of 4 restitution may be revisited at a later stage,” Nacarino v. Chobani, LLC, No. 20-cv-07437-EMC, 2022 WL 344966, at *10 (N.D. Cal. Feb. 4, 2022), Defendant’s motion to dismiss the claims for 5 equitable relief is denied. 6 J. Motion to Strike 7 Federal Rule of Civil Procedure 12(f) permits a court to strike “any redundant, immaterial, 8 impertinent, or scandalous matter” from a pleading. The purpose of a motion to strike is primarily 9 “to avoid the expenditure of time and money that must arise from litigating spurious issues by 10 dispensing with those issues prior to trial.” Whittlestone, Inc. v. Handi-Craft Co., 618 F.3d 970, 11 973 (9th Cir. 2010) (quotation omitted). 12 Defendant’s request to strike the allegations in Paragraphs 64-65, 76-81, and 147 as 13 redundant and immaterial is not well taken. Motions to strike are “generally disfavored,” 14 XpertUniverse, Inc. v. Cisco Sys., Inc., No. 17-cv-03848-RS, 2019 WL 3413309, at *3 (N.D. Cal. 15 July 29, 2019) (citations omitted). The paragraphs in question concern topics related to Plaintiffs’ 16 allegations about Defendant—including, broadly, data brokers and data potentially available on 17 Defendant’s Data Marketplace. Contrary to Defendant’s argument, none of the information 18 contained therein presents content so prejudicial or immaterial and irrelevant as to warrant their 19 removal at this juncture. Accordingly, Defendant’s request to strike is denied. 20 V. CONCLUSION 21 In light of the above, Plaintiffs’ UCL, ECPA, unjust enrichment, and intrusion upon 22 seclusion (on behalf of the Worldwide and United States sub-classes) claims are dismissed without 23 prejudice, whereas their remaining claims—invasion of privacy, intrusion upon seclusion (for the 24 California sub-class), CIPA, declaratory judgment and equitable relief—survive, albeit some 25 barely. Defendant’s motion to strike is denied, and its request for incorporation by reference is 26 granted only as to Exhibits J and H. Plaintiffs are given 30 days to file an amended complaint. 27 1 IT IS SO ORDERED. 2 3 Dated: April 6, 2023 A RICHARD SEEBORG 5 Chief United States District Judge 6 7 8 9 10 11 e 12
13 14
15 16 € 7 6 Zz 18 19 20 21 22 23 24 25 26 27 98 ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION TO DISMISS CASE No. 22-cv-04792-RS