1 2 3 4 5 6 7 8 UNITED STATES DISTRICT COURT 9 SOUTHERN DISTRICT OF CALIFORNIA 10 11 DAVID KAUFFMAN, et al., Case No.: 22-cv-1492-L-MSB
12 Plaintiff, ORDER GRANTING IN PART AND 13 v. DENYING IN PART MOTION TO DISMISS [ECF NO. 30 ] 14 PAPA JOHN’S INTERNATIONAL, INC., 15 Defendant. 16
17 Pending before the Court in this putative class action asserting violations of the 18 California Invasion of Privacy Act (“CIPA”), Cal. Pen. Code §§ 631 and 632.7, is 19 Defendant Papa John’s International’s Motion to Dismiss. [ECF No. 30.] The Court 20 decides the matter on the papers submitted and without oral argument. See Civ. L. R. 21 7.1(d.1). For the reasons stated below, the Court grants in part and denies in part the 22 Motion to Dismiss. 23 I. FACTUAL BACKGROUND1 24 Defendant owns and operates the following website: www.papajohns.com. Over 25 the past year, David Kauffman (“Plaintiff”) and Class Members visited Defendant’s 26 27 28 1 website from cell phones and other mobile devices to purchase pizzas. Plaintiff and Class 2 Members were in California during each visit to Defendant’s website. Plaintiff used 3 Defendant’s mobile website to order pizza sold by Defendant from its location at 4089 4 Genesee Avenue, San Diego, California. Plaintiff placed the order(s) by entering 5 information on Defendant’s website, customizing his order, adding the order to his cart, 6 and making payment by entering his credit card information to complete his purchase. 7 Defendant and FullStory used session replay software which enabled it to see the 8 screens of Plaintiff and Class Members while they were on Defendant’s website. The 9 “sessions” were recorded and shared with or by FullStory. Defendant installed 10 FullStory’s session replay onto its servers and inserted the JavaScript into the HTML 11 code of its website. When consumers visit Defendant’s website, the JavaScript 12 immediately loads onto their device, from Defendant’s site, and is stored in their device’s 13 cache or temporary internet files. As soon as Defendant’s site loaded on Plaintiff’s cell 14 phone, Plaintiff’s phone began sending and receiving electronic communications in the 15 form of instructions to and from Defendant’s computer servers utilized to operate its 16 website. The commands were sent as messages indicating to Defendant what words and 17 text were typed, credit card number, CVV, billing zip code, first name, last name, phone 18 number, address, email address, any search terms entered, and what content was being 19 clicked, requested, and inputted by Plaintiff including what food he was ordering to be 20 delivered to his home in California from the Genesee Avenue Papa John’s location. 21 II. PROCEDURAL BACKGROUND 22 On October 3, 2022, Plaintiff filed a Complaint asserting violations of the Federal 23 Wiretap Act, 18 U.S.C. §2510 et seq (the “Wiretap Act”) and the California Invasion of 24 Privacy Act (“CIPA”), Cal. Pen. Code § 631, in relation to the unauthorized interception, 25 collection, recording, and dissemination of Plaintiff’s and Class Members’ 26 communications and data. [ECF No. 1.] On January 26, 2023, Plaintiffs filed a First 27 Amended Complaint asserting violations of the Federal Wiretap Act, 18 U.S.C. §2510 et 28 seq and CIPA, Cal. Pen. Code §§ 631 and 632. [ECF No. 22.] On April 10, 2023, 1 Plaintiffs filed a Second Amended Complaint asserting violations of CIPA, Cal. Pen. 2 Code §§ 631 and 632.7. [ECF No. 29.] 3 On April 24, 2023, Defendant filed the present Motion to Dismiss. (Motion [ECF 4 No. 30.]) On May 8, 2023, Plaintiffs filed a response in opposition. (Opposition [ECF 5 No. 31.]) On May 15, 2023, Defendants filed a Reply. [ECF No. 32.]) 6 III. DISCUSSION 7 Defendant seeks dismissal of this action for lack of personal jurisdiction and 8 failure to state a claim. 9 A. Personal Jurisdiction 10 Where a defendant moves to dismiss for lack of personal jurisdiction, it “is the 11 plaintiff’s burden to establish the court’s personal jurisdiction over a defendant.” Doe v. 12 Unocal, 248 F.3d 915, 922 (9th Cir. 2001)(abrogated on other grounds) (citing Cubbage 13 v. Merchent, 744 F.2d 665, 667 (9th Cir. 1984), cert. denied 470 U.S. 1005 (1985)). To 14 withstand a motion to dismiss under Fed. R. Civ. P. 12(b)(2), the plaintiff need only 15 demonstrate facts that if true, would support jurisdiction over the defendant. Id. 16 Although the plaintiff cannot “simply rest on the bare allegations of the complaint,” 17 uncontroverted allegations contained in the complaint must be taken as true. 18 Schwarzenegger v. Fred Martin Motor Co., 374 F.3d 797, 800 (9th Cir. 2004). 19 A district court has personal jurisdiction over a defendant only if a statute 20 authorizes jurisdiction and the assertion of jurisdiction does not offend due process. 21 Unocal, 248 F.3d at 922. “Where . . . there is no applicable federal statute governing 22 personal jurisdiction, the district court applies the law of the state in which the district 23 court sits.” Yahoo! Inc., v. La Ligue Contre Le Racisme Et L’Antisemitisme, 433 F.3d 24 1199, 1205 (9th Cir. 2006); see also Fed. R. Civ. P. 4(k)(1)(a). Because California’s 25 long-arm statute is coextensive with federal due-process requirements, the jurisdictional 26 analyses under state and federal law are the same. Yahoo!, Inc., 433 F.3d at 1205; Cal. 27 Civ. Proc. Code § 410.10. 28 1 Absent traditional bases for personal jurisdiction (i.e. physical presence, domicile, 2 and consent), the Due Process Clause requires that a nonresident defendant have certain 3 minimum contacts with the forum state such that the exercise of personal jurisdiction 4 does not offend traditional notions of fair play and substantial justice. Int’l Shoe Co. v. 5 Washington, 326 U.S. 310, 316 (1945). Depending upon the level of contacts with the 6 forum state, personal jurisdiction can be “general” or “specific”. See Helicopteros 7 Nacionales de Colombia, S.A. v. Hall, 466 U.S. 408, 414 n. 8 (1984). A court may assert 8 general personal jurisdiction over a corporation "when their affiliations with the State are 9 so 'continuous and systematic' as to render them essentially at home in the forum State." 10 Goodyear Dunlop Tires Operations, S.A. v. Brown, 564 U.S. 915, 919 (2011). “[I]n the 11 paradigmatic circumstance for exercising general jurisdiction, the corporate defendant is 12 incorporated or has its principal place of business in the forum state.” Williams v. 13 Yamaha Motor Co., 851 F.3d1015, 1020 (9th Cir. 2017). The Second Amended 14 Complaint implicates only specific, not general jurisdiction because Papa John’s is a 15 Delaware corporation with its principal place of business in Kentucky. See Williams, 851 16 F.3d at 1020. 17 For specific jurisdiction to apply: 18 (1) The non-resident defendant must purposefully direct his activities or consummate some transaction with the forum or resident thereof; or perform 19 some act by which he purposefully avails himself of the privilege of 20 conducting activities in the forum, thereby invoking the benefits and protections of its laws; 21 22 (2) the claim must be one which arises out of or relates to the defendant's forum-related activities; and 23 24 (3) the exercise of jurisdiction must comport with fair play and substantial justice, i.e. it must be reasonable. 25 26 Schwarzenegger, 374 F.3d at 802. 27 Plaintiff bears the burden of satisfying the first two prongs of the test. Id. If 28 plaintiff succeeds in satisfying both prongs, the burden shifts to the defendant to present a 1 “compelling case” that the exercise of jurisdiction would not be reasonable. Id. “If the 2 plaintiff fails to satisfy either of these prongs, personal jurisdiction is not established in 3 the forum state.” Id. 4 1. Purposeful Availment/Direction 5 The phrase “purposeful availment” includes both purposeful availment, which is 6 most often used in contract suits, and purposeful direction, which is most often used in 7 tort causes of action such as the present claims. Schwarzenegger, 674 F.3d at 802. “A 8 showing that a defendant purposefully directed his conduct toward a forum state . . . 9 usually consists of evidence of the defendant's actions outside the forum state that are 10 directed at the forum, such as the distribution in the forum state of goods originating 11 elsewhere.” Id. at 803. Purposeful direction is evaluated under the three-part “effects” 12 test originating with Calder v. Jones, 465 U.S. 783 (1984). Id. Under Calder, the 13 defendant must “have 1) committed an intentional act, (2) expressly aimed at the forum 14 state, (3) causing harm that the defendant knows is likely to be suffered in the forum 15 state.” Dole Foods Co., Inc., v. Watts, 303 F.3d 1104, 1111 (9th Cir. 2002). 16 According to Defendant, Plaintiff fails to show that Papa John’s “operation of a 17 nationally accessible website and its alleged use of session replay technology on that 18 website” are expressly aimed at California or distinguish California from other states 19 where the website is accessible. (Mot. at 6). In addition, Defendant contends that the 20 automatic location services on Papa John’s website and California-specific provisions in 21 the Privacy Statement do not indicate that Papa John’s specifically aimed its conduct at 22 California residents. (Id. at 7). According to Defendant, the complaint lacks allegations 23 that show any of Papa John’s acts were more likely to cause harm in California than any 24 other forum. (Id. at 8). 25 Plaintiff counters that all three of the “purposeful direction” elements are satisfied 26 here: (1) Defendant committed an intentional act by operating numerous restaurants in 27 conjunction with its website to sell pizza to individuals in California and imbedded the 28 website with session replay code; (2) Defendant expressly aimed conduct at California by 1 using a website that was integrated with the operation of retail outlets and franchises; and 2 (3) Defendant knew that harm was likely to be suffered in California by the collection of 3 personal data via FullStory’s session replay code. (Oppo. at 6-8). 4 Plaintiff has satisfied the first element because the Complaint sufficiently alleges 5 that Defendant committed an intentional act by operating restaurants in California from 6 which customers purchase food via the website, and that Papa John’s intentionally 7 embedded the website with session replay technology See Schwarzenegger, 374 F.3d at 8 806 (For purposes of Calder test, “intent” is construed as “an intent to perform an actual, 9 physical act in the real world, rather than an intent to accomplish a result or consequence 10 of that act.”) 11 Turning to the “express aiming” prong, “[n]ot all material placed on the Internet is, 12 solely by virtue of its universal accessibility, expressly aimed at every state in which it is 13 accessed.” Mavrix Photo, Inc. v. Brand Technologies, Inc., 647 F.3d 1218, 1231 (9th Cir. 14 2011). While the operation of “a passive website alone cannot satisfy the express aiming 15 prong,” the operation of a website in conjunction with “something more” including the 16 “interactivity of the defendant’s website [and] the geographic scope of the defendant’s 17 commercial ambitions” can satisfy this prong. Id. at 1229. It is undisputed that Defendant 18 operates the interactive website www.papajohns.com, that allows California users to 19 peruse menus, place orders, and pay for food from Papa John retail stores as part of its 20 regular course of business. The Complaint claims that “Defendant chose to benefit from 21 marketing and doing business in California” and cites to the website to illustrate that 22 California residents were targeted by Defendant. (SAC at ¶¶ 33, 41 n. 7). The landing 23 page notes “Menu, Special Offers and Pricing may vary for each Papa Johns location.”2 24 Papa John’s website https://www.papajohns.com/order/stores-near-me (last visited 25
26 2 “A court may … consider certain materials—documents attached to the complaint, documents 27 incorporated by reference in the complaint, or matters of judicial notice—without converting the motion to dismiss into a motion for summary judgment.” United States v. Ritchie, 342 F.3d 903, 908 (9th Cir. 28 1 January 8, 2024). Plaintiff also claims that Defendant “included California-specific 2 provisions in its Privacy Statement in recognition that California citizens would be using 3 Defendant’s website” which subjects Defendant to California law. (SAC ¶ 35). 4 These assertions sufficiently allege that Defendant operates an interactive website 5 which is integrated with retail outlets in California, therefore Papa John’s is carrying on 6 part of its general business in California by marshaling the market via its website. This 7 satisfies the “something more” requirement to demonstrate that Defendant “expressly 8 aimed” its conduct at California. See Mavrix, 647 F.3d at 1231 (“where, as here, a 9 website with national viewership and scope appeals to, and profits from, an audience in a 10 particular state, the site's operators can be said to have ‘expressly aimed’ at that state.”) 11 The final element requires Plaintiff to show that Papa John’s was aware that the 12 alleged harm was likely to be suffered in California. To show that Papa John’s knew its 13 conduct was likely to cause harm in California, Plaintiff must show that Papa John’s 14 knew of his connection to California. See generally, Bergstein v. Parmar, 2014 WL 15 12586073, at * 3-4 (C.D. Cal. June 23, 2014)(Plaintiff satisfied third element where 16 defendant was aware that plaintiff “lived and worked in California” and that plaintiff 17 suffered harm in California as a result of defendant’s conduct.) In the Complaint, Plaintiff 18 asserts that Defendant knew the harm caused by the session replay recording would be 19 suffered by Californians because 20 [m]any Californians purchase items on Defendant’s site and enter their California addresses. Another way Defendant knows a consumer is located in California is 21 through location-determining tools that track and analyze users’ IP addresses, 22 without requiring the user to manually input a physical address. The employment of automatic location services in this way means that Defendant is continuously 23 aware that its website is being visited by people located in California to buy 24 Defendant’s products in California, and that such website visitors are being tapped and recorded in violation of California statutory law, causing privacy harm to 25 California citizens. 26 (SAC ¶ 34). 27 28 1 Defendant claims that auto-location functionalities are insufficient to meet Plaintiff’s 2 burden under AMA Multimedia, LLC v. Wanat, 970 F.3d 1201, 1211 (9th Cir. 2020), but 3 the issue in AMA was “geo-located advertisements” which did not operate in the same 4 manner as the Papa John’s session replay technology which employs geo-tracking to 5 target specials to California residents and find the nearest restaurant for delivery 6 purposes. Accordingly, the Court finds that Plaintiff has sufficiently alleged for purposes 7 of this motion that California residents were the focal point of Papa John’s target 8 marketing via its website and that they knew Californians would suffer the alleged harm. 9 2. Arise out of or Relate to Defendant’s Conduct 10 The Ninth Circuit distinguishes between “passive” and “interactive” websites when 11 determining whether a claim arises out of a Defendant’s operation of a nationally 12 accessible internet cite. See Cybersell, Inc., v. Cybersell, Inc., 130 F.3d 414, 418 (9th Cir. 13 1997). “Courts that have addressed interactive sites have looked to the ‘level of 14 interactivity and commercial nature of the exchange of information that occurs on the 15 Web site’ to determine if sufficient contacts exist to warrant the exercise of jurisdiction.” 16 Id. 17 Defendant claims that Plaintiff has failed to establish that his claims arise out of or 18 relate to Papa John’s contacts with the forum because the complaint lacks any factual 19 detail specifically linking Plaintiff’s claim to California, except for the allegation that 20 Plaintiff chose to access the website from within California. (Mot. at 9). Instead, 21 Defendant argues that the “relevant conduct” is Papa John’s operation of a nationally 22 accessible website and alleged use of session replay technology on that website but that 23 conduct did not occur within California and is therefore insufficient to authorize 24 jurisdiction. (Id.) 25 In response, Plaintiff contends that Defendant uses its website to systematically 26 serve the California market by directing “California customers to its numerous 27 restaurants in the state and offers specific menus and offers to California residents” which 28 1 forms the basis for specific jurisdiction under Ford Motor Company v. Montana Eighth 2 Judicial District Court, 141 S.Ct. 1017, 1026 (2021). (Oppo. at 9). 3 Plaintiff has alleged facts demonstrating that Defendant’s website is interactive 4 because it allows customers to obtain information about Defendant’s menu, order 5 products, and receive delivery of those products in California at a restaurant closest to the 6 customer’s location. In the Complaint, Plaintiff asserts that Defendant directed 7 “purposeful and tortious acts toward the citizens of California” by doing business and 8 engaging in commercial activity with California citizens via the website which was 9 viewing and collecting information from California residents. (SAC at ¶ 33). Under 10 Cybersell, these facts support Plaintiff’s argument that his claims “arise out of or relate 11 to” Defendant’s deployment of session replay technology on its website. 12 Defendant’s argument that the “relevant conduct” is the “operation of a nationally 13 accessible website and alleged use of ‘session replay’ technology on that website” too 14 narrowly frames the scope of the inquiry. In Ford Motor Company, the Supreme Court 15 emphasized that the “arises out of or relates to” test “contemplates that some 16 relationships will support jurisdiction without a causal showing.” Although doctrinal 17 questions bearing on the applicability of the “related to” test with regard to internet 18 transactions were left for another day, nothing in the Ford opinion bars application of the 19 general proposition to these facts. Id. at 1028, n. 4. For purposes of the motion to dismiss, 20 Plaintiff has sufficiently alleged that the claims “arise out of or relate to” Defendant’s 21 conduct. 22 Plaintiff has successfully satisfied both prongs of the personal jurisdiction test, and 23 Defendant has not presented a “compelling case” that the exercise of jurisdiction would 24 not be reasonable. Schwarzenegger, 374 F.3d at 802. Accordingly, the Court denies 25 Defendant’s motion to dismiss for lack of personal jurisdiction. 26 B. Failure to State a Claim 27 A 12(b)(6) motion to dismiss tests the sufficiency of the complaint. Navarro v. 28 Block, 250 F.3d 729, 732 (9th Cir. 2001). A pleading must contain, in part, “a short and 1 plain statement of the claim showing that the pleader is entitled to relief.” Fed. R. Civ. P. 2 8(a)(2). But plaintiffs must also plead “enough facts to state a claim to relief that is 3 plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007); see also 4 Fed. R. Civ. P. 12(b)(6). The plausibility standard demands more than “a formulaic 5 recitation of the elements of a cause of action,” or “ ‘naked assertions’ devoid of ‘further 6 factual enhancement.’ ” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Twombly, 7 550 U.S. at 557). Instead, the complaint “must contain allegations of underlying facts 8 sufficient to give fair notice and to enable the opposing party to defend itself effectively.” 9 Starr v. Baca, 652 F.3d 1202, 1216 (9th Cir. 2011). 10 In reviewing a 12(b)(6) motion to dismiss, “[a]ll allegations of material fact are 11 taken as true and construed in the light most favorable to the nonmoving party.” Cahill v. 12 Liberty Mut. Ins. Co., 80 F.3d 336, 337–38 (9th Cir. 1996). However, a court need not 13 take legal conclusions as true merely because they are cast in the form of factual 14 allegations. See Roberts v. Corrothers, 812 F.2d 1173, 1177 (9th Cir. 1987). Similarly, 15 “conclusory allegations of law and unwarranted inferences are not sufficient to defeat a 16 motion to dismiss.” Pareto v. FDIC, 139 F.3d 696, 699 (9th Cir. 1998). 17 1. Consent 18 Defendant argues that Plaintiff cannot state a claim under either provision of the 19 CIPA because he fails to plead facts establishing lack of consent to Defendant’s actions. 20 (Mot. at 10 [ECF No. 30.]) Specifically, Defendant argues that each time Plaintiff placed 21 an order on the website, he checked a box that confirmed he understood and agreed that 22 his information would be collected and used as described in the Privacy Policy. (Id. at 10- 23 11). That Privacy Policy was hyperlinked on every page of the website and disclosed 24 Papa John’s data collection practice along with use of vendors. (Reply at 5). According to 25 Defendant, Plaintiff must do more than merely allege lack of consent such as alleging 26 additional facts showing Plaintiff did not have actual or constructive knowledge of the 27 Privacy Policy. (Id.) Defendant claims that Plaintiff did not elect to have his data deleted 28 despite being presented with that option in the Privacy Policy, and he continued to use the 1 website, showing at a minimum his implied consent. (Id. at 11). Defendant further 2 contends that Plaintiff’s prior complaints suggested he placed orders online before 3 October 3, 2022, outside CIPA’s one-year statute of limitations period, making it 4 implausible that he did not consent to any data collection that occurred after October 3, 5 2022. (Id. at 12 n. 4). 6 In response, Plaintiff argues that Defendant's consent defense turns on the outcome 7 of multiple factual disputes which defeat dismissal at this stage, such as whether Plaintiff 8 actually saw the privacy policy link on the website pages, what the link looked like, and 9 whether the privacy policy adequately discloses that it uses session replay recording 10 code. (Oppo. at 11). In addition, Plaintiff claims that reliance on the Privacy Policy is 11 insufficient to show consent because it appears as a “browsewrap” agreement which does 12 not require the user to expressly “manifest assent to the terms and conditions.” (Id.) 13 In the Complaint, Plaintiff clearly states that “Defendant never sought consent, and 14 Plaintiff and Class Members never provided consent, for the unauthorized access and 15 reading and recording of their electronic communications prior to it occurring.” (SAC at ¶ 16 76). This is sufficient to meet his burden to plead that he did not provide prior consent to 17 the recording. See Javier v. Assurance IQ, LLC, No. 21-16351, 2022 WL 1744107, at *2 18 (9th Cir. May 31, 2022) (holding that the plaintiff met his pleading burden by alleging 19 that he did not provide express consent.) Moreover, the factual disputes regarding 20 whether Plaintiff actually saw the Privacy Policy and consented to it are not suitable for 21 resolution at this stage in the proceedings. See In re Tracht Gut, LLC, 836 F.3d 1146, 22 1150 (9th Cir. 2016) (“At the motion to dismiss phase, the trial court must accept as true 23 all facts alleged in the complaint and draw all reasonable inferences in favor of the 24 plaintiff.”) As a result, the Court declines to dismiss Plaintiff's CIPA claims based on 25 consent. 26 // 27 // 28 1 2. First Cause of Action- Violation of the California Invasion of Privacy Act, 2 Cal Penal Code § 631 3 Section 631(a) of the California Penal Code provides for civil and criminal liability 4 where: 5 Any person who, by means of any machine, instrument, or contrivance, or any other matter, intentionally taps, or makes any unauthorized connection, 6 whether physically, electrically, acoustically, inductively, or otherwise, with 7 any telegraph or telephone wire, line, cable, or instrument, including the wire, line, cable. Or instrument of any internal telephonic communication 8 system, or who willfully and without consent of all parties to the 9 communication, or in any unauthorized manner, reads, or attempts to read, or to learn the contents or meaning of any message, report, or 10 communication while the same is in transit or passing over any wire, line, or 11 cable, or is being sent from, or received at any place within this state; or who uses, or attempts to use, in any manner, or for any purpose, or to 12 communicate in any way, any information so obtained, or who aids, agrees 13 with, employs, or conspires with any person or persons to unlawfully do, or permit, or cause to be done any of the acts or things mentioned above in this 14 section” [violates this section]. 15 Cal. Penal Code § 631(a). 16 17 a) Party Exception 18 Defendant argues that Plaintiff cannot state a claim under section 631 because 19 Papa John’s was a party to the communication and any alleged interception is permitted 20 under the “party exception”. (Mot. at 13). Plaintiff asserts that the party exception does 21 not apply because the claim is based on derivative liability alleging that Defendant aided 22 and abetted FullStory, who is not a party to the communications. (Oppo. at 14). 23 “Courts perform the same analysis for both the Wiretap Act and CIPA regarding 24 the party exemption.” In re Facebook, Inc., v Internet Tracking Litigation, 956 F.3d 589, 25 607 (9th Cir. 2020). Only a third party can “eavesdrop” on a conversation, therefore a 26 party to the communication is exempt from liability under section 631. See Warden v. 27 Kahn, 99 Cal.App.3d 805, 811 (Ct. App. 1979). “The party exception must be considered 28 in the technical context of [a] case.” In re Facebook, 956 F.3d at 607. District courts in 1 California addressing the party exception have disagreed with Papa John’s argument: 2 “[I]t cannot be that anyone who receives a direct signal escapes liability by becoming a 3 party to the communication. Someone who presses up against a door to listen to a 4 conversation is no less an eavesdropper just because the sound waves from the next room 5 reach his ears directly.” Revitch v. New Moosejaw, LLC, 2019 WL 5485330, at *2 (N.D. 6 Cal. Oct. 23, 2019). In contrast, another Northern District of California court held that a 7 tracking service provider was considered a participant in the conversation under § 631(a) 8 because that defendant only stored user’s data and did not use or resell that data, unlike 9 the Moosejaw defendant. See Graham v. Noom, Inc., 533 F.Supp.3d 823, 833–34 (N.D. 10 Cal. Apr. 8, 2021). In Graham, the court reasoned that the tracking defendant provided a 11 tool, like a tape recorder, and therefore was not an eavesdropper. Id. at 833. Whether 12 FullStory acts akin to a tape recorder or whether its actions are closer to “an eavesdropper 13 standing outside the door” is a question of fact which is better answered after discovery 14 into the session replay technical context of the case. See In re Facebook, 956 F.3d at 607; 15 Yoon v. Lululemon USA, Inc., 1081 (C.D. Cal. 2021). 16 b) Intentional Wiretapping 17 According to Defendant, Plaintiff has not alleged that Defendant engaged in 18 intentional wiretapping under the first clause of section 631(a) because online 19 communications between a website and a visitor do not qualify. (Id. at 16). Plaintiff 20 counters that the second prong of section 631(a) applies to internet communication, citing 21 Javier, 2022 WL 1744107. (Oppo. at 16-17). 22 For Plaintiff to invoke the first clause of Section 631(a) which addresses 23 intentional wiretapping, he must allege facts plausibly showing that Papa John’s or its 24 vendor made an unauthorized connection with a “telegraph or telephone wire, line, cable, 25 or instrument.” Cal. Penal Code § 631(a). In an unpublished decision, the Ninth Circuit 26 has indicated that “Section 631(a) applies to Internet communications” despite being 27 written in terms of wiretapping. Javier, 2022 WL 1744107 at 1. In contrast, some district 28 courts in the Ninth Circuit have found that the first clause of Section 631(a) does not 1 apply to internet communications because the clause states that it applies only to 2 telegraphic or telephone wire communications. See Byars v. Hot Topic, Inc., 656 3 F.Supp.3d 1051, 1065 n.8 (C.D. Cal. Feb. 14, 2023). 4 In Javier, the Court initially addressed the second clause of Section 631(a) but 5 included language indicating that the holding applied to both clauses when it stated that 6 “[t]hough written in terms of wiretapping, §631(a) applies to internet communications.” 7 Javier, 2022 WL 1744107 at 1. Reading the first clause of Section 631 to apply only to 8 communications through a wire ignores the fact that a statute may be read to apply to new 9 technologies “where such a reading would not conflict with the statutory scheme.” 10 Matera v. Google, Inc., 2016 WL 8200619 (N.D. Cal. Aug. 12, 2016)(citing Apple Inc., 11 v. Superior Court, 56 Cal.4th 128, 137 (2013)(“Fidelity to legislative intent does not 12 ‘make it impossible to apply a legal text to technologies that did not exist when the text 13 was created.... Drafters of every era know that technological advances will proceed apace 14 and that the rules they create will one day apply to all sorts of circumstances they could 15 not possibly envision.”) For purposes of the present motion, the Court finds that Plaintiff 16 has plausibly alleged a cause of action under the first clause of Section 631(a) and denies 17 Defendant’s motion to dismiss on this ground. 18 c) Contents of Communication 19 Finally, Defendant argues that the claim must be dismissed because Papa John’s 20 did not acquire the “contents” of a communication, as required under the second clause of 21 section 631. (Id. at 17-18). 22 For purposes of Section 631(a)’s second clause Plaintiff must allege that Papa 23 John’s or its vendor “read, or attempts to read, or to learn the contents or meaning of any 24 message, report, or communication.” Cal. Penal Code § 631(a). Courts analyzing CIPA 25 claims apply the same definitions for the federal Wiretap Act where appropriate. Saleh v. 26 Nike, Inc., 562 F.Supp.3d 503, 517 (C.D. Cal. 2021). “The Ninth Circuit has held that the 27 ‘contents’ of an online communication under federal wiretap law ‘refers to the intended 28 message conveyed by the communication, and does not include record information 1 regarding the characteristics of the message that is generated in the course of the 2 communication.’” Yoon, 549 F.Supp.3d at 1082 (citing In re Zynga Priv. Litig., 750 F.3d 3 1098, 1106 (9th Cir. 2014). 4 Here, Plaintiff asserted in the Complaint that: 5 [b]y using the spyware, Defendant and FullStory were able to learn much 6 more about Plaintiff and class members including the pages and content they viewed, their scroll movements, words and text typed even if not fully 7 entered, copy and paste actions, search terms (including what pizza sold by 8 Defendant were available at the Genesee Avenue location in San Diego, California) even if not fully entered, mouse clicks and movements, 9 keystrokes, and all other information related to the visit. Defendant tracked 10 and recorded similar communications of other Class Members. 11 (SAC at ¶ 42.) 12 Taking these allegations as true, the Court finds that Plaintiff has sufficiently 13 alleged that Defendant intercepts the contents of internet communication rather than 14 simply “record” information for purposes of the present motion. See Cahill, 80 F.3d 336, 15 337–38. For the above reasons, Plaintiff’s Complaint is sufficient to state a cause of 16 action under the second clause of Section 631(a) and the Court denies Defendant’s 17 motion to dismiss on this ground. 18 3. Second Cause of Action- Violation of California Invasion of Privacy Act- 19 California Penal Code 632.7 20 Defendant moves to dismiss Plaintiff’s second cause of action claiming that 21 Plaintiff does not allege the communication involved two telephones as required under 22 section 632.7. Further, Defendant argues that it is not clear whether the cell phone 23 Plaintiff used can be considered a “phone” within the meaning of Section 632.7 because 24 he used it as a smartphone with mobile browsing functionality to access the website. 25 (Mot. at 19). 26 Section 632.7 imposes liability on anyone who aids in the interception and 27 intentional recording of “a communication transmitted between two cellular radio 28 1 telephones, a cellular radio telephone and a landline telephone, two cordless telephones, a 2 cordless telephone and a landline telephone, or a cordless telephone and a cellular radio 3 telephone.” In interpreting a California statute, the Court “first looks to the language of 4 the statute, giving effect to the words’ plain meaning; ‘if the language is unambiguous, 5 the plain meaning controls.’” Gonzales v. CarMax Auto Superstores, LLC, 840 F.3d 644, 6 650 (9th Cir. 2016) (quoting Voices of the Wetlands v. State Water Res. Control Bd., 257 7 P.3d 81, 93 (2011)). “A statute's plain meaning, however, cannot be determined without 8 reference to the context in which the words are used.” Id. 9 The Court finds that the plain language of section 632.7 limits the applicability of 10 the statute to communications between certain types of telephones, not the internet, and 11 Plaintiff did not allege that the communication was between two telephones as required 12 by statute. See Garcia v. Build.com, Inc., No. 22-CV-01985-DMS-KSC, 2023 WL 13 4535531, at *6 (S.D. Cal. July 13, 2023) (dismissing a section 632.7 claim where 14 “Plaintiff makes no persuasive argument that the statute contemplates internet 15 communications between a smart phone and an unspecified device on Defendant's end” 16 (quotation omitted)). Indeed, “[t]ransmission by internet through a device called ‘phone’ 17 is not sufficient.” Id. Accordingly, Defendant's motion to dismiss Plaintiff's second cause 18 of action is granted with leave to amend. See Knappenberger v. City of Phoenix, 566 F.3d 19 936, 942 (9th Cir. 2009) (“Leave to amend should be granted unless the district court 20 determines that the pleading could not possibly be cured by the allegation of other facts.” 21 (quotation omitted)). 22 C. Standing for Injunctive Relief 23 Defendant argues that Plaintiff lacks standing to seek injunctive relief because he 24 does not and cannot allege he will again visit the Papa John’s website without knowing 25 about its use of session replay technology, therefore he cannot be wronged again in the 26 manner alleged in the SAC. (Mot. at 20). 27 28 1 To successfully assert a claim for injunctive relief, a plaintiff must contend that, 2 despite knowledge of the asserted violative conduct, he or she may suffer an “actual and 3 imminent” threat of future harm. See Graham, 533 F.Supp.3d at 836. 4 [A] previously deceived consumer may have standing to seek an injunction against false advertising or labeling, even though the consumer now knows 5 or suspects that the advertising was false at the time of the original purchase, 6 because the consumer may suffer an “actual and imminent, not conjectural or hypothetical” threat of future harm. Knowledge that the advertisement or 7 label was false in the past does not equate to knowledge that it will remain 8 false in the future. In some cases, the threat of future harm may be the consumer's plausible allegations that she will be unable to rely on the 9 product's advertising or labeling in the future, and so will not purchase the 10 product although she would like to. 11 Davidson v. Kimberley-Clark Corporation, 889 F.3d 956, 969 (9th Cir. 2018)(internal 12 citations omitted). 13 Plaintiff has not sufficiently alleged that he and the class he seeks to represent 14 intend to visit the site in the future. The Complaint merely avers that “The past invasions 15 were actual and future invasions are imminent and will occur next time Plaintiff visits 16 Defendant’s website.” (SAC at ¶ 92). Plaintiff’s request for injunctive relief is dismissed 17 with leave to amend. 18 // 19 // 20 // 21 // 22 // 23 // 24 // 25 // 26 // 27 // 28 1 IV. CONCLUSION AND ORDER 2 For the forgoing reasons, Defendant's motion to dismiss Plaintiff's complaint for 3 || lack of personal jurisdiction is DENIED. Further, Defendant’s motion to dismiss the first 4 || cause of action for violation of section 631 of the California Penal Code is DENIED. 5 || Defendant's motion to dismiss Plaintiff's second cause of action for violation of section 6 || 632.7 of the California Penal Code is GRANTED with leave to amend. Defendant’s 7 motion to dismiss Plaintiff's request for injunctive relief is GRANTED and the claim is 8 || dismissed with leave to amend. 9 IT IS SO ORDERED. 10 || Dated: January 12, 2024 fee Soop 12 H . James Lorenz, 3 United States District Judge
14 15 16 17 18 19 20 21 22 23 24 25 26 27 28
1°