Lightoller v. JetBlue Airways Corporation

Opinion

ANNE LIGHTOLLER, individually and Case No.: 23-cv-00361-H-KSC on behalf of all others similarly situated, ORDER GRANTING DEFENDANT’S Plaintiff, v. [Doc. No. 6.] JETBLUE AIRWAYS CORPORATION, Defendant.

On April 25, 2023, Defendant Jetblue Airways Corporation filed a motion to dismiss Plaintiff Anne Lightoller’s complaint pursuant to Federal Rules of Civil Procedure 12(b)(1) and 12(b)(6). (Doc. No. 6.) On May 16, 2023, Plaintiff filed a response in opposition to Defendant’s motion to dismiss. (Doc. No. 12.) On May 23, 2023, Defendant filed a reply. (Doc. No. 13.) A hearing on Defendant’s motion to dismiss is currently scheduled for Monday, June 26, 2023 at 10:30 a.m. The Court, pursuant to its discretion under Civil Local Rule 7.1(d)(1), determines the matter is appropriate for resolution without oral argument, submits the motion on the parties’ papers, and vacates the hearing. For the reasons below, the Court grants Defendant’s motion to dismiss. Background The following background is based on the allegations in Plaintiff’s complaint. Defendant is a commercial airline that provides both national and international flights to the public. (Doc. No. 1, Compl. ¶ 42.) Defendant operates the website, www.jetblue.com. (Id.) Defendant procures and embeds various Session Reply Code – from third-party Session Reply Providers, including FullStory – on Defendant’s website to track and analyze website user interactions with the website. (Id. ¶¶ 43-44.) Session Replay Code enables website operators to record, save, and replay a website visitor’s interactions with a given website, including “mouse movements, clicks, keystrokes (such as text being entered into an information field or text box), URLs of webpages visited, and/or other electronic communications in real-time.” (Id. ¶¶ 1, 22; see also id. ¶¶ 24-25.) Once the events have been recorded by a Session Replay Code, a website operator can view a visual reenactment of the user’s visit through the Session Replay Provider, usually in the form of a video. (Id. ¶ 27.) Plaintiff visited Defendant’s website to “obtain information on flight pricing.” (Id. ¶ 48.) During her visit, Plaintiff’s communications were captured by Session Replay Code and sent to various Session Replay Providers. (Id. ¶ 51.) Plaintiff alleges that Defendant’s conduct violates the California Invasion of Privacy Act (“CIPA”), California Penal Code § 630 et. seq., and constitutes the tort of invasion of privacy rights and intrusion upon seclusion. (Id. ¶ 3.) On February 24, 2023, Plaintiff filed a class action complaint against Defendant, alleging claims for: (1) violation of CIPA; and (2) invasion of privacy – intrusion upon seclusion. (Doc. No. 1, Compl. ¶¶ 73-98.) By the present motion, Defendant moves to dismiss Plaintiff’s complaint pursuant to Federal Rule of Civil Procedure 12(b)(1) for lack of subject matter jurisdiction and pursuant to Federal Rule of Civil Procedure 12(b)(6) for failure to state a claim. (Doc. No. 6 at 6-21.) / / / / / / Discussion Defendant moves pursuant to Federal Rule of Civil Procedure 12(b)(1) to dismiss Plaintiff’s complaint for lack of subject matter jurisdiction. (Doc. No. 6 at 6-9.) Specifically, Defendant argues that Plaintiff lacks standing to bring her claims because she has failed to establish that she suffered an injury in fact. (See id.) I. Legal Standards for a Rule 12(b)(1) Motion to Dismiss Federal Rule of Civil Procedure 12(b)(1) authorizes a court to dismiss claims for lack of subject matter jurisdiction. “Rule 12(b)(1) jurisdictional attacks can be either facial or factual.” White v. Lee, 227 F.3d 1214, 1242 (9th Cir. 2000). “In a facial attack, the challenger asserts that the allegations contained in a complaint are insufficient on their face to invoke federal jurisdiction. By contrast, in a factual attack, the challenger disputes the truth of the allegations that, by themselves, would otherwise invoke federal jurisdiction.” Safe Air for Everyone v. Meyer, 373 F.3d 1035, 1039 (9th Cir. 2004). Here, Defendant’s Rule 12(b)(1) motion focuses solely on the allegations in Plaintiff’s complaint, and, thus, Defendant makes a facial attack under Rule 12(b)(1). (See Doc. No. 6 at 6-9.) “In deciding a Rule 12(b)(1) facial attack motion, a court must assume the facts alleged in the complaint to be true and construe them in the light most favorable to the nonmoving party.” Strojnik v. Kapalua Land Co. Ltd., 379 F. Supp. 3d 1078, 1082 (D. Haw. 2019) (citing Warren v. Fox Family Worldwide, Inc., 328 F.3d 1136, 1139 (9th Cir. 2003)); see Savage v. Glendale Union High Sch., Dist. No. 205, Maricopa Cty., 343 F.3d 1036, 1039 (9th Cir. 2003); Rimac v. Duncan, 319 F. App’x 535, 536 (9th Cir. 2009). II. Analysis Defendant argues that Plaintiff lacks Article III standing to bring her claims in this action because she has failed to adequately allege that she suffered an injury in fact – specifically, that she suffered a concrete harm. (Doc. No. 6 at 7-9.) In response, Plaintiff asserts that she sufficiently alleges an injury in fact. (Doc. No. 12 at 5-7.) Article III of the Constitution “confines the federal judicial power to the resolution of ‘Cases’ and ‘Controversies.’” TransUnion LLC v. Ramirez, 141 S. Ct. 2190, 2203 (2021). “For there to be a case or controversy under Article III, the plaintiff must have a personal stake in the case—in other words, standing.” Id. “[T]he ‘irreducible constitutional minimum’ of standing consists of three elements.” Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016) (quoting Lujan v. Defenders of Wildlife, 504 U.S. 555, 560 (1992)). To establish standing, “a plaintiff must show (i) that he suffered an injury in fact that is concrete, particularized, and actual or imminent; (ii) that the injury was likely caused by the defendant; and (iii) that the injury would likely be redressed by judicial relief.” TransUnion, 141 S. Ct. at 2203 (citing Lujan, 504 U.S. at 560–61). “The plaintiff, as the party invoking federal jurisdiction, bears the burden of establishing these elements.” Spokeo, 578 U.S. at 338. Further, “‘[t]hat a suit may be a class action . . . adds nothing to the question of standing, for even named plaintiffs who represent a class must allege and show that they personally have been injured, not that injury has been suffered by other, unidentified members of the class to which they belong.’” Id. at 338 n. 6 (quoting Simon v. Eastern Ky. Welfare Rights Organization, 426 U.S. 26, 40, n. 20 (1976)); accord Lewis v. Casey, 518 U.S. 343, 357 (1996). To establish the first element of standing, “injury in fact,” “a plaintiff must show that he or she suffered ‘an invasion of a legally protected interest’ that is ‘concrete and particularized’ and ‘actual or imminent, not conjectural or hypothetical.’” Spokeo, 578 U.S. at 339 (citing Lujan, 504 U.S. at 560). “A “concrete” injury must be ‘de facto’; that is, it must actually exist.” Id. at 340. A concrete injury must be “real” and not “abstract.” Id. “[C]ertain harms readily qualify as concrete injuries under Article III. The most obvious are traditional tangible harms, such as physical harms and monetary harms.” TransUnion, 141 S. Ct. at 2204. “Various intangible harms can also be concrete.” Id.; see Spokeo, 578 U.S. at 340. “Chief among them are injuries with a close relationship to harms traditionally recognized as providing a basis for lawsuits in American courts[,] . . . for example, reputational harms, disclosure of private information, and intrusion upon seclusion.” TransUnion, 141 S. Ct. at 2204. Importantly, “‘Article III standing requires a concrete injury even in the context of a statutory violation.’” TransUnion, 141 S. Ct. at 2205 (quoting Spokeo, 578 U.S. at 341). The Supreme Court “has rejected the proposition that ‘a plaintiff automatically satisfies the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right.’” Id. A legislature’s creation of a statutory prohibition or obligation and a cause of action does not relieve courts of their responsibility to independently decide whether a plaintiff has suffered a concrete harm under Article III. Id. “[U]nder Article III, an injury in law is not an injury in fact.” Id. Plaintiff argues that she has adequately alleged an injury in fact as a result of Defendant’s alleged violation of CIPA and her constitutional right to privacy, citing In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589 (9th Cir. 2020), and Licea v. Am. Eagle Outfitters, Inc., No. EDCV221702MWFJPR, 2023 WL 2469630 (C.D. Cal. Mar. 7, 2023). (Doc. No. 12 at 5-6.) Plaintiff’s reliance on these two decisions is not persuasive. In Facebook, the Ninth Circuit held that CIPA codifies “a substantive right to privacy, the violation of which gives rise to a concrete injury sufficient to confer standing.” 956 F.3d at 598. In Licea, the district court held “‘violations of [p]laintiffs’ statutory rights under CIPA, [even] without more, constitute injury in fact because instead of a bare technical violation of a statute, . . . a CIPA violation involves . . . a violation of privacy rights.’” 2023 WL 2469630, at *3 (quoting Osgood v. Main Streat Mktg., LLC, Case. No. 16-cv-2415-GPC (BGS), 2017 WL 131829, at *7 (S.D. Cal. Jan. 13, 2017)). These holdings are untenable in light of the Supreme Court’s holding in TransUnion that “‘Article III standing requires a concrete injury even in the context of a statutory violation.’”1 141 S. Ct. at 2205 (“‘[W]e cannot treat an injury as “concrete” for Article III purposes based

1 Facebook is a pre-TransUnion case. Further, although the district court decision in Licea was issued after TransUnion, it cites to pre-TransUnion district court cases as support for its holding, and Licea does not reference, discuss, or even acknowledge TransUnion’s holding that Article III standing requires a concrete injury even in the context of a statutory only on Congress’s say-so.’ . . . [A]n injury in law is not an injury in fact.”); see also Miller v. Gammie, 335 F.3d 889, 900 (9th Cir. 2003) (explaining that district courts are bound by intervening Supreme Court authority and must reject any prior Ninth Circuit precent that is clearly irreconcilable with that intervening authority). Under the Supreme Court’s holding in TransUnion, a bare CIPA violation by itself is insufficient to demonstrate Article III injury in fact. See id. Indeed, at least one district court has rejected the contention that “any violation of CIPA necessarily constitutes an injury in fact without the need for an additional showing of harm” on the grounds that it is at odds with the Supreme Court’s holding in TransUnion. Byars v. Sterling Jewelers, Inc., No. 5:22-CV-01456-SB-SP, 2023 WL 2996686, at *3 (C.D. Cal. Apr. 5, 2023); see also, e.g., Massie v. Gen. Motors LLC, No. CV 21-787-RGA, 2022 WL 534468, at *2, 5 (D. Del. Feb. 17, 2022) (dismissing CIPA claims for lack of standing on the grounds that plaintiff failed to allege a concrete injury). “To be sure, the Ninth Circuit has stated that ‘violations of the right to privacy have long been actionable at common law,’ and CIPA ‘codif[ies] a substantive right to privacy, the violation of which gives rise to a concrete injury sufficient to confer standing.’” Byars, 2023 WL 2996686, at *3 (quoting Facebook, 956 F.3d at 599); see also Smith v. LoanMe, Inc., 11 Cal. 5th 183, 191 (2021) (explaining the purpose of CIPA is “‘to protect the right of privacy by, among other things, requiring that all parties consent to a recording of their conversation’”). But the Ninth Circuit also explained that that right to privacy encompasses an “‘individual’s control of information concerning his or her person.’” Facebook, 956 F.3d at 598 (quoting Eichenberger v. ESPN, Inc., 876 F.3d 979, 983 (9th Cir. 2017)); see U.S. Dep’t of Just. v. Reps. Comm. For Freedom of Press, 489 U.S. 749, 763 (1989) (“[B]oth the common law and the literal understandings of privacy encompass the individual’s control of information concerning his or her person.”); see also TransUnion, 141 S. Ct. at 2204 (explaining that for there to be a concrete harm, the alleged injury must bear “a close relationship to harms traditionally recognized as providing a basis for lawsuits in American courts,” such as “disclosure of private information” and “intrusion upon seclusion”). This is significant because Plaintiff’s complaint does not allege that she disclosed any personal information to Defendant. Plaintiff alleges that she visited Defendant’s website to “obtain information on flight pricing.” (Doc. No. 1, Compl. ¶ 48.) Plaintiff alleges that while visiting Defendant’s website, her communications were monitored, recorded, and collected by Defendant’s Session Replay Code. (Id. ¶¶ 49, 51-53.) Plaintiff further alleges Defendant’s Session Replay Code is able to intercept and record a website visitor’s electronic communications, including her “mouse movements, clicks, keystrokes (such as text being entered into an information field or text box), URLs of webpages visited, and/or other electronic communications in real-time.” (Id. ¶ 1; see also id. ¶¶ 22, 25, 27, 46.) These allegations are insufficient to allege a concrete harm that bears a close relationship to the substantive right of privacy (i.e., an individual’s right to control information concerning his or her person). Although Plaintiff alleges that Defendant monitored and recorded her communications via software when she visited Defendant’s website, Plaintiff does not allege that she disclosed any personal information when she visited the website. As such, no personal information was intercepted and recorded. The only internet communications specifically alleged in the complaint is that Plaintiff “obtain[ed] information on flight pricing.”2 (Doc. No. 1, Compl. ¶ 48; see also Doc. No. 12 at 2.) Flight pricing information is not personal information.3 As such, Plaintiff has

2 In the complaint, Plaintiff includes purported screenshots from Defendant’s website in an effort to bolster her allegations, but the screenshots do not even include flight pricing information. (See Doc. No. 1, Compl. ¶¶ 52-53.) The screenshots reference an address of “1133 Penn Avenue, Pittsburg, PA, USA.” (Id. ¶ 52.) Nowhere in the complaint does Plaintiff explain what this address is or how it relates to her claims. 3 In the complaint, Plaintiff generally alleges: “Because most Session Replay Codes will by default indiscriminately capture the maximum range of user-initiated events and content displayed by the website, researchers have found that a variety of highly sensitive information can be captured in event responses from website visitors.” (Doc. No. 1, Compl. ¶ 28; see also Doc. No. 12 at 3.) But, importantly, Plaintiff does not allege that she failed to adequately allege that she suffered any concrete harm that bears a close relationship to the right to control personal information, meaning Plaintiff has failed to establish an injury in fact. See Byars, 2023 WL 2996686, at *3 (“Plaintiff does not allege that she disclosed any sensitive information to Defendant, much less identify any specific personal information she disclosed that implicates a protectable privacy interest. She therefore has not identified any harm to her privacy.”); Massie, 2022 WL 534468, at *5 (“I agree that Plaintiffs have a legally cognizable interest in controlling their personal information and that intrusion upon that interest would amount to a concrete injury. The fact of the matter remains, however, that none of Plaintiffs’ personal information is implicated by the allegations they make. Plaintiffs fail to explain how either GM’s or Decibel’s possession of anonymized, non-personal data regarding their browsing activities on GM’s website harms their privacy interests in any way.”); see also I.C. v. Zynga, Inc., 600 F. Supp. 3d 1034, 1049–50 (N.D. Cal. 2022) (finding disclosure of “basic contact information, including one’s email address, phone number, or . . . username” inadequate to establish Article III standing based on the “insufficient fit between the loss of information alleged here and the common law privacy torts of private disclosure of private facts and intrusion upon seclusion”). In addition, the present case is readily distinguishable from the Ninth Circuit’s decision in Facebook regarding Article III standing. In Facebook, the Ninth Circuit held that the plaintiffs had adequately alleged harm to their interest in controlling their personal information based on the following allegations: Plaintiffs alleged that Facebook continued to collect their data after they had logged off the social media platform, in order to receive and compile their personally identifiable browsing history. As alleged in the complaint, this tracking occurred “no matter how sensitive” or personal users’ browsing

captured by Session Replay Code. See Spokeo, 578 U.S. at 338 n.6 (“‘[N[amed plaintiffs who represent a class must allege and show that they personally have been injured, not that injury has been suffered by other, unidentified members of the class to which they histories were. Facebook allegedly constantly compiled and updated its database with its users’ browsing activities, including what they did when they were not using Facebook. According to Plaintiffs, by correlating users’ browsing history with users’ personal Facebook profiles—profiles that could include a user’s employment history and political and religious affiliations— Facebook gained a cradle-to-grave profile without users’ consent. Here, Plaintiffs have adequately alleged that Facebook’s tracking and collection practices would cause harm or a material risk of harm to their interest in controlling their personal information. As alleged, Facebook’s tracking practices allow it to amass a great degree of personalized information. Facebook’s user profiles would allegedly reveal an individual’s likes, dislikes, interests, and habits over a significant amount of time, without affording users a meaningful opportunity to control or prevent the unauthorized exploration of their private lives. Facebook, 956 F.3d at 598–99. Facebook involved the tracking and collecting of sensitive personal information. In contrast, in this case, Plaintiff does not allege that Defendant recorded or collected any of her personal information. See Byars, 2023 WL 2996686, at *3 (finding the Ninth Circuit’s decision in Facebook distinguishable). In sum, Plaintiff has failed to adequately allege that she suffered a concrete harm, and, therefore, Plaintiff has failed to satisfy the injury in fact element for Article III standing. Because Plaintiff lacks standing, the Court must dismiss Plaintiff’s claims for lack of subject matter jurisdiction. See Maya v. Centex Corp., 658 F.3d 1060, 1067 (9th Cir. 2011) (“lack of Article III standing requires dismissal for lack of subject matter jurisdiction”). / / / / / / / / / Conclusion For the reasons above, the Court grants Defendant’s motion to dismiss.* The Court dismisses Plaintiff's complaint without leave to amend for lack of subject matter jurisdiction.” See Telesaurus VPC, LLC v. Power, 623 F.3d 998, 1003 (9th Cir. 2010) (“A district court may deny a plaintiff leave to amend if it determines that ‘allegation of other consistent with the challenged pleading could not possibly cure the deficiency.”” (citation omitted)); see, e.g., Byars, 2023 WL 2996686, at *4 (dismissing action for lack of subject matter jurisdiction and entering final judgment). The Clerk is directed to close the case. DATED: June 12, 2023 lu MARILYN HUFF, Distri ge UNITED STATES DISTRICT COURT 4 It its motion to dismiss, Defendant also argues that Plaintiff's complaint should be dismissed because: (1) Plaintiffs claims are preempted by the Airline Deregulation Act, U.S.C. § 41713(b)(1) (“ADA”); (2) Plaintiff does not state a plausible claim for relief; and (3) Plaintiff's consent to Defendant’s recording of her website activity bars her claims. (Doc. No. 6 at 9-21.) Because the Court grants Defendant’s motion to dismiss for the reasons above, the Court declines to address these additional bases for dismissal. In addition, along with its motion to dismiss, Defendant also filed a request for judicial notice of certain documents. (Doc. No. 7.) In the analysis above, the Court does not reference or cite to any of the documents at issue in the request for judicial notice. As such, the Court denies Defendant’s request for judicial notice as moot. In her opposition to Defendant’s motion to dismiss, Plaintiff did not request leave to amend her complaint nor did Plaintiff assert that she could allege any additional facts that would cure the defects in Article II standing.