UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF CALIFORNIA
ABBY LINEBERRY, et al., Case No. 23-cv-01996-VC
Plaintiffs, ORDER GRANTING IN PART, v. DENYING IN PART ADDSHOPPERS' AND PEET'S COFFEE'S MOTION TO ADDSHOPPER, INC., et al., DISMISS THE FIRST AMENDED COMPLAINT Defendants. Re: Dkt. Nos. 138, 139
The motion to dismiss is granted in part and denied in part. This ruling assumes the reader is familiar with the facts, the applicable legal standards, the arguments made by the parties, and this Court’s prior order on the defendants’ first motions to dismiss. See McClung v. AddShopper, Inc., No. 23-CV-01996, 2024 WL 189006 (N.D. Cal. Jan. 17, 2024). 1. Article III Standing. The defendants reraise their argument that the plaintiffs have not suffered an injury-in-fact. The prior order explained that “misappropriating a person’s browsing activity across a network of thousands of online retailers and using it to barrage that person’s devices with unwanted email communications” is “the type of intrusion on privacy and seclusion that can be vindicated in the federal courts.” Id. at *1. As a reminder, the “question whether an invasion of privacy is severe enough to confer liability is distinct from whether the injury is concrete and particularized enough to confer standing in federal court.” Id.; see also TransUnion LLC v. Ramirez, 594 U.S. 413, 424 (2021); In re Facebook, Inc., Consumer Privacy User Profile Litigation, 402 F. Supp. 3d 767, 786 (N.D. Cal. 2019). The defendants argue that neither Cordero nor Lineberry disclosed private information on the Peet’s website such that they suffered an injury to their privacy. Whether browsing activity is private or personal enough depends on the facts of each case, including how much information is captured and how it is aggregated or used. Here, as discussed before, the complaint alleges that Addshoppers’ scheme is to “tie browsing activity on one site with personal information disclosed on another site, obviating the need for the retailers to do it themselves.” Id. at *2 n.1; see also First Amended Complaint ¶ 37–38, Dkt. No. 135 (describing how AddShoppers’ “business model hinges on its ability to send targeted emails to individuals who never voluntarily provided their email address to a member of the Data Co-Op”). And the information was not just from one retailer or on one occasion; Addshoppers aggregated browsing activity that spanned across many retailers and over years. In this situation, the plaintiffs have alleged a privacy injury sufficient to confer Article III standing. The defendants also argue that Cordero lacks standing because he did not allege receiving any targeted emails. Receipt of an unwanted email isn’t necessary to plead a concrete privacy injury. For instance, the common-law tort of intrusion upon seclusion doesn’t require that the private information taken be used in any particular way. See Restatement (Second) of Torts § 652B cmt. a, b (1977) (intrusion upon seclusion includes “examination into his private concerns” without “publication or other use of any kind” of the information acquired). Similarly, the common-law tort of publicity given to private life requires that private information be disseminated—akin to Addshoppers disseminating its dossiers to its retailer-customers—but does not require a further intrusion like an email toward the plaintiff. Id. § 652D. Therefore, Cordero’s allegation that his browsing activity was tracked by dozens of companies through SafeOpt over several years is sufficient. 2. CDAFA. The defendants next argue that the plaintiffs lack statutory standing to bring their CDAFA claims because they have not suffered the type of “damage or loss” necessary under CDAFA. Cal. Penal Code § 502(e)(1). The prior order held that the plaintiffs had adequately alleged damage or loss under a benefit of the bargain theory. See AddShopper, Inc., 2024 WL 189006, at *2. But the plaintiffs removed that theory in their amended complaint, and now solely rely on the theory that plaintiffs suffered economic loss because the defendants’ misappropriation of their data decreased the value of that data. The prior order expressed skepticism of this theory, but the Court now addresses it in more detail. Id. at *2. To begin, the defendants contend that “damage or loss” under CDAFA is limited to damage or loss to a computer system, network, program, or data contained on that computer, as some courts have held. See Heiting v. Taro Pharmaceuticals. USA, Inc., 709 F. Supp. 3d 1007, 1020 (C.D. Cal. 2023). This narrow interpretation of “damage or loss” is not supported by the text of CDAFA. The statute does not define “damage or loss” and the plain reading of “damage or loss by reason of a violation” of CDAFA is that any loss due to the CDAFA violation is cognizable. See Cal. Penal Code § 502(e)(1). The statute says that damages “shall include any expenditure reasonably and necessarily incurred by the owner or lessee to verify that a computer system, computer network, computer program, or data was or was not altered, damaged, or deleted by the access,” but that statement is best read as ensuring one type of damage is cognizable, not limiting damages to that alone. The defendants next point to the federal counterpart to CDAFA, the Comprehensive Computer Data Access and Fraud Act, which also requires “damage or loss” and defines that phrase as limited to “impairment to the integrity or availability of data, a program, a system, or information.” 18 U.S.C. § 1030(e)(8). The problem with this analogy is that CDAFA does not have a similar definition for “damage or loss,” and the defendants did not point to any statutory language or legislative history indicating the California Legislature wanted to adopt the federal definition, or even model the state statute after the federal one. Thus, the plaintiffs may allege damage or loss from the misappropriation of their data, so long as they articulate that theory of loss a concrete way. In this case, the plaintiffs have not done so. The complaint asserts that the plaintiffs suffer an economic loss every time their data is used and shared. Compl. ¶ 73. But they don’t provide any allegations about how or why that is the case. For instance, the complaint neither alleges that there is a market for individual people’s browsing activity, nor anything about what the actual value of the plaintiffs’ data could be. Cf. Brown v. Google LLC, 685 F. Supp. 3d 909, 940 (N.D. Cal. 2023) (holding that plaintiffs alleged CDAFA loss when they alleged Google had a program where it paid users $3/day for their browsing history). The complaint also doesn’t explain whether a person can still sell their data if Addshoppers already has it, nor how the value of a person’s data decreases when their data is misappropriated. The plaintiffs analogize to the intellectual property context and argue that data is like a patent or copyright: it is non-rivalrous, but the patent or copyright holder can still seek damages for reasonable royalties. But patents and copyrights are exclusive rights and others are precluded by statute from using the patented or copyrighted work; in contrast, it’s not clear whether each plaintiff has the exclusive right to their data nor is the scope of such an exclusive right clear if it does exist. This is not to say that a theory of economic loss based on the misappropriation of personal data is never cognizable. But at least here, the complaint fails to allege that the plaintiffs’ losses are anything other than “purely hypothetical.” In re Facebook, Inc., 402 F. Supp. 3d at 784 (dismissing similarly speculative economic loss theory on Article III standing). The CDAFA claims are dismissed for lack of CDAFA statutory standing. 3.
Free access — add to your briefcase to read the full text and ask questions with AI
UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF CALIFORNIA
ABBY LINEBERRY, et al., Case No. 23-cv-01996-VC
Plaintiffs, ORDER GRANTING IN PART, v. DENYING IN PART ADDSHOPPERS' AND PEET'S COFFEE'S MOTION TO ADDSHOPPER, INC., et al., DISMISS THE FIRST AMENDED COMPLAINT Defendants. Re: Dkt. Nos. 138, 139
The motion to dismiss is granted in part and denied in part. This ruling assumes the reader is familiar with the facts, the applicable legal standards, the arguments made by the parties, and this Court’s prior order on the defendants’ first motions to dismiss. See McClung v. AddShopper, Inc., No. 23-CV-01996, 2024 WL 189006 (N.D. Cal. Jan. 17, 2024). 1. Article III Standing. The defendants reraise their argument that the plaintiffs have not suffered an injury-in-fact. The prior order explained that “misappropriating a person’s browsing activity across a network of thousands of online retailers and using it to barrage that person’s devices with unwanted email communications” is “the type of intrusion on privacy and seclusion that can be vindicated in the federal courts.” Id. at *1. As a reminder, the “question whether an invasion of privacy is severe enough to confer liability is distinct from whether the injury is concrete and particularized enough to confer standing in federal court.” Id.; see also TransUnion LLC v. Ramirez, 594 U.S. 413, 424 (2021); In re Facebook, Inc., Consumer Privacy User Profile Litigation, 402 F. Supp. 3d 767, 786 (N.D. Cal. 2019). The defendants argue that neither Cordero nor Lineberry disclosed private information on the Peet’s website such that they suffered an injury to their privacy. Whether browsing activity is private or personal enough depends on the facts of each case, including how much information is captured and how it is aggregated or used. Here, as discussed before, the complaint alleges that Addshoppers’ scheme is to “tie browsing activity on one site with personal information disclosed on another site, obviating the need for the retailers to do it themselves.” Id. at *2 n.1; see also First Amended Complaint ¶ 37–38, Dkt. No. 135 (describing how AddShoppers’ “business model hinges on its ability to send targeted emails to individuals who never voluntarily provided their email address to a member of the Data Co-Op”). And the information was not just from one retailer or on one occasion; Addshoppers aggregated browsing activity that spanned across many retailers and over years. In this situation, the plaintiffs have alleged a privacy injury sufficient to confer Article III standing. The defendants also argue that Cordero lacks standing because he did not allege receiving any targeted emails. Receipt of an unwanted email isn’t necessary to plead a concrete privacy injury. For instance, the common-law tort of intrusion upon seclusion doesn’t require that the private information taken be used in any particular way. See Restatement (Second) of Torts § 652B cmt. a, b (1977) (intrusion upon seclusion includes “examination into his private concerns” without “publication or other use of any kind” of the information acquired). Similarly, the common-law tort of publicity given to private life requires that private information be disseminated—akin to Addshoppers disseminating its dossiers to its retailer-customers—but does not require a further intrusion like an email toward the plaintiff. Id. § 652D. Therefore, Cordero’s allegation that his browsing activity was tracked by dozens of companies through SafeOpt over several years is sufficient. 2. CDAFA. The defendants next argue that the plaintiffs lack statutory standing to bring their CDAFA claims because they have not suffered the type of “damage or loss” necessary under CDAFA. Cal. Penal Code § 502(e)(1). The prior order held that the plaintiffs had adequately alleged damage or loss under a benefit of the bargain theory. See AddShopper, Inc., 2024 WL 189006, at *2. But the plaintiffs removed that theory in their amended complaint, and now solely rely on the theory that plaintiffs suffered economic loss because the defendants’ misappropriation of their data decreased the value of that data. The prior order expressed skepticism of this theory, but the Court now addresses it in more detail. Id. at *2. To begin, the defendants contend that “damage or loss” under CDAFA is limited to damage or loss to a computer system, network, program, or data contained on that computer, as some courts have held. See Heiting v. Taro Pharmaceuticals. USA, Inc., 709 F. Supp. 3d 1007, 1020 (C.D. Cal. 2023). This narrow interpretation of “damage or loss” is not supported by the text of CDAFA. The statute does not define “damage or loss” and the plain reading of “damage or loss by reason of a violation” of CDAFA is that any loss due to the CDAFA violation is cognizable. See Cal. Penal Code § 502(e)(1). The statute says that damages “shall include any expenditure reasonably and necessarily incurred by the owner or lessee to verify that a computer system, computer network, computer program, or data was or was not altered, damaged, or deleted by the access,” but that statement is best read as ensuring one type of damage is cognizable, not limiting damages to that alone. The defendants next point to the federal counterpart to CDAFA, the Comprehensive Computer Data Access and Fraud Act, which also requires “damage or loss” and defines that phrase as limited to “impairment to the integrity or availability of data, a program, a system, or information.” 18 U.S.C. § 1030(e)(8). The problem with this analogy is that CDAFA does not have a similar definition for “damage or loss,” and the defendants did not point to any statutory language or legislative history indicating the California Legislature wanted to adopt the federal definition, or even model the state statute after the federal one. Thus, the plaintiffs may allege damage or loss from the misappropriation of their data, so long as they articulate that theory of loss a concrete way. In this case, the plaintiffs have not done so. The complaint asserts that the plaintiffs suffer an economic loss every time their data is used and shared. Compl. ¶ 73. But they don’t provide any allegations about how or why that is the case. For instance, the complaint neither alleges that there is a market for individual people’s browsing activity, nor anything about what the actual value of the plaintiffs’ data could be. Cf. Brown v. Google LLC, 685 F. Supp. 3d 909, 940 (N.D. Cal. 2023) (holding that plaintiffs alleged CDAFA loss when they alleged Google had a program where it paid users $3/day for their browsing history). The complaint also doesn’t explain whether a person can still sell their data if Addshoppers already has it, nor how the value of a person’s data decreases when their data is misappropriated. The plaintiffs analogize to the intellectual property context and argue that data is like a patent or copyright: it is non-rivalrous, but the patent or copyright holder can still seek damages for reasonable royalties. But patents and copyrights are exclusive rights and others are precluded by statute from using the patented or copyrighted work; in contrast, it’s not clear whether each plaintiff has the exclusive right to their data nor is the scope of such an exclusive right clear if it does exist. This is not to say that a theory of economic loss based on the misappropriation of personal data is never cognizable. But at least here, the complaint fails to allege that the plaintiffs’ losses are anything other than “purely hypothetical.” In re Facebook, Inc., 402 F. Supp. 3d at 784 (dismissing similarly speculative economic loss theory on Article III standing). The CDAFA claims are dismissed for lack of CDAFA statutory standing. 3. Plaintiff Cook’s Claims Against Peet’s. Peet’s argues that Cook’s claims must be dismissed because neither CDAFA nor CIPA apply extraterritorially. A California statute applies extraterritorially only if that “intention is clearly expressed or reasonable to be inferred ‘from the language of the act or from its purpose, subject matter or history.’” Sullivan v. Oracle Corp., 51 Cal. 4th 1191, 1207 (2011) (quoting Diamond Multimedia Systems, Inc. v. Superior Court, 19 Cal. 4th 1036, 1059 (1999)). Here, both CDAFA and CIPA contain language suggesting the statutes only apply in California. See Cal. Penal Code § 630 (stating the legislature “intends to protect the right of privacy of the people of this state”); Cal. Penal Code § 502(a) (declaring CDAFA “vital to the protection of the privacy of individuals . . . within this state”). To be sure, as the plaintiffs argue, a California statute may apply to claims by a non- California resident if the allegedly wrongful conduct occurred in California. See Hughes v. Apple, Inc., No. 22-CV-07668, 2024 WL 4828072, at *3 (N.D. Cal. Nov. 18, 2024). But here, the complaint contains no allegations that any of the unlawful conduct occurred in California. Cook is a Florida resident, and it is reasonable to assume he accessed the Peet’s website while in Florida. The complaint alleges SafeOpt intercepted his browsing activity directly from the website and sent it to Addshoppers, which is based in North Carolina. And there are no allegations that Peet’s made any business decisions relevant to this case—such as the decision to join SafeOpt, or decisions about the marketing emails it would send via SafeOpt—in California. Cook’s CDAFA and CIPA claims are therefore dismissed. 4. CIPA. The defendants make a final argument that the CIPA claims should be dismissed because the information intercepted is not the “contents” of communications as required by CIPA. District courts have split on whether browsing history is considered the “contents” of communications. Compare, e.g., Yoon v. Meta Platforms, Inc., 2024 WL 5264041, at *5 (N.D. Cal. Dec. 30, 2024), with Yoon v. Lululemon USA, Inc., 549 F. Supp. 3d 1073, 1082–83 (C.D. Cal. Jul. 15, 2021). Here, at least, it seems clear that the browsing activity intercepted—which included the specific products viewed as opposed to just the IP address and fact that the website was accessed on a particular date—should be considered the “contents” of the communication. Browsing a specific product online is akin to calling the store and asking for information about that product, and everyone agrees that the latter counts as the “content” of the communication. * * * The plaintiffs’ CDAFA claims and Cook’s CIPA claim against Peet’s are dismissed. The plaintiffs stated they are no longer pursuing the UCL claims so those are dismissed as well. These claims are dismissed without leave to amend given the case schedule and the fact that plaintiffs have already had a chance to amend. The remaining CIPA claims are not dismissed. Since the briefing on class certification is underway, the defendants may submit a five-page supplemental opposition brief on 2/24/25 and the plaintiffs may submit their reply, with an additional 5 pages, on 3/2/25. IT IS SO ORDERED. Dated: February 19, 2025 Loo. VINCE CHHABRIA United States District Judge