Mata v. Digital Recognition Network, Inc.

Opinion

Case No.: 21-CV-1485 JLS (BLM) GUILLERMO MATA, individually and

on behalf of all others similarly situated, ORDER GRANTING IN PART AND Plaintiff, DENYING IN PART DEFENDANT’S v. MOTION TO DISMISS AND DISMISSING PLAINTIFF’S DIGITAL RECOGNITION NETWORK, COMPLAINT FOR LACK OF INC., a Delaware corporation, STANDING Defendant. (ECF No. 4)

Presently before the Court is Defendant Digital Recognition Network, Inc.’s (“Defendant” or “DRN”) Motion to Dismiss (“Mot.,” ECF No. 4). Plaintiff Guillermo Mata (“Plaintiff”) has filed an Opposition to (“Opp’n,” ECF No. 9), and Defendant has filed a Reply in support of (“Reply,” ECF No. 10), the Motion. The Court took this matter under submission without oral argument pursuant to Civil Local Rule 7.1(d)(1). See ECF No. 6. Having carefully reviewed Plaintiff’s Complaint (“Compl.,” ECF No. 1-3), the Parties’ arguments, and the law, the Court GRANTS IN PART AND DENIES IN PART Defendant’s Motion and DISMISSES Plaintiff’s Complaint for lack of standing. Defendant is a corporation organized and existing under the laws of Delaware with its principal place of business located in Fort Worth, Texas. See Compl. ¶ 10. Defendant operates an automated or automatic license plate reader (“ALPR”) system within the state of California that collects photographs of vehicles as well as their license plate numbers. Compl. ¶¶ 14, 18–19, 49; see also Cal. Civ. Code § 1798.90.5(a). Defendant uses vehicle- mounted ALPR cameras to collect these photographs, and additionally records the camera’s location and the date and time of the photograph. Id. ¶ 19; see also id. Fig. 2. Defendant uses this data “to provide its customers real-time vehicle location data.” Id. ¶ 18. Defendant’s website states that “[its] platform can build a full, historical story on a vehicle and owner. . . . [Defendant’s] realternative data—license plate recognition data paired with our powerful, exclusive analytics platform—helps build the full vehicle stories our users need to solve their portfolio management, collections, recovery and fraud challenges.” Id. ¶¶ 21–22. Because Defendant operates and uses an ALPR system within California, Plaintiff alleges that it must comply with California Civil Code §§ 1798.90.5 et seq. (the “ALPR statute”), but that it has failed to do so. See generally Compl. Specifically, Plaintiff pleads that Defendant “deliberately collected Plaintiff’s and the putative Class’s ALPR information and disclosed that information to its 1,000 clients allowing them to identify locations visited by Plaintiff and each putative Class member’s vehicles.” Id. ¶ 54. Plaintiff alleges that Defendant’s conduct violates certain notice, privacy, security, and proper-use requirements in the ALPR statute. See generally id. Plaintiff further claims that Defendant “tracked [Plaintiff’s] vehicle, thus gaining access to his home and work address and other sensitive information such as the time he typically leaves and comes home and where he likes to spend his free time,” thereby “disparaging the privacy rights of California citizens,” including Plaintiff. Id. ¶ 8.

1 The facts alleged in Plaintiff’s Complaint are accepted as true for purposes of Defendant’s Motion. See Vasquez v. Los Angles Cty., 487 F.3d 1246, 1249 (9th Cir. 2007) (holding that, in ruling on a motion to Plaintiff initiated this putative class action on May 26, 2021, in the Superior Court of the State of California for the County of San Diego, asserting a single cause of action against Defendant for violation of the ALPR statute. See generally ECF No. 1 (“Notice of Removal”). On August 8, 2021, Defendant removed to this District based on diversity jurisdiction. See generally id. The instant Motion followed. See Mot. As an initial matter Plaintiff’s Opposition makes a passing request that the Court take judicial notice of Defendant’s website. Opp’n at 7 n.1 (citing Declaration of Lily E. Hough (“Hough Decl.,” ECF No. 9-1) Ex. A (the “Website,” ECF No. 9-2)). “Generally, district courts may not consider material outside the pleadings when assessing the sufficiency of a complaint under Rule 12(b)(6) of the Federal Rules of Civil Procedure.” Khoja v. Orexigen Therapeutics, Inc., 899 F.3d 988, 998 (9th Cir. 2018) (citation omitted). “There are two exceptions to this rule,” including the incorporation-by- reference doctrine. Id. “Even if a document is not attached to a complaint, it may be incorporated by reference into a complaint if the plaintiff refers extensively to the document or the document forms the basis of the plaintiff’s claim.” United States v. Ritchie, 342 F.3d 903, 908 (9th Cir. 2003) (citations omitted). “‘[T]he mere mention of the existence of a document is insufficient to incorporate the contents of a document’ under Ritchie.” Khoja, 899 F.3d at 1002 (citation omitted). Nonetheless, a document may still form the basis of the plaintiff’s claim where “the claim necessarily depended on the[ document].” Id. (citation omitted). When a document is incorporated by reference, “the district court may treat such a document as part of the complaint, and thus may assume that its contents are true for purposes of a motion to dismiss under Rule 12(b)(6).” Ritchie, 342 F.3d at 908. However, “it is improper to assume the truth of an incorporated document if such assumptions only serve to dispute facts stated in a well-pleaded complaint.” Khoja, 899 F.3d at 1003. Here, the Court finds that Plaintiff’s claim “necessarily depend[s] on [Defendant’s Website]” and that his Complaint “refers extensively” to Defendant’s Website, Khoja, 899 F.3d at 1002 (citation omitted); thus, the Website is incorporated by reference into the Complaint. Indeed, the Complaint not only “mention[s] . . . the existence” of the Website, id. at 1002 (citation omitted), but quotes portions of it throughout, see, e.g., Compl. ¶¶ 18– 22, 30–35. Further, the bulk of Plaintiff’s allegations revolve around the alleged failure of Defendant’s policy, posted on the Website, to adhere to the requirements of the ALPR statute. See, e.g., Compl. ¶¶ 55–56. Defendant does not object to Plaintiff’s request, but rather also refers extensively to its Website in its briefing on the Motion. Accordingly, the Court GRANTS Plaintiff’s request to find Defendant’s Website incorporated by reference into the Complaint. MOTION TO DISMISS AND/OR STRIKE I. Legal Standards A. Rule 12(b)(6) Motion to Dismiss Federal Rule of Civil Procedure 12(b)(6) permits a party to raise by motion the defense that the complaint “fail[s] to state a claim upon which relief can be granted,” generally referred to as a motion to dismiss. The Court evaluates whether a complaint states a cognizable legal theory and sufficient facts in light of Federal Rule of Civil Procedure 8(a), which requires a “short and plain statement of the claim showing that the pleader is entitled to relief.” Although Rule 8 “does not require ‘detailed factual allegations,’ . . . it [does] demand more than an unadorned, the-defendant-unlawfully- harmed-me accusation.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007)). In other words, “a plaintiff’s obligation to provide the ‘grounds’ of his ‘entitle[ment] to relief’ requires more than labels and conclusions, and a formulaic recitation of the elements of a cause of action will not do.” Twombly, 550 U.S. at 555 (citing Papasan v. Allain, 478 U.S. 265, 286 (1986)). A complaint will not suffice “if it tenders ‘naked assertion[s]’ devoid of ‘further factual enhancement.’” Iqbal, 556 U.S. at 677 (citing Twombly, 550 U.S. at 557). To survive a motion to dismiss, “a complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’” Id. (quoting Twombly, 550 U.S. at 570); see also Fed. R. Civ. P. 12(b)(6). A claim is facially plausible when the facts pled “allow the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Iqbal, 556 U.S. at 677 (citing Twombly, 550 U.S. at 556). That is not to say that the claim must be probable, but there must be “more than a sheer possibility that a defendant has acted unlawfully.” Id. Facts “‘merely consistent with’ a defendant’s liability” fall short of a plausible entitlement to relief. Id. (quoting Twombly, 550 U.S. at 557). This review requires context-specific analysis involving the Court’s “judicial experience and common sense.” Id. at 675 (citation omitted). “[W]here the well-pleaded facts do not permit the court to infer more than the mere possibility of misconduct, the complaint has alleged—but it has not ‘show[n]’—‘that the pleader is entitled to relief.’” Id. “In reviewing a Rule 12(b)(6) motion to dismiss, a district court must accept as true all facts alleged in the complaint, and draw all reasonable inferences in favor of the plaintiff.” Wi-LAN Inc. v. LG Elecs., Inc., 382 F. Supp. 3d 1012, 1020 (S.D. Cal. 2019) (citing Retail Prop. Trust v. United Bhd. of Carpenters & Joiners of Am., 768 F.3d 938, 945 (9th Cir. 2014)). Where a complaint does not survive 12(b)(6) analysis, the Court will grant leave to amend unless it determines that no modified contention “consistent with the challenged pleading . . . [will] cure the deficiency.” DeSoto v. Yellow Freight Sys., Inc., 957 F.2d 655, 658 (9th Cir. 1992) (quoting Schreiber Distrib. Co. v. Serv-Well Furniture Co., 806 F.2d 1393, 1401 (9th Cir. 1986)). B. Rule 12(f) Motion to Strike Federal Rule of Civil Procedure 12(f) provides that a court “may strike from a pleading an insufficient defense or any redundant, immaterial, impertinent, or scandalous matter.” “The function of a [Rule] 12(f) motion to strike is to avoid the expenditure of time and money that must arise from litigating spurious issues by dispensing with those issues prior to trial.” Whittlestone, Inc. v. Handi-Craft Co., 618 F.3d 970, 973 (9th Cir. 2010) (quoting Fantasy, Inc. v. Fogerty, 984 F.2d 1524, 1527 (9th Cir. 1993), rev’d on other grounds, 510 U.S. 517 (1994)). “Motions to strike are ‘generally disfavored because they are often used as delaying tactics and because of the limited importance of pleadings in federal practice.’” Cortina v. Goya Foods, Inc., 94 F. Supp. 3d 1174, 1182 (S.D. Cal. 2015) (quoting Rosales v. Citibank, 133 F. Supp. 2d 1177, 1180 (N.D. Cal. 2001)). “[M]otions to strike should not be granted unless it is clear that the matter to be stricken could have no possible bearing on the subject matter of the litigation.” Colaprico v. Sun Microsys., Inc., 758 F. Supp. 1335, 1339 (N.D. Cal. 1991). “When ruling on a motion to strike, this Court ‘must view the pleading under attack in the light most favorable to the pleader.’” Id. (citing RDF Media Ltd. v. Fox Broad. Co., 372 F. Supp. 2d 556, 561 (C.D. Cal. 2005)). “Unless it would prejudice the opposing party, courts freely grant leave to amend stricken pleadings.” Roe v. City of San Diego, 289 F.R.D. 604, 608 (S.D. Cal. 2013) (citing Fed. R. Civ. P. 15(a)(2); Wyshak v. City Nat’l Bank, 607 F.2d 824, 826 (9th Cir. 1979)). II. Analysis Plaintiff’s sole cause of action asserts that Defendant violates the ALPR statute. See Compl. ¶¶ 54–60. Plaintiff alleges that DRN is an “ALPR operator” as defined by the ALPR statute because it “operates an ALPR system.” Cal. Civ. Code § 1798.90.5(c); Compl. ¶¶ 49–51. Additionally, DRN is an “ALPR end-user” because it “accesses or uses an ALPR system.” Cal. Civ. Code § 1798.90.5(a); Compl. ¶ 52. Per the ALPR statute, ALPR operators and end-users must “[m]aintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure.” Cal. Civ. Code § 1798.90.51(a) (ALPR operators); id. § 1798.90.53(a) (ALPR end-users). This, Plaintiff contends, is the statute’s “Security Requirement.” Compl. ¶ 15(i). Among such safeguards, ALPR operators must “[i]mplement a usage and privacy policy to ensure that the collection, use, maintenance, sharing, and dissemination of ALPR information is consistent with respect for individuals’ privacy and civil liberties.” Cal. Civ. Code § 1798.90.51(b)(1). Similarly, ALPR end-users must “[i]mplement a usage and privacy policy in order to ensure that the access, use, sharing, and dissemination of ALPR information is consistent with respect for individuals’ privacy and civil liberties.” Id. § 1798.90.53(b)(1). This, Plaintiff contends, is the statute’s “Privacy Requirement.” Compl. ¶ 15(ii). “The usage and privacy policy shall be available to the public in writing, and, if the ALPR [operator and/or end-user] has an Internet Web site, the usage and privacy policy shall be posted conspicuously on that Internet Web site.” Cal. Civ. Code §§ 1798.90.51(b)(1) (ALPR operators), 1798.90.53(b)(1) (ALPR end-users). The usage and privacy policy is required to include, at a minimum, specified information that varies depending on whether the person in question is an ALPR operator or end-user. Id. §§ 1798.90.51(b)(2) (ALPR operators), 1798.90.53(b)(2) (ALPR end-users). This, Plaintiff contends, is the statute’s “Notice Requirement.” Compl. ¶ 15(iii). Additionally, ALPR operators who access or provide access to ALPR information must maintain detailed records of such access. Cal. Civ. Code § 1798.90.52(a). This, Plaintiff contends, is the statute’s “Audit Requirement.” Compl. ¶ 16(i). Finally, ALPR operators must “[r]equire that ALPR information only be used for the authorized purposes described in the usage and privacy policy.” Cal. Civ. Code § 1798.90.52(b). This, Plaintiff contends, is the statute’s “Proper Use Requirement.” Compl. ¶ 16(ii). The ALPR statute authorizes “an individual who has been harmed by a violation of this title” to bring a civil action. Cal. Civ. Code § 1798.90.54(a). A plaintiff in such an action may seek a combination of actual damages (not less than liquidated damages in the amount of $2,500); punitive damages “upon proof of willful or reckless disregard of the law”; attorneys’ fees and costs; and preliminary or equitable relief. Id. § 1798.90.54(b). Plaintiff contends that DRN has failed to comply with the ALPR statute’s Notice, Privacy, Security, and Proper Use Requirements, and that he and the Class have been harmed by these violations “because their private and sensitive personal information has been improperly collected and used without their notice or consent.” See Compl. ¶¶ 54– 60. Defendant argues that Plaintiff fails to state a claim because he fails to allege sufficient plausible facts to establish that he has suffered any actionable harm as a result of a violation of the ALPR statute. See Mot. at 5–7. Defendant further seeks to dismiss or strike Plaintiff’s claim for punitive damages for failure to allege sufficiently egregious conduct. See id. at 7–8. The Court analyzes each of Defendant’s arguments in turn. A. Sufficiency of the Complaint’s Allegations Defendant argues that “[Plaintiff] fails to allege the existence of any actionable ‘harm’ that he or any members of his purported class may have suffered.” Mot. at 5. Plaintiff responds that “DRN frames this argument as going to the merits, though it uses the language of Article III standing.” Opp’n at 10. Nonetheless, Plaintiff argues that “under either a constitutional or statutory analysis it is clear that Plaintiff alleges precisely the type of harm the statute was designed to prevent: intrusions upon his individual privacy rights.” Id. at 2. Plaintiff elaborates that, “because DRN failed to embrace the safeguards outlined by the ALPR statute, [Plaintiff’s] privacy interests have been jeopardized,” thus satisfying both statutory and constitutional standing. Id. at 13 (footnote omitted). Plaintiff alternatively contends that, “[i]f the Court has any doubts about whether Plaintiff was injured, this action must be remanded to California Superior Court.” Id. at 2. In its Reply, Defendant claims not to challenge Plaintiff’s Article III standing, but contends that “Plaintiff has failed to allege any specific violation of the ALPR law tied to the alleged harm, which is purely a statutory question and properly decided by this Court under Rule 12(b)(6) standards.” Reply at 6–7 n.5 (citing Maya v. Centex Corp., 658 F.3d 1060, 1067 (9th Cir. 2011)). 1. Standing As an initial matter, regardless of whether Defendant raised the issue, “[f]ederal district courts are courts of limited jurisdiction that ‘may not grant relief absent a constitutional or valid statutory grant of jurisdiction’ and are ‘presumed to lack jurisdiction in a particular case unless the contrary affirmatively appears.’” Cooper v. Tokyo Elec. Power Co., 990 F. Supp. 2d 1035, 1038 (S.D. Cal. 2013) (quoting A-Z Int’l v. Phillips, 323 F.3d 1141, 1145 (9th Cir. 2003)). Thus, “[f]ederal courts are required sua sponte to examine jurisdictional issues such as standing.” Chapman v. Pier 1 Imports (U.S.) Inc., 631 F.3d 939, 954 (9th Cir. 2011) (quoting Bernhardt v. Cty. of Los Angeles, 279 F.3d 862, 868 (9th Cir. 2002)) (citing United States v. Hays, 515 U.S. 737, 742 (1995)). “Standing . . . requires a plaintiff to demonstrate the now-familiar elements of injury in fact, causation, and redressability.” Lance v. Coffman, 549 U.S. 437, 439 (2007) (per curiam) (citing Lujan v. Defenders of Wildlife, 504 U.S. 555, 573–74 (1992)). To satisfy the requirements of “injury in fact,” a plaintiff must show that he suffered “an invasion of a legally protected interest which is (a) concrete and particularized, and (b) actual or imminent, not conjectural or hypothetical.” Lujan, 504 U.S. at 560 (internal quotation marks and citations omitted). In other words, the injury must be “concrete in both a qualitative and temporal sense” such that a plaintiff “must allege an injury to himself that is distinct and palpable.” Whitmore v. Arkansas, 495 U.S. 149, 155 (1990) (internal quotation marks and citations omitted). “A plaintiff does not necessarily meet the concrete injury requirement ‘whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right.’” Patel v. Facebook, Inc., 932 F.3d 1264, 1270 (9th Cir. 2019) (quoting Spokeo, Inc. v. Robins, 578 U.S. 330, 341 (2016), as revised (May 24, 2016)). In assessing “whether the violation of a statute causes a concrete injury,” courts within the Ninth Circuit “ask ‘(1) whether the statutory provisions at issue were established to protect [the plaintiff’s] concrete interests (as opposed to purely procedural rights), and if so, (2) whether the specific procedural violations alleged in this case actually harm, or present a material risk of harm to, such interests.’” Id. at 1270–71 (quoting Robins v. Spokeo, Inc., 867 F.3d 1108, 1113 (9th Cir. 2017)). Even assuming that “‘the statutory provisions at issue’ in [the ALPR statute] were established to protect an individual’s ‘concrete interests’ in privacy, not merely procedural rights,” the Court finds that the Complaint, as presently pleaded, fails to adequately establish that “the specific procedural violations alleged in this case actually harm, or present a material risk of harm to, such interests.” Id. at 1274 (citation omitted). Accepting the factual allegations of the Complaint as true, Plaintiff alleges that “[he] is one of millions of individuals who has fallen victim to DRN’s pervasive surveillance network. DRN tracked [Plaintiff]’s vehicle, thus gaining access to his home and work address and other sensitive information.” Compl. ¶ 8. Plaintiff “is concerned to whom and for what reasons [Defendant] may have disclosed [Plaintiff’s] sensitive license plate data together with his vehicle’s location. Worst of all, [Plaintiff] is concerned how this information can be misused.” Id. ¶ 41. As the allegations of the Complaint make clear, however, the purported harm to Plaintiff’s privacy interests relies heavily on speculation; thus, any harm appears not to be “actual or imminent,” but rather “conjectural or hypothetical.” Lujan, 504 U.S. at 560. For example, Plaintiff pleads that DRN’s collection of his data “allowed DRN to identify” aspects of Plaintiff’s personal life—such as the identity his former employer, where he spends his time after work, and the school “his family member attended”—but Plaintiff does not plead that Defendant actually used the data it collected to identify said information about Plaintiff. Compl. ¶ 38 (emphasis added). Further, Plaintiff alleges he “is concerned” about to whom, and for what reasons, Defendant “may have disclosed” Plaintiff’s license plate information, but Plaintiff does not plead that Defendant actually disclosed his data to anyone at all. Id. ¶ 40 (emphasis added). In the same vein, Plaintiff claims that he “is concerned [about] how this information can be misused,” but he does not plead that the information in fact was misused. Id. (emphasis added). Thus, although Plaintiff has listed various possibilities as to how Defendant’s data theoretically could be misused, Plaintiff fails to allege that any of these eventualities have occurred or are likely to occur. Thus, as presently pleaded, the Court finds that Plaintiff has not adequately alleged standing and thus DISMISSES Plaintiff’s Complaint. Nonetheless, because the Court finds that Plaintiff could allege facts in an amended complaint to establish standing and solidify this Court’s jurisdiction, the Court finds that remand is not required at this time. See Maya, 658 F.3d at 1060. The Court now turns to Defendant’s arguments. 2. The Notice Requirement Plaintiff alleges that “Defendant’s conduct violates the Notice Requirement under Cal. Civ. Code §§ 1798.90.51(b)(1) & [1798.90.]53(b)(1) because the company does not make a meaningful usage and/or privacy policy available to the public, nor does it conspicuously post any information about usage and/or privacy on its website.” Compl. ¶ 56. Defendant argues that the ALPR statute does not contain a provision requiring it “to individually provide notice to or obtain consent from anyone before photographing vehicle license plates in public spaces. Indeed, the terms ‘notice’ and ‘consent’ appear nowhere in the ALPR statute.” Mot. at 5. While that is true, the argument misses the mark. Plaintiff’s claim is that, “even if one somehow becomes aware of the collection [of one’s ALPR information], the company responsible for doing it and the address of its website, DRN takes pains to hide its policy, burying it in small dark font against a dark background at the very bottom of its website.” Opp’n at 9 (citing Compl. ¶¶ 36, 56). Thus, “DRN’s hollow disclosures fail to comport with the statute’s notice requirements,” given that the Website posting is not “conspicuous.” Id. at 15. Having found the Website to be incorporated by reference into the Complaint, the Court finds, subject to the standing deficiency noted supra, that the Complaint plausibly alleges a claim for violation of the Notice Requirement. Although Defendant has a link to its “California ALPR Policy” on its homepage, the link appears in small words at the very bottom of its website. One must scroll all the way to the bottom, and accept a pop-up notification about cookies, to even see the link. One plausibly could infer that this is not “posted conspicuously” as required by the ALPR statute. See Cal. Civ. Code §§ 1798.90.51(b)(1) & 1798.90.53(b)(1). Accordingly, the Court DENIES Defendant’s Motion on this ground. / / / / / / 3. The Privacy, Security, and Proper Use Requirements Plaintiff acknowledges that Defendant maintains a privacy policy on its Website but claims that it only does so to “maintain the appearance of adhering to the law.” Compl. ¶ 30. Ultimately, Defendant violates the Privacy Requirement, according to Plaintiff, because its policy is “illusory,” see Opp’n at 15–16, as it does not “ensure that [DRN’s] collection, use, maintenance, sharing, and dissemination of ALPR information is consistent with respect for individuals’ privacy and civil liberties,” Compl. ¶ 57. Plaintiff alleges that Defendant violates the Security Requirement “because it expressly disclaims the highly sensitive nature and serious privacy implications of its ALPR data, and as a result fails to conduct the security procedures and practices reasonably necessary to protect such sensitive information from unauthorized access, destruction, use, modification, or disclosure.” Id. ¶ 58. Finally, Plaintiff pleads that ALPR operators must “require that ALPR information only be used for the authorized purposes described in the usage and privacy policy,” but Defendant violates this Proper Use Requirement by “allow[ing], and indeed encourag[ing] its customers to use its ALPR system for the unauthorized purpose of tracking and locating individuals.” Id. ¶¶ 15, 59 (citing Cal. Civ. Code § 1798.90.52(b)). Defendant argues that Plaintiff fails to allege an actionable violation of the ALPR statute because he does not plausibly allege: (1) “that DRN actually failed to maintain reasonable security procedures and practices,” (2) “that the usage and privacy policy does not disclose the information required by the statute,” (3) that “any unauthorized access to DRN’s ALPR data has ever occurred,” or (4) “that DRN fails to limit access to its ALPR data to the ‘authorized purposes’ described in its usage and privacy policy.” Mot. at 6. Further, Defendant argues that the ALPR statute does not mandate that its security procedures be set forth in its published usage and privacy policy. Reply at 6. In response, Plaintiff argues that he “need not prove a specific breach of ALPR’s [sic] system” because “it is a reasonable inference to draw from the fact that DRN uses ambiguous language to describe how its system will be monitored for security purposes, appears to have no concrete security procedures beyond ‘periodically audit[ing]’ usage logs, and disclaims the security needs of that information altogether.” Opp’n at 16 (citing Compl. ¶¶ 35, 58). Plaintiff points to the marketed possible uses of Defendant’s system for mailing campaigns and debt collection purposes as improper uses of ALPR data, according to Defendant’s policy, to track individuals rather than vehicles. Compl. ¶¶ 31– 33; see also Opp’n at 16. The Court finds that the Complaint at present fails to adequately plead any violation of the ALPR statute’s Privacy, Security, or Proper Use Requirements. Plaintiff concedes that the privacy policy on Defendant’s Website “appears to track the topics outlined by the ALPR law.” Opp’n at 7. To the extent Plaintiff argues that Defendant does not properly implement its own usage and privacy policy or that said policy is “illusory,” Plaintiff relies on hypotheticals about what could happen if the data fell into the wrong hands and how this would infringe on his privacy and civil liberties, see Compl. ¶¶ 24–25, but Plaintiff fails to allege any facts tending to show that Defendant indeed did violate its policy, and therefore the ALPR statute. Similarly, Plaintiff offers no facts to support his bald assertion that Defendant has not implemented reasonable security procedures and practices necessary to protect its ALPR data. Id. ¶ 58. Rather, by outlining the content of the usage logs Defendant keeps in the “Monitoring and Compliance” section of its usage and privacy policy, Defendant appears to facially comply with the requirement that it provide “a description of how the ALPR system will be monitored to ensure the security of the information accessed or used, and compliance with all applicable privacy laws, and a process for periodic system audits.” See Cal. Civ. Code §§ 1798.90.51(b)(2)(c) & 1798.90.53(b)(2)(c); see also Website at 2. Finally, the allegedly unauthorized uses of ALPR information facially appear to fall within the permissible uses outlined in Defendant’s policy. Defendant makes clear that possible users and uses of the system and data include “[f]inancial services companies and other businesses that have a legitimate commercial interest in locating or identifying a vehicle.” Website at 2. As Defendant argues in its Reply, that the location of a vehicle can be used to validate other data about a person, such as his address or possible location, does not necessarily mean that the ALPR data is being accessed and used in contravention of Defendant’s policy. Accordingly, the threadbare allegations of the Complaint and the unfounded inferences Plaintiff invites the Court to draw, see Opp’n at 16, are inadequate to state a claim. Because Plaintiff has failed to allege specific and plausible facts to support his broad and unsubstantiated claim that Defendant has violated the Privacy, Security or Proper Use Requirements of the ALPR statute, the Court finds that Plaintiff fails to plead a violation of those requirements and GRANTS Defendant’s Motion on these grounds. B. Punitive Damages Request Plaintiff requests “an award of liquidated damages, punitive damages, costs, and attorneys’ fees” for Defendant’s alleged violations of the ALPR Statute. Compl. at 15 (“Prayer”). Defendant argues that Plaintiff’s request for punitive damages should be stricken and/or dismissed because Plaintiff has failed to plead “any facts that would establish entitlement to punitive damages.” Mot. at 7. Specifically, Defendant contends that punitive damages are available “only upon clear and convincing evidence that defendant’s conduct is ‘so vile, base, contemptible, miserable, wretched or loathsome that it would be looked down upon or despised by ordinary decent people’ or ‘[having] the character of outrage frequently associated with crime.’” Mot. at 7 (citing Tomaselli v. Transamerica Ins. Co., 25 Cal. App. 4th 1269, 1287 (1994)). Plaintiff counters that, under the ALPR statute, punitive damages may be awarded upon a lesser showing: “proof of willful or reckless disregard of the law.” Opp’n at 16–17 (citing Cal. Civ. Code § 1798.90.54(b)(2)). Plaintiff argues that Defendant “violated the law despite knowing or perceiving the risk that its conduct would violate the statute” by “expressly disclaim[ing] the highly sensitive nature and serious privacy implications of [Defendant’s] ALPR data” while “impersonating compliance as a way to ‘pay lip service to privacy laws.’” Id. at 17 (citing Compl. ¶¶ 34, 55, 58). In its Reply, Defendant maintains that Plaintiff “failed to allege any meaningful violation of the ALPR law at all, much less a willful or reckless violation of the statute,” and accordingly urges the Court to strike Plaintiff’s punitive damages claim. Reply at 7 (emphasis in original). A growing number of district courts have concluded that Rule 12(b)(6) is generally inapplicable to damage prayers. See, e.g., Sturm v. Rasmussen, Case No.: 18-CV-01689- W-BLM, 2019 WL 626167, at *3 (S.D. Cal. Feb. 14, 2019) (collecting cases). Nor does the Court find that Defendant establishes that Plaintiff's prayer for punitive damages is “redundant, immaterial, impertinent, or scandalous matter” properly stricken under Rule 12(f). Fed. R. Civ. P. 12(f). Rather, Plaintiff’s request for punitive damages goes directly to the relief to which Plaintiff may be entitled, assuming he can establish standing and a violation of the ALPR statute. Accordingly, striking Plaintiff's claim for punitive damages would be improper at this stage and the Court DENIES Defendant’s request. 1] In light of the foregoing, the Court GRANTS IN PART AND DENIES IN PART Defendant’s Motion to Dismiss (ECF No. 4) and DISMISSES Plaintiff's Complaint for lack of standing. Because the Court finds it is possible Plaintiff could amend his Complaint cure the deficiencies noted herein, however, said dismissal is WITHOUT PREJUDICE. Plaintiff MAY FILE an amended complaint within thirty (30) days of the /date on which this Order is electronically docketed. Should Plaintiff elect to file an amended complaint, it must cure the deficiencies noted herein and must be complete in itself without reference to Plaintiffs prior Complaint. See S.D. Cal. CivLR 15.1. Should Plaintiff fail to file an amended complaint within thirty (30) days of the date on which this Order is electronically docketed, the Court will enter a final order dismissing this civil action based on Plaintiff's failure to prosecute in compliance with a court order requiring amendment. See Lira v. Herrera, 427 F.3d 1164, 1169 (9th Cir. 2005) (“If a plaintiff does not take advantage of the opportunity to fix his complaint, a district court may convert the dismissal of the complaint into dismissal of the entire action.’’). Dated: March 25, 2022 . tt pon Janis L. Sammartino United States District Judge