Mikulsky v. Noom, Inc.

Opinion

ERIKA MIKULSKY, individually and on Case No.: 3:23-cv-00285-H-MSB behalf of all others similarly situated, ORDER GRANTING DEFENDANT’S Plaintiff, v. [Doc. No. 37.] NOOM, INC., Defendant.

On October 30, 2023, Defendant Noom, Inc. (“Defendant” or “Noom”) moved to dismiss Plaintiff Erika Mikulsky’s (“Plaintiff”) first amended complaint (“FAC”) pursuant to Federal Rules of Civil Procedure 12(b)(1), 12(b)(2), and 12(b)(6). (Doc. No. 37.) On November 30, 2023, Plaintiff filed a response in opposition to Defendant’s motion to dismiss. (Doc. No. 38.) On December 21, 2023, Defendant filed a reply in support of its motion. (Doc. No. 42.) The Court, pursuant to its discretion under Civil Local Rule 7.1(d)(1), determined the matter was appropriate for resolution without oral argument, submitted the motion on the parties’ papers, and vacated the hearing. (Doc. No. 45.) For the reasons below, the Court grants Defendant’s motion to dismiss. This case is one of dozens of proposed class actions being litigated in federal courts challenging the use of “Session Replay Code.” The Court briefly summarizes the factual background taken from the allegations in Plaintiff’s first amended complaint. (Doc. No. 34, “FAC”.) Defendant is a Delaware corporation that has its principal place of business in New York. (FAC ¶ 8.) Defendant is a digital health and wellness platform that focuses on helping individuals lose weight and lead healthier lives. (Id. ¶¶ 11-12.) Defendant operates the website “www.noom.com” (the “Website”). (Id. ¶ 1.) Defendant procures and embeds various Session Replay Code from third-party Session Replay Providers, including FullStory, on its Website to track and analyze website users’ interactions with the Website. (Id.) Session Replay Code enables website operators to record, save, and replay website visitors’ interactions with a given website, including “mouse movements, clicks, keystrokes (such as text being entered into an information field or text box), URLs of webpages visited, and/or other electronic communications in real-time.” (Id.; see also id. ¶¶ 36-57.) Once the Session Replay Code records the website visitors’ interactions, the website operator can view a visual reenactment of users’ visits through the Session Replay Provider, usually in the form of a video. (Id. ¶¶ 2, 43, 66.) Plaintiff alleges that she visited Defendant’s Website on her computer while in California prior to filing this action. (Id. ¶ 73.) During her visit to Defendant’s Website, Plaintiff was directed to complete a detailed screening survey (the “Noom Survey”). (Id. ¶ 75.) The Noom Survey asked Plaintiff to “input [her] personal health information (including current weight, ideal weight, sex, gender identity, and age) and answer questions about [her] fitness goals, eating and exercise habits, medical and family history, mental health, home environment, marital status, weight loss motivations and struggles, and personal lifestyle.” (Id.) Plaintiff completed the Noom Survey through “mouse movements, clicks and by typing the requested personal information into text fields.” (Id. ¶ 77.) While visiting Defendant’s Website, Session Replay Code captured Plaintiff’s communications and sent her responses and “sensitive personal health information” to various Session Replay Providers without her knowledge and without her consent. (Id. ¶¶ 78, 81.) Plaintiff alleges that Defendant’s conduct violates the California Invasion of Privacy Act (“CIPA”), California Penal Code § 630 et seq., and constitutes the tort of invasion of privacy rights and intrusion upon seclusion. (Id. ¶ 5.) On February 14, 2023, Plaintiff filed a class action complaint against Defendant. (Doc. No. 1.) On May 8, 2023, Defendant moved to dismiss the complaint pursuant to Federal Rules of Civil Procedure 12(b)(2) and 12(b)(6). (Doc. No. 12-1 at 6-21.) On June 13, 2023, the Court asked the parties sua sponte to address Plaintiff’s Article III standing under Federal Rule of Civil Procedure 12(b)(1). (Doc. No. 21.) Defendant moved to dismiss on that ground as well. (Doc. No. 24.) On July 17, 2023, the Court granted Defendant’s motion to dismiss Plaintiff’s complaint pursuant to Federal Rules of Civil Procedure 12(b)(1) and 12(b)(2) for lack of subject matter jurisdiction and lack of personal jurisdiction, respectively. (Doc. No. 26.) In its Order, the Court warned Plaintiff that the Court may dismiss Plaintiff’s claims with prejudice and without leave to amend should she fail to cure the deficiencies identified by the Court. (Id. at 15.) The Court further instructed that Plaintiff may amend her complaint by filing a motion for leave to amend. (Id.) On August 7, 2023, Plaintiff filed a motion for leave to amend her complaint. (Doc. No. 27.) On September 1, 2023, Defendant opposed Plaintiff’s motion, citing the same jurisdictional issues identified in Defendant’s motion to dismiss. (Doc. No. 29.) On September 27, 2023, the Court granted Plaintiff’s motion for leave to amend and specifically deferred “consideration of Defendant’s challenges to the merits of Plaintiff’s proposed amended complaint until after Plaintiff files it.” (Doc. No. 33 at 3.) On September 29, 2023, Plaintiff filed the operative first amended class action complaint. (Doc. No. 34, “FAC”.) By the present motion, Defendant moves to dismiss Plaintiff’s FAC pursuant to Federal Rule of Civil Procedure 12(b)(1) for lack of subject matter jurisdiction, Federal Rule of Civil Procedure 12(b)(2) for lack of personal jurisdiction, and Federal Rule of Civil Procedure 12(b)(6) for failure to state a claim. (Doc. No. 37-1.) On January 10, 2024, Defendant provided the Court with notice of supplemental authority in support of its motion to dismiss. (Doc. No. 44.) Defendant moves to dismiss Plaintiff’s complaint pursuant to Federal Rule of Civil Procedure 12(b)(1), 12(b)(2), and 12(b)(6) for lack of subject matter jurisdiction, lack of personal jurisdiction, and for failure to state a claim,1 respectively. (Doc. No. 37-1.) Specifically, Defendant argues that Plaintiff’s claims should be dismissed because Plaintiff failed to establish that she suffered an injury in fact and thus lacks standing to bring her claims.2 (See id.) I. Legal Standard A. Federal Rule of Civil Procedure 12(b)(1) Federal Rule of Civil Procedure 12(b)(1) authorizes a court to dismiss claims for lack of subject matter jurisdiction. “Rule 12(b)(1) jurisdictional attacks can be either facial or factual.” White v. Lee, 227 F.3d 1214, 1242 (9th Cir. 2000). “In a facial attack, the challenger asserts that the allegations contained in a complaint are insufficient on their face to invoke federal jurisdiction. By contrast, in a factual attack, the challenger disputes the

1 Because the Court grants Defendant’s motion to dismiss on subject matter jurisdiction grounds, the Court declines to reach the question as to whether Plaintiff has personal jurisdiction or states a claim for relief. 2 Defendant requests that the Court take judicial notice and/or incorporate by reference Defendant’s Privacy Policy. (Doc. No. 37-2; Doc. No. 37-4, Ex. A to Declaration of Aarti Reddy.) Plaintiff opposes Defendant’s request for judicial notice and/or incorporation by reference. (Doc. No. 39.) The Court notes that Plaintiff references Defendant’s Privacy Policy throughout her FAC. (See FAC ¶¶ 21, 79, 89, 90.) However, because the Court’s analysis under Federal Rule of Civil Procedure 12(b)(1) does not rely on Defendant’s Privacy Policy, the Court denies Defendant’s request for judicial notice truth of the allegations that, by themselves, would otherwise invoke federal jurisdiction.” Safe Air for Everyone v. Meyer, 373 F.3d 1035, 1039 (9th Cir. 2004). Here, Defendant’s Rule 12(b)(1) briefing focuses solely on the allegations in Plaintiff’s complaint, and, thus, Defendant makes a facial attack under Rule 12(b)(1). (See Doc. No. 37-1 at 22-23.) “In deciding a Rule 12(b)(1) facial attack motion, a court must assume the facts alleged in the complaint to be true and construe them in the light most favorable to the nonmoving party.” Strojnik v. Kapalua Land Co. Ltd., 379 F. Supp. 3d 1078, 1082 (D. Haw. 2019) (citing Warren v. Fox Family Worldwide, Inc., 328 F.3d 1136, 1139 (9th Cir. 2003)); see Savage v. Glendale Union High Sch., Dist. No. 205, Maricopa Cty., 343 F.3d 1036, 1039 (9th Cir. 2003); Rimac v. Duncan, 319 F. App’x 535, 536 (9th Cir. 2009). B. Article III Standing Article III of the Constitution “confines the federal judicial power to the resolution of ‘Cases’ and ‘Controversies.’” TransUnion LLC v. Ramirez, 141 S. Ct. 2190, 2203 (2021). “For there to be a case or controversy under Article III, the plaintiff must have a personal stake in the case—in other words, standing.” Id. Standing consists of three elements: “a plaintiff must show (i) that he suffered an injury in fact that is concrete, particularized, and actual or imminent; (ii) that the injury was likely caused by the defendant; and (iii) that the injury would likely be redressed by judicial relief.” Id. (citing Lujan v. Defs. of Wildlife, 504 U.S. 555, 560-61 (1992)). “The plaintiff, as the party invoking federal jurisdiction, bears the burden of establishing these elements.” Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016). The first element, injury-in-fact, requires “a plaintiff [to] show that he or she suffered ‘an invasion of a legally protected interest’ that is ‘concrete and particularized’ and ‘actual or imminent, not conjectural or hypothetical.’” Spokeo, 578 U.S. at 339 (citing Lujan, 504 U.S. at 560). In Spokeo, the Supreme Court made clear that a plaintiff may not “allege a bare procedural violation, divorced from any concrete harm, and satisfy the injury-in-fact requirement of Article III.” 578 U.S. at 341. Rather, “‘Article III standing requires a concrete injury even in the context of a statutory violation.’” TransUnion, 141 S. Ct. at 2205 (quoting Spokeo, 578 U.S. at 341). A legislature’s creation of a statutory prohibition or obligation and a cause of action does not relieve courts of their responsibility to independently decide whether a plaintiff has suffered a concrete harm under Article III. Id. “[U]nder Article III, an injury in law is not an injury in fact.” Id. “[C]ertain harms readily qualify as concrete injuries under Article III. The most obvious are traditional tangible harms, such as physical harms and monetary harms.” TransUnion, 141 S. Ct. at 2204. “Various intangible harms can also be concrete.” Id.; see Spokeo, 578 U.S. at 340. “Chief among them are injuries with a close relationship to harms traditionally recognized as providing a basis for lawsuits in American courts[,] . . . for example, reputational harms, disclosure of private information, and intrusion upon seclusion.” TransUnion, 141 S. Ct. at 2204. In the privacy context, the Ninth Circuit “has stated that ‘violations of the right to privacy have long been actionable at common law,’ and CIPA ‘codif[ies] a substantive right to privacy, the violation of which gives rise to a concrete injury sufficient to confer standing.’” Byars v. Sterling Jewelers, Inc., No. 5:22-CV-01456-SB-SP, 2023 WL 2996686 at *3 (C.D. Cal. Apr. 5, 2023) (quoting In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 599 (9th Cir. 2020)). The Ninth Circuit has also clarified that the right to privacy encompasses an “‘individual’s control of information concerning his or her person.’” Facebook, 956 F.3d at 598 (quoting Eichenberger v. ESPN, Inc., 876 F.3d 979, 983 (9th Cir. 2017)); see U.S. Dep’t of Just. v. Reps. Comm. For Freedom of Press, 489 U.S. 749, 763 (1989) (“[B]oth the common law and the literal understandings of privacy encompass the individual’s control of information concerning his or her person.”). As this Court previously articulated in its July 17, 2023 Order, district courts “make their decisions regarding whether a plaintiff has stated a legally protectible privacy interest based on the nature of the information at issue.” (Doc. No. 26 at 8 (quoting In re Yahoo Mail Litig., 7 F. Supp. 3d 1016, 1040 (N.D. Cal. 2014).). A plaintiff must identify the “‘specific personal information she disclosed that implicates a protectible privacy interest’” to survive a motion to dismiss. (Id. (quoting Byars, 2023 WL 2996686, at *3).) Mere assertion a violation of CIPA or invasion of the plaintiff’s right to privacy is insufficient to confer standing under Article III. (See id. at 8-9.) II. Analysis The Court previously dismissed Plaintiff’s complaint for lack of subject matter jurisdiction under Federal Rule of Civil Procedure 12(b)(1). (Doc. No. 26.) In its July 17, 2023 Order, the Court held that Plaintiff failed to plead an injury in fact necessary for Article III standing because she had not alleged that Noom collected information over which she had a protectable privacy interest. (Id. at 10.) Specifically, Plaintiff’s conclusory allegations that Noom collected her “personal information”—without specifying the type of information—could not establish that she suffered a concrete harm. (Id.) Upon initial review, the FAC appears to have remedied the deficiencies identified by the Court. But for the reasons below, deficiencies in the FAC remain. The FAC details the type of “personal information” Plaintiff allegedly disclosed to Defendant. Plaintiff alleges she disclosed “sensitive personal health information” via the Noom Survey, which Noom and its Session Replay Provider captured and shared without her consent. (FAC ¶¶ 14, 76.) Plaintiff contends the Noom Survey “asks potential customers to input their personal health information (including current weight, ideal weight, sex, gender identity, and age) and answer questions about their fitness goals, eating and exercise habits, medical and family history, mental health, home environment, marital status, weight loss motivations and struggles, and personal lifestyle.” (Id. ¶ 75.) Plaintiff further alleges that FullStory “records all of Noom’s website visitor actions, including substantive personal information typed by Noom’s website users” and discloses this information without Website visitors’ consent. (Id. ¶ 64.) Defendant argues that these new allegations still do not establish that Defendant collected information over which Plaintiff has a protectible privacy interest for purposes of Article III standing. (Doc. No. 37-1 at 22.) Specifically, Defendant asserts that the FAC fails to allege that Plaintiff provided Defendant with any identifiable information that would allow Defendant to connect her alleged responses to the Noom Survey to Plaintiff herself. (See FAC ¶¶ 58-85.) Defendant claims that the lack of connection between the information Plaintiff allegedly disclosed and Plaintiff is fatal to her claim. (Doc. No. 37-1 at 22.) The Court agrees. The disclosure of non-individually identifiable data is insufficient to give rise to an injury-in-fact to support Article III standing. Cahen v. Toyota Motor Corp., 717 F. App’x 720, 724 (9th Cir. 2017) (“Plaintiffs have not pleaded sufficient facts demonstrating how the aggregate collection and storage of non-individually identifiable driving history and vehicle performance data cause an actual injury.”); Popa v. PSP Grp., LLC, No. C23-0294JLR, 2023 WL 7001456, at *5 (W.D. Wash. Oct. 24, 2023) (dismissing session replay provider lawsuit on 12(b)(1) grounds where plaintiff did not allege that defendant was able to connect the information collected to her identity); Massie v. Gen. Motors LLC, No. CV 21-787-RGA, 2022 WL 534468, at *5 (D. Del. Feb. 17, 2022) (“Plaintiffs do not have a reasonable expectation of privacy over the anonymized data captured by the Session Replay software at issue here.”). The court’s decision in Cook v. GameStop, Inc., No. 2:22-CV-1292, 2023 WL 5529772 (W.D. Pa. Aug. 28, 2023), is directly on point. GameStop involved a similar challenge to session replay technology under Pennsylvania’s wiretap statute. Id. at *1. There, the court dismissed the action for lack of Article III standing because the plaintiff failed to allege that she disclosed “any personally identifying information at any point during her [online] interaction. Not her name. Not her address. Not her credit card information. Nothing that could connect her browsing activity to her.” Id. at *4 (emphasis omitted). The plaintiff “didn’t even provide her basic contact information when she browsed the GameStop website.” Id. at *4, n. 2. Because the plaintiff’s online browsing was “completely anonymous” her allegations did “not set forth a concrete harm.” Id. at *4. The GameStop court’s conclusion is consistent with other courts, which have found that the collection of non-individually identifiable data does not give rise to an actual injury under Article III. See Popa, 2023 WL 7001456, at *5; Saeedy v. Microsoft Corp., No. 23- CV-1104, 2023 WL 8828852, at *4 (W.D. Wash. Dec. 21, 2023) (collecting cases); Hernandez v. Noom, Inc., No. 1:23-CV-00641-JRR, 2023 WL 8934019 at *8-9 (D. Md. Dec. 27, 2023). Here, the FAC does not allege that Plaintiff provided any personally identifiable information that would allow Noom to link the “sensitive health information” she purportedly provided via the Noom Survey to Plaintiff. (See FAC.) The FAC does not allege that she entered her name, email address, credit card details, or other contact information on Defendant’s Website. Neither does the FAC allege that Plaintiff purchased any product on Noom’s Website. Put differently, Plaintiff’s activity on Defendant’s website was basically anonymous. Without a connection between the information she allegedly disclosed to Defendant and Plaintiff herself, Plaintiff’s allegations in the FAC are insufficient to establish she suffered a concrete harm to support Article III standing. See GameStop, 2023 WL 5529772, at *4. Additionally, the FAC’s allegations regarding Session Replay Providers’ capacities are likewise insufficient to confer standing. For example, the FAC alleges that “Session Replay Code does not necessarily anonymize user sessions” and “[s]ome Session Replay Providers explicitly offer website owners cookie functionality that permits linking a session to an identified user, who may be personally identified if the website owner has associated the user with an email address or username.” (FAC ¶¶ 46, 49.) However, these allegations do not pertain to Defendant or even purport to allege that these capabilities were executed by Defendant during Plaintiff’s visit to Defendant’s Website. See In re BPS Direct, LLC, No. 22-CV-4709, 2023 WL 8458245, at *12 (E.D. Pa. Dec. 5, 2023) (citations omitted) (“We need to know what session replay code actually captured, not what session replay code is capable of capturing.”). In response, Plaintiff does not address whether the lack of connection between the “sensitive personal health information” and Plaintiff is fatal to her claim. (Doc. No. 38 at 13-15.) Rather, Plaintiff asserts that the FAC sufficiently alleges an injury in fact based on the allegations that Noom “secretly recorded her communications and procured a third party to intercept and eavesdrop on her in real time” without her consent. (Doc. No. 38 at 15; see also FAC ¶¶ 1-6.) According to Plaintiff, her allegations of Defendant’s violations of CIPA and her right to privacy—in and of themselves—constitute a concrete injury in fact sufficient to confer Article III standing. (Doc. No. 38 at 15.) In the Court’s prior Order, the Court thoroughly rejected the argument that the bare assertion of a statutory harm is sufficient to confer standing. (Doc. No. 26 at 8-9.) Plaintiff’s argument ignores the Court’s prior Order and the Supreme Court’s holding in TransUnion both of which dismissed her theory outright. (Doc. No. 26 at 9; see also TransUnion, 141 S. Ct. at 2205 (“[U]nder Article III, an injury in law is not an injury in fact.”).) The relevant question is whether Plaintiff has adequately pled that she disclosed information over which she had a protectible privacy interest. See Byars, 2023 WL 2996686, at *3. As discussed above, Plaintiff has failed to do so. Plaintiff’s reliance on In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589 (9th Cir. 2020), is once again misplaced. Plaintiff claims Facebook stands for the proposition that CIPA “codif[ied] a substantive right to privacy, the violation of which gives rise to a concrete injury sufficient to confer standing.” (Doc. No. 38 at 14 (quoting 956 F.3d at 599).) However, the Ninth Circuit’s decision did not purport to find Article III standing merely from the bare assertion of a statutorily granted privacy right. Rather, in Facebook, the court found that the plaintiffs adequately alleged that Facebook’s tracking and collection practices, which correlated users’ browsing history with users’ personal Facebook profiles, would cause harm or material risk of harm to the plaintiffs’ interest in controlling their personal information. 956 F.3d at 598-599. What the court found there, and what is missing here, is a connection between the personal information and the plaintiffs. Id.

Plaintiff’s citation to the Ninth Circuit’s recent decision in Jones v. Ford Motor Co., 85 F.4th 570 (9th Cir. 2023), is equally unavailing. In Jones, the court found that the plaintiffs plausibly alleged Article III standing where the plaintiffs alleged that the defendants compiled and permanently stored “all text messages and call logs from [the p]laintiffs’ cell phones . . . without [the p]laintiffs’ knowledge or consent” as soon as their phones connected to the defendant’s on-board vehicle entertainment system. 85 F.4th 570 at 574. In contrast to Jones and Facebook, Plaintiff does not allege that Defendant collects, tracks, or discloses any individually identifiable data or that Defendant has or does anything to connect the information that she allegedly disclosed via the Noom Survey to her. (See FAC.) Accordingly, Plaintiff’s FAC is insufficient to establish she suffered a concrete harm. Thus, Plaintiff has failed to satisfy the injury in fact element for Article III standing and the Court must dismiss Plaintiff’s claims for lack of subject matter jurisdiction. Esquivel v. Fresno Cnty. Dep’t of Soc. Servs., No. 22-16975, 2023 WL 8014223 at *1 (9th Cir. Nov. 20, 2023) (citation omitted) (“A lack of constitutional standing requires dismissal for lack of subject matter jurisdiction.”). Lastly, the Court finds that granting leave to amend would be futile and unduly prejudicial to Defendant. In its July 17, 2023 Order, the Court dismissed Plaintiff’s claims under Federal Rule of Civil Procedure 12(b)(1) for failure to allege an injury in fact sufficient to satisfy Article III standing. (Doc. No. 28 at 10-11.) The Court questioned whether Plaintiff could cure the deficiencies identified in its Order and warned that failure to cure the identified deficiencies may result in dismissal with prejudice and without leave to amend. Nonetheless, Plaintiff failed to cure the deficiencies. Because any amendment would be futile and unduly prejudicial to Defendant, leave to amend is denied. See. e.g., Ali v. Intel Corp., No. 18-CV-03981-LHK, 2019 WL 1369926, at *5 (N.D. Cal. Mar. 26, 2019), aff’d,797 F. App’x 325 (9th Cir. 2020) (dismissing claims without leave to amend following a court order warning the plaintiff that failure to cure the deficiencies may result in dismissal with prejudice and plaintiff’s subsequent failure to cure the deficiencies). /// /// /// /// /// For the reasons above, the Court grants Defendant’s motion to dismiss. The Court dismisses Plaintiff's complaint with prejudice and without leave to amend for lack of subject matter jurisdiction. || DATED: January 22, 2024 | | □□□ |. | | MARILYN. HUFF, Distri ge UNITED STATES DISTRICT COURT 1]