Rodriguez v. Google LLC

Opinion

1 2 3 4 5 6 9 ANIBAL RODRIGUEZ, et al., 10 Case No. 20-cv-04688-RS Plaintiffs, 11 v. ORDER GRANTING IN PART 12 MOTION TO “CLARIFY” CLASS GOOGLE LLC, DEFINITION 13 Defendant. 14

16 This a privacy class action against Google with three claims: intrusion upon seclusion, 17 invasion of privacy, and violation of the Comprehensive Computer Data Access and Fraud Act 18 (CDAFA), Cal. Penal Code § 502 et seq. Plaintiffs represent class members who had certain 19 Google privacy settings, referred to as Webb App & Activity (WAA) and supplemental Web App 20 & Activity (sWAA), turned off during the class period. Two classes were certified on January 3, 21 2024, and the parties now seek to disseminate class notice. Accordingly, Plaintiffs filed a motion 22 to direct notice to class members, seeking approval of the proposed notice plan. However, during 23 the parties’ meet and confer regarding class notice, a dispute arose about whether certain 24 categories of Google accounts are part of the class. This threshold issue, which was not briefed by 25 either side at class certification, must be resolved before notice may be issued. Supplemental 26 briefing was consequently ordered, and Google subsequently filed the instant motion for 27 clarification of the class definition. 2 The two classes certified in this case are defined as: 3 Class 1: All individuals who, during the period beginning July 1, 2016 and continuing through the present (the “Class Period”), (a) had their 4 “Web & App Activity” and/or “supplemental Web & App Activity” setting turned off and (b) whose activity on a non-Google-branded 5 mobile app was still transmitted to Google, from (c) a mobile device running the Android operating system, because of the Firebase 6 Software Development Kit (“SDK”) and/or Google Mobile Ads SDK. 7 Class 2: All individuals who, during the Class Period (a) had their “Web & App Activity” and/or “supplemental Web & App Activity” 8 setting turned off and (b) whose activity on a non-Google-branded mobile app was still transmitted to Google, from (c) a mobile device 9 running a non-Android operating system, because of the Firebase SDK and/or Google Mobile Ads SDK. 10 11 At the most recent case management conference, the parties agreed to submit their 12 proposed class notice plan on February 29, 2024. That motion was timely filed, however the 13 parties identified two lingering issues that required resolution before class notice could be 14 disseminated. The first issue pertained to directing notice via email to class members and the 15 security of that data, and on March 8, 2024, the parties submitted a joint letter brief stating that 16 issue was resolved. 17 The second dispute is the subject of the instant order. The parties disagree whether two 18 categories of Google accounts are included in the class definition: Enterprise Dasher (“Dasher”) 19 accounts, or accounts created by businesses or organizations for their employees or other 20 members, and Supervised Unicorn (“Unicorn”) accounts, i.e., accounts created for children under 21 thirteen by their parents. Dasher accounts are managed by an enterprise administrator, who 22 controls both the initial account settings, including the WAA and sWAA settings, and the range of 23 Google services available to a user. Monsees Decl. ¶ 5-7. A Dasher user does not set the Google 24 privacy settings, including WAA and sWAA, when creating the account. Id. at ¶ 7. However, if a 25 Dasher user turns WAA off, an enterprise administrator may not necessarily override that 26 decision. Ruemmler Tr. at 173:18-23. Similarly, a Unicorn account is designed for children under 27 the age of thirteen, created and supervised by their parents or guardians. Id. at ¶ 8. A separate 1 Google account belonging to the parent or guardian is necessary to create and manage the Unicorn 2 account’s settings, including privacy-related settings. Id. Some Unicorn accounts do not even have 3 associated Google email addresses. Like Dasher accounts, Unicorn users do not see or set WAA or 4 sWAA settings at account creation. Id. at ¶ 11. The parent or guardian has the authority to decide 5 whether the Unicorn user can modify their activity controls at all. Id. at ¶ 9. The account 6 disclosures for Unicorn accounts are identical to those of regular Google accounts, except they 7 replace “your data” with “your child’s data.” Fair Tr. at 172:21-23; Dkt. 377-6. Google suggests it 8 did not raise this issue in opposition to class certification because it assumed that individuals “who 9 cannot enable or disable sWAA should [not] be in the classes defined by Plaintiffs.” Plaintiffs, on 10 the other hand, charge Google with raising these objections belatedly, risking prejudice to 11 individuals who thought this case included their account types, and maintains that including these 12 account types is consistent with the aims of this litigation. 14 A court retains jurisdiction to rescind, alter, or amend the class certification order prior to 15 final judgment in “light of subsequent developments in the litigation,” for the order is “inherently 16 tentative.” Gen. Tel. Co. of Southwest v. Falcon, 457 U.S. 147, 160 (1982); Fed. R. Civ. P. 17 23(c)(1)(C). “Any amendment must, however, satisfy the requirements of Rule 23.” Peel v. 18 Brooksam Mortg. Corp., No. SACV1100079JLSRNBX, 2014 WL 12589317, at *3 (C.D. Cal. 19 Nov. 13, 2014) (citation omitted); see also Ms. L. v. U.S. Immigration & Customs Enf't, 330 20 F.R.D. 284, 287 (S.D. Cal. 2019) (“In considering the appropriateness of [modification or] 21 decertification, the standard of review is the same as a motion for class certification: whether the 22 Rule 23 requirements are met.”) (alteration in original) (citation omitted). 24 A. Procedural Issues 25 Google first insists that its motion is procedurally appropriate because it is merely seeking 26 to clarify the class definition, and “[c]ourts routinely clarify ambiguities in class definitions.” To 27 be sure, where true ambiguities exist in class definitions, clarification may be useful in 1 determining what is and is not in the bounds of the class definition. Here, however, no such 2 ambiguity exists. The plain language of the certified classes clearly identifies, with particularity, 3 class members as “all individuals” who had their WAA and sWAA settings turned off. It does not 4 limit the class to all individuals who by themselves turned those settings off. This unambiguous 5 language was unopposed at class certification. Moreover, Google’s insistence that it had no way of 6 knowing that Plaintiffs meant to include Dasher and Unicorn accounts in the class definition is 7 untenable based on even its own attached exhibit, which shows a discussion between counsel for 8 both sides during the deposition of Google’s rebuttal expert, John Black, that raised, at the very 9 least, ambiguity regarding this issue. See Dkt. 375-2 at 6. Likewise, Plaintiffs’ expert Jonathan 10 Hochman discussed both Dasher and Unicorn accounts in his expert reports, and the fact that 11 Black excluded those accounts in his technical analysis is inapposite here. Further, Michael 12 Lasinski, who was the subject of Google’s Daubert motion that was briefed concurrently to class 13 certification, also included Dasher and Unicorn accounts in his analysis. 14 On this basis, Lasinski’s calculations were not challenged in the Daubert motion or related 15 filings. Google was therefore on notice at class certification that Plaintiffs were contemplating 16 including those accounts in the certified classes, evidenced by their proposed definition of the 17 classes consisting of “all individuals” who had disabled their WAA/sWAA settings. Accordingly, 18 Google’s artful attempt to portray the instant motion as one seeking merely to clarify the class 19 definition to align with the class certification order is unavailing. It is more fitting to characterize 20 the instant motion as a request to modify the class certification order to exclude Dasher and 21 Unicorn accounts. Nonetheless, while Plaintiffs are correct that Google’s objections should have 22 been raised at class certification, the “inherently tentative” nature of the class certification order, 23 “particularly during the period before any notice is sent to the members of the class,” permits 24 review of Google’s motion for modification so as to ensure the class, as defined, comports with 25 the stringent requirements of Rule 23. See Falcon, 457 U.S. at 160. 26 B. Commonality, Typicality, Adequacy 27 Plaintiffs’ proposed classes were certified because they met the 23(a) requirements of 1 commonality, numerosity, typicality, and adequacy as well as the requirements of both 23(b)(3) 2 and 23(b)(2). Google insists that the inclusion of Dasher and Unicorn accounts in the certified 3 classes disturbs the commonality, typicality, and adequacy requirements under 23(a). 23(a)(2) 4 requires that “questions of law or fact” be common to the class, (a)(3) mandates that the “claims or 5 defenses of the representative parties [be] typical of the claims or defenses of the class,” and (a)(4) 6 requires the class representatives to “fairly and adequately protect the interests of the class.” 7 Commonality is met because Google’s representations and conduct as to the WAA and 8 sWAA settings are common to the class, even with Dasher and Unicorn accounts included. 9 Google conflates the predominance inquiry of 23(b)(3) and the commonality question of 23(a)(2). 10 To satisfy 23(a)(2), “even a single common question will do,” whereas the 23(b)(3) inquiry 11 requires common questions to predominate over individual ones. Wal-Mart Stores, Inc. v. Dukes, 12 564 U.S. 338, 359 (2011) (internal quotes omitted). The class representatives of the two classes 13 are also typical and adequate representatives of the class, inclusive of Dasher and Unicorn 14 accounts. Named Plaintiffs’ claims “are typical of those of the class members” because “each class 15 member’s claim arises from the same course of events, and each class member makes similar legal 16 arguments to prove the defendant’s liability.” Rodriguez v. Hayes, 591 F.3d 1105, 1124 (9th Cir. 17 2010) (quoting Armstrong v. Davis, 275 F.3d 849, 868 (9th Cir. 2001)). “Like the commonality 18 requirement, the typicality requirement is permissive and requires only that the representative’s 19 claims are ‘reasonably co-extensive with those of absent class members.’” Id. (quoting Hanlon v. 20 Chrysler Corp., 150 F.3d 1011, 1020 (9th Cir. 1998)). 21 Here, Plaintiffs satisfy that standard even as to Dasher or Unicorn users who had WAA or 22 sWAA off during the class period as that conduct is typical of all class members. Further, named 23 plaintiffs’ claims are typical of the class members, arising from the same course of events, alleging 24 the same injury, and carrying the same legal arguments. The adequacy requirement is also met 25 because Google has failed to show how class counsel or named Plaintiffs’ claims or interests 26 conflict with those of Dasher or Unicorn users, or that they will fail to prosecute this action 27 vigorously on behalf of those users. See Hanlon v. Chrysler Corp., 150 F.3d 1011, 1020 (9th Cir. 1 1998); Falcon, 457 U.S. at 158 n.13. Accordingly, the classes, inclusive of Dasher and Unicorn 2 accounts, meet the 23(a) requirements. 3 C. Predominance1 4 23(b)(3) requires a finding that questions of law and fact common to class members 5 predominate over individual ones, as well as a finding that a class action is the superior method of 6 adjudicating the controversy. Fed. R. Civ. P. 23(b)(3). “Implicit in the satisfaction of the 7 predominance test is the notion that the adjudication of common issues will help achieve judicial 8 economy.” Zinser v. Accufix Rsch. Inst., Inc. 253 F.3d 1180 (9th Cir. 2001) (quoting Valentino v. 9 Carter-Wallace, Inc., 97 F.3d 1227, 1234 (9th Cir. 1996)). For the certified classes, the 10 predominance condition was met, in part, because Plaintiffs established that Google’s 11 representations about the WAA and sWAA settings and its alleged misconduct are uniform across 12 the class, and because Plaintiffs’ averred claims are “subject to common proof.” Pertinently, the 13 predominance inquiry also rested on the notion that the relevant, uniform conduct here is the 14 proposed class members’ decisions affirmatively to turn off the WAA and sWAA buttons. Cf. 15 Hart v. TWC, No. 20-cv-03842-JST, 2023 WL 3568078 (N.D. Cal. Mar. 30, 2023). 16 A predominance inquiry necessitates analysis of what individual and common questions 17 exist as to the proposed class and averred claims. The intrusion upon seclusion and invasion of 18 privacy claims are frequently discussed together because they raise similar elements, whether “(1) 19 there exists a reasonable expectation of privacy, and (2) the intrusion was highly offensive.” In re 20 Facebook, Inc. Internet Tracking Litigation, 956 F.3d 589, 601 (9th Cir. 2020). Whether a 21 reasonable expectation of privacy exists is an objective question, evidenced by Google’s uniform 22 disclosures about the WAA and sWAA settings and the class members’ corresponding choices 23 affirmatively to switch those settings off. The second prong questions whether Google’s intrusion 24

25 1 Google focuses its motion on the deficiencies of the class as currently defined under 23(b)(3) and 26 does not touch on any deficiencies of the class under 23(b)(2). Having determined that typicality and adequacy are, in fact, met even with Dasher and Unicorn users, the instant order applies only 27 to the classes to the extent they were certified under 23(b)(3). 1 is offensive to a reasonable person. While these elements may be proven class-wide as to standard 2 Google users, these considerations break in the other direction vis-à-vis Dasher and Unicorn 3 accounts. Unlike the remaining class members, these users do not necessarily turn off the WAA or 4 sWAA settings themselves, nor do they always know if those settings are turned off. For Dasher 5 accounts, an enterprise administrator chooses the account settings, including whether to turn WAA 6 or sWAA off, at account creation. If the enterprise administrator turns WAA or sWAA on, an 7 employee might subsequently choose to turn those settings off, and this choice may not be 8 necessarily overridden by the enterprise administrator. Similarly, Unicorn accounts are managed 9 by parents or guardians who control the user’s privacy settings and decide whether the user can 10 even alter those settings. The configurations of these accounts necessarily raise individualized 11 factual questions of who actually engaged in the pertinent conduct for the purposes of class 12 certification; that is, switching off WAA or sWAA. Put differently, whether WAA or sWAA is off 13 for a Dasher or Unicorn account may represent the choice of someone distinct from the user (i.e., 14 class member), raising individualized inquiries about reasonable expectations of privacy, which 15 would unavoidably undermine the predominance prong of Rule 23(b)(3). 16 Despite Plaintiffs’ insistence otherwise, it does matter whether it is the administrator or 17 parent who chose to turn WAA or sWAA off or whether the actual user did so, because this 18 inquiry reflects the meaningfulness of the user’s choice and, therefore, whether they maintained a 19 reasonable expectation of privacy throughout the class period.2 It similarly signifies whether the 20 user or the enterprise administrator/parent actually saw Google’s disclosures and policies about the 21 WAA and sWAA settings, as this raises individual questions about whether users (as opposed to 22 their parents or administrators) consented to the complained about conduct. Plaintiffs’ argument 23 that a parent’s choice to switch WAA or sWAA off is no reason to “exclude children from this 24

25 2 Plaintiffs argue that Google must have information about the number of Dasher accounts for which sWAA was switched off by the user instead of the enterprise administrator, because Google 26 maintains records of when all users turned sWAA off or on. Even accepting that these records give Google this information, individualized inquiries would still exist as to whether it was the 27 enterprise administrator or the employee who switched sWAA off. 1 important privacy case” fails to persuade. The relevant inquiry here is not whether Unicorn users’ 2 privacy interests should be litigated at all, but whether common questions as to those accounts 3 predominate over individual ones.3 The need to investigate Dasher and Unicorn accounts’ conduct 4 as to these privacy settings necessarily raises individual questions that make class treatment 5 unmanageable and defeat predominance. 6 Inclusion of Dasher and Unicorn users in the classes does not, however, raise 7 individualized inquiries for the CDAFA claim. CDAFA makes it unlawful to “knowingly access[] 8 and without permission take…any data from a computer.” Cal. Penal Code § 502(c)(2). Whether 9 Google had “permission” to collect the data turns on what words or conduct were communicated 10 to Google, in this case, the status of the sWAA setting. California courts have yet to define what 11 “without permission” means in the CDAFA context, but courts in this district often suggest that a 12 defendant acts without permission when it circumvents “technical or code-based barriers.” See In 13 re Carrier IQ., Inc. 78 F. Supp. 3d 1051, 1100 (N.D. Cal. 2015) (collecting cases) (citations 14 omitted). Here, the relevant technical barrier is the WAA or sWAA settings. Plaintiffs insist that 15 “consent” was communicated to Google based on the status of the sWAA button, i.e., if it was 16 toggled off, Google took that to mean they had no permission to collect the data. Indeed, CDAFA 17 does not mandate that “consent” be given by the user and not the parent or enterprise 18 administrator. The other elements of CDAFA–whether Google knowingly accessed the data; 19 whether Google took, copied, or made use of any data from a computer; or whether class members 20 suffered any damage or loss–are unaddressed by Google and are also subject to common proof of 21 Google’s conduct. Therefore, as to the CDAFA claim, Dasher and Unicorn accounts are included 22 in the classes as defined. 23 D. Feasibility 24 While Google points out that not all Dasher and Unicorn accounts have associated email 25

26 3 Indeed, even accepting this argument, Dasher and Unicorn accounts remain part of the classes as 27 certified under 23(b)(2), discussed further below. 1 addresses, which makes it challenging to send class notice, Plaintiffs are correct that the Class 2 Administrator can undertake publication notice to reach those individuals without associated email 3 addresses through other methods. This might be enough for the transmission of notice, but 4 Plaintiffs have not provided a solution to the inevitable challenge that the notice language will 5 inevitably be different as to the Dasher and Unicorn accounts to identify which individual belongs 6 in the class. 7 E. Prejudice 8 The notion that excluding Dasher and Unicorn users from the 23(b)(3) classes will risk 9 unfair prejudice to them is questionable. Dasher users have personal Google accounts which, 10 provided the WAA or sWAA settings are off during the class period, would be included in the 11 class. Likewise, Unicorn accounts require parents to have their own Google accounts, and those 12 parents’ Google accounts would also be included in the classes provided the class definitions are 13 met. Plaintiffs suggest that excluding Dasher and Unicorn accounts from the certified classes 14 would require a separate action to litigate the interests of those users. This is not necessarily true. 15 In fact, those users may remain in the classes certified under 23(b)(2). For purposes of 23(b)(3), 16 however, predominance is a prerequisite that warrants exclusion of Dasher and Unicorn accounts 17 as to the intrusion upon seclusion and invasion of privacy claims. Dasher and Unicorn users may 18 attempt to bring these claims as individuals should they wish to do so. 19 Plaintiffs raise concerns that class members who thought they would be part of the classes 20 would be unfairly prejudiced if the applicable statute of limitations is no longer suspended upon 21 modification. See Am. Pipe & Const. Co. v. Utah, 414 U.S. 538, 554 (1978); Newberg & 22 Rubenstein on Class Action § 7.40. While tolling may be appropriate, Plaintiffs are to submit a 23 stipulated tolling agreement within two weeks or provide a proposed tolling order to which 24 Google may respond. 25 Plaintiffs also seek to direct notice to all Dasher and Unicorn accounts so they may be 26 made aware of their change in status. See Newberg & Rubenstein on Class Action § 7.40 (“If a 27 class certification order is modified to exclude some previous members of the class, these newly 1 excluded class members… should receive notice of this action”). In the interest of fairness to the 2 Dasher and Unicorn users, notice of their change in status is warranted. 3 Lastly, Plaintiffs seek permission to proceed on a Rule 23(b)(2) basis as to the Dasher and 4 Unicorn users even if the instant motion is granted so that injunctive relief may apply equally, 5 regardless of account type. Given that any declaratory or injunctive relief regarding Google’s 6 WAA or sWAA settings would impact all users, and because Google has failed to establish that 7 any of the 23(a) factors are deficient, inclusive of Dasher and Unicorn users, this request is also 8 granted. See Ellis v. Costco Wholesale Corp., 657 F.3d 970, 988 (9th Cir. 2011) (“the court [may] 9 certify a Rule 23(b)(2) class for equitable relief and a separate Rule 23(b)(3) class for damages”) 10 (internal citation omitted). 11 Accordingly, the classes certified under 23(b)(3) for the invasion of privacy and intrusion 12 upon seclusion claims are modified as follows: 13 Class 1: All “non-Enterprise” and “non-Unicorn” individuals who, during the period beginning July 1, 2016 and continuing through the 14 present (the “Class Period”), (a) had their “Web & App Activity” and/or “supplemental Web & App Activity” setting turned off and 15 (b) whose activity on a non-Google-branded mobile app was still transmitted to Google, from (c) a mobile device running the Android 16 operating system, because of the Firebase Software Development Kit (“SDK”) and/or Google Mobile Ads SDK. 17 Class 2: All “non-Enterprise” and “non-Unicorn” individuals who, 18 during the Class Period (a) had their “Web & App Activity” and/or “supplemental Web & App Activity” setting turned off and (b) whose 19 activity on a non-Google-branded mobile app was still transmitted to Google, from (c) a mobile device running a non-Android operating 20 system, because of the Firebase SDK and/or Google Mobile Ads SDK. 21

22 For the CDAFA claim, the 23(b)(3) classes as certified in the original class certification 23 order, Dkt. 352, see supra section II, remain the same (i.e., the CDAFA subclasses under 23(b)(3) 24 include Dasher and Unicorn users). Likewise, the 23(b)(2) classes follow the class definition as set 25 forth in the original class certification order and include Dasher and Unicorn users. 27 Google’s motion to modify the class certification order is granted in part. The hearing set 1 for April 11, 2024 is vacated per L.R. 7-1(b). The parties must inform the Court whether they plan 2 || on withdrawing and resubmitting a modified class notice plan in accordance with this order and 3 provide a briefing schedule as to the notice plan within one week. If the parties do not plan on 4 || filing a new motion, an order will be issued based on the class notice plan currently filed, Dkt. 5 370, without a hearing. Additionally, as stated above, Plaintiffs must file within two weeks a 6 stipulated tolling agreement or a proposed tolling order to which Defendants may respond. Finally, 7 Plaintiffs filed a motion to seal exhibits containing Google employee email addresses, internal 8 || code names, and commercially sensitive business information. The information sought to be 9 sealed is narrowly tailored, and the motion to seal is granted. Public, redacted versions of the 10 || exhibits must be filed within two weeks of this order. 11 12 || ITISSO ORDERED.

14 |] Dated: April 5, 2024 VLA 15 RICHARD SEEBORG = 16 Chief United States District Judge = 17 18 19 20 21 22 23 24 25 26 27 98 ORDER GRANTING MOTION TO “CLARIFY” CLASS DEFINITION CASE No. 20-cv-04688-RS