1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 7 DANA TURNER, et al., Case No. 22-cv-05827-DMR
8 Plaintiffs, ORDER 9 v. Re: Dkt. No. 49 10 NUANCE COMMUNICATIONS, INC., 11 Defendant.
12 This action began with two separately-filed putative class actions in which three named 13 plaintiffs alleged that Defendant Nuance Communications, Inc. (“Nuance”) violated the California 14 Invasion of Privacy Act (“CIPA”). The court consolidated the matters on May 31, 2023 and 15 Plaintiffs subsequently filed a consolidated amended class action complaint. [Docket No. 34 16 (“CFAC”).] Nuance moves to dismiss the CFAC for failure to state a claim under Federal Rule of 17 Civil Procedure 12(b)(6). [Docket No. 49 (“Mot.”).] The court held a hearing on April 11, 2024. 18 For the following reasons, the motion is granted in part and denied in part. 19 I. FACTUAL BACKGROUND 20 Plaintiffs make the following allegations in the CFAC, all of which are taken as true for purposes of the motion to dismiss.1 Nuance “markets and provides an artificial intelligence 21 software-as-a-service that allows businesses to authenticate their customers’ identities with their 22 voice,” called “Gatekeeper.” CFAC ¶ 1. Gatekeeper is a voice recognition software which 23 “records a consumer’s voice, creates a biometric voice print of the caller, and then examines that 24 voiceprint to determine whether the caller is a potential fraudster in future calls, and—above all— 25 26 1 When reviewing a motion to dismiss for failure to state a claim, the court must “accept as true all 27 of the factual allegations contained in the complaint.” Erickson v. Pardus, 551 U.S. 89, 94 (2007) 1 to determine whether the caller is telling the truth when identifying themselves and attempting to 2 gain access to their customer account.” Id. at ¶ 4. Businesses can license Gatekeeper and 3 integrate it into their call centers to verify callers’ identities. Id. at ¶¶ 5, 27. 4 Nuance’s marketing describes its Gatekeeper product as an “AI Risk Engine” which uses 5 “[d]eep neural networks” to “analyze biometric, non-biometric, and other available data to make 6 intelligent authentication and fraud risk assessments.” Id. at ¶ 31. Plaintiffs allege that Nuance 7 “analyzes ‘more than 1,000 characteristics’ of a person’s unique voice, such as the sound of a 8 person’s voice, how they talk, what they say, their pattern of speech, word choice, grammar, and syntax.” Id. at ¶ 2. Nuance can “authenticat[e] individuals by the way they talk . . . and flag[] 9 potential bad actors in as quick as half a second.” Id. at ¶ 28. Nuance’s technology works by 10 creating a voice print for each consumer derived from a recording and examination of the 11 consumer’s voice, enrolling those voice prints into a database, and then comparing the voice 12 characteristics of later callers against its saved voice prints. Id. at ¶ 29. A voice print serves as an 13 audible “fingerprint” which can “directly identify an individual.” Id. at ¶ 22. Plaintiffs allege that, 14 by “segment[ing]” and “cluster[ing]” voices and metadata from prior callers, “Nuance turns 15 individuals’ personal biometric data into a product offering for corporate clients.” Id. at ¶ 30. 16 Plaintiffs assert that Nuance has “amassed a massive database” of individuals’ voice prints and 17 retains that biometric data for “a significant period of time.” Id. at ¶¶ 32-33. 18 Plaintiffs claim that Nuance creates voice prints without the consumer’s “knowledge or 19 express written consent.” Id. at ¶ 37. Nuance’s software “seamlessly incorporates into its 20 customers’ call centers, without adequate notice (or any at all) that Nuance . . . is even involved in 21 the call.” Id. Plaintiffs allege that Nuance “listens to the consumer’s voice quietly in the 22 background of a call, and in such a way that consumers will likely be entirely unaware they are 23 unknowingly interacting with a third-party company.” Id. at ¶ 3. 24 According to Plaintiffs, Nuance’s voice recognition service exposes customers to 25 significant risks. For example, Plaintiffs state that voices are highly personal and can reveal 26 sensitive information about an individual’s mental state and behaviors. Id. at ¶ 6. They also aver 27 that artificial intelligence is “extremely susceptible to racial and gender bias,” and that voice 1 examination technology has been known to mistakenly classify legitimate customers as fraudsters 2 based on their voice, locking them out of their accounts and finances. Id. at ¶¶ 34-35. In addition, 3 they allege that Nuance’s system can be “easily fooled” by fraudsters, such as by using a free 4 online AI voice cloning service with an audio recording of a person’s voice. Id. at ¶ 36. 5 Plaintiff Turner called Chase’s customer support call center on numerous occasions, 6 including most recently in October 2022. Id. at ¶ 44. Turner alleges that she reasonably expected 7 her conversation with Chase to be confidential because Chase was a banking entity, “which 8 naturally involves the discussion of confidential information,” and because Turner spoke to Chase on her personal telephone and not in the direct presence of others. Id. at ¶ 45. During the call 9 with Chase, Turner was asked to make various “yes” or “no” statements in order to respond to 10 questions Chase asked her, or to otherwise provide additional information to Chase. Id. at ¶ 46. 11 Unbeknownst to Turner, her call was recorded by Nuance’s technology, which created a voice 12 print for Turner and automatically enrolled her voice print in Nuance’s biometric voice print 13 database. Id. at ¶¶ 47-48. Turner asserts that she did not give her consent, written or otherwise, to 14 “allow Nuance to wiretap her confidential communications with Chase.” Id. at ¶ 50-51. 15 Plaintiffs Smith and Youshei allege similar facts. They both called Chase’s customer 16 support call center multiple times during the past three years. Id. at ¶¶ 54, 63. They allege that 17 they reasonably expected their conversations with Chase to be confidential. Id. at ¶¶ 55, 64. 18 However, their calls were recorded by Gatekeeper, which created a voice print for each Plaintiff 19 and automatically enrolled the voice prints in Nuance’s biometric voice print database. Id. at ¶¶ 20 57, 66. Neither Nuance nor Chase disclosed to Plaintiffs that their voices were being recorded or 21 analyzed by Nuance to make a voice print, nor that their voice prints were being enrolled in 22 Nuance’s voice print database. Id. at ¶¶ 59, 68. Plaintiffs Smith and Youshei allege that they did 23 not consent to Nuance “collect[ing] [their] voice print[s] and to examine, record, wiretap, or 24 analyze [their] voice[s] for any purpose whatsoever.” Id. at ¶¶ 60, 69. 25 Plaintiffs assert that Nuance violated Cal. Penal Code §§ 631(a), 632(a), and 637.3. They 26 seek to represent a statewide class of similarly situated individuals, defined as: “All residents of 27 the State of California who had their voice prints, voice stress patterns, or other elements of their 1 conversation recorded and examined by Nuance without first obtaining prior written consent.” 2 CFAC ¶ 72. Plaintiffs seek declarative relief, injunctive relief, and damages. Id. at 10. 3 II. PROCEDURAL BACKGROUND 4 Turner brought a putative class action on October 6, 2022. [Docket No. 1.] Turner filed a 5 first amended class action complaint on January 9, 2023. [Docket No. 19.] Smith and Youshei 6 also brought a putative class action, which the court related to Turner’s case on March 30, 2023. 7 [Docket No. 27.] The cases were subsequently consolidated on May 31, 2023. [Docket No. 33.] 8 Plaintiffs filed the CFAC on June 14, 2023. Nuance now moves to dismiss the CFAC. 9 III. LEGAL STANDARD 10 A motion to dismiss under Rule 12(b)(6) tests the legal sufficiency of the claims alleged in 11 the complaint. See Parks Sch. of Bus., Inc. v. Symington, 51 F.3d 1480, 1484 (9th Cir. 1995). 12 When reviewing a motion to dismiss for failure to state a claim, the court must “accept as true all 13 of the factual allegations contained in the complaint,” Erickson, 551 U.S. at 94 (2007) (citation 14 omitted), and may dismiss a claim “only where there is no cognizable legal theory” or there is an 15 absence of “sufficient factual matter to state a facially plausible claim to relief.” Shroyer v. New 16 Cingular Wireless Servs., Inc., 622 F.3d 1035, 1041 (9th Cir. 2010) (citing Ashcroft v. Iqbal, 556 17 U.S. 662, 677-78 (2009); Navarro v. Block, 250 F.3d 729, 732 (9th Cir. 2001)) (quotation marks 18 omitted). A claim has facial plausibility when a plaintiff “pleads factual content that allows the 19 court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” 20 Iqbal, 556 U.S. at 678 (citation omitted). In other words, the facts alleged must demonstrate 21 “more than labels and conclusions, and a formulaic recitation of the elements of a cause of action 22 will not do.” Bell Atl. Corp. v. Twombly, 550 U.S. 554, 555 (2007) (citing Papasan v. Allain, 478 23 U.S. 265, 286 (1986)); see Lee v. City of L.A., 250 F.3d 668, 679 (9th Cir. 2001), overruled on 24 other grounds by Galbraith v. Cty. of Santa Clara, 307 F.3d 1119 (9th Cir. 2002). 25 As a general rule, a court may not consider “any material beyond the pleadings” when 26 ruling on a Rule 12(b)(6) motion. Lee, 250 F.3d at 688 (citation and quotation marks omitted). 27 However, “a court may take judicial notice of ‘matters of public record,’” id. at 689 (citing Mack 1 whose contents are alleged in a complaint and whose authenticity no party questions, but which 2 are not physically attached to the pleading,” without converting a motion to dismiss under Rule 3 12(b)(6) into a motion for summary judgment. Branch v. Tunnell, 14 F.3d 449, 454 (9th Cir. 4 1994), overruled on other grounds by Galbraith, 307 F.3d at 1125-26. The court need not accept 5 as true allegations that contradict facts which may be judicially noticed. See Mullis v. U.S. Bankr. 6 Court, 828 F.2d 1385, 1388 (9th Cir. 1987). 7 IV. DISCUSSION 8 California enacted CIPA in 1967 “to replace prior laws that permitted recording of 9 telephone conversations when one party consents.” Lopez v. Apple, Inc., 519 F. Supp. 3d 672, 688 10 (N.D. Cal. 2021) (citing Flanagan v. Flanagan, 27 Cal. 4th 766, 768 (2002)). The Legislature 11 was responding to concerns “that advances in science and technology have led to the development 12 of new devices and techniques for the purpose of eavesdropping upon private communications.” 13 Cal. Penal Code § 630. “The Legislature thus enacted CIPA ‘to protect the right of privacy of the 14 people of’ California from what it perceived as ‘a serious threat to the free exercise of personal 15 liberties [that] cannot be tolerated in a free and civilized society.’ . . . This philosophy lies ‘at the 16 heart of virtually all decisions construing [CIPA].’” Lopez, 519 F. Supp. 3d at 688 (quoting Ribas 17 v. Clark, 38 Cal. 3d 355, 359 (1985)). 18 Plaintiffs bring claims under three sections of CIPA: Cal. Penal Code §§ 631(a), 632(a), 19 and 637.3. 20 Section 631 is titled “Wiretapping.” Section 631(a) contains four clauses which impose 21 liability for “distinct and mutually independent patterns of conduct.” Tavernetti v. Superior Ct., 22 22 Cal. 3d 187, 192 (1978). The first three clauses are at issue here. They impose liability on any 23 person who: (1) intentionally taps, or makes any unauthorized connection . . . with 24 any telegraph or telephone wire, line, cable, or instrument, (2) or who willfully and without the consent of all parties to the 25 communication . . . reads, or attempts to read, or to learn the contents or meaning of any message . . . while the same is in transit 26 or passing over any wire, line, or cable, or is being sent from, or received at any place within this state; 27 (3) or who uses, or attempts to use, in any manner, or for any purpose, 1 Cal. Penal Code § 631(a) (line breaks and subdivisions added).2 To make out a section 631 claim, 2 plaintiffs must sufficiently allege that they did not consent to the defendant’s conduct. See Silver 3 v. Stripe Inc., No. 4:20-CV-08196-YGR, 2021 WL 3191752, at *3 (N.D. Cal. July 28, 2021) 4 (finding that consent is appropriate to consider on a motion to dismiss CIPA claims). In addition, 5 plaintiffs must show that the defendant was a third party who was not a participant in the 6 communication. See Rogers v. Ulrich, 52 Cal.App.3d 894, 900 (1975) (finding that only third 7 parties can be liable under section 631). Plaintiffs assert that they have stated a claim under each 8 of the first three clauses of section 631(a). 9 Section 632 is titled “Eavesdropping on or recording confidential communications.” It 10 imposes liability on any person who “intentionally and without the consent of all parties to a 11 confidential communication, uses an electronic amplifying or recording device to eavesdrop upon 12 or record the confidential communication.” Cal. Penal Code § 632(a). The three elements of a 13 section 632(a) claim are: “(1) an electronic recording of (or eavesdropping on); (2) a ‘confidential’ 14 communication; and (3) all parties did not consent.” Weiner v. ARS Nat. Servs., Inc., 887 F. Supp. 15 2d 1029, 1032 (S.D. Cal. 2012) (citing Flanagan v. Flanagan, 27 Cal.4th 766, 774–76 (2002)). 16 The statute imposes liability for either eavesdropping or recording; Plaintiffs assert a claim under 17 both prongs. 18 Plaintiffs also assert a claim under section 637.3. The statute reads: “No person or entity in 19 this state shall use any system which examines or records . . . voice prints or other voice stress 20 patterns of another person to determine the truth or falsity of statements made by such other 21 person without his or her express written consent given in advance of the examination or 22 recordation.” Cal. Penal Code § 637.3. Plaintiffs assert that Nuance (1) examined or recorded 23 Plaintiffs’ voice prints, (2) without their prior written consent, (3) in order to determine the truth 24 or falsity of statements made by Plaintiffs. 25 Nuance moves to dismiss all of Plaintiffs’ claims by arguing that Plaintiffs gave prior 26
27 2 The fourth clause, which imposes liability on any person who “aids, agrees with, employs, or 1 written consent to be recorded in their phone calls with Chase. Nuance also moves to dismiss the 2 section 631 claims and the eavesdropping prong of the section 632 claim because Nuance argues 3 that it is not an eavesdropping third party subject to CIPA. Specific to the second and third 4 clauses of section 631, Nuance argues that Plaintiffs failed to allege that Nuance intercepted the 5 “content or meaning” of any purported communication, or that it “used” any purportedly 6 intercepted information for any purpose other than providing the information to Chase. See Cal. 7 Penal Code § 631(a). Lastly, Nuance asserts that Plaintiffs’ section 637.3 claim fails because 8 Nuance’s technology does not determine the truth or falsity of statements made. 9 A. Consent 10 To make out a claim under sections 631(a) and 632(a), Plaintiffs must allege that Nuance’s 11 conduct was without Plaintiffs’ consent. See Silver, 2021 WL 3191752, at *3; Weiner, 887 F. 12 Supp. 2d at 1032. To state a section 637.3 claim, Plaintiffs must allege the lack of “express 13 written consent.” See Cal. Penal Code § 637.3(a). 14 Plaintiffs assert that “[n]either Nuance nor Chase disclosed” to Plaintiffs that their voices 15 were being “recorded or analyzed by Nuance to make a voice print . . . for the purposes of 16 determining the truth or falsity of [Plaintiffs’] statements. Likewise, [Plaintiffs] did not give [their] 17 consent, written or otherwise, to either Nuance or Chase to allow Nuance to wiretap [their] confidential communications with Chase.” CFAC ¶¶ 50, 59, 68. Nuance contends that Plaintiffs 18 provided express written consent. Mot. 4. It requests that the court take judicial notice of eight 19 exhibits which it asserts demonstrate Plaintiffs’ consent, contradicting Plaintiffs’ allegations in the 20 CFAC. [Docket No. 50 (Request for Judicial Notice, “RJN”); 50-1 (Deck Decl., July 17, 2023) 21 Exs. A-E; 50-2 (Moore Decl., July 18, 2023) Exs. A-C.] Plaintiffs do not dispute the authenticity 22 of the documents, instead arguing that the language of the documents is too ambiguous to 23 constitute consent to Nuance’s conduct. Opp’n 7. 24 A district court generally may not consider any material beyond the pleadings in ruling on 25 a Rule 12(b)(6) motion. Branch, 14 F.3d at 453. If “matters outside the pleading are presented to 26 and not excluded by the court,” the court must treat the motion as a Rule 56 motion for summary 27 1 documents attached to the complaint, documents incorporated by reference in the complaint, or 2 matters of judicial notice—without converting the motion to dismiss into a motion for summary 3 judgment.” United States v. Ritchie, 342 F.3d 903, 908 (9th Cir. 2003). “Both of these procedures 4 permit district courts to consider materials outside a complaint, but each does so for different 5 reasons and in different ways.” Khoja v. Orexigen Therapeutics, Inc., 899 F.3d 988, 998 (9th Cir. 6 2018). The Ninth Circuit has cautioned courts about the appropriate use of judicial notice and the 7 incorporation by reference doctrine when ruling on Rule 12(b)(6) motions:
8 The overuse and improper application of judicial notice and the incorporation-by-reference doctrine . . . can lead to unintended and 9 harmful results. Defendants face an alluring temptation to pile on numerous documents to their motions to dismiss to undermine the 10 complaint, and hopefully dismiss the case at an early stage. Yet the unscrupulous use of extrinsic documents to resolve competing 11 theories against the complaint risks premature dismissals of plausible claims that may turn out to be valid after discovery. . . . If defendants 12 are permitted to present their own version of the facts at the pleading stage—and district courts accept those facts as uncontroverted and 13 true—it becomes near impossible for even the most aggrieved plaintiff to demonstrate a sufficiently “plausible” claim for relief. 14 Such undermining of the usual pleading burdens is not the purpose of judicial notice or the incorporation-by-reference doctrine. 15 Id. (internal citations omitted). 16 Federal Rule of Evidence 201 governs judicial notice. Under Rule 201, a court may take 17 judicial notice of “an adjudicative fact if it is ‘not subject to reasonable dispute.’” Id. at 999 18 (quoting Fed. R. Evid. 201(b)). A fact is “not subject to reasonable dispute” if it is “generally 19 known,” or “can be accurately and readily determined from sources whose accuracy cannot 20 reasonably be questioned.” Fed. R. Evid. 201(b). While a court may take judicial notice of 21 matters of public record without converting a motion to dismiss into a motion for summary 22 judgment, it may not take judicial notice of disputed facts stated in public records. Lee, 250 F.3d 23 at 690. “Just because [a] document itself is susceptible to judicial notice does not mean that every 24 assertion of fact within that document is judicially noticeable for its truth.” Khoja, 899 F.3d at 25 999. If a court takes judicial notice of a document, it must identify the specific fact or facts it is 26 noticing from the document. Id. 27 In contrast, the incorporation by reference doctrine is “a judicially-created doctrine that 1 treats certain documents as though they are part of the complaint itself.” Id. at 1002. This is to 2 prevent “plaintiffs from selecting only portions of documents that support their claims, while 3 omitting portions that weaken—or doom—their claims.” Id. Incorporation by reference is 4 appropriate “if the plaintiff refers extensively to the document or the document forms the basis of 5 the plaintiff’s claim.” Id. at 1002 (quoting Ritchie, 342 F.3d at 907). However, if a document 6 “merely creates a defense to the well-pled allegations in the complaint, then that document did not 7 necessarily form the basis of the complaint.” Id. Further, “the mere mention of the existence of a 8 document is insufficient to incorporate the contents of a document.” Id. (quoting Coto Settlement 9 v. Eisenberg, 593 F.3d 1031, 1038 (9th Cir. 2010)). The Ninth Circuit has instructed that “the 10 doctrine is not a tool for defendants to short-circuit the resolution of a well-pleaded claim.” Id. 11 Thus, “while a court may assume [an incorporated document’s] contents are true for purposes of a 12 motion to dismiss under Rule 12(b)(6) . . . it is improper to assume the truth of an incorporated 13 document if such assumptions only serve to dispute facts stated in a well-pleaded complaint.” Id.; 14 see also id. at 1014 (“The incorporation-by-reference doctrine does not override the fundamental 15 rule that courts must interpret the allegations and factual disputes in favor of the plaintiff at the 16 pleading stage.”). 17 According to Nuance’s RJN, Exhibits A-C to the Declaration of Laura Deck are iterations 18 of the Deposit Account Agreement (“DAA”) which were in effect when Plaintiffs opened their 19 accounts with Chase Bank. Deck Decl. ¶¶ 2-7. Exhibits D-E are iterations of the DAA which 20 were in effect when Plaintiffs filed their class action lawsuits. Id. at ¶¶ 12-13. Some versions of 21 the DAAs include the language: “We may record and/or monitor any of our telephone 22 conversations with you. . . . We may use your voice to verify your identity.” Id. Exs. A, D and E § 23 VI.C. All of the DAAs also include a Privacy Notice, which states that Chase “can share your 24 personal information” “[f]or our everyday business purposes—such as to process your transactions 25 [and] maintain your account(s)[.]” Id. Exs. A-E at Privacy Notice at 1. Exhibit A to the 26 Declaration of Christopher Moore is a copy of the Personal Electronic Signature Card digitally 27 signed by Plaintiff Turner when she opened an account with Chase Bank. Moore Decl. ¶ 7. It 1 Exhibits B-C are copies of the Personal Signature Cards signed by Plaintiffs Youshei and Smith 2 when they opened accounts with Chase Bank. Id. at ¶¶ 8-9. The signature cards state that they 3 “acknowledge[d] receipt of the Bank’s Deposit Account Agreement . . . and agree[d] to be bound 4 by the terms and conditions contained therein as amended from time to time.” Id. Exs. B-C at 1. 5 The copies of the DAA and the signature cards were taken from Chase’s records. Deck Decl. ¶ 1; 6 Moore Decl. ¶ 2. 7 Nuance argues that the exhibits are incorporated by reference because lack of consent 8 forms the basis of their CIPA claims. See Garcia v. Enter. Holdings, Inc., 78 F. Supp. 3d 1125, 9 1136 (N.D. Cal. 2015) (finding that lack of consent is an express element of a CIPA claim). In 10 Garcia, the court took judicial notice of the defendant Zimride’s Terms of Service and Privacy 11 Policy because the plaintiff’s claim “necessarily depend[ed] on the application of Zimride’s 12 policies—which relate directly to the issue of consent.” Id. Nuance argues that, likewise, 13 Plaintiffs’ claims depend on the contents of the DAA. 14 Garcia was decided before Khoja clarified the proper standard for judicial notice and is not 15 binding on this court. Under Khoja, there are only “rare instances when assessing the sufficiency 16 of a claim” requires the incorporation of materials that the complaint did not reference at all, such 17 as a defamation claim where the plaintiff did not include the context of the allegedly defamatory 18 publication. Khoja, 899 F.3d at 1002 (citing Knievel v. ESPN, 393 F.3d 1068 (9th Cir. 2005)). 19 This case is not one of those “rare instances” because it is possible to assess the sufficiency of 20 Plaintiffs’ claims on the face of the complaint. See id. Plaintiffs clearly alleged that they were not 21 aware and did not consent to Nuance’s software recording and examining their voices. CFAC ¶¶ 22 50-51, 59-60, 68-69. Plaintiffs did not rely on the DAA for any of their claims. Nuance cites to 23 several cases which find that lack of consent is an element of a CIPA claim, but none of these 24 cases hold that it is appropriate to incorporate documents to find consent when the documents 25 were not even mentioned in the complaint. See, e.g., Silver, 2021 WL 3191752, at *4; Smith v. 26 Facebook, Inc., 262 F. Supp. 3d 943, 955 (N.D. Cal. 2017). Incorporation of the DAA is not 27 appropriate in this instance. 1 current version of the DAA appears on a publicly available website. The court is not persuaded 2 that just because the latest version of a document is publicly available, all prior versions of the 3 document are judicially noticeable. To the contrary, Nuance admits that the DAA has been 4 revised multiple times over the years, so the current version of the DAA may not be the same as 5 the version Plaintiffs allegedly read. Cf. Hammerling v. Google LLC, No. 21-CV-09004-CRB, 6 2022 WL 17365255, at *4 (N.D. Cal. Dec. 1, 2022), aff’d, No. 22-17024, 2024 WL 937247 (9th 7 Cir. Mar. 5, 2024) (declining to take judicial notice of the most recent privacy policy of the 8 defendant because it may be different from the version read by plaintiffs). 9 Even if the court could take judicial notice of the DAA, there is a factual dispute over 10 whether the DAA sufficiently notified Plaintiffs of Nuance’s conduct. A court can find consent on 11 a motion to dismiss if the disclosures “‘explicitly notify’ users of the practice at issue. . . . The 12 disclosures must have only one plausible interpretation for a finding of consent.” Calhoun v. 13 Google LLC, 526 F. Supp. 3d 605, 620 (N.D. Cal. 2021) (quoting In re Google, Inc., 2013 WL 14 5423918, at *12 (N.D. Cal. Sept. 26, 2013)). Plaintiffs argue that the language of the DAA only 15 discloses that Chase, not third parties, may record consumers’ voices. Opp’n 8. Plaintiffs also 16 contend that the language in the Privacy Policy does not notify consumers that their live phone 17 conversations may be intercepted by third parties to create voice prints. Opp’n 8-11. This is a 18 factual dispute which is not appropriate for resolution at the pleadings stage. See In re Facebook, 19 Inc., Consumer Priv. User Profile Litig., 402 F. Supp. 3d 767, 789 (N.D. Cal. 2019) (“[I]f the 20 contract language at issue is reasonably susceptible to more than one interpretation, with one of 21 those interpretations suggesting consent and another belying it, the Court cannot decide the 22 consent issue in [the defendant’s] favor at the motion to dismiss stage.”); McCoy v. Alphabet, Inc., 23 No. 20-CV-05427-SVK, 2021 WL 405816, at *6 (N.D. Cal. Feb. 2, 2021) (declining to find 24 consent on a motion to dismiss because defendant did not disclose how it used plaintiffs’ data with 25 the sufficient “level of specificity”).3 26 3 In a CIPA case, it is unclear whether it is ultimately the defendant’s or the plaintiff’s burden to 27 prove the issue of consent. See Brown v. Google LLC, No. 4:20-CV-3664-YGR, 2023 WL 1 The court denies Nuance’s request for judicial notice and denies the motion to dismiss on 2 the issue of consent. 3 B. “Third Party” Under Sections 631 and 632 4 Participants in a conversation cannot be held liable for unauthorized wiretapping under 5 section 631; only a third party who intercepts that conversation is culpable. See Rogers, 52 Cal. 6 App. 3d at 900 (“It is never a secret to one party to a conversation that the other party is listening 7 to the conversation; only a third party can listen secretly to a private conversation.”). For the same 8 reason, a party cannot “eavesdrop” on their own conversation under the first prong of section 632.4 9 Only a third party can do that. See Thomasson v. GC Servs. Ltd. P’ship, 321 F. App'x 557, 559 10 (9th Cir. 2008) (finding that the defendant was not liable for monitoring the defendant’s own 11 phone call with plaintiffs under the eavesdropping prong of section 632). 12 To make out their claims under section 631 and the first prong of section 632, Plaintiffs 13 must allege that Nuance was a third party intercepting Plaintiffs’ conversations with Chase. 14 Nuance argues that Plaintiffs have failed to meet this burden because Nuance only provided a tool 15 that Chase used for its own purposes. Mot. 9. According to Nuance, its voice recognition 16 software is “merely an extension of” Chase, so Nuance did not intercept Plaintiffs’ conversations 17 as a third party. Id. at 9-10. Plaintiffs argue that Nuance does more than offer a tool—it actively 18 offers and conducts an eavesdropping service as an independent third party. Opp’n 17. 19 Two seminal California Supreme Court cases delineate when a defendant is a third party 20 and when a defendant merely provides a tool to a participant in the conversation. In Ribas, the 21 court found that third-party liability is triggered when there is an “unannounced second auditor” to 22 a conversation, such as when a participant invites a third person to simultaneously “listen on an 23 (finding that the plaintiff has the burden to prove lack of consent). It is not necessary for the court 24 to resolve this issue in adjudicating this motion. 25 4 Section 632 makes it illegal to either “eavesdrop upon or record” confidential communications. Cal. Penal Code § 632(a) (emphasis added). The third party doctrine applies to “eavesdropping,” 26 but not “recording.” See, e.g., Kearney v. Salomon Smith Barney, Inc., 39 Cal. 4th 95, 119 (2006) (finding that a defendant can be liable under section 632 for recording its own conversation with 27 plaintiff if plaintiff did not consent to the recording). At the April 11, 2024 hearing, Nuance 1 extension telephone” to a conversation with an unknowing participant. Ribas v. Clark, 38 Cal. 3d 2 355, 358-361 (1985). By contrast, in Rogers, the court found that third-party liability is not 3 triggered if a participant uses a “tape recorder jack . . . installed on [the] telephone by the 4 telephone company” to record a phone conversation and later play it back to a third party. Rogers, 5 52 Cal. App. 3d at 897-99. Therefore, the question before the court is whether Nuance’s artificial 6 intelligence software is more like the “unannounced second auditor” in Ribas, or the “tape 7 recorder” in Rogers. Put differently, “the question boils down to whether [Nuance] was an 8 independent third party hired to eavesdrop on [Chase’s] communications, or whether [Nuance’s] 9 software was merely a tool that [Chase] used to record its own communications with plaintiff.” 10 See Williams v. What If Holdings, LLC, No. C 22-03780 WHA, 2022 WL 17869275, at *3 (N.D. 11 Cal. Dec. 22, 2022). 12 Nuance argues that it is not a third party because the alleged artificial intelligence software 13 does not capture communications for Nuance’s own uses, but only to facilitate Chase’s purposes. 14 Mot. 10. Nuance cites Graham v. Noom, Inc., which found that third-party liability was not 15 triggered where a software-as-a-service (“SaaS”) provider captured a client website’s visitor data, 16 hosted the data on the SaaS provider’s servers, and allowed the client to review that data. 533 F. 17 Supp. 3d 823, 832 (N.D. Cal. 2021). In Graham, the defendant FullStory developed a software 18 which could record a website visitor’s data such as “keystrokes, mouse clicks, and page scrolling.” 19 Id. at 828. Clients could put FullStory’s code on their websites, and then see a “playback” of how 20 each visitor was using its website. Id. Visitors’ data was stored in the cloud on FullStory’s 21 servers. Id. The Graham court found that FullStory was not a third party under section 631 22 because it was only a “vendor” that “provide[d] a tool . . . that allow[ed] [a client] to record and 23 analyze its own data in aid of [the client’s] business.” Id. at 832-33. Key to the court’s decision 24 was its finding that “there are no allegations here that FullStory intercepted and used the data 25 itself. Instead, as a service provider, FullStory is an extension of [the client].” Id. Nuance argues 26 that, likewise, Plaintiffs do not allege that Nuance used the intercepted data for its own purposes. 27 Plaintiffs make two counter-arguments: (1) Graham is distinguishable on its facts, and (2) 1 intercepted data for its own purposes to qualify as a third party. Opp’n 18-20. As to the first 2 point, Plaintiffs argue that the SaaS provider in Graham was more like a tape recorder because it 3 was only capable of capturing and storing data for the client’s review. See Graham, 533 F. Supp. 4 3d at 832-33. In contrast, Nuance is not like a tape recorder because it uses captured data to 5 conduct sophisticated biometric analyses, such as creating voice prints and authenticating 6 customers. CFAC ¶¶ 28-31. For this reason alone, Plaintiffs argue that Graham does not apply. 7 To support the second point, Plaintiffs cite Saleh v. Nike, Inc., 562 F. Supp. 3d 503, 520 8 (C.D. Cal. 2021) and Javier v. Assurance IQ, LLC, 649 F. Supp. 3d 891, 900 (N.D. Cal. 2023), 9 which both found that the statutory language of section 631(a) does not require the SaaS provider 10 to use the intercepted information for its own purposes in order to be a third party. Instead, a 11 plaintiff only needs to plead that the SaaS provider has “the capability to use its record of the 12 interaction for any other purpose” independently of its client. Javier, 649 F. Supp. 3d at 900 13 (emphasis in original). If the SaaS provider can monitor, analyze, and store information and can 14 use that information for independent purposes, then it has capabilities “beyond the ordinary 15 function of a tape recorder,” so it is a third party. Id. (quoting Yoon v. Lululemon USA, Inc., 549 16 F. Supp. 3d 1073, 1081 (C.D. Cal. 2021)). 17 There is a split in the Ninth Circuit on the standard used to define a third party. On this 18 issue, Javier is instructive. Judge Breyer identified two problems with including the defendant’s 19 actual use of the intercepted data as a necessary element to prove that the defendant is a third 20 party. Javier, 649 F. Supp. 3d at 900. The first is that “use” is already an element of the third 21 clause of section 631, which penalizes anyone “who uses, or attempts to use, in any manner, or for 22 any purpose, or to communicate in any way, any information” obtained by unauthorized 23 wiretapping. Cal. Penal Code § 631(a). Therefore, “reading a use requirement” into all three 24 clauses would “add requirements that are not present (and swallow the third [clause] in the 25 process).” Javier, 649 F. Supp. 3d at 900. The California Supreme Court has emphasized that the 26 three clauses of Cal. Penal Code § 631(a) are “three distinct and mutually independent patterns of 27 conduct,” which supports Judge Breyer’s reasoning and conclusion. See Tavernetti, 22 Cal. 3d at 1 Second, the California Supreme Court in Ribas did not consider the alleged eavesdropper’s 2 intentions or how they used the information they obtained. Javier, 649 F. Supp. 3d at 900 (citing 3 Ribas, 38 Cal. 3d at 360–61). “Instead, [the Ribas court] emphasized the privacy concerns at issue 4 with having an ‘unannounced second auditor’ listening in on the call, when Section 631 concerns 5 ‘the right to control the nature and extent of the firsthand dissemination of [their] statements.’” Id. 6 (quoting Ribas, 38 Cal. 3d at 360–61). Following this reasoning, Judge Breyer found only two 7 ways that a SaaS provider like Nuance may fall under the party exception: “(1) If [Nuance] does 8 not have the capability to use its record of the interaction for any other purpose (just as a tape 9 recorder has no independent capability to divulge the recording for any other purpose but that of 10 its owner); or (2) the ubiquity of services like [Nuance] effectively renders it party to the ‘firsthand 11 dissemination’ of [Plaintiffs’] information to [Chase].” See id. (citing Ribas, 38 Cal. 3d at 360– 12 61). 13 The court is persuaded by the reasoning in Javier, tracking a growing number of district 14 courts which have reached the same conclusion. See, e.g., Balletto v. Am. Honda Motor Co., No. 15 23-CV-01017-JSW, 2023 WL 7026931, at *2 (N.D. Cal. Oct. 24, 2023); Yockey v. Salesforce, 16 Inc., No. 22-CV-09067-JST, --- F.Supp.3d ---, 2023 WL 5519323, at *5 (N.D. Cal. Aug. 25, 17 2023); Valenzuela v. Super Bright LEDs Inc., No. EDCV2301148JAKSPX, 2023 WL 8424472, at 18 *7 (C.D. Cal. Nov. 27, 2023); Rodriguez v. Ford Motor Co., No. 323CV00598RBMJLB, --- 19 F.Supp.3d ---, 2024 WL 1223485, at *13 (S.D. Cal. Mar. 21, 2024). 20 Nuance does not contend that its services are ubiquitous. The question therefore turns on 21 whether Nuance had the “capability” to use the recorded phone conversations for its own 22 purposes. See Javier, 649 F. Supp. 3d at 900. “To ask a plaintiff to plead with great particularity 23 exactly what a third-party software company is capable of doing with data gathered from 24 defendant’s website sets the pleading bar too high. . . . However, a plaintiff still must have at least 25 pled some non-conclusory factual allegations to support the use capabilities of the third-party 26 software company involved.” Heiting v. Taro Pharms. USA, Inc., No. 2:23-CV-08002-SPG-E, --- 27 F.Supp.3d ---, 2023 WL 9319049, at *4 (C.D. Cal. Dec. 26, 2023). The Balletto cases provide 1 defendant’s motion to dismiss because the plaintiff failed to show that the SaaS provider, 2 Salesforce, was a third party. 2023 WL 7026931, at *1-2. The plaintiff’s complaint alleged that 3 Salesforce “analyze[d] customer-support agent interactions in real time to create live transcripts 4 of” chat communications on the client’s website. Id. at *1. The court found that this did not 5 support a reasonable inference that Salesforce was capable of using the communications for any 6 purpose other than furnishing them to the client. Id. at *3. After amendment, the court in Balletto 7 II allowed the complaint to go forward. Balletto v. Am. Honda Motor Co., No. 23-CV-01017- 8 JSW, 2024 WL 589090, at *3 (N.D. Cal. Feb. 13, 2024). The plaintiff added allegations that 9 Salesforce “intercepts . . . communications and sends those communications to its Einstein data 10 intelligence platform. . . . Salesforce then has the capability to use the information contained in 11 chats ‘to (i) improve Salesforce’s own products and services; (ii) develop new Salesforce products 12 and services; and (iii) analyze Chat communications to assist with customer service interactions 13 and data analytics.’” Id. at *1 (citation omitted). This was sufficient to show that Salesforce was 14 a third party. Id. at *3. 15 Plaintiffs have sufficiently alleged that Nuance is capable of using intercepted data for 16 purposes other than furnishing the data back to the client. The CFAC states that Nuance turns 17 recordings of consumers’ voices into “voice print[s],” enrolls those voice prints into a database of 18 voice prints, and then compares the voice characteristics of later callers against its saved voice 19 prints. CFAC ¶ 29. Plaintiffs allege that Nuance developed an “AI Risk Engine” which uses 20 “[d]eep neural networks” to “analyze” consumers’ voices and “make intelligent authentication and 21 fraud risk assessments.” Id. at ¶ 31. Plaintiffs also assert that Nuance has “amassed a massive 22 database” of voice prints, including a “watchlist” of “known fraudsters,” and retains the voice 23 prints for “a significant period of time.” Id. at ¶¶ 32-34. Based on these allegations, the court may 24 reasonably infer that at the very least, Nuance can use consumers’ voice prints to improve its own 25 products and services—for example, to improve the accuracy of its authentication software for 26 uses beyond benefiting Chase.5 This is sufficient to show that Nuance is capable of creating, 27 1 recording, and retaining biometric data for purposes other than sending the data back to Chase. 2 Plaintiffs have adequately alleged that Nuance is an independent third party. Nuance’s 3 motion to dismiss Plaintiffs’ claims under section 631 and the eavesdropping prong of section 632 4 based on the third-party doctrine is denied. 5 C. Failure to State a Claim Under Section 631 6 Nuance argues that Plaintiffs have failed to state a claim under the second and third clauses 7 of section 631. The second clause of the statute prohibits “[willfully] attempting to learn the 8 contents or meaning of a communication in transit over a wire.” Tavernetti, 22 Cal. 3d at 192 9 (citing Cal. Penal Code § 631(a)). The third clause prohibits “attempting to use or communicate 10 information obtained as a result of” violating the first two clauses of the statute. Id. According to 11 Nuance, Plaintiffs’ claim under the second clause fails because Plaintiffs did not allege that 12 Nuance learned the “contents or meaning” of communications. Mot. 13. Nuance argues that 13 Plaintiffs’ claim under the third clause fails because Plaintiffs did not plead that Nuance “used” 14 the allegedly intercepted recordings. Id. at 15. 15 1. Contents or Meaning 16 In order to state a claim under the second clause of section 631, Plaintiffs must identify the 17 “contents” of the communications that Nuance allegedly intercepted. See Brodsky v. Apple Inc., 18 445 F. Supp. 3d 110, 127 (N.D. Cal. 2020). The term “contents” is defined as “any information 19 concerning the substance, purport, or meaning of that communication.” Id. (quoting 18 U.S.C. § 20 2510).6 “Contents” refers to “the intended message conveyed by the communication,” as opposed 21 to “record information regarding the characteristics of the message that is generated in the course 22 of the communication.” In re Zynga Priv. Litig., 750 F.3d 1098, 1106 (9th Cir. 2014). For 23 example, text messages qualify as contents. Brodsky, 445 F. Supp. 3d at 127 (citing In re Carrier 24 IQ, Inc., 78 F. Supp. 3d 1051, 1083 (N.D. Cal. 2015)). The “source, destination, duration, and 25
26 court now grants them leave to amend the CFAC for other purposes discussed below.
27 6 This definition is drawn from the Wiretap Act, the “federal counterpart” of CIPA. Bradley v. 1 time of a call” are not considered contents. United States v. Reed, 575 F.3d 900, 916 (9th Cir. 2 2009). 3 Nuance argues that its software only analyzes the “characteristics” of the allegedly 4 intercepted communications, namely the speaker’s identity. Mot. 14. This ignores Plaintiffs’ 5 allegations that Nuance authenticates consumers by analyzing the substance of their conversations 6 with Chase, including “word choice, grammar, syntax, and other elements across messaging and 7 transcribed voice interactions.” CFAC ¶ 30. Nuance’s challenge fails because this is clearly 8 content, not just “characteristics” of communications. In the simplest terms, Plaintiffs allege that 9 Nuance identifies speakers by analyzing “[w]hat they say.” CFAC ¶ 31. 10 2. Use of Information 11 In order to establish a claim under the third clause of section 631, Plaintiffs must allege 12 that Nuance “uses, or attempts to use, in any manner, or for any purpose, or to communicate in any 13 way,” the information it obtains by violating the first two clauses. Cal. Penal Code § 631(a). 14 Nuance argues that Plaintiffs’ claim under the third clause fails because Nuance does not use the 15 allegedly intercepted data “for any purpose outside of furnishing it to customers like Chase to 16 support the customers’ fraud detection efforts.” Mot. 15. Plaintiffs argue that creating voice 17 prints and analyzing the voice prints to identify fraud is itself a “use” that triggers CIPA liability. 18 Opp’n 22. 19 Nuance appears to conflate “use” under the third clause of section 631 with “use” or 20 “capability of use” under the third-party analysis discussed above. Nuance cites Licea v. Old 21 Navy, LLC, which followed the Graham line of cases to find that the SaaS provider was not a third 22 party because it did not “record[] . . . customers’ information for its independent use.” 669 F. 23 Supp. 3d 941, 946–47 (C.D. Cal. 2023). As noted above, this court does not follow Graham. 24 Moreover, Licea is not helpful because it dismissed the section 631 claims based on the third-party 25 analysis and did not reach “use” under the third clause. Nuance also cites cases following Javier 26 which dismissed the section 631 claims because the SaaS provider was not a third party. See, e.g., 27 Rodriguez, 2024 WL 1223485, at *13 (finding that the plaintiff did not adequately allege that the 1 benefit”). But these cases also did not reach the third clause of 631. In other words, Nuance’s 2 cases are inapposite. The third-party analysis discussed above is distinct from the analysis of the 3 third clause of section 631; nowhere does Nuance explain why it is appropriate to inject 4 considerations from the third-party doctrine into the third clause of section 631. 5 To the contrary, the statutory language prohibits the use of intercepted communications “in 6 any manner, or for any purpose.” Cal. Penal Code § 631(a). The statute does not contain the 7 limiting language Nuance wants to read into it—i.e., that the statute prohibits use, except if the 8 purpose of the use is to benefit a party to the communication. A broad reading of “use” is 9 supported by the case law. For example, in Valenzuela v. Nationwide Mut. Ins. Co., the court 10 joined the Javier line of cases in finding that the SaaS provider was a third party even if it did not 11 use the data for its own independent purposes. No. 222CV06177MEMFSK, --- F.Supp.3d ---, 12 2023 WL 5266033, at *7 (C.D. Cal. Aug. 14, 2023). Separately, the court considered use under 13 the third clause of section 631. Id. at *6. The court found that the plaintiff met her burden to 14 show use because she alleged that the SaaS provider harvested data as part of its business model, 15 even if such data was only harvested for the client’s benefit. Id. at *6. In other words, data 16 harvesting is a “use” under section 631, and “any purpose” includes for the sole benefit of the 17 client. See id. The third prong of section 631 does not require a use independent of the client. 18 Nuance does not dispute that Plaintiffs have alleged that Nuance “uses its recordings of 19 customers’ voices to create voice prints, which Nuance then uses to assess whether customers are 20 who they purport to be and sends real-time alerts to Chase to confirm the identities of customers.” 21 [Docket No. 53 (Reply) 13.] Nuance’s only argument is that the alleged uses were for the benefit 22 of Chase, not Nuance. Id. But “[n]othing more is required” to show use under the third clause of 23 section 631. See Valenzuela, 2023 WL 5266033, at *6. 24 Nuance’s motion to dismiss Plaintiffs’ section 631 claim on these grounds is denied. 25 D. Failure to State a Claim Under Section 637.3 26 Section 637.3 prohibits the examining or recording of “voice prints or other voice stress 27 patterns . . . to determine the truth or falsity of statements made.” Cal. Penal Code § 637.3(a). 1 make during their telephone conversations with call centers,” such as consumers’ “assertions 2 regarding their respective identities” and “various ‘yes’ or ‘no’ statements in order to respond to 3 questions.” CFAC ¶¶ 40, 46. Nuance argues that Plaintiffs have only alleged that Gatekeeper 4 functions as a means of identification, not as a lie detector. Mot. 21. 5 There are very few cases about the application of section 637.3 to emerging technology 6 like Gatekeeper, but Balanzar v. Fidelity Brokerage Services, LLC is directly on point. 654 F. 7 Supp. 3d 1075 (S.D. Cal. 2023). In Balanzar, the defendant’s voice authentication technology 8 “create[d] a ‘biometric voice print’ of a caller, which [was] saved and used to verify the caller’s 9 identity . . . [t]hrough natural conversation.” Id. at 1078. The court held that such technology was 10 “nothing more than a biometric passcode and [was] not a lie detector.” Id. at 1086. Likewise, 11 Plaintiffs have alleged that Gatekeeper uses biometric voice prints to verify a caller’s identity “by 12 the way they talk, text and type . . . flagging potential bad actors in as quick as half a second.” 13 CFAC ¶ 28. Plaintiffs attempt to distinguish Balanzar by arguing that, when a customer calls 14 Chase for the first time, they are asked a series of “yes” or “no” questions to identify themselves, 15 and Nuance analyzes those statements for their truth when authenticating the customer. Opp’n 24. 16 These allegations are vague and conclusory. Rather, the pleadings suggest that Gatekeeper uses 17 general conversation to create an audible “fingerprint,” which is then used to directly identify an 18 individual. CFAC ¶ 22. This is similar to the “biometric passcode” in Balanzar. See Balanzar, 19 654 F. Supp. 3d at 1086. 20 Plaintiffs urge the court to extend section 637.3 to include biometric voice authentication 21 as a “new generation[] of lie detector[].” Opp’n 23. This stretches beyond the plain meaning of 22 section 637.3, which is limited to technology used “to determine the truth or falsity of statements 23 made.” Cal. Penal Code § 637.3(a). The allegations in the CFAC do not lead to a reasonable 24 inference that Gatekeeper determines the truth or falsity of any specific statements; only that 25 Gatekeeper “compare[s] the voice characteristics of later callers against their saved voice prints” 26 to identify a caller. CFAC ¶ 29. 27 At the hearing, Plaintiffs stated that they can amend their complaint to plead specific 1 Therefore, Plaintiffs’ claim under section 637.3 is dismissed with leave to amend the CFAC to 2 address the deficiencies identified in this order. 3 V. CONCLUSION 4 Defendant’s motion to dismiss Plaintiffs’ claims under CIPA sections 631 and 632 is 5 denied. Defendant’s motion to dismiss Plaintiffs’ claim under section 637.3 is granted with leave 6 to amend. As discussed in footnote 5, Plaintiffs shall also amend the CFAC to more specifically 7 allege that Nuance uses its Chase database of voice prints for other clients. The amended 8 complaint is due on June 18, 2024. 9 10 IT IS SO ORDERED. 11 Dated: May 28, 2024 12 ______________________________________ Donna M. Ryu 13 Chief Magistrate Judge 14 15 16 17 18 19 20 21 22 23 24 25 26 27