Williams v. DDR Media, LLC

Opinion

LORETTA WILLIAMS, Case No. 22-cv-03789-SI

Plaintiff, ORDER GRANTING MOTIONS TO v. DISMISS

DDR MEDIA, LLC, et al., Re: Dkt. Nos. 47, 48 Defendants.

Before the Court are defendants’ motions to dismiss. Dkt. Nos. 47, 48. For the reasons set forth below, the motions to dismiss are GRANTED. BACKGROUND1 Defendant Lead Intelligence, Inc. d/b/a Jornaya (“Jornaya”) provides a software known as “TCPA Guardian,” which websites use to document users’ consent to receive telemarketing calls. Dkt. No 43 at ¶ 5. One of the main features of TCPA Guardian is a “visual playback” function, which records in real time users’ keystrokes and clicks interacting with Jornaya’s client websites. Id. ¶¶ 2, 6. The TCPA Guardian records are “hosted on Jornaya’s servers,” and to access them one must follow a hyperlink provided by Jornaya. Id. ¶ 25. Jornaya also independently collects and stores website users’ information. Id. Defendant DDR Media, LLC d/b/a Royal Marketing Group (“DDR Media”) owns a website called scrappyrent2own.com. Id. ¶ 9. TCPA Guardian is installed on that website. Id. 1 Factual allegations are taken from the Amended Complaint and are assumed true for the purposes of a Motion to Dismiss. See Usher v. City of Los Angeles, 828 F.2d 556, 561 (9th Cir. On or around December 10, 2021, Loretta Williams visited DDR Media’s website. Id. ¶ 20. During her visit, her entire interaction with the website was recorded in real time by DDR Media and Jornaya via TCPA Guardian. Id. ¶ 23. This recording captured information including the plaintiff’s IP address, geographic location, name, address, and phone number. Id. ¶ 21, 22. DDR Media did not inform plaintiff of such recording or seek prior consent. Id. ¶ 24. On June 27, 2022, plaintiff Loretta Williams filed a complaint, on behalf of herself and those similarly situated, against defendants DDR Media and Jornaya. Dkt. No. 1. Claiming jurisdiction under CAFA, 28 U.S.C. § 1332(d), et seq., plaintiff brings causes of action pursuant to (1) the California Invasion of Privacy Act (“CIPA”), California Penal Code Section 631(a) (“Section 631(a)”), (2) California’s Unfair Competition Law Cal. Bus Prof. Code Section 17200, et seq. (“UCL”), and (3) the California Constitution. Id. On December 15, 2022, defendants filed a joint motion to compel arbitration, Dkt. No. 29, which the Court denied. Dkt. No. 36. Plaintiff filed an amended complaint. Dkt. No. 43. On April 12, 2023, DDR Media filed a motion to dismiss for failure to state a claim, lack of subject matter jurisdiction, and lack of Article III standing. Dkt. No. 47. On April 13, 2023, Jornaya also filed a motion to dismiss for failure to state a claim. Dkt. No. 48. Plaintiff opposes. Dkt. No. 50. The Court heard the motions on June 16, 2023, at 10:00 AM. Federal Rule of Civil Procedure 12(b)(1) allows a party to challenge a federal court’s jurisdiction over the subject matter of the complaint. As the party invoking the jurisdiction of the federal court, the plaintiff bears the burden of establishing that the court has the requisite subject matter jurisdiction to grant the relief requested. See Kokkonen v. Guardian Life Ins. Co. of America, 511 U.S. 375, 377 (1994) (internal citations omitted). A complaint will be dismissed if, looking at the complaint as a whole, it appears to lack federal jurisdiction either “facially” or “factually.” Thornhill Publ’g Co., Inc. v. General Tel. & Elecs. Corp., 594 F.2d 730, 733 (9th Cir. 1979); Safe Air for Everyone v. Meyer, 373 F.3d 1035, 1039 (9th Cir. 2004). When the complaint is challenged taken as true and construed in the light most favorable to the plaintiff. NL Indus. v. Kaplan, 792 F.2d 896, 898 (9th Cir. 1986). Under Federal Rule of Civil Procedure 12(b)(6), a district court must dismiss a complaint if it fails to state a claim upon which relief can be granted. To survive a Rule 12(b)(6) motion to dismiss, the plaintiff must allege “enough facts to state a claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). This “facial plausibility” standard requires the plaintiff to allege facts that add up to “more than a sheer possibility that a defendant has acted unlawfully.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). While courts do not require “heightened fact pleading of specifics,” a plaintiff must allege facts sufficient to “raise a right to relief above the speculative level.” Twombly, 550 U.S. at 555, 570. In deciding whether the plaintiff has stated a claim upon which relief can be granted, the court must assume that the plaintiff’s allegations are true and must draw all reasonable inferences in the plaintiff’s favor. See Usher v. City of Los Angeles, 828 F.2d 556, 561 (9th Cir. 1987). However, the court is not required to accept as true “allegations that are merely conclusory, unwarranted deductions of fact, or unreasonable inferences.” In re Gilead Scis. Sec. Litig., 536 F.3d 1049, 1055 (9th Cir. 2008). If the Court dismisses the complaint, it must then decide whether to grant leave to amend. The Ninth Circuit has “repeatedly held that a district court should grant leave to amend even if no request to amend the pleading was made, unless it determines that the pleading could not possibly be cured by the allegation of other facts.” Lopez v. Smith, 203 F.3d 1122, 1130 (9th Cir. 2000) (citations and internal quotation marks omitted). I. Unfair Competition Law In their motions to dismiss, defendants argue that plaintiff failed to state a claim under California’s UCL because plaintiff did not allege an injury in fact that involves loss of money or property. Dkt. No. 47 at 11; Dkt. No. 48 at 9. Plaintiff concedes that she does not have standing see Birdsong v. Apple, Inc., 590 F .3d 955, 959 (9th Cir. 2009) (holding that standing under the UCL requires the plaintiff to allege injury in fact and loss of money or property). Therefore, defendants’ motion to dismiss plaintiff’s UCL claim for failure to state a claim is granted without leave to amend.2 II. California Penal Code Section 631(a) Section 631(a) of the California Penal Code penalizes: Any person who, by means of any machine, instrument, or contrivance, or in any other manner, intentionally taps, or makes any unauthorized connection, whether physically, electrically, acoustically, inductively, or otherwise, with any telegraph or telephone wire, line, cable, or instrument, including the wire, line, cable, or instrument of any internal telephonic communication system, or who willfully and without the consent of all parties to the communication, or in any unauthorized manner, reads, or attempts to read, or to learn the contents or meaning of any message, report, or communication while the same is in transit or passing over any wire, line, or cable, or is being sent from, or received at any place within this state; or who uses, or attempts to use, in any manner, or for any purpose, or to communicate in any way, any information so obtained, or who aids, agrees with, employs, or conspires with any person or persons to unlawfully do, or permit, or cause to be done any of the acts or things mentioned above in this section[.] Cal. Penal Code § 631(a) (line breaks added). Plaintiff argues that Jornaya violated the second prong of Section 631(a) and DDR Media violated the fourth prong. Specifically, plaintiff alleges that (1) Jornaya’s TCPA Guardian was a “new technology” that falls within the definition of “a machine, instrument, contrivance, or … any other manner” and (2) by using it, Jornaya intentionally read or learned the contents of a message, report, or communication (3) “without prior express consent.” Dkt. No. 43 ¶¶ 39–42; see Matera v. Google Inc., 2016 WL 8200619, at *21 (N.D. Cal. Aug. 12, 2016) (applying Section 631(a) to new technology such as email). DDR Media was a party in the communication that cannot be sued under the first three prongs, but plaintiff alleges that DDR Media is liable for violating the fourth prong

2 DDR Media also argues that plaintiff failed to allege a violation of an underlying law because it partnered with Jornaya. Id. ¶43. Both defendants argue that this claim should be dismissed because (1) Jornaya merely enabled DDR Media to record its own communications and did not act as a third-party eavesdropper; and (2) the information allegedly intercepted was “record information” not protected by the statute. Dkt. No. 47 at 4–8; Dkt. No. 48 at 4–5, 8. In addition, DDR Media argues that plaintiff fails to plead facts showing that the information was intercepted “in transit” and that the alleged intrusion did not involve a wiretap of a “telegraph or telephone wire, line, cable, or instrument.” Dkt. No. 48 at 6–7. Defendants argue that Jornaya was not a third-party eavesdropper because its software “acted as an extension of” DDR Media’s website rather than intercepting and using the data for Jornaya’s own purposes. See Dkt. No. 47 at 5. Section 631 does not prohibit parties from recording their own conversations, even without the other party’s knowledge. See Rogers v. Ulrich, 52 Cal. App. 3d 894, 899, 125 Cal. Rptr. 306 (Ct. App. 1975) (“[O]nly a third party can listen secretly to a private conversation.”). In Rogers v. Ulrich, a California appellate court rejected Section 631 claims against a defendant who had recorded his own conversations and then played the recordings to others. Id. However, if one participant in a conversation permits a third party to eavesdrop on a conversation without the knowledge of the other participant, then the third party is liable under the second prong of Section 631 (and the participant may be liable under the fourth prong). Ribas v. Clark, 38 Cal. 3d 355, 361, 696 P.2d 637, 641 (1985). In Ribas v. Clark, a woman in the middle of divorce proceedings asked a friend to listen in on a phone call to the woman’s husband. Id. at 358, 696 P.2d 637. The California Supreme Court held that this act constituted eavesdropping under the statute because “a substantial distinction has been recognized between the secondhand repetition of the contents of a conversation and its simultaneous dissemination to an unannounced second auditor.” Id. at 360, 696 P.2d 640. Defendants argue that Jornaya merely provided DDR Media with “a tool . . . like a tape recorder.” Dkt. No. 47 at 5. Plaintiff argues that defendants’ reasoning would add an additional “use” requirement into the second prong of Section 631(a) and that Jornaya is liable for recording Jornaya’s TCPA Guardian software is more akin to a tape recorder or a secret listener. This is a close question, and district courts have split on the issue. In Graham v. Noom, Inc., a district court considered similar allegations against Fullstory, a company that provides software that “records visitor data such as keystrokes, mouse clicks, and page scrolling” and enables clients to “see a ‘playback’ of any visitor’s session.” Graham v. Noom, Inc., 533 F. Supp. 3d 823 (N.D. Cal. 2021). The court held that Fullstory was not a third-party eavesdropper because it captured data only for the client website to use. The court reasoned that Fullstory “provides a tool – like the tape recorder in Rogers – that allows [a client website] to record and analyze its own data in aid of [the client website’s] business.” Id. at 832. Because there were no allegations that Fullstory “intercepted and used the data itself,” the court concluded that it was not a third-party eavesdropper. Id. at 833. Other courts have followed Graham’s reasoning. See, e.g., Williams v. What If Holdings, LLC, No. C 22-03780 WHA, 2022 WL 17869275, at *3 (N.D. Cal. Dec. 22, 2022) (concluding that software vendor “functioned as a recorder, and not as an eavesdropper”); Johnson v. Blue Nile, Inc., No. 20-CV-08183-LB, 2021 WL 1312771, at *2 (N.D. Cal. Apr. 8, 2021). In Javier v. Assurance IQ, LLC, a district court took issue with this reasoning. Javier v. Assurance IQ, LLC, No. 20-CV-02860-CRB, 2023 WL 114225, at *6 (N.D. Cal. Jan. 5, 2023). It found that considering a software vendor’s use of the information to determine whether it was a third-party eavesdropper “read[s] a use requirement into the second prong” of Section 631(a). Because the third prong of Section 631(a) separately penalizes use of information obtained via wiretapping, the court reasoned that considering use in analyzing the second prong would “add requirements that are not present (and swallow the third prong in the process).” Id. It also noted that the California Supreme Court did not consider the third party eavesdropper’s “intentions” or “the use to which they put the information they obtained” in Ribas v. Clark, 38 Cal. 3d 355, 696 P.2d 637 (1985). The Javier court concluded that so long as the recording software provider has “the capability to use its record of the interaction for any other purpose,” it is a third-party eavesdropper. Id. This is a difficult issue, and the Javier court’s point that use is penalized by the third prong penalizes anyone who “reads, or attempts to read, or to learn the contents or meaning of” the communication. Cal. Penal Code § 631(a). A person who eavesdrops on a conversation clearly falls under that definition. And a software company that analyzes or uses a recorded communication has read, attempted to read, or learned the contents of that communication. But the Court can think of no sense in which Jornaya has read, attempted to read, or learned the contents or meaning of the communication at issue here. Jornaya has merely recorded the communication for retrieval by a party to the same communication. Thus, the Court finds that Jornaya is more akin to a tape recorder vendor than an eavesdropper. Because plaintiff has not sufficiently alleged that a third-party read, attempted to read, or learned (or attempted to learn) the contents or meaning of its communication, her claim under Section 631(a) is dismissed.3 III. Invasion of Privacy Under the California Constitution In their motions to dismiss, defendants argue plaintiff failed to state a claim for invasion of privacy under the California Constitution. To state a claim of invasion of privacy under the California Constitution, plaintiff must show (1) she possesses a legally protected privacy interest, (2) she maintains a reasonable expectation of privacy, and (3) the defendant’s conduct amounts to a serious invasion of privacy. Hernandez v. Hillsides, Inc., 47 Cal. 4th 272, 287 (2009). To state a claim for of invasion of privacy under California common law, the plaintiff must show the defendant “intentionally intruded into a place… in which the plaintiff has a reasonable expectation of privacy,” and “the intrusion occurred in a manner highly offensive to a reasonable person.” Id. Because of the similarity in these tests, courts often simplify the elements required for an invasion of privacy claim to two factors: “(1) there exists a reasonable expectation of privacy, and (2) the intrusion was highly offensive.” In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 601 (9th Cir. 2020). Defendants argue the invasion of privacy claim failed because it did not show a “highly offensive intrusion” as required by the California Constitution Article 1, Section 1. Dkt. No. 47 at 8; Dkt. No. 48 at 9. Plaintiff argues that she plausibly alleged a reasonable expectation of privacy and the issue of whether the alleged invasion of privacy was highly offensive cannot be resolved at the pleadings stage. Dkt. No. 50 at 13. Plaintiff primarily relies on In Re Facebook, Inc. Internet Tracking Litigation, 956 F.3d 589, 601 (9th Cir. 2020), for the proposition that the question of whether the alleged invasion of privacy was highly offensive cannot be resolved at the pleadings stage. Dkt. No. 50 at 13. In Facebook Internet Tracking, the Ninth Circuit considered allegations that Facebook was tracking user activity across the internet even after users had logged out of the website. 956 F.3d at 606. The court held the issue of whether Facebook’s tracking and collection practices were highly offensive was an issue that “cannot be resolved at the pleading stage.” Id.; see also, Hart v. TWC Prod. & Tech. LLC, 526 F. Supp. 3d 592, 602 (N.D. Cal. 2021) (holding the issue of whether tracking user activity through the weather app even after it was closed is highly offensive cannot be resolved at the pleading stage). But the conclusion in Facebook Internet Tracking made a case-specific determination, not a generalized holding that this issue can never be resolved at the pleadings stage. The Ninth Circuit reasoned: The ultimate question of whether Facebook's tracking and collection practices could highly offend a reasonable individual is an issue that cannot be resolved at the pleading stage. Plaintiffs have identified sufficient facts to survive a motion to dismiss. Plaintiffs’ allegations of surreptitious data collection when individuals were not using Facebook are sufficient to survive a dismissal motion on the issue. Indeed, Plaintiffs have alleged that internal Facebook communications reveal that the company's own officials recognized these practices as a problematic privacy issue. 956 F.3d at 606. The Ninth Circuit explicitly distinguished Facebook Internet Tracking from cases where district courts found no highly offensive intrusion. Id. at 606 n.8. If the Ninth Circuit intended to invalidate those cases rather than distinguish them, it would have done so. Facebook Internet Tracking does not stand for the proposition that this question cannot be resolved at the pleadings stage. The Court turns to the question of whether plaintiff plausibly alleged a highly offensive intrusion in this case. The California Constitution sets a high standard for intrusion. The analysis of intrusion involves the “degree to which the intrusion is unacceptable as a matter of public policy.” Facebook Internet Tracking, 956 F.3d at 606. Factors such as “the likelihood of serious harm to the victim, the degree and setting of the intrusion, the intruder's motives and objectives, and whether countervailing interests or social norms render the intrusion inoffensive” may also be considered. Id. The intrusion must constitute an “egregious breach of social norms.” Hernandez, 47 Cal 4th at 295 (citing Hill v. Nat’l Collegiate Athletic Assn., 7 Cal. 4th 8, 37 (1994)). The plaintiff in this case alleges limited information was recorded without consent during a single visit to the website; unlike the plaintiffs in Facebook Internet Tracking, she does not allege defendants tracked her activity after she left the website. Compare Dkt. No. 43 ⁋⁋ 21–22 with 956 F.3d at 596. When determining whether an intrusion is highly offensive, other courts in the district have considered whether the information was gathered after users left the defendants’ websites. See Facebook Internet Tracking, 956 F.3d at 606 n.8 (distinguishing cases where there were “no allegations that the defendants tracked the plaintiffs after the plaintiffs stopped using the defendant's services”); Hart v. TWC Prod. & Tech. LLC, 526 F. Supp. 3d 592, 602 (N.D. Cal. 2021) (finding plaintiff plausibly alleged highly offensive intrusion where defendant “allegedly tracked, stored, and shared precise location data on a continuous basis, even when the user did not have the app open”). The information allegedly gathered in this case is minimal. Plaintiff alleges defendants recorded the date and time of plaintiff’s visit to DDR Media’s website, her keystrokes and clicks on the website, her name, her IP address, her geographic location, her address, and her phone number. Dkt. No. 43 ⁋⁋ 21–22. In contrast, in Facebook Internet Tracking, the plaintiffs alleged Facebook captured extensive information about plaintiffs’ internet activity and turned it into detailed “personal profiles” that described the plaintiffs. 956 F.3d at 596. The alleged data gathering in this case is much less extensive than in other cases where a highly offensive intrusion was sufficiently alleged. See, e.g., In re Google RTB Consumer Priv. Litig., 606 F. Supp. 3d 935, 947 (N.D. Cal. 2022) (denying motion to dismiss where plaintiffs alleged “Google sells sensitive personal information such as plaintiff's IP address, geo-location data, and web-browsing information, search terms, and sensitive websites that plaintiffs visited relating to race, religion, sexual orientation, and health”); In re Google Assistant Priv. Litig., 457 F. Supp. 3d 797, 830 (N.D. Cal. 2020) (finding it is a “close call” whether intrusion was highly offensive where Google Assistant recorded conversations after falsely identifying words meant to trigger recording). Indeed, the information gathered here is less extensive than that gathered in other cases where no highly offensive intrusion was found. See, e.g., Hammerling v. Google LLC, No. 21-CV- 09004-CRB, 2022 WL 17365255, at *9 (N.D. Cal. Dec. 1, 2022) (finding no highly offensive intrusion where Google allegedly collected information including a plaintiff’s bank, the car she drove, another plaintiff’s religious beliefs, and shopping searches); In re Google, Inc. Privacy Pol’y Litig., 58 F. Supp. 3d 968, 988 (N.D. Cal. 2014) (finding no intrusion where Google commingled data collection across its platforms). There is also a distinction in the defendants’ use of the recorded information. Here, the information was being sent back to the same website the plaintiff willingly provided her information to, while in Facebook Tracking Litigation and other cases where a highly offensive intrusion was adequately alleged, the plaintiffs’ information was sold to third parties for advertising and marketing purposes. See, e.g., Facebook Tracking Litigation, 956 F.3d at 600; In re Google RTB Consumer Priv. Litig., 606 F. Supp. 3d 935, 947 (N.D. Cal. 2022). Plaintiff voluntarily provided information to DDR Media; to the extent that information was provided to a third party, plaintiff alleges no use by the third party other than storing that information for DDR Media to refer back to. Defendants’ use of the information here was benign. See Folgelstrom v. Lamps Plus, Inc., 195 Cal. App. 4th 986, 991 (2011) (finding the intrusion when the defendant wrongfully obtained the plaintiff’s address through misrepresentation and used it to send him unsolicited advertisements was not highly offensive but was rather “routine commercial behavior”). Plaintiff has alleged a minimal intrusion that was not highly offensive. Accordingly, defendants’ motion to dismiss the claim of invasion of privacy under the California Constitution is granted with leave to amend. For the foregoing reasons and for good cause shown, the Court hereby GRANTS 1 amend is granted as to plaintiff's other claims. If plaintiff wishes to amend her claims, she must 2 doso no later than September 20, 2023, or her claims will be dismissed with prejudice. 3 5 Dated: August 18, 2023 6 Af | sf f pa □□ SUSAN ILLSTON 7 United States District Judge 8 9 10 11 12

© 15 16 & = 17

Z 18 19 20 21 22 23 24 25 26 27 28