Williams v. What If Holdings, LLC

Opinion

NORTHERN DISTRICT OF CALIFORNIA

Plaintiff, No. C 22-03780 WHA

v.

WHAT IF HOLDINGS, LLC, and ORDER RE MOTIONS TO DISMISS ACTIVEPROSPECT, INC., AND COMPEL ARBITRATION Defendants.

In this diversity and putative class action, plaintiff asserts that defendants violated California wiretapping and unfair competition statutes as well as the California constitution by using software to record her computer screen. Defendants move both to dismiss and to compel arbitration. For the reasons that follow, the motions to dismiss are GRANTED. Defendant ActiveProspect, Inc. is a software company incorporated in Nevada with its principal place of business in Texas. At all material times, ActiveProspect offered a software product called “TrustedForm,” which had the ability to document a website visitor’s keystrokes and mouse movements as they happened and then create a video replay of the website visitor’s interactions with the website. Clients implemented TrustedForm by Plaintiff Loretta Williams is a resident of California. On December 24, 2021, plaintiff visited a website owned and operated by defendant What If Holdings, LLC, a company based in New Jersey. She alleges that What If used TrustedForm to record her keystrokes and clicks on the website, while also recording data regarding the date and time of her visit, her browser and operating system, and her geographic location. Plaintiff’s complaint contains screenshots of the resultant recording, which show a four second video of her interactions with a single webpage displaying her name and contact information. Plaintiff alleges she never consented to this recording. As such, Plaintiff asserts that What If and ActiveProspect violated the wiretapping provision of the California Invasion of Privacy Act, California’s Unfair Competition Law, and plaintiff’s right to privacy under the California Constitution (Compl. ¶¶ 15, 21–31, 41–62). Defendants each move to dismiss all three claims under FRCP 12(b)(6). What If also moves to compel arbitration, which ActiveProspect joins. This order follows full briefing and oral argument. To survive a motion to dismiss, plaintiff’s complaint must plead “enough facts to state a claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). A claim has facial plausibility when the party asserting it pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged. See Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). Conclusory allegations or “formulaic recitation of the elements” of a claim, however, are not entitled to the presumption of truth. Id. at 681. This order will first consider whether plaintiff has sufficiently pled a CIPA violation for wiretapping. It will then address plaintiff’s UCL claim and constitutional claim, both of which are predicated on the CIPA claim. For the reasons that follow, all claims are dismissed. 1. CIPA WIRETAPPING CLAIM. Defendants argue that plaintiff fails to plead various requisite elements of a violation each element is sufficiently pled. This order finds that neither defendant is a third-party eavesdropper under Section 631(a). Plaintiff’s failure to plead this element proves fatal to her claim. Section 631(a), which provides for civil in addition to criminal liability, states as follows: (a) Any person [1] who, by means of any machine, instrument, or contrivance, or in any other manner, intentionally taps, or makes any unauthorized connection, whether physically, electrically, acoustically, inductively, or otherwise, with any telegraph or telephone wire, line, cable, or instrument, including the wire, line, cable, or instrument of any internal telephonic communication system, or [2] who willfully and without the consent of all parties to the communication, or in any unauthorized manner, reads, or attempts to read, or to learn the contents or meaning of any message, report, or communication while the same is in transit or passing over any wire, line, or cable, or is being sent from, or received at any place within this state; or [3] who uses, or attempts to use, in any manner, or for any purpose, or to communicate in any way, any information so obtained, or [4] who aids, agrees with, employs, or conspires with any person or persons to unlawfully do, or permit, or cause to be done any of the acts or things mentioned above in this section . . . . The Supreme Court of California has distilled this down to “three distinct and mutually independent patterns of conduct: intentional wiretapping, wilfully attempting to learn the contents or meaning of a communication in transit over a wire, and attempting to use or communicate information obtained as a result of engaging in either of the previous two activities.” Tavernetti v. Superior Court of San Diego Cty., 583 P.2d 737, 741 (Cal. 1978). Here, What If’s liability is premised on the fourth clause of Section 631(a), which targets one who “aids, agrees with, employs, or conspires with” another party that violates any of the prior three clauses. As the website owner, What If was the intended recipient of plaintiff’s communication. Parties to a conversation cannot eavesdrop on their own conversation, so no other part of Section 631(a) is applicable to What If. See Warden v. Kahn, 160 Cal. Rptr. 471, 475 (Cal. Ct. App. 1979) (distinguishing “eavesdropping by a third party” from “recording by a participant to a conversation”); Rogers v. Ulrich, 125 Cal. Rptr. 306, 309 (Cal. Ct. App. 1975). What If’s liability in this case is therefore based entirely on whether ActiveProspect violated Section 631(a) in some way, and plaintiff does not argue to the contrary (Opp. 16). ActiveProspect’s liability on the other hand is premised on the second clause of Section 631(a) (Opp. 16). Plaintiff makes no allegation that ActiveProspect used her information in any way, so the third clause of Section 631(a) is inapplicable here (Opp. 16–17). Meanwhile the first clause of Section 631(a) concerns telephonic wiretapping specifically, which does not apply to the context of the internet. See In re Google Assistant Privacy Litig., 457 F. Supp. 3d 797, 825 (N.D. Cal. 2020) (Judge Beth Labson Freeman) (explaining that “the plain text of the statute . . . expressly requires that the unauthorized ‘connection’ be made with ‘any telegraph or telephone wire, line, cable, or instrument’” (quoting Cal. Penal Code § 631(a))); In re Google Inc. Gmail Litig., No. C 13-02430 LHK, 2013 WL 5423918, at *20 (N.D. Cal. Sept. 26, 2013) (Judge Lucy H. Koh) (describing the “limitation of ‘telegraphic or telephone’ on ‘wire, line, cable, or instrument’ in the first clause of [Section 631(a)]”). Indeed, courts have applied Section 631(a) via the language of its second clause to the internet browsing context. See, e.g., In re Google Assistant Privacy Litig., 457 F. Supp. 3d at 826 (analyzing whether communication was sent from or received in California); Silver v. Stripe Inc., No. C 20-08196 YGR, 2021 WL 3191752, at *3–4 (N.D. Cal. July 28, 2021) (Judge Yvonne Gonzalez Rogers) (analyzing whether alleged eavesdropping was consented to); Adler v. Community.com, Inc., No. C 21-02416 SB JPR, 2021 WL 4805435, at *3–4 (C.D. Cal. Aug. 2, 2021) (Judge Stanley Blumenfeld, Jr.) (analyzing whether communication was intercepted in transit). Because a party to the communication is exempt from liability under CIPA, our dispositive question is whether ActiveProspect constitutes a third-party eavesdropper. See Davis v. Facebook, Inc. (In re Facebook Inc. Internet Tracking Litig.), 956 F.3d 589, 607 (9th Cir. 2020). Put differently, the question boils down to whether ActiveProspect was an independent third party hired to eavesdrop on What If’s communications, or whether ActiveProspect’s software was merely a tool that What If used to record its own communications with plaintiff. Our facts suggest the latter. The complaint most pertinently alleges that What If deployed ActiveProspect’s TrustedForm recording software only on What If’s websites and 21–29). These limited allegations are not enough to show that ActiveProspect was a third- party eavesdropper as contemplated by Section 631(a). Plaintiff posits that if ActiveProspect is not considered a third party, then website owners can always circumvent Section 631(a) by hiring a vendor to record communications (Opp. 17). Not so. Our relevant inquiry here is whether a website owner’s usage of third-party recordation software can be considered equivalent to having hired a third party to record. That inquiry thus determines whether or not the software provider can be considered a third party in the first place for purposes of a Section 631(a) analysis. Judge Laurel Beeler’s reasoning in deciding a series of factually similar cases is instructive: a key distinction is whether or not the alleged third-party software provider aggregates or otherwise processes the recorded information, which might suggest that the software vendor independently “uses” the gathered data in some way. See Graham v. Noom, Inc., 533 F. Supp. 3d 823, 832–33 (N.D. Cal. 2021); Johnson v. Blue Nile, Inc., No. C 20-08183 LB, 2021 WL 1312771, at *3 (N.D. Cal. Apr. 8, 2021); Yale v. Clicktale, Inc., No. C 20-07575 LB, 2021 WL 1428400, at *3 (N.D. Cal. Apr. 15, 2021); see also In re Facebook Inc. Internet Tracking Litig., 956 F.3d at 608 (“Permitting an entity to engage in the unauthorized duplication and forwarding of unknowing users’ information would render permissible the most common methods of intrusion, allowing the exception to swallow the rule” (emphasis added)). Just like in Graham, there are no facts here to suggest that ActiveProspect “intercepted and used the data itself.” Graham, 533 F. Supp. 3d at 832. If anything, the facts suggest the contrary. The specific recording alleged in the complaint shows the same webpage in every screenshot. This demonstrates that TrustedForm was deployed on a single page as opposed to the entire website. The top of every screenshot in the complaint shows that the recordation in question was four seconds of plaintiff’s interaction with that particular page of What If’s website. The interaction consists of confirming user-inputted information from prior pages, specifically by checking an “I CONFIRM” box and then clicking on a “CLAIM YOUR CASH!” button to proceed (Compl. ¶¶ 22–27). As defendants assert and plaintiff recognizes, (Compl. ¶ 5; What If Br. 18; ActiveProspect Br. 18). The facts as pled suggest that the recordation is routine documentation and therefore clerical in nature, which is qualitatively different from data mining. That recorded videos are hosted and accessed on ActiveProspect’s servers is part of how the software tool functions, and plaintiff makes no allegation that ActiveProspect or its TrustedForm product affirmatively engages with that data in any way other than to store it. By contrast, both Saleh and Yoon, which plaintiff cites, involved recordation software of a much broader scope, namely all of users’ interactions across an entire website. See Saleh v. Nike, Inc., 562 F. Supp. 3d 503, 509 (C.D. Cal. 2021) (Judge Fernando L. Aenlle-Rocha); Yoon v. Lululemon United States, 549 F. Supp. 3d 1073, 1077 (C.D. Cal. 2021) (Judge John W. Holcomb). In other words, the allegations in Yoon suggested that the recordation software there “extend[ed] beyond the ordinary function of a tape recorder,” and thus there was a question of fact as to how different it was. Yoon, 549 F. Supp. 3d at 1081. Plaintiff fails to make comparable allegations here. In sum, the facts as pled show that TrustedForm functioned as a recorder, and not as an eavesdropper. ActiveProspect is not liable for wiretapping under Section 631(a) for providing a software tool, and the fact that What If used software rather than a physical recording device for the same function does not mean that it aided and abetted wiretapping. Plaintiff’s wiretapping claim is therefore DISMISSED. In light of the foregoing, this order need not consider the issues of consent, whether communications were intercepted in transit, and whether the recorded data constitute protected content under CIPA. Plaintiff’s reliance on Javier v. Assurance IQ, LLC is therefore inapposite, as Javier was expressly cabined to the question of consent. No. C 21-16351, 2022 WL 1744107, at *2 (9th Cir. May 31, 2022). However, this is not to say that consent is irrelevant. What If’s entire lead generation business model is to entice website visitors to consent to telemarketing phone calls, and ActiveProspect’s software enables them to do so. Although this order sides with defendants, it does not in any way bless a business model that depends on the ability of telemarketing companies to freely harass unsuspecting Americans. 2. CALIFORNIA UNFAIR COMPETITION LAW CLAIM. Plaintiff’s second claim for relief is a violation of the UCL’s prohibition against any “unlawful, unfair or fraudulent business act or practice,” Cal. Bus. & Prof. Code § 17200, specifically the “unlawful” prong (Compl. ¶ 53). UCL provides an independent cause of action but requires an underlying violation because “[S]ection 17200 borrows violations of other laws and treats them as unlawful practices.” See Davis v. HSBC Bank, 691 F.3d 1152, 1168 (9th Cir. 2012) (alteration in original) (quoting Cel-Tech Commc’ns, Inc. v. L.A. Cellular Tel. Co., 973 P.2d 527, 539–40 (Cal. 1999)). Plaintiff’s UCL claim fails because her underlying CIPA violation fails. Additionally, a UCL claim may only be brought by “a person who has suffered injury in fact and has lost money or property as a result of the unfair competition.” Cal. Bus. & Prof. Code § 17204. This means that to have standing under California’s UCL, plaintiff “must demonstrate some form of economic injury.” Kwikset Corp. v. Superior Court, 246 P.3d 877, 885 (Cal. 2011); see Birdsong v. Apple, Inc., 590 F.3d 955, 959 (9th Cir. 2009). Plaintiff has conceded that she lacks UCL standing because she “did not experience a loss of money or property to support standing” (Opp. 8). Plaintiff’s UCL claim is accordingly DISMISSED 3. CALIFORNIA CONSTITUTION CLAIM. Plaintiff’s third claim for relief is for invasion of privacy under the California Constitution. For such claims, plaintiffs must plead that “they possess a legally protected privacy interest.” In re Facebook Inc. Internet Tracking Litig., 956 F.3d at 601 (quoting Hernandez v. Hillsides, Inc., 211 P.3d 1063, 1073 (Cal. 2009)). Whether plaintiff possesses a legally-protected privacy interest is “a question of law to be decided by the court.” Hill v. Nat’l Collegiate Athletic Ass’n, 865 P.2d 633, 657 (Cal. 1994). Here, plaintiff’s asserted privacy interest is “an interest in conducting personal activities 1 without being subjected to secret wiretaps” (Compl. § 59; Opp. 19). Because plaintiff did not 2 plausibly plead wiretapping, plaintiff likewise did not plausibly plead a protected privacy 3 interest under the California Constitution. Plaintiffs constitutional claim is accordingly 6 For the foregoing reasons, defendants’ motions to dismiss are GRANTED. Defendants’ 7 motion to compel arbitration is DENIED AS MOOT OR WAIVED. Plaintiff may seek leave to 8 amend her complaint and shall have FOURTEEN CALENDAR DAYs from the date of this order 9 to file a motion, noticed on the normal 35-day track, for leave to file an amended complaint. A 10 proposed amended complaint must be appended to the motion. The motion should explain 11 how the amendments to the complaint cure the deficiencies identified herein, as well as any a 12 others raised in defendants’ briefs. If such a motion is not filed by the deadline, this case will

13 be closed.

= 17 Dated: December 22, 2022.

Z 18 19 ( Co Pee WILLIAM ALSUP 20 UNITED STATES DISTRICT JUDGE 21 22 23 24 25 26 27 28