Yale v. The Gap, Inc.

Opinion

San Francisco Division AMBER YALE, Case No. 20-cv-07575-LB

Plaintiff, ORDER GRANTING MOTION TO v. DISMISS

CLICKTALE, INC., Re: ECF No. 28 Defendant. Gap sells clothing online through its websites, including www.oldnavy.com. It uses Clicktale’s software (called “Event-Triggered Recorder”) to record what visitors are doing on its websites, such as their keystrokes, mouse clicks, and page scrolling, thereby allowing a full picture of the user’s website interactions. The plaintiff — on behalf of a putative California class — claims that Clicktale is illegally wiretapping her communications with Gap in violation of California’s Invasion of Privacy Act (CIPA) and the California Constitution. Clicktale moved to dismiss the claims, in part on the ground that Clicktale — as Gap’s vendor for analyzing its website traffic — was a party to the communication (and not an eavesdropper). The court can decide the motion without oral argument. N.D. Cal. Civ. L.R. 7-1(b). The and pleads only that Clicktale is Gap’s vendor for software services. She thus does not plausibly plead wiretapping or invasion of privacy in violation of California law. The next sections describe how Clicktale’s software works, how the plaintiff used Gap’s website (and what information Clicktale’s software captured), and the case’s procedural history. 1. Clicktale’s Software Clicktale provides software to its clients (including Gap) to capture and analyze data so that the clients can see how visitors to their websites are using the sites.1 The clients put Clicktale’s code on their websites to capture the data, and then they can review the data, which is stored in the cloud on Clicktale’s servers.2 The software records visitor data such as keystrokes, mouse clicks, and other website interactions. Through a featured called Event-Triggered Recorder, Clicktale’s clients can see a “playback[]” of any visitor’s session on their website.3 2. The Plaintiff Use of Gap’s Website In October 2020, the plaintiff visited Gap’s website (www.oldnavy.com) and bought a product.4 Clicktale’s Event-Triggered Recorder “capture[d] each of Plaintiff’s keystrokes and mouse clicks on the [w]ebsite[] . . . [and] also captured the date and time of the visit, the duration of the visit, Plaintiff’s IP address, her location at the time of the visit, her browser type, and the operating system on her device.”5

1 First Am. Compl. (FAC) – ECF No. 24 at 4–5 (¶¶ 12–19), 7 (¶¶ 27–30). Citations refer to material in the Electronic Case File (ECF); pinpoint citations are to the ECF-generated page numbers at the top of documents. 2 Id. at 6–7 (¶¶ 23–24, 30). 3 Id. at 4–5 (¶¶ 14–21). 4 Id. at 7 (¶ 32). “When users access [] [Gap’s] Websites and make a purchase, they enter their PII [personally identifiable information],” and Clicktale’s software captures users’ electronic communications “[e]ven if users do not complete the form” for the purchase.”6 The captured PII includes — in addition to the information in the last paragraph — the user’s email and shipping addresses, and payment-card information such as card number, expiration code, and CVV security code.7 3. Relevant Procedural History The plaintiff’s amended complaint has three claims against Clicktale: (1) wiretapping, in violation of Cal. Penal Code § 631(a); (2) the sale of eavesdropping software, in violation of Cal. Penal Code § 635(a); and (3) invasion of privacy in violation of California’s Constitution.8 (In her earlier complaint, the plaintiff also sued Gap but voluntarily dismissed it as a defendant.9) The putative class is “all California residents who visited [Gap’s] websites, and whose electronic communications were intercepted or recorded by Clicktale.”10 All parties consented to magistrate jurisdiction.11 The parties do not dispute that there is subject-matter jurisdiction under the Class Action Fairness Act, 28 U.S.C. § 1332(d)(2)(A).12 Clicktale moved to dismiss the case.13 1. Rule 12(b)(1) A complaint must contain a short and plain statement of the ground for the court’s jurisdiction. Fed. R. Civ. P. 8(a)(1). The plaintiff has the burden of establishing jurisdiction. Kokkonen v. 6 Id. at 8 (¶ 35). 7 Id. (¶ 36). 8 Id. at 10–14 (¶¶ 50–77). 9 Notice of Voluntary Dismissal – ECF No. 23. 10 FAC – ECF No. 24 at 9 (¶ 43). 11 Consents – ECF Nos. 6, 12. 12 FAC – ECF No. 24 at 3 (¶ 8). Guardian Life Ins. Co. of Am., 511 U.S. 375, 377 (1994); Farmers Ins. Exch. v. Portage La Prairie Mut. Ins. Co., 907 F.2d 911, 912 (9th Cir. 1990). A defendant’s Rule 12(b)(1) jurisdictional attack can be either facial or factual. White v. Lee, 227 F.3d 1214, 1242 (9th Cir. 2000). “A ‘facial’ attack asserts that a complaint’s allegations are themselves insufficient to invoke jurisdiction, while a ‘factual’ attack asserts that the complaint’s allegations, though adequate on their face to invoke jurisdiction, are untrue.” Courthouse News Serv. v. Planet, 750 F.3d 776, 780 n.3 (9th Cir. 2014). This is a facial attack. The court thus “accept[s] all allegations of fact in the complaint as true and construe[s] them in the light most favorable to the plaintiff[].” Warren v. Fox Family Worldwide, Inc., 328 F.3d 1136, 1139 (9th Cir. 2003). Clicktale contends that the plaintiff lacks standing. Standing pertains to the court’s subject- matter jurisdiction and thus is properly raised in a Rule 12(b)(1) motion to dismiss. Chandler v. State Farm Mut. Auto. Ins. Co., 598 F.3d 1115, 1121–22 (9th Cir. 2010) (citation omitted). A court should dismiss a complaint without leave to amend only if the jurisdictional defect cannot be cured by amendment. Eminence Capital, LLC v. Aspeon, Inc., 316 F.3d 1048, 1052 (9th Cir. 2003). 2. Rule 12(b)(6) A complaint must contain a “short and plain statement of the claim showing that the pleader is entitled to relief” to give the defendant “fair notice” of what the claims are and the grounds upon which they rest. Fed. R. Civ. P. 8(a)(2); Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007). A complaint does not need detailed factual allegations, but “a plaintiff’s obligation to provide the grounds of his entitlement to relief requires more than labels and conclusions, and a formulaic recitation of the elements of a cause of action will not do. Factual allegations must be enough to raise a claim for relief above the speculative level.” Twombly, 550 U.S. at 555 (cleaned up). To survive a motion to dismiss, a complaint must contain sufficient factual allegations, which when accepted as true, “state a claim to relief that is plausible on its face.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Twombly, 550 U.S. at 570). “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the ‘probability requirement,’ but it asks for more than a sheer possibility that a defendant has acted unlawfully.” Id. (citing Twombly, 550 U.S. at 557). “Where a complaint pleads facts that are merely consistent with a defendant’s liability, it stops short of the line between possibility and plausibility of ‘entitlement to relief.’” Id. (cleaned up) (quoting Twombly, 550 U.S. at 557). A court should dismiss a complaint with leave to amend unless the “pleading could not possibly be cured by the allegation of other facts.” United States v. United Healthcare Ins. Co., 848 F.3d 1161, 1182 (9th Cir. 2016) (cleaned up). In two recent cases involving the plaintiff’s counsel, the court dismissed virtually identical claims against another software-services provider (a company called FullStory). Graham v. Noom, Inc., No. 3:20-cv-06903-LB, Order – ECF No. 51; Johnson v. Blue Nile, Inc., No. 3:20-cv-08183-LB, Order – ECF No. 49. The analysis in Noom applies here: (1) for the section 631(a) claim, the plaintiff does not plausibly plead Clicktale’s wiretapping; (2) there is no section 635(a) claim because there is no wiretapping; and (3) because there is no plausible wiretapping, the plaintiff does not plead a legally protected privacy interest for her invasion-of-privacy claim under the California Constitution. 1. Section 631(a) Claim First, for the reasons stated in Noom, Clicktale is not a third-party eavesdropper. It is a vendor that provides a software service that allows its clients to monitor their website traffic. Noom, No. 3:20-cv-06903-LB, Order – ECF No. 51 at 6–9. Second, the plaintiff predicates her claim in part on information — such as IP addresses, locations, browser types, and operating systems — that is not content.14 The plaintiff does not meaningfully dispute that this information is not content but contends that other website interactions are content.15 The court dismisses the claim to the extent that it is predicated on non-

14 Id. at 13 n.5 (summarizing allegations in the FAC); Reply – ECF No. 30 at 12–13. ] content information. /d. at 9-10. In any amended complaint, the plaintiff can delineate content 2 from non-content records. 3 4 2. Section 635(a) Claim 5 The plaintiff does not have a private right of action and lacks Article III standing for the 6 section 635(a) claim because she did not plausibly plead wiretapping. /d. at 12. 7 8 3. Invasion of Privacy Under California’s Constitution 9 The plaintiff does not plausibly plead a violation of her right to privacy under the California 10 Constitution because she did not plausibly plead wiretapping. /d. at 13. 1] CONCLUSION E 13 The court dismisses the complaint with leave to amend within 21 days. Any amended complaint 14 must attach a blackline comparison between the current complaint and the amended complaint. 15 IT IS SO ORDERED. E16 Dated: April 15, 2021 LAS

LAUREL BEELER 18 United States Magistrate Judge 19 20 21 22 23 24 25 26 27 28