Yoon v. Meta Platforms, Inc.

Opinion

1 2 3 4 5 6 7 UNITED STATES DISTRICT COURT 8 NORTHERN DISTRICT OF CALIFORNIA 9

10 MARY YOON, et al., Case No. 24-cv-02612-NC 11 Plaintiffs, ORDER GRANTING JUDICIAL 12 v. NOTICE; AND GRANTING IN PART AND DENYING IN PART 13 META PLATFORMS, INC., MOTION TO DISMISS 14 Defendant. Re: ECF 24, 29, 31 15 16 This class action against Defendant Meta Platforms, Inc. brought by Plaintiffs Mary 17 Yoon, William Martin, and Kat Walker arises from Meta’s alleged collection of their 18 sensitive video viewing data through tracking tools installed on third party websites. 19 Plaintiffs bring several claims under the California Invasion of Privacy Act (CIPA). 20 Defendant moves to dismiss these claims under Federal Rule of Civil Procedure 12(b)(6) 21 and seeks judicial notice of 16 exhibits. For the following reasons, Defendant’s motion to 22 dismiss is GRANTED in part and DENIED in part, and the requests for judicial notice are 23 GRANTED. 24 I. BACKGROUND 25 A. Factual Background 26 Plaintiffs’ Complaint alleges the following facts. 27 1. Wiretapping Devices 1 SDK, and Conversions API. 2 The Pixel is an invisible web element that website owners can install on their 3 websites to measure and track certain actions taken by users on their own websites. ECF 4 1-3 (FAC) ¶¶ 24–25. It is widely deployed across many industries. Id. ¶ 46. The Pixel 5 collects a large range of user data. Id. ¶ 26. When a website user takes an action on a 6 webpage which includes the Pixel, Meta’s source code commands the user’s device to re- 7 direct the content of the communication to Meta while the exchange of the communication 8 between the user and the website is still occurring. Id. ¶ 31. Through this technology, 9 Meta intercepts each page a user visits, what buttons they click, and specific information 10 they input into the website, along with a user’s PII, like their IP address, allowing it to 11 match its users with the data. Id. ¶¶ 33, 35. By design, Meta receives the contents of 12 website communications as the website user enters the information, but before the website 13 owner receives it. Id. ¶ 32. Meta falsely claims that it does not track non-Facebook user 14 data; that data is still collected in dossiers called “shadow profiles.” ¶ 40. 15 Facebook’s other Business Tools function similarly. Id. ¶ 48. Advertisers can 16 utilize the Facebook SDK for mobile applications to track events on their mobile apps. Id. 17 Advertisers and web developers can also use the Conversions API to circumvent a user’s 18 choice to exercise privacy controls and collect server events that are linked to a Pixel ID. 19 Id. ¶ 49. The Conversions API intercepts these communications contemporaneously and 20 surreptitiously. Id. 21 Meta offers the Pixel to companies for free because it benefits Meta. Id. ¶ 43. Meta 22 uses the data it gleans from tools like the Pixel to power its algorithms, providing it insight 23 into the habits of users across the internet. Id. For example, it uses the data to target users 24 with advertisements based on their interests and thus, increase its ad revenue. Id. ¶ 44. 25 Thus, Meta intentionally obtained video viewing information due to its valuable 26 advertising purposes because it can shed light on people’s interests, politics, artistic 27 tastes—it is not an accident, mistake, or inadvertence. Id. ¶¶ 87, 91. Meta knows about 1 data transmissions to support its business model and advertising revenue. Id. ¶¶ 88–89, 91. 2 The Pixel and other business tools operate all the time and work the same way for 3 everyone who visits a website with the tools installed. Id. ¶ 52. 4 2. Video Viewing Data 5 The Pixel and related business tools were installed on each of the subject websites 6 when Plaintiffs watched video content on those sites. Id. ¶ 53. The subject websites 7 include HGTV.com, Bloomberg.com, USAToday.com, 247Sports.com, and PBS.com. Id. 8 ¶¶ 57–67. All host videos. Id. Using the Pixel and related business tools, these websites 9 have been transmitting viewing history information to Meta. Id. ¶ 50. 10 Plaintiffs allege that each had their video viewing history unlawfully transmitted 11 from the subject websites to Meta, which in turn was matched to their Facebook accounts 12 for marketing and to train its algorithms. Id. ¶ 56. 13 The Pixel and related business tools transmitted a wide variety of viewing data to 14 Meta. This included personally identifiable information (PII) about the person watching 15 video. Id. ¶ 54. One way it did so was via the Facebook ID (FID), which is a unique and 16 persistent identifier that Facebook assigns to each user. Id. Several cookies also work in 17 conjunction with the Pixel that contains the visitor’s FID, including the c_user cookie. Id. 18 The viewing data also included events like the video’s URL whenever a viewer access that 19 webpage, the title of the video watched, when a view started and finished the video’s 20 consent, and when the viewer started and finished the advertisement that plays before the 21 video. Id. ¶¶ 57–77. The Pixel also scanned form fields containing a user’s email, first 22 name, last name, gender, phone number, city, state, and zip code. Id. ¶ 65. 23 Plaintiffs did not consent to Meta obtaining their video viewing data and other 24 internet activities. Id. ¶¶ 7–9. Meta’s Terms of Service, Data Policy, and Cookies Policy 25 never specifically indicated that Meta may acquire video viewing history obtained from 26 Facebook users’ interactions on third-party websites. Id. ¶¶ 80–82. None of the subject 27 websites obtained express written consent for the disclosure of video viewing to Meta. Id. 1 sensitive information like the information at issue here. Id. ¶ 84. 2 B. Procedural Background 3 Plaintiffs filed a Class Action Complaint on behalf of everyone in the United States 4 who watched videos on HGTV.com, Bloomberg.com, USAToday.com, 247Sports.com, or 5 PBS.com against Meta Platforms, Inc. FAC ¶ 1. Plaintiffs originally filed in Santa Clara 6 Superior Court. ECF 1 ¶ 1. Plaintiffs then filed their First Amended Complaint (FAC) in 7 Santa Clara Superior Court. Id. The FAC alleged six counts under the Federal Wiretap 8 Act, CIPA, and negligence. FAC ¶¶ 112–75. Defendants then properly removed the case 9 to the Northern District of California using federal question jurisdiction. ECF 1 ¶ 6. 10 Defendants moved to dismiss Plaintiff’s FAC under Rule 12(b)(6). ECF 24. 11 Defendants also attached a Request for Judicial Notice in support of its motion to dismiss 12 under Federal Rule of Evidence 201. ECF 24-18. Plaintiffs opposed the motion to 13 dismiss, and Defendant submitted a reply in support of it. ECF 29, ECF 32. Through 14 these pleadings, Plaintiffs withdrew their causes of action brought under the Federal 15 Wiretap Act (Counts I and V) and negligence (Count VI), leaving 3 counts: Counts II, III, 16 and IV, all under CIPA. ECF 29 at 1 n.1. Defendant consequently asserted and provided 17 evidence of the Court’s jurisdiction under the Class Action Fairness Act. ECF 36; ECF 45. 18 Plaintiffs did not object. ECF 43. The Court agreed. ECF 48. 19 II. LEGAL STANDARD 20 A motion to dismiss for failure to state a claim under Rule 12(b)(6) tests the legal 21 sufficiency of a complaint. Navarro v. Block, 250 F.3d 729, 732 (9th Cir. 2001). “To 22 survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as 23 true, to ‘state a claim to relief that is plausible on its face.’” Ashcroft v. Iqbal, 556 U.S. 24 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). When 25 reviewing a 12(b)(6) motion, a court “must accept as true all factual allegations in the 26 complaint and draw all reasonable inferences in favor of the non-moving party.” Retail 27 Prop. Trust v. United Bd. of Carpenters & Joiners of Am., 768 F.3d 938, 945 (9th Cir. 1 unwarranted deductions of fact, or unreasonable inferences.” In re Gilead Scis. Secs. 2 Litig., 536 F.3d 1049, 1055 (9th Cir. 2008). A claim is facially plausible when it “allows 3 the court to draw the reasonable inference that the defendant is liable for the misconduct 4 alleged.” Id. If a court grants a motion to dismiss, leave to amend should be granted 5 unless the pleading could not possibly be cured by the allegation of other facts. Lopez v. 6 Smith, 203 F.3d 1122, 1127 (9th Cir. 2000). 7 III. JUDICIAL NOTICE AND INCORPORATION BY REFERENCE 8 When ruling on a Rule 12(b)(6) motion, district courts may consider documents 9 attached to the complaint, documents incorporated by reference into the complaint, and 10 matters of judicial notice without converting a motion to dismiss into one for summary 11 judgment. United States v. Ritchie, 342 F.3d 903, 908 (9th Cir. 2003). 12 Defendant requests that the Court consider Exhibits 1 through 16 when ruling on its 13 motion to dismiss by (1) taking judicial notice of Exhibits 1 through 16 pursuant to Federal 14 Rule of Evidence 201(b), and/or (2) deeming them incorporated by reference. ECF 24-18 15 at 1. These 16 exhibits encompass Meta’s Terms of Service, Meta’s Data Policy (now 16 called the Privacy Policy), and Meta’s Cookies Policy that were in effect on January 1, 17 2021, as well as their subsequent versions. Id. at 1–3. All exhibits can be found on either 18 Meta’s website or on the Internet Archive. Id. 19 A. Judicial Notice 20 Defendant requests that the Court take judicial notice of Exhibits 1 through 16 21 pursuant to Federal Rule of Evidence 201 because they are public records available on 22 publicly available websites. ECF 24-18 at 1. 23 Federal Rule of Evidence 201 allows a court to take judicial notice of “a fact that is 24 not subject to reasonable dispute” because it is “generally known” within the court’s 25 jurisdiction or can be “accurately and readily determined from sources whose accuracy 26 cannot be reasonably questioned.” 27 Defendant argues that the Court may take judicial notice of all 16 exhibits under 1 and the contents are not subject to reasonable dispute.” ECF 24-18 at 3. The Court agrees. 2 Courts routinely take judicial notice of terms of service and other policies, including 3 content from Internet Archive’s Wayback Machine. Zhang v. Twitter Inc., Case No. 23- 4 cv-00980, 2023 WL 5493823, at *3 (N.D. Cal. Aug. 23, 2023). Thus, this Court finds that 5 Exhibits 1 through 16 are judicially noticeable. While the Court will take notice of the 6 existence and contents of Exhibits 1 through 16, it cannot and will not draw other 7 conclusions or inferences. See In re Meta Tax Filing Cases, Case No. 22-cv-07557, 2024 8 WL 1251350, at *3 (N.D. Cal. Mar. 25, 2024). 9 B. Incorporation by Reference 10 Defendant additionally requests that the Court deem Exhibits 1 through 16 11 incorporated by reference. ECF 24-18 at 1. Because the Court judicially noticed all 12 exhibits under Federal Rule of Evidence 201 and will therefore consider them in its Rule 13 12(b)(6) analysis, it does not find it necessary to determine whether they should also be 14 incorporated by reference. 15 IV. DISCUSSION 16 A. Consent 17 Defendant argues that as a general matter, all of Plaintiffs’ claims fail because 18 Plaintiffs consented to Defendant’s alleged receipt of their video viewing data. ECF 24 at 19 7. Defendant reasons that because Plaintiffs consented to Defendant’s policies, 20 specifically its Terms of Service, Data Policy, and Cookies Policy, when they signed up 21 for a Facebook account and used Meta’s services, and those policies adequately disclose 22 that it would collect data from third-party sites for advertising purposes, Plaintiffs’ consent 23 of its policies equated to also consenting to the sharing of their video viewing data. The 24 Court finds that this argument fails because it cannot determine at this stage that Plaintiffs 25 consented to Defendant’s policies. 26 Contracts on the Internet are typically either clickwrap agreements, in which 27 website users are required to click on an “I agree” box after being presented with a list of 1 conditions of use are generally posted on the website via a hyperlink at the bottom of the 2 screen. Nguyen v. Barnes & Noble Inc., 763 F.3d 1171, 1176 (9th Cir. 2014). While a 3 clickwrap agreement requires the user to manifest assent expressly, a browsewrap contract 4 doesn’t require affirmative action. Id. Instead, its validity depends on “whether the user 5 has actual or constructive knowledge of a website’s terms and conditions.” Id. 6 Here, Defendant alleges that Plaintiffs “agreed to Meta’s policies by creating a 7 Facebook account and using Meta’s services.” ECF 24 at 7. There is no evidence in the 8 record that Plaintiffs were required to affirmatively acknowledge the policies before 9 signing up for Facebook that would constitute consent to a clickwrap agreement. 10 Defendant has also not shown that Plaintiffs consented to a browsewrap agreement. While 11 Plaintiffs could have given consent “simply by using the website,” Defendant has not 12 shown that Plaintiffs had the requisite actual or constructive knowledge of the policies. 13 See Nguyen, 763 F.3d at 1176. It is not sufficient to simply allege that the policies exist 14 and Plaintiffs created and used a Facebook account to prove consent. See In re Meta Tax 15 Filing Cases, 2024 WL 1251350, at *5. The Court is not persuaded at this time that 16 Plaintiffs consented to Defendant’s policies. 17 Because the Court cannot determine that Plaintiffs have consented to Defendant’s 18 policies, the Court does not find it necessary to determine whether consenting to those 19 policies resulted in also consenting to the sharing of video viewing data. 20 B. Count II – CIPA § 631 21 CIPA § 631(a) makes it unlawful to use “any machine, instrument or contrivance” 22 to intentionally intercept the content of a communication over any “telegraph or telephone 23 wire, line, cable or instrument,” or to read, attempt to read, or learn the “contents or 24 meaning of any message, report, or communication while the same is in transit or passing 25 over any wire, line or cable” without the consent of all parties to the communication. Cal. 26 Pen. Code § 631(a). Thus, it is limited to the “contents or meaning” of a communication. 27 Id. The Ninth Circuit held that contents “refers to the intended message conveyed by the 1 the message that is generated in the course of the communication.” Gershzon v. Meta 2 Platforms, Inc., Case No. 23-cv-00083, 2023 WL 5420234, at *12 (N.D. Cal. Aug. 22, 3 2023) (citing In re Zynga Priv. Litig., 750 F.3d 1098, 1106 (9th Cir. 2014)). “The analysis 4 for a violation of CIPA is the same as that under the federal Wiretap Act.” Brodsky v. 5 Apple Inc., 445 F. Supp. 3d 110, 127 (N.D. Cal. 2020). 6 Here, Plaintiffs allege that the unlawful intercepted communications include 7 “detailed URL request[s], form field entries like email address and name, button clicks and 8 associated text, and the title of videos that the subscribers asked the subject websites to 9 deliver.” FAC ¶ 119. Defendant argues that none of these communications are contents 10 because they are not “the intended message conveyed,” and therefore Plaintiffs fail to state 11 a claim under CIPA § 631. ECF 24 at 12. The Court finds that Plaintiffs have sufficiently 12 alleged that some of the communications are “contents.” 13 1. Detailed URL Request and Title of Videos 14 Plaintiffs allege that the Pixel intercepted the video’s URL, as well as the title of the 15 video watched. FAC ¶¶ 60, 68–69, 74, 77. 16 To determine whether information is contents, Courts employ a contextual “case- 17 specific” analysis hinging on “how much information would be revealed” by the 18 information’s tracking and disclosure. Hammerling v. Google LLC, 615 F. Supp. 3d 1069, 19 1092 (N.D. Cal. 2022). This district further clarified that under CIPA, a URL that simply 20 includes “basic identification and address information” is not content, but a URL 21 disclosing a “search term or similar communication made by the user” could be content. In 22 re Meta Pixel Healthcare Litig., 647 F. Supp. 3d 778, 795 (N.D. Cal. 2022) (citing In re 23 Zynga Priv. Litig., 750 F.3d at 1106). 24 Here, both the intercepted URLs and the title of the video watched are contents 25 because they provide “significant information regarding the user’s browsing history” and 26 divulge “a user’s personal interests, queries, and habits on third-party websites operating 27 outside of Facebook’s platform.” Gershzon, 2023 WL 5420234 at *12 (citing In re 1 the video viewing history can “shed light on people’s interests, politics, artistic tastes.” 2 FAC ¶ 87. Further, the URL and video title tells Defendant the exact video users watched, 3 which means Defendant is not limited to making an “educated guess about what [users 4 viewed] on the websites.” United States v. Forrester, 512 F.3d 500, 510 (9th Cir. 2008); 5 Hammerling, 615 F. Supp. 3d at 1093. 6 The alleged URLs also go beyond revealing a general webpage address with basic 7 identification information that would render it record information. They are descriptive of 8 the content. For example, the FAC alleges that the URL not only shows that the user 9 watched a specific video called “Plants for a Shady Landscape,” but also that it was within 10 HGTV’s outdoor, gardens, and planting and maintenance section. FAC ¶ 60. Thus, the 11 intercepted URLs do not, as Defendant alleges, “merely reflect[] the web pages a person 12 has visited”—it reveals both the “path” and “query string” that user used that concerns the 13 substance of a communication. In re Meta Pixel Healthcare Litig., 647 F. Supp. 3d at 795. 14 It also shows content categories and details that describe the current section of the site. 15 See In re Google RTB Consumer Priv. Litig., Case No. 21-cv-2155, 606 F. Supp. 3d 935, 16 949 (N.D. Cal. June 13, 2022). 17 Thus, the alleged intercepted URLs and titles of the videos are content, and the 18 claims stemming from these communications pass the Rule 12(b)(6) challenge. 19 2. Form Field Entries and Facebook ID 20 Plaintiffs also allege that form field entries are recorded. FAC ¶ 26. Specifically, 21 they allege that Defendants receive a user’s email, first name, last name, gender, phone 22 number, city, state, and zip code from form fields, as well as a visitor’s FID. Id. ¶¶ 64–65, 23 68, 71, 74. 24 “Generally, customer information such as a person’s name, address, and subscriber 25 number or identity is record information, but it may be contents when it is part of the 26 substance of the message conveyed to the recipient.” Hammerling, 615 F. Supp. 3d at 27 1093 (citing In re Zynga Priv. Litig., 750 F.3d at 1104, 1108–09). 1 “contents.” ECF 24 at 13. They divulge only customer record information such as the 2 user’s name, address, and subscriber identity. See In re Zynga Priv. Litig., 750 F.3d at 3 1106. Further, they are automatically generated in the course of communication—the 4 Pixel and browser are automatically prompted to scan the form fields and transmit the 5 c_user cookie with the FID when a visitor watches a video. Id. Thus, they are not user- 6 generated material, just routine identifiers not protected by CIPA § 631. Yoon v. 7 Lululemon USA, Inc., 549 F. Supp. 3d 1073, 1082 (C.D. Cal. 2021). 8 Thus, the form field entries and FID are not contents, and the claims related to these 9 communications do not pass Defendant’s Rule 12(b)(6) challenge. 10 3. Button Clicks and Associated Texts 11 Plaintiffs also allege that Defendant intercepts button clicks and its associated text. 12 FAC ¶ 119. Specifically, they allege that Defendant intercepts when a viewer starts and 13 finishes the advertisement that plays before the video and the video itself, the names of the 14 buttons, and pages visited as a result of button clicks (including the video’s title). FAC ¶¶ 15 26, 61–63. 16 User habits are often record information and thus not contents. For example, the 17 Ninth Circuit found that a telephone call’s “origination, length, and time” was not contents. 18 United States v. Reed, 575 F.3d 900, 917 (9th Cir. 2009). This District also found that 19 usage and engagement data such as installation metrics, number of days users were active, 20 and a user’s total time spent on a third-party app was not content. Hammerling, 615 F. 21 Supp. 3d at 1093. However, the court emphasized “how much information would be 22 revealed” by the information’s tracking and disclosure, stating that had the information 23 intercepted “identif[ied] the specific videos or document that the user view[ed]” would 24 make this data contents. Id. at 1092–1093. 25 Here, generally the alleged button clicks and pages viewed are record information 26 since they are akin to user habits. While the majority of the button click data do not 27 convey the intended message in the same way as, for example, the intercepted URLs, 1 Supp. 3d at 1082. For example, they allege that a button click discloses the video’s title, 2 which identifies the “specific videos . . . that the user view[ed],” making it content. 3 Hammerling, 615 F. Supp. 3d at 1093; supra Section IV.B.1. In a similar vein, tracking 4 viewership of the video and knowing what exact video it is, taken together, describes the 5 substance of the communications and is thus contents. These two exceptions allow 6 Defendant to go beyond an “educated guess.” Hammerling, 615 F. Supp. 3d at 1093. 7 Thus, the button click data associated with the video titles are contents and pass 8 Defendant’s 12(b)(6) challenge. However, the rest of the button click data are not contents 9 and these claims do not pass Defendant’s Rule 12(b)(6) challenge. 10 C. Count III – CIPA § 632 11 Plaintiffs also allege that Defendant violated California Penal Code § 632 when 12 Defendant used the Pixel to collect confidential video viewing data without prior consent. 13 FAC ¶¶ 142–46. Defendant argues that this claim was not plausibly alleged because the 14 alleged web-browsing data is not “confidential.” ECF 24 at 13. 15 Under CIPA § 632, a communication is confidential if “a party to that conversation 16 has an objectively reasonable expectation that the conversation is not being overheard or 17 recorded.” Flanagan v. Flanagan, 27 Cal. 4th 766, 777 (2002). Courts generally find that 18 Internet communications do not have an objectively reasonable expectation of 19 confidentiality, especially if those communications can be easily shared by the recipients 20 of the communications. Brown v. Google LLC, 685 F. Supp. 3d 909, 938 (N.D. Cal. 21 2023); Campbell v. Facebook Inc., 77 F. Supp. 3d 836, 849 (N.D. Cal. 2014). Plaintiffs 22 must plead “something unique about these particular internet communications” to justify 23 that they are confidential. In re Meta Pixel Healthcare Litig., 647 F. Supp. 3d at 799. 24 Defendant first argues that Plaintiffs have not alleged that the collected data was 25 “confidential” because they do not bring any plausible claims under the federal Video 26 Privacy Protection Act (VPPA) or its state analogue. ECF 24 at 13. However, it is 27 irrelevant whether Plaintiffs do not or could not plausibly allege that either of those laws 1 reasonable expectation that the conversation is being overheard or recorded.” Thus, 2 analysis under VPPA or its state analogue is unnecessary. 3 Defendant then argues that the collected data is not “confidential” because Plaintiffs 4 have not rebutted the Internet presumption. ECF 24 at 14. The Court finds that they have. 5 The reasoning behind the presumption fails here—Plaintiffs’ communications have no 6 recipients, and thus Plaintiffs could not reasonably expect that they would be forwarded or 7 otherwise easily shared. See In re Google Inc., No. 13-MD-02430, 2013 WL 5423918, at 8 *22 (N.D. Cal. Sept. 26, 2013) (involving email); see also People v. Nakai, 183 9 Cal.App.4th 499, 518 (2010) (involving an Internet chat). Further, the court in Brown 10 clarified that while there is no reasonable expectation of privacy over URLs that only 11 reveal basic identification information, they do over URLs that disclose “the particular 12 document within a website that a person views. Brown v. Google, 685 F. Supp. 3d 909, 13 941 (N.D. Cal. 2023) (citing Hammerling, 615 F. Supp. 3d at 1089). The collected data 14 here is therefore confidential because it allegedly reveals the exact title of the video being 15 watched. Plaintiffs’ reasonable expectation of privacy is strengthened by the allegation 16 that there was no express written consent for the disclosure of video viewing history and 17 that to the contrary, Defendant made false representations and warranties that it does not 18 collect such information. FAC ¶¶ 83–84; supra Section IV.A. Given Defendant’s 19 portrayal and Plaintiffs’ lack of consent to its collection policies, Plaintiffs could have had 20 a reasonable expectation of privacy over their private browsing. See Brown, 685 F. Supp. 21 3d at 939. 22 As such, Plaintiffs have plausibly alleged a claim under CIPA § 632 and it passes 23 the Rule 12(b)(6) challenge. 24 D. Count IV – CIPA § 635 25 Plaintiffs allege that Defendant violated CIPA § 635 when it implemented the Pixel. 26 FAC ¶¶ 151–52. Defendant argues that there is no private right of action to enforce the 27 statute and that Plaintiffs cannot plead the essential elements of the claim. 1 1. Private Right of Action 2 Defendant argues that there is no private right of action to enforce the criminal 3 provisions in CIPA § 635 because Plaintiffs do not allege they were injured by Meta’s 4 creation of the Pixel, but rather certain websites’ improper use of the Pixel. ECF 24 at 15. 5 CIPA creates a private right of action for “any person who has been injured by a 6 violation of this chapter.” Cal. Penal Code § 637.2(a). “It is not a necessary prerequisite to 7 an action pursuant to this section that the plaintiff has suffered, or be threatened with, 8 actual damages.” Id. § 637.2(c). 9 Here, while Defendant is right that Plaintiffs do not allege they were injured by 10 Meta’s creation of the Pixel, Plaintiffs do allege that they were injured by Meta violating 11 CIPA § 635. ECF 24 at 15; FAC ¶ 154. Thus, unlike Yoon v. Lululemon, Plaintiffs allege 12 more than injury from Defendant’s use of its tracking devices. See Yoon, 549 F. Supp. 3d 13 at 1085. Even if the injury is not direct, this Court has found that “the better 14 interpretation” of CIPA § 637.2 is finding a private right of action for “injuries caused by 15 use of an eavesdropping device are traceable to the manufacture, sale, and provision of that 16 device.” In re Meta Pixel Tax Filing Cases, 724 F. Supp. 3d at 1009. As such, because 17 the alleged injuries stemming from the websites’ usage of the Pixel were because of 18 Meta’s violation of CIPA § 635, there is a private right of action. 19 Thus, there is a plausible private right of action and it passes the Rule 12(b)(6) 20 challenge. 21 2. Primarily or Exclusively Designed 22 Defendant then argues that Plaintiffs have not plausibly alleged a violation of CIPA 23 § 635 because the Pixel cannot be primarily useful for unlawful spying if it is “perfectly 24 lawful when used properly” and is “widely deployed across many industries.” ECF 24 at 25 17–18. 26 In a Rule 12(b)(6) analysis, the Court must accept as true all factual allegations in 27 the complaint and draw all reasonable inferences in favor of the non-moving party. Retail 1 imagine any purpose . . . other than eavesdropping but instead whether plaintiffs’ 2 allegations are sufficient to plausibly state a claim.” In re Meta Pixel Tax Filing Cases, 3 724 F. Supp. 3d at 1010. Here, Plaintiffs allege that that the Pixel is a “device” that was 4 “primarily or exclusively designed” for eavesdropping because it was designed to gather 5 information about what URLs users visit and what they search for. FAC ¶ 152. They 6 additionally allege that the Pixel is “invisible.” FAC ¶ 24. These allegations can still be 7 true, even if it can be used lawfully and is widely deployed. Drawing all reasonable 8 inferences in Plaintiffs’ favor, these nonconclusory allegations are sufficient to plead that 9 the Pixel is primarily designed for eavesdropping. In re Meta Pixel Tax Filing Cases, 724 10 F. Supp. 3d at 1009. 11 Thus, Plaintiffs sufficiently allege that the Pixel is “primarily or exclusively 12 designed” for eavesdropping and pass the 12(b)(6) challenge. 13 3. Scienter 14 Defendant lastly argues that Plaintiffs “allege no facts plausibly showing any such 15 knowledge or intent” as required under CIPA § 635. ECF 24 at 18. 16 Under CIPA § 635, “[t]he crime lies in intentionally manufacturing the device, 17 knowing that it could be primarily used for wiretapping. The statute does not require 18 intent or knowledge that the device would actually be used unlawfully.” United States v. 19 Christensen, 828 F.3d 763, 792 (9th Cir. 2015). Intent and knowledge “may be alleged 20 generally.” Fed. R. Civ. P. 9(b). 21 Plaintiffs argue that Meta knew and intended the result of wiretapping by alleging 22 that Defendant’s entire business model is based on surveillance and “gunning hard to get 23 lots and lots of third-party data about its users into its database.” FAC ¶¶ 12–22. Further, 24 Plaintiffs allege that Defendant already knew that it was receiving video information 25 through its devices. FAC ¶ 87. Thus, because collecting video information would be 26 helpful to Defendant and Defendant knowingly wanted to use that information, the Court 27 finds it is plausible that Defendant knew or intended its surveillance technology to be 1 However, Defendant argues that Plaintiffs’ allegations that the Pixel is widely 2 || deployed across many industries and Meta’s policies forbid third-party developers from 3 || sending any sensitive information shows that Meta did not have knowledge or intent. ECF 4 |} 24 at 18. That the Pixel is widely deployed is irrelevant to whether it could primarily be 5 || used for wiretapping. Further, Defendant’s policies limiting the use of the Pixel can show 6 || that Defendant knew it could be used for wiretapping if used improperly as it addressed the 7 || potential for misuse. CIPA § 635 does not require the intent that the device would be used 8 || unlawfully, just that it could be. Christensen, 828 F.3d at 792. 9 Thus, Plaintiffs have sufficiently alleged scienter and pass the Rule 12(b)(6) 10 || challenge. 11 || V. CONCLUSION 12 Based on the foregoing, the Court GRANTS Defendant’s request for judicial notice 13 |} as to all 16 exhibits. Further, the Court GRANTS Defendant’s Rule 12(b)(6) motion to 14 || dismiss regarding CIPA § 631 claims stemming from form field entries, FID, and button 15 || click data not related to the title of the video and DENIES Defendant’s motion to dismiss 16 on all other claims. Because the deficiencies can be remedied, the Court also GRANTS 5 17 || Plaintiffs leave to file a second amended complaint. Plaintiffs must file their amended 5 18 |} complaint or notify the Court that they do not wish to amend by January 21, 2025. 19 || Plaintiffs may not add any new parties or claims without further leave of Court. 20 21 22 23 IT IS SO ORDERED. 24 25 Dated: December 30, 2024 NATHANAEL M. COUSINS 26 United States Magistrate Judge 27 28