Young v. Salesforce, Inc.

• Court: District Court, N.D. California
• Decided: June 30, 2025
• Docket: 4:22-cv-09067
• Status: Unknown

Opinion

1 2 3 4 5 6 7 8 UNITED STATES DISTRICT COURT 9 NORTHERN DISTRICT OF CALIFORNIA 10 San Francisco Division 11 DIANE YOUNG, et al., Case No. 22-cv-09067-JST (LB)

12 Plaintiffs, DISCOVERY ORDER 13 v. Re: ECF No. 107 14 SALESFORCE, INC., 15 Defendant. 16 17 INTRODUCTION 18 Defendant Salesforce provides Chat, a customer-service tool hosted on its servers and 19 integrated into websites of customers like Rite Aid and Kaiser Permanente to enable real-time 20 consumer interaction and background analytics.1 In this putative class action, the plaintiffs — 21 users of Rite Aid’s and Kaiser Permanente’s websites — allege that Salesforce violates the 22 California Invasion of Privacy Act, Cal. Penal Code §§ 631 and 632, and Pennsylvania’s 23 Wiretapping and Electronic Surveillance Control Act, 18 Pa. Const. Stat. § 5701 et seq., by 24 intercepting their communications, including personally identifiable information and protected 25 26

27 1 Third Am. Compl. – ECF No. 93 at 3 (¶¶ 12–14); see Order – ECF No. 69 at 1–2. Citations refer to 1 health information.23 Salesforce denies reading the communications, asserting that it merely 2 provides the tool, which its customers control.4 3 The parties dispute whether the plaintiffs are entitled to the source code for Salesforce Chat. The 4 plaintiffs argue that it reveals how data is intercepted and used. Salesforce counters that its 5 disclosures about its software architecture are sufficient.5 The court can decide the dispute without 6 oral argument. Civil L. R. 7-1(b). The court denies the discovery because source-code disclosure is 7 disproportionate under Fed. R. Civ. P. 26(b). 8 9 ANALYSIS 10 Parties may obtain discovery of any nonprivileged matter relevant to any party’s claim or 11 defense and proportional to the needs of the case, considering the importance of the issues at stake 12 in the action, the amount in controversy, the parties’ relative access to relevant information, the 13 parties’ resources, the importance of the discovery in resolving the issues, and whether the burden 14 or expense of the proposed discovery outweighs its likely benefit. Information within this scope of 15 discovery need not be admissible in evidence to be discoverable. Fed. R. Civ. P. 26(b). “Pretrial 16 discovery is ordinarily accorded a broad and liberal treatment.” Peng v. Nw. Mut. Life Ins. Co., No. 17 17-cv-01760-SI, 2017 WL 3007030, at *1 (N.D. Cal. July 14, 2017) (cleaned up) (quoting Shoen v. 18 Shoen, 5 F.3d 1289, 1292 (9th Cir. 1993)). The party moving to compel discovery “has the initial 19 burden of establishing that the information sought is relevant to any party’s claim or defense and 20 proportional to the needs of the case.” Impinj, Inc. v. NXP USA, Inc., No. 19-cv-03161-YGR 21 (AGT), 2022 WL 16586886, at *2 (N.D. Cal. Nov. 1, 2022) (cleaned up). 22 The plaintiffs argue that the source code will reveal how Chat routes communications and 23 Salesforce uses the data.6 Salesforce counters that Chat’s functionality — not its code — is 24

25 2 Id. at 2 (¶ 1). 26 3 Id. 4 Joint Case-Mgmt. Statement – ECF No. 66 at 3. 27 5 Disc. Letter Br. – ECF No. 107 at 1–5. 1 relevant, it has provided discovery about its software architecture and capabilities, and the 2 plaintiffs have sent their Rule 30(b)(6) topics, which will illuminate the issues.7 Chat, an 3 application-programming interface — prewritten code enabling customers to build functions into 4 their programs — is configured by those customers (like Rite Aid and Kaiser), who control the 5 data.8 Also, disclosing proprietary source code risks competitive harm in Saleforce’s software-as- 6 a-service market.9 7 On this record, discovery is disproportionate. Salesforce’s documents and proposed depositions 8 offer less burdensome alternatives to understanding Chat’s functionality.10 Saleh v. Nike, Inc., No. 9 CV 20-09581-FLA (RAOX), 2021 WL 4434352, at *2 (C.D. Cal. Aug. 16, 2021) (denying source 10 code in wiretapping case involving the same plaintiffs’ counsel). The plaintiffs cite cases where 11 source code was disclosed, but all involve the voluntary production of source code. See, e.g., In re 12 Hulu Priv. Litig., No. 11-03716 LB, 2014 WL 3421036, at *1 (N.D. Cal. July 14, 2014) (Video 13 Privacy Protection Act case).11 Courts authorize alternatives like documents, diagrams, and 14 testimony as less burdensome, proportional alternatives to source-code disclosure. See, e.g., Saleh, 15 2021 WL 4434352, at *2; Realtime Data, LLC v. MetroPCS Tex., LLC, No. 12cv1948-BTM 16 (MDD), 2012 WL 1905080, at *1, 3 (S.D. Cal. May 25, 2012) (in patent case against wireless 17 communication companies, held that non-infringing third-party’s production of source code was 18 burdensome; witnesses could more easily provide information about the software); Disney Enters., 19 Inc. v. Hotfile Corp., No. 11-20427-CIV-JORDAN, 2011 WL 13100240, at *2 (S.D. Fla. Aug. 26, 20 2011) (in copyright-infringement case, the plaintiffs did not establish a need for the source code 21 where it was possible to describe the computer program by means other than source code; 22 distinguished cases where there was a dispute about the source code itself). 23 24

25 7 Id. at 3. 26 8 Id. (citing Order – ECF No. 107 at 69 n.1) (cleaned up). 9 Id. (pointing out that the plaintiffs’ counsel has other wiretapping litigation against it). 27 10 Id. ] Regarding hyperlinked documents, Salesforce need not produce publicly available material but 2 || must disclose all relevant Chat-related hyperlinked material about functionality and architecture.” 3 The plaintiffs must specify any disputed hyperlinks, and the parties must meet and confer to resolv 4 || disputes, per the court’s standing order (attached). 5 IT IS SO ORDERED. 6 Dated: June 29, 2025 LAE 7 LAUREL BEELER 8 United States Magistrate Judge 9 10 1] a 12

(«17

Z 18 19 20 21 22 23 24 25 26 27 28 || 7 Jd. at 5.