Opinion
23-cv-03101-PCP
06-18-2024
A.B., A MINOR, BY AND THROUGH HIS GUARDIAN JEN TURNER, et al., Plaintiffs, v. GOOGLE LLC, et al., Defendants.
Re: Dkt. No. 27
ORDER DENYING MOTION TO DISMISS
P. Casey Pitts, United States District Judge
Plaintiffs, six minors under the age of 13 domiciled in California, Florida, and New York, allege that defendants Google LLC, AdMob Google Inc., and AdMob Inc. unlawfully invaded their privacy by collecting their personal information through various mobile apps without parental consent. The defendants now move to dismiss plaintiffs' complaint pursuant to Federal Rule of Civil Procedure 12(b)(6). For the following reasons, the defendants' motion is denied.
BACKGROUND
Google maintains a marketplace for Android mobile phone apps called the Google Play Store, where AdMob Google and AdMob (both owned by Google) show advertisements to users of such apps. The AdMob software development kit (SDK) purportedly enables Google to collect data from Android app users and show them targeted advertisements based on this data. AdMob allegedly pays Android app developers to integrate its SDK into their mobile apps to make this data collection and targeted advertising possible.
The following facts are drawn from the complaint. In considering a Rule 12(b)(6) motion contending that a complaint fails to state a claim, the Court must “accept all factual allegations in the complaint as true and construe the pleadings in the light most favorable” to the non-moving party. Rowe v. Educ. Credit Mgmt. Corp., 559 F.3d 1028, 1029 (9th Cir. 2009).
In April 2015, Google developed a Designed for Families (DFF) program for children's apps, which purportedly imposed requirements set by the federal Children's Online Privacy Protection Act (COPPA) to protect children under the age of 13 from having their personal information collected without parental consent. COPPA states: “It is unlawful for an operator of a website or online service directed to children, or any operator that has actual knowledge that it is collecting personal information from a child, to collect personal information from a child in a manner that violates the regulations prescribed [by the Federal Trade Commission].” 15 U.S.C. § 6502(a). The FTC has interpreted “website or online service” to include mobile apps as well as individual channels like the Google Play Store that serve as the platform for such apps. 16 C.F.R. § 312.2. The relevant FTC rule has interpreted “directed to children” to mean that data cannot be collected through apps that are primarily child-directed or for mixed audiences but not properly age-gated.
In 2018, security researchers from the University of California, Berkeley purportedly informed defendants of surreptitious tracking and data collection in violation of COPPA by developers of apps included in Google's DFF program. Specifically, the researchers found that 2,667 apps were potentially incorrectly characterized by developers as directed to “mixed audiences” or “not primarily directed to children,” allowing developers to engage in defective agegating and thus participate in prohibited behavioral advertising to children. Dkt. No. 1, at 36. Based on the results of this study, Google banned the app developer Tiny Lab Productions from its Play Store in September 2018. The New Mexico Attorney General's Office then brought a lawsuit against Tiny Lab Productions, various advertising networks including AdMob, and Google as the operator of the Play Store. N.M. ex rel. Balderas v. Tiny Lab Prods., 457 F.Supp.3d 1103 (D.N.M. 2020). On December 10, 2021, as part of a settlement agreement and without admitting any liability, Google and AdMob agreed to implement policy changes to prevent the mischaracterization of DFF apps. Dkt. No. 27, at 12.
Plaintiffs here allege that defendants obtained personal information from children under the age of 13 through Android apps in violation of COPPA and other common law privacy protections. Google purportedly accepted children's apps (including 86 from the app developer Tiny Lab Productions) to its DFF program after individualized review but allowed the apps to be categorized as for a “mixed audience” or “not primarily intended for children” without proper agegating, thereby enabling developers to skirt COPPA's prohibitions on collecting data from minors under the age of 13. Dkt. No. 1, at 30. Plaintiffs further allege that defendants knew about the collection of personal data from children through DFF program apps. Plaintiffs assert the following causes of action: (1) violation of California's Unfair Competition Law (UCL); (2) violation of common law intrusion upon seclusion; (3) unjust enrichment under California law; (4) violation of California's constitutional right to privacy; (5) violation of Florida's Deceptive and Unfair Trade Practices Act (FDUTPA); (6) unjust enrichment under Florida law; (7) violation of New York's General Business Law (NYGBL); and (8) unjust enrichment under New York law. Plaintiffs' claims under the UCL, FDUTPA, and NYGBL are all premised on an underlying COPPA violation.
Defendants now move to dismiss plaintiffs' complaint, contending that the purported unlawful conduct only pertains to developer Tiny Lab Productions, which was banned from the Google Play Store in September 2018. Defendants also argue that plaintiffs: (1) fail to provide fair notice under Rule 8 because they do not allege when the supposed misconduct occurred and most of the state law claims have statutes of limitations between 2 to 4 years; (2) lack standing to seek prospective injunctive relief because they do not demonstrate a threat of being harmed again; (3) cannot assert any state law claims because they are preempted by COPPA; (4) fail to state a claim under the UCL because they have not established an economic injury, do not allege wrongful conduct under any of the three prongs, and are not entitled to equitable relief; (5) fail to state a claim under New York and Florida's consumer protection laws because Google's Terms of Service contain a California choice-of-law provision and plaintiffs do not plead claims with particularity or provide a sufficient nexus to New York and Florida; (6) fail to state claims for common law and constitutional right to privacy violations under California law because they do not allege egregious conduct violating a reasonable expectation of privacy; and (7) fail to state a claim for unjust enrichment because this cause of action does not exist.
LEGAL STANDARDS
The Federal Rules require a complaint to include only a “short and plain statement of the claim showing that the pleader is entitled to relief.” Fed.R.Civ.P. 8(a)(2). In considering a Rule 12(b)(6) motion contending that a complaint fails to state a claim, the Court must “accept all factual allegations in the complaint as true and construe the pleadings in the light most favorable” to the non-moving party. Rowe v. Educ. Credit Mgmt. Corp., 559 F.3d 1028, 1029 (9th Cir. 2009). Dismissal is required if the plaintiff fails to allege facts allowing the Court to “draw the reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 663 (2009). While legal conclusions “can provide the complaint's framework,” the Court will not assume they are correct unless adequately “supported by factual allegations.” Id. at 664.
On a Rule 12(b)(6) motion, materials outside the complaint can be considered only if they are incorporated by reference therein or otherwise judicially noticeable. See United States v. Ritchie, 342 F.3d 903, 908 (9th Cir. 2003) (“A [district] court may .. consider certain materials- documents attached to the complaint, documents incorporated by reference in the complaint, or matters of judicial notice-without converting the motion to dismiss into a motion for summary judgment.”). Incorporation by reference is permitted if the complaint “refers extensively to the document” or if “the document forms the basis” of the claim. Khoja v. Orexigen Therapeutics, Inc., 899 F.3d 988, 1002 (9th Cir. 2018). Federal Rule of Evidence 201 permits judicial notice of “a fact that is not subject to reasonable dispute” because it is “generally known.”
Fraud-based claims are subject to the heightened pleading requirements established by Federal Rule of Civil Procedure 9(b) instead of the more lenient Rule 8 standard. When “alleging fraud or mistake, a party must state with particularity the circumstances constituting fraud or mistake.” Fed.R.Civ.P. 9(b). The pleading of fraud must be “specific enough to give defendants notice of the particular misconduct ... so that they can defend against the charge and not just deny that they have done anything wrong.” Vess v. Ciba-Geigy Corp. USA, 317 F.3d 1097, 1106 (9th Cir. 2003). Malice, intent, and knowledge may be alleged generally, however. Fed.R.Civ.P. 9(b).
ANALYSIS
I. Plaintiffs' Claims Are Not Time-Barred.
Defendants argue that because Tiny Lab was banned from the Google Play Store in September 2018, more than 4 years before this complaint was filed on June 6, 2023, plaintiffs' claims are time-barred. Plaintiffs respond that while the AdMob SDK was discovered in DFF program children's apps in 2018, Google did not remedy this conduct until December 10, 2021, when it reached a settlement agreement with the New Mexico Attorney General's Office to prevent further mischaracterization of child-targeted DFF apps as apps for “mixed audiences.” Dkt. No. 33, at 14. Accordingly, plaintiffs argue, the COPPA violations that form the primary basis for their claims continued through 2021 in apps by developers other than Tiny Lab. Plaintiffs also contend that even if Tiny Lab was banned from the Google Play Store in September 2018, apps by Tiny Lab were not deleted from children's phones so tracking and data collection through such apps could have continued past 2018. Id. at 15 (noting that collection of plaintiffs' information through AdMob's SDK also occurs “during the use of the already-downloaded DFF AdMob Apps”).
The fact that Google banned Tiny Lab from its Play Store in September 2018 is judicially noticeable because plaintiffs explicitly reference a news article saying as much in their complaint. Dkt. No. 1, at 40 n.42 (citing https://gizmodo.com/new-mexico-sues-google-twitter-and-app-developers-ove-1829109436).
In the Ninth Circuit, the statute of limitations is generally an affirmative defense rather than an element of the plaintiff's claim. See Lasko v. Caliber Home Loans, 2022 WL 728820, at *1 (9th Cir. Mar. 10, 2022) (noting that “a statute of limitations is an affirmative defense, not a cause of action”) (citing United States v. Allahyari, 980 F.3d 684, 686 (9th Cir. 2020)). As a result, the defense generally cannot be asserted on a Rule 12(b)(6) motion. “If the running of the statute is apparent on the face of the complaint,” however, “the defense may be raised by a motion to dismiss.” Jablon v. Dean Witter & Co., 614 F.2d 677, 682 (9th Cir. 1980). “When a motion to dismiss is based on the running of the statute of limitations, it can be granted only if the assertions of the complaint, read with the required liberality, would not permit the plaintiff to prove that the statute was tolled” or that the claims were timely. Id. Thus, to survive a motion to dismiss, plaintiffs “simply need to plead facts demonstrating a potential factual dispute that could affect whether the defense applies.” Rabin v. Google LLC, 2024 WL 1269313, at *2 (N.D. Cal. Mar. 26, 2024). “Only when the plaintiff pleads itself out of court-that is, admits all the ingredients of an impenetrable defense-may a complaint that otherwise states a claim be dismissed under Rule 12(b)(6).” Durnford v. MusclePharm Corp., 907 F.3d 595, 604 (9th Cir. 2018).
Plaintiffs' complaint here, when construed liberally, pleads facts demonstrating a potential factual dispute by sufficiently alleging that defendants' purportedly unlawful conduct continued within the relevant statute-of-limitations period. Specifically, the complaint alleges that minors were tracked through various Android apps in Google's DFF program, not just Tiny Lab's apps. The fact that Tiny Lab was removed from the Google Play Store in 2018 therefore does not on its own render plaintiffs' claims time-barred. Further, plaintiffs allege that unlawful tracking continued to occur through 2021 on the devices of children who had downloaded Tiny Lab apps before its 2018 removal from the Google Play Store because the apps were not deleted from their devices.
Because plaintiffs allege that unlawful tracking and advertising was occurring through Android apps at least until 2021, defendants cannot establish, from the face of the complaint, that plaintiffs' claims are time-barred.
Defendants cite statutes of limitations ranging between 2 and 4 years for the various causes of action. Dkt. No. 27, at 15 n.5. Because the settlement with the New Mexico Attorney General's Office occurred in December 2021 and the complaint was filed in June 2023, even claims with a two-year statute of limitations would not be time-barred if the tracking and data collection at issue ended with the settlement.
II. Plaintiffs Have Standing To Seek Injunctive Relief.
Defendants argue that plaintiffs lack standing to seek injunctive relief because they fail to establish a “real or immediate threat that [they] will again be wronged in a similar way.” Mayfield v. United States, 599 F.3d 964, 970 (9th Cir. 2010). “Past exposure to illegal conduct does not in itself show a present case or controversy regarding injunctive relief if unaccompanied by any continuing, present adverse effects.” O'Shea v. Littleton, 414 U.S. 488, 495-96 (1974). Because Google purportedly altered its policies concerning the characterization of apps in the DFF program through its settlement with the New Mexico Attorney General's Office in 2021, defendants contend that plaintiffs fail to allege any continuing harm to warrant injunctive relief.
The defendants may be correct that plaintiffs lack standing to seek prospective changes to Google's DFF program policies. But plaintiffs also request that defendants “permanently delete, destroy or otherwise sequester the Personal Information collected without parental consent.” Dkt. No. 1, at 63. Notwithstanding any change in defendants' DFF policies, defendants have not provided evidence that the information purportedly collected from minors before the 2021 settlement has been deleted. Dkt. No. 33, at 33. Because the harm from defendants' alleged possession and use of plaintiffs' information purportedly continues, plaintiffs have standing to seek injunctive relief to remedy that harm.
III. Plaintiffs' State Law Claims Are Not Preempted by COPPA.
Defendants argue that plaintiffs' state law claims are preempted by COPPA because those claims are inconsistent with the federal statute. The FTC's COPPA Rule requires a defendant to have “actual knowledge” that data is being collected from apps that are primarily child-directed or relevant to mixed audiences but not properly age-gated. 16 C.F.R. § 312.2. Defendants argue that plaintiffs fail to meet this actual knowledge requirement because they only allege in a conclusory manner that “Google had actual knowledge that every DFF App was ‘child directed' as defined under COPPA.” Dkt. No. 1, at 33. Defendants also contend that plaintiffs' state law claims are too broad because the fact that DFF apps were deemed “appropriate for children” per Google's policies did not mean that they were “directed to children” under COPPA's statutory definition.
The Ninth Circuit recently held in a similar case that the same causes of action being pursued here were not preempted by COPPA because they did not “stand as an obstacle to COPPA in purpose or effect” and were “consistent with COPPA.” Jones v. Google LLC, 73 F.4th 636, 643 (9th Cir. 2023). The Jones Court found that COPPA does not preempt “state-law causes of action that are parallel to, or proscribe the same conduct forbidden by, COPPA.” Id. The Court explained that COPPA does not preempt “state law claims based on underlying conduct that also violates COPPA's regulations.” Id. at 640-41.
The crux of the defendants' argument is that plaintiffs' state law claims are preempted because plaintiffs fail to sufficiently plead that defendants had actual knowledge about data collection through apps that were directed to children, and thus do not allege an underlying COPPA violation but instead seek to hold the defendants liable for conduct that does not violate COPPA's regulations.
Defendants may or may not be right that state law claims permitting liability to be established absent actual knowledge are preempted by COPPA. Contrary to the defendants' contentions, however, plaintiffs have adequately pleaded actual knowledge. As noted already, plaintiffs specifically allege that “Google had actual knowledge that every DFF App was ‘child directed' as defined under COPPA.” Dkt. No. 1, at 33; see Fed.R.Civ.P. 9(b) (noting that knowledge may be alleged generally). They have also pleaded facts plausibly supporting this allegation. Plaintiffs allege that defendants were made aware by security researchers at Berkeley that 2,667 DFF apps (~51% of the apps in their sample) were incorrectly listed as directed to “mixed audiences” and “not primarily directed to children.” Dkt. No. 1, at 36. The researchers noted that developers were miscategorizing their apps and then engaging in defective age-gating, thereby collecting data from minors under the age of 13 in violation of COPPA. The researchers used 84 Tiny Lab apps as a case study to show evidence of this behavior. Because plaintiffs allege that Google was informed of this study, plaintiffs at the very least adequately plead that Google had actual knowledge of Tiny Lab's purportedly unlawful behavior (which, as previously noted, allegedly continued to permit tracking and data collection until 2021).
Because plaintiffs have adequately pleaded actual knowledge, the Court will not decide that issue at this time and will instead consider it in the future if plaintiffs are unable to establish Google's actual knowledge.
Plaintiffs also allege that Google “reviewed each DFF App submission to ensure that the App provided a specific benefit to children under thirteen or was relevant to children under thirteen.” Dkt. No. 1, at 32. As plaintiffs note, Google's 2015 DFF program policy stated that “[g]eneral audience apps that have no specific benefit or relevance for audiences under the age of thirteen will not be accepted into the program. To participate, there are specific guidelines your apps need to meet, which are assessed in an app content review.” Dkt. No. 1, at 27-28 (emphasis added). Assuming that Google reviewed every app for compliance with COPPA before accepting it into the DFF program, plaintiffs sufficiently allege that Google had actual knowledge that certain apps were being mischaracterized as for “mixed audiences” when they were in fact child-directed.
Taken together, plaintiffs' allegations about the Berkeley study and Google's individualized review of each app submitted to the DFF program adequately plead that defendants had actual knowledge of the purported misconduct. The District of New Mexico held as much in its related 2020 case:
Putting it all together, these facts state that: Google reviews the content of apps submitted to its Designed for Families program with a particular eye toward whether the apps are relevant for children; Tiny Lab's apps, replete with characteristics revealing their child-directed content, were submitted to and accepted by Google into that program; and, after being contacted by concerned [Berkeley] researchers, Google reviewed the content of Tiny Lab's apps with the specific goal of determining whether they were primarily directed to children. The reasonable inference to be drawn from these facts is that Google conducted not one but two reviews of the content of Tiny Lab's apps, during which Google gained (and gained again) a firsthand awareness or understanding of the child-directed nature of those apps. The Complaint thus plausibly claims that, first through its review process in connection with the submission of Tiny Lab's apps to its Designed for Families program and again through its investigation of those apps to determine whether they were primarily child-directed, Google obtained actual knowledge that Tiny Lab's apps are directed to children.
Balderas, 457 F.Supp.3d at 1107. Similarly here, plaintiffs sufficiently allege that defendants had actual knowledge, generated through its internal review process and the Berkeley study, that apps directed to children in the DFF program had been instead characterized as for mixed audiences and were using the AdMob SDK to track and collect data. Because plaintiffs adequately plead an underlying COPPA violation, their state law claims proscribing the same conduct are not preempted by COPPA.
Google moved for reconsideration, but the Court denied its motion in 2021. See N.M. ex rel. Balderas v. Tiny Lab Prods, 516 F.Supp.3d 1293, 1301 (D.N.M. 2021) (“Reading these allegations together, the factual content of the Complaint plausibly alleges that, first through its review process in connection with the submission of Tiny Lab's apps to its Designed for Families program and again through its investigation of those apps to determine whether they were ‘primarily directed to children,' Google obtained actual knowledge that Tiny Lab's apps are ‘child directed sites or services whose primary target audience is children.'”).
IV. Plaintiffs Adequately Plead a UCL Claim.
California's Unfair Competition Law (UCL) prohibits unfair competition, which means “any unlawful, unfair, or fraudulent business act or practice and unfair, deceptive, untrue, or misleading advertising.” Cal. Bus. & Prof. Code § 17200. When assessing a UCL claim, courts consider each of three prongs-unlawful, fraudulent, and unfair-to determine whether a practice constitutes unfair competition, and “a claim that sufficiently pleads any of these prongs survives a motion to dismiss.” MacDonald v. Ford Motor Co., 37 F.Supp.3d 1087, 1097 (N.D. Cal. 2014).
Defendants first contend that plaintiffs lack standing to bring a UCL claim because they have not alleged an economic injury. See Turner v. Wells Fargo Bank NA, 859 F.3d 1145, 1151 (9th Cir. 2017) (noting that a plaintiff must “establish a loss or deprivation of money or property sufficient to qualify as injury in fact, i.e., economic injury” to assert a UCL claim). In their view, the misappropriation of personal information does not qualify. Pruchnicki v. Envision Healthcare Corp., 845 Fed.Appx. 613, 615 (9th Cir. 2021) (holding that “mere misappropriation of personal information does not establish compensable damages”); see also In re Google, Inc. Privacy Pol'y Litig., 2015 WL 4317479, at *5 n.63 (N.D. Cal. Jul. 15, 2015) (finding the misappropriation of personal information without a resultant economic harm to be neither damage nor injury-in-fact).
There is a split of authority in this District on this issue and no binding Ninth Circuit precedent. Compare In re Facebook Privacy Litig., 791 F.Supp.2d 705, 714 (N.D. Cal. 2011), aff'd 572 Fed.Appx. 494 (9th Cir. 2014) (“[P]ersonal information does not constitute property for purposes of a UCL claim.”) and M.K. v. Google LLC, 2023 WL 2671381, at *5 (N.D. Cal. Mar. 27, 2023) (same) with Calhoun v. Google LLC, 526 F.Supp.3d 605, 636 (N.D. Cal. 2021) (concluding that “plaintiffs who suffered a loss of their personal information suffered economic injury and had standing”) and Brown v. Google LLC, 2021 WL 6064009, at *15 (N.D. Cal. Dec. 22, 2021) (finding the loss of personal information through Google's data collection as sufficient to qualify as the diminution of a future property interest).
Notwithstanding decisions in this District holding otherwise, see, e.g., Katz-Lacabe v. Oracle Am., Inc., 668 F.Supp.3d 928, 943 (N.D. Cal. 2023) (collecting cases), the Court agrees with the rationale of Calhoun and Brown and concludes that plaintiffs have adequately pleaded the economic injury needed to establish UCL standing. As the Court has previously held, “Privacy harms involving personal data can constitute an injury to money or property sufficient to provide standing under the UCL.” In re Meta Pixel Tax Filing Cases, 2024 WL 1251350, at *24 (N.D. Cal. Mar. 25, 2024) (noting that privacy harms can constitute economic injury to confer UCL standing under three theories: unfair benefit-of-the-bargain to businesses who violate user expectations about how their data will be used, diminished value of personal information, and reduced right to exclude others from accessing personal data).
In Brown, the Court noted it was plausible that plaintiffs would “decide to sell their data at some point,” and because Google obtained the data and sold it to advertisers, Google diminished plaintiffs' “future property interest.” 2021 WL 6064009, at *15. Similarly, plaintiffs here recognize that there is a market for their data, alleging in their complaint that “there is a market for consumers to monetize Personal Information and the behavioral preferences that Defendants have usurped.” Dkt. No. 1, at 47 (citing studies placing a value of $200 on an individual's personal information). Because plaintiffs allege that they can “no longer realize the full economic value of their Personal Information” due to the data collection by defendants, they adequately plead an economic injury resulting from defendants' purported misconduct. Id. at 48. Accordingly, they have sufficiently alleged that they “lost money or property as the result of the unfair competition,” as is required to establish standing under the UCL. Cal. Bus. & Prof. Code § 17204.
Defendants separately argue that plaintiffs fail to adequately plead a UCL violation under either of the three prongs. Because the Court finds that plaintiffs sufficiently alleged an underlying COPPA violation, however, they have adequately pleaded a UCL claim under at least the unlawful prong.
V. Plaintiffs Adequately Plead Violations of New York and Florida Statutes.
The New York General Business Law (NYGBL) states, “Deceptive acts or practices in the conduct of any business, trade or commerce or in the furnishing of any service in this state are hereby declared unlawful.” N.Y. Gen. Bus. Law § 349(a). An NYGBL claim consists of three elements: “first, that the challenged act or practice was consumer-oriented; second, that it was misleading in a material way; and third, that the plaintiff suffered injury as a result of the deceptive act.” Boris v. Wal-Mart Stores, Inc., 35 F.Supp. 1163, 1173 (C.D. Cal. 2014). “Whether a representation or omission is a deceptive act or practice depends on the likelihood that it will mislead a reasonable consumer acting reasonably under the circumstances.” Id. (citation omitted).
The Florida Deceptive and Unfair Trade Practices Act (FDUTPA) prohibits “[u]nfair methods of competition, unconscionable acts or practices, and unfair or deceptive acts or practices in the conduct of any trade of commence.” Fla. Stat. § 501.204(1). “A consumer claim for damages under FDUTPA has three elements: (1) a deceptive act or unfair practice; (2) causation; and (3) actual damages.” Parziale v. HP, Inc., 445 F.Supp.3d 435, 442 (N.D. Cal. 2020). “An unfair practice is one that offends established public policy and one that is immoral, unethical, oppressive, unscrupulous or substantially injurious to consumers.” In re Carrier IQ, Inc., 78 F.Supp.3d 1051, 1119 (N.D. Cal. 2015). A deceptive act “occurs if there is a representation, omission, or practice that is likely to mislead consumers acting reasonably in the circumstances, to the consumer's detriment.” Id. (citations and internal quotations omitted).
Defendants argue that plaintiffs' causes of action under the NYGBL and FDUTPA must fail because Google's Terms of Service contain a California choice-of-law provision. They also contend that the claims are not pleaded with particularity and lack a sufficient nexus to New York and Florida. The Court disagrees.
First, the Court cannot hold at this stage that the California choice-of-law provision applies because defendants' argument depends upon Google's Terms of Service, which are not properly cognizable on this Rule 12(b)(6) motion. Dkt. No. 29-4. Those Terms of Service are neither incorporated by reference in the complaint nor judicially noticeable. See Urban v. Tesla, Inc., 2023 WL 6796021, at * 3 (N.D. Cal. Oct. 13, 2023) (holding that defendant's evidence of a choice-of-law provision in a purported purchase agreement “outside the four corners of the complaint” “must be disregarded” under Rule 12(b)(6)). And even if the Terms of Service were judicially noticeable, defendants fail to show that plaintiffs actually agreed to these specific Terms when downloading Android apps from the Google Play Store. The Terms presented by defendants were effective January 5, 2022, Dkt. No. 29-4, at 1, and there is no evidence that plaintiffs consented to these Terms when they downloaded apps through the DFF program in 2021 and before. See, e.g., Weizman v. Talkspace, Inc., 2023 WL 8461173, at *5 (N.D. Cal. Dec. 6, 2023) (holding that defendants' undated screenshot showing its Terms as clickwrap at the sign up page fails to establish that plaintiffs consented to those Terms). Because defendants cannot introduce Google's Terms of Service at this juncture and fail to show that plaintiffs agreed to those Terms, the California choice-of-law provision therein does not bar plaintiffs' New York and Florida claims for purposes of this Rule 12(b)(6) motion.
Second, plaintiffs adequately plead their NYGBL and FDUTPA claims, even under Rule 9(b)'s heightened pleading standard. Both the NYGBL and FDUTPA require a deceptive act that misleads consumers and causes them to suffer an injury. As discussed above in the context of UCL standing, plaintiffs have adequately pleaded that they suffered an economic injury. The remaining question, therefore, is whether plaintiffs have pleaded with particularity that defendants engaged in a deceptive act that resulted in said injury. Plaintiffs specifically allege that “Google broadly promoted, marketed, and represented in numerous ways that the DFF program and the Apps included in the program [were] suitable and safe and designed for children and legally compliant,” citing relevant provisions from Google's 2015 DFF policy and 2018 DFF eligibility requirements. Dkt. No. 1, at 70, 78. By pointing out specific statements made by defendants about the suitability of DFF apps for children, and adequately pleading with circumstantial evidence that defendants had actual knowledge about the mischaracterization of child-directed apps on the platform, plaintiffs sufficiently allege that defendants made representations likely to mislead reasonable consumers. By making consumers feel as though children's personal information was not being collected through DFF program apps, defendants encouraged plaintiffs to download and use the DFF apps, which resulted in the purportedly unlawful collection of data and subsequent advertising targeted toward minors.
Defendants argue that plaintiffs must plead their consumer protection statute claims with particularity because they sound in fraud. Dkt. No. 27, at 26. The Second Circuit, however, has held that “an action under § 349 is not subject to the pleading-with-particularity requirements of Rule 9(b) ... but need only meet the bare bones notice-pleading requirements of Rule 8(a).” Pelman ex rel. Pelman v. McDonald's Corp., 396 F.3d 508, 511 (2d Cir. 2005). And “[f]ederal district courts are split as to whether FDUTPA claims are subject to the heightened pleading requirements of Rule 9(b).” Parziale, 445 F.Supp.3d at 442; see also Griffey v. Magellan Health Inc., 562 F.Supp.3d 34, 54 (N.D. Cal. 2021) (“There is a district split about whether Rule 9(b) applies to the Florida DUTPA. But where the gravamen of the claims sounds in fraud Rule 9(b) applies.”). Because the Court concludes that plaintiffs satisfy Rule 9(b), it need not decide whether their New York and Florida claims are instead subject to the less stringent standard of Rule 8.
Third, defendants argue that plaintiffs did not plead a sufficient nexus to New York or Florida. But plaintiffs residing in New York and Florida allege that they used the DFF apps while in those states and they were presumably injured by the alleged misconduct in those states. Dkt. No. 1, at 69 (alleging that plaintiffs C.D.1, C.D.2, and C.D.3 “are or were residents of Florida and/or used the Apps in Florida”); id. at 77 (alleging that plaintiffs E.F.1 and E.F.2 “are or were residents of New York and/or used the Apps in New York”). This provides a sufficient nexus for the purposes of Rule 12(b)(6).
VI. Plaintiffs Adequately Plead California Privacy Claims.
To state a claim for invasion of privacy under California law, a plaintiff must allege (1) a legally protected privacy interest; (2) a reasonable expectation of privacy under the circumstances; and (3) a serious invasion of the protected privacy interest. Hill v. Nat'l Collegiate Athletic Assn., 7 Cal.4th 1, 6 (1994). Stating a claim for intrusion upon seclusion in California requires a showing that the defendant (1) intruded into a private place, conversation or matter, (2) in a manner highly offensive to a reasonable person. Taus v. Loftus, 40 Cal.4th 683, 725 (2007). As summarized by the Ninth Circuit, both claims are plausibly alleged where (1) there exists a reasonable expectation of privacy, and (2) the intrusion was highly offensive. In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 601 (9th Cir. 2020).
Defendants first argue that plaintiffs fail to allege that they have a legally protected interest in their personal information. But as discussed above, plaintiffs have a property interest in their data.
Defendants also argue that Google's Privacy Policy discloses that Google engages in interest-based advertising and shares non-personally identifiable information with advertising partners, undermining any expectation of privacy. Dkt. No. 27, at 28. As already discussed, however, defendants cannot establish, for purposes of this motion, that plaintiffs actually saw or agreed to Google's general terms and policies. Further, plaintiffs cite the DFF program's guidelines, which state that ads “displayed to child audiences do not involve interest-based advertising.” Dkt. No. 1, at 4, 23. Given the legal bar on interest-based advertising for the narrower class of DFF children's apps, the minor plaintiffs have adequately pleaded that they had a reasonable expectation of privacy in their personal information notwithstanding any general disclosure by Google about potential interest-based advertising and data collection they might have seen. These facts stand in contrast to cases cited by defendants that only involve a general disclosure provision. See, e.g., Smith v. Facebook, Inc., 745 Fed.Appx. 8, 9 (9th Cir. 2018) (dismissing intrusion upon seclusion claim given users' acquiescence to policies disclosing data collection practices).
Defendants also argue that the purported intrusion into plaintiffs' reasonable expectation of privacy was not highly offensive. Under California law, an intrusion must constitute “an egregious breach of the social norms underlying the privacy right” to be actionable. Folgelstrom v. Lamps Plus, Inc., 195 Cal.App.4th 986, 992 (Cal.Ct.App. 2011). By surreptitiously collecting data from minors under the age of 13 after representing that DFF apps were child-directed, defendants allegedly engaged in the specific conduct proscribed by COPPA. A violation of federal law is generally considered egregious, and because COPPA prohibits such data collection from minors to protect their privacy, plaintiffs have adequately pleaded an egregious intrusion into the minors' expectation of privacy. See, e.g., In re Facebook, Inc. Internet TrackingLitig., 956 F.3d at 602-03 (finding privacy violations when “the online entity represented to the plaintiffs that their information would not be collected, but then proceeded to collect it anyway”). No matter how unsensitive or un-intimate the personal information collected here was, the allegation that defendants collected the data in violation of federal law despite representing that their DFF program apps did not engage in interest-based advertising suffices to show that defendants' intrusion upon plaintiffs' expectation of privacy was highly offensive.
VII. Plaintiffs Adequately Plead Unjust Enrichment Claims.
Defendants finally argue that plaintiffs' unjust enrichment claim under California law should be dismissed because “there is no cause of action in California labeled unjust enrichment.” Dkt. No. 27, at 31 (citation omitted). Defendants further contend that the unjust enrichment claims under New York and Florida law should fail because the purported contracts at issue (Google's Terms of Service and Privacy Policy) cover the same subject matter as the dispute. Id.
The Ninth Circuit has recently acknowledged (albeit in a nonprecedential opinion) that unjust enrichment may constitute a standalone cause of action under California law. Bruton v. Gerber Products Co., 703 Fed.Appx. 468, 470 (9th Cir. 2017). To adequately allege unjust enrichment as an independent cause of action, “a plaintiff must show that the defendant received and unjustly retained benefit at the plaintiff's expense.” ESG Capital Partners, LP v. Stratos, 828 F.3d 1023, 1038 (9th Cir. 2016). Here, plaintiffs have adequately pleaded that defendants were unjustly enriched by collecting plaintiffs' personal information and employing it to target advertisements to children. See In re Facebook, Inc., Consumer Priv. User Profile Litig., 402 F.Supp.3d 767, 808 (N.D. Cal. 2019) (“And even if the plaintiffs suffered no economic loss from the disclosure of their information, they may proceed at this stage on a claim for unjust enrichment to recover the gains that Facebook realized from its allegedly improper conduct.”).
As to the unjust enrichment claims under New York and Florida law, defendants fail to establish the existence of a contract between plaintiffs and defendants because the Court cannot consider defendants' extrinsic evidence of Google's Terms of Service and Privacy Policy on this Rule 12(b)(6) motion. The Court therefore denies defendants' motion to dismiss these unjust enrichment claims as well.
CONCLUSION
For the foregoing reasons, the Court denies the defendants' motion to dismiss.
IT IS SO ORDERED.