Opinion
Case No. EDCV 22-1702-MWF (JPR)
03-07-2023
Miguel LICEA v. AMERICAN EAGLE OUTFITTERS, INC.
Scott J. Ferrell, Victoria C. Knowles, Pacific Trial Attorneys APC, Newport Beach, CA, for Miguel Licea. Paul M. Kakuske, Pooja Shah, Joel D. Siegel, Dentons U.S. LLP, Los Angeles, CA, for American Eagle Outfitters, Inc. Gabriela Gonzalez Araiza, Lehotsky Keller LLP, Washington, DC, for Amicus National Retail Federation.
Scott J. Ferrell, Victoria C. Knowles, Pacific Trial Attorneys APC, Newport Beach, CA, for Miguel Licea. Paul M. Kakuske, Pooja Shah, Joel D. Siegel, Dentons U.S. LLP, Los Angeles, CA, for American Eagle Outfitters, Inc. Gabriela Gonzalez Araiza, Lehotsky Keller LLP, Washington, DC, for Amicus National Retail Federation. Proceedings (In Chambers): ORDER GRANTING MOTION TO DISMISS CASE [18] MICHAEL W. FITZGERALD, United States District Judge
Before the Court is Defendant American Eagle Outfitters, Inc.'s Motion to Dismiss Case ("the Motion"), filed on January 3, 2023. (Docket No. 18). The National Retail Federation filed an Amicus Curiae Brief ("NRF Amicus Brief") in support of the Motion on December 27, 2022. (Docket No. 23). Plaintiff Miguel Licea filed an Opposition on January 23, 2023. (Docket No. 24). Defendant filed a Reply on January 30, 2023. (Docket No. 25).
The Court read and considered the papers on the Motion and held a hearing on February 13, 2023.
The Motion is GRANTED with leave to amend . Plaintiff's claim under the first clause of section 631(a) fails because the first clause does not apply to communications made through the computer functions of a smart phone. Plaintiff's claim under the second clause of section 631(a) fails because Plaintiff's allegations suggest that Defendant is entitled to the party exemption and because Plaintiff does not adequately allege facts to suggest that his conversation was intercepted in transit.
Defendant's Request for Judicial Notice is DENIED as moot as the Court did not rely on it in reaching its holding.
I. BACKGROUND
On September 28, 2022, Plaintiff Miguel Licea filed a class action complaint on behalf of a putative statewide class, alleging violations the California Invasion of Privacy Act ("CIPA"). (Complaint (Docket No. 1) at 2). On December 19, 2022, Plaintiff filed a First Amended Complaint ("FAC") alleging that Defendant covertly wiretaps the personal conversations of everyone who uses the chat feature at www.ae.com ("the Website") and allows at least one third-party to eavesdrop on such communications in real time and during transmission for financial gain. (FAC (Docket No. 16) at 2).
Plaintiff alleges that Defendant American Eagle Outfitters, Inc. is a Delaware corporation with a principal place of business in Pennsylvania that owns, operates, and/or controls the Website. (FAC ¶ 5).
Plaintiff is consumer privacy advocate with dual motivations for initiating conversations with Defendant. First, Plaintiff alleges that he genuinely interested in learning more about the goods and services offered by Defendant. Second, Plaintiff alleges that he is a "tester" who works to ensure that companies abide by the privacy obligations imposed by California law. (Id. ¶ 16).
Plaintiff alleges that Defendant has covertly embedded code into its chat feature that automatically intercepts, records, and creates transcripts of all such conversations. (Id. ¶ 12). Plaintiff alleges that Defendant allows at least one independent third-party vendor (on information and belief, Salesforce and/or Webex) to secretly intercept (during transmission and in real time), eavesdrop upon, and store transcripts of Defendant's chat communications with unsuspecting website visitors - even when such conversations are private and deeply personal. (Id.). Plaintiff alleges that Defendant neither informs visitors of this conduct nor obtains their consent. (Id. ¶ 13).
Plaintiff alleges that given the nature of Defendant's business, visitors often share highly sensitive personal data with Defendant via the Website chat feature. (Id. ¶ 14).
Plaintiff alleges that he visited Defendant's Website and had a brief conversation utilizing the chat feature on Defendant's Website. (Id. ¶ 18). Plaintiff alleges that Defendant did not inform him or Class Members that Defendant was secretly recording their conversations or allowing, aiding, and abetting a third party to intercept and eavesdrop on them in real time. (Id. ¶ 20).
Plaintiff seeks relief on behalf of "[a]ll persons within California who: (1) visited Defendant's Website and communicated through the chat feature on Defendant's Website, and (2) whose electronic communications were recorded, stored, and/or shared by Defendant without prior express consent within the statute of limitations period. (Id. ¶ 22).
Plaintiff asserts one cause of action for violation of the California Invasion of Privacy Act ("CIPA") under California Penal Code section 631. (Id. ¶¶ 28-33). Plaintiff prays for relief in the form of class certification, declaratory relief, injunctive relief, statutory and punitive damages, prejudgment interest, and costs and attorneys' fees. (Id. at 8-9).
II. LEGAL STANDARD
In ruling on a motion under Rule 12(b)(6), the Court follows Bell Atlantic v. Twombly, 550 U.S. 544, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007), Ashcroft v. Iqbal, 556 U.S. 662, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009), and their Ninth Circuit progeny.
"Dismissal under Rule 12(b)(6) is proper when the complaint either (1) lacks a cognizable legal theory or (2) fails to allege sufficient facts to support a cognizable legal theory." Somers v. Apple, Inc., 729 F.3d 953, 959 (9th Cir. 2013). "To survive a motion to dismiss, a complaint must contain sufficient factual matter . . . to 'state a claim for relief that is plausible on its face.' " Iqbal, 556 U.S. at 678, 129 S.Ct. 1937 (quoting Twombly, 550 U.S. at 570, 127 S.Ct. 1955). The Court must disregard allegations that are legal conclusions, even when disguised as facts. See id. at 681, 129 S.Ct. 1937 ("It is the conclusory nature of respondent's allegations, rather than their extravagantly fanciful nature, that disentitles them to the presumption of truth."); Eclectic Props. E., LLC v. Marcus & Millichap Co., 751 F.3d 990, 996 (9th Cir. 2014). "Although 'a well-pleaded complaint may proceed even if it strikes a savvy judge that actual proof is improbable,' plaintiffs must include sufficient 'factual enhancement' to cross 'the line between possibility and plausibility.' " Eclectic Props., 751 F.3d at 995 (quoting Twombly, 550 U.S. at 556-57, 127 S.Ct. 1955) (internal citations omitted).
The Court must then determine whether, based on the allegations that remain and all reasonable inferences that may be drawn therefrom, the complaint alleges a plausible claim for relief. See Iqbal, 556 U.S. at 679, 129 S.Ct. 1937; Cafasso, U.S. ex rel. v. Gen. Dynamics C4 Sys., Inc., 637 F.3d 1047, 1054 (9th Cir. 2011). "Determining whether a complaint states a plausible claim for relief is 'a context-specific task that requires the reviewing court to draw on its judicial experience and common sense.' " Ebner v. Fresh, Inc., 838 F.3d 958, 963 (9th Cir. 2016) (quoting Iqbal, 556 U.S. at 679, 129 S.Ct. 1937).
III. DISCUSSION
A. Standing
As an initial matter, a complaint must include "a short and plain statement of the grounds for the court's jurisdiction . . . ." Fed. R. Civ. P. 8(a)(1). "It is to be presumed that a cause lies outside [of federal courts'] limited jurisdiction, and the burden of establishing the contrary rests upon the party asserting jurisdiction." Kokkonen v. Guardian Life Ins. Co. of Am., 511 U.S. 375, 377, 114 S.Ct. 1673, 128 L.Ed.2d 391 (1994) (citations omitted). Courts have an independent obligation to determine whether subject-matter jurisdiction exists, even in the absence of a challenge from any party. Arbaugh v. Y & H Corp., 546 U.S. 500, 514, 126 S.Ct. 1235, 163 L.Ed.2d 1097 (2006). "If the court determines at any time that it lacks subject-matter jurisdiction, the court must dismiss the action." Fed. R. Civ. P. 12(h)(3).
Article III of the Constitution requires courts to adjudicate only actual cases or controversies. U.S. Const. art. III, § 2, cl. 1. "A suit brought by a plaintiff without Article III standing is not a 'case or controversy,' and an Article III federal court therefore lacks subject matter jurisdiction over the suit." Cetacean Cmty. v. Bush, 386 F.3d 1169, 1174 (9th Cir. 2004). "Standing is determined by the facts that exist at the time the complaint is filed." Clark v. City of Lakewood, 259 F.3d 996, 1006 (9th Cir. 2001). In order to establish Article III standing, "a plaintiff must show (i) that he suffered an injury in fact that is concrete, particularized, and actual or imminent; (ii) that the injury was likely caused by the defendant; and (iii) that the injury would likely be redressed by judicial relief." TransUnion LLC v. Ramirez, — U.S. —, 141 S. Ct. 2190, 2203, 210 L.Ed.2d 568 (2021) (citing Lujan v. Defs. of Wildlife, 504 U.S. 555, 560-61, 112 S.Ct. 2130, 119 L.Ed.2d 351, (1992)). "[A] plaintiff must demonstrate standing separately for each form of relief sought." Friends of the Earth, Inc. v. Laidlaw Environ. Servs. (TOC), Inc., 528 U.S. 167, 185, 120 S.Ct. 693, 145 L.Ed.2d 610 (2000) (internal citations omitted).
The National Retail Federation ("NRF") argues that Plaintiff has failed to allege any injury sufficient to show Article III standing because they make no allegations as to any information exchanged through the website chat, including whether, how, and why that information was sensitive, or why Plaintiff was injured by sending that information to the Defendant. (NRF Amicus Brief at 2-3 (citing Rahman v. Marriott Int'l, Inc., No. SA CV 20-00654-DOC-KES, 2021 WL 346421, at *2 (C.D. Cal. Jan. 12, 2021) ("information obtained lack[ed] the degree of sensitivity required by the Ninth Circuit to establish injury in fact"); United States v. Heckenkamp, 482 F.3d 1142, 1146 (9th Cir. 2007) ("A person's reasonable expectation of privacy may be diminished in transmissions over the Internet or e-mail that have already arrived at the recipient." (internal marks omitted)).
However, "violations of [p]laintiffs' statutory rights under CIPA, [even] without more, constitute injury in fact because instead of a bare technical violation of a statute, . . . a CIPA violation involves . . . a violation of privacy rights.' " Osgood v. Main Streat Mktg., LLC, Case. No. 16-cv-2415-GPC (BGS), 2017 WL 131829, at *7 (S.D. Cal. Jan. 13, 2017) (internal citation omitted); see also Raffin v. Medicredit, Inc., No. 15-cv-4912-GHK-PJW, 2016 WL 7743504, at *3 (C D. Cal. Dec. 19, 2016) ("Following Spokeo, district courts in the Ninth Circuit consistently have concluded that, to satisfy injury in fact, a plaintiff in a CIPA action need not allege actual harm beyond the invasion of the private right conferred by the statute."); Matera v. Google Inc., Case No. 15-cv-04062-LHK, 2016 WL 5339806, at *11 (N.D. Cal. Sept. 23, 2016) (denying motion to dismiss holding that alleged violations of Plaintiff's statutory rights under CIPA constitute concrete injury in fact under Spokeo). Plaintiff here alleges that "Defendant did not inform him or Class Members that Defendant was secretly recording their conversations or allowing, aiding, and abetting a third party to intercept and eavesdrop on them in real time." (FAC ¶ 18). This sufficiently alleges a CIPA claim.
The NRF additionally points out that any alleged harm stems from Plaintiff's purported lack of knowledge that chat messages were being read and stored, rather than immediately deleted. (NRF Amicus Brief at 3). The NRF contends that because Defendant's websites have a privacy policy that discloses how it uses the data customers send to it, Plaintiff either read the disclosures and suffered no injury or he deliberately avoided the privacy policy, in which case the alleged privacy harms were self-inflicted. (NRF Amicus Brief at 3 (citing see also Mendia v. Garcia, 768 F.3d 1009, 1013 n.1 (9th Cir. 2014) (self-inflicted injury cannot confer standing)).
Neither the NRF or Defendant has provided evidence that Defendant had any a privacy policy in place or that it was conspicuously placed. Absent evidence of Plaintiff's avoidance of such a privacy policy, the Court finds it has not been divested of subject matter jurisdiction over Plaintiff's FAC. Defendant is welcome to raise a similar jurisdictional argument in future motions.
Accordingly, the Court determines that Plaintiff has established Article III standing.
B. Statute of Limitations
The NRF additionally argues that Plaintiff's claims are barred by California's statute of limitations. (NRF Amicus Brief at 5-6 (citing Cal. Code Civ. Proc. § 340(a) (one-year statute of limitations for claims brought under the CIPA)).
The statute of limitations is an affirmative defense, Fed. R. Civ. P. 8(c), and complaints do not ordinarily need to allege the non-availability of affirmative defenses. United States v. Northern Trust Co., 372 F.3d 886, 888 (7th Cir. 2004). Nonetheless, "[a] claim may be dismissed under Rule 12(b)(6) on the ground that it is barred by the applicable statute of limitations only when 'the running of the statute is apparent on the face of the complaint.' " Von Saher v. Norton Simon Museum of Art at Pasadena, 592 F.3d 954, 969 (9th Cir. 2010) (quoting Huynh v. Chase Manhattan Bank, 465 F.3d 992, 997 (9th Cir. 2006)).
It is premature to decide a statute of limitations defense because the Complaint does not present a facial statute of limitations issue. See Jablon v. Dean Witter & Co., 614 F.2d 677, 682 (9th Cir. 1980). It is not apparent from the face of the FAC that the alleged CIPA violation occurred over a year before Plaintiff filed his complaint. Moreover, courts in this circuit have refused to dismiss claims where plaintiffs adequately provide notice of the general time-period at issue. See e.g., Baldain v. Am. Home Mortg. Servicing, Inc., No. 09-cv-0931-LKK (GGH), 2010 WL 56143, *4-5 (E.D. Cal. Jan. 5, 2010). Here, the allegations suggest that Plaintiff visited Defendant's website "within the statute of limitations period." (FAC ¶ 18). Reading the FAC with the required liberality, it does not appear that Plaintiff alleged use of Defendant's chat function occurred over a year before the Complaint was filed. At a minimum, while the allegations do not conclusively demonstrate the applicability or non-applicability of the statute of limitations, Plaintiff's allegations provide sufficient notice to Defendant that the statute of limitations may be at issue, and thereby allow Defendant to formulate an answer. See Baldain, 2010 WL 56143 at *4-5; see also Famolare, Inc. v. Edison Bros. Stores, Inc., 525 F. Supp. 940, 949 (E.D. Cal. 1981) (dates should be obtained through the discovery process).
C. Section 631(a) Claims
1. Plaintiff fails to plead a claim under the first clause of section 631(a).
The first clause of section 631(a) provides that it is punishable by fine or imprisonment for "any person who by means of any machine, instrument, or contrivance, or in any other manner, intentionally taps, or makes any unauthorized connection, whether physically, electrically, acoustically, inductively, or otherwise, with any telegraph or telephone wire, line, cable, or instrument, including the wire, line, cable, or instrument of any internal telephonic communication system[.]" (emphasis added).
Courts have consistently interpreted this clause as applying only to communications over telephones and not through the internet. See Williams v. What If Holdings, LLC, No. C 22-03780 WHA, 2022 WL 17869275, at *2 (N.D. Cal. Dec. 22, 2022) (determining "the first clause of Section 631(a) concerns telephonic wiretapping specifically, which does not apply to the context of the internet"); In re Google Assistant Priv. Litig., 457 F.Supp.3d 797, 825-26 (N.D. Cal. 2020) (reasoning that the first clause "expressly requires that the unauthorized connection be made with any telegraph or telephone wire, line, cable, or instrument.") (internal quotations omitted).
Plaintiff argues that In re Google Inc. stands for the proposition that the first clause of section 631(a) applies to emails due to "California courts' approach [of] updating obsolete statutes in light of emerging technologies." (Opposition at 17 (citing 2013 WL 5423918, at *21 (N.D. Cal. Sept. 26, 2013))). Plaintiff urges the Court to broadly interpret the first clause of section 631(a) as applying to smart phones.
This argument has been uniformly rejected by numerous courts, including the In re Google Inc. court itself which was only applying the second clause of section 631(a) to email. Id. at *20. The In re Google Inc. court found the second clause applied to new technologies over the internet by comparing the inclusion of the limiting language "telegraphic or telephone" in the first clause to the absence of such limiting language in the second clause. Id. The court found that this construction meant the California "Legislature intended the two clauses to apply to different types of communications." Id. Other courts have similarly interpreted the first clause as applying solely to telephonic communications. See Mastel v. Miniclip SA, 549 F.Supp.3d 1129, 1135 (E.D. Cal. 2021) ("The court will therefore follow the overwhelming weight of authority requiring a plaintiff to plausibly allege that a defendant intentionally tapped or made an unauthorized connection with a telegraph or telephone wire, line, cable, or instrument to state a claim under § 631(a)'s first clause.") (internal quotations omitted); Matera v. Google Inc., 2016 WL 8200619, at *18 (N.D. Cal. Aug. 12, 2016) (affirming interpretation of the first clause to solely telephonic communication); In re Google Assistant Priv. Litig., 457 F. Supp. 3d at 825-26; Williams v. What If Holdings, LLC, No. C 22-03780 WHA, 2022 WL 17869275, at *2 (N.D. Cal. Dec. 22, 2022). Here, the Court similarly determines that the first clause of Section 631(a) does not apply to communications over the internet.
Plaintiff argues that a smart phone falls within the definition of telephone and utilizes "cellular towers, computer servers, and other electronic equipment comprised of 'wire[s], line[s], cable[s], or instrument[s]' to transmit both voice calls and computer data to their intended recipients." (Opposition at 17). However, a similar argument regarding the definition of an iPhone was rejected in Mastel v. Miniclip. 549 F. Supp. 3d at 1135. In Mastel, the court determined that "[a]lthough iPhones contain the word "phone" in their name, and have the capability of performing telephonic functions, they are, in reality, small computers." Id. Here, the Court similarly declines to interpret the first clause as applying to smart phones which are wireless, despite their use of communication technologies which then are comprised of "wire[s], line[s], cable[s], or instrument[s]."
Plain interpretation and case law dictate that Plaintiff's preferred interpretation is not consistent with the language of the first clause describing "telephone wires, lines, or cables" which refers to specific technology. Cal. Penal Code § 631 (emphasis added); Herrera v. Zumiez, Inc., 953 F.3d 1063, 1071 (9th Cir. 2020) (California law of statutory interpretation "begins with the words themselves . . . because the words generally provide the most reliable indicator of [legislative] intent").
Plaintiff argues that the California Legislature's failure to clarify that section 631(a) only applies to landline telephones supports an inference of "acquiescence in a broad interpretation of the 'telephone' term" to include smart phones and Wi-Fi-enabled devices. (Opposition at 19). The Court is not persuaded that there has been any such acquiescence. The fact that the Legislature has had an opportunity to amend section 631(a) to take into account privacy issues raised by new technologies like internet messaging is indicative of its intent not to expand protections. See Smith v. LoanMe, Inc., 11 Cal. 5th 183, 191, 276 Cal.Rptr.3d 746, 483 P.3d 869 (2021) (finding the Legislature's intent was evidenced through their amendments in 1985, 1990, and 1992 to the statute "to take account of privacy issues raised by the increased use of cellular and cordless telephones"). Here, the Legislature amended the California Invasion of Privacy Act many times since it was enacted, and has not redefined section 631 to apply to internet communications. Cal. Penal Code §§ 632 (amended 2016), 633 (amended 2018), 633.5 (amended 2017), 633.6 (same), 633.8 (amended 2011), 636 (same), 637 (same), 637.2 (amended 2016). The California Legislature amended section 631 itself in 1988, 1992, 2011 and 2022. Cal. Penal Code § 631 (amended 2022, eff. Jan. 1, 2023). The Legislature did not add protections for internet communications to the first clause of 631(a) in either 2011 or 2022. The Court therefore rejects Plaintiff's argument that because the Legislature had decades to clarify that 'telephone' was to be interpreted narrowly this warrants a reading that telephone applies to all telephones which then includes internet technologies. Courts have consistently favored a narrow reading of the first clause which the Legislature could have rejected through clarifying amendment. Plaintiff is incorrect that the Legislature is required to define terms specifically to exclude the inclusion of new technologies as time passes. The Legislature's narrow construction of the statute is evidence of its intent and the Court declines to expand protections and usurp the Legislature based on Plaintiff's speculation.
Because the Court determines that the first clause of section 631(a) does not apply to communications with a smart phone or Wi-Fi-enabled laptop, it need not address the issues of the direct party exemption or consent in relation to the first clause of section 631(a).
2. Plaintiff fails to plead a viable claim under the second clause of section 631(a).
a. Consent
For purposes of Rule 12(b)(6), Plaintiff sufficiently pleads that he did not consent to the recording of their conversations with Defendant. See Yoon v. Lululemon USA, Inc., 549 F. Supp. 3d 1073 (C.D. Cal. 2021) (finding that plaintiffs pleading that stated she did not consent to recording was sufficiently pled to overcome a 12(b)(6) motion); Javier v. Assurance IQ, LLC, No. 21-16351, 2022 WL 1744107 (9th Cir. 2022) (finding that the plaintiff met his pleading burden where he alleged he did not give express prior consent).
b. Party Exemption
Section 631 contains an exemption from liability for a person who was a "party" to a communication. In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 607 (9th Cir. 2020) (citing Warden v. Kahn, 99 Cal. App. 3d 805, 160 Cal. Rptr. 471, 475 (1979) ("[S]ection 631 . . . has been held to apply only to eavesdropping by a third party and not to recording by a participant to a conversation.").
California law is well settled that a party to the communication is not liable for recording their own conversation under section 631(a), however, a party may be held vicariously liable under the fourth clause of the section where it "aids, agrees with, employs, or conspires with any person or persons to unlawfully do, or permit, or cause to be done any of the acts or things" prohibited in the previous three clauses. Cal. Penal Code § 631.
In Rogers v. Ulrich, the defendant used a tape-recording device to record a conversation with the plaintiff without the plaintiff's knowledge or consent. 52 Cal. App. 3d 894, 897, 125 Cal.Rptr. 306, Cal. Rptr 306 (1975). The Court of Appeal found that the second clause of section 631(a) did not apply to participant recording. In looking at the Legislature's intent in passing CIPA, the court noted "it speaks of preventing eavesdropping and other invasions of privacy, thus suggesting that participant recording was not meant to be included." Id. at 899, 125 Cal.Rptr. 306. The court reasoned that "it is never a secret to one party to a conversation that the other party is listening to the conversation; only a third party can listen secretly to a private conversation." Id.
Federal courts have routinely affirmed the holding in Rogers that a party cannot eavesdrop on its own conversation. Saleh v. Nike, 562 F.Supp.3d 503, 516 (C.D. Cal. 2021) ("Section 631(a) contains an exemption from liability for a person who is a "party" to a communication, where a party to a communication cannot be held to wiretap another party to the same communication"); Javier v. Assurance IQ, LLC, No. 20-CV-02860-CRB, 2023 WL 114225 at *4 (N.D. Cal. Jan. 5, 2023) (affirming that a party to a conversation cannot be held liable as an eavesdropper); Graham v. Noom, 533 F.Supp.3d 823, 831 (N.D. Cal. 2021) ("a party to a communication can record it (and is not eavesdropping when it does)"); Revitch v. New Moosejaw, LLC, No. 18-CV-06827-VC, 2019 WL 5485330 at *2 (N.D. Cal. Oct. 23, 2019) (noting that a defendant would not have violated section 631 if it had made a transcript of the conversation with plaintiff and then transmitted a copy to a third party because "sharing a record is not eavesdropping"); Williams v. What If Holdings, LLC, No. C 22-03780 WHA, 2022 WL 17869275 at *2 (N.D. Cal. Dec. 22, 2022) ("Parties to a conversation cannot eavesdrop on their own conversation . . . . [defendant]'s liability is therefore based entirely on whether [the third party] violated Section 631(a)").
It is clear that Defendant was a party to the purported conversation with Plaintiff and, as such, cannot be held liable under the second clause of section 631(a). However, Defendant can be held vicariously liable under the fourth clause if it assists a third party in violating the second clause of section 631(a).
The Court must consider the "party exemption . . . in the technical context of this case." See In re Facebook, Inc. Internet Tracking Litig., 956 F.3d at 607. In Rogers v. Ulrich, the party to the conversation who used a tape recorder to record the conversation did not violate section 631(a) under the party exemption. However, in Ribas v. Clark, where a defendant allowed her friend to listen in on a conversation with herself and her husband, the court found the friend's actions to be prohibited by CIPA which raised liability for the defendant. 38 Cal. 3d 355, 362, 212 Cal. Rptr. 143, 696 P.2d 637 (1985). The Ribas court determined that "a substantial distinction has been recognized between the second-hand repetition of the contents of a conversation and its simultaneous dissemination to an unannounced second auditor, whether that auditor be a person or mechanical device." Id. at 360-61, 212 Cal. Rptr. 143, 696 P.2d 637.
Following the Rogers and Ribas distinction, Federal and California courts have been instructed to analyze whether the technology (or actor) behaves more akin to a tape recorder utilized by the party to the conversation or as an eavesdropper "press[ing] up against a door to listen to a conversation." Revitch, 2019 WL 5485330 at *2. While technology has developed over the years, the basic inquiry remains the same. In the software context, the court in Javier stated that "whether software providers . . . are third parties under California's eavesdropping statute, or mere tools used by websites, goes to the heart of the privacy concerns articulated in [s]ection 631 and California cases interpreting it." 2023 WL 114225 at *4.
Here, Plaintiff alleges that "Defendant both wiretaps the conversations of all website visitors and allows a third party to eavesdrop on the conversations in real time during transmission." (FAC ¶ 9). Plaintiff alleges that "[t]o enable the wiretapping, Defendant has covertly embedded code into its chat feature that automatically intercepts, records and creates transcripts of all such conversations." (Id. ¶ 12). Plaintiff additionally asserts that "[t]o enable the eavesdropping, Defendant allows at least one independent third-party vendor (on information and belief, Salesforce and/or Webex) to secretly intercept (during transmission and in real time), eavesdrop upon, and store transcripts of Defendant's chat communications with unsuspecting website visitors." (Id.). Plaintiff alleges that Defendant allows a third party to eavesdrop on the conversations in real time under guise of "data analytics." (Id. ¶ 14).
Courts have determined that software like the alleged code employed by Defendant which intercepts in real time and stores transcripts is more akin to a tape recorder like the one used in Rogers than a friend against the door like in Ribas. For instance, in Williams, the court determined the plaintiff's limited allegations that the defendant "deployed [the third party]'s recording software only on [defendant]'s websites and that the recordings were stored and accessed on [third party]'s servers" suggested that the third party's software was merely a tool used by defendant and did not suggest there was an independent third party hired to eavesdrop. 2022 WL 17869275 at *3. The court reasoned that there were no facts to suggest independent use of the allegedly collected data by the third party and that the "recordation is routine documentation and therefore clerical in nature which is qualitatively different than data mining." Id.
The allegations here of intercepting, eavesdropping, and creating transcripts on chat communications in real time in order for "data analytics" appear to involve two separate issues. First, there is the allegation of what the third party does during the conversation and second, what the third party does with the recorded transcripts after the conversation. During the conversation, when the third party was purportedly recording and storing the transcript, the third party appears to be operating like a tape recorder. When a party captures and stores data, courts have found that they operate like an extension of the defendant (i.e. a tape recorder). Williams, 2022 WL 17869275 at *4 ("the fact that [defendant] used software rather than a physical recording device for the same function does not mean that it aided and abetted wiretapping"); Graham v. Noom, Inc., 533 F. Supp. 3d at 833 (determining a third party software company was not liable where it captured and stored its client's information). This is what appears to be alleged here.
After the conversation, Plaintiff alleges that the "third party publicly boasts of its ability to harvest valuable data from such communications for the benefit of its clients," and "[d]efendant and third parties then harvest data . . . for financial gain." (FAC ¶ 9, 12) (emphasis added). The alleged use of the data by the third party therefore does not appear to be independent. The pleadings, taken as true at this stage, nowhere suggest that the third party has the ability to use the information independently. The bare allegations only suggest that the third party analyzed or used the data on behalf of or in tangent with Defendant.
These allegations are materially different from those against the defendants in In re Facebook, Inc. and Revitch where the third party captured data and then used the data for its own benefit by reselling the aggregated data. See In re Facebook, 956 F.3d at 601; Revitch, 2019 WL 5485330 at *2 (N.D. Cal. Oct. 23, 2019). instead, Plaintiffs' allegations suggest a situation more akin to Graham, where the court found that a third party was not an eavesdropper where their software collected clients' data, kept the data on its servers, and allowed clients to analyze their data. Graham v. Noom, Inc., 533 F. Supp. 3d at 833 ("unlike NaviStone's and Facebook's aggregation of data for resale, there are no allegations here that [the third party] intercepted and used the data itself."). Because Plaintiff's allegations suggest that the third party is more similar to the software provider in Graham than in In re Facebook or Revitch, Graham holds more persuasive value.
Accordingly, Defendant is entitled to the party exemption applied to the second clause of section 631(a), as Plaintiff fails to plead that the alleged third party acted independently from Defendant as to constitute an unannounced auditor under California law.
c. Interception
The second clause of section 631(a) requires that messages be intercepted while in transit. See Mastel v. Miniclip SA, 549 F. Supp. 3d at 1135 ("the second clause only imputes liability when the defendant reads, or attempts to read, a communication that is in transit or passing over any wire, line, or cable, or is being sent from, or received at any place within California") (internal quotations omitted) (emphasis in original). Because the federal Wiretap Act (18 U.S.C. § 2511(1)(a)) also requires messages be intercepted while in transit, courts have looked at cases analyzing the Wiretap Act as informative of section 631(a). See Konop v. Hawaiian Airlines, Inc., 302 F.3d 868, 876 (9th Cir. 2002) (interpreting the in transit language of the Wiretap Act as requiring interception during the communication's transmission and not during electronic storage); NovelPoster v. Javitch Canfield Grp., 140 F.Supp.3d 938, 954 (N.D. Cal. 2014) (applying Konop's analysis of the Wiretap Act to a CIPA claim). Courts in the Ninth Circuit have interpreted the in transit requirement narrowly. See Bunnell v. Motion Picture Ass'n of Am., 567 F.Supp.2d 1148, 1152 (C.D. Cal. 2007) ("Even if the storage phase is transitory and lasts only a few seconds, it is still considered electronic storage").
Plaintiff urges this Court to follow Campbell v. Facebook Inc. which they quote for the proposition that "the complaint's allegation that users' messages were intercepted in transit is to be taken as true at this stage of the case." (Opposition at 30 (citing 77 F. Supp. 3d 836, 848 (N.D. Cal. 2014))). However, the Campbell plaintiffs alleged far more details about the purported interception than Plaintiffs do here. Id. at 839 ("[plaintiffs] allege that Facebook scans the content of their private messages, and if there is a link to a web page contained in that message, Facebook treats it as a "like" of the page, and increases the page's "like" counter by one"). This allegation contains sufficient detail to support an inference of in transit interception, whereas Plaintiff's bare allegations that "the third party . . . secretly intercept[s] (during transmission and in real time)" is conclusory and does not allege specific facts as to how or when the interception takes place, which has been found to fall short of stating a plausible claim under section 631(a).
Courts have found that similarly conclusory allegations fail to support a claim under section 631(a). See Rosenow v. Facebook, Inc., No. 19-CV-1297-WQH-MDD, 2020 WL 1984062 (S.D. Cal. Apr. 27, 2020) (dismissing plaintiffs' Wiretap Act claims for failing to allege sufficient facts about interception). Plaintiff attempts to distinguish Rosenow on the grounds that the Rosenow plaintiff "made a judicial admission" that suggested the communications were accessed in storage. (Opposition at 31). The Court does not agree with Plaintiff's argument. The Rosenow plaintiff alleged that "[defendant] knowingly used an algorithm to intercept and scan [p]laintiff's incoming chat messages for content during transit and before placing them in electronic storage." Id. at *7. The allegation in Rosenow contained greater detail about the purported interception than Plaintiff includes in his FAC. And still, the Rosenow court held that "[plaintiff] fails to allege facts that support an inference that [defendant] 'captured or redirected' the contents of [plaintiff]'s communications while in transit." Id.
Similarly, in Rodriguez v. Google LLC, the court found that the plaintiff failed to allege sufficient allegations where "[p]laintiffs reference an 'open line of communication,' and 'real-time ad bidding' in support of [their] theory, but neither describes how Google actually intercepts data in real time." No. 20-CV-04688-RS, 2022 WL 214552 at *1 (N.D. Cal. Jan. 25, 2022). The court found that "using the word 'intercept' repeatedly is simply not enough without the addition of specific facts that make it plausible [defendant] is intercepting their data in transit." Plaintiff similarly does not allege specific facts in regard to the third party's purported interception. Plaintiff alleges that one third party vendor to "secretly intercept, eavesdrop upon, and store transcripts of Defendant's chat communications." (FAC ¶ 12). Bare allegations of recording and creating transcripts do not specifically allege that Plaintiffs' messages were intercepted while in transit. The timeline of the automatic recording and transcription is unclear, as it could occur during transit or it can take place after receipt of the message in Defendant's inbox. Plaintiffs do not sufficiently allege how the messages were intercepted, and thereby do not provide fair notice to Defendant of their alleged violation. See In re Vizio, Inc., Consumer Priv. Litig., 238 F. Supp. 3d 1204 (C.D. Cal. 2017) ("While [p]laintiffs need not prove their theory of interception on a motion to dismiss, [p]laintiffs must provide fair notice to [d]efendants of when they believe [defendant] intercepts their communication. A written explanation of [p]laintiffs' theory is . . . important"). Here, Plaintiff does not allege sufficient facts as to how and when the third party receives the communications. Plaintiffs must provide more than conclusory allegations that messages were intercepted "during transmission and in real time."
Plaintiffs raise multiple "Session Replay" cases as analogous to their pleading and as support for their interception argument. (Opposition at 27). However, Plaintiffs do not plead that their interactions with Defendant used "Session Replay" technology, only that there was code that allowed interception, eavesdropping, and transcribing. (FAC ¶ 12). "Session Replay" technology "embeds snippets of code that watch and record, in real time, 'a visitor's every move on a website.' " Saleh v. Nike, 562 F. Supp. 3d 503, 509 (C.D. Cal. 2021). "Session Replay" technology goes beyond monitoring of conversations and creating "transcripts" and instead collects and records all interactions with a website. Plaintiffs' pleadings do not allege this type or level of data collection and instead focus on "transcripts" from "communication with Defendant's chat feature. (FAC ¶¶ 8, 9, 11, 12, 14, 16, 18, 20, 22, 23). Plaintiff alleges that Defendant violated section 631(a) through recording a transcript of visitor's conversation and not the entirety of a visitor's interaction with Defendant's website. For this reason, the Court finds Plaintiffs' arguments regarding "Session Replay" and automatic routing software to be unpersuasive.
Plaintiff does not adequately plead that Defendant or the third party intercepted Plaintiffs' messages in transit.
Because Plaintiff's allegations suggest that Defendant is entitled to the party exemption and because Plaintiff does not adequately allege that their conversations were intercepted in transit, Plaintiff's claim under the second clause of section 631(a) fail.
Plaintiff may be able to amend the FAC to allege additional facts that suggest that the party exemption does not apply to Defendant and that Plaintiff's communications were intercepted in transit.
Accordingly, the Motion is GRANTED with leave to amend. Plaintiff is granted one final opportunity to amend his claim. Plaintiff must file any Second Amended Complaint no later than April 3, 2023. Failure to file a Second Amended Complaint will result in dismissal of the action with prejudice.
IT IS SO ORDERED.