Opinion
2:23-cv-00058-BLW
10-02-2023
CINDY MURPHY, SCOTT CONNELLY, JENNY WATSON, and ADRIANA INGRAM, individually and on behalf of all others similarly situated, Plaintiffs, v. KOCHAVA INC., Defendant.
MEMORANDUM DECISION AND ORDER
B. LYNN WINMILL, U.S. DISTRICT COURT JUDGE
INTRODUCTION
In this putative class action, mobile device users sue Kochava, Inc. for selling their geolocation data in a format that could enable third parties to track them “to and from sensitive locations.” Am. Compl. ¶ 1, Dkt. 13. Kochava asks the Court to dismiss Plaintiffs' complaint for lack of standing and failure to state a plausible claim. The Court will grant the motion, in part, as to Plaintiffs' Washington Consumer Protection Act (WCPA) claim, Unfair Competition Law (UCL) claim, and requests for injunctive relief. The Court will deny the motion as to all other claims.
At this early stage in the litigation, the Court must assume the truth of Plaintiffs' factual allegations. This does not mean, however, that the Court believes those allegations. Rather, the Court makes no determination whatever as to the truth or falsity of the factual assertions in Plaintiffs' Amended Complaint (Dkt. 13).
Kochava, Inc. is a data analytics company that offers various digital marketing and analytics services. One of its services involves aggregating and selling data collected from billions of mobile devices across the world. Among other things, Kochava's data includes timestamped location coordinates and unique device identifiers which, viewed together, reveal the past movements of mobile devices.
1. Geolocation Data
Geolocation data is a broad term for information about a mobile device's geographic location. It may reveal where a device currently is, as with Global Position Systems (GPS), or it may only reveal where a device has been in the past. Real-time and historical geolocation data are used by commercial and governmental entities in many ways. Familiar examples include the use by emergency dispatch to track 9-1-1 callers and the use by cellphone applications that provide turn-by-turn driving directions and traffic alerts. A less visible but equally ubiquitous use of geolocation data is by data analytics companies who analyze consumer trends for the purpose of developing targeted marketing strategies.
Kochava is one such data analytics company. It obtains geolocation data from third-party data brokers, such as cellphone application developers, who collect data with consent directly from mobile device users. Kochava then aggregates the data in its proprietary data bank which its paying customers can access. Kochava's data bank contains data from “billions of devices globally” and includes around ninety-four billion coordinates per month, from thirty-five million daily active users, with each device generating an average of over ninety data points per day. Am. Compl. ¶ 15, Dkt. 13. That means the location coordinates in the data bank record where each mobile device has been approximately every fifteen minutes.
2. Mobile Advertising IDs (“MAIDs”)
Mobile Advertising IDs (MAIDs) are unique alphanumeric names that operating systems, such as IOS and Android, assign to mobile devices. Acting as virtual fingerprints, MAIDs are also called “unique persistent identifiers” because they remain unchanged unless proactively reset by device users. Id. ¶ 14. In the context of data analytics, MAIDs are used to link series of otherwise unconnected data points, such as geolocation coordinates, and, hence, reveal the movements of particular devices throughout time. By associating data points with MAIDs, analytics companies can identify patterns among specific devices, group devices into categories, and develop targeted marketing campaigns based on that information.
According to Plaintiffs, each set of location coordinates in Kochava's data bank is paired with a MAID. This linking of coordinates to MAIDs, they claim, enables Kochava's customers to plot the coordinates on a map and trace a particular device's movements, and in doing so, to associate each set of coordinates with a specific consumer. It is this practice of selling both geolocation coordinates and MAIDs that Plaintiffs challenge in this lawsuit.
3. The FTC's Lawsuit
The Federal Trade Commission (FTC) sued Kochava in August of 2022 over these same privacy concerns. FTC v. Kochava, Inc., Case No. 2:22-cv-00377-BLW. It sought a permanent injunction barring Kochava from continuing its sale of “precise location data associated with unique persistent identifiers that reveal consumers' visits to sensitive locations.” Compl. ¶ 36, Case No. 2:22-cv-00377-BLW. According to the FTC, by aggregating and selling both data points, together, without any technical controls to prevent tracking device users to sensitive locations, Kochava violates device users' privacy and exposes them to risks of secondary harms. In doing so, the FTC alleged, Kochava engages in an “unfair . . . act or practice” in violation of Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a)(1).
On May 4, 2023, this Court granted Kochava's motion to dismiss the FTC's complaint. FTC v. Kochava, Inc., Case No. 2:22-cv-00377-BLW, 2023 WL 3249809, at *13 (D. Idaho May 4, 2023). As the Court explained, the FTC had not adequately alleged the kind of “substantial injury to consumers” that the FTC Act prohibits. Id. at *9. But the Court gave the FTC an opportunity to fix its complaint. And, on June 5, 2023, the FTC filed an amended complaint under seal, Dkt. 26, Case No. 2:22-cv-00377-BLW, and Kochava responded by filing another motion to dismiss (Dkt. 33), along with a motion to seal the Amended Complaint and a motion for Rule 11 Sanctions (Dkt. 40). Those motions are currently ripe for decision and pending before the Court.
4. This Lawsuit
In February of 2023, Plaintiffs-two California citizens and two Washington citizens-filed this putative class action alleging unjust enrichment and violations of several state statutes: the Washington Consumer Protection Act (WCPA), the California Data Access and Fraud Act (CDAFA), and California's Unfair Competition Law (UCL). Compl., Dkt. 1. The factual allegations set forth in Plaintiffs' Amended Complaint (Dkt. 13) largely track with the allegations in the FTC's original complaint in Case No. 2:22-cv-00377-BLW.
Kochava previously filed a Motion to Dismiss (Dkt. 9) in March 2023, Plaintiffs filed an Amended Complaint (Dkt. 13) in April 2023, and Kochava filed its second Motion to Dismiss (Dkt. 14) shortly thereafter.
Instead of answering the Amended Complaint, Kochava filed a motion to dismiss for lack of subject-matter jurisdiction under Rule 12(b)(1) and failure to state a plausible claim for relief under Rule 12(b)(6). Dkt. 14. The motion has been fully briefed and is ripe for decision.
LEGAL STANDARD
Kochava seeks dismissal of Plaintiffs' Amended Complaint under Federal Rule of Civil Procedure 12(b)(1) and 12(b)(6). Under Rule 12(b)(1), a complaint must be dismissed if it fails to adequately allege subject-matter jurisdiction. And, to avoid dismissal under Rule 12(b)(6), a complaint must contain sufficient factual matter, accepted as true, to “state a claim to relief that is plausible on its face.” Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 570 (2007). Rule 12(b)(6) “does not impose a probability requirement at the pleading stage; it simply calls for enough facts to raise a reasonable expectation that discovery will reveal evidence” of the truth of the allegations. Id. at 556.
When a court grants a motion to dismiss, it should generally allow the plaintiff an opportunity to cure any deficiencies by filing an amended complaint, unless the complaint clearly “could not be saved by any amendment.” Chang v. Chen, 80 F.3d 1293, 1296 (9th Cir. 1996), overruled on other grounds by Odom v. Microsoft Corp., 486 F.3d 541 (9th Cir. 2007); see also FED. R. CIV. P. 15(a)(2).
ANALYSIS
Kochava raises jurisdictional and merit-based arguments for dismissal. First, Kochava argues that Plaintiffs have not alleged a sufficiently “concrete” and “particularized” injury to establish Article III standing. Second, Kochava challenges the sufficiency of Plaintiffs' allegations to state plausible claims for relief under each cause of action.
Ultimately, the Court's review renders mixed results: Plaintiffs have standing, but they have only stated plausible claims for unjust enrichment and violation of the California Data Access and Fraud Act (CDAFA). They have not, however, made sufficient factual allegations to proceed under the Washington Consumer Protection Act (WCPA), California's Unfair Competition Law (UCL), or for injunctive relief, so those claims will be dismissed with leave to amend.
1. Article III Standing
The judiciary plays a limited role in American democracy. Gill v. Whitford, 138 S.Ct. 1916, 1929 (2018). Under Article III of the United States Constitution, courts only have authority to decide actual “cases” and “controversies” brought by individuals and entities with genuine interests at stake. U.S. CONST. art. III, § 2. This principle is known as the doctrine of “standing.”
To have standing, a plaintiff must “show a personal stake in the outcome of the controversy.” Gill, 138 S.Ct. at 1929. Specifically, she must have suffered an (1) “injury in fact” that was (2) caused by the defendant's conduct and (3) is redressable through a favorable ruling. Lujan v. Defenders of Wildlife, 504 U.S. 555, 563 (1992). “[A]s the party invoking federal jurisdiction, [the plaintiff] bears the burden of establishing these elements.” Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016).
Injury in fact is the “[f]irst and foremost element” of standing. Dutta v. State Farm Mut. Auto. Ins. Co., 895 F.3d 1166, 1173 (9th Cir. 2018) (internal quotation omitted). The injury must be “concrete and particularized” and “actual or imminent, not conjectural or hypothetical.” Lujan, 504 U.S. at 560 (internal quotations omitted).
The Article III standing requirement is claim-specific. See Davis v. Fed. Election Comm'n, 554 U.S. 724, 734 (2008) (quoting Lewis v. Casey, 518 U.S. 343, 358 n.6 (1996)) (standing is not “dispensed in gross” and must be established for each claim and form of relief). Accordingly, where, as here, a plaintiff asserts multiple claims, she must have standing as to each separate claim.
A. Plaintiffs have standing to sue for unjust enrichment.
Plaintiffs claim that Kochava was unjustly enriched when it sold their “valuable personal location information” without their knowledge or consent. Am. Compl. ¶ 48, Dkt. 13. Kochava argues that Plaintiffs lack standing because their injury allegations are “generalized” and “conclusory.” The Court disagrees.
The deprivation of a legally protected interest in unjustly earned profits can constitute injury in fact for purposes of Article III standing. In In re Facebook, Inc. Internet Tracking Litigation, for example, the Ninth Circuit held that Facebook users had standing to sue Facebook for profits it allegedly earned by selling their browsing history data. 956 F.3d 589, 599-601 (9th Cir. 2020). In short, “[b]ecause California law recognize[d] a legal interest in unjustly earned profits,” the plaintiffs' claim of “entitlement to Facebook's profits from [their] personal data” was “sufficient to confer Article III standing.” Id.
Likewise, Plaintiffs here claim that Kochava earned profits by selling their “valuable personal location information” in an unjust manner-i.e., without their knowledge or consent-and that allowing Kochava to retain those profits would be “unjust and inequitable.” Am. Compl. ¶¶ 48, 50, Dkt. 13. Following the Ninth Circuit's reasoning in In re Facebook, the Court concludes that Plaintiffs have alleged a sufficient personal stake in the outcome of this dispute to establish Article III standing. 956 F.3d at 599-601.
Kochava attempts to distinguish In re Facebook, arguing that the plaintiffs' claims in that case were more detailed than those at-issue in this case. Here, Kochava argues, Plaintiffs' claim “rest[s] on generalized allegations about Kochava's data practices” rather than “specific facts showing that they were personally subjected to the challenged practices.” Def.'s Memo. in Supp. at 4-5, Dkt. 14-1. But, upon review of the Amended Complaint, Kochava's position does not ring true. Plaintiffs do specifically allege that Kochava sold their personal geolocation data and associated MAIDs without authorization, and that in doing so, Kochava unjustly earned profits. See Am. Compl. ¶¶ 7-10, Dkt. 13.
Ultimately, Plaintiffs allege a sufficiently concrete and particularized injury and have Article III's standing for their unjust enrichment claim.
B. Plaintiffs have Article III standing to sue under all three state statutes.
In addition to claiming unjust enrichment, Plaintiffs allege violations of one Washington statute and two California statutes. Kochava argues that Plaintiffs lack standing to bring those claims because their alleged injury-an invasion of privacy-is not “concrete and particularized.” Again, the Court disagrees.
First, even intangible harms may be “concrete” for purposes of Article III standing, because “‘concrete' is not . . . necessarily synonymous with ‘tangible.'” Spokeo, Inc, 578 U.S. at 340. An intangible harm is concrete for purposes of Article III standing if it bears a “close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts.” Id.
Here, Plaintiffs claim that, by selling their geolocation data and associated MAIDs, Kochava violated their privacy and created a risk that third parties will track them to and from sensitive locations. See e.g., Am. Compl. ¶ 28, Dkt. 13. A privacy intrusion-the underlying harm alleged-is precisely the kind of intangible harm that can constitute concrete injury under Article III, because “[p]rivacy rights have long been regarded ‘as providing a basis for a lawsuit in English or American courts.'” Spokeo, Inc., 578 U.S. 341; see also FTC v. Kochava, Inc., 2023 WL 3249809, at *7 (collecting cases); id. (“[P]rivacy is-and has always been-a legally protected interest in many contexts, including specifically with regard to sensitive personal information.”). Accordingly, Plaintiffs allege a sufficiently concrete injury to satisfy Article III.
Second, Plaintiffs' alleged injury is sufficiently “particularized.” Kochava points out that the complaint does not identify “any specific instances of locations where [Plaintiffs] or other Class Members were ‘tracked.'” Def.'s Memo. in Supp. at 9, Dkt. 14-1. But a review of the Amended Complaint leaves no doubt that Plaintiffs claim Kochava sold their personal geolocation data and, in doing so, revealed their past movements to its customers. Am. Compl. ¶¶ 7-10, Dkt. 13. For purposes of Article III standing, they do not need to go further and identify specific instances of tracking. It is enough that plaintiffs allege an invasion of their legally protected privacy interests resulting from Kochava's sale of their geolocation data.
Kochava's causation and redressability arguments fare no better. The injury Plaintiffs allege is directly tied to Kochava's practice of aggregating and selling their geolocation data and associated MAIDs. Whether, as Kochava claims, third parties also play a role as middlemen for the data or by using the data to track users to and from sensitive locations does not diminish the link between Kochava's practices and Plaintiffs' alleged injury.
Kochava also argues that Plaintiffs lack standing to seek injunctive relief under any of their statutory claims because they do not claim to be “realistically threatened by a repetition” of their alleged injury. Def.'s Memo. in Supp. at 10, Dkt. 14-1. Plaintiffs respond by noting that the Court rejected that very same argument in the related FTC case, Case No. 2:22-cv-00377-BLW. Pl.'s Resp. at 6, Dkt. 18. But the two cases differ in important ways. Here, the putative class is comprised of individuals whose data “was sold by Defendant without their consent,” whereas the FTC alleged ongoing sales of data in violation of the FTC Act. Am. Compl. ¶ 37, Dkt. 13 (emphasis added). Ultimately, Plaintiffs' complaint-unlike the FTC's complaint-is backward-looking and lacks any assertion that Kochava is likely to sell the plaintiffs' personal geolocation data in the future. Accordingly, Plaintiffs lack standing to seek injunctive relief under any of their claims.
In sum, Plaintiffs have Article III standing to sue under the WCPA, CDAFA, and UCL, but they lack standing to seek injunctive relief.
2. Plausibility of Claims
Having determined that Plaintiffs have standing to sue, the Court turns now to the plausibility of their claims. Again, the Court's analysis yields mixed results: Plaintiffs' claims for unjust enrichment and violation of the California Data Access and Fraud Act (CDAFA) are plausible; the others are not.
A. Plaintiffs have stated a plausible claim for unjust enrichment.
In Idaho, “[u]njust enrichment occurs where (1) the plaintiff confers a benefit on the defendant; (2) the defendant appreciates the benefit; and (3) the defendant's acceptance of the benefit is inequitable without payment to the plaintiff for the benefit's value.” Wadsworth & Reese, PLLC v. Siddoway & Co., 445 P.3d 1090, 1098 (Idaho 2019).
Plaintiffs here allege that Kochava collected and sold their “valuable personal location information . . . without the[ir] consent,” and that it would be “unjust and inequitable” for Kochava to retain those profits. Am. Compl. ¶¶ 48, 50, Dkt. 13. Kochava offers four reasons why these allegations do not constitute a plausible claim for unjust enrichment, none of which persuade the Court.
First, Kochava contends that a plaintiff can only bring a suit for unjust enrichment against a defendant with whom she has a “direct relationship.” Def.'s Memo. in Supp. at 11, Dkt. 14-1. To support this proposition, Kochava relies on the Idaho Supreme Court's decision in Beco Construction Co. v. Bannock Paving Co., 797 P.2d 863, 866-67 (Idaho 1990). In that case, one construction company sued another for winning a government contract that both companies sought. According to the plaintiff, the defendant won the contract only because it made false representations to the government. Id. at 863. Ultimately, the Idaho Supreme Court affirmed summary judgment in favor of the defendant, concluding that an unjust enrichment claim cannot succeed where “the alleged injured party has no relationship with the alleged injuring party.” Id. at 865-66. Other than seeking the same government contract, the plaintiff and defendant in Beco had no connection to each other, so the plaintiff's claim failed.
At first glance, Beco seems to support Kochava's position that a plaintiff can only sue for unjust enrichment when she has a “direct relationship” with the defendant. However, upon a closer read, the “relationship” the court deemed absent in Beco had only to do with the flow of the benefit from the plaintiff to the defendant. There, the plaintiff was seeking to recover a benefit that the defendant had obtained from a third party. Id. at 866. That was the problem, rather than the lack of any direct interaction or communication between the parties. See Stevenson v. Windermere Real Estate/Capital Grp., Inc., 275 P.3d 839, 843 (Idaho 2012).
Here, the parties may not have directly interacted or communicated prior to this lawsuit, but Plaintiffs are seeking restitution for a benefit that they-not some third party-allegedly conferred upon Kochava. That is all Beco requires. See also Idaho Lumber, Inc. v. Buck, 710 P.2d 647, 656 (Idaho Ct. App. 1985) (permitting unjust enrichment claim by contractor against landowner despite lack of any direct interaction between the two).
Next, Kochava notes that Plaintiffs failed to “allege the value of the benefit conferred on Kochava.” Def.'s Memo. in Supp. at 12, Dkt. 14-1. But Kochava asks too much at this early stage in the litigation. Plaintiffs need not identify precisely- or even approximately-how much Kochava profited from selling their geolocation data. It is enough, for now, that they claim Kochava earned some amount of profit by selling that data. Am. Compl. ¶ 13, Dkt. 13.
Third, according to Kochava, Plaintiffs “have not properly alleged that equity requires Kochava to return the alleged revenues obtained from sale of [their] location data.” Def.'s Memo. in Supp. at 12, Dkt. 14-1. Again, the Court is unpersuaded. Plaintiffs claim Kochava sold their precise location data and MAIDs, without authorization, in a format that enabled its customers to see where Plaintiffs' mobile devices had been every fifteen minutes over an extended period prior to the sale. Allowing Kochava to reap the benefits of violating consumers' privacy, Plaintiffs contend, would be inequitable. These allegations are sufficient to withstand dismissal under Rule 12(b)(6).
Finally, Kochava argues that equitable remedies are inappropriate where, as here, “an adequate remedy at law is available to the plaintiff.” Def.'s Memo. in Supp. at 13, Dkt. 14-1 (quoting DBSI Signature Place, LLC v. BL Greensboro, L.P., No. CV 05-051-SLMB, 2006 WL 1275394, at *9 (D. Idaho May 9, 2006)). But that principle should not be applied mechanically. Its purpose is to prevent plaintiffs from pursuing claims in equity instead of seeking the same relief under law. See generally Farmers Nat'l Bank v. Wickham Pipeline Const., 759 P.2d 71, 75 (“Equity will not afford relief to plaintiffs where they have passed up an adequate remedy at law.”). For example, courts often refuse equitable relief when a plaintiff foregoes seeking damages under the terms of a contract and, instead, seeks a parallel remedy in equity. See, e.g., Vreeken v. Lockwood Eng'g, B.V., 218 P.3d 1150, 1166 (Idaho 2009).
Here, Kochava does not contend that Plaintiffs failed to pursue an adequate remedy at law, such as contract damages, nor that any such remedy exists. It instead points to Plaintiffs' alternative, statutory claims which allege violations of various consumer protection laws. But Federal Rule of Civil Procedure 8(d)(2) permits plaintiffs to plead alternative theories of liability, and the plaintiffs here have not neglected to pursue a claim at law instead of alleging unjust enrichment.
In sum, Plaintiffs' unjust enrichment claim may proceed.
B. Plaintiffs have not stated a plausible claim under the Washington Consumer Protection Act (WCPA).
To state a claim under the Washington Consumer Protection Act (WCPA), a plaintiff must allege the existence of (1) an unfair or deceptive act or practice (2) occurring in trade or commerce, (3) public interest impact, (4) injury to the plaintiff's business or property, and (5) a causal connection between the defendant's act or practice and the plaintiff's injury. Hangman Ridge Training Stables, Inc. v. Safeco Title Ins. Co., 719 P.2d 531, 533 (Wash. 1986).
Kochava persuasively argues that Plaintiffs have not satisfied the fourth element because they have not alleged any injury to their “business or property.” Def.'s Memo in Supp. at 13, Dkt. 14-1. In response, Plaintiffs argue that Washington courts have “broadly construed” that statutory language. Pl.'s Resp. at 10, Dkt. 18. For support, Plaintiffs cite a decision from the Western District of Washington as an example of a court holding that an invasion of privacy, alone, may constitute injury to “business or property” under the WCPA. Domain Name Comm'n Ltd. v. DomainTools, LLC, 449 F.Supp.3d 1024, 1032 (W.D. Wash. 2020).
Upon careful review, however, the Court concludes that DomainTools is distinguishable. There, although the plaintiff raised privacy concerns to demonstrate a public-interest impact, the injury it asserted was of “incur[ring] expenses and suffer[ring] injury to reputation and good will as a result” of the defendant's practices. Id. at 1031. Those alleged injuries, rather than the plaintiff's privacy concerns, are what satisfied the WCPA's economic-injury requirement. Id. (associating privacy concerns with public-interest element instead of injury element).
In contrast, Plaintiffs here do not allege any harm to their business or property because of Kochava's data sales. They claim only that those sales violated their privacy and enabled third parties to track them to and from sensitive locations. But economic injury is “a crucial element of a [WCPA] claim.” Cousineau v. Microsoft Corp., 992 F.Supp.2d 1116, 1128 (W.D. Wash. 2012). And, although an invasion of privacy may support Article III standing, it is not actionable on its own under Washington's consumer protection law. See Panag v. Farmers Ins. Co. of Wash., 204 P.3d 885, 899 (Wash. 2009) (“Personal injuries, as opposed to injuries to ‘business or property,' are not compensable and do not satisfy the injury requirement. [. . .] Thus, damages for mental distress, embarrassment, and inconvenience are not recoverable under the [WCPA].”) (internal quotation omitted).
Plaintiffs' WCPA claim is therefore dismissed. However, because the claim could be cured through additional factual allegations, Plaintiffs will be given leave to amend.
C. Plaintiffs have stated a plausible claim under the California Data Access and Fraud Act (CDAFA).
Plaintiffs claim that Kochava's data sales violate three provisions of the California Data Access and Fraud Act (CDAFA). Cal. Penal Code § 502(c)(1), (2), and (7). Those provisions differ from each other but share the common requirement that the defendant used the plaintiff's data “without permission.” See id.
Kochava offers two reasons why Plaintiffs cannot satisfy that common element. First, Kochava argues that it did have permission to access Plaintiffs' data because Plaintiffs voluntarily downloaded third-party applications and authorized those applications to collect their data. Put another way, by authorizing third parties to collect their data, Plaintiffs constructively authorized others, including Kochava, to do so the same. Second, Kochava argues that a defendant does not act “without permission” within the meaning of CDAFA unless it circumvents some technical barrier to access the data in question. Neither of Kochava's arguments carry the day.
The Honorable Cynthia Bashant of the United States District Court for the Southern District of California recently addressed very similar arguments Kochava raised as a defendant in another case: Greenley v. Kochava, Inc., Case No. 22-cv-01327-BAS-AHG, 2023 WL 4833466 (S.D. Cal. July 27, 2023). Judge Bashant's decision, while not binding here, is instructive. There, as here, mobile device users challenged Kochava's collection and sale of their geolocation data. Id. Moving to dismiss the plaintiffs' CDAFA claim, Kochava argued that they had constructively authorized its data collections by downloading third-party applications.
Judge Bashalt was not persuaded. Based on the plaintiffs' allegations, she explained, they did not know that downloading third-party phone applications would enable other entities, including Kochava, to access and sell their geolocation data. Greenley v. Kochava, Inc., 2023 WL 4833466, at *13 (S.D. Cal. July 27, 2023) (“Nowhere does the Amended Complaint suggest that consumers were aware of Defendant's involvement, when they purportedly consented to data collection.”). Critically, Judge Bashalt explained, although the plaintiffs may have allowed another entity to access their data, doing so did not constitute consent to “the practice at issue.” Id. (quoting Brown v. Google LLC, 525 F.Supp.3d 1049, 1063 (N.D. Cal. Mar. 12, 2021)); see also Brown v. Google LLC, Case No.: 4:20-cv-3664-YGR, 2023 WL 5029899, at *1 (N.D. Cal. Aug. 7, 2023) (rejecting Google's consent defense because Google “never explicitly told users” that it collected their data while in private browsing mode, so users had not “explicitly consented to the at-issue data collection”). This Court agrees with Judge Bashalt's reasoning and arrives at the same conclusion, here.
Next, Kochava asserts that it could not have violated CDAFA because it did not circumvent any technical barrier to access Plaintiffs' data. Again, Judge Bashalt's analysis is persuasive. First, nothing within CDAFA's text-which simply prohibits taking or using data “without permission”-indicates that liability is limited to defendants who circumvent technical barriers to access data. See Greenley, 2023 WL 4833466, at *14. The Court will not impose such a requirement where the legislature did not.
The Ninth Circuit's discussion of CDAFA in US v. Christensen aligns with this Court's understanding. 828 F.3d 763, 789 (9th Cir. 2015). There, the court distinguished between the federal Computer Fraud and Abuse Act (CFAA), which criminalizes unauthorized access to data, and CDAFA, which criminalizes (and provides a civil cause of action for) the unauthorized taking or use of data. CDAFA, the Ninth Circuit explained, “does not require unauthorized access. It merely requires knowing access.” Id.; West v. Ronquillo-Morgan, 526 F.Supp.3d 737, 746 (C.D. Cal. 2020) (“Circumventing technical barriers may be sufficient to show that a person acted ‘without permission,' but that does not mean it is necessary for a person to circumvent technical barriers to act ‘without permission.' Christensen makes this clear.”); accord Volkswagen Grp. of Am., Inc. v. Smartcar, Inc., Case No. 21-cv-04895-JST, 2022 WL 20184651, at *5 (N.D. Cal. July 7, 2022) (no technical circumvention required); CTI III, LLC v. Devine, No. 2:21-cv-02184-JAM-DB, 2022 WL 1693508, at *4 (E.D. Cal. May 26, 2022) (same).
Here, although Plaintiffs do not claim that Kochava circumvented any technical barrier to access their data, they do allege that Kochava gathered and sold that geolocation data without their knowledge or permission. At this early stage, that is enough to survive dismissal under Rule 12(b)(6).
D. Plaintiffs have not alleged the kind of economic injury necessary to state a claim under California's Unfair Competition Law (UCL).
Kochava challenges Plaintiffs' Unfair Competition Law (UCL) claim on two grounds: (1) failure to allege an economic injury and (2) failure to allege an unlawful, unfair, or fraudulent act or practice. The Court agrees with Kochava's first critique, but not its second.
(1) Economic Injury
The UCL prohibits any “unlawful, unfair or fraudulent business act or practice.” Cal. Bus. & Prof. Code § 17200. To sue under the UCL, a plaintiff must have “suffered injury in fact and . . . lost money or property as a result of the unfair competition.” Rubio v. Capital One Bank, 613 F.3d 1195, 1203 (9th Cir. 2010) (emphasis added). Non-economic injuries are not cognizable, which “renders standing under [the UCL] substantially narrower than federal standing under article III.” McGee v. S-L Snacks Nat'l, 982 F.3d 700, 705 n.3 (9th Cir. 2020) (quoting Kwikset Corp. v. Super. Ct., 246 P.3d 877, 886 (Cal. 2011)); see also Cal. Med. Ass'n v. Aetna Health of Cal. Inc., 532 P.3d 250, 258 (Cal. 2023) (“The UCL's focus on ‘los[s]' of ‘money or property' (§ 17204) restricts the broad range of harms that could otherwise give rise to standing.”) (alteration in original).
Here, Plaintiffs claim that Kochava's data sales violate their privacy and “depriv[e]” them of the “economic value” of their personal location data. Pl.'s Resp. at 15, Dkt. 18. Kochava responds that lost privacy is not “lost money or property” within the meaning of the UCL. Moreover, Kochava argues, Plaintiffs' Amended Complaint contains only conclusory allegations to support their second, informational-value theory of economic injury. Kochava is right on both points.
Bare allegations that a defendant disclosed a plaintiff's private information do not, alone, satisfy the UCL's economic-injury requirement. See e.g., Fraley v. Facebook, Inc., 830 F.Supp.2d 785, 811 (N.D. Cal. 2011) (collecting cases); see also In re Facebook Privacy Litig. 572 Fed.Appx. 494, 494 (9th Cir. 2014) (unpublished) (affirming dismissal of UCL claim for alleged dissemination of personal information). Accordingly, California's state and federal courts have consistently dismissed informational-privacy claims resting on bald references to the “economic value” of a plaintiff's information. See, e.g., Moore v. Centrelake Med. Grp., Inc., 83 Cal.App. 5th 515, 540-41 & n.13 (Cal.Ct.App. 2022); Bass v. Facebook, Inc., 394 F.Supp.3d 1024, 1040 (N.D. Cal. 2019) (holding that “to merely say the information was taken and therefore it has lost value” does not confer UCL standing); Gonzales v. Uber Techs., Inc., 305 F.Supp.3d 1078, 1093 (N.D. Cal. 2018) (citing Campbell v. Facebook, 77 F.Supp.3d 836, 849 (N.D. Cal. 2014)) (“[T]he sharing of names, user IDs, location and other personal information does not constitute lost money or property for UCL standing purposes.”); Greenley, 2023 WL 4833466, at *19 (“Courts have consistently found that alleging the economic value of data is not enough, if a plaintiff fails to allege the economic value to him.”) (emphasis in original).
Instead, to claim and economic injury, “data privacy plaintiffs must allege the existence of a market for their data and the impairment of the ability to participate in that market.” Ji v. Naver Corp., No. 21-cv-05143-HSG, 2022 WL 4624898, at *9 (N.D. Cal. Sept. 30, 2022); see also Folgelstrom v. Lamps Plus, Inc., 195 Cal.App.4th 986, 989 (Cal.Ct.App. 2011). In Brown v. Google LLC, for example, the plaintiffs made “detailed allegations” that their personal data had quantifiable “cash value” that they could have personally monetized absent the defendant's practices. Case No. 20-CV-03664-LHK, 2021 WL 6064009, at *15 (N.D. Cal. Dec. 22, 2021). Those allegations satisfied the UCL's economic-injury requirement.
Here, in contrast, Plaintiffs have not alleged that their geolocation data had any economic value to them, nor that Kochava's practices diminished any such value. The suggestion in Plaintiffs' response brief that they were “depriv[ed]” of the “economic value” of their data is too little, too late, where the Amended Complaint itself lacks any such allegations. Pl.'s Resp. at 15, Dkt. 18. Accordingly, Plaintiffs' UCL claim will be dismissed under Rule 12(b)(6). Because this deficiency could be cured through additional factual allegations, however, Plaintiffs will be given leave to amend.
(2) Unlawful, Unfair, or Fraudulent Act or Practice
Finally, the Court turns to Kochava's argument that Plaintiffs have not alleged any “unlawful, unfair, or fraudulent business act or practice.”
Although Plaintiffs' UCL claim will be dismissed for the reasons explained above, Plaintiffs will be given an opportunity to file an amended complaint. Accordingly, the Court will also take this opportunity to address Kochava's second argument for dismissal.
Each of the three types of conduct prohibited by the UCL-unlawful, unfair, and fraudulent-constitutes a “'separate and distinct theory of liability' and an independent basis for relief.” Rojas-Lozano v. Google, Inc., 159 F.Supp.3d 1101, 1117 (N.D. Cal. 2016). The first prong, relevant here, prohibits “unlawful” practices which include “anything that can be called a business practice and that at the same time is forbidden by law.” Id.
Kochava argues that Plaintiffs have not alleged a violation of the UCL “under any test.” Def.'s Memo. in Supp. at 19, Dkt. 14-1. As explained above, however, Plaintiffs have stated a plausible claim under CDAFA. It follows that Plaintiffs have also stated a plausible claim for violation of the UCL, because they allege that Kochava's business practice of collecting and selling their geolocation data is unlawful under California law. Accordingly, the Court is not persuaded by Kochava's second argument for dismissing Plaintiffs' UCL claim.
ORDER
IT IS ORDERED that Defendant's Motion to Dismiss (Dkt. 14) is GRANTED in part and DENIED in part, as follows:
1. Plaintiffs' claims for injunctive relief are DISMISSED with leave to amend;
2. Plaintiffs' claims under the Washington Consumer Protection Act (WCPA) and California's Unfair Competition Law (UCL) are DISMISSED with leave to amend; and
3. Defendant's Motion to Dismiss (Dkt. 14) is DENIED in all other respects.
IT IS FURTHER ORDERED that Plaintiffs are granted leave to amend in accordance with this Order. Any such amendment shall be filed within 30 days after issuance of this Order.