Opinion
20-cv-04688-RS
01-03-2024
ANIBAL RODRIGUEZ, et al., Plaintiffs, v. GOOGLE LLC, Defendant.
ORDER GRANTING MOTION TO CERTIFY CLASS AND DENYING DAUBERT MOTION
RICHARD SEEBORG, Chief United States District Judge
I. INTRODUCTION
Plaintiffs Anibal Rodriguez, Sal Cataldo, Julian Santiago, and Susan Lynn Harvey are users of third-party apps to which Google provides services. Plaintiffs bring a putative class action against Defendant Google LLC with three claims: invasion of privacy, intrusion upon seclusion, and violation of the Comprehensive Computer Data Access and Fraud Act (CDAFA), Cal. Penal Code § 502, et seq. Pursuant to Federal Rules of Civil Procedure 23(b)(3) and 23(b)(2), they seek certification of nationwide classes of all Google users who had their “Web & App Activity” (“WAA”) and/or “supplemental Web & App Activity” (“sWAA”) switched off in their Google privacy settings since July 1, 2016.
Concurrently, Google moves to exclude the opinion by Plaintiffs' damages expert, Michael J. Lasinski, pursuant to Federal Rule of Evidence 702 and Daubert v. Merrell Dow Pharmaceuticals, Inc., 509 U.S. 579 (1993). Lasinski submitted a report to calculate class-wide unjust enrichment and actual damages for Plaintiff's two proposed classes. For the reasons below, Plaintiffs' motion to certify class is granted and Google's Daubert motion is denied.
II. BACKGROUND
This is a putative class action challenging Google's data practices. See Fourth Amended Complaint (“FAC”). The factual history of this case has been discussed at length in previous orders. In sum, Plaintiffs aver Google contravenes its representations to its WAA-off and sWAA-off users when it collects, saves, and uses their data from third-party apps built with the Firebase and/or Google Mobile Ads Software Developer Kits (“SDKs”). Google admits that it collects this data but, for sWAA-off users, it does so only for “basic record-keeping” of its advertising services and to store and analyze data for the third-party app developers. Opp. at 1. Plaintiffs now move to certify two classes:
Class 1: All individuals who, during the period beginning July 1, 2016 and continuing through the present (the “Class Period”), (a) had their “Web & App Activity” and/or “supplemental Web & App Activity” setting turned off and (b) whose activity on a non-Google-branded mobile app was still transmitted to Google, from (c) a mobile device running the Android operating system, because of the Firebase Software Development Kit (“SDK”) and/or Google Mobile Ads SDK.
Class 2: All individuals who, during the Class Period (a) had their “Web & App Activity” and/or “supplemental Web & App Activity” setting turned off and (b) whose activity on a non-Google-branded mobile app was still transmitted to Google, from (c) a mobile device running a non-Android operating system, because of the Firebase SDK and/or Google Mobile Ads SDK.
Class Cert. Mot. at 1. To support their motion, Plaintiffs proffer the opinion of Lasinski, the Senior Managing Director at Ankura Consulting Group (“Ankura”) and head of the Intellectual Property group. Lasinski's report calculates class-wide damages for Plaintiffs' proposed classes under two damages theories, one based on unjust enrichment to Google, and another based on actual damages to Plaintiffs. Under the unjust enrichment theory, Lasinski provides calculations for two damage scenarios. Lasinski's first model, “Scenario One,” provides for damages equal to “the portion of Google's U.S. App Promo, AdMob, and Ad Manager app ads revenues and profits attributable to Google's collection, saving, and/or use of WAA/sWAA-Off Data for purposes of tracking advertising conversions” which he calculates to be approximately $558.8 million. Lasinski Rep. 1. Alternatively, Lasinski provides a second model, “Scenario Two,” which calculates damages equal to “the portion of Google's U.S. App Promo, AdMob, and Ad Manager app ads revenues and profits attributable to Google's collection, saving, and/or use of WAA/sWAA-Off Data for purposes of serving and monetizing advertisements” totaling approximately $664.3 million. Id. Lasinski also calculated actual damages for the proposed classes as the value to an individual knowingly to surrender their choice to keep their app data private and allow an organization to track their data. Id. at 2. Lasinski estimated damages based on baseline monthly compensation provided to participants in a Google consumer research study, the Ipsos Screenwise Panel. The baseline compensation to participants was $3 per device per month, so Lasinski applied a one-time $3 payment to the number of Class Member Devices, totaling $486.0 million approximately. Id. Google filed a Daubert motion as to Lasinski's opinions.
According to Lasinski, “[t]hese Scenario One and Two amounts represent approximately 5.27% and 6.27%, respectively, of Google's U.S. revenues net of traffic acquisition costs from App Promo, AdMob, and Ad Manager for apps” between July 1, 2016 and December 31, 2022.
III. LEGAL STANDARD
A. Class Certification
Class actions are governed by Rule 23 of the Federal Rules of Civil Procedure. To obtain class certification, plaintiffs bear the burden of showing they have met each of the four requirements of Rule 23(a) and at least one subsection of Rule 23(b). Zinser v. Accufix Rsch. Inst., Inc., 253 F.3d 1180, 1186 (9th Cir. 2001), amended by 273 F.3d 1266 (9th Cir. 2001). Plaintiffs must establish these requirements by a preponderance of the evidence. Olean Wholesale Grocery Cooperative, Inc. v. Bumble Bee Foods LLC, 31 F.4th 651, 665 (9th Cir. 2022) (en banc).
Class certification is proper if four conditions are met: “(1) the class is so numerous that joinder of all members is impracticable; (2) there are questions of law or fact common to the class; (3) the claims or defenses of the representative parties are typical of the claims or defenses of the class; and (4) the representative parties will fairly and adequately protect the interests of the class.” Fed.R.Civ.P. 23(a). These requirements are commonly referred to as numerosity, commonality, typicality, and adequacy of representation, respectively. Mazza v. Am. Honda Motor Co., Inc., 666 F.3d 581, 588 (9th Cir. 2012).
If all four Rule 23(a) prerequisites are satisfied, plaintiffs must also “satisfy through evidentiary proof' at least one of the three subsections of Rule 23(b). Comcast Corp. v. Behrend, 569 U.S. 27, 33 (2013). Rule 23(b)(3) requires that “the questions of law or fact common to class members predominate over any questions affecting only individual members, and that a class action is superior to other available methods for fairly and efficiently adjudicating the controversy.” Fed.R.Civ.P. 23(b)(3). Such common questions need only be capable of classwide resolution; plaintiffs are not required to show that “the evidence in fact establishes [they] would win at trial.” Olean, 31 F.4th at 667. Rule 23(b)(2) requires that “the opposing party has acted or refused to act on grounds that apply generally to the class” and “final injunctive relief or corresponding declaratory relief is appropriate respecting the class as a whole.” Fed.R.Civ.P. 23(b)(2). A court may certify a 23(b)(2) class and 23(b)(3) class separately. In re ConAgra Foods, Inc., 302 F.R.D. 537, 573 (C.D. Cal. 2014) (“Ninth Circuit precedent indicates that the court can separately certify an injunctive relief class and if appropriate, also certify a Rule 23(b)(3) damages class”).
B. Daubert
Federal Rule of Evidence 702 requires that a witness proffered as an expert by a party be qualified by “knowledge, skill, experience, training, or education.” Fed.R.Evid. 702. Even if a witness is qualified as an expert in a particular field, any scientific, technical, or specialized testimony is admissible only if it (a) “will help the trier of fact to understand the evidence or to determine a fact in issue,” (b) “is based upon sufficient facts or data,” (c) “is the product of reliable principles and methods,” and (d) “the expert has reliably applied the principles and methods to the facts of the case.” Id.
Irrelevant or unreliable testimony is prohibited under Rule 702. Daubert v. Merrell Dow Pharm., Inc., 509 U.S. 579, 589 (1993). Expert opinions are relevant if the knowledge underlying them has a “valid connection to the pertinent inquiry.” United States v. Sandoval-Mendoza, 472 F.3d 645, 654 (9th Cir. 2006) (internal quotation marks and alteration omitted). “Expert testimony which does not relate to any issue in the case is not relevant and, ergo, non-helpful.” Daubert, 509 U.S. at 590. Expert opinion testimony is reliable if such knowledge has a “basis in the knowledge and experience of [the relevant] discipline.” Id. at 592. Under Daubert, courts should consider the following factors when evaluating whether an expert's proposed testimony is reliable: (1) “whether a theory or technique . . . can be (and has been) tested,” (2) “whether the theory or technique has been subjected to peer review and publication[,]” (3) the known or potential error rate of the particular scientific theory or technique, and (4) the degree to which the scientific technique or theory is accepted in a relevant scientific community. Id. at 593-94. This list is not exhaustive, however, and the standard is flexible. Kumho Tire Co. v. Carmichael, 526 U.S. 137, 151 (1999). The Daubert inquiry “applies not only to testimony based on ‘scientific' knowledge, but also to testimony based on ‘technical' and ‘other specialized' knowledge.” Id. at 141.
The court's task is not to “decid[e] whether the expert is right or wrong, just whether his testimony has substance such that it would be helpful to a jury.” Alaska Rent-A-Car, Inc. v. Avis Budget Grp., Inc., 738 F.3d 960, 969-70 (9th Cir. 2013). Courts may not exclude testimony simply because it is impeachable. Id. at 969. “Vigorous cross-examination, presentation of contrary evidence, and careful instruction on the burden of proof are the traditional and appropriate means of attacking shaky but admissible evidence.” Daubert, 509 U.S. at 596. The focus of the inquiry is thus on the principles and methodology employed, not the conclusions reached by the expert. See id. at 595. Ultimately, the purpose of the assessment is to exclude speculative or unreliable testimony to ensure accurate, unbiased decision-making by the trier of fact.
IV. DISCUSSION
A. Class Certification
Plaintiffs contend their claims warrant class-wide treatment because they satisfy the four 23(a) requirements, common questions predominate over individual ones pursuant to 23(b)(3), and they seek uniform equitable relief from Google's conduct per 23(b)(2). Plaintiffs seek application of California law to all claims. Defendants do not raise any choice-of-law related objections and focus on California law in opposing Plaintiff's motion for class certification.
I. 23(a) requirements
Plaintiffs meet the four 23(a) requirements of numerosity, commonality, typicality, and adequacy. Class 1 proposes Android users, while Class 2 proposes non-Android users, who during the class period had their WAA/sWAA settings turned off and had their data transmitted to Google while using non-Google branded apps.
a. Numerosity
First, each of the proposed classes contain members so numerous that class-wide treatment is appropriate. The numerosity prong of Rule 23(a) requires joinder to be “impracticable.” Fed.R.Civ.P. 23(a)(1). There is no numerical cut-off to determine whether this requirement has been met. Gen. Tel. Co. v. EEOC, 446 U.S. 318, 330 (1980). Instead, a fact-specific inquiry may be used to determine whether joinder would be impracticable. Id. Here, each of Plaintiffs' proposed classes constitute millions of users, so this condition is satisfied.
b. Commonality
Next, Plaintiffs proposed classes satisfy the commonality requirement because their claims pose common “questions of law or fact.” Fed.R.Civ.P. 23(a)(2). Plaintiffs suggest that common questions include whether Google has “permission” to collect third party app data based on the “objective meaning” of Google's sWAA disclosures. Id. Plaintiffs' claims raise a “common contention” as to Google's conduct, and the “determination of its truth or falsity will resolve an issue that is central to the validity of each one of the claims in one stroke.” Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338, 350 (2011). Therefore, Plaintiffs meet the commonality requirement.
c. Typicality
Named plaintiffs' individual claims are also typical of those of the proposed class members. See Fed.R.Civ.P. 23(a)(3). “The purpose of the typicality requirement is to assure that the interest of the named representative aligns with the interests of the class.” Hanon v. Dataproducts Corp., 976 F.2d 497, 508 (9th Cir. 1992). All named plaintiffs are Google users who used third-party apps with the Firebase and/or Google Mobile Ads SDKs. Named Plaintiffs Rodriguez, Cataldo, and Harvey are Android users and aver claims typical of Class 1, while named Plaintiff Santiago uses an Apple device and avers claims typical of Class 2.
d. Adequacy
Finally, Plaintiffs and their counsel “fairly and adequately protect the interest of the class[es].” Fed.R.Civ.P. 23(a)(4). Two questions determine adequacy: “(1) do the named plaintiffs and their counsel have any conflicts of interest with other class members and (2) will the named plaintiffs and their counsel prosecute the action vigorously on behalf of the class?” Hanlon v. Chrysler Corp., 150 F.3d 1011, 1020 (9th Cir. 1998). Plaintiffs and their counsel have shown no conflicts of interest, and Google has not asserted any. Further, Plaintiffs and their counsel state in their declaration that they are committed to the prosecution of this matter on behalf of the proposed classes. Thus, this requirement is satisfied.
II. 23(b)(3)
Rule 23(b)(3) certification requires Plaintiffs to satisfy two conditions: predominance and superiority. See Fed. R. Civ. Pro. 23(b)(3). To meet the predominance requirement, Plaintiffs do not need to show an absence of individual claims, only that the claims that may be resolved classwide predominate over individual ones. See Dukes, 564 U.S. at 359. “Considering whether ‘questions of law or fact common to class members predominate' begins, of course, with the elements of the underlying cause of action.” Erica P. John Fund, Inc. v. Halliburton Co., 563 U.S. 804, 809 (2011). The second requirement under 23(b)(3) is that class treatment is the superior method of fairly and effectively adjudicating the instant controversy. Fed.R.Civ.P. 23(b)(3).
The parties' primary dispute concerns whether common or individual questions predominate. Plaintiffs argue they do because the central issues in this action, specifically what Google represented and the technical functioning of Google's SDK technology, “turn on common questions” and “are subject to common proof.” Class Cert. Mot. at 9. Conversely, Google argues, first, that the averred harms are individualized, and even if not, they cannot be determined on a class-wide basis. Google further argues that even if both harms and damages can be determined class-wide, it would thereby be unfairly precluded from asserting its implied and explicit consent defenses. It insists that Plaintiffs failed to identify a single California mass torts case that certified a class for a “privacy tort claims (or CDAFA)” because “these claims are inherently personal, and the nature, extent, and frequency of injury and damage are highly individualized issues that are typically unsuitable for class treatment.” Opp. at 12; but see McDonald v. Kiloos ApS, 385 F.Supp.3d 1022, 1034 (N.D. Cal. 2019) (a putative class action with intrusion upon seclusion and invasion of privacy claims, in which the Court held that Plaintiffs had adequately pleaded the offensiveness element); see also Order Concerning: (1) The Parties' Expert Exclusion Motions; and (2) Plaintiffs' Class Certification Motion, Csupo, et al. v. Alphabet, Inc., 19CV352557 (Super. Ct. Santa Clara Oct. 26, 2023) (certifying a class in which the plaintiffs, under theories of conversion and quantum meruit, alleged that the defendant used their cellular data allowances without consent). Thus, according to Google, common questions fail to predominate over individual ones.
Left unsaid is that Google similarly cannot point to developed California mass torts case authority in the privacy context in which certification was denied. Absence of a case in a new area of law is not surprising.
The intrusion upon seclusion and invasion of privacy claims are increasingly discussed together because they entail similar elements, “[a]lthough the claims do continue to exist as separate claims with technically distinct elements.” McDonald v. Kiloo ApS, 385 F.Supp.3d 1022, 1033 (N.D. Cal. 2019). Combined, these claims ask whether “(1) there exists a reasonable expectation of privacy, and (2) the intrusion was highly offensive.” In re Facebook, Inc. Internet Tracking Litigation, 956 F.3d 589, 601 (9th Cir. 2020) (hereinafter “Facebook Tracking”).
a. Reasonable expectation of privacy
Under both the intrusion upon seclusion and invasion of privacy claims, the question of whether a reasonable expectation of privacy exists is an objective one. See Shulman v. Grp. W. Prods., Inc., 18 Cal.4th 200, 232 (1998). Nonetheless, this objective test may permit examination of “the surrounding circumstances” to ascertain whether a person had a reasonable expectation of privacy. Opp at 13. “California law does not require Plaintiffs to prove subjective expectation.” Opperman v. Path, 13-cv-00453-JST, 2016 WL 3844326 at *11 (N.D. Cal. July 15, 2016) (discussing the elements of the intrusion upon seclusion tort); see also Hill v. Natl. Collegiate Athletic Assn., 7 Cal.4th 1, (1994) (holding that, for the state constitutional privacy cause of action, “a reasonable expectation of privacy is an objective entitlement founded on broadly based and widely accepted community norms.” (internal quotations omitted)). Instead, the claim requires: “(1) intrusion into a private place, conversation or matter, (2) in a manner highly offensive to a reasonable person.” Opperman, 2016 WL 3844326 at *11 (quoting Shulman, 18 Cal.4th at 231) (emphasis in original).
Google invokes Hart v. TWC to argue that individual inquiries as to whether putative class members had a reasonable expectation of privacy can defeat predominance. No. 20-cv-03842-JST, 2023 WL 3568078 (N.D. Cal. March 30, 2023). In that case, the plaintiffs averred that The Weather Channel (“TWC”) violated the California Constitution when it tracked and collected users' data and engaged in a scheme to sell that data to third parties and business partners without users' knowledge. Id. at *1. The court determined that ascertaining if users maintained a reasonable expectation of privacy required “an individualized factual inquiry” into whether they knew their affirmative responses to the permission prompts allowed TWC to engage in the averred misconduct. Id. at *10. Furthermore, the Court held that analysis of an individual user's “conduct” could also defeat predominance by manifesting “voluntary consent.” Id. (citation omitted).
Here, those same considerations weigh in favor of predominance. First, the relevant “conduct” showing a lack of consent is the users' decisions affirmatively to switch off the WAA and sWAA buttons. It is not, as Google tries to argue, the fact that users continued using apps with Google's SDKs. It is unreasonable for Google to expect, as it does, that users must also stop using the many apps on their phone, after selecting sWAA to be off, to show a lack of consent. This places an undue burden on everyday users who indicated their privacy preferences by turning off sWAA. Second, Google's argument places an impossible burden on Plaintiffs that would preclude injunctive relief altogether: they must stop using the many apps on their phones to avoid consenting to the wrongful conduct, unfairly undercutting standing to seek injunctive relief. See infra at IV.A.II.c. Third, both the third party apps in this case and TWC in Hart provided its users with privacy disclosures when the app was opened. Separately from these disclosures, putative class members here affirmatively sought out and clicked on Google's WAA and sWAA buttons, a common act representing their privacy choices, based on Google's own ubiquitous representations. In Hart, TWC was both the app facing users and the defendant; user's reasonable expectations as to TWC's conduct was the basis of the court's decision there. By contrast, Google is the party engaging in the alleged wrongful conduct separate from the third party apps making disclosures to class members. Individual representations by the third party apps here do not outweigh Google's common representation to users for purposes of finding predominance.
Despite Google's insistence otherwise, whether the amount or nature of data collected is a fact-specific inquiry does not by itself defeat predominance, because the relevant question is whether the members, who shared common conduct, had an objective, reasonable expectation of privacy based on Google's representation about the sWAA button to all members under these claims. This is a question capable of resolution class-wide.
b. Highly offensive conduct
The second element of both claims, whether the intrusion was “highly offensive,” also warrants class treatment. Google argues this is a complex question that “requires consideration of all the circumstances of intrusion, including its degree and setting and the intruder's motives and objectives.” Opp. at 13 (quoting Shulman, 18 Cal.4th at 236). Again, Google fails to make a case for why these additional questions supersede the central inquiry: whether a reasonable person would find the intrusion by Google highly offensive. Instead, Google invokes two cases decided under the California Invasion of Privacy Act (CIPA) section 632, which protects communications made over a “wire, line, or cable,” to argue that both claims require a fact-specific inquiry incapable of class-wide treatment. See Kight v. CashCall, Inc., 231 Cal.App.4th 112 (2014); Hataishi v. First Am. Home Buyers Prot. Corp., 223 Cal.App.4th 1454 (2014). Both cases Google identifies pertain to secretly overheard phone conversations that were listened to surreptitiously. Plaintiffs' CIPA section 632 claim, while previously dismissed, does not control the analysis of the intrusion upon seclusion and invasion of privacy claims.
Factual inquiries underscoring a § 632 analysis are inapplicable here. There are no similar individual issues about whether each plaintiff “reasonably believed their calls were not being monitored.” Kight, 231 Cal.App.4th at 119. Here, the relevant inquiries are primarily Google's uniform disclosures and users' uniform conduct. Furthermore, CIPA § 632 is not, as Google contends, an analog for the common law privacy tort. As stated above, the test under the state intrusion upon seclusion and invasion of privacy claims is an objective one, capable of resolution class-wide, and while analysis of surrounding circumstances may sometimes be necessary to determine whether a user maintained their reasonable expectation of privacy, here, that question is eclipsed by the undisputed fact that all class members switched off their sWAA settings. Cf. Hart v. TWC, 2023 WL 3568078 at *9.
c. CDAFA
CDAFA makes certain computer-related crimes a public offense, including to “knowingly access[] and without permission take . . . any data from a computer.” Cal. Penal Code § 502(c)(2). Access “means to gain entry to, instruct, cause input to, cause output from, cause data processing with, or communicate with, the logical, arithmetical, or memory function resources of a computer, computer system, or computer network.” Cal. Penal Code 502(b)(1). Further, to show “damage or loss” under CDAFA, a plaintiff need not have suffered a corresponding loss, as “California law recognizes a right to disgorgement of profits resulting from unjust enrichment.” Facebook Tracking, 956 F.3d at 599-600.
Google first argues, incorrectly, that CDAFA provides for “highly individualized . . . compensatory damages” limited to the victim's expenditure, i.e. what was “reasonably and necessarily incurred by the owner or lessee to verify that a computer system, computer network, computer program, or data was or was not altered, deleted, damaged, or destroyed by the access.” Opp. at 15 (quoting Cal. Penal Code § 502(b)(11)). However, the statute provides for compensatory damages including victim expenditures. Cal. Penal Code § 502(e)(1).
Next, Google asserts that it cannot be all class members who used apps with Firebase and/or Google Mobile Ads SDKs suffered “damage or loss,” as their information was collected for “run-of-the-mill record-keeping” and was not “sensitive, confidential, or even meaningful to users.” Opp. at 16. Plaintiffs, on the other hand, argue that they need not prove the at-issue data was sensitive or not-anonymous, but that “any damage or loss” is sufficient for standing under the CDAFA. Reply at 3; see Facebook Tracking, 956 F.3d at 599-600. Google's definition is too restrictive, while Plaintiff's is too permissive. In order to maintain entitlement to the disgorged profits, plaintiffs must show that they have standing, i.e. that they “retain a stake in the profits garnered.” Facebook Tracking, 956 F.3d at 599-600. In that case, the Court held that Plaintiffs had adequately established standing because they alleged their data “carr[ied] financial value” and that the defendant “profited from this valuable data.” Plaintiffs' damages expert provides two models of unjust enrichment that account for both elements capable of application class-wide. However, even if Google is right, and the “vast majority” of class members' data was only exposed to record-keeping “not tied to a person's identity or used by Google for any purpose other than to perform accounting for the apps that generated the data or advertising in the first place,” Opp. at 16, then surely that can be proven by common evidence of Google's record-keeping practices. It is unclear why Google would need to take discovery “from the 100 million privacy plaintiffs” if it engaged in a uniform policy of record-keeping.
Plaintiffs provide three ways damage or loss may be adjudicated class-wide: first, by proof of Google's unjust enrichment class-wide; second, because Google failed to pay for collected data despite there being a “market” for it, see Brown v. Google LLC, 2023 WL 5029899 at *19 (N.D. Cal. Aug. 7, 2023); and third, by showing how the data collection negatively impacts members' devices. See Class Cert. Mot. at 3.
Google further insists predominance is not met because Plaintiffs “admitted they suffered no harm.” Opp. at 17. Google points to concessions by the named plaintiffs of their continued use of apps, Google accounts, and Google services, despite knowledge of the alleged privacy violations. Google argues that this behavior “fatally undermined the claim of harm because each [named plaintiff] testified they had not changed their behavior [on their] phones after learning ‘the truth' about sWAA.” Opp. at 17. This argument places an undue burden on Plaintiffs. They need not show they unilaterally stopped using Google's services after learning about sWAA's alleged privacy violations to be able to aver they suffered harm. This would permit Google to argue that Plaintiffs lack standing to aver the instant claims as they would face no real and immediate threat. In In re Yahoo Mail Litig., 308 F.R.D. 577, 589 (N.D. Cal. 2015) (hereinafter, “Yahoo Mail Litig.”), the Court declined to place such an impossible burden on Plaintiffs seeking injunctive relief.
Yahoo would put Plaintiffs in a catch-22 that would essentially preclude injunctive relief altogether. Yahoo would require Plaintiffs to allege both (1) that Plaintiffs, in order to avoid “consenting” to Yahoo's conduct, stopped emailing Yahoo subscribers after discovering Yahoo's alleged wrongful conduct, and (2) that Plaintiffs continued to email Yahoo subscribers so that Plaintiffs allege a real and immediate threat of future injury, i.e., that Yahoo would intercept Plaintiffs' communications in the future.Id. Aside from this unworkable predicament, the ubiquitous nature of phones, coupled with the sheer number of apps with Google SDKs would render Plaintiffs' use of their phones impossible. The growing reliance on phones increasingly make them necessities, not luxuries, with significant privacy implications for users. The fact that Plaintiffs, as putative class members, affirmatively selected the WAA/sWAA-off buttons sheds light on their privacy choices as to Google's practices. Google may argue, as it does, that Plaintiffs have consented to the behavior they complain about, but Plaintiffs' continued use of Google's products and services does not equate to consent. See id.
d. Damages
Plaintiffs next argue that common questions predominate regarding damages. A showing of predominance may fail if “questions of individual damage calculations will inevitably overwhelm questions common to the class.” Comcast Corp. v. Behrend, 569 U.S. 27, 34 (2013). Damage calculations need not be exact, but “at the class-certification stage (as at trial), any model supporting a ‘plaintiffs damages case must be consistent with its liability case.'” Id. at 35 (citation omitted).
The parties' primary dispute as it relates to damages is whether they may be shown on a class-wide basis, particularly with respect to Lasinski's expert opinion (discussed infra Section B). Plaintiffs provide four models for monetary relief: “disgorgement, actual damages, punitive damages, and nominal damages.” Class Cert. Mot. at 19. Lasinski's models on disgorgement and actual damages are at issue in Google's Daubert motion and are discussed below, so first discussion turns to punitive and nominal damages.
Plaintiffs seek punitive damages for all three claims to “punish and deter” Google based on its “conduct towards the class as a whole.” Class Cert. Mot. at 22 (citing Ellis v. Costco Corp. III, 285 F.R.D. 492, 542-44 (N.D. Cal. 2012)). Plaintiffs also seek nominal damages, relying on Opperman, 2016 WL 3844326 at *15-16. Google argues that Plaintiffs “would need to have shown that something about the data collection in question went beyond routine commercial behavior . . . and crossed into highly-offensive-and-harmful territory.” Opp. at 19. At this juncture, “it is sufficient to decide that the availability of punitive damages is amenable to classwide resolution,” through common evidence. Opperman, 2016 WL 3844326 at *17.
e. Consent
While Plaintiffs bear the burden of proving predominance under 23(b)(3), Google bears the burden of proof for the affirmative defense of consent. See True Health Chiropractic Inc. v McKesson Corp., 896 F.3d 923, 931 (9th Cir. 2018); see also Brown v. Google LLC, No.: 4:20-cv-3664-YGR, 2023 WL 5029899 *17-18 (N.D.Cal. Aug. 7, 2023). “When ‘one or more of the central issues in the action are common to the class and can be said to predominate, the action may be considered proper under Rule 23(b)(3) even though other important matters will have to be tried separately, such as damages or some affirmative defenses peculiar to some individual class members.'” Tyson Foods, Inc. v. Bouaphakeo, 577 U.S. 442, 453-54, (2016) (citation omitted).
i. sWAA disclosures
Google argues that even if harms and damages may be shown class-wide, its asserted defenses of express and implied consent as to its own disclosures raise individual questions that supersede common ones. First, Google suggests Plaintiffs theorize sWAA disclosures created confusion for class members “as to types of data it covered and which aspects of Google's business would be disabled by turning sWAA off” as necessarily raising individualized questions. Opp. at 20. Specifically, Google reasons that whether sWAA really was ambiguous to Plaintiffs requires individualized evidence about a user's “experience with Google, their exposure to third-party app developers, and their own personal experiences with technology.” Opp. at 20. Plaintiffs object to this characterization of their claim, arguing that express consent does not defeat predominance because the “sWAA disclosures and Google's Privacy Policy” are the only relevant materials for analysis, and are “the same for all class members.” Reply at 10.
By way of example, Google invokes In re Google, Inc. Gmail Litigation, No. 13-MD-02430-LHK, 2014 WL 1102660 (N.D. Cal. Mar. 18, 2014). In that case, the Court held that predominance was defeated because plaintiffs could learn about Google's disclosures from a “panoply of sources” including Google's own Terms of Service, privacy policies, news sources, with continued use of these various disclosures raising individual questions about implied consent. Id. at *17.
Google's position for purposes of this argument is a curious one. Throughout their Opposition to Plaintiffs' Motion, Google provides evidence that its disclosures to class members were decidedly unambiguous. See, e.g., Opp. at 6-9 (describing Google's Privacy Policy, and various disclosures to users about what data is collected and/or saved). In fact, Google insists that “for users who actually read the disclosures and engaged with the Ad Settings button, they would have understood that turning off the personalization setting would not prevent Google from serving ads, only make the ads less relevant” and, in order to disclose its notice and consent procedures as clearly as possible, Google “disclos[es] information over time rather than all at once.” Opp. at 9. Google bears the burden of proof of express consent, but the “non-speculative” evidence it has provided leans against individualized treatment because Google itself vehemently insists that its own disclosures are unambiguous. See Brown, 2023 WL 5029899 at *18. Google cannot argue that its disclosures were unambiguous where it suits it, and ambiguous where it does not. While it is possible that individual class members learned about the WAA feature from a panoply of sources, it is left unexplained why that necessarily means Google's explanations were inconsistent, warranting defeat of predominance. Google's representations about the WAA feature, unambiguous and persistent by its own admission, outweigh these individual questions about where class members learned about the WAA feature.
Google next argues that users impliedly consented because “most of the class was likely well aware that sWAA would not serve as an ad blocker because they turned sWAA off and Google kept serving them ads.” Opp. at 21 (emphasis in original). This argument supposedly weighs against Plaintiffs' position that the “sWAA button could never be unambiguous.” Id. Plaintiffs argue that “Google cites no evidence users know a Google ad when they see one,” and, regardless, “Google must prove class members consented to Google's saving and use of sWAA-off data, not Google advertising.” Reply at 14 (emphasis in original). Indeed, the relevant inquiry is whether class members consented to the collection of sWAA-off data. Google has maintained that the only data collected from sWAA-off users is required for their “record-keeping,” most of which is related to tracking their ad services. Therefore, Google argues that it can raise a defense of implied consent because users knew they were being served Google ads. Again, this defense may be raised class-wide. Google's ubiquitous representation to users is a common question, not an individual one, particularly as Google insists that “every member of the class who was served an ad by Google had the obvious and clear opportunity to understand that the ad was served by Google.” Opp. at 21. If its behavior was consistent across the class, then it may raise its defense class-wide, even if an additional concern may arise as to who actually clicked on the representations. That individual question, balanced against the many common ones, does not defeat predominance. In this respect, Google's policy is uniform, and common questions predominate.
While Google's third argument breaks in the opposite direction, it is not enough to defeat a finding of predominance. Google maintains that each class member had a way to prevent conversion attribution at the device-level. For example, Google points to Apple iOS's “opt-in” policy starting in April 2021, called App Tracking Transparency, which requires users “to opt-in to ad tracking affirmatively.” Opp. at 22. An analog for Android devices that allows users to optout of ad-tracking is called “Opt out of Ad Personalization.” Id. Google insists that predominance is defeated because some of the proposed class members will have consented by opting-in to ad tracking affirmatively, and others will not. Plaintiffs insist that this technology is irrelevant to sWAA-off data. While Google has sufficiently pointed to the challenge of raising this defense class-wide, this issue still warrants class treatment because device-level settings presumably apply uniformly across all iOS devices or all Android devices. Further, summary adjudication, not class certification, is the appropriate vehicle by which to resolve how device-level settings may interact with sWAA.
Google's last argument focuses on users who had accounts prior to 2016. It asserts that, prior to that date, sWAA was “off by default” for accounts. It insists that the challenge will be in separating which members did not change their settings by default and which did not do so by choice, raising individualized inquiries. Plaintiffs rely on two expert opinions to refute Google's contention. Plaintiffs point out that pre-2016 users received a “consent bump” prompt, by “which Google urged them to turn sWAA on.” Reply at 14-15. This conduct matches the conduct post-2016, as all users collectively switched sWAA off. In other words, the users who did not turn sWAA on effectively refused data collection by Google. While Google points out that it may have to raise different defenses with respect to the pre-2016 users, these defenses need not be individualized and may apply as a whole to pre-2016 users and post-2016 users, such that the issue may be resolved through sub-classing if necessary. See Tyson Foods, Inc., 577 U.S. at 453-54.
ii. Third-party disclosures
Google argues that that each class members “was subjected to dozens, perhaps hundreds, of disclosures from apps informing them that their activity data on third party apps was being collected.” Opp. at 23. Google suggests that, as a result, a factfinder will have to sift through “each innumerable permutations of apps the user has downloaded” to conduct a consent inquiry. However, the relevant question concerns Google's disclosures about the sWAA button, not third-party disclosures to users. To the extent Google had a policy that required third party apps to disclose Google's policies to users, that evidence may be applied across the class. Google is correct that a factfinder may have to analyze an app's specific disclosures to evaluate consent but that individual inquiry, if applicable, does not overwhelm predominating questions as to Google's privacy disclosures.
The predominance inquiry of 23(b)(3) is therefore satisfied. Additionally, class treatment of this case is the “superior” method of adjudication because each class member would not have to “litigate numerous and substantial issues to establish his or her right to recover individually.” Zinser, 253 F.3d at 1192. For these reasons, the motion to certify a damages class under 23(b)(3) is granted.
III. 23(b)(2)
Plaintiffs also seek certification under 23(b)(2) for injunctive relief from Google's alleged misconduct class-wide. “Rule 23(b)(2) applies only when a single injunction or declaratory judgment would provide relief to each member of the class.” Dukes, 564 U.S. at 360. Unlike 23(b)(3), the relevant inquiry here is not whether common questions predominate in the individual claims of proposed class members, “but rather whether [the defendant] has engaged in a “common policy'” with respect to the class. Yahoo Mail Litig., 308 F.R.D. at 599.
Plaintiffs seek injunctive relief:
(1) precluding Google from further collecting, storing, and using consumers' (s)WAA-off app activity data; (2) requiring Google to delete already collected (s)WAA-off app activity data; (3) requiring Google to delete any products, services, or algorithms built in whole or in part with that unlawfully collected (s)WAA-off app activity data; and (4) appointing an independent third party to verify that the injunctive relief has been (and continues to be) implemented.
Class Cert. Mot. at 25. Google argues that none of these requests address any “common policy” by Google. Plaintiffs' second request would, according to Google, require it to identify each class member and contravene its own policy “against joining pseudonymous data with user accounts” to delete this data. Opp. at 25. This argument is unavailing. Plaintiffs seek deletion of all sWAA-off data collected. Indeed, if Google were conducting “basic record-keeping” of its users' data, then it should know which of its users toggled sWAA off and which did not - a feature by Google and, therefore, under its control. Plaintiffs contend that Google should delete sWAA-off data Google itself admits to collecting, albeit only for record-keeping purposes. Further, Google fails to raise any arguments against three out of four Plaintiffs' requests, and Plaintiffs have convincingly identified “the general contours” of the class-wide injunctive relief they seek. Parsons v. Ryan, 754 F.3d 657, 689-90 fn. 35 (9th Cir. 2014). Google may raise these arguments again at summary judgment should it wish to do so, but at this stage, Plaintiffs have met their burden. Class certification is granted under 23(b)(2).
Google states that it conducts “basic record-keeping” of its users' data because, even when a user's sWAA is turned off, it will “(1) log the fact that it has served an ad alongside a pseudonymous device identifier for accounting purposes, and (2) attribute conversion events to those ad serving records.” Opp at 5.
B. Daubert Motion as to Michael J. Lasinski
Google moves to exclude the opinion of Michael J. Lasinski, Plaintiff's damages expert, relying on Fed.R.Evid. 702 and Daubert. Dkt. at 330. Lasinski opines that discovery can be used to establish monetary relief sought by Plaintiffs class-wide. Lasinski Rep. 1. As discussed above, Lasinski provided two sub-models under Plaintiffs' unjust enrichment theory (Scenarios One and Two) and one model for actual damages. Lasinski's unjust enrichment analyses “quantify the portion of Google's U.S. App Promo, AdMob, and Ad Manager app ads revenues and attendant profits attributable to the alleged wrongful conduct” under two scenarios, discussed further below. Lasinski Rep. ¶ 77. For much of his analysis, Lasinski relies on the opinions of Jonathan Hochman, Plaintiffs' technical expert, and Mark Keegan, Plaintiffs' survey expert.
I. Unjust Enrichment
Under Scenario One, Lasinski calculates Google's unjust enrichment as equal to “(a) Google's U.S. App Promo revenues and attendant profits from signed-in, WAA/sWAA-Off users attributable to conversion tracking with GA4F plus [(b)] the portion of Google's U.S. AdMob and [(c)] Ad Manager app ads revenues and attendant profits from signed-in, WAA/sWAA-Off users attributable to conversion tracking.” Id. ¶ 82-91 (describing methods of calculating the proportion of Google's U.S. App Promo net revenue from signed-in, WAA/sWAA-off users attributable to conversion tracking). Per Scenario 1, damages equate to $558.8 million.
In Scenario Two, Lasinski calculates (a) “the revenues and attendant profits attributable to conversion tracking quantified under Scenario One plus [(b)] an additional measure of AdMob and Ad Manager app ads revenues and attendant profits attributable to the serving and monetization of ads to WAA/sWAA-Off users.” Id. ¶ 113. The additional measure here adds the value to Google derived from served ads from methods other than conversions. Scenario Two calculates damages totaling $664.3 million.
II. Actual damages
To generate a model for his actual damages calculation, Lasinski considered: (a) Google's payments for user data, (b) Users' willingness to pay to prevent data collection; and (c) Research organizations' willingness to pay for data collection.” Id. ¶ 132.
Lasinski looked to the Ipsos Screenwise Panel, a consumer research study conducted by Google since 2012 to “collect information about how users browse the internet.” Id. ¶ 135. Lasinski states that the panel participants knowingly allow Google to track their activity, thus “relinquish any sense of online data privacy.” Id. ¶ 139. The minimum recurring payment for a participant is $3 a month. To arrive at an actual damages calculation, Lasinski applied the $3 value once to each of the class member devices (i.e. a device where WAA/sWAA was turned off from July 1, 2016 to December 2022). Lasinski calculates actual damages to equal approximately $486.05 million.
III. Recoverable damages
To support its Daubert motion, Google asserts that (a) Plaintiffs cannot recover disgorgement on their claims, (b) the disgorgement model provides for a “full restitution model” based on unrealistic “hypothetical damages scenario” or fictitious facts, (c) the actual damages model has no methodology and is therefore unreliable because it is cribbed from another case, (d) the models used by Lasinski are “outcome determinative” and “cherry-picked” so should be rejected, and (e) the actual damages model does not account for variances among class members.
a. Availability of disgorgement as a remedy
Google argues that Plaintiffs did not suffer any actual loss, as Google never invaded any property right, so disgorgement is not available to Plaintiffs as a remedy. As already discussed above in the analysis for 23(b)(3), Google is incorrect at least with respect to the CDAFA claim. See Facebook Tracking, 956 F.3d at 600; see also Brown v. Google LLC, 2023 WL 5029899 at *6-7 (N.D. Cal. Aug. 7, 2023).
With respect to the intrusion upon seclusion and invasion of privacy claims, Google argues that disgorgement is unavailable to Plaintiffs because “the primary damage . . . is the mental distress from having been exposed to public view.” Time, Inc. v. Hill, 385 U.S. 374 384 n.9 (1967) (as quoted in CACI 1820 (2023)). However, that argument misses the mark. The Ninth Circuit has not limited disgorgement to CDAFA claims. The relevant inquiry under California law is whether there is “an entitlement to unjustly earned profits” and, “to establish standing, plaintiffs must only establish a stake in the profits garnered from their personal data and that it is unjust for the defendant to retain those profits.” Greenley v. Kochava, Inc., No. 22-cv-01327-BAS-AHG, 2023 WL 4833466 at *4 (S.D. Cal. July 27, 2023) (citation omitted). Plaintiffs, through Lasinski's opinion, have met this burden for Daubert purposes. Further, Plaintiffs must show that the damages model is “consistent with its theory of liability in the case.” Brown, 2023 WL 5029899 at *6 (quoting Comcast, 569 U.S. at 35). Here, Plaintiffs' theory is consistent to the extent that they contend Google was unjustly enriched by collection of their data. Lasinski's theory attributes damages to the wrongful conduct.
b. Lasinski's model is not based on fictitious scenarios
Google next argues that Lasinski's model for unjust enrichment suffers causation deficiencies because he assumes that all of Google's revenue from ads served to sWAA-off users was attributed to Google's capacity to keep a record the ad was served. Google objects to Lasinski's methods, which according to Google “presume 100% forfeiture” because Lasinski does not consider “(1) user reactions if Google had provided users with the disclosures Plaintiffs allege it should have provided; or (2) changes in behavior by Google or advertisers if Google could no longer use the record-keeping data.” Daubert Mot. at 10-11. Google argues this analysis is “critical” because, if class members would not change their behavior based on Google's disclosures, or if advertisers would have placed just as many ads with Google in the absence of sWAA-off data, then Google could not have been unjustly enriched. However, Lasinski was not required to examine whether Google could have profited otherwise before reaching a conclusion that Google was not unjustly enriched. Furthermore, Google bears the burden of quantifying recouped profits.
Google relies on Hart to argue that Lasinski's methods suffer an attribution problem. In that case, the plaintiffs calculated gross revenue minus costs equal unjustly retained benefit. By contrast, Lasinski further apportioned his calculations by how many class devices had their WAA/sWAA off, a value provided to Lasinski by Google. Lasinski's models do not speculate on hypothetical scenarios, but Google's own practices.
c. The actual damages model is not unreliable for being used in a different case
Google argues that Lasinski's actual damages model should be excluded because it is “cribbed” from another case. However, that by itself should not preclude Lasinski's actual damages model. See Brown, 2023 WL 5029899 at *6 (discussing a similar damages calculation but for restitutionary damages). As it did in that case, Google tries to argue that Lasinski does not rationalize “pegging actual damages to a one-time $3 payment per device.” Daubert Mot. at 18. However, as the court in Brown already noted, “The $3 rate is derived from looking at what Google actually pays Screenwise participants for agreeing to allow Google to collect their browsing data.” Id. (emphasis added). The simple fact that this model was utilized in another case averring Google mishandled private data does not warrant exclusion.
d. Lasinski's models are not “cherry-picked”
Google argues Lasinski's damages model “cherry-picked” his actual damages model from “a single survey.” Daubert Mot. at 19. Google insists that because Lasinski could not explain why $4 or $2, or any other figure, would also be appropriate, the $3 is a cherry-picked figure. It also argues that because Lasinski referred to the $3 valuation as “conservative” in his deposition, this must also mean that it is inaccurate. However, Google incorrectly characterizes the actual damages calculation as being randomly picked from a single survey. In fact, Lasinski provided analysis and compared market studies to explain why he settled on the Screenwise panel and the $3 figure. He provided insight as to why the payments made by Google to the Screenwise participants offers a strong basis for an actual damages model. Lasinski explored other programs that pay users for their data, and ultimately generated a model based on an actual, baseline payment made by Google to track actual consumer data.
e. Actual damages need not account for variances as they are based on the market value
Google's final argument is that Lasinski's actual damages model does not account for variances among class members and risks grossly undercompensating and overcompensating others. Google makes three arguments to this end: first, that some users are willing to let analytics providers access their data for free. Second, Lasinski overlooks the “diversity of user attitudes” related to privacy. Third, Lasinski never showed actual economic injury to the class. However, as Brown points out, where there is unjust enrichment, “restitution can be measured by either: (a) the value of benefit to the defendant; (b) the cost to plaintiff of conferring such benefit; (c) the market value of the benefit; or (d) the price the defendant has expressed a willingness to pay, if the defendant's asset may be treated valid on the question of price.” 2023 WL 5029899 at *7 (quoting Rest. 3d of Restitution and Unjust Enrichment § 49). In that case as here, Lasinski appropriately built his model around the price Google was willing to pay for users' privacy and this “objective standard” warrants denial of Google's motion. To the extent that users have mixed attitudes related to privacy - all class members shared at least one uniform attitude related to privacy, evidenced by their uniform conduct of switching WAA/sWAA off. Therefore, as to the uniform conduct of the class, the actual damages model does, in fact, account for class-wide attitudes and Google's class-wide alleged wrongdoing.
V. CONCLUSION
For the reasons discussed above, Plaintiffs' motion to grant class certification is granted, and Google's motion to exclude the opinion of Plaintiffs' damages expert is denied. The following classes are certified:
Class 1: All individuals who, during the period beginning July 1, 2016 and continuing through the present (the “Class Period”), (a) had their “Web & App Activity” and/or “supplemental Web & App Activity” setting turned off and (b) whose activity on a non-Google-branded mobile app was still transmitted to Google, from (c) a mobile device running the Android operating system, because of the Firebase Software Development Kit (“SDK”) and/or Google Mobile Ads SDK.
Class 2: All individuals who, during the Class Period (a) had their “Web & App Activity” and/or “supplemental Web & App Activity” setting turned off and (b) whose activity on a non-Google-branded mobile app was still transmitted to Google, from (c) a mobile device running a non-Android operating system, because of the Firebase SDK and/or Google Mobile Ads SDK.
The parties will appear for a Case Management Conference on February 1, 2024 and submit a Joint Case Management Statement by January 25, 2024.
IT IS SO ORDERED.