Summary
finding allegations sufficient under either Graham or Javier approaches
Summary of this case from Gladstone v. Amazon Web Servs.Opinion
23-cv-03527-PCP
06-03-2024
MARY L. SMITH, et al., Plaintiffs, v. GOOGLE, LLC, Defendant.
ORDER DENYING MOTION TO DISMISS
P. Casey Pitts, United States District Judge
In this consolidated putative class action against Google, LLC, plaintiffs bring several state and federal law claims arising from Google's alleged collection of their financial data through tracking tools installed on several tax preparation websites. Google has moved to dismiss these claims and seeks judicial notice of certain documents. For the reasons that follow, Google's requests for judicial notice are granted and its motion to dismiss is denied.
I. Background
The following facts from the complaint are accepted as true for purposes of this motion.
Google operates a well-known search engine and many other internet services and products. Google makes most of its money selling ads. Its advertising tools allow advertisers to target a specific location, language, and audience. Google also offers tools that track how users interact with websites. These tools can track groups of users who behave similarly or share characteristics like age or gender. They can also track specific user actions on websites, like the number of clicks, scrolls, searches, or downloads. These tools can link all of the data associated with a single user. This data can measure how effective ads are and monitor how users behave.
One such tool is Google Analytics. Website owners can install an “invisible” snippet of code which can measure actions users take on the site. When a user visits a website with Google Analytics installed, the tracking code collects pseudonymous information about how the user interacts with the webpage. By default, Google Analytics collects information about the user's browser, language, clicks, downloads, and form interactions, as well as the titles of webpages, and matches the information it collects with a user's location, gender, and general interests. Google also offers a more powerful tracking tool called the Google Tag. This allows sophisticated web publishers to customize what data is collected and how it is processed.
Data collected by these tools is sent in real time to Google, which stores the data and processes it into reports. According to the complaint, Google benefits from this collection because it can use the data to power its algorithms and learn about user habits. The complaint alleges that Google uses this data to assemble a “detailed dossier” for Google users and other website visitors.
H&R Block, TaxAct, and TaxSlayer are online tax filing services. The complaint alleges that H&R Block “transmitted information about tax filers' fillings to Google” (although it does not allege which specific tracking tools or products H&R Block used). The complaint alleges that both TaxAct and TaxSlayer disclosed “adjusted gross income and refund amounts” to Google.
Google purportedly prohibits Google Analytics customers from “passing any information that could be used by Google to identify individuals.” According to the complaint, Google has never contacted any of the tax preparation sites about their sharing potentially sensitive information with Google, nor has Google suspended or terminated any of these sites' accounts.
The named plaintiffs are residents of California, Florida, Georgia, Illinois, New York, South Carolina, and Texas who used TaxAct, H&R Block, and TaxSlayer to prepare their taxes. Each alleges that the site they used to file taxes had installed Google's tracking tools. Plaintiffs seek to represent a nationwide class of people who used online tax providers like H&R Block, TaxAct, or TaxSlayer that used Google tracking tools, as well as California, Illinois, Florida, and Texas subclasses.
Plaintiffs filed the present consolidated complaint after the Court consolidated two similar cases. Plaintiffs assert eight claims under a variety of state and federal laws on behalf of the putative nationwide class and state subclasses. Google has moved to dismiss the complaint under Rule 12(b)(6) and requested judicial notice of several documents.
II. Legal Standards
A complaint that does not state a plausible claim upon which relief can be granted can be dismissed under Federal Rule of Civil Procedure 12(b)(6). “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). Legal conclusions “must be supported by factual allegations.” Id. at 679. The Court must “accept all factual allegations in the complaint as true and construe the pleadings in the light most favorable to the nonmoving party.” Rowe v. Educ. Credit Mgmt. Corp., 559 F.3d 1028, 1029-30 (9th Cir. 2009).
There are two exceptions to the general rule that “courts may not consider material outside the pleadings when assessing the sufficiency of a complaint.” Khoja v. Orexigen Therapeutics, Inc., 899 F.3d 988, 998 (9th Cir. 2018). First, Federal Rule of Evidence 201 permits judicial notice of “a fact that is not subject to reasonable dispute” because the fact is “generally known” or “can be accurately and readily determined from sources whose accuracy cannot reasonably be questioned.” A court may take notice of “undisputed matters of public record,” but not of “disputed facts stated in public records.” Lee v. City of L.A., 250 F.3d 668, 690 (9th Cir. 2001). Second, the doctrine of incorporation by reference permits a court to treat an extrinsic document as if it were part of the complaint if the pleading “refers extensively to the document” or if “the document forms the basis” of a claim. Khoja, 899 F.3d at 1002. This can be proper “when assessing the sufficiency of a claim requires that the document at issue be reviewed,” but is not warranted when “the document merely creates a defense to the well-ple[aded] allegations.” Id.
III. Requests for Judicial Notice
Google has requested judicial notice of several documents. These requests are granted.
First, Google seeks judicial notice of the “Google Analytics Terms of Service” posted on its website. Google argues that this document is noticeable because it is posted on a public website and, alternatively, because it is incorporated by reference into the complaint. Although the complaint refers to “policies” that Google purportedly has in place, Compl. ¶ 42, this is not enough for the document to be incorporated by reference. The complaint's indirect reference to “policies” is not the kind of extensive reference that would warrant incorporation, nor do the claims arise from or depend on that agreement. Still, the Court takes notice of this document because it is publicly available from a source whose accuracy cannot reasonably be questioned and its contents can be accurately determined. But this notice is limited to the existence and contents of this May 15, 2023 version of the document. The Court cannot conclude that any of the tax preparation sites ever assented to the terms therein, or that plaintiffs had notice of the contents.
Second, Google seeks judicial notice of two other pages on its website that discuss Google Analytics. This request is similarly granted, but notice is again limited to the existence of these documents. The Court cannot conclude that these documents-a blog post addressing “Google Analytics privacy” and a support article identifying “[b]est practices to avoid sending Personally Identifiable Information”-accurately characterize how Google's tools operate.
Third, Google requests judicial notice of copies of the “TaxAct Privacy Policy,” the “H&R Block Privacy Policy,” and the “TaxSlayer Privacy Policy” posted on the tax preparation services' respective websites. These documents are not incorporated by reference, but the Court will similarly take judicial notice of them because they are posted publicly. As before, though, the Court cannot conclude that any of the plaintiffs ever saw or agreed to the terms therein, or that the tax preparation companies operated in compliance with those policies.
Finally, Google requests judicial notice of purported additional versions of the Google Analytics Terms of Service, the H&R Block Privacy Notice, the TaxAct Privacy Statement, and the TaxSlayer Privacy Policy. These versions cover a broader range of effective dates than Google's original submission and are all taken from the Internet Archive's “Wayback Machine” archival service. This request is similarly granted but, again, judicial notice of the existence of these documents in the Wayback Machine archive cannot support any conclusions regarding their terms, plaintiffs' consent to those terms, or Google's compliance with those terms.
IV. Motion To Dismiss
Google seeks dismissal of each of plaintiffs' claims. The Court addresses them in turn.
A. Count I: California Invasion of Privacy Act (Cal. Penal Code § 631)
Section 631(a) of the California Penal Code makes punishable anyone who, “by means of any machine, instrument, or contrivance, or in any other manner,” does any of four things:
(1) “intentionally taps, or makes any unauthorized connection, whether physically, electrically, acoustically, inductively, or otherwise, with any telegraph or telephone wire, line, cable, or instrument ...”;
(2) “willfully and without the consent of all parties to the communication, or in any unauthorized manner, reads, or attempts to read, or to learn the contents or meaning of any message, report, or communication while the same is in transit or passing over any wire, line, or cable, or is being sent from, or received at any place within this state”;
(3) “uses, or attempts to use, in any manner, or for any purpose, or to communicate in any way, any information so obtained”; or
(4) “aids, agrees with, employs, or conspires with any person or persons to unlawfully do, or permit, or cause to be done any of the acts or things mentioned above in this section.”Section 631 is a criminal statute, but Section 637.2 provides a civil cause of action to anyone “injured by a violation of this chapter . against the person who committed the violation.”
Google raises several challenges to the Section 631 claim. Because none have merit at this stage, its motion to dismiss the claim under prongs two and three of Section 631 is denied.
Plaintiffs confirmed at the hearing that they are not pursuing a claim under the first or fourth prong. If they later seek to pursue a claim under these prongs, they may request leave to amend.
1. Consent
Google first argues that plaintiffs consented to the tax sites' use of Google Analytics. Google argues that terms of service and privacy policies of which the Court has taken judicial notice establish that plaintiffs consented to the use of Google Analytics. Although these documents suggest that plaintiffs could have consented to Google's alleged data collection, plaintiffs specifically allege that they did not. The mere existence of various terms of service and privacy policies cannot establish at this stage, where the Court must draw all reasonable inferences in plaintiffs' favor, that any of the plaintiffs did in fact consent. Google's consent arguments do not provide a basis to dismiss the Section 631 claim. See In re Meta Pixel Tax Filing Cases,___F.Supp.3d ___, 2024 WL 1251350, at *5 (N.D. Cal. 2024) (rejecting similar consent arguments).
2. Vendor
Google next argues that the Section 631 claim should be dismissed because Google acted as a “mere vendor” of a tool that allows websites to record their own interactions with their users.
Under Section 631, “it ... matter[s] who is holding the tape recorder.” Javier v. Assurance IQ, LLC, 649 F.Supp.3d 891, 900 (N.D. Cal. 2023). If a party to a conversation uses a recording device to capture it, Section 631 is not violated. See Rogers v. Ulrich, 52 Cal.App.3d 894, 899 (1975) (explaining that Section 631 does not cover “participant recording”). But if a nonparty to a conversation listens in directly or records the conversation themselves, they are generally liable under Section 631 if the other elements of that claim are satisfied. See Ribas v. Clark, 38 Cal.3d 355, 360-61 (1985) (explaining that Section 631 covers “simultaneous dissemination to an unannounced second auditor, whether that auditor be a person or mechanical device”).
Participant recording can violate other provisions of the California Invasion of Privacy Act, but plaintiffs are not pursuing claims under any of those provisions.
If Google Analytics is like a tape recorder, the question is who is “holding” it. Did Google simply build a tape recorder and pass it off to the tax sites to use for their own purposes? Or did Google not only create the tape recorder but also use it to make a recording? The former scenario might not violate Section 631 under Rogers, but the latter would under Ribas. Some courts have concluded that web tracking tools are like a tape recorder that is simply handed off to website operators to collect data on their own users, even if the maker of the recording tool stores the data. In Graham v. Noom, Inc., for example, one court in this district explained that “a software service that captures its clients' data, hosts it on [its own] servers, and allows the clients to analyze their data” is simply “a tool-like the tape recorder in Rogers-that allows [a client] to record and analyze its own data.” 533 F.Supp.3d 823, 832-33 (N.D. Cal. 2021). But another court in this district recently concluded that for an online tracking service to be more like a tape recorder device than an eavesdropper using a tape recorder, the service must be entirely incapable of using the data it collects and stores for any other purpose, “just as a tape recorder has no independent capability to divulge the recording.” See Javier, 649 F.Supp.3d at 900. Such a service might, for example, encrypt the data it collects so that only the website developer, not the service provider, can access the unencrypted data.
Whether or not a third-party service incapable of using the data it collects might avoid liability under Section 631, the complaint alleges that Google does read and use Google Analytics data. It asserts that “Google Analytics .. is not simply a ‘tool' utilized by website owners for their own purposes” but that Google “benefits (and profits from)” the use of Google Analytics and “can use the data it gleans ... to power its algorithms.” Compl. ¶ 29. It asserts that Google uses the data from its tracking tools to compile a “detailed dossier, or digital fingerprint” for each of its users. Id. Google Analytics is free, suggesting that Google derives some benefit when websites use the tool. And when a website installs Google Analytics, “by default, Google Analytics matches that information with users' geolocation, gender, and general interests.” Compl. ¶ 34. The complaint is not entirely clear about whether the user information that is “matched” is exclusively information collected from a particular website or whether Google compares information collected through web tracking tools to other information Google has already amassed, but it seems unlikely that tax preparation websites sent Google information about their users' “general interests.” Either way, the complaint alleges that the collected data is “aggregated” and presented to Google Analytics customers in an online “account dashboard.” Compl. ¶ 34. This suggests that Google processes and analyzes the data it collects at least to some extent. Even if this processing is done primarily for the benefit of Google Analytics users, Google is still the one “reading” and/or “using” the data it collects for the purposes of Section 631. See also Valenzuela v. Nationwide Mut. Ins. Co.,___F.Supp.3d___, 2023 WL 5266033, at *7 (C.D. Cal. 2023) (“Eavesdropping on a conversation at the time it occurs is a violation of Section 631, even if done for the benefit of a party to the conversation.”).
Plaintiffs' allegations, which must be taken as true, suggest that Google is not simply a vendor of a tool that websites can use to “record” their own users' interactions on their websites, but rather that Google read or used the data collected about these users. Although Google can provide evidence to refute these allegations at a later stage, on this Rule 12(b)(6) motion Google's device-vendor arguments do not provide a basis to dismiss plaintiffs' Section 631 claim.
3. Intent
Finally, Google argues that the Section 631 claim fails because the complaint does not adequately plead intent. The complaint asserts that Google “intentionally tapped” plaintiffs' communications and “willfully read or attempted to read” their contents. Compl. ¶¶ 61-62. The complaint acknowledges that Google has policies to prohibit customers from sending personally identifiable information to Google, but it also contends that Google never enforced these policies against any of the tax preparation sites and that it “would have known” of or “at best turned a blind eye to” the use of its tools to collect users' tax information. Compl. ¶¶ 40, 42-43. The complaint further alleges that the information transmitted to Google would have been “highly valuable” as a “demographic marker[] for advertising purposes.” Compl. ¶ 40.
These allegations are sufficient to plead willfulness for the purposes of Rule 12(b)(6). While Google argues that judicially noticeable policy documents suggest that Google did not actually want to receive personally identifiable information and expressly prohibited developers from transmitting such data, this presents a question of fact that the Court cannot resolve at this stage. See Meta Pixel, 2024 WL 1251350, at *5 (“Whatever agreements may have been in place, those agreements do not establish as a matter of law that Meta did not intend to receive the information plaintiffs claim was transmitted.”).
Plaintiffs also note in their opposition brief that even under the higher Rule 9(b) standard, intent can be averred generally. Google latches onto this passing reference to argue that plaintiffs have “back[ed] themselves into the strictures of Rule 9(b)” and that plaintiffs' “salacious allegation” that Google prohibits websites from sending personal information but in fact intended that websites do so means that their claims are subject to Rule 9(b). That is not how Rule 9(b) works. Plaintiffs' statutory claims here do not sound in fraud. Their claim requires intent, which plaintiffs have specifically alleged. That Google also allegedly misrepresented its true intent is a separate issue from whether Google actually did intend to receive the data. Because plaintiffs are directly challenging Google's alleged data collection rather than challenging any potentially fraudulent or misleading representations about this collection, their claims do not sound in fraud and are not subject to Rule 9(b).
4. Contents
The second and third prongs of Section 631 require reading, learning, or using the “contents or meaning” of a communication. Google argues that plaintiffs' allegations of the actual data sent to Google are insufficient. The complaint states that “H&R Block, TaxAct, and TaxSlayer have been quietly transmitting sensitive financial information to Google when Americans file their taxes online.” Compl. ¶ 32. It alleges that “H&R Block reportedly transmitted information about tax filers' filings to Google” and that both TaxAct and Tax Slayer disclosed “the dollar amount of adjusted gross income and refund amounts to Google.” Compl. ¶¶ 38-39. These allegations are not as detailed as they might be, nor are they as detailed as corresponding allegations in the related case against Meta. And Google correctly points out that other statements in the complaint are phrased as speculation rather than allegations. See, e.g., Compl. ¶ 37 (“The type of data collected by these sites may include email addresses, data on users' income, filing status, refund amounts, buttons that were clicked, and year of return.”). Still, while these allegations are thinner than those in the Meta Pixel complaint, they are enough to state a claim. The complaint alleges that each of the three tax filing services transmitted sensitive financial information about tax filings to Google. It alleges the kinds of information that the tax filing services would have been able to transmit, and it alleges the mechanism for transmission. Although it does not specify exactly what information was actually transmitted by H&R Block, the allegations are sufficient at the pleading stage to state a claim that the contents or meaning of plaintiffs' confidential communications were read and/or used by Google.
* * *
For the foregoing reasons, Google's motion to dismiss Count I is denied.
B. Count II: California Invasion of Privacy Act (Cal. Penal Code § 632)
Section 632 of the California Penal Code makes punishable anyone who “intentionally and without the consent of all parties to a confidential communication, uses an electronic amplifying or recording device to eavesdrop upon or record the confidential communication, whether the communication is carried on among the parties in the presence of one another or by means of a telegraph, telephone, or other device, except a radio.”
Google raises the same consent and intent arguments addressed above in moving to dismiss the Section 632 claim, and they are rejected for the same reasons.
Google also argues that Section 632 does not apply because there is a “presumption” under California law that online communications are not confidential. This view of California law overreads the cases. A conversation is “confidential” under Section 632 if one of the parties has “a reasonable expectation .. that no one is listening in or overhearing the conversation.” Flanagan v. Flanagan, 27 Cal.4th 766, 772-73 (2002). Although California courts applying Section 632 to online communications have concluded in certain cases that communications were not confidential, “California courts have never recognized a legal ‘presumption' that internet communications are not confidential under Section 632.” See Brown v. Google LLC, ___ F.Supp.3d. ___, 2023 WL 5029899, at *18 (N.D. Cal. 2023). Further, the cases Google relies on involved internet chats and emails, not sensitive financial information submitted to a tax preparation website. See Campbell v. Facebook, Inc., 77 F.Supp.3d 836, 848-49 (N.D. Cal. 2014) (collecting cases). The scattering of state and federal cases (none from the California Supreme Court) considering various communications on a case-by-case basis do not establish that California law presumes the non-confidentiality of all online communication. But see Revitch v. New Moosejaw, LLC, No. 18-CV-06827-VC, 2019 WL 5485330, at *3 (N.D. Cal. Oct. 23, 2019) (finding such a presumption).
In any case, the factual circumstances alleged here are clearly distinguishable from chats or emails. Plaintiffs are not alleging that their communications with another person were intercepted. The cases Google cites conclude that online chats and emails cannot be reasonably expected to be confidential because they “can easily be shared by ... the recipient(s) ” See Campbell, 77 F.Supp.3d at 849. But that reasoning is wholly inapplicable here. Plaintiffs instead allege that they expected their tax information would remain confidential-an expectation they argue was objectively reasonable because sharing tax return information without consent is a crime. At the pleading stage, plaintiffs have plausibly alleged that Google intercepted communications that were confidential under Section 632. Google's motion to dismiss Count II is therefore denied.
C. Count III: California Invasion of Privacy Act (Cal. Penal Code § 635)
Section 635 of the California Penal Code makes punishable anyone who “manufactures, assembles, sells, offers for sale, advertises for sale, possesses, transports, imports, or furnishes to another any device which is primarily or exclusively designed or intended for eavesdropping upon the communication of another.” Plaintiffs assert that Google Analytics is a “device .. primarily or exclusively designed” for eavesdropping, and that Google has therefore violated Section 635. They bring a civil claim for violation of this criminal provision pursuant to Section 637.2.
Section 637.2 provides a right of action to “[a]ny person who has been injured by a violation of this chapter ... against the person who committed the violation.” Google briefly contends that Section 637.2 does not allow claims under Section 635, but the Court recently rejected this argument in its Meta Pixel decision, concluding that the “better interpretation” of Section 637.2 is that “injuries caused by use of an eavesdropping device are traceable to the manufacture, sale, and provision of that device, and that an injured party therefore has a private right of action against the creator of the device.” 2024 WL 1251350, at *10.
Google next argues that Google Analytics is not designed or intended for eavesdropping. Google contends that it is a vendor providing a tool to enable websites to record user interactions, that such tools are commonplace, and that the vast majority of developers use Google Analytics in a legitimate manner. But these are all factual responses to plaintiffs' complaint. The complaint asserts that Google Analytics is “primarily or exclusively” designed for eavesdropping. Compl. ¶ 77. It alleges that the Google Analytics tracking code is “invisible” to users and is a “default feature.” Compl. ¶¶ 25-27. Even without the additional configuration available to “sophisticated” users, the complaint alleges that the tracking code collects detailed information about user behavior by default. See Compl. ¶¶ 25-27, 35. The complaint does not suggest that the optional advanced features render data collection more surreptitious. Instead, the allegations simply suggest that sophisticated users can exercise greater control over the type of data collected. As the Court previously explained, “at the 12(b)(6) stage the question is not whether the Court can imagine any purpose ... other than eavesdropping but instead whether plaintiffs' allegations are sufficient to plausibly state a claim.” Meta Pixel, 2024 WL 1251350, at *11.
Finally, Google repeats its argument that plaintiffs consented to the tax sites' use of Google Analytics. As before, this is a factual determination that contradicts the pleadings, which the Court must take as true. This argument is therefore similarly rejected.
Because plaintiffs have alleged facts that state a Section 635 violation, Google's motion to dismiss Count III is denied.
D. Count IV: Wiretap Act (18 U.S.C. § 2510, et seq. )
Google argues that plaintiffs' federal Wiretap Act claim should be dismissed because plaintiffs have not adequately alleged intent, because Google is merely acting as a vendor and is not “intercepting” communications, and because the websites consented to data collection. The intent and vendor liability arguments are the same as Google's arguments against the California Invasion of Privacy Act claims and are rejected for the same reasons. With respect to consent, Google argues that because the tax sites “chose to use Google Analytics, they obviously consented to it.” But this argument draws a crucial inference in Google's favor-that in addition to installing Google Analytics, website operators understood how the software works and what data would be sent to Google and fully consented to that transmission. The complaint alleges that Google purportedly prohibited sending personal information via Google Analytics but nevertheless allowed such information to be transmitted (to its benefit). Taking this as true, the Court cannot presume that every website owner who installed Google Analytics understood exactly what data would be sent to Google and how Google might use it. Whether developers consented to data collection by using Google Analytics is a fact dispute that cannot be resolved at this stage. Accordingly, Google's motion to dismiss Count IV is denied.
E. Count V: Wiretap Act (18 U.S.C. § 2512)
18 U.S.C. § 2512(1)(b) is similar to Section 635. It makes punishable any person who “intentionally manufactures, assembles, possesses, or sells any electronic, mechanical, or other device, knowing or having reason to know that the design of such device renders it primarily useful for the purpose of the surreptitious interception of wire, oral, or electronic communications, and that such device or any component thereof has been or will be sent through the mail or transported in interstate or foreign commerce.” 18 U.S.C. § 2512(1)(b). Section 2520, in turn, provides that “any person whose wire, oral, or electronic communication is intercepted, disclosed, or intentionally used in violation of this chapter may in a civil action recover from the person or entity, other than the United States, which engaged in that violation.”
Google raises the same arguments against the federal Section 2512 claim as the California Section 635 claim. The consent and device-design arguments are rejected for the same reasons. And as the Court has previously concluded, “Section 2520 at the very least provides a private cause of action to enforce Section 2512(1)(b) against a defendant who also played an active role in the unlawful interception, disclosure, or use of the plaintiff's communication.” 2024 WL 1251350, at *12. Here, as in Meta Pixel, plaintiffs allege that Google not only created Google Analytics but also played an active role in its use to collect data from tax site users. See, e.g., Compl. ¶ 28.
Google also argues that plaintiffs have failed to plausibly allege that Google knew that Google Analytics could be primarily used for a criminal purpose, as required under the federal statute. But plaintiffs allege that Google furnished Google Analytics “with knowledge that it would primarily be used to illegally intercept electronic communications.” Compl. ¶ 182. Google argues that this allegation cannot be plausible in the face of Google's policies purporting to require that developers disclose their use of Google Analytics and obtain user consent. But this too requires making factual determinations and drawing inferences in Google's favor that go beyond the pleadings and materials subject to judicial notice. Indeed, as the Court concluded in Meta Pixel, “although disclosures about how [a tool] collects data might support a conclusion that collection was not surreptitious, the fact that additional disclosures not inherent to the device's design are necessary to warn tracked individuals about how it works might also indicate that the [tool's] design does render it useful for surreptitious collection.” 2024 WL 1251350, at *11. Here, too, the plaintiffs' allegations regarding knowledge and intent are sufficient at the Rule 12(b)(6) stage.
Accordingly, Google's motion to dismiss Count V is denied.
F. Count VI: Florida Security of Communications Act (Fla. Stat. § 934.10)
The Florida Security of Communications Act provides a civil cause of action for criminal wiretap violations. Fla. Stat. §§ 934.03, 934.10. Google repeats its consent and vendor arguments, which are rejected for the reasons discussed above. The motion to dismiss Count VI is denied.
G. Count VII: Illinois Eavesdropping Statute (720 Ill. Comp. Stat. 5/14)
The Illinois eavesdropping statute provides that “[a] person commits eavesdropping when he or she knowingly and intentionally [intercepts, records, or transcribes, in a surreptitious manner, any private electronic communication to which he or she is not a party unless he or she does so with the consent of all parties to the private electronic communication.” 720 Ill. Comp. Stat. 5/14-2(a). Google's consent, intent, and vendor-liability arguments are again rejected. Google also argues that the complaint fails to allege intentional interception “in a surreptitious manner” as required. But the complaint alleges that the Google Analytics tracking code is “invisible” and was used to “quietly transmit[]” plaintiffs' sensitive financial information to Google. Compl. ¶¶ 25, 32. This is enough to state a claim. Whether Google or the tax sites disclosed their use of Google Analytics to plaintiffs in a manner that rendered it not surreptitious is a factual issue that cannot be resolved on the pleadings. The motion to dismiss Count VII is therefore denied.
H. Count VIII: Texas Wiretap Statute (Tex. Penal Code § 16.02)
Google raises the same arguments against the Texas claims as the federal wiretap claims, and they are rejected for the same reasons. The motion to dismiss Count VII is therefore denied.
V. Conclusion
For the reasons set forth above, Google's requests for judicial notice are granted and its motion to dismiss is denied.
Pursuant to the parties' stipulation, the initial case management conference is reset for June 27, 2024. The parties shall submit a joint case management statement by June 13, 2024.
IT IS SO ORDERED.