Opinion
22-cv-09067-JST
08-16-2024
PATRICK YOCKEY, et al., Plaintiffs, v. SALESFORCE, INC., Defendant.
ORDER DENYING DEFENDANT'S MOTION TO DISMISS RE: ECF NO. 44
Before the Court is Defendant Salesforce, Inc.'s motion to dismiss Plaintiffs' second amended complaint. ECF No. 44. The Court will deny the motion.
I. BACKGROUND
Salesforce offers a service called Chat that operates from Salesforce's web servers but is functionally implemented on Rite Aid's and Kaiser Permanente's websites, allowing Rite Aid's and Kaiser Permanente's customers to interact with the company directly on the website. ECF No. 43 ¶¶ 11-13. Chat “is a combination of a basic customer service chat function and backend analytics tools to ostensibly improve a company's customer service experience.” Id. ¶ 11.
Specifically, Chat is an application programming interface (“API”), id. ¶ 12, which is a tool that allows programmers to use “pre-written code to build certain functions into their own programs, rather than write their own code to perform those functions from scratch.” Google LLC v. Oracle Am., Inc., 593 U.S. 1, 9 (2021). “An API divides and organizes the world of computing tasks in a particular way.” Id.
Chat works as follows. When a customer sends a chat message to a company's customer service agent, “it is first routed through a Salesforce server.” Id. ¶ 13. Transcripts of communications over Chat are automatically created in real time and subsequently transmitted to the contracting company. Id. ¶ 15. Chat also includes a “Sneak Peek” feature, which enables an agent to view the contents of a customer's message while the customer types the message, i.e., before the customer sends the message to the agent. Id. ¶ 22-23. Plaintiffs, users of Rite Aid's and Kaiser Permanente's websites, now bring this putative class action against Salesforce for violations of the California Invasion of Privacy Act (“CIPA”) Sections 631 and 632 and violation of Pennsylvania's Wiretapping and Electronic Surveillance Control Act (“WESCA”). Id. ¶¶ 3883 (citing Cal. Penal Code §§ 631-632; 18 Pa. Cons. Stat. §§ 5701, et seq.).
Salesforce previously moved to dismiss Plaintiffs' complaint for failure to state a claim under either statute. ECF No. 23. The Court largely denied the motion, finding that Plaintiffs had standing to bring their statutory claims; rejecting Salesforce's argument regarding Section 632 that the communications were not confidential and that Plaintiffs had consented to the recording of their communications; and rejecting Salesforce's arguments concerning WESCA that Salesforce had not intercepted Plaintiff Yockey's communications, that it had not used a “device” to intercept them, that WESCA imposed a requirement that Yockey's communications be rerouted contemporaneously with transmission, that the alleged interception was a “necessary incident to the rendition of [Salesforce's] service, and that (again) Yockey had consented to Salesforce's conduct.” ECF No. 35. The Court did grant the motion in part, however, finding that Plaintiffs' “allegations [did] not support a reasonable inference that Salesforce has the capability to use these communications for any purpose other than furnishing them to Kaiser” in order to state a claim pursuant to Section 631. Id. at 9. The Court granted leave to Plaintiffs to amend their complaint only with respect to their CIPA Section 631 claim. Id. at 16.
Plaintiffs then filed a second amended complaint (“SAC”). ECF No. 43. The SAC contains new allegations regarding how Salesforce can use the intercepted communications for its own purposes. Id. ¶ 26. Specifically, Plaintiffs allege that the “Chat communications are sent to Salesforce's Einstein data intelligence platform” which are then used to “train the AI models that form the basis of some of its services.” Id. Plaintiffs add that “Salesforce has the capability to use Chat communications to (i) improve Salesforce's own products and services; (ii) develop new Salesforce products and services; and (iii) analyze Chat communications to assist with customer service interactions and data analytics.” Id. ¶ 28.
Salesforce now moves to dismiss the SAC. ECF No. 44. Plaintiffs have filed an opposition, ECF No. 45, and Salesforce has filed a reply, ECF No. 46.
II. JURISDICTION
The Court has jurisdiction pursuant to 28 U.S.C. § 1332(d)(2)(A).
III. LEGAL STANDARD
To survive a motion to dismiss under Federal Rule of Civil Procedure 12(b)(6), a complaint must contain “a short and plain statement of the claim showing that the pleader is entitled to relief.” Fed.R.Civ.P. 8(a)(2). Dismissal “is appropriate only where the complaint lacks a cognizable legal theory or sufficient facts to support a cognizable legal theory.” Mendiondo v. Centinela Hosp. Med. Ctr., 521 F.3d 1097, 1104 (9th Cir. 2008). “[A] complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.'” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). Factual allegations need not be detailed, but facts must be “enough to raise a right to relief above the speculative level.” Twombly, 550 U.S. at 555.
“A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Iqbal, 556 U.S. at 678. While this standard is not “akin to a ‘probability requirement,' . . . it asks for more than a sheer possibility that a defendant has acted unlawfully.” Id. (quoting Twombly, 550 U.S. at 556). “Where a complaint pleads facts that are ‘merely consistent with' a defendant's liability, it ‘stops short of the line between possibility and plausibility of entitlement to relief.'” Id. (quoting Twombly, 550 U.S. at 557). In determining whether a plaintiff has met the plausibility requirement, a court must “accept all factual allegations in the complaint as true and construe the pleadings in the light most favorable” to the plaintiff. Knievel v. ESPN, 393 F.3d 1068, 1072 (9th Cir. 2005). A plaintiff may “plead[] facts alleged upon information and belief where the facts are peculiarly within the possession and control of the defendant or where the belief is based on factual information that makes the inference of culpability plausible.” Soo Park v. Thompson, 851 F.3d 910, 928 (9th Cir. 2017) (quoting Arista Recs., LLC v. Doe 3, 603 F.3d 110, 120 (2d Cir. 2010)).
IV. DISCUSSION
Salesforce argues that (1) Plaintiffs fail to state a claim under the CIPA; (2) the WESCA's distinct mutual consent exception applies to the Pennsylvania Plaintiffs and Salesforce's collection of their information; and (3) Plaintiffs cannot apply the CIPA extraterritorially to Pennsylvania residents. ECF No. 44. Plaintiffs maintain that they have sufficiently alleged violations of the CIPA and the WESCA. ECF No. 45 at 11-23.
A. Motion to Dismiss CIPA § 632 and WESCA Claims
As a threshold issue, Plaintiffs contend that Salesforce's new and previously rejected arguments regarding the CIPA and the WESCA should be treated as a “de facto motion for reconsideration” and denied on that basis. Id. at 8-11.
In addition to other challenges, Salesforce's motion to dismiss once again argues that Plaintiffs have failed to state a claim under CIPA Section 632 and WESCA. ECF No. 44 at 1523. Plaintiffs object to these arguments because the Court already found that the Plaintiffs stated a claim under CIPA Section 632 and WESCA. ECF No. 45 at 7; ECF No. 35. Plaintiffs contend that “it is improper to file a motion to dismiss an amended complaint where the amended complaint asserts no new causes of action.” ECF No. 45 at 8. Salesforce responds that “an amended complaint supersedes the prior one, rendering it ‘without legal effect.'” ECF No. 46 at 9 (citing Lacey v. Maricopa Cnty., 693 F.3d 896, 927 (9th Cir. 2012)).
The Court largely agrees with Salesforce. “It is well-established in our circuit that an amended complaint supersedes the original, the latter being treated thereafter as non-existent.” Ramirez v. County of San Bernardino, 806 F.3d 1002, 1008 (9th Cir. 2015) (internal citation and quotation marks omitted). A motion to dismiss an amended complaint “is not a motion for reconsideration of the Court's prior order, but, rather, a new motion addressing a newly filed complaint.” Turner v. Tierney, No. 12-cv-6231-MMC, 2013 WL 2156264, at *1 (N.D. Cal. May 17, 2013). “In the interest of judicial economy,” courts in this circuit will consider arguments under a Rule 12(b)(6) motion that otherwise could be brought in a later Rule 12(c) motion. W. Digit. Techs., Inc. v. Viasat, Inc., No. 22-cv-04376-HSG, 2023 WL 7739816, at *2 (N.D. Cal. Nov. 15, 2023).
The cases cited by Plaintiffs do not compel a different result because these cases involve defendants who filed a motion to dismiss on an amended complaint after answering the original complaint. See Pascal v. Concentra, Inc., No. 19-cv-02559-JCS, 2020 WL 4923974, at *2 (N.D. Cal. Aug. 21, 2020) (rejecting defendant's 12(b)(6) challenges because defendant answered the complaint); Brooks v. Caswell, No. 14-cv-01232-AC, 2016 WL 866303, at *3 (D. Or. Mar. 2, 2016) (same); Townsend Farms v. Goknur Gida Madderleri Enerji Imalat Ithalat Ihracat Ticaret Ve Sanayi A.S., No. 15-cv-0837-DOC-JCGx, 2016 WL 10570248, at *1 (C.D. Cal. Aug. 17, 2016) (same); Best Fresh LLC v. Vantaggio Farming Corp., No. 21-cv-00131-BEN-WVG, 2022 WL 4112231, at *10 (S.D. Cal. Sept. 8, 2022) (same). Here, no answer has been filed, Plaintiffs have filed an amended complaint, and Salesforce raises new arguments it didn't previously raise. Salesforce may assert these new defenses not previously presented to the Court.
Furthermore, certain district courts have entertained post-answer motions to dismiss amended complaints for the purpose of judicial economy or based on distinguishing factors. Best Fresh LLC v. Vantaggio Farming Corp., No. 21-cv-00131-BEN-WVG, 2022 WL 4112231, at *6 (S.D. Cal. Sept. 8, 2022).
What the Court says here should not be construed as license simply to reassert arguments the Court previously rejected, unless the arguing party has new, controlling authority decided after the Court's initial order.
B. CIPA
1. Section 631
CIPA Section 631 creates liability in four circumstances:
(1) where a person “by means of any machine, instrument, or contrivance, or in any other manner, intentionally taps, or makes any unauthorized connection . . . with any telegraph or telephone wire, line, cable, or instrument”;
(2) where a person “willfully and without consent of all parties to the communication, or in any unauthorized manner, reads, or attempts to read, or to learn the contents or meaning of any message, report, or communication while the same is in transit or passing over any wire, line, or cable, or is being sent from, or received at any place within this state”;
(3) where a person “uses, or attempts to use, in any manner, or for any purpose, or to communicate in any way, any information so obtained”; and
(4) where a person “aids, agrees with, employs, or conspires with
any person or persons to unlawfully do, or permit, or cause to be done any of the acts or things mentioned above.”Javier v. Assurance IQ, LLC, 649 F.Supp.3d 891, 897 (N.D. Cal. 2023) (quoting Cal. Penal Code § 631(a)). In addition, a plaintiff must show that the third party “ha[s] the capability to use its record of the interaction for any other purpose.” Id. at 900.
Salesforce's motion to dismiss challenges whether Plaintiffs have shown that (1) Salesforce has the “capability to use its record of the interaction for any other purpose”; and (2) Salesforce reads the messages “in transit” under Section 631(a)(2).
a. Capability To Use Communications for Other Purposes
The Court previously dismissed Plaintiffs' Section 631 claim because Plaintiffs' “allegations [did not] support a reasonable inference that Salesforce ha[d] the capability to use these communications for any purpose other than furnishing them to [customer websites].” ECF No. 35 at 9.
Plaintiffs have now amended their complaint to allege that Salesforce sends the chat communications to “Salesforce's Einstein data intelligence platform” to “train the AI models that form the basis of some of its services.” ECF No. 43 ¶ 26. Plaintiffs add that “Salesforce has the capability to use Chat communications to (i) improve Salesforce's own products and services; (ii) develop new Salesforce products and services; and (iii) analyze Chat communications to assist with customer service interactions and data analytics.” Id. ¶ 28. Salesforce disagrees with Plaintiffs' characterization of these tools as a factual matter, but concedes that Plaintiffs have now sufficiently alleged that Salesforce “has the capability to use [Chat] communications for [] purpose[s] other than furnishing them to Kaiser.” ECF No. 44 at 15.
Because Plaintiffs have properly alleged that Salesforce has the ability to use its record of the interaction for other purposes beyond just furnishing them to customer websites, the Court finds that Plaintiffs have alleged sufficient facts to meet the plausibility requirement. Knievel, 393 F.3d at 1072 (9th Cir. 2005).
b. Interception of Communications “In Transit”
Every clause of Section 631(a) has three requirements in common: “(1) the absence of consent; (2) the party exception; and (3) the ‘while . . . in transit' requirement.” Valenzuela v. Keurig Green Mountain, Inc., 674 F.Supp.3d 751, 756 (N.D. Cal. 2023) (citing Cal. Penal Code § 631(a)). Salesforce asserts that Plaintiffs fail to state a claim because the communications “are not read ‘in transit' and are by definition outside the scope of [S]ection 631(a).” ECF No. 44 at 14. That is, Salesforce argues that the “data transmitted (containing the typed Chat text) can be read only after arriving at Salesforce's servers-not while they are in transmission.” Id. (emphasis in original). Plaintiffs respond that Salesforce's servers provide “transient electronic storage that is intrinsic to the communication,” but such transient storage still means that communications are intercepted “in transit.” ECF No. 45 at 13-15. Salesforce replies that electronic signals sent over the internet must arrive on Salesforce's server before computer systems can interpret and display the typed text and therefore cannot be intercepted “in transit.” ECF No. 46 at 12-13. At its core, Salesforce's argument is that it has not “intercepted” communications because it was both the intended destination server of the communications and the transient server “before computer systems [could] interpret and display the typed text.” Id.
Although Plaintiffs respond that chat messages are in transient storage, ECF No. 45 at 14-15, this argument is not responsive to Salesforce's contention. Salesforce's argument is that regardless of whether the chat messages are transient (i.e., incidental to the sending of the message) or permanent, the Salesforce server is the only server that is used in the transmission of these chats, and therefore Salesforce could not intercept such communications. However, as the Court concludes, Salesforce was not the intended recipient, even if its server was the only server involved in receiving the messages.
The cases cited by Salesforce, however, do not support its argument. In the first set of cases, the messages were clearly in digital storage and therefore were not simultaneously or contemporaneously intercepted. See Konop v. Hawaiian Airlines, Inc., 302 F.3d 868, 878 (9th Cir. 2002) (finding no interception where messages were retrieved from bulletins and postings on a secure website); see also Theofel v. Farey-Jones, 359 F.3d 1066, 1077 (9th Cir. 2004) (addressing copies of e-mails transmitted in the past retained by the internet service provider). In the second set of cases, the communications were considered not “in transit” because the defendant gained access after receipt by the intended recipient. See Adler v. Community.com, Inc., No. 2:21-cv-02416-SBJPR, 2021 WL 4805435, at *4 (C.D. Cal. Aug. 2, 2021) (finding that CIPA Section 631 claim failed because plaintiff alleged defendant gained access to plaintiff's text “upon the completion of its transmission to the proper number”); Swarts v. Home Depot, Inc., 689 F.Supp.3d 732, 746 (N.D. Cal. 2023) (finding that plaintiffs allegations that “online traffic occurs between the customer's browser and several liveperson.net subdomains” “does not indicate when the interception occurs . . . [and] does not dispel the notion that LivePerson receives the information after the chat reaches Home Depot.”); see also Martin v. Sephora USA, Inc., No. 22-cv-01355-JLT-SAB, 2023 WL 2717636, at *10 (E.D. Cal. Mar. 30, 2023), report and recommendation adopted, No. 22-cv-01355-JLT-SAB, 2023 WL 3061957 (E.D. Cal. Apr. 24, 2023) (dismissing plaintiffs' Section 631(a) claim because the allegations in the complaint stated that defendant (Sephora) “records and creates transcripts of the chats, which Hubspot/Salesforce is then permitted to access,” and plaintiffs failed to make any non-conclusory allegations about how the transcripts are intercepted simultaneously by Hubspot/Salesforce.)
Those are not the allegations here. First, Salesforce does not argue that chat messages to and from Rite-Aid and Kaiser websites reside in long-term storage on Salesforce's servers. Second, notwithstanding Salesforce's arguments to the contrary, Salesforce is not the intended recipient. Salesforce conflates Section 631(a)'s requirement of receipt by the intended recipient with receipt by the destination server. These are not the same thing. “[T]he crucial question under § 631(a)'s second clause is whether [a plaintiff] has plausibly alleged that [the defendant] read one of his communications while it was still in transit, i.e., before it reached its intended recipient.” Mastel v. Miniclip SA, 549 F.Supp.3d 1129, 1137 (E.D. Cal. 2021) (emphasis added).
Salesforce's argument is identical to one recently rejected in Lopez v. Apple, Inc., 519 F.Supp.3d 672, 683 (N.D. Cal. 2021). In Lopez, plaintiffs brought a putative consumer class action against Apple for violating the CIPA when Siri intercepted and disclosed “private discussions between doctors and patients, confidential business deals, and sexual encounters.” Id. at 679. Plaintiffs alleged “that they did not intend Apple to receive their private communications, but that Apple ‘captured' such communications using the software in their devices.” Id. at 683. Like Salesforce, Apple argued “that it ha[d] not ‘intercepted' communications because it was the intended recipient of the communications.” Id. The Court disagreed and held that plaintiffs sufficiently alleged interception. Id.
Here too, Plaintiffs have alleged that the intended recipient of communications concerning medical conditions, insurance information, and prescription history, ECF No. 43 ¶¶ 31-34, are Plaintiffs' doctors and pharmacists, respectively-not Salesforce. Lopez, 519 F.Supp.3d at 683. While the information was routed through Salesforce's server, the “intended recipients” were Rite Aid and Kaiser. Id. The reasonable inference here, because Salesforce “apparently receives the chat messages either before or simultaneously with” its clients--the intended recipients, is that Salesforce intercepts these messages. D'Angelo v. Penny OpCo, LLC, No. 23-cv-0981-BAS-DDL, 2023 WL 7006793, at *8 (S.D. Cal. Oct. 24, 2023).
In light of this conclusion, the Court need not reach Plaintiffs' alternative argument that Salesforce could satisfy the “in transit” requirement of Section 631(a) by “caus[ing] Plaintiff Magpayo's California-based chat communications to be directly routed to Salesforce's servers in California.” ECF No. 45 at 15.
Salesforce's motion to dismiss Plaintiffs' Section 631 claim is therefore denied.
2. Section 632
CIPA Section 632 imposes liability against a “person who, intentionally and without the consent of all parties to a confidential communication, uses an electronic amplifying or recording device to eavesdrop upon or record the confidential communication, whether the communication is carried on among the parties in the presence of one another or by means of a telegraph, telephone, or other device, except a radio.” Cal. Pen. Code § 632(a).
Salesforce argues that Plaintiffs fail to allege a Section 632 claim for two reasons: (1) Plaintiffs cannot show that their communications are confidential; and (2) Plaintiffs cannot show that the software in this case is a “device” under the statutory language. ECF No. 44 at 16-18.
a. Confidentiality of Communication
Salesforce argues that its “previous argument against CIPA § 632 focused on the likelihood chats would be ‘shared' or ‘disclosed,'” whereas now, it argues that Plaintiffs' Section 632 claim must fail because the communications are not “confidential” under the plain text of the statute because they can be recorded by others. ECF No. 46 at 15 (citing Cal. Pen. Code § 632(c)). There is little daylight between these arguments, and the new argument fares no better than the old.
The CIPA defines a “confidential communication” as “any communication carried on in circumstances as may reasonably indicate that any party to the communication desires it to be confined to the parties thereto, but excludes a communication made . . . in any other circumstance in which the parties to the communication may reasonably expect that the communication may be overheard or recorded.” Cal. Pen. Code § 632(c).
The Court determines the meaning of “confidential communication” using traditional tools of statutory interpretation. “The first and most important canon of statutory construction is the presumption ‘that a legislature says in a statute what it means and means in a statute what it says there.'” In re Pangang Grp. Co., Ltd., 901 F.3d 1046, 1056 (9th Cir. 2018) (quoting Conn. Nat'l Bankv. Germain, 503 U.S. 249, 253-254 (1992)). The Court “starts with the plain statutory text and, ‘when deciding whether the language is plain, . . . must read the words in their context and with a view to their place in the overall statutory scheme.'” Altera Corp. & Subsidiaries v. Comm'r of Internal Revenue, 926 F.3d 1061, 1075 (9th Cir. 2019) (quoting King v. Burwell, 576 U.S. 473, 486 (2015)).
The California Supreme Court has interpreted the language of Section 632 as follows:
the first clause includes within the statutory protection any conversation under circumstances showing that a party desires it not to be overheard or recorded. The second clause then excludes a conversation under circumstances where the party reasonably believes it will be overheard or recorded. Under this construction, the two clauses of section 632 do not conflict nor leave any uncertainty; they act together in harmony to prohibit unconsented-to eavesdropping or recording of conversations regardless of whether the party expects that the content of the conversation may later be conveyed to a third party.Flanagan v. Flanagan, 27 Cal.4th 766, 774-775 (2002) (citing Cal. Pen. Code § 632(c)). Following this holding, the question then becomes, what were the parties' reasonable expectations about confidentiality? See Brown v. Google LLC, 685 F.Supp.3d 909, 937 (N.D. Cal. 2023) (“the inquiry is whether ‘any party to the communication desires it to be confined to the parties thereto.' [This] is a fact-intensive inquiry.”) (internal citation omitted).
In California, courts have developed a presumption that Internet communications do not reasonably give rise to an expectation of confidentiality, and plaintiffs must “show[] that there is something unique about these particular internet communications which justify departing from the presumption.” In re Meta Pixel Healthcare Litig., 647 F.Supp.3d 778, 799 (N.D. Cal. 2022). In its prior order, however, the Court determined that Plaintiffs did “show something unique”, which was the context of the communications:
Plaintiffs respond that Magpayo maintained a reasonable expectation of confidentiality because she communicated information related to her prescription history, medical conditions, and insurance information to the customer service agents in a healthcare context. ECF No. 28 at 23. The Court agrees with Plaintiffs that the context of these communications renders them confidential.ECF No. 35 at 10.
Nothing has changed since the Court's prior order. Once again, “Salesforce cites no authority for the proposition that communications with a health care provider must occur with only certain of its agents or employees to be confidential, or that such communications are not confidential if conducted with a customer support worker.” Id. at 11. Accordingly, “[t]he Court [again] rejects Salesforce's argument and concludes that Magpayo's communications were ‘confidential' within the meaning of Section 632.” Id.
b. Chat API Software is a “Device”
Salesforce next argues that Plaintiffs' Section 632 claim fails because Plaintiffs do not sufficiently allege that Salesforce used a “device” to intercept Plaintiffs' communications. ECF No. 44 at 17-18.
“CIPA does not define ‘device,' and few courts have squarely addressed the issue.” Gladstone v. Amazon Web Servs., Inc., No. 2:23-CV-00491-TL, 2024 WL 3276490, at *7 (W.D. Wash. July 2, 2024). The Court agrees with those Ninth Circuit district court decisions that have found that software qualifies as a device under Section 632. Id. at *8 (“‘device,' as used in Section 632, can include software”); Doe v. Meta Platforms, Inc., 690 F.Supp.3d 1064, 1080 (N.D. Cal. 2023) (holding that “Pixel software is a device under Section 632(a)”).
The Court is aware of Doe v. Microsoft Corp., No. C23-0718-JCC, 2023 WL 8780879 (W.D. Wash. Dec. 19, 2023), which held that “[b]ecause software does not constitute a ‘device' under the CIPA, Plaintiff's § 632 claim against Microsoft is deficient.” Id., at *8. However, Doe v. Microsoft Corp. relied on In re Google Location Hist. Litig., 428 F.Supp.3d 185, 193 (N.D. Cal. 2019) and Moreno v. San Francisco Bay Area Rapid Transit Dist., 2017 WL 6387764 (N.D. Cal. 2017). Those cases both involved Penal Code Section 637.7 and are distinguishable on that basis. Doe v. Meta Platforms, 690 F.Supp.3d at 1080.
The Court finds these cases persuasive for at least two reasons. First, where the Legislature has failed to define a term specifically, and the parties offer no legislative history that would shed light on the question, “our best approach is to construe the statutory language in accordance with its purpose.” Burroughs v. Operating Engineers Loc. Union No. 3, 686 F.2d 723, 727 (9th Cir. 1982). “In enacting [CIPA], the Legislature declared in broad terms its intent ‘to protect the right of privacy of the people of this state' from what it perceived as ‘a serious threat to the free exercise of personal liberties [that] cannot be tolerated in a free and civilized society.'” Ribas v. Clark, 38 Cal.3d 355, 359 (1985) (citing Cal. Pen. Code § 630). In so doing, the Legislature recognized “that advances in science and technology have led to the development of new devices and techniques for the purpose of eavesdropping upon private communications and that the invasion of privacy resulting from the continual and increasing use of such devices and techniques has created a serious threat to the free exercise of personal liberties and cannot be tolerated in a free and civilized society.” Cal. Pen. Code § 630. Thus, the Legislature itself evinced a desire that the CIPA's statutory protections should extend across the developing field of technology. Furthermore, “the California Supreme Court has also emphasized that all CIPA provisions are to be interpreted in light of the broad privacy-protecting statutory purposes of CIPA.” Javier v. Assurance IQ, LLC, No. 21-16351, 2022 WL 1744107, at *2 (9th Cir. May 31, 2022) (first citing Ribas, 38 Cal.3d at 359-62; then Smith v. LoanMe, Inc., 11 Cal. 5th 183, 199200 (2021)).
The Court recognizes that this case is not binding precedent under Ninth Circuit Rule 36-3 but nonetheless relies on it as persuasive authority.
Second, the Court looks to cases construing the word “device” in the federal Wiretap Act, 18 U.S.C. § 2510 et seq., because “[t]he analysis for a violation of CIPA is the same as that under the federal Wiretap Act.” Brodsky v. Apple Inc., 445 F.Supp.3d 110, 127 (N.D. Cal. 2020) (citation and quotation omitted). “The majority of courts to consider this issue have entertained the notion that software may be considered a device for the purposes of the Wiretap Act.” United States v. Hutchins, 361 F.Supp.3d 779, 795 (E.D. Wis. 2019) (citing cases). That includes courts within this district. See In re Carrier IQ, Inc., 78 F.Supp.3d 1051, 1087 (N.D. Cal. 2015) (“Carrier IQ Software is an ‘[e]lectronic, mechanical, or other device' which ‘can be used to intercept a wire, oral, or electronic communication” pursuant to the federal Wiretap Act).
The Court therefore denies Salesforce's motion to dismiss Plaintiffs' CIPA Section 632 claims and finds that Plaintiffs have plausibly alleged that Chat API software is a “device.”
C. WESCA
In its first motion to dismiss, Salesforce raised four WESCA arguments: (1) that Plaintiff Yockey failed to allege that Salesforce intercepted his chat; (2) that the WESCA exempts Chat from its definition of “electronic, mechanical or other device”; (3) that Yockey's allegations do not establish that his communications were rerouted contemporaneously with transmission; and (4) that two of WESCA's exceptions to liability apply to Salesforce's conduct. ECF No. 23. The Court rejected all four arguments. ECF No. 35 at 12-15.
Salesforce now brings a different argument challenging Yockey's WESCA claim. Salesforce argues that Yockey “impliedly consented to the recording of his chat conversation” because he knew or should have known the conversation was being recorded, defeating his wiretap claim under WESCA. ECF No. 44 at 23. That is, Salesforce argues that it is the “chat box user's expectation of recording that matters--not who allegedly does the recording.” ECF No. 46 at 21. Plaintiffs respond that “Defendant has cited no case that stands for the proposition that users who send written communications impliedly consent to interceptions and use of their communications by third parties other than the intended recipient.” ECF No. 45 at 21.
The WESCA permits interception “where all parties to the communication have given prior consent to such interception.” 18 Pa. Cons. Stat. § 5704(4). “Prior consent, including implied consent, can be demonstrated when the person being recorded knew or should have known [ ] that the conversation was being recorded.” Popa v. Harriet Carter Gifts, Inc., 52 F.4th 121, 132 (3d Cir. 2022) (internal citation and quotation marks omitted). In the case of websites, this turns on whether the website's communications with the user-for example, by displaying its privacy policy-adequately alerted a reasonable person that a third-party might intercept the recorded communications. Oliver v. Noom, Inc., No. 2:22-CV-1857, 2023 WL 8600576, at *9 (W.D. Pa. Aug. 22, 2023) (finding that Defendants did not show that Plaintiffs “knew or should have known” that their activity on Noom's website was being recorded prior to allegedly being wiretapped.); see also Vonbergen v. Liberty Mut. Ins. Co., No. CV 22-4880, 2023 WL 8569004, at *13 (E.D. Pa. Dec. 11, 2023) (finding that although plaintiff “may have consented to Liberty Mutual recording her personal information inputted into the website, she has plausibly alleged that she was not aware Liberty Mutual had procured an undisclosed third party to intercept that information too.”). Here, there is no allegation that Rite Aid or Kaiser tells website users that Salesforce might record their communications.
Salesforce's authority is distinguishable. First, Salesforce relies on Commonwealth v. Proetto for the principle that “there is no expectation of privacy in written electronic communications, because it is understood that any such message, is by its very nature, recorded.” ECF No. 44 at 22; see also ECF No. 46 at 21. However, as the Proetto court explains, “[a]ny reasonably intelligent person, savvy enough to be using the Internet, however, would be aware of the fact that messages are received in a recorded format, by their very nature, and can be downloaded or printed by the party receiving the message.” Com. v. Proetto, 771 A.2d 823, 829 (Pa. Super. Ct. 2001), aff'd, 575 Pa. 511 (Pa. 2003) (emphasis added). Proetto is distinguishable from the instant case because while Plaintiffs may have been aware that the “party receiving the message”-i.e., Rite Aid and Kaiser Permanente were receiving the communications in a “recorded format”-they had not consented to an undisclosed third party intercepting the message.
None of Salesforce's other Pennsylvania cases involve an undisclosed third-party. Proetto, 771 A.2d at 826 (finding that where the messages were sent directly to a minor, and the minor then forwarded the messages to a detective, there was no interception because the detective's acquisition of the communications was not contemporaneous with their transmission); Com. v. Diego, 119 A.3d 370, 380-81 (Pa. Super. Ct. 2015) (where the recipient of a text message relayed the message to the police, court concluded that there was no interception because the recipient “control[ed] the destiny of the content of that message once it [was] received.”); Com. v. Cruttenden, 619 Pa. 123, 132 (Pa. 2012) (finding no interception even where “officer shields or misrepresents his or her identity, because the caller elects to talk to the officer who answered the phone” and so the officer was the intended recipient of the communications).
With regard to communications received directly by the detective when he posed as an underage female, the Proetto court found no violation of the Wiretap Act because he was party to the conversation. Proetto, 771 A.2d at 832. Furthermore, under the WESCA, the term interception, does “not include the acquisition of the contents of a communication made . . . to an investigative or law enforcement officer[.]” Diego, 119 A.3d at 380-81.
The remaining question is whether Yockey sufficiently alleges a lack of consent. Plaintiffs allege that Salesforce's recording “begins the moment a user accesses or interacts with the Chat feature on the Website, prior to a user consenting to any sort of privacy policy or the wiretaps generally,” and that users are not told “prior to being wiretapped, that their electronic communications are being simultaneously directed to Salesforce, as opposed to just the Website customer service agent.” ECF No. 43 ¶ 31 (emphasis added). Yockey also alleges that “users, including Plaintiffs, are thus not on notice of any wiretapping when they begin a Chat interaction, nor do they provide their prior consent to the same.” Id. ¶ 32. Furthermore, Pennsylvania district courts have held that “whether Plaintiffs gave consent to disclosure under the PA Wiretapping Act would appear to be factual in nature--involving issues of factual dispute and interpretation,” and accordingly this Court finds that it is “appropriate to defer ruling on questions about whether Plaintiffs gave consent until after the Parties engage in discovery and develop the factual record.” Braun v. Philadelphia Inquirer, LLC, No. 22-CV-4185-JMY, 2023 WL 7544160, at *5 (E.D. Pa. Nov. 13, 2023).
The Court denies Salesforce's motion to dismiss Plaintiffs' WESCA claims because Plaintiffs have plausibly alleged that they did not consent to interceptions by an undisclosed third party.
D. Extraterritorial Application of CIPA
The CIPA contains express geographical limitations. Cal. Pen. Code § 631. Section 631 provides for liability where a person “willfully and without the consent of all parties to the communication, or in any unauthorized manner, reads, or attempts to read, or to learn the contents or meaning of any message, report, or communication while the same is in transit or passing over any wire, line, or cable, or is being sent from, or received at any place within this state.” Id. (emphasis added).
In its motion, Salesforce argued that the CIPA does not apply to Plaintiff Yockey and nonresident members of the putative nationwide class because: (i) non-residents fall outside the CIPA's stated legislative purpose of protecting the privacy interests of California citizens; (ii) Yockey fails to allege a sufficient California nexus; and (iii) California's choice-of-law rules preclude application of California law to Yockey and other non-residents. ECF No. 44 at 18-21. In their opposition, Plaintiffs voluntarily withdrew their CIPA Sections 631(a) and 632 claims on behalf of the Nationwide Website Class without prejudice but did not withdraw Plaintiff Magpayo's individual claims or those of the California website class and Kaiser subclass. ECF No. 45 at 8 n.1. Salesforce argues that these remaining CIPA claims still impermissibly require extraterritorial application because “the California subclass-unlike the Kaiser subclass-is not limited to use of websites at issue while putative subclass members were ‘in California.'” ECF No. 46 at 8 n.1.
The California Website Class is “a class of all California residents who used Salesforce's Chat function on any Website,” and the Kaiser Subclass is “a subclass of all California residents who used Salesforce's Chat function on Kaiser Permanente's website while in California.” ECF No. 43 ¶¶ 40, 43. Plaintiffs have also pleaded that “each communication by Plaintiff Magpayo and California Website Class and Kaiser Subclass Members was sent from California and received by Salesforce in California.” Id. ¶ 68. These allegations are sufficient to establish a prima facie case that the communication falls within the ambit of Section 632. Knievel, 393 F.3d at 1072 (9th Cir. 2005). Accordingly, the Court denies Salesforce's motion to dismiss on extraterritoriality because Plaintiffs have plausibly alleged that the conduct at issue occurred in California.
CONCLUSION
For the foregoing reasons, Salesforce's motion to dismiss is denied.
IT IS SO ORDERED.