Opinion
23-cv-0981-BAS-DDL
10-24-2023
NOELLE D'ANGELO and ANTHONY D'ANGELO, individually and on behalf of all others similarly situated, Plaintiffs, v. PENNY OPCO, LLC, d/b/a JCPENNEY, Defendant.
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT'S MOTION TO DISMISS (ECF NO. 9)
Hop; Cynthia Bashant, United States District Judge
This action is one in a series of consumer privacy actions sweeping California as advocates attempt to crack down on consumer privacy issues brought on by today's digital age. Plaintiffs Noelle D'Angelo and Anthony D'Angelo (collectively, “Plaintiffs”) commenced this lawsuit against Penney OpCo, LLC (“JC Penney” or “Defendant”) pursuant to California statutory and common-law privacy claims. Plaintiffs allege, on behalf of themselves and a putative class, that Defendant violated state law by permitting at least one third party, Vergic, to intercept and analyze Plaintiffs' and class members' online chats with Defendant's customer service representatives via the Defendant's website.
Plaintiffs' suit brings claims against Defendant for violations of Sections 631(a) and 632.7 of the California Invasion of Privacy Act (“CIPA”), Cal. Penal Code §§ 63038, California's Unfair Competition Law (“UCL”), Cal. Bus. & Prof. Code § 17200 et seq., and the California Constitution, Cal. Const. art. I, § 1.
Presently before the Court is Defendant's motion to dismiss Plaintiffs' Complaint. (Mot., ECF No. 9.) Defendant bases its motion on Plaintiffs' lack of standing and failure to state a claim. (Id.) JC Penney argues that Plaintiffs do not allege an injury sufficient to show standing and do not plausibly allege a claim upon which relief may be granted. (Id.) Plaintiffs oppose. (Resp., ECF No. 11.)
The Court finds this motion suitable for determination on the papers submitted and without oral argument. See Fed.R.Civ.P. 78(b); Civ. L.R. 7.1(d)(1). For the reasons that follow, the Court GRANTS IN PART and DENIES IN PART Defendant's motion to dismiss for lack of standing and failure to state a claim.
The facts are taken from Plaintiffs' Complaint (ECF No. 1), to which the presumption of truth attaches for the instant Motion. See, e.g., Manzarek v. St. Paul Fire & Marine Ins. Co., 519 F.3d 1025, 1031 (9th Cir. 2008) (holding that in evaluating a complaint on a motion to dismiss, the court “accept[s] factual allegations in the complaint as true and construe[s] the pleadings in the light most favorable to the nonmoving party”).
JC Penney, a Texas-based retailer, owns and operates www.JCPenney.com (the “Website”), on which it sells products. (Compl., ECF No. 1, at 1:5.) Embedded in the code of the Website is a code written by third-party Vergic, which “automatically records and creates transcripts of all” conversations users have on Defendant's Website chat feature. (Compl., ECF No. 1, ¶12.)
Allegedly, this code “directs [chat] communications to be routed directly to Vergic” because “Vergic's chat service is an Application Programming Interface . . . that is ‘plugged into' the Website.” (Compl., ECF No. 1, ¶13.) Even though “the chat function is run from Vergic's servers [it] allows for chat functionality on the Website. In other words, Vergic runs the chat service from its own servers, but consumers interact with the chat service on Defendant's Website, so it appears they are only communicating with a company representative of Defendant.” (Compl., ECF No. 1, ¶ 13.)
Therefore, when chatting with a Defendant customer service representative via the Website chat feature, each message sent by a user “is first routed through Vergic's server” where Vergic may “analyze, interpret, and collect customer-support agent interactions in real time to create live transcripts of communications as they occur.” (Compl., ECF No. 1, ¶ 14.) Vergic “analyze[s], interpret[s], and collect[s] customer support agent interactions,” (Id.), using the data to “enable [businesses and public organizations] to proactively and in realtime [sic] create valuable connections with their online visitors through personalized and relevant dialogues which boosts online sales, reduces service costs, increases customer satisfaction and exceeds the customer's expectations,” (Id. ¶ 17).
At some point during the statute of limitations period, Plaintiffs, who are residents and citizens of California (Compl., ECF No. 1, ¶ 4), visited the Website (Id. ¶ 23). Allegedly, they did so using “smart phones . . . and/or wifi-enabled tablets and laptops.” (Id.) In visiting the Website, Plaintiffs allege they “engaged with the ‘chat' feature . . . to communicate with Defendant.” (Id.) Plaintiffs do not share the nature or content of their messages on the chat feature; yet, they allege that “[g]iven the nature of Defendant's business, visitors often share highly sensitive personal data with Defendant via the Website's chat feature.” (Id. ¶ 21.)
Users of the Website chat feature, such as Plaintiffs, are not aware of Defendant's practice of routing all chats through Vergic. This is because Defendant does not disclose Vergic's, or any other third party's, listening in on or recording of communications users have with Defendant's customer service representatives via the Website chat feature. (Id. ¶¶ 15, 25-27.) Moreover, users do not have the opportunity to, nor did Plaintiffs in this case, expressly consent to this practice. (Id. ¶¶ 15, 28, 47.)
II. LEGAL STANDARDS
A. Standing
To bring a case in federal court, Plaintiffs must show they have standing. This requirement ensures the court is hearing an actual case or controversy, as required by Article III of the United States Constitution. Spokeo, Inc. v. Robins, 578 U.S. 330, 33738 (2016). In a putative class action at the motion-to-dismiss phase, such as in the instant case, the court examines the standing of the putative class representatives. Id. at 338 n.6.
To successfully plead standing, Plaintiffs must show a number of things, In re Zappos.com, Inc., 888 F.3d 1020, 1024 (9th Cir. 2018), but only one is at issue here: whether Plaintiffs have suffered an injury in fact. To allege an injury in fact, the injury must be “an invasion of a legally protected interest which is (a) concrete and particularized, . . . and (b) actual or imminent, not conjectural or hypothetical.” Lujan v. Defs. of Wildlife, 504 U.S. 555, 560 (1992) (citations omitted). “The most obvious [concrete injuries] are traditional tangible harms, such as physical harms and monetary harms.” Trans Union LLC v. Ramirez, 141 S.Ct. 2190, 2204 (2021). Violation of the right to privacy serves as one of these traditional tangible harms because it has “long been actionable at common law.” Eichenberger v. ESPN, 876 F.3d 979, 983 (9th Cir. 2017).
B. Rule 12(b)(6) Motion to Dismiss
Pursuant to Rule 12(b)(6), a defendant may move to dismiss an action for failure to allege sufficient factual allegations to “state a claim to relief that is plausible on its face.” Bell Atlantic v. Twombly, 550 U.S. 544, 570 (2007) (citations omitted). In evaluating the sufficiency of these factual allegations, the court “accept[s] factual allegations in the complaint as true and construe[s] the pleadings in the light most favorable to the non moving party.” Manzarek v. St. Paul Fire & Marine Ins. Co., 519 F.3d 1025, 1031 (9th Cir. 2008).
However, the court is not required to “assume the truth of legal conclusions merely because they are cast in the form of factual allegations.” Fayer v. Vaughn, 649 F.3d 1061, 1064 (9th Cir. 2011) (citations omitted). Mere “conclusory allegations of law and unwarranted inferences are insufficient to defeat a motion to dismiss.” Adams v. Johnson, 355 F.3d 1179, 1183 (9th Cir. 2004) (internal citations omitted); accord Ashcroft v. Iqbal, 556 U.S. 662, 663-64 (2009).
III. ANALYSIS
A. Standing
In evaluating the pleadings at the motion-to-dismiss stage to determine whether a plaintiff has alleged an injury sufficient to confer standing, the court must first determine if the attack on standing is a facial or a factual one. See Safe Air for Everyone v. Meyer, 373 F.3d 1035, 1039 (9th Cir. 2004). Here, Defendant has raised a facial attack because it “asserts that the allegations contained in [the] complaint are insufficient on their face to invoke federal jurisdiction” as opposed to disputing “the truth of the allegations themselves.” Id. In a facial attack, the court applies the same analysis as for a motion to dismiss under Rule 12(b)(6): “Accepting the plaintiff's allegations as true and drawing all reasonable inferences in the plaintiff's favor, the court determines whether the allegations are sufficient as a legal matter to invoke the court's jurisdiction.” Leite v. Crane Co., 749 F.3d 1117, 1121 (9th Cir. 2014) (citations omitted).
For three of the four claims, Plaintiffs assert one type of harm: invasion of privacy. For this, they seek three types of remedy: declarative relief, injunctive relief, and damages. Claim Three, brought under the UCL, contains its own standing requirements, which the Court addresses below.
1. Nature of the Harm: Invasion of Privacy
Plaintiffs root their standing in a harm to privacy. Defendant responds that Plaintiffs' harm is not sufficiently concrete to confer standing because Plaintiffs “do not allege that they suffered any harm as a result of the alleged recording; do not allege that they disclosed any sensitive information to JC Penney; or identify any specific personal information they disclosed.” (Mot., ECF No. 9, at 5:23-28.) Therefore, the Court addresses whether the alleged invasion of privacy is a sufficiently concrete harm that may confer standing under Article III.
Certain torts, like the “disclosure of private information,” result in “intangible” but concrete harms. Transunion, 141 S.Ct. at 2204. However, standing for privacy rights may vary depending on whether the statute at issue codifies substantive or procedural privacy rights. Where a statute codifies procedural rights, their violation “would not invariably injure a concrete interest.” Eichenberger, 876 F.3d at 982 (citing Robins v. Spokeo, Inc., 867 F.3d 1108, 1114 (9th Cir. 2017)). In contrast, violation of a statute that codifies a “substantive right to privacy” constitutes a concrete harm. See 876 F.3d at 983. In such a case, the violation of the statue itself makes a defendant liable. Id.
To determine whether a statute codifies a substantive or procedural right to privacy, and thus whether an injury is sufficiently concrete, courts are “guided in determining concreteness by both history and the judgment of Congress, or the legislature that enacted the statute.” Campbell v. Facebook, Inc., 951 F.3d 1106, 1116 (9th Cir. 2020) (citations omitted). The Ninth Circuit has found that CIPA and the California Constitution's right to privacy codify substantive rights to privacy. In re Facebook, Inc. Internet TrackingLitig., 956 F.3d 589, 598 (9th Cir. 2020); Campbell, 951 F.3d at 111718. Therefore, Plaintiffs have Article III standing for Claims One, Two, and Four if they sufficiently allege Defendant violated CIPA and the California Constitution's right to privacy.
2. Nature of the Remedy
Having found Plaintiffs allege a concrete injury, the Court examines if they also plead sufficient facts for relief.
Declarative and Injunctive Relief. Plaintiffs seek injunctive relief, specifically, an order “enjoining Defendant's conduct as alleged herein.” (Compl. at 15:4.) Plaintiffs also seek declarative relief. (Id. at 15:1.) To establish standing for prospective injunctive relief, a plaintiff must demonstrate “continuing, present adverse effects.” City of Los Angeles v. Lyons, 461 U.S. 95, 102 (1983) (citations omitted). Similarly, to establish standing for declarative relief, “Plaintiff must establish an ongoing or future injury that is certainly impending.” Ctr. for Biological Diversity v. Bernhardt, 442 F.Supp.3d 97, 111 (D.D.C. 2020) (citations omitted), aff'd sub nom. Ctr. for Biological Diversity v. Haaland, 849 Fed.Appx. 2 (D.C. Cir. 2021). To show these “continuing, present adverse effects,” a plaintiff must show that he “‘has sustained or is immediately in danger of sustaining some direct injury' as the result of the challenged official conduct and the injury or threat of injury must be both ‘real and immediate,' not ‘conjectural' or ‘hypothetical.'” Lyons, 461 U.S. at 101-02 (citations omitted).
While Plaintiffs sufficiently allege past injury (which entitles them to damages), they do not allege a real and immediate threat of future injury, nor an ongoing injury, so as to make a case for declaratory and injunctive relief. Plaintiffs do not allege they intend to continue to use the Website and thus, as in Lujan, there is no threat of imminent future injury. Compare Lujan, 504 U.S. at 564 (holding that, without alleging concrete plans to visit an area endangered by the challenged policy, the plaintiffs did not successfully allege an imminent injury) with (Compl., ECF No. 1 (including no allegation that Plaintiffs have plans to use the JC Penney Website chat feature in the future).) Therefore, Plaintiffs do not sufficiently allege standing for declaratory and injunctive relief.
Damages. The California legislature has created statutory damages for each violation of CIPA, with “no separate showing of injury aside from a violation of the privacy rights protected by CIPA” required. Ades v. Omni Hotels Mgmt. Corp., 46 F.Supp.3d 999, 1018 (C.D. Cal. 2014). Therefore, if Plaintiffs plausibly allege at this stage that Defendant has violated provisions of CIPA, Plaintiffs plausibly allege standing for damages.
Similarly, a court may award damages for violation of the California Constitution, Article I, Section 1. See Sanchez-Scott v. Alza Pharms., 103 Cal.Rptr.2d 410, 417 (Cal.Ct.App. 2001). Therefore, if Plaintiffs plausibly allege Defendant violated the California Constitution, they plausibly allege standing for damages for that violation.
3. Standing under the UCL
Standing under the UCL is “substantially narrower than federal standing under Article III, Section 2 of the United States Constitution, which may be predicated on a broader range of injuries.” Kwikset Corp. v. Superior Ct., 51 Cal.4th 310, 324 (Cal. 2011). Section 17204 of California's UCL grants standing to bring suits under the UCL by “a person who has suffered injury in fact and has lost money or property as a result of the unfair competition.” Cal. Bus. & Prof. Code § 17204. A UCL plaintiff must “(1) establish a loss or deprivation of money or property sufficient to qualify as injury in fact, i.e., economic injury, and (2) show that economic injury was the result of, i.e., caused by, the unfair business practice or false advertising that is the gravamen of the claim.” Kwikset, 246 P.3d at 885.
In In re Facebook, Inc. Internet Tracking Litigation, the Ninth Circuit held that the plaintiffs had sufficiently alleged users' browsing histories carried financial value and thus users were entitled to Facebook's profits from users' personal data. 956 F.3d 589, 600-01 (9th Cir. 2020). In that case, the plaintiffs pointed to “the existence of a study that values users' browsing histories at $52 per year, as well as research panels that pay participants for access to their browsing histories” to support their claims of economic injury. Id. at 600.
Here, Plaintiffs do not include similarly sufficient factual allegations in their Complaint. Plaintiffs do not sufficiently allege that they lost money or property as a result of Defendant's unfair competition, as required under the UCL. See Cal. Bus. & Prof. Code § 17204. Plaintiffs argue that the “economic value” of their harvested data is “inherent in the fact that they allege that Defendant and Vergic harvested and ‘exploit[ed]' their data ‘for financial gain.'” (Resp., ECF No. 11, at 22:5-7 (citing to the Complaint).) Contrary to Plaintiffs' arguments, the economic value of their customer service chat transcripts is not inherent upon the facts Plaintiffs allege in the Complaint. The factual allegations in the Complaint show that Vergic “analyze[s], interpret[s], and collect[s] customer-support agent interactions,” (Compl., ECF No. 1, ¶ 14), and that it “uses [that data] for a variety of its own purposes,” (Id. ¶ 15). The Complaint alleges Vergic also uses the data to “enable [businesses and public organizations] to proactively and in realtime [sic] create valuable connections with their online visitors through personalized and relevant dialogues.” (Id. ¶ 17.) None of these allegations points to how these data are economically valuable to Plaintiffs, and therefore Plaintiffs fail to plausibly plead an economic injury.
For the foregoing reasons, Plaintiffs have failed to establish they have suffered an economic injury and thus they do not have standing to bring a claim under the UCL. The motion to dismiss as to the claim under the UCL (Claim Three) is granted with leave to amend.
B. Rule 12(b)(6) Motion to Dismiss
Finding standing for Claims One, Two, and Four, contingent upon whether Plaintiffs sufficiently plead these claims, the Court considers the sufficiency of the Complaint in pleading claims under Section 631(a) of CIPA and under the California Constitution.
1. Section 631(a) of CIPA
CIPA is California's anti-wiretapping and anti-eavesdropping statute that prohibits unauthorized interceptions of communications in order “to protect the right of privacy.” Cal. Penal Code § 630. The California Legislature enacted CIPA in 1967 in response to “advances in science and technology [that] have led to the development of new devices and techniques for the purpose of eavesdropping upon private communications[.]” Id.
As explained in Swarts v. The Home Depot, Inc., Section 631(a) of CIPA may be broken into four clauses:
(1) where a person by means of any machine, instrument, or contrivance, or in any other manner, intentionally taps, or makes any unauthorized connection with any telegraph or telephone wire, line, cable, or instrument; (2) where a person willfully and without consent of all parties to the communication, or in any unauthorized manner, reads, or attempts to read, or to learn the contents or meaning of any message, report, or communication while the same is in transit;
(3) where a person uses, or attempts to use, in any manner, or for any purpose, or to communicate in any way, any information so obtained; and (4) where a person aids, agrees with, employs, or conspires with any person or persons to unlawfully do, or permit, or cause to be done any of the acts or things mentioned above.No. 23-cv-0995-JST, 2023 WL 5615453, at *5 (N.D. Cal. Aug. 30, 2023) (citations omitted). Here, Plaintiffs bring claims under all four Clauses. Plaintiffs allege that JC Penney aided and abetted Vergic, a third party, to violate Clauses One through Three of Section 631. JC Penney contends there are multiple issues with both the factual allegations in the Complaint and Plaintiffs' legal theories of liability that render any proposed amendment futile as to each clause of Section 631.
i. Clause One of Section 631(a)
Based on the statutory language of Clause One, courts have consistently held that Clause One applies only to “telegraph and telephone” wires, lines, cables, or instruments,” and not to internet connections. See, e.g., In re Google Inc., No. 13-MD-2430-LHK, 2013 WL 5423918, at *20 (N.D. Cal. Sept. 26, 2013); see also Williams v. What If Holdings, LLC, No. C 22-03780 WHA, 2022 WL 17869275, at *2 (N.D. Cal. Dec. 22, 2022) (“[T]he first clause of Section 631(a) concerns telephonic wiretapping specifically and does not apply to the context of the internet.”); see also Javier v. Assurance IQ, LLC, No. 20-cv-02860-CRB, 2023 WL 114225, at *4 n.3 (N.D. Cal. Jan. 5, 2023) (“As Defendants correctly argue, the first prong of Section 631 does not apply to internet communications.” (citations omitted)). This Court has adopted this interpretation in a previous ruling. See Greenley v. Kochava, Inc., No. 22-cv-1327-BAS-AHG, 2023 WL 4833466, at *16 (S.D. Cal. July 27, 2023).
Because Clause One does not apply to internet connections, prospective plaintiffs who allege their communications were intercepted when using their smartphones as computers (for example, to access and browse the internet) are foreclosed from stating a claim under Clause One of Section 631. See Mastel v. Miniclip SA, 549 F.Supp.3d, 1129, 1135 (E.D. Cal. July 15, 2021) (holding that “[a]lthough [smartphones] contain the word ‘phone' in their name, and have the capability of performing telephonic functions, they are, in reality, small computers”); see also Licea v. Am. Eagle Outfitters, Inc., No. EDCV 22-1702-MWF (JPR), 2023 WL 2469630, at *5 (C.D. Cal. Mar. 7, 2023) (rejecting the argument that Clause One of Section 631 applies to smartphones).
Here, Plaintiffs allege they “used smart phones (cellular telephones with integrated computers to enable web browsing) and/or wifi-enabled tablets and laptops that use a combination of cellular and landline telephony” to engage with the “‘chat' feature of the Website to communicate with Defendant.” (Compl., ECF No. 1, ¶ 23.) The lone reasonable inference that arises from this allegation is that Plaintiffs used smartphones, tablets, and/or computers to access the Website over the internet. Hence, the communications that traversed between their mobile devices and JC Penney's servers fall outside the realm of Clause One of Section 631. See, e.g., Swarts, 2023 WL 5615453, at *6 (dismissing a Clause One claim where the plaintiff alleged he “visited Defendants' website” via “his cellular telephone”). Plaintiffs seemingly concede that Clause One does not apply to smartphones. (See generally Resp., ECF No. 11 (containing arguments for claims under Clauses Two and Three but no arguments for a claim under Clause One).)
Accordingly, the Court finds that Plaintiffs' admission that they utilized cellular phones to access the Website renders futile any amendment of any Section 631 claim premised upon an alleged violation of Clause One. See Airs Aromatics, LLC v. Victoria's Secret Stores Brand Mgmt., Inc., 744 F.3d 595, 600 (9th Cir. 2014) (“A party cannot amend pleadings to directly contradict an earlier assertion made in the same proceeding.”) (citations omitted).
ii. Clause Two of Section 631(a)
“[C]ourts have applied Section 631(a) via the language of its second clause to the internet browsing context.” What If Holdings, 2022 WL 17869275, at *2. This Court finds persuasive the analytical structure in Valenzuela v. Keurig Green Mountain, Inc., which breaks Clause Two down into three elements: “(1) absence of consent; (2) the party exception; and (3) the ‘while . . . in transit' requirement.” No. 22-cv-09042-JSC, 2023 WL 3707181, at *3 (N.D. Cal. May 24, 2023) (citing to Cal. Penal Code § 631(a)).
Absence of consent. Plaintiffs meet their burden to plead lack of consent. The statute prohibits eavesdropping “without consent of all parties to the communication.” Cal. Penal Code § 631(a). Plaintiffs allege they were not informed of the chat recording or interception when they used the Website to chat with a JC Penney customer service representative. (Compl., ECF No. 1, ¶¶ 23, 25-27.) Plaintiffs further allege they did not give their express or implied consent to allow Vergic to learn of their communications with JC Penney. (Id., ¶ 28.) That is sufficient at this stage. See Javier, 2022 WL 1744107, at *2 (finding there was no prior consent when the complaint pled that neither party to the communication requested the plaintiff's “consent prior to his filling out the insurance questionnaire.”). Accordingly, this element is satisfied.
The Party Exception. The parties here do not dispute that JC Penney falls under this exception as a party to the communication. However, Plaintiffs successfully allege the party exception does not apply to Vergic.
CIPA contains an exemption from liability for a person who was a “party” to a communication. See Warden v. Kahn, 160 Cal.Rptr. 471 (Cal.Ct.App. 1979) (“[S]ection 631 . . . has been held to apply only to eavesdropping by a third party and not to recording by a participant to a conversation.”); see also Javier, 2023 WL 114225, at *4. The question here, then, is whether Vergic is a third-party eavesdropper or the equivalent of a tape-recorder in Defendant's control. Compare Rogers v. Ulrich, 125 Cal.Rptr. 306 (Cal.Ct.App. 1975) (holding that a tape recorder jack installed in a telephone, used to record a conversation, then played back to a third party later, did not create liability under CIPA) with Ribas v. Clark, 696 P.2d 637 (Cal. 1985) (holding that allowing a friend to listen in on a phone conversation via an extension created liability under CIPA). So, is Vergic the tape recorder or is Vergic the friend listening in?
The answer turns on whether there is a “use” requirement in Clause Two; that is, whether Plaintiffs must show Vergic used the data for its own ends. Plaintiffs cite to Javier, which held that “reading a use requirement into the second [clause] would add requirements that are not present (and swallow the third [clause] in the process).” 2023 WL 114225, at *6. This Court finds the reasoning in Javier persuasive. A use requirement is more appropriate in a Clause Three, not Clause Two, analysis, which the Court examines below. See infra Section III.B.1.iii.
This conclusion is bolstered by the Ninth Circuit's reasoning in In re Facebook, Inc. Internet Tracking Litigation. In that case, the court held that surreptitious duplication of an electronic transmission between two parties does fall within CIPA and is not subject to the “party” exemption. 956 F.3d at 608. In reaching this conclusion, the court cited to legislative history evincing an “intent to prevent the acquisition of the contents of a message by an unauthorized third-party or ‘an unseen auditor.'” Id. (citing S. REP. NO. 90-0197, reprinted in 1986 U.S.C.C.A.N. 2112, 2154, 2182).
Here, Plaintiffs sufficiently allege Defendant allowed Vergic to contemporaneously duplicate their chat conversations with Defendant as they occurred, thereby reading them. To plausibly allege a violation of Clause Two, they need not allege that Vergic did so for its own use. Therefore, Plaintiffs successfully allege, at this stage, that JC Penney may be liable for violating Clause Two of CIPA, by aiding and abetting Vergic.
The “While in Transit” Requirement. Plaintiffs sufficiently allege their communications with Defendant were intercepted while in transit to Defendant. Liability under Clause Two arises when the purported CIPA violator “reads, or attempts to read, a communication that is ‘in transit or passing over any wire, line, or cable, or is being sent from, or received at any place within' California.” Mastel, 549 F.Supp.3d at 1135 (quoting Cal. Penal Code § 631(a)). Some courts have held that, at the motion to dismiss stage, a plaintiff is not expected to prove or even know how and when its communications were captured. See, e.g., In re Vizio, Inc. Consumer Priv. Litig., 238 F.Supp.3d 1204, 1228 (C.D. Cal. 2017). Indeed, a pleading standard to the contrary would require the CIPA plaintiff to engage in a one-sided guessing game because the relevant information about data capture typically resides uniquely in the custody and control of the CIPA defendant and its third-party recorder. Still, a CIPA plaintiff “must provide fair notice to [d]efendant” of how and when she “believe[s]” the defendant or the conspiring third party intercepts her communications. Id.; see also Licea, 2023 WL 2469630, at *9 (“Plaintiffs must provide more than conclusory allegations that messages were intercepted during transmission in real time.”).
Plaintiffs successfully plead that Vergic intercepted Plaintiffs' chats with JC Penney. Plaintiffs allege that the JC Penney Website chat feature operates through Vergic's servers, allowing real-time interception of the communication. (See Compl., ECF No. 1, ¶ 13 (“[T]he chat function is run from Vergic's servers but allows for chat functionality on the Website. In other words, Vergic runs the chat service from its own servers, but consumers interact with the chat service on Defendant's Website, so it appears they are only communicating with a company representative of Defendant.”); (see also id. ¶ 14 (“[W]henever a chat message is sent from a member of the Class to Defendant, it is first routed through Vergic's server.”).) The reasonable inference here, because Vergic apparently receives the chat messages either before or simultaneously with JC Penney, is that Vergic intercepts these messages.
JC Penney's argument that Plaintiffs do not allege the “how or when” of the eavesdrop necessarily fails. Plaintiffs do indeed allege with sufficient specificity the how and when of Vergic's interception of Plaintiffs' chat communications with JC Penney. (See Mot., ECF No. 9, at 15:22-16:5.)
Ultimately, Plaintiffs plausibly allege that JC Penney has violated CIPA Clause Two, by aiding and abetting Vergic, in allowing Vergic to “listen in” on chats between Website users and JC Penney customer service representatives.
iii. Clause Three of Section 631(a)
Plaintiffs do not plausibly allege that Defendant violated Clause Three. Clause Three creates liability under CIPA for any party “who uses, or attempts to use, in any manner, or for any purpose, or to communicate in any way, any information [as laid out in Clauses One and Two].” Cal. Penal Code § 631(a). However, unlike Clause Two, Clause Three specifically includes a use requirement. See supra Section III.A.B.1.ii. (analyzing how a use requirement makes more sense in the plain language of Clause Three, rather than inferred from the text of Clause Two).
JC Penney persuasively argues that Plaintiffs do not sufficiently plead that Vergic uses their chat data for its own purposes.Plaintiffs aver in their Response that Vergic is using “the information obtained from those conversations for Vergic's own purposes.” (ECF No. 11, at 13:3-4.) This is a conclusory allegation without a supporting factual allegation in the Complaint. In contrast, the specific factual allegations of the Complaint contradict Plaintiffs' argument. Repeatedly, the Complaint states Vergic “exhaustively analyze[s]” visitor conversations, or Vergic “allow[s] brands & organisations to engage with customers through . . . supported messaging and collaboration tools.” (Compl., ECF No. 1, ¶¶ 1-17.) These uses all point to Vergic acting as a tool for companies like Defendant, and not as a user of the customers' chat transcripts for Vergic's own ends. Therefore, Plaintiffs do not successfully plead JC Penney has violated CIPA under Clause Three because they do not sufficiently allege Vergic, or any other third party, uses the chat data for its own purposes.
Plaintiffs attempted to shoehorn in an additional factual allegation in their Response when they stated, “On information and belief, Vergic analyzes and uses the chat conversations it intercepts and records to, inter alia, improve its SaaS platform, including proprietary machine learning for its chatbots and related technologies.” (Resp., ECF No. 11, at 13:11-13.) This Court cannot consider this as a factual allegation because a Rule 12(b)(6) motion is based on the insufficiency of the pleadings and a response to a motion is not a pleading. Therefore, the Court will not consider it here.
2. Section 632.7 of CIPA
Plaintiffs have failed to plausibly allege a claim for violating Section 632.7 of CIPA. “[C]ourts applying § 632.7 have characterized the statute as prohibiting the intentional recording of any communication without the consent of all parties where one of the parties is using a cellular or cordless phone.” McCabe v. Six Continents Hotels, Inc., No. 12-cv-4818 NC, 2014 WL 465750, at *3 (N.D. Cal. Feb. 3, 2014). Section 632.7(a) states:
Every person who, without the consent of all the parties to a communication, intercepts or receives and intentionally records, or assists in the interception or reception and intentional recordation of, a communication transmitted between two cellular radio telephones, a cellular radio telephone and a land telephone, two cordless telephones and a landline telephone, or a cordless telephone and a cellular radio telephone, shall be punished by a fineCal. Penal Code § 632.7.
Defendant contends that Plaintiffs' Section 632.7 claim falls because Plaintiffs admit they used cellular devices to access the Website, and communications originating from smartphones are not covered by Section 632.7. (ECF No. 9, at 17:26-18:19.) The Court agrees and adopts the reasoning in Cinmar and Mastel that when a consumer uses a phone to access a website over the internet, the phone functions as a computer, not a phone. See Mastel, 549 F.Supp.3d at 1135; see also Licea v. Cinmar, No. CV 22-6454-MWF (JEM), 2023 WL 2415592, at *2 (C.D. Cal. Mar. 7, 2023). If Section 632.7 is to apply to newer technologies, like cell phones that operate as hand-held computers, it must be because California's Legislature amended the statute to incorporate such technologies. See Smith v. LoanMe, Inc., 11 Cal. 5th 183, 202 n.10 (Cal. 2021). Accordingly, the Court finds Plaintiffs' admission they used “smart phones . . . and/or wifi-enabled tablets and laptops,” (Compl., ECF No. 1, ¶ 23), to access the Website renders amendment of their Section 632.7 claim futile, see Airs Aromatics, 744 F.3d at 600.
3. The UCL
Because Plaintiffs do not sufficiently allege facts so as to have standing to bring this claim, the Court will not address the 12(b)(6) motion to dismiss this claim. See supra Section III.A.2.iii.
4. Invasion of Privacy under the California Constitution
To bring a claim for invasion of privacy under the California Constitution, “Plaintiffs must show “(1) there exists a reasonable expectation of privacy, and (2) the intrusion was highly offensive.” In re Facebook, Inc. Internet Tracking Litig., 956 F.3d at 601.
i. Reasonable Expectation of Privacy
The relevant question here is whether, in chatting with a customer service representative on Defendant's website, a user would reasonably expect that Defendant would monitor and record those chats. A reasonable expectation of privacy is an “objective entitlement founded on broadly based and widely accepted community norms.” Hill v. Nat'l Collegiate Athletic Ass'n, 865 P.2d 633, 655 (Cal. 1994). Courts analyzing this entitlement question “must take into account any ‘accepted community norms,' advance notice to [the plaintiff] . . ., and whether [the plaintiff] had the opportunity to consent to or reject the very thing that constitutes the invasion.” TBG Ins. Servs. Corp. v. Superior Crt., 96 Cal.App.4th 443, 450 (Cal. 2002).
Accepted community norms. The “community norms” aspect of the “reasonable expectation of privacy” element means “‘[t]he protection afforded to the plaintiff's interest in his privacy must be relative to the customs of the time and place, to the occupation of the plaintiff and to the habits of his neighbors and fellow citizens.'” Id.
In the instant case, Plaintiffs' chats did not take place in an online space where one may reasonably expect privacy, such as in a private chat with a therapist or clinician. Rather, Plaintiffs' chats took place on a public website owned and operated by a private company. It would not be reasonable for a consumer to expect privacy in such a situation, given the common practice that companies monitor customer service phone lines, and Plaintiffs' online chats in the instant case were with customer service representatives.
Courts have recognized this reasoning. For instance, where customers “voluntarily sent [the defendant] all the internet usage information at issue,” the Third Circuit did not find an invasion of privacy. In re Google Inc. Cookie Placement Consumer Priv. Litig., 806 F.3d 125, 150 (3d Cir. 2015). Similarly, in California, routine commercial behavior is not considered an “egregious breach of social norms.” Folgelstrom v. Lamps Plus, Inc., 195 Cal.App.4th 986, 992 (2011). Here, a company recording the chats a consumer has with a customer service representative falls under the umbrella of “routine commercial behavior.” See id.
Advance notice to Plaintiffs. Plaintiffs successfully plead they did not receive advance notice from Defendant that a third party storing the chat history was listening in. “Vergic runs the chat service from its own servers, but consumers interact with the chat service on Defendant's Website, so it appears they are only communicating with a company representative of Defendant.” (Compl., ECF No. 1, ¶ 13.) It is reasonable to infer from allegations such as these that Plaintiffs did not have advance notice that Defendant or a third party may have recorded the chats Plaintiffs had on Defendant's website.
Consent. To successfully plead an invasion of privacy, the plaintiffs must have conducted themselves in a manner consistent with an actual expectation of privacy, meaning they must not have manifested by their conduct a voluntary consent to the invasive actions of defendant. Hill, 865 P.2d at 633. As analyzed above, Plaintiffs successfully plead they did not consent to the recording of their chats with Defendant. See supra Section III.B.1.ii.
In summary, applying the TBG factors as a balancing test, this Court finds that although Plaintiffs did not have advance notice and did not consent to Defendant allowing Vergic to listen in on the chats and store the transcripts, accepted community norms around conversations in this type of space (a commercial website for selling merchandise) point away from a reasonable expectation of privacy. See 96 Cal.App.4th at 450. Thus, Plaintiffs did not have a reasonable expectation of privacy in their chats with customer service representatives on Defendant's website and therefore this element of an invasion of privacy claim is not met.
ii. Serious Invasion of Privacy Interest.
Further, “[a]ctionable invasions of privacy must be sufficiently serious in their nature, scope, and actual or potential impact to constitute an egregious breach of the social norms underlying the privacy right. Thus, the extent and gravity of the invasion is an indispensable consideration in assessing an alleged invasion of privacy.” Hill, 865 P.2d at 633. However, determinations of the egregiousness of the privacy intrusion are not usually resolved at the pleading stage. See In re Facebook, Inc. Tracking Litig., 956 F.3d at 606 (“The ultimate question of whether Facebook's tracking and collection practices could highly offend a reasonable individual is an issue that cannot be resolved at the pleading stage.”); see also In re Facebook, Inc., Consumer Priv. User Profile Litig., 402 F.Supp.3d 767, 797 (N.D. Cal. 2019) (“Under California law, courts must be reluctant to reach a conclusion at the pleading stage about how offensive or serious the privacy intrusion is.”).
Therefore, the Court will not resolve this particular question at this stage in the litigation. However, the motion to dismiss this cause of action will be granted, with leave to amend, on the grounds that Plaintiffs do not allege facts sufficient to establish a reasonable expectation of privacy in their chats with customer service representatives on Defendant's website.
C. Leave to Amend
Under Rule 15(a)(2), granting leave to amend rests within the trial court's sound discretion. Swanson v. U.S. Forest Serv., 87 F.3d 339, 343 (9th Cir. 1996). The Ninth Circuit has held that leave to amend should be freely granted. See Morongo Band of Mission Indians v. Rose, 893 F.2d 1073, 1079 (9th Cir. 1990).
Therefore, leave to amend is hereby granted for each cause of action dismissed, except for any allegation brought under CIPA Section 631(a), Clause One, and Section 632.7, as analyzed above. See supra Sections III.B.1.i, III.B.2. Leave to amend is also granted as to Plaintiffs' requests for declaratory and injunctive relief.
IV. CONCLUSION
Accordingly, the Court rules as follows on Defendant's Motion to Dismiss Plaintiffs' Complaint (ECF No. 9):
1. Section 631(a) of CIPA
a. GRANTED with prejudice, as to Clause One, for failure to state a claim.
b. DENIED as to Clause Two.
c. GRANTED without prejudice, as to Clause Three, for failure to state a claim and lack of standing.
2. GRANTED with prejudice, as to Section 632.7 of CIPA, for failure to state a claim.
3. GRANTED without prejudice, as to the UCL, for lack of standing.
4. GRANTED without prejudice, as to invasion of privacy under the California Constitution, for failure to state a claim and lack of standing.
5. GRANTED without prejudice, as to Plaintiffs' pleas for declaratory and injunctive relief for the surviving claim, for lack of standing.
6. DENIED as to Plaintiffs' plea for damages for the surviving claim.
If Plaintiffs wish to amend, they must do so on or before November 7, 2023. If Plaintiffs fail to amend by November 7, 2023, Defendant is ordered to file a response by November 14, 2023.
IT IS SO ORDERED.