Summary
holding plaintiff failed to state a claim that website owner eavesdropped, plaintiff stated a claim that website owner aided in software provider's eavesdropping, and plaintiff had no standing for his CIPA § 635 claim because he did not allege any injury from defendant's mere possession of an eavesdropping device
Summary of this case from Massie v. Gen. MotorsOpinion
Case No. 2:20-cv-09581-FLA (RAOx)
2021-09-27
Burhaan SALEH, Plaintiff, v. NIKE, INC., et al., Defendants.
Lawrence Timothy Fisher, Joel D. Smith, Bursor and Fisher PA, Walnut Creek, CA, Alec M. Leslie, Pro Hac Vice, Bursor and Fisher PA, New York, NY, Marc G. Reich, Reich Radcliffe and Hoover LLP, Newport Beach, CA, for Plaintiff. Emily Johnson Henn, Covington and Burling LLP, Palo Alto, CA, Jenna Lian Zhang, Matthew Q. Verdin, Patrick R. Carey, Simon J. Frankel, Covington and Burling LLP, San Francisco, CA, for Defendants.
Lawrence Timothy Fisher, Joel D. Smith, Bursor and Fisher PA, Walnut Creek, CA, Alec M. Leslie, Pro Hac Vice, Bursor and Fisher PA, New York, NY, Marc G. Reich, Reich Radcliffe and Hoover LLP, Newport Beach, CA, for Plaintiff.
Emily Johnson Henn, Covington and Burling LLP, Palo Alto, CA, Jenna Lian Zhang, Matthew Q. Verdin, Patrick R. Carey, Simon J. Frankel, Covington and Burling LLP, San Francisco, CA, for Defendants.
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANTS’ MOTION TO DISMISS [DKT. 30]
FERNANDO L. AENLLE-ROCHA, United States District Judge
RULING
Before the court is Defendants Nike, Inc. ("Nike") and FullStory, Inc.’s ("FullStory") (collectively, "Defendants") Motion to Dismiss ("Motion"). Dkt. 30 (Mot.). For the reasons set forth below, the court DENIES Defendants’ Motion as to Plaintiff's claim against Defendant Nike under Cal. Penal Code § 631(a) for aiding FullStory's alleged wiretapping and GRANTS Defendants’ Motion in all other respects with leave to amend. Plaintiff shall have fourteen (14) days from the date of this order to file an amended complaint.
BACKGROUND
The following facts are alleged in the First Amended Complaint ("FAC"). Plaintiff Burhaan Saleh ("Saleh" or "Plaintiff") is a California citizen and resident living in Glendale, California. Dkt. 24 (FAC) ¶ 4. Nike is an Oregon corporation with its principal place of business in Beaverton, Oregon. Id. ¶ 5. FullStory is a Delaware corporation with its principal place of business in Atlanta, Georgia. Id. ¶ 8.
FullStory is a marketing software-as-a-service ("SaaS") company and provides Nike with "Session Replay," a feature Nike uses on its website to capture data regarding visitors to Nike's website, nike.com (the "Website" or "Nike's Website"). Id. ¶¶ 9, 16-17. Session Replay embeds snippets of code that watch and record, in real time, "a visitor's every move on a website." Id. ¶ 18. "On Nike's website, FullStory's software captures, among other things: (a) The user's mouse clicks; (b) The user's keystrokes; (c) The user's payment card information, including card number, expiration date, and CVV code; (d) The user's IP address; (e) The user's location at the time of the visit; and (f) The user's browser type and the operating system on their devices." Id. ¶ 44 (paragraph breaks omitted).
In May 2020, Plaintiff visited Nike's Website and completed a purchase. Id. ¶¶ 2, 40. During Plaintiff's visit, Defendants Nike and FullStory recorded Plaintiff's electronic communications in real time, including Plaintiff's mouse clicks, keystrokes, and payment card information. Id. Plaintiff was unaware at the time that his keystrokes, mouse clicks, and other electronic communications were being intercepted in real-time and would be disclosed to FullStory, nor did Plaintiff consent to the same. Id. ¶ 4. Nike does not ask users whether they consent to FullStory's recordation of their interactions with Nike's Website, or inform users of the recording in its Privacy Policy. Id. ¶¶ 45, 46.
Plaintiff initiated this putative class action on October 19, 2020 and filed the operative FAC on December 22, 2020. Dkts. 1, 24. Plaintiff brings causes of action against Defendants under the California Invasion of Privacy Act ("CIPA"), Cal. Penal Code §§ 631 and 635, and for invasion of privacy under the California Constitution. FAC ¶¶ 59-89. Defendants filed a Motion to Dismiss the FAC on January 22, 2021, which the court took under submission on April 23, 2021. Dkts. 30 (Mot.), 46.
MOTION TO DISMISS: PERSONAL JURISDICTION
I. Legal Standard
Under Fed. R. Civ. P. 12(b)(2), a party may file a motion to dismiss a complaint for lack of personal jurisdiction. "When a defendant moves to dismiss for lack of personal jurisdiction, the plaintiff bears the burden of demonstrating that the court has jurisdiction." In re Western States Wholesale Nat. Gas Antitrust Litig. , 715 F.3d 716, 741 (9th Cir. 2013) ; accord Schwarzenegger v. Fred Martin Motor Co. , 374 F.3d 797, 800 (9th Cir. 2004) (citation omitted).
"The court may consider evidence presented in affidavits to assist it in its determination and may order discovery on the jurisdictional issues." Doe v. Unocal Corp. , 248 F.3d 915, 922 (9th Cir. 2001), overruled on other grounds as discussed in Williams v. Yamaha Motor Co. , 851 F.3d 1015, 1021 (9th Cir. 2017). "However, ‘when a district court acts on a defendant's motion to dismiss without holding an evidentiary hearing, the plaintiff need make only a prima facie showing of jurisdictional facts to withstand the motion to dismiss. That is, the plaintiff need only demonstrate facts that if true would support jurisdiction over the defendant.’ " Id. (quoting Ballard v. Savage , 65 F.3d 1495, 1498 (9th Cir. 1995) ).
"Where ... there is no applicable federal statute governing personal jurisdiction, the district court applies the law of the state in which the district court sits." Id. (citing Fed. R. Civ. P. 4(k)(1)(A) ). "Personal jurisdiction over a nonresident defendant is proper if permitted by a state's long-arm statute and if the exercise of that jurisdiction does not violate federal due process." Western States , 715 F.3d at 741. California's long-arm statute provides for jurisdiction coextensive with the Constitution of the United States. Cal. Code Civ. Proc. § 410.10. "Because California's long-arm jurisdictional statute is coextensive with federal due process requirements, the jurisdictional analyses under state law and federal due process are the same." Schwarzenegger , 374 F.3d at 800-01. Accordingly, this court's exercise of personal jurisdiction over a non-resident defendant not present in the forum will satisfy due process if the defendant has sufficient "minimum contacts" with the forum, such that the exercise of jurisdiction "does not offend traditional notions of fair play and substantial justice." Schwarzenegger , 374 F.3d at 801 (quoting Int'l Shoe Co. v. Washington , 326 U.S. 310, 316, 66 S.Ct. 154, 90 L.Ed. 95 (1945) ).
II. Discussion
A. General Personal Jurisdiction
A district court may exercise either general or specific personal jurisdiction. See Bristol-Myers Squibb Co. v. Superior Court , ––– U.S. ––––, 137 S. Ct. 1773, 1780, 198 L.Ed.2d 395 (2017). To establish general jurisdiction over a defendant corporation, the plaintiff must demonstrate the defendant has sufficient contacts to constitute the kind of "continuous and systematic general business contacts" that approximate physical presence in the forum state. Schwarzenegger , 374 F.3d at 801 (quoting Helicopteros Nacionales de Colombia, S.A. v. Hall , 466 U.S. 408, 416, 104 S.Ct. 1868, 80 L.Ed.2d 404 (1984) ). For corporations, the place of incorporation and principal place of business are "paradigm" examples of continuous and systematic general business contacts sufficient to support general personal jurisdiction." Daimler AG v. Bauman , 571 U.S. 117, 137, 134 S.Ct. 746, 187 L.Ed.2d 624 (2014).
Defendants argue the court cannot exercise general personal jurisdiction over FullStory because FullStory is incorporated in Delaware, has its principal place of business in Georgia, FAC ¶ 8, and has not otherwise established continuous and systematic contacts in California, such that it is essentially at home in the state. Mot. 7 (citing BNSF Ry. Co. v. Tyrrell , ––– U.S. ––––, 137 S. Ct. 1549, 1559, 198 L.Ed.2d 36 (2017) ). Plaintiff appears to concede the argument, as Plaintiff does not respond and argues only that the court has specific personal jurisdiction over FullStory. Opp. 2-8. Thus, Plaintiff has not established general personal jurisdiction over FullStory, and the court will proceed to assess the parties’ arguments regarding specific personal jurisdiction.
B. Specific Personal Jurisdiction
For a court to exercise specific personal jurisdiction over a defendant, "the suit must arise out of or relate to the defendant's contacts with the forum." Bristol-Myers , 137 S. Ct. at 1780 (internal brackets and quotation marks omitted). The Ninth Circuit has established a three-prong test for analyzing a claim of specific personal jurisdiction:
(1) The non-resident defendant must purposefully direct his activities or consummate some transaction with the forum or resident thereof; or perform some act by which he purposefully avails himself of the privilege of conducting activities in the forum, thereby invoking the benefits and protections of its laws;
(2) the claim must be one which arises out of or relates to the defendant's forum-related activities; and
(3) the exercise of jurisdiction must comport with fair play and substantial justice, i.e. it must be reasonable.
Schwarzenegger , 374 F.3d at 802. The plaintiff bears the burden to establish the first two prongs, and failure to establish either one requires dismissal for lack of personal jurisdiction. Id.
The first prong of the specific jurisdiction test refers to both "purposeful availment" and "purposeful direction." Mavrix Photo, Inc. v. Brand Techs., Inc. , 647 F.3d 1218, 1228 (9th Cir. 2011). A purposeful availment analysis is most often used in suits sounding in contract, while a purposeful direction analysis is most often used in suits sounding in tort. Schwarzenegger , 374 F.3d at 802 ; Mavrix , 647 F.3d at 1228. The parties agree the court must apply the purposeful direction analysis here. Mot. 8; Opp. 2.
The purposeful direction test, or "effects test," looks to whether the defendant: (1) committed an intentional act, (2) expressly aimed at the forum state, (3) causing harm that the defendant knows is likely to be suffered in the forum state. Mavrix , 647 F.3d at 1228 (citing Calder v. Jones , 465 U.S. 783, 104 S.Ct. 1482, 79 L.Ed.2d 804 (1984) ); Schwarzenegger , 374 F.3d at 803. The court will address each factor in turn.
1. Whether FullStory Committed an Intentional Act
Defendants argue the FAC fails to allege any facts regarding intentional conduct by FullStory to create contacts with California sufficient to support the exercise of specific personal jurisdiction. Mot. 7-10. Specifically, according to Defendants, the FAC does not allege that (1) Nike and FullStory's licensing agreement was negotiated in California, (2) the agreement was entered into in California, (3) FullStory developed its software in California, or (4) "FullStory has any other suit-related contacts to this forum other than the fact that Plaintiff happened to be in California when he visited Nike's website." Id. at 8-9.
Plaintiff responds that his allegations of "wiretapping" satisfy the requirement that FullStory purposefully direct itself toward California, including that FullStory committed an intentional act. Opp. 2-5. Relying on S.D. v. Hytto Ltd. , Case No. 4:18-cv-00688-JSW, 2019 WL 8333519, 2019 U.S. Dist. LEXIS 229909 (N.D. Cal. May 14, 2019), Plaintiff argues FullStory "intentionally wiretapped visitors" and, therefore, committed an intentional act under the purposeful direction test. Opp. 3.
In Hytto , 2019 WL 8333519, at *1, 2019 U.S. Dist. LEXIS 229909 at *4, a California plaintiff alleged a Hong Kong defendant, a manufacturer of smartphone-connected sex toys, " ‘continuously and contemporaneously intercept[ed]’ and transmit[ted] to [the defendant's] servers, the date and time of each use of the paired [ ] device(s), the vibration intensity level users select using the app, and the email address of users sending and receiving commands." The court emphasized that, under the purposeful direction test, an "intentional act" refers to "an intent to perform an actual, physical act in the real world, rather than an intent to accomplish a result or consequence of that act." Id. at *4, 2019 U.S. Dist. LEXIS 229909, at *10 (internal quotation marks and citation omitted). As the defendant had allegedly purposefully intercepted the plaintiff's electronic transmissions, the Hytto court concluded "the ‘intentional act’ standard [was] easily satisfied ...." Id.
Defendants respond the term "intentional act" bears a particularized meaning not recognized in Hytto and urge the court to follow the Ninth Circuit's definition of an "intentional act" in Wash. Shoe Co. v. A-Z Sporting Goods Inc. , 704 F.3d 668 (9th Cir. 2012). Dkt. 32 (Reply) at 2; see Bergstein v. Parmar , Case No. 2:13-cv-06167-DMG (MRWx), 2014 WL 12586073, at *3, 2014 U.S. Dist. LEXIS 195552, at *6 (C.D. Cal. June 23, 2014) (citing Wash. Shoe , 704 F.3d at 673 ). In Washington Shoe , the court explained as follows:
" ‘Intentional act’ has a specialized meaning in the context of the Calder effects test." Schwarzenegger , 374 F.3d at 806. We have defined an ‘act’ as ‘denot[ing] an external manifestation of the actor's will ... not includ[ing] any of its results, even the most direct, immediate, and intended." Id. ("Thus, if the actor, having pointed a pistol at another, pulls the trigger, the act is the pulling of the trigger and not the impingement of the bullet upon the other's person." (quoting Restatement (Second) of Torts § 2 & cmt. c (1964))). Further, "[w]e construe ‘intent’ ... as referring to an intent to perform an actual, physical act in the real world, rather than an intent to accomplish a result or consequence of that act." Id. Accordingly, an intentional act is an external manifestation of the actor's intent to perform an actual, physical act in the real world, not including any of its actual or intended results.
Wash. Shoe Co., 704 F.3d at 674-75.
With this understanding, the Washington Shoe court had "little difficulty" finding the defendant had committed an intentional act when it purchased and sold boots that allegedly infringed the plaintiff's copyright. Id. at 675. Similarly, in Bergstein , 2014 WL 12586073, 2014 U.S. Dist. LEXIS 195552, upon which the Hytto court relied, the court found the intentional act requirement was "easily satisfied" where the defendant allegedly "recorded [ ] telephone conversations, extorted [the plaintiff], and released some of the recordings." Id. at *3, 2014 U.S. Dist. LEXIS 195552, at *8.
Defendants argue the present case is distinguishable from Washington Shoe and Bergstein because Plaintiff does not allege facts showing the external manifestation of FullStory's will was to record Plaintiff's activity on the Website. Reply 2 (quoting Bergstein , 2014 WL 12586073, at *3, 2014 U.S. Dist. LEXIS 195552, at *7 ). Defendants emphasize, "[t]here is no suggestion, let alone allegation, that this external manifestation was to wiretap an individual in this forum or even enable Nike to do so." Id. Rather, Defendants argue, FullStory's intentional acts include (1) developing software and (2) providing its software to Nike through a voluntary partnership. Id. (citing FAC ¶¶ 15, 34). Defendants conclude the " ‘results, even the most direct, immediate, and intended’ results of the original intent," cannot support a finding of an intentional act to record Plaintiff's online activity. Id. (quoting Bergstein , 2014 WL 12586073, at *2, 2014 U.S. Dist. LEXIS 195552, at *3 ). The court disagrees.
Plaintiff alleges FullStory intentionally recorded his activity. FAC ¶¶ 35-36. According to the FAC, FullStory "intentionally installed the wiretap at issue here on Nike's Website" and "purposefully intercepted electronic transmissions from users of Nike's website." Id. ¶ 14; see also id. ¶¶ 64, 76, 84. Plaintiff further alleges that "[w]hen the website user's communications are transmitted to Nike's Website, FullStory records the website user's interactions locally in the user's browser in real time, and then transmits that information to FullStory's recording servers every few seconds. FullStory then makes the information available to its clients." Id. ¶ 27. Taking these allegations as true, as is required, the court finds Plaintiff has successfully alleged FullStory committed intentional acts for purposes of personal jurisdiction.
2. Whether FullStory Expressly Aimed its Conduct Toward California
Defendants next argue Plaintiff fails to allege FullStory expressly aimed its conduct toward California. Mot. 9. Defendants cite Bristol-Myers , 137 S. Ct. at 1781, to argue "[t]here must be ‘an adequate link’ between the defendant's contacts with the forum and the claims at issue" for specific personal jurisdiction to exist, and that "[c]ontacts unrelated to Plaintiff's alleged claims will not suffice for specific jurisdiction." Id.
As stated, Defendants contend the FAC does not allege that (1) Nike and FullStory's licensing agreement was negotiated in California, (2) the agreement was entered into in California, (3) FullStory developed its software in California, or (4) "FullStory has any other suit-related contacts to this forum other than the fact that Plaintiff happened to be in California when he visited Nike's website." Id. at 8-9. According to Defendants, the mere allegation that FullStory entered into a licensing agreement to provide software and services to Nike, whose website was available to California residents, is not sufficient to show FullStory expressly aimed its conduct toward California. Id.
Plaintiff responds that FullStory's online activity is sufficient to show FullStory expressly aimed its conduct toward California. Opp. 3-5. Plaintiff relies on several district court cases in which courts found the defendants’ websites had sufficient "interactivity" with the forum state, and that the defendants engaged in other additional acts toward the forum state, for the courts to exercise personal jurisdiction over the defendants. Opp. 4 (citing Oakley, Inc. v. Donofrio , Case No. 8:12-cv-02191-CJC (RNBx), 2013 WL 12126017, 2013 U.S. Dist. LEXIS 198264 (C.D. Cal. June 14, 2013) and Loomis v. Slendertone Distribution, Inc. , 420 F. Supp. 3d 1046, 1069 (S.D. Cal. 2019) ).
The Ninth Circuit has explained, "[n]ot all material placed on the Internet is, solely by virtue of its universal accessibility, expressly aimed at every state in which it is accessed." Mavrix , 647 F.3d at 1231. In the context of specific personal jurisdiction, "maintenance of a passive website alone cannot satisfy the express aiming prong." Id. at 1229 (internal quotation marks and citation omitted). However, "operating even a passive website in conjunction with ‘something more’—conduct directly targeting the forum—is sufficient." Id. (quoting Rio Props., Inc. v. Rio Int'l Interlink , 284 F.3d 1007, 1020 (9th Cir. 2002) ). In determining whether a nonresident defendant has done "something more," the Ninth Circuit has considered several factors, including, among others not relevant here, the interactivity of the defendant's website, the geographic scope of the defendant's commercial ambitions, and whether the defendant "individually targeted" a plaintiff known to be a forum resident. Id. (citations omitted).
In Oakley , on which Plaintiff relies, the out-of-state defendants sold products on eBay to California residents, but the defendant corporation was not incorporated in California and the defendants did not operate their business there. Oakley , 2013 U.S. Dist. LEXIS 198264, at *4-5, 19. The defendants challenged the court's exercise of personal jurisdiction on the grounds the defendants had not specifically targeted the California market and only sold products to California residents with "little or no control" over whether California residents would purchase their items. Id. at *12.
The Oakley court began its "expressly aimed" analysis with the holdings of Mavrix and Washington Shoe , that an Internet presence alone was not sufficient to establish conduct that was expressly aimed at the forum state, and "something more" was necessary. Id. at *18-19. The court concluded there were at least two reasons why the Oakley defendants had done "something more" than simply operate an online store to which California residents had access. Id. at *19. First, the defendants "all interacted with California consumers by accepting orders from those consumers through eBay and shipping products to consumers in California." Id. Specifically, they "actively conducted transactions with California customers, accepted payment from those customers, and shipped products into California." Id. Second, the defendants "engaged in wrongful conduct targeted at a plaintiff whom the defendant knows to be a resident of the forum state." Id. at *20 (quoting Wash. Shoe , 704 F.3d at 675 ) (internal quotation marks omitted). Similarly, in Loomis , the court concluded the defendant had expressly aimed its conduct toward California because, among other things, the defendant maintained an interactive website available to California residents, exploited the California advertising market, sold products through the website to California residents, and exchanged information with users in California. Loomis , 420 F. Supp. 3d at 1069-70.
According to Plaintiff, Nike is a commercial website that is available to, and sells to, California residents in the same manner as in Oakley and Loomis. Opp. 5; FAC ¶¶ 4, 14. Thus, Plaintiff contends, FullStory—operating on Nike's website—expressly aimed its conduct toward California. Opp. 5. Defendants respond Oakley and Loomis are distinguishable because, unlike in those and other similar cases, Plaintiff does not allege FullStory itself operated a website accessible to California residents such as Plaintiff; rather, Plaintiff alleges Nike operated the Website and FullStory's software was embedded therein. Reply 3; FAC ¶ 18. Defendants explain, "[i]n each internet-based case Plaintiff cites on this point, the Court addressed whether a website operator , not a company who supplied software to the website operator, was subject to personal jurisdiction." Reply 3 (emphasis in original). The court agrees with Defendants.
Here, unlike in Oakley , Plaintiff does not allege that FullStory accepts orders or payments from California customers, that FullStory ships goods to California customers, or that California residents interact with FullStory links or features. Plaintiff instead alleges FullStory "recorded Plaintiff's electronic communications in real time, including Plaintiff's mouse clicks, keystrokes, and payment card information." Id. ¶ 2; see also id. ¶¶ 4, 17-19, 23, 25, 27, 31, 41-44. As alleged in the FAC, users do not provide order information to FullStory, conduct business with FullStory, or otherwise interact with FullStory by clicking on FullStory links or features, nor does FullStory facilitate Nike's transactions with California customers. Cf. Loomis , 420 F. Supp. 3d at 1070 ; Oakley , 2013 U.S. Dist. LEXIS 198264, at *19; j2 Cloud Servs. v. Fax87 , Case No. 2:13-cv-05353-DDP (AJWx), 2017 WL 1535083, at *6, 2017 U.S. Dist. LEXIS 64064, at *20 (C.D. Cal. Apr. 27, 2017). While the FAC alleges FullStory is a "marketing software-as-a-service (‘SaaS’) company, FAC ¶ 9, Plaintiff does not allege FullStory provides its services to California companies or plead other facts sufficient to demonstrate it "expressly aimed" conduct to this forum. See Mavrix , 647 F.3d at 1231. Plaintiff's cited cases, therefore, are distinguishable.
Defendants further argue it is "not enough" for Plaintiff to allege FullStory "constructively" knew some of Nike's customer base was in California. Id. at 9; FAC ¶ 14. According to Defendants, that the FAC alleges Californians form a significant portion of Nike's customer base "shows nothing" about whether FullStory has "actively and affirmatively" transacted with California customers or "conducted regular business" with California citizens. Reply 3 (quoting Oakley , 2013 U.S. Dist. LEXIS 198264, at *15-16). Plaintiff, meanwhile, argues it is sufficient to allege FullStory was aware Nike had a substantial customer base in California and that it was foreseeable FullStory's services would be used to record California users. Opp. 3-4. Plaintiff, however, cites no authority for the proposition that a defendant's unilateral observation of a user's interaction with a third party's website is sufficient to find the defendant "interacted" with the user for purposes of personal jurisdiction. Because the court concludes Plaintiff has failed to allege facts showing FullStory expressly aimed its conduct toward California, the court need not consider the parties’ remaining arguments regarding foreseeability and the other specific personal jurisdiction prongs. As Plaintiff has failed to allege facts sufficient to show the court may exercise personal jurisdiction over FullStory, the court restricts its analysis of Defendants’ Motion to whether Plaintiff has stated claims against Defendant Nike.
MOTION TO DISMISS: FAILURE TO STATE A CLAIM
I. Legal Standard
Under Fed. R. Civ. P. 12(b)(6), a party may file a motion to dismiss a complaint for "failure to state a claim upon which relief can be granted." The purpose of Rule 12(b)(6) is to enable defendants to challenge the legal sufficiency of the claims asserted in a complaint. Rutman Wine Co. v. E. & J. Gallo Winery , 829 F.2d 729, 738 (9th Cir. 1987). A district court properly dismisses a claim under Rule 12(b)(6) if the complaint fails to allege sufficient facts "to support a cognizable legal theory." Caltex Plastics, Inc. v. Lockheed Martin Corp , 824 F.3d 1156, 1159 (9th Cir. 2016).
"To survive a motion to dismiss, a complaint must contain sufficient factual matter ... to ‘state a claim for relief that is plausible on its face.’ " Ashcroft v. Iqbal , 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009) (quoting Bell Atl. Corp. v. Twombly , 550 U.S. 544, 570, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007) ). "While a complaint attacked by a Rule 12(b)(6) motion to dismiss does not need detailed factual allegations, a plaintiff's obligation to provide the ‘grounds’ of his ‘entitlement to relief’ requires more than labels and conclusions, and a formulaic recitation of the elements of a cause of action will not do." Twombly , 550 U.S. at 555, 127 S.Ct. 1955 (internal citations omitted). "Factual allegations must be enough to raise a right to relief above the speculative level." Id. (internal citations omitted). "Determining whether a complaint states a plausible claim for relief is ‘a context-specific task that requires the reviewing court to draw on its judicial experience and common sense.’ " Ebner v. Fresh, Inc. , 838 F.3d 958, 963 (9th Cir. 2016) (quoting Iqbal , 556 U.S. at 679, 129 S.Ct. 1937 ). When evaluating a complaint under Rule 12(b)(6), the court "must accept all well-pleaded material facts as true and draw all reasonable inferences in favor of the plaintiff." Wilson v. Hewlett–Packard Co. , 668 F.3d 1136, 1140 (9th Cir. 2012). Legal conclusions, however, "are not entitled to the assumption of truth" and "must be supported by factual allegations." Iqbal , 556 U.S. at 679, 129 S.Ct. 1937. A court must normally convert a Rule 12(b)(6) motion into a Rule 56 motion for summary judgment if it considers evidence outside the pleadings. United States v. Ritchie , 342 F.3d 903, 907-08 (9th Cir. 2003). "A court may, however, consider certain materials—documents attached to the complaint, documents incorporated by reference in the complaint, or matters of judicial notice—without converting the motion to dismiss into a motion for summary judgment." Id.
II. Cal. Penal Code § 631
Plaintiff's first claim for relief is under Cal. Penal Code § 631(a) (" § 631(a)"). FAC ¶¶ 59-72. Section 631(a) provides, in relevant part:
Any person ... [1] who willfully and without the consent of all parties to the communication, or in any unauthorized manner, reads, or attempts to read, or to learn the contents or meaning of any message, report, or communication while the same is in transit or passing over any wire, line, or cable, or is being sent from, or received at any place within this state; or [2] who uses, or attempts to use, in any manner, or for any purpose, or to communicate in any way, any information so obtained, or [3] who aids, agrees with, employs, or conspires with any person or persons to unlawfully do, or permit, or cause to be done any of the acts or things mentioned above in this section, is punishable by a fine not exceeding two thousand five hundred dollars ($2,500), or by imprisonment in the county jail not exceeding one year, or by imprisonment pursuant to subdivision (h) of Section 1170, or by both a fine and imprisonment in the county jail or pursuant to subdivision (h) of Section 1170."
A private party may bring a claim for a violation of § 631(a) pursuant to Cal. Penal Code § 637.2, which provides that "[a]ny person who has been injured by a violation of this chapter may bring an action against the person who committed the violation...." Section 631(a) contains an exemption from liability for a person who is a "party" to a communication, where a party to a communication cannot be held to wiretap another party to the same communication. Davis v. Facebook, Inc. (In re Facebook Inc. Internet Tracking Litig.) , 956 F.3d 589, 607 (9th Cir. 2020) (citing Warden v. Kahn , 99 Cal. App. 3d 805, 811, 160 Cal.Rptr. 471 (1979) ).
A. Whether Nike's Privacy Policy Precludes Plaintiff's Claims
Defendants argue Nike disclosed FullStory's alleged interception to Plaintiff in its Privacy Policy and, therefore, Plaintiff cannot state a claim under § 631. Mot. 17-19; Reply 11-12. To support their argument, Defendants rely on a version of the Privacy Policy that they represent was "last modified" on October 12, 2020. Mot. 18. Defendants cite Garcia v. Enterprise Holdings, Inc. , 78 F. Supp. 3d 1125, 1137 (N.D. Cal. 2015), to argue that courts in the Ninth Circuit routinely consider website privacy policies at the motion to dismiss stage, where, as here, the plaintiff refers to the privacy policy in the complaint. Mot. 18 n.4.
Unlike in Garcia , however, Defendants have not submitted a request for judicial notice or request for incorporation by reference. See id. at 1130, 1136. Moreover, Defendants have not submitted a copy of the Privacy Policy with their moving papers, as required by Local Rule 7-5(b). Accordingly, the court rejects this argument and will not grant the motion on this basis.
On reply, Defendants present a copy of the Privacy Policy, dated December 30, 2019, which their counsel, Jenna Zhang, attests is identical to the version of the Privacy Policy discussed in the moving papers. Dkt. 32-1 at ¶¶ 4-6, Dkt. 32-2 (Ex. A). The court, however, declines to consider new evidence presented on reply, as Plaintiff has not had a reasonable opportunity to respond. See Zamani v. Carnes , 491 F.3d 990, 997 (9th Cir. 2007) ("The district court need not consider arguments raised for the first time in a reply brief").
B. Whether Plaintiff Alleges Defendants Recorded "Contents" of a Communication
"The analysis for a violation of [the California Invasion of Privacy Act ("CIPA")] ... is the same as that under the federal Wiretap Act [ 18 U.S.C. §§ 2510 - 2523, the Electronic Communications Privacy Act of 1986]" (the "Wiretap Act"). Brodsky v. Apple Inc. , 445 F. Supp. 3d 110, 127 (N.D. Cal. 2020) (quoting Cline v. Reetz-Laiolo , 329 F. Supp. 3d 1000, 1051 (N.D. Cal. 2018) ). Under the Wiretap Act, "contents" is defined as "any information concerning the substance, purport, or meaning of [a] communication." 18 U.S.C. § 2510(8).
"[T]he term ‘contents’ refers to the intended message conveyed by the communication, and does not include record information regarding the characteristics of the message that is generated in the course of the communication." Graf v. Zynga Game Network, Inc. (In re Zynga Privacy Litig.) , 750 F.3d 1098, 1107 (9th Cir. 2014) (holding "referer header information ... transmitted to third parties .... does not meet the definition of ‘contents,’ because these pieces of information are not the ‘substance, purport, or meaning’ of a communication"). Such "record information" includes, among other things, the " ‘name,’ ‘address,’ and ‘subscriber number or identity’ of a subscriber or customer." Id. at 1106 (citing 18 U.S.C. § 2702(c)(2) ).
Whether information is "content" or "record information" can depend in part on the manner in which the information is generated, as information that would otherwise be considered "record information"—such as names, addresses, telephone numbers, and email addresses—may be "contents" of a communication where the user communicates with a website by entering his information into a form provided by the website. See id. at 1107 (citing Blumofe v. Pharmatrak, Inc. (In re Pharmatrak, Inc. Privacy Litig.) , 329 F.3d 9, 15, 18-19 (1st Cir. 2003) ).
Defendants argue Plaintiff relies on FullStory's alleged "capturing of data that are not the ‘contents’ of his communications," such as the date and time of the visit, the duration of the visit, Plaintiff's IP address, his location at the time of the visit, his browser type, and the operating system on his device." Mot. 16 (citing FAC ¶¶ 41, 44). According to Defendants, "[n]one of this information is ‘the intended message conveyed by the communication’ but is instead ‘information regarding the characteristics of the message,’ " and therefore does not qualify as "contents" under the Wiretap Act. Id. (quoting In re Zynga , 750 F.3d at 1106 ).
Plaintiff argues these communications do not constitute "record information" as a matter of law and dismissal is not warranted. Opp. 12-15. The court agrees. Here, the FAC alleges FullStory captures mouse movements, clicks, typing, scrolling, swiping, tapping, keystrokes, geographic location, IP addresses, and data entry. FAC ¶¶ 17 (internal quotation marks omitted), 23, 25. Plaintiff alleges FullStory records these and other details alongside "a video capturing each of Plaintiff's keystrokes and mouse clicks on the website." Id. ¶ 41. According to the FAC, FullStory's software allows for the recording and "pixel-perfect playback" of all in-browser interactions, which includes any "content" information Plaintiff sent to Nike. See FAC ¶¶ 23-31 (displaying images from FullStory's promotional materials that demonstrate FullStory's ability to record a customer's purchasing selections and other content communications to a website owner). Although not all of this information may constitute the "contents" of a communication under the federal Wiretap Act, Plaintiff has met his burden to allege facts plausibly showing Defendants recorded Plaintiff's content communications with Nike by recording, among other things, keystrokes and a video of Plaintiff's interactions with Nike's website. See Iqbal , 556 U.S. at 678, 129 S.Ct. 1937. The court, therefore, will not grant Defendants’ Motion on this basis.
On September 20, 2021, Defendants filed a Notice of Supplemental Authority in which they attached the court's order granting the defendant's motion to dismiss in Goldstein v. Costco Wholesale Corp. , Case No. 21-cv-80601-RAR, 2021 WL 4134774, 2021 U.S. Dist. LEXIS 170815 (S.D. Fla. Sep. 9, 2021). Dkt. 70, 70-1. Although the Goldstein court examined the "session replay" and the distinction between contents and record information, the court finds Goldstein distinguishable. In that case, the court construed Florida's Security of Communications Act ("FSCA") and granted the defendant's motion to dismiss in part on the grounds that the "session replay" at issue in that case fell within a statutory exemption under the FSCA. See Goldstein , 2021 WL 4134774, at *2, 2021 U.S. Dist. LEXIS 170815, at *6-7 (quoting Fla. Stat. § 934.02(12)(c) ) ("The FSCA's text itself reinforces that such actions fall outside the statute's purview. The statute specifically excludes "[a]ny communication from an electronic or mechanical device which permits the tracking of the movement of a person or an object.").
As Defendants fail to demonstrate any similar exemption exists under Cal. Penal Code § 631(a), the court will not grant Defendants’ Motion under Goldstein . To the extent the court in Goldstein held the tracking and recording of website interactions did not amount to "contents" of communications under the Wiretap Act, this court reaches a contrary conclusion for the reasons stated herein.
C. Whether Plaintiff Alleges Nike Was a Third Party
As stated, § 631(a) exempts from liability a person who is a "party" to a communication. In re Facebook , 956 F.3d at 607 (citing Warden , 99 Cal. App. 3d at 811, 160 Cal.Rptr. 471 ). Defendants argue Plaintiff's claims fail because Nike was a party to the communication and FullStory acted as Nike's vendor. Mot. 11-12.
Plaintiff argues Defendants overstate the exemption under § 631(a) and are liable under § 631(a) despite the allegation that Nike was a party to its communications with Plaintiff. Opp. 10-11. According to Plaintiff, "[t]his case and In re Facebook both involve website operators who surreptitiously record information about [a] consumer's internet usage and activity," and "Nike overlooks that the Ninth Circuit rejected the same argument Nike makes here and reversed dismissal." Id. (italics in original).
In In re Facebook , the Ninth Circuit held that Facebook was not immune under § 631(a) as a matter of law where Facebook allegedly "engaged in the unauthorized duplication and forwarding of unknowing users’ information" from communications that were not directed to Facebook, to third parties. Id. at 608. Specifically, the plaintiffs alleged Facebook "use[d] plug-ins to track users’ browsing histories when they visit[ed] third-party websites ..." after its users had logged out of Facebook. Id. at 596. The plaintiffs further alleged they visited third-party websites (i.e., websites other than Facebook), and that Facebook used plug-ins to "replicate[ ] and send [ ] user data to Facebook through a separate, but simultaneous, channel in a manner undetectable by the user." Id. Through this process, Facebook allegedly collected the third-party website's Uniform Resource Locator ("URL"), and from the URL, further collected "significant information regarding the user's browsing history," including "the identity of the individual internet user and the web server, as well as the name of the web page and the search terms that the user used to find it." Id.
Plaintiff's allegations here are distinguishable. Whereas in In re Facebook the plaintiffs alleged Facebook recorded communications between the plaintiffs and third parties to which Facebook was not a party, here, Plaintiff alleges Nike and FullStory recorded Plaintiff's communications with Nike. FAC ¶¶ 41-44. Thus, to the extent Plaintiff alleges Nike recorded its own communications with Plaintiff, the court finds the § 631 exemption applies. See Warden , 99 Cal. App. 3d 805 at 811, 160 Cal.Rptr. 471. Accordingly, the court GRANTS Defendants’ Motion as to Defendant Nike for Plaintiff's direct invasion of privacy claim under § 631, with leave to amend.
The court now turns to the parties’ arguments regarding Nike's potential liability for aiding or enabling FullStory's alleged wiretapping.
D. Whether Plaintiff Sufficiently Alleges FullStory Was a Third Party to Plaintiff's Communication With Nike
Plaintiff next contends Nike can be held liable under § 631 for enabling FullStory's wiretapping. Opp. 9. According to Plaintiff, § 631(a) imposes liability for "any person" who "aids, agrees with, employs, or conspires with" anyone who violates this section and does not include an exemption for participants to a conversation who permit third parties to eavesdrop on that conversation. Id.
Although, the court finds Plaintiff has failed to allege facts showing the court has personal jurisdiction over FullStory, the analysis of whether FullStory was a third party to the communication between Plaintiff and Nike affects whether Plaintiff sufficiently alleges Nike aided or enabled FullStory's recording of Plaintiff's communications with Nike. Thus, the court will assess the parties’ arguments regarding whether FullStory was a third party to these communications.
According to Defendants, because FullStory provides a service to Nike, "FullStory cannot be considered a third party to Plaintiff's alleged communications with Nike." Mot. 13. Defendants rely on Rogers v. Ulrich , 52 Cal. App. 3d 894, 125 Cal.Rptr. 306 (1975) and Membrila v. Receivables Performance Mgmt., LLC , Case No. 3:09-cv-02790-IEG (RBB), 2010 WL 1407274, 2010 U.S. Dist. LEXIS 33565 (S.D. Cal. Apr. 6, 2010) for the proposition that FullStory's SaaS does not amount to wiretapping by a third party under the statute. Mot. 12-14. In Rogers , 52 Cal. App. 3d at 897-98, 125 Cal.Rptr. 306, the defendant recorded a telephone conversation he had with the plaintiff without the plaintiff's knowledge and later played the recording for others, including a newspaper editor who was preparing a story about the telephone conversation. The court affirmed summary judgment in favor of the defendant, reasoning the defendant was a party to the conversation and "only a third party can listen secretly to a private conversation." Id. at 899, 125 Cal.Rptr. 306. Similarly, in Membrila , 2010 WL 1407274, at *2, 2010 U.S. Dist. LEXIS 33565, at *6, the court granted the defendant's motion to dismiss where the plaintiff alleged the defendant had recorded the parties’ telephone conversation, on the grounds that § 631 "applies only to eavesdropping by a third party and not to recording by a participant to a conversation."
Rogers was disapproved on other grounds by In re Arias , 42 Cal. 3d 667, 680 n.11, 230 Cal.Rptr. 505, 725 P.2d 664 (1986), which, in turn, was superseded by statute as discussed in People v. Loyd , 27 Cal. 4th 997, 1008, 119 Cal.Rptr.2d 360, 45 P.3d 296 (2002).
Defendants urge the court to follow Rogers and Membrila because, according to Defendants, Plaintiff's allegations "are no different than if the defendant in Rogers had used SaaS to record, store, listen to, and analyze his conversations with the plaintiff there." Mot. 13. The court disagrees. Whereas the defendants in Rogers and Membrila recorded the conversations with the plaintiffs, here Plaintiff alleges FullStory—which Plaintiff contends he did not know was a party to the communication—recorded Plaintiff's communications. FAC ¶¶ 27, 40-44.
Defendants further contend "Nike uses FullStory's software the same way the defendants in Rogers and Membrila used recorders—behavior the courts there made clear was not prohibited under the statute." Id. at 14. Nike argues Plaintiff alleges only that "Nike is effectively renting space on FullStory's servers where Nike can store data related to website interactions and view that data using FullStory's dashboard." Mot. 13. The court disagrees.
Unlike the recorders in Rogers and Membrila , FullStory is a separate legal entity that offers "software-as-a-service" and not merely a passive device. Defendants’ argument would imply that any third party who surreptitiously recorded a conversation between two parties would not violate § 631(a) so long as it was recording the conversation at the direction and for the benefit of a party. The text of section 631(a), however, does not contain any such exception, and indeed, Defendants invite an interpretation that would vitiate the statute's protections. See In re Marriage of Evans , 229 Cal. App. 4th 374, 381, 177 Cal.Rptr.3d 256 (2014) (explaining "a court must select the construction that comports most closely with the apparent intent of the Legislature, in order to promote, rather than to frustrate the purpose of the statute, and to avoid an interpretation that would lead to absurd consequences") (internal quotation marks omitted). Thus, Rogers and Membrila do not support Defendants’ argument that FullStory was a party to the communication between Plaintiff and Nike.
The facts here are more similar to those of Revitch v. New Moosejaw, LLC , Case No. 3:18-cv-06827-VC, 2019 WL 5485330, at *1–2, 2019 U.S. Dist. LEXIS 186955, at *2-3 (N.D. Cal. Oct. 23, 2019), in which the court denied a motion to dismiss where the plaintiff alleged the owner of a website, New Moosejaw, LLC ("Moosejaw"), violated § 631 by embedding into its webpages a mechanism that allowed a third party, NaviStone, Inc. ("NaviStone"), to eavesdrop on the plaintiff's communications. While NaviStone argued it was a "party" to the communications because it was a direct recipient, the court disagreed, holding that a third-party eavesdropper does not become a party to a communication merely by directly receiving the communication. Id. at *2, 2019 U.S. Dist. LEXIS 186955, at *4. As Revitch further explained, "[a]lthough Moosejaw cannot be liable for eavesdropping on its own communications with Revitch, the complaint adequately alleges that Moosejaw violated section 631 by enabling NaviStone's wrongdoing." Id. at *3, 2019 U.S. Dist. LEXIS 186955, at *5.
Here, as in Revitch , FullStory did not become a "party" to the communication simply because it was providing recording and transmission services for Nike. As stated, the FAC alleges FullStory provides a "software-as-a-service" by which "FullStory records the website user's interactions locally in the user's browser in real time, and then transmits that information to FullStory's recording servers every few seconds," which FullStory then makes available to its clients. FAC ¶¶ 9, 27. Plaintiff further alleges Nike facilitated FullStory's actions by voluntarily embedding FullStory's software code on its website. Id. ¶¶ 27, 35-39.
Viewing the allegations as true and accepting all reasonable inferences in favor of Plaintiff, Saleh pleads sufficient facts regarding FullStory's conduct to state a claim for violation of § 631(a). See Wilson , 668 F.3d at 1140. Thus, the court will not dismiss Count 1 against Nike for allegedly aiding, agreeing, or conspiring with FullStory to provide FullStory with Plaintiff's communications with Nike.
Lastly, Defendants contend that, because Plaintiff only alleges FullStory shared the data it collected with Nike, Plaintiff's allegations would "criminalize" "ubiquitous" functions of websites. Mot. 14-15. Defendants cite no authority for this proposition or explain its legal significance. The court will not grant Defendants’ Motion on this basis.
III. Cal. Penal Code § 635
Plaintiff's second claim for relief is for violation of Cal. Penal Code § 635 (" § 635"). FAC ¶¶ 73-80. Section 635 provides, in relevant part:
Every person who manufactures, assembles, sells, offers for sale, advertises for sale, possesses, transports, imports, or furnishes to another any device which is primarily or exclusively designed or intended for eavesdropping upon the communication of another ... shall be punished by a fine not exceeding two thousand five hundred dollars ($2,500), by imprisonment in the county jail not exceeding one year, or in the state prison, or by both that fine and imprisonment.
Cal. Penal Code § 635. As with § 631(a), a private party may bring a claim for a violation of § 635 pursuant to Cal. Penal Code § 637.2.
Defendants argue Plaintiff lacks statutory and Article III standing to assert a claim under § 635 because Plaintiff was not "injured by a violation of [ § 635 ]" and, therefore, lacks statutory standing under the plain text of § 637.2. Mot. 19-20. Defendants further argue that, to construct § 637.2 to permit Plaintiff's claim would run afoul of the injury-in-fact requirement under Article III. Id. Because they are interrelated, the court will address both arguments together.
To assess statutory standing, the court must first consider the exact act Plaintiff alleges Nike committed and whether such act falls within § 635. Whereas § 635 prohibits, among other things, the manufacture, assembly, sale, or possession of a wiretapping device, Defendants argue "[t]he only term in that list that could plausibly apply to Nike is ‘possess.’ " Mot. 22. Plaintiff, in turn, responds that Nike is liable for not only its possession but also its implementation and use of FullStory's code. Opp. 23. The court agrees with Defendants. As Plaintiff notes, "the plain meaning of the statute governs." Id. Contrary to Plaintiff's argument, § 635 does not prohibit the "implementation" or "use" of a wiretapping device; instead, it prohibits the manufacture, assembly, sale, offer for sale, advertisement for sale, possession, transport, import, or furnishment of such device. Cal. Penal Code § 635.
The FAC does not allege Nike committed any act covered under § 635 beyond, possibly, possession of FullStory's code. FAC ¶ 38. Plaintiff fails to direct the court to any allegation in the FAC showing otherwise. See Opp. 22-23. Thus, the court finds Plaintiff has alleged Nike violated § 635 only through Nike's possession of the code and restricts its Article III standing analysis accordingly.
Article III of the Constitution requires courts to adjudicate only actual cases or controversies. U.S. Const. art. III, § 2, cl. 1. "A suit brought by a plaintiff without Article III standing is not a ‘case or controversy,’ and an Article III federal court therefore lacks subject matter jurisdiction over the suit." Cetacean Cmty. v. Bush , 386 F.3d 1169, 1174 (9th Cir. 2004). To establish standing, a plaintiff must show he "(1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision." Spokeo, Inc. v. Robins , 578 U.S. 330, 136 S. Ct. 1540, 1547, 194 L.Ed.2d 635 (2016). A plaintiff must clearly allege facts demonstrating each element at the pleading stage. Id.
According to Defendants, even if Nike possessed FullStory's code, Plaintiff suffered no injury arising from those alleged acts, and to construe § 637.2 to allow Plaintiff to bring a claim for mere possession would violate the case or controversy requirements of Article III. Mot. 19-20. Defendants analogize standing to bring a claim under § 635 to its federal counterpart, 18 U.S.C. § 2512 (" § 2512"). Mot. 19-20. Similar to § 635, § 2512 prohibits the "manufacture[ ], assembl[y], possess[ion], or s[ale] [of] any electronic, mechanical, or other device," the defendant knows or has reason to know is "primarily useful for the purpose of the surreptitious interception of wire, oral, or electronic communications ...." Like § 637.2, 18 U.S.C. § 2520(a) (" § 2520(a)") provides a private right of action against "any person whose wire, oral, or electronic communication is intercepted, disclosed, or intentionally used in violation of this chapter ...."
Although district courts have taken varying views, the Circuit Courts of Appeal that have addressed the issue agree that § 2520(a) —by its plain text—does not provide a private right action for mere possession of a device in violation of § 2512. See, e.g., DirecTV, Inc. v. Treworgy , 373 F.3d 1124, 1127 (11th Cir. 2004) ; Luis v. Zang , 833 F.3d 619, 636-37 (6th Cir. 2016).
The Eleventh Circuit in Treworgy , 373 F.3d at 1127, for example, declined to interpret the statutory text of § 2520(a) as permitting a private right of action for mere possession, in part because that construction would be "constitutionally problematic." The court explained a defendant's possession of a wiretap device, without an allegation that the wrongdoer "actually injured" the plaintiff from the act of possession, is "nothing more than conjectural or hypothetical harm." Id. As the Supreme Court succinctly stated, "No concrete harm, no standing." TransUnion LLC v. Ramirez , ––– U.S. ––––, 141 S. Ct. 2190, 2200, 210 L.Ed.2d 568 (2021). That possession under § 2512 was a criminal offense did not affect the court's analysis, see Treworgy , 373 F.3d at 1127, as a violation of a statute is not alone sufficient to show an injury-in-fact for purposes of standing. See Summers v. Earth Island Inst. , 555 U.S. 488, 491, 496, 129 S.Ct. 1142, 173 L.Ed.2d 1 (2009) (concluding plaintiff lacked standing to challenge the alleged failure of the Forest Service to observe notice and comment and appeal regulations); see also id. (explaining "deprivation of a procedural right without some concrete interest that is affected by the deprivation—a procedural right in vacuo —is insufficient to create Article III standing."). Accordingly, the Treworgy court reasoned that permitting a plaintiff to bring suit under § 2520(a) for a violation of § 2512 would unconstitutionally result in a statutory cause of action where the plaintiff failed to establish an injury-in-fact, and hence failed to establish standing under Article III. Treworgy , 373 F.3d at 1127.
Defendants argue the reasoning in Treworgy should apply here under §§ 635 and 637.2. Specifically, Defendants submit that Plaintiff lacks a statutory basis for standing under § 637.2 and that construal of § 637.2 as providing a private right of action for a violation of § 635 would be unconstitutional, as it would provide Plaintiff a cause of action without suffering an injury-in-fact. Finding Treworgy persuasive authority, the court agrees.
Although Plaintiff alleges Nike implemented, used, and possessed FullStory's software, § 635 only refers to possession of a wiretapping device, as explained above. And while § 637.2 provides a private right of action to "[a]ny person injured" by such possession under § 635, Treworgy instructs that mere possession does not lead to actual injury, but only potential injury, which is insufficient under Article III. See TransUnion , 141 S. Ct. at 2204 (" Article III require[s] that the plaintiff's injury in fact be ‘concrete’—that is, ‘real, and not abstract.’ ") (citations omitted). The court need not address the parties’ arguments as to whether FullStory's software constitutes a "device" under CIPA because, even if it were, Plaintiff has failed to allege he suffered an injury from Nike's possession of FullStory's software. As Plaintiff alleges no injury, Article III prevents this court from hearing his claim for possession under § 635.
Plaintiff urges the court to follow Luis v. Zang , 833 F.3d 619, 637 (6th Cir. 2016), for the proposition that a claim under the Wiretap Act could not lie from the defendant's mere possession of a wiretapping device, but could proceed where the defendant possessed and manufactured, marketed, and sold the device "with knowledge that it would be primarily used to illegally intercept electronic communications." Id. Luis is distinguishable, however, because Plaintiff here does not allege Nike manufactured, marketed, or sold FullStory's code. As Defendants argue, Plaintiff at most alleges Nike possessed the code, like the defendant in Treworgy . Thus, Plaintiff's reliance on Zang is misplaced.
Plaintiff also invokes Revitch , 2019 WL 5485330, at *3, 2019 U.S. Dist. LEXIS 186955, at *7-8, where the court found no "severe constitutional concerns" with the plaintiff's claim under § 635 because the plaintiff had "alleged injuries traceable to Moosejaw's possession and use of the device." Revitch , however, did not consider whether § 637.2 allowed the plaintiff to bring and maintain a § 635 claim. See generally id. Rather, the Revitch court only considered whether the plaintiff had pleaded sufficient facts to state a claim. See id. at *3, 2019 U.S. Dist. LEXIS 186955, at *7.
Lastly as to this claim, although Plaintiff notes that California case law has recognized § 637.2 does not require a plaintiff to show it "has suffered, or been threatened with actual damages" to bring suit, this court is not bound by California authority that permits a cause of action without a showing of injury. Opp. 20 (citing Ion Equip. Corp. v. Nelson , 110 Cal. App. 3d 868, 882, 168 Cal.Rptr. 361 (1980), superseded by statute on other grounds as stated in Hart v. TWC Prod. & Tech. LLC , 526 F.Supp.3d 592, 598-99 (N.D. Cal. 2021) ). "[S]tanding in federal court is a question of federal law, not state law." Hollingsworth v. Perry , 570 U.S. 693, 715, 133 S.Ct. 2652, 186 L.Ed.2d 768 (2013). Thus, even if California courts have interpreted § 637.2 as allowing a suit absent a showing of concrete harm, that conclusion is not binding on this court's standing analysis under Article III. The court will not deny Defendants’ Motion on this basis.
The court, therefore, GRANTS Defendants’ Motion as to Defendant Nike on Plaintiff's claim under § 635, with leave to amend. The court need not address the parties’ remaining arguments regarding the legal sufficiency of this claim.
IV. Invasion of Privacy Under the California Constitution
Article I, section 1 of the California Constitution declares privacy an inalienable right of the people of California. Cal. Const. Art. I, § 1. "The right, in many respects broader than its federal constitutional counterpart, protects individuals from the invasion of their privacy not only by state actors but also by private parties." Leonel v. Am. Airlines, Inc. , 400 F.3d 702, 711 (9th Cir. 2005). "To prove a claim under the California right to privacy, a plaintiff must first demonstrate three elements: (1) a legally protected privacy interest; (2) a reasonable expectation of privacy under the circumstances; and (3) conduct by the defendant that amounts to a serious invasion of the protected privacy interest." Id. (citing Hill v. Nat'l Collegiate Athletic Ass'n , 7 Cal. 4th 1, 40, 26 Cal.Rptr.2d 834, 865 P.2d 633 (1994) ).
"Whether plaintiff has a reasonable expectation of privacy in the circumstances and whether defendant's conduct constitutes a serious invasion of privacy are mixed questions of law and fact." Hill , 7 Cal. 4th at 40, 26 Cal.Rptr.2d 834, 865 P.2d 633. "If the undisputed material facts show no reasonable expectation of privacy or an insubstantial impact on privacy interests, the question of invasion may be adjudicated as a matter of law." Id. "[C]ustoms, practices, and physical settings surrounding particular activities may create or inhibit reasonable expectations of privacy." Id. at 36, 26 Cal.Rptr.2d 834, 865 P.2d 633. A plaintiff cannot have a reasonable expectation of privacy if she consented to the intrusion. Id. at 26, 26 Cal.Rptr.2d 834, 865 P.2d 633 ("[T]he plaintiff in an invasion of privacy case must have conducted himself or herself in a manner consistent with an actual expectation of privacy, i.e., he or she must not have manifested by his or her conduct a voluntary consent to the invasive actions of defendant.").
Defendants argue Plaintiff's claim for invasion of privacy under the California Constitution fails because Plaintiff does not allege he had a reasonable expectation of privacy over his activity on Nike's Website. Mot. 23-24. According to Defendants, Plaintiff "intentionally provided [information] to the Defendants," and it is of no moment that Plaintiff alleges he was unaware that FullStory recorded his activity. Id. at 23, 26 Cal.Rptr.2d 834, 865 P.2d 633 (emphasis in original). Plaintiff responds he alleges he did not intentionally provide FullStory with his activity and, therefore, to the extent Plaintiff understood he was providing information to Nike, he was not informed he was "being wiretapped by FullStory." Opp. at 24.
The court agrees with Defendants. As the California Supreme Court has explained, "[t]he plaintiff in an invasion of privacy case must have conducted himself or herself in a manner consistent with an actual expectation of privacy." Hill , 7 Cal. 4th at 26, 26 Cal.Rptr.2d 834, 865 P.2d 633 ; see, e.g., Warden , 99 Cal. App. 3d at 811, 160 Cal.Rptr. 471. "Courts have been hesitant to extend the tort of invasion of privacy to the routine collection of personally identifiable information as part of electronic communications." In re Vizio, Inc. Consumer Privacy Litig. , 238 F. Supp. 3d 1204, 1233 (C.D. Cal. 2017). "By contrast, collection of intimate or sensitive personally identifiable information may amount to a highly offensive intrusion." Id. "Further, more routine data collection practices may be highly offensive if a defendant disregards consumers’ privacy choices while simultaneously h[olding] itself out as respecting them." Id. (internal quotations omitted).
Here, the FAC does not plead any facts to suggest Defendants collected intimate or sensitive personally identifiable information or otherwise disregarded Plaintiff's privacy choices while simultaneously holding themselves out as respecting them. See id. The fact that FullStory's software allegedly captured, among other things, "(a) [t]he user's mouse clicks; (b) [t]he user's keystrokes; (c) [t]he user's payment card information, including card number, expiration date, and CCV code; (d) [t]he user's IP address; (e) [t]he user's location at the time of the visit; and (f) [t]he user's browser type and the operating system on their devices," FAC ¶ 44, is insufficient to demonstrate that Defendants’ conduct constituted a serious invasion of a protected privacy interest. See Hill , 7 Cal. 4th at 26, 26 Cal.Rptr.2d 834, 865 P.2d 633 ; In re Vizio , 238 F. Supp. 3d at 1233.
Accordingly, the court GRANTS Defendants’ Motion as to Defendant Nike on Plaintiff's claim under the California Constitution for invasion of privacy, with leave to amend. Because the court grants Defendants’ Motion as stated, finding Plaintiff has not alleged facts supporting the exercise of personal jurisdiction over FullStory, the court need not address the parties’ remaining arguments as to whether Plaintiff states a claim against FullStory under the California Constitution.
CONCLUSION
For the foregoing reasons, the court DENIES Defendants’ Motion as to Plaintiff's claim against Defendant Nike under Cal. Penal Code § 631(a) for aiding FullStory's alleged wiretapping and GRANTS Defendants’ Motion in all other respects with leave to amend. Plaintiff shall have 14 days from the date of this order to file an amended complaint. The court further VACATES the scheduling conference taken under submission on April 23, 2021 to be reset upon the filing of an Answer. Dkt. 46.
IT IS SO ORDERED.