Opinion
Case No. 18-cv-01881-RS
2019-08-29
Anthony WILLIAMS, et al., Plaintiffs, v. FACEBOOK, INC., Defendant.
John A. Yanchunis, Pro Hac Vice, Morgan and Morgan, P.A., Patrick A. Barthle, II, Pro Hac Vice, Ryan McGee, Pro Hac Vice, Morgan and Morgan Complex Litigation Group, Tampa, FL, Joshua Haakon Watson, Clayeo C. Arnold, a Professional Law Corporation, Sacramento, CA, Sabita J. Soneji, Tycko & Zavareei LLP, Oakland, CA, for Plaintiffs Lisa Renken, Sean Mannion. L. Timothy Fisher, Bursor & Fisher, P.A., Walnut Creek, CA, Alec Leslie, Pro Hac Vice, Joshua David Arisohn, Neal J. Deckant, Bursor and Fisher, P.A., New York, NY, Sabita J. Soneji, Tycko & Zavareei LLP, Oakland, CA, Scott A. Bursor, Bursor & Fisher, P.A., Miami, FL, for Plaintiffs Lawrence Olin, Janice Vega-Latker, Harold Nyanjom, Sheron Smith-Jackson. Francis J. Flynn, Jr., Law Offices of Francis J. Flynn, Jr., Los Angeles, CA, Kevin Scott Hannon, Pro Hac Vice, The Hannon Law Firm, LLC, Denver, CO, Sabita J. Soneji, Tycko & Zavareei LLP, Oakland, CA, for Plaintiff Leland Tracy. Kevin Francis Ruf, Glancy Prongay & Murray LLP, Los Angeles, CA, Sabita J. Soneji, Tycko & Zavareei LLP, Oakland, CA, for Plaintiffs Nicole Sternemann, Phyllis Sternemann. Diana Janik Zinser, Pro Hac Vice, Spector Roseman and Kodroff, P.C., Philadelphia, PA, Hassan Ali Zavareei, Tycko & Zavareei LLP, Washington, DC, Sabita J. Soneji, Tycko & Zavareei LLP, Oakland, CA, for Plaintiff John Condelles, III. Joshua David Arisohn, Bursor & Fisher, P.A., New York, NY, L. Timothy Fisher, Bursor & Fisher, P.A., Walnut Creek, CA, for Plaintiffs Blake Carlyle, Marc Boehm, Raven Winham. Elizabeth L. Deeley, Joseph C. Hansen, Nicole Charlene Valco, Latham & Watkins LLP, San Francisco, CA, Matthew J. Peters, Susan E. Engel, Latham and Watkins LLP, Washington, DC, for Defendant.
John A. Yanchunis, Pro Hac Vice, Morgan and Morgan, P.A., Patrick A. Barthle, II, Pro Hac Vice, Ryan McGee, Pro Hac Vice, Morgan and Morgan Complex Litigation Group, Tampa, FL, Joshua Haakon Watson, Clayeo C. Arnold, a Professional Law Corporation, Sacramento, CA, Sabita J. Soneji, Tycko & Zavareei LLP, Oakland, CA, for Plaintiffs Lisa Renken, Sean Mannion.
L. Timothy Fisher, Bursor & Fisher, P.A., Walnut Creek, CA, Alec Leslie, Pro Hac Vice, Joshua David Arisohn, Neal J. Deckant, Bursor and Fisher, P.A., New York, NY, Sabita J. Soneji, Tycko & Zavareei LLP, Oakland, CA, Scott A. Bursor, Bursor & Fisher, P.A., Miami, FL, for Plaintiffs Lawrence Olin, Janice Vega-Latker, Harold Nyanjom, Sheron Smith-Jackson.
Francis J. Flynn, Jr., Law Offices of Francis J. Flynn, Jr., Los Angeles, CA, Kevin Scott Hannon, Pro Hac Vice, The Hannon Law Firm, LLC, Denver, CO, Sabita J. Soneji, Tycko & Zavareei LLP, Oakland, CA, for Plaintiff Leland Tracy.
Kevin Francis Ruf, Glancy Prongay & Murray LLP, Los Angeles, CA, Sabita J. Soneji, Tycko & Zavareei LLP, Oakland, CA, for Plaintiffs Nicole Sternemann, Phyllis Sternemann.
Diana Janik Zinser, Pro Hac Vice, Spector Roseman and Kodroff, P.C., Philadelphia, PA, Hassan Ali Zavareei, Tycko & Zavareei LLP, Washington, DC, Sabita J. Soneji, Tycko & Zavareei LLP, Oakland, CA, for Plaintiff John Condelles, III.
Joshua David Arisohn, Bursor & Fisher, P.A., New York, NY, L. Timothy Fisher, Bursor & Fisher, P.A., Walnut Creek, CA, for Plaintiffs Blake Carlyle, Marc Boehm, Raven Winham.
Elizabeth L. Deeley, Joseph C. Hansen, Nicole Charlene Valco, Latham & Watkins LLP, San Francisco, CA, Matthew J. Peters, Susan E. Engel, Latham and Watkins LLP, Washington, DC, for Defendant.
ORDER DENYING IN PART AND GRANTING IN PART MOTION TO DISMISS
RICHARD SEEBORG, United States District Judge
I. INTRODUCTION
Plaintiffs are consumers from the states of New York, Kansas, Texas, and Florida who bring claims against Facebook, Inc. for violations of California's Computer Data Access and Fraud Act ("CDAFA"), Cal. Penal Code § 502, California's constitutional right to privacy, intrusion upon seclusion, unjust enrichment, and common law fraud. The center of the dispute revolves around whether Facebook scraped user call and text data by exploiting a software vulnerability in the permission settings of older versions of the Android OS. For the second time, Facebook moves to dismiss, contending that Plaintiffs: (1) lack Article III standing as a factual matter because they were not subjected to the alleged unlawful conduct and thus could not have been injured by it; (2) lack Article III standing as a facial matter; (3) fail to state a claim under Federal Rule of Civil Procedure 9(b) ; and (4) fail to state a claim under Federal Rule of Civil Procedure 12(b)(6). For the reasons explained below, Facebook's motion is denied except with regard to its factual attack on Plaintiffs' standing involving the Facebook Lite application.
Anthony Williams was named as a plaintiff in the First Amended Consolidated Class Action Complaint ("FAC"), but was omitted as such in the Second Amended Consolidated Class Action Complaint ("SAC"). The parties have not filed a request to change the case name nor is there a notice of voluntary dismissal of Williams as a plaintiff.
The factual background is based on the averments in the SAC, which must be taken as true at the pleading stage, with the exception of averments Facebook challenges as a factual matter as explained below.
The full facts of this case are set forth in this Court's prior order granting Facebook's first motion to dismiss and need not be repeated here. The prior order held the nature of the averred representation sounded in fraud, and therefore Rule 9(b) applied to all such claims. The prior order further held that the FAC failed to meet this heightened pleading standard because Plaintiffs did not include the allegedly fraudulent contact upload prompt or particularized averments of fraud in the FAC. Moreover, Plaintiffs failed to aver an economic injury to establish standing for the CDAFA cause of action. The prior order found, however, that Plaintiffs' CDAFA, intrusion upon seclusion, California privacy, and unjust enrichment claims could survive dismissal if fraud were sufficiently averred under Rule 9(b). Plaintiffs reallege these four claims, in addition to a new claim for fraud.
Plaintiffs' claims under California's Consumers Legal Remedies Act ("CLRA"), Cal. Civ. Code §§ 1750, et seq. , California's Unfair Competition Law ("UCL"), Cal. Bus. & Prof. Code §§ 17200, et seq. , trespass to chattel, and New York's General Business Law ("GBL"), Gen. Bus. Law § 349, were dismissed without leave to amend. (Dkt. 85 at 5 n.2, 17.)
Plaintiffs offer new averments to account for the deficiencies identified in the prior order. The SAC includes the language of the contact upload prompt, whereby Plaintiffs allege they were prompted to grant Facebook access to their "contacts" with the following text: "Allow Facebook Messenger access to your contacts?" (SAC ¶ 1 (the "Allow Access" prompt).) Below the prompt were choices labeled "Allow" or "Deny." (Id. ) According to Plaintiffs, selecting "Allow" permitted Facebook Messenger and Facebook Lite apps for Android scape users' call and text logs even though they were not explicitly asked to consent to such conduct. Additionally, the SAC contains new averments based on an email between Facebook employees that Plaintiffs contend show Facebook knew scraping users' call and text logs without permission was possible and that it would act accordingly. Finally, Plaintiffs provide new averments regarding how they suffered an economic injury-in-fact. They first contend that Facebook's conduct depleted their phones' resources, including "battery, electricity, cellular data, CPU processing power, RAM storage, and hard drive space." (SAC ¶¶ 6-9, 42.) Plaintiffs also rely on a diminution-in-value theory, whereby they allege their personal information has diminished in value now that Facebook has purportedly stolen and monetized the information, which has an established market value of $0.05 per individual.
III. LEGAL STANDARD
A complaint must contain "a short and plain statement of the claim showing that the pleader is entitled to relief." Fed. R. Civ. P. 8(a)(2). While "detailed factual allegations" are not required, a complaint must have sufficient factual allegations to state a claim that is "plausible on its face." Ashcroft v. Iqbal , 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009) (citing Bell Atl. v. Twombly , 550 U.S. 544, 555, 570, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007) ). A claim is facially plausible "when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Id. (citing Twombly , 550 U.S. at 556, 127 S.Ct. 1955 ). This standard asks for "more than a sheer possibility that a defendant has acted unlawfully." Id. The determination is a context-specific task requiring the court "to draw on its judicial experience and common sense." Id. at 679, 129 S.Ct. 1937.
Additionally, fraud claims are subject to a higher standard and the circumstances constituting fraud must be pleaded with particularity. Fed. R. Civ. P. 9(b). The same is true of state law claims that are grounded in fraud. Vess v. Ciba-Geigy Corp. USA , 317 F.3d 1097, 1103 (9th Cir. 2003). "To satisfy Rule 9(b), a pleading must identify the who, what, when, where, and how of the misconduct charged, as well as what is false or misleading about [the purportedly fraudulent] statement, and why it is false." Cafasso, U.S. ex rel. v. Gen. Dynamics C4 Sys., Inc. , 637 F.3d 1047, 1055 (9th Cir. 2011) (internal quotation marks omitted). "[T]he circumstances constituting the alleged fraud [must] be specific enough to give defendants notice of the particular misconduct ... so that they can defend against the charge and not just deny that they have done anything wrong." Vess , 317 F.3d at 1106 (internal quotation marks omitted).
A motion to dismiss a complaint under Rule 12(b)(1) of the Federal Rules of Civil Procedure challenges the court's subject matter jurisdiction over the asserted claims. It is the plaintiff's burden to prove jurisdiction at the time the action is commenced. Tosco Corp. v. Cmtys. For Better Env't , 236 F.3d 495, 499 (9th Cir. 2001), overruled on other grounds by Hertz Corp. v. Friend , 559 U.S. 77, 130 S.Ct. 1181, 175 L.Ed.2d 1029 (2010) ; Morongo Band of Mission Indians v. Cal. State Bd. of Equalization , 858 F.2d 1376, 1380 (9th Cir. 1988). "A Rule 12(b)(1) jurisdictional attack may be facial or factual." Safe Air for Everyone v. Meyer , 373 F.3d 1035, 1039 (9th Cir. 2004). "In a facial attack, the challenger asserts that the allegations contained in the complaint are insufficient on their face to invoke federal jurisdiction." Id. Accordingly, when considering this type of challenge, the court is required to "accept as true the allegations of the complaint." U.S. ex rel. Lujan v. Hughes Aircraft Co. , 243 F.3d 1181, 1189 (9th Cir. 2001). By contrast, in a factual attack, "the challenger disputes the truth of the allegations that, by themselves, would otherwise invoke federal jurisdiction." Safe Air , 373 F.3d at 1039. In resolving a factual attack on jurisdiction, the court need not presume the truthfulness of the plaintiff's allegations and it may review evidence beyond the complaint without converting the motion to dismiss into a motion for summary judgment. Id. Once a factual challenge has been raised to the court's subject matter jurisdiction, the party opposing dismissal must "present affidavits or any other evidence necessary to satisfy its burden of establishing that the court, in fact, possesses subject matter jurisdiction." Id. (quoting Savage v. Glendale Union High Sch. , 343 F.3d 1036, 1039 n.2 (9th Cir. 2003) ).
IV. DISCUSSION
A. Factual Attack on Jurisdiction
Facebook once more contests the sufficiency of Plaintiffs' allegations regarding their injury-in-fact. This time, Facebook provides evidence in the form of a declaration from Louis Boval, a Facebook software engineering manager, and accompanying exhibits to show Plaintiffs were not subjected to the practice they are challenging and therefore lack standing. See Foster v. Essex Prop., Inc. , No. 5:14-cv-05531-EJD, 2017 WL 264390, at *4 (N.D. Cal. Jan. 20, 2017) (granting Rule 12(b)(1) factual attack on standing in data breach case where defendant produced evidence showing plaintiffs' information was not on breached system). Specifically, Facebook asserts this evidence demonstrates that: (1) the Allow Access prompt could only have been presented to Plaintiffs on a later Android OS version that did not permit apps to access call and text logs without separate, explicit Android permission prompts, (Boval Decl. ¶¶ 9, 28, 39-40, 45-47); (2) Facebook presented each Plaintiff with Facebook's own prompt that explicitly sought consent to collect the logs, and Plaintiffs either consented through this separate consent screen or by subsequently opting-in through the Facebook Messenger settings, (Id. ¶¶ 6-8, 18-20, 22, 24-25, 51-54); and (3) none of the Plaintiffs downloaded the Facebook Lite app on their Android devices, (Id. at 10, 50-51, 55-56), and so no Plaintiff has standing to bring suit regarding conduct associated with that specific app. Separately, Facebook submits a declaration from Konstantinos Papamiltiadis, Facebook's Director of Developer Platforms and Programs, to argue that Facebook never disseminated the logs to third parties, and therefore Plaintiffs cannot establish a privacy-based injury premised on the disclosure of their information. (Papamiltiadis Decl. ¶¶ 6-11.)
Facebook's accompanying sealing motion will be granted by separate order.
Article III of the U.S. Constitution authorizes the judiciary to adjudicate only "cases" and "controversies." The doctrine of standing is "an essential and unchanging part of the case-or-controversy requirement of Article III." Lujan v. Defs. of Wildlife , 504 U.S. 555, 560, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992). The three well-known "irreducible constitutional minim[a] of standing" are injury-in-fact, causation, and redressability. Id. at 560-61, 112 S.Ct. 2130. A plaintiff bears the burden of demonstrating that her injury-in-fact is "concrete, particularized, and actual or imminent; fairly traceable to the challenged action; and redressable by a favorable ruling." Monsanto Co. v. Geertson Seed Farms , 561 U.S. 139, 149, 130 S.Ct. 2743, 177 L.Ed.2d 461 (2010). As mentioned above, it is the Plaintiffs' burden to establish these elements.
Since Facebook has attacked Plaintiffs allegations factually, Plaintiffs must establish their standing "with ‘competent proof.’ " Leite v. Crane Co. , 749 F.3d 1117, 1121 (9th Cir. 2014) ("When the defendant raises a factual attack, the plaintiff must support her jurisdictional allegations with ‘competent proof,’ under the same evidentiary standard that governs in the summary judgment context." (citation omitted)). Plaintiffs initially countered that these jurisdictional facts were wholly intertwined with the merits of their claims such that resolution of these issues must be deferred until summary judgment or trial. The Ninth Circuit has held that jurisdictional issues and substantive issues are intertwined where "a statute provides the basis for both the subject matter jurisdiction of the federal court and the plaintiff's substantive claim for relief." Safe Air , 373 F.3d at 1039 (internal quotation marks omitted). While Plaintiffs initially failed to submit any competing evidence to create a dispute of material fact warranting deferral, they contend that they have now done so in the form of a late administrative motion for leave to submit a declaration from Jason Frankovitz, an expert Plaintiffs retained to rebut the assertions contained in the Boval Declaration. (Dkt. 119.)
Frankovitz contends that although Android had an update to correct the alleged vulnerability in 2012, a great number of consumers did not download it such that they were still exposed to Facebook's purported scraping of user data. He further asserts the Boval Declaration does not affirmatively state that Facebook failed to scrap Plaintiffs' data prior to their purported individual consents in 2015 and 2016. Frankovitz does not state that Plaintiffs failed to update their phones, only that they have call and text log entries dating from prior to their purported dates of consent. Facebook opposes consideration of the Frankovitz Declaration, claiming it is too late for Plaintiffs to submit it, relying on Daubert -type arguments regarding the admissibility of Frankovitz's expert opinions, and contending his opinion fails to create a dispute of material fact.
To be sure, Frankovitz's opinions, or, more appropriately, the lack thereof, do not present a guaranteed path to victory for Plaintiffs. Stating that many or even most consumers failed to update their Android phones to foreclose Facebook's continued scraping of user call and text logs is not the same as asserting that these particular plaintiffs shared in that failure. Nevertheless, resolving all doubt in favor of Plaintiffs, it is enough to create a dispute of material fact with respect to Facebook's factual attacks regarding which Android version Plaintiffs were using and whether they consented to an explicit prompt to access their call and text logs. If Plaintiffs or other members of the putative class failed to update an older version of Android such that they were exposed to Facebook's alleged scraping prior to giving express consent for such data collection, this would be enough to establish injury-in-fact. Whether they are ultimately successful in proving such facts is another matter that is appropriately addressed in a subsequent fact-finding stage of the litigation. Although Plaintiffs' explanation for submitting the Frankovitz Declaration now instead of as part of the original motion practice is questionable, there is a strong preference to resolve issues on the merits. Moreover, Facebook's Daubert -type arguments regarding whether Frankovitz's expert opinions are admissible are better addressed prior to trial and not at the pleadings stage. Therefore, the Frankovitz Declaration identifies a dispute of material fact regarding Facebook's first two factual attacks on standing and Plaintiffs' motion for leave to file is granted.
Facebook has filed an administrative motion of its own for leave to submit recent authority from another Court in this district. (Dkt. 124.) The motion is denied for two reasons: it is not necessary specifically to move to submit such authority, as the Court can readily consider recent cases decided in its District sua sponte , and the case Facebook wishes to submit does not change the analysis here.
That said, Facebook must prevail on its third factual attack: that none of the Plaintiffs downloaded the Facebook Lite app on their Android devices, and so no Plaintiff has standing to bring suit regarding conduct associated with that specific app. Plaintiffs offer nothing in response to Facebook's evidence, such as declarations reaffirming they downloaded the app. Indeed, nothing in the Frankovitz Declaration states that any Plaintiff downloaded Facebook Lite. Plaintiffs' failure to submit any competing evidence to identify a dispute of material fact or to suggest that the jurisdictional and substantive issues are intertwined such that deferral is necessary warrants dismissal. Accordingly, Plaintiffs' claims with respect to the Facebook Lite app are dismissed for lack of standing.
Plaintiffs argue in the alternative that they must have discovery into the issues raised in Facebook's factual attack before their claims can be dismissed based on Facebook's unrebutted evidence. With the exception of whether Facebook disclosed user information to third parties, Plaintiffs have not explained why they need discovery to uncover facts that are within their control: facts regarding their own devices and experiences. Cf. Vera v. Bureau of Indian Affairs , 738 F. App'x 431, 432 (9th Cir. 2018) (reversing Rule 12(b)(1) dismissal for not permitting plaintiff to pursue discovery as to jurisdictional facts that were not within his knowledge or control, in this case the extent of government control over a portion of a road where plaintiff's accident occurred). Moreover, discovery has been ongoing for months and Plaintiffs have had the opportunity to collect facts establishing their standing to sue. Indeed, Facebook represents it has repeatedly requested evidence relevant to jurisdictional issues from Plaintiffs, who have refused to disclose them. Accordingly, Plaintiffs have presented no compelling reason to delay ruling on Facebook's Rule 12(b)(1) motion. See Am. W. Airlines, Inc. v. GPA Grp., Ltd. , 877 F.2d 793, 800-01 (9th Cir. 1989) (finding no abuse of discretion in district court's dismissing a case based on defendant's affidavits without granting further discovery when plaintiff did not seek discovery targeted to the jurisdictional issues during ten-month discovery period), disapproved on other grounds by Republic of Argentina v. Weltover, Inc. , 504 U.S. 607, 617, 112 S.Ct. 2160, 119 L.Ed.2d 394 (1992).
Finally, Facebook contends that, based on the evidence presented in the Konstantinos Declaration, Plaintiffs lack standing because their allegations of a privacy-based injury due to Facebook's alleged sharing of their call and text logs with third parties are inaccurate because Facebook did not share any such information with third parties. Konstantinos asserts Facebook did not share call or text logs as part of any agreement referenced in the June 2018 production to Congress and that Facebook has not provided third parties with access to users' call and text logs through any data-sharing mechanism. Facebook's arguments miss the mark. Whether Plaintiffs suffered a privacy-based injury through the disclosure of their information to third parties is a merits question intertwined with the jurisdictional question of their standing to sue. For example, in Van Patten v. Vertical Fitness Group, LLC , the Ninth Circuit held the plaintiffs established standing based on allegedly unwanted text solicitations, but lost on the merits because they consented to receive those texts. 847 F.3d 1037, 1043, 1048 (9th Cir. 2017) ; Cf. Bassett v. ABM Parking Servs., Inc. , 883 F.3d 776 (9th Cir. 2018) (affirming dismissal of case for lack of standing where plaintiff allege he received an overly revealing credit card receipt from defendant that was unseen by others and unused by identity thieves). Thus, any dispute about whether a plaintiff consented to receive texts went to the merits rather than to standing. In contrast to whether Plaintiffs downloaded the Facebook Lite app—a fact readily within their control outside of discovery—evidence of who, if any, third parties Facebook may have disclosed Plaintiffs' call and text logs, whether intentionally or inadvertently, are wholly within Facebook's control. To expect Plaintiffs to produce evidence to counter Facebook's factual attack on these grounds is inappropriate at this stage of litigation.
B. Facial Attack on Jurisdiction
Facebook contends Plaintiffs lack Article III standing as a facial matter for three reasons: (1) Plaintiffs were not subjected to the unlawful conduct and thus could not have been injured by it; (2) Plaintiffs' allegations do not show that they suffered an invasion of privacy injury because they do not explain why the call and text logs are sensitive/confidential; and (3) Plaintiffs allegations remain facially insufficient to state an economic injury. As previously discussed, the allegations in the SAC must be taken as true in a facial attack on jurisdiction.
1. Subjected to Unlawful Conduct
As with its factual attack, Facebook contends that, as a facial matter, Plaintiffs were not subjected to the purported unlawful conduct and so have no injury-in-fact. Since this is a facial attack, Facebook cannot simply introduce evidence to combat the averments in the SAC. Instead, Facebook requests judicial notice of the Android Developer Guides, which Facebook represents reveals that the Allow Access prompt Plaintiffs saw could not have appeared in prior versions of the Android operating system ("OS") that allegedly had the vulnerability Facebook exploited to access user call and text logs. The simple act of posting information on a webpage, however, even one that may not be edited by the general public, is insufficient on its own to make a fact worthy of judicial notice. Therefore, Facebook's argument fails.
2. Sensitivity of Information
The prior order rejected Facebook's argument that the call and text logs are not sensitive information and cannot form the basis of a concrete injury-in-fact. Whether someone has a reasonable expectation of privacy in their call and text logs "appear[ed] to involve a question of fact under California law." (Dkt. 85 at 8 (citing Hill v. Nat'l Collegiate Athletic Assn. , 7 Cal. 4th 1, 40, 26 Cal.Rptr.2d 834, 865 P.2d 633 (1994) ("Whether plaintiff has a reasonable expectation of privacy in the circumstances and whether defendant's conduct constitutes a serious invasion of privacy are mixed questions of law and fact.")).) Facebook now re-argues its prior point. Facebook contends it is appropriate for a court to inquire into the sufficiency of Plaintiffs' allegations regarding the sensitivity of the information in their call and text logs to determine whether Plaintiffs have satisfied their Article III burden of showing a concrete privacy inquiry. See Cahen v. Toyota Motor Corp. , 717 F. App'x 720, 724 (9th Cir. 2017) ; Cf. In re iPhone Application Litig. , 6 F. Supp. 3d 1004, 1014 n.5 (N.D. Cal. 2013) (finding no injury-in-fact notwithstanding plaintiffs' claim that their personal information was transmitted to third parties, when plaintiffs did not "explain how the mere transmission of data caused them concrete harm"). According to Facebook, the Ninth Circuit has held that "to sufficiently allege an injury due to invasion of their privacy," plaintiffs must include "specific allegations as to why th[e] [disseminated] data is sensitive[.]" Cahen , 717 F. App'x at 724. Facebook presents no compelling reason why, under California law, the prior order should be reconsidered.
Facebook further argues that it is not enough simply to allege that Facebook obtained Plaintiffs' information: they must allege how the obtaining of the information caused them harm. The prior order held that "standing for the remaining common law claims depends on the sufficiency of the averred disclosure of sensitive private information to third parties." Indeed, the prior order found sufficient the allegations that information was shared to third parties. It is similarly alleged here, so taking the SAC as true, as must be done in a facial attack, there is again no reason to disturb the prior ruling regarding the sufficiency of the complaint.
3. Economic Injury
The prior order observed the FAC lacked averments that offered a particularized or concrete harm related to the individual Plaintiffs' deprivation of any income. In dismissing the CDAFA claim due to Plaintiffs' failure to allege an actual injury, the Order held "[w]ithout a successful deprivation of income or actual loss, the CDAFA ... claim[ ] cannot proceed. It would not be enough for plaintiffs to rely on intangible invasion of privacy allegations, for example, without any claim the information had value before Facebook harvested it, diminished in value once Facebook accessed it, or was entirely unavailable to the plaintiffs after Facebook collected it."
In the SAC, Plaintiffs allege both diminution in value of their personal information and usage of their devices' resources as constituting actual economic damages. (SAC ¶¶ 6-9, 42.) Namely, the information has diminished in value now that Facebook has stolen and monetized it. The call and text logs Facebook stole are allegedly sold for, and have an established market value of, $0.05 per individual. Further, by scraping the call and text logs, Facebook allegedly caused Plaintiffs to deplete their phones' resources, including battery, electricity, cellular data, CPU processing power, RAM storage, and hard drive space.
Facebook asserts Plaintiffs' diminution in value injury is not particularized or concrete. As for particularity, Facebook notes Plaintiffs do not allege that they actually attempted to sell their logs and were unable to do so at their desired price, or that they want to sell their logs at all. See, e.g., In re Facebook Internet Tracking Litig. , 140 F. Supp. 3d 922, 930-32 (N.D. Cal. 2015) (finding no standing where plaintiffs alleged that collected information had "economic value" because plaintiffs did not show "that they personally lost the opportunity to sell their information"); In re Google Android Consumer Privacy Litig. , No. 11-md-02264-JSW, 2013 WL 1283236, at *4 (N.D. Cal. Mar. 26, 2013) (dismissing plaintiffs' diminution of value theory to challenge Google's collection of their personal data despite their allegation of a market for that data, because the plaintiffs "d[id] not allege they attempted to sell their personal information, that they would do so in the future, or that they were foreclosed from entering into a value for value transaction"). The Ninth Circuit's decision in In re Facebook Privacy Litigation , 572 F. App'x 494, 494 (9th Cir. 2014) reaches a contrary conclusion. There, the court found the loss of the sales value of disclosed information was sufficient to confer standing for breach of contract and fraud claims. Id. Courts in this district have since followed suit. See, e.g., Svenson v. Google Inc. , No. 13-cv-04080-BLF, 2015 WL 1503429, at *5 (N.D. Cal. Apr. 1, 2015) ("In light of the Ninth Circuit's ruling [in In re Facebook Privacy Litig. ], this Court concludes that Svenson's allegations of diminution in value of her personal information are sufficient."); id. (noting that "district court decisions requiring factual specificity as to how the defendant's use of the information deprived the plaintiff of the information's economic value," including [ In re Google Android Consumer Privacy Litig. ], were decided before In re Facebook Privacy Litig. ). These cases are persuasive and support finding Plaintiffs have satisfied particularity here.
As for concreteness, Facebook first argues that each individual Plaintiffs' alleged injury of $0.05 is de minimis, and that de minimis injuries are insufficient to confer standing. The injury may be minimal, Preminger v. Peake , 552 F.3d 757, 763 (9th Cir. 2008), so long as it amounts to more than an "identifiable trifle." Council of Ins. Agents & Brokers v. Molasky-Arman , 522 F.3d 925, 932 (9th Cir. 2008). Although small in amount, Plaintiffs allege more than an identifiable trifle. Indeed, "[t]he policy at the very core of the class action mechanism is to overcome the problem that small recoveries do not provide the incentive for any individual to bring a solo action prosecuting his or her rights." Amchem Prod., Inc. v. Windsor , 521 U.S. 591, 617, 117 S.Ct. 2231, 138 L.Ed.2d 689 (1997).
Facebook next attacks Plaintiffs' depletion of device resources injury as insufficiently concrete. According to Facebook, courts in the Ninth Circuit have rejected such injury allegations where plaintiffs either fail to provide details regarding the extent of the alleged resource consumption, or when the alleged facts revealed that any effect on a device's resources could only be negligible. Instead, Facebook interprets case law to suggest that courts at the pleadings stage have found an injury-in-fact on this theory where the defendant's wrongful activity is so constant or systematic as plausibly to cause a significant impact on the plaintiff's device, or when the plaintiff otherwise includes specific facts demonstrating the significant extent of the depletion or damage. See, e.g., In re Google Android , 2013 WL 1283236, at *5 (allegations that Google's collection of location data caused "chemical changes to the[ir] battery material," more quickly discharged batteries, and interrupted services). Giving the SAC the broadest interpretation, Plaintiffs have averred such systemic conduct by Facebook: that by consenting to Facebook's access to their contacts, not only were Plaintiffs' call and text logs prior to their consent scraped by Facebook, but that Facebook continued to scrap their call and text logs thereafter. Plaintiffs may face an uphill battle proving they have Article III standing under such a theory, but they have set forth sufficient facts to allege Article III standing. Therefore, Facebook's facial attacks on Plaintiffs' standing must fail.
C. Rule 9(b) Heightened Pleading
The prior Order held the nature of the averred misrepresentation sounded in fraud, and therefore Rule 9(b) applied to all such claims. The Order further held that the FAC failed to meet this heightened pleading standard because Plaintiffs did not include the allegedly fraudulent contact upload prompt or particularized averments of fraud in the FAC. The Order further found that the CDAFA, intrusion upon seclusion, California privacy, and unjust enrichment claims could survive dismissal if fraud is sufficiently averred under Rule 9(b). (Order at 12-13, 15, 18; see also id. at 12 (holding that Plaintiffs also needed to satisfy standing with regard to their CDAFA claim).) Plaintiffs reallege these four claims, in addition to a new claim for fraud (SAC ¶¶ 60-65). Facebook argues Plaintiffs have once more failed to satisfy Rule 9(b)'s heightened pleading requirements: they now identify the language of the Allow Access prompt (the "what"), but they do not allege the who, when, where, or how, of the alleged fraud, or what is false or misleading about the purportedly fraudulent statement and why it is false. See Cafasso , 637 F.3d at 1055.
Facebook's arguments ultimately fail to persuade. First, Facebook attacks the "who" prong, asserting Plaintiffs do not allege the Allow Access prompt is a Facebook statement. In Facebook's view, there is no averred fact for attributing Android's prompt to Facebook and is therefore insufficient to bring a claim grounded in fraud. The SAC, however, contains sufficient facts to allege the misleading statements at issue were triggered by Facebook's application, thereby becoming Facebook's statements by implication. Facebook's attacks under the "when" and "where" prong similarly bear no fruit. Facebook asserts Plaintiffs do not plead particularized facts showing when they were presented with the Allow Access prompt and what OS version was running on their device at that time. Such exacting specificity is not required, however, as the SAC contains sufficient facts to aver that Plaintiffs downloaded the Facebook Messenger apps on their personal Android phones prior to October 2017 (when the exploited vulnerability was patched thereby stopping Facebook's alleged misconduct). As for the "how," Plaintiffs sufficiently allege how Facebook exploited a vulnerability in prior versions of Android to access users' call and text logs without their consent. Finally, Plaintiffs sufficiently allege a reasonable person would not interpret a request for access to one's contacts as covering consent for Facebook to access one's call and text logs. Although not a model of precision, the SAC alleges enough facts at this time to state a claim under Rule 9(b).
D. Rule 12(b)(6)
The sole new claim Plaintiffs bring in the SAC is for common law fraud. Facebook's arguments therefore are advanced for the first time as to that claim. Otherwise, Facebook simply reargues many of its prior arguments in the first motion to dismiss but presents no compelling reasons to revisit the prior order.
As to the new claim, the elements of a cause of action for fraud in California are: (1) misrepresentation (either a false representation, concealment, or nondisclosure), (2) knowledge of falsity (scienter), (3) intent to defraud (to induce reliance), (4) justifiable reliance, and (5) resulting damage. Kearns v. Ford Motor Co. , 567 F.3d 1120, 1126 (9th Cir. 2009) (citing Engalla v. Permanente Med. Grp., Inc. , 15 Cal. 4th 951, 974, 64 Cal.Rptr.2d 843, 938 P.2d 903 (1997) ). Plaintiffs do not add new allegations to the Fraud section itself (paragraphs 60-65 of the SAC) beyond incorporating by reference the allegations in the rest of the SAC and reciting the elements of fraud. Since the SAC successfully states a claim for relief under Rule 9(b) for the other causes of action, it therefore succeeds in alleging a cause of action for common law fraud. Moreover, "[w]hile the factual circumstances of the fraud itself must be alleged with particularity, the state of mind—or scienter—of the defendants may be alleged generally." United Energy Trading, LLC v. Pac. Gas & Elec. Co. , 146 F. Supp. 3d 1122, 1138 (N.D. Cal. 2015). The SAC adequately alleges that Facebook knew what it was doing—scraping call and text logs without permission—because it was deliberately discussed among Facebook employees, including a recognition that doing so would be "a pretty high-risk thing to do from a PR perspective." (SAC ¶ 2; see also id. ¶ 3.) Accordingly, Plaintiffs common law fraud claim survives.
V. CONCLUSION
For the foregoing reasons, Plaintiffs lack standing only with regard to their allegations involving the Facebook Lite application and Facebook's motion is granted on that aspect under Rule 12(b)(1). Dismissal under Rule 12(b)(1) for lack of standing is without prejudice. See Fleck & Assocs., Inc. v. Phoenix , 471 F.3d 1100, 1106-07 (9th Cir. 2006). Facebook's motion is otherwise denied in all other respects. Plaintiffs' motion for leave to file the Frankovitz Declaration (Dkt. 119) is granted, while Facebook's motion for leave to submit recent authority (Dkt. 124) is denied. Finally, Facebook's sealing motion will be granted by separate order.