Summary
holding plaintiff did not state a claim for violation of CIPA § 631 because she had not alleged third party intercepted "content," but did state a claim for violation of CIPA § 631 for aiding in wiretapping by "allowing] a third party to access the communication."
Summary of this case from Massie v. Gen. MotorsOpinion
Case No. 5:20-cv-02439-JWH-SHKx
2021-07-15
Mary YOON, individually and on behalf of all others similarly situated, Plaintiff, v. LULULEMON USA, INC. and Quantum Metric, Inc., Defendants.
Joel D. Smith, Lawrence Timothy Fisher, Bursor and Fisher PA, Walnut Creek, CA, for Plaintiff. David Brian Farkas, Angela Christine Agrusa, DLA Piper LLP, Los Angeles, CA, for Defendant Lululemon USA Inc. Jovanna Bubar, Matthew Earl Ladew, Purvi G. Patel, Morrison and Foerster LLP, Los Angeles, CA, for Defendant Quantum Metric, Inc.
Joel D. Smith, Lawrence Timothy Fisher, Bursor and Fisher PA, Walnut Creek, CA, for Plaintiff.
David Brian Farkas, Angela Christine Agrusa, DLA Piper LLP, Los Angeles, CA, for Defendant Lululemon USA Inc.
Jovanna Bubar, Matthew Earl Ladew, Purvi G. Patel, Morrison and Foerster LLP, Los Angeles, CA, for Defendant Quantum Metric, Inc.
ORDER GRANTING-IN-PART AND DENYING-IN-PART DEFENDANTS’ MOTION TO DISMISS [ECF No. 23]
John W. Holcomb, UNITED STATES DISTRICT JUDGE Before the Court is the motion of Defendants Lululemon USA, Inc. and Quantum Metric, Inc. to dismiss, pursuant to Rule 12(b)(6) of the Federal Rules of Civil Procedure. The Court finds this matter appropriate for resolution without a hearing. See Fed. R. Civ. P. 78 ; L.R. 7-15. After considering the papers filed in support and in opposition, the Court orders that the Motion is GRANTED IN PART and DENIED IN PART , as set forth herein.
Defs.’ Joint Mot. to Dismiss (the "Motion") [ECF No. 23]; Req. for Judicial Notice (the "RJN") [ECF No. 24].
The Court considered the following papers: (1) Pl.’s First Am. Compl. (the "Amended Complaint") [ECF No. 20]; (2) the Motion; (3) Pl.’s Opp'n to the Motion (the "Opposition") [ECF No. 25]; and (4) Defs.’ Reply in Support of the Motion (the "Reply") [ECF No. 28].
I. BACKGROUND
Yoon alleges the following facts in her Amended Complaint, which the Court assumes to be true for the purposes of the instant Motion. See, e.g., Cahill v. Liberty Mut. Ins. Co. , 80 F.3d 336, 337-38 (9th Cir. 1996) (on motion to dismiss for failure to state a claim, "[a] allegations of material fact are taken as true and construed in the light most favorable to the nonmoving party").
Yoon is a resident of Corona, California. Lululemon is a Nevada corporation that does business in California, including through a website; Quantum Metric is a Delaware corporation. Yoon visited and made a purchase from Lululemon's website in April 2020.
Amended Complaint ¶ 4.
Id. ¶¶ 5-8.
Id. ¶ 4.
Lululemon uses Quantum Metric software called "Session Replay" to captures a customer's interactions with Lululemon's webpage, including mouse movements, clicks, keystrokes, scrolls, and pageviews. Quantum Metric markets this software as allowing a company " ‘to pull up any user who had visited [a] website and watch their journey as if [the company] was standing over their shoulder’ " and " ‘[s]ee actual customer interactions.’ " Quantum Metric has obtained patent protection for its Session Replay technology, which Quantum Metric touts as giving companies " ‘real-time visibility into all behavioral, technical, and segment data.’ " The monitoring that Quantum Metric's technology provides extends beyond the computer "cookies" with which ordinary consumers are familiar. One 2017 study found that products similar to Session Replay collected users’ passwords and credit card numbers. Lululemon is aware of this monitoring.
Id. ¶¶ 10 & 18.
Id. ¶¶ 18, 28, & 20.
Id. ¶ 35.
Id. ¶¶ 35 & 36.
Id. ¶¶ 41 & 42.
When Yoon visited Lululemon's website, Session Replay captured her keystrokes and clicks; pages viewed; shipping and billing information; date, time, and duration of visit; IP address and physical location; and browser type and operating system. Quantum Metric then supplies that information back to Lululemon. The home page and checkout page of Lululemon's website contain links to a Privacy Policy in size 7.5 non-contrasting font. Lululemon did not ask Yoon to agree to the Privacy Policy; rather, Lululemon instructed Yoon that she could "learn more" about the Privacy Policy when she placed her order. Yoon seeks to represent a class of similarly situated consumers; certification of that class is not currently before the Court. The Amended Complaint asserts the following four claims for relief against both Defendants: (1) violation of Cal. Penal Code § 631 ; (2) violation of Cal. Penal Code § 635 ; (3) invasion of privacy under California's Constitution; and (4) violation of 18 U.S.C. § 2512. Defendants’ Motion now stands submitted.
Id. ¶ 46.
Id. ¶ 26.
Id. ¶¶ 55 & 56.
Id. ¶¶ 56 & 57.
Id. ¶¶ 63-71.
See generally Amended Complaint.
II. LEGAL STANDARD
Under Rule 12(b)(6), a party may make a motion to dismiss for failure to state a claim upon which relief can be granted. Rule 12(b)(6) must be read in conjunction with Rule 8(a), which requires a "short and plain statement of the claim showing that a pleader is entitled to relief," in order to give the defendant "fair notice of what the claim is and the grounds upon which it rests." Bell Atlantic Corp. v. Twombly , 550 U.S. 544, 555, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007) ; see Horosny v. Burlington Coat Factory, Inc. , 2015 WL 12532178, at *3 (C.D. Cal. Oct. 26, 2015). When evaluating a Rule 12(b)(6) motion, a court must accept all material allegations in the complaint—as well as any reasonable inferences to be drawn from them—as true and must construe them in the light most favorable to the non-moving party. See, e.g., Doe v. United States , 419 F.3d 1058, 1062 (9th Cir. 2005). "While a complaint attacked by a Rule 12(b)(6) motion to dismiss does not need detailed factual allegations, a plaintiff's obligation to provide the ‘grounds’ of his ‘entitlement to relief’ requires more than labels and conclusions, and a formulaic recitation of the elements of a cause of action will not do." Twombly , 550 U.S. at 555, 127 S.Ct. 1955 (citations omitted). Rather, the allegations in the complaint "must be enough to raise a right to relief above the speculative level." Id.
Although the scope of review on a Rule 12(b)(6) motion to dismiss is limited to the contents of the complaint, the Court may consider certain materials, such as documents attached to the complaint, documents incorporated by reference in the complaint, or matters of judicial notice. United States v. Ritchie , 342 F.3d 903, 907-08 (9th Cir. 2003). Under the incorporation by reference doctrine, the Court may consider documents not attached to the pleading if: (1) those documents are referenced extensively in the complaint or form the basis of the plaintiff's claim; and (2) no party questions their authenticity. Knievel v. ESPN , 393 F.3d 1068, 1076 (9th Cir. 2005).
Generally, "a district court should grant leave to amend even if no request to amend the pleading was made, unless it determines that the pleading could not possibly be cured by the allegation of other facts." Lopez v. Smith , 203 F.3d 1122, 1127 (9th Cir. 2000) (en banc ) (internal quotations omitted).
III. DISCUSSION
A. Request for Judicial Notice
"A court shall take judicial notice if requested by a party and supplied with the necessary information." Fed. R. Evid. 201(d). An adjudicative fact may be judicially noticed if it is "not subject to reasonable dispute in that it is either (1) generally known within the territorial jurisdiction of the trial court, or (2) capable of accurate and ready determination by resort to sources whose accuracy cannot reasonably be questioned." Id. Defendants request that the Court take notice of the following documents:
• U.S. Patent No. 10,656,984 (the "Session Replay Patent I") [ECF No. 24, Ex. A];
• Screenshots of the "Frequently Asked Questions" and "Data Privacy and Security" sections of Quantum Metric's website, captured on October 30, 2020, by the Wayback Machine ("QM Website Screenshots") [ECF No. 24, Ex. B];
• U.S. Patent No. 10,146,752 (the "Session Replay Patent II") [ECF No. 24, Ex. C];
• Screenshot of Lululemon's website's Privacy Policy captured on April 19, 2020, by the Wayback Machine (the "Lululemon Privacy Policy") [ECF No. 24, Ex. D];
• Screenshot of the Lululemon website captured on February 8, 2021 (the "Lululemon Website Screenshot") [ECF No. 24, Ex. E]; and
• Screenshot of an October 18, 2018, blog post on Quantum Metric's website captured on March 24, 2021 (the "Blog Post") [ECF No. 24, Ex. F].
Yoon opposes the RJN in its entirety. The Court considers each individual request below.
Opposition at 33:5-35:18.
Yoon opposes judicial notice of the Session Replay Patents I and II, arguing that they are "irrelevant." This seems unlikely, as Yoon quoted from the Patents in her Amended Complaint. The Court may therefore take judicial notice of the Patents either (1) under the incorporation-by-reference doctrine; or (2) because they are relevant and capable of accurate determination. The Court GRANTS the RJN with respect to the Session Replay Patents.
Id. at 34:25.
Defendants request judicial notice of the QM Website Screenshots because their contents are alleged in the Amended Complaint. Yoon opposes judicial notice, arguing that the contents of the QM Website were not included in the Amended Complaint. Defendants are correct: the Amended Complaint references Quantum Metric's website. Indeed, the Amended Complaint does not merely mention the website; it extensively discusses the ways in which Quantum Metric advertises Session Replay. In this section of the Amended Complaint, Yoon relies upon Quantum Metric's alleged advertisements to explain how Session Reply works. The Court therefore GRANTS the RJN with respect to the QM Website Screenshots. The Court additionally GRANTS the RJN with respect to the Lululemon Privacy Policy and the Lululemon Website Screenshot because the Amended Complaint also discusses those documents extensively. Because the Court does not consider the Blog Post, it DENIES the RJN with respect to that document. B. Motion to Dismiss
RJN at 3:26-4:10.
Opposition at 34:27-35:4.
Amended Complaint ¶ 20 (citing ECF No. 19 at 34 (screenshots of Quantum Metric's website, attached to Defs.’ Req. for Judicial Notice [ECF No. 19] attached to prior moot Mot. to Dismiss [ECF No. 18; see ECF No. 22]).)
Amended Complaint ¶¶ 18-26.
Yoon's cited case, Khoja v. Orexigen Therapeutics, Inc. , 899 F.3d 988 (9th Cir. 2018), is inapposite. See Opposition at 33:11-33:19 (citing Khoja ). That case discussed when "documents not mentioned in the complaint" can be incorporated by reference "in SEC fraud matters, where there is already a heightened pleading standard, and the defendants possess materials to which the plaintiffs do not yet have access." Khoja , 899 F.3d at 1003, 998.
1. First Claim for Relief: Violation of California Invasion of Privacy Act § 631
California Invasion of Privacy Act ("CIPA"), Cal. Penal Code § 631, reads as follows:
(a) Any person who, by means of any machine, instrument, or contrivance, or in any other manner,
[i] intentionally taps, or makes any unauthorized connection, whether physically, electrically, acoustically, inductively, or otherwise, with any telegraph or telephone wire, line, cable, or instrument, including the wire, line, cable, or instrument of any internal telephonic communication system, or
[ii] who willfully and without the consent of all parties to the communication, or in any unauthorized manner, reads, or attempts to read, or to learn the contents or meaning of any message, report, or communication while the same is in transit or passing over any wire, line, or cable, or is being sent from, or received at any place within this state; or
[iii] who uses, or attempts to use, in any manner, or for any purpose, or to communicate in any way, any information so obtained, or
[iv] who aids, agrees with, employs, or conspires with any person or persons to unlawfully do, or permit, or cause to be done any of the acts or things mentioned above in this section,
is punishable by a fine ....
Cal. Penal Code § 631(a) (line breaks and subdivisions added for ease of reference). Courts agree, and the parties do not contest, that CIPA § 631(a) applies to communications conducted over the internet. See Matera v. Google Inc. , 2016 WL 8200619, at *21 (N.D. Cal. Aug. 12, 2016) (collecting cases). Yoon alleges that Quantum Metric violated § 631(a) [i] and [ii] and that Lululemon violated § 631(a) [iv].
Amended Complaint ¶¶ 77, 78, & 80.
Before the Court analyzes the components of § 631(a) [i] and § 631(a) [ii] individually, it must address the so-called "participant exception." Courts agree that § 631(a) [i] and [ii] apply only to third parties and not to participants. Powell v. Union Pac. R. Co. , 864 F. Supp. 2d 949, 955 (E.D. Cal. 2012) (collecting cases). Separating participants from third parties, however, is not as straightforward as one might hope. Quantum Metric contends that Yoon agreed to its presence in the conversation because it was "conspicuously disclosed in numerous parts of Lululemon's Privacy Policy." Furthermore, Quantum Metric maintains that even absent Yoon's consent, Quantum Metric was a participant in the conversation because "Lululemon voluntarily and intentionally embedded Quantum's script" in its website, and, so, Quantum Metric acted "on Lululemon's behalf." Therefore, the argument goes, Quantum Metric was a participant, not a third party.
Motion at 9:5-9.
Motion at 8:3-11.
The disclosure in Lululemon's Privacy Policy of Quantum Metric's presence does not constitute consent on Yoon's part. The Lululemon Privacy Policy reads, in part:
We share personal data with unaffiliated companies or individuals we hire or work with that perform services on our behalf, including ... information technology .... We only share with service providers the personal data that they need to perform services for us .... We may allow others to provide analytics services and serve advertisements on our behalf across the web and in mobile
applications. These entities may use cookies, web beacons, device identifiers, and other tracking technologies which collect information about your use of the Services and other websites and applications. This information may be used by lululemon and others to, among other things, analyze and track data, determine the popularity of certain content, deliver advertising and content targeted to your interest on our Services and other websites, and better understand your online activity.
"Lululemon" is stylized "lululemon"—e e cummings-like—in the Privacy Policy.
Lululemon Privacy Policy at 3, 5.
The Ninth Circuit has held, however, that such privacy policies do not bind users: "where a website makes its terms of use available via a conspicuous hyperlink on every page of the website but otherwise provides no notice to users nor prompts them to take any affirmative action to demonstrate assent, even close proximity of the hyperlink to relevant buttons users must click on—without more—is insufficient to give rise to constructive notice." Nguyen v. Barnes & Noble Inc. , 763 F.3d 1171, 1178–79 (9th Cir. 2014). For the purposes of Rule 12(b)(6), then, Yoon has sufficiently alleged that she did not consent to Quantum Metric's participation in the conversation.
Quantum Metric additionally contends, however, that it was a participant even without Yoon's consent, because it stood in the shoes of Lululemon. At least one federal district court in California has disagreed with Quantum Metric's argument: "[I]t cannot be that anyone who receives a direct signal escapes liability by becoming a party to the communication. Someone who presses up against a door to listen to a conversation is no less an eavesdropper just because the sound waves from the next room reach his ears directly." Revitch v. New Moosejaw, LLC , 2019 WL 5485330, at *2 (N.D. Cal. Oct. 23, 2019). However, in a case nearly identical to the instant case, a different Northern District of California court found that a defendant that provided tracking services was a participant in the conversation for the purposes of § 631(a) because that defendant merely stored, but did not otherwise use or resell, the user's data, unlike the Moosejaw defendant. See Graham v. Noom, Inc. , 533 F.Supp.3d 823, 833–34 (N.D. Cal. Apr. 8, 2021). The Graham court reasoned that the tracking defendant provided a tool, much like a tape recorder, and therefore was a participant in the conversation, not an eavesdropper. Id. at 832–332.
The question thus becomes, in analogue terms: is Quantum Metric a tape recorder held by Lululemon, or is it an eavesdropper standing outside the door? This is a question of fact for a jury, best answered after discovery into the storage mechanics of Session Replay. For the purposes of the instant Motion, Yoon's first claim for relief survives Quantum Metric's participant exception challenge because she alleges that QM captures, stores, and interprets her real-time data—which extends beyond the ordinary function of a tape recorder.
Quantum Metric briefly suggests that it should be considered an extension of Lululemon under the California Consumer Privacy Act of 2018, Cal. Civ. Code § 1798.140, but it offers no authority to suggest that the Consumer Privacy Act rewrote CIPA in that way. Motion at 8:12-9:4.
Quantum Metric does not otherwise challenge Yoon's § 631(a) [i] claim. However, it contends that her § 631(a) [ii] claim should be dismissed because Session Replay does not collect the "contents" of Yoon's communications and because Session Replay does not collect communications "in transit."
Motion at 11:1-13:5, 13:6-15:12.
Section 631(a) [ii] penalizes a person who "reads, or attempts to read, or to learn the contents or meaning of any message, report, or communication ...." (emphasis added). The Ninth Circuit has held that the "contents" of an online communication under federal wiretap law "refers to the intended message conveyed by the communication, and does not include record information regarding the characteristics of the message that is generated in the course of the communication." In re Zynga Priv. Litig. , 750 F.3d 1098, 1106 (9th Cir. 2014) (contents transmitted by Facebook.com did not include a user's Facebook ID and browsing history when automatically gathered, but it could include messages that stated that information).
Yoon argues that the Ninth Circuit recently enlarged the definition of "contents" in In re Facebook, Inc. Internet Tracking Litig. , 956 F.3d 589 (9th Cir. 2020), cert. denied sub nom. Facebook, Inc. v. Davis , ––– U.S. ––––, 141 S.Ct. 1684, 209 L.Ed.2d 464 (2021). Not so: the Ninth Circuit explicitly stated that it analyzed only the participant exception to CIPA, not the other elements of the statute. Id. at 608. That court did determine that "a full-string detailed URL, which contains the name of a website, folder and sub-folders on the web-server, and the name of the precise file requested" carries the same expectation of privacy as a message for standing purposes, but it did not clarify whether that holding enlarges the definition of "contents" in wiretapping statutes. Id. at 605.
The parties do not dispute that this definition of "content" applies to CIPA § 631(a) [ii] claims. Numerous federal courts have applied this definition in this context. See, e.g., Brodsky v. Apple Inc. , 445 F. Supp. 3d 110, 127 (N.D. Cal. 2020) (text messages are content, but "user names, passwords, and geographic location information are not"); In re Vizio, Inc., Consumer Priv. Litig. , 2017 WL 11420284, at *6 (C.D. Cal. July 25, 2017) (" ‘samples’ of the actual content displayed on a consumer's screen" are message content because "[w]hen watching a program through a connected device or streaming service, the ‘intended message conveyed by the communication’ is the program that the consumer is watching") (citing Zynga , 750 F.3d at 1106 ); In re Carrier IQ, Inc. , 78 F. Supp. 3d 1051, 1083 (N.D. Cal. 2015) (intercepted text messages and URLs containing search terms constitute content, but user names and passwords do not, even when transmitted together to allow another to gain access); In re Yahoo Mail Litig. , 7 F. Supp. 3d 1016, 1034 (N.D. Cal. 2014) ("email content" is content for wiretapping statutes, but "name, address, email address or phone number" are not); In re Nickelodeon Consumer Priv. Litig. , 2014 WL 3012873, at *15 (D.N.J. July 2, 2014) ("IP addresses and URLs" are not content); McCoy v. Alphabet, Inc. , 2021 WL 405816, at *14 (N.D. Cal. Feb. 2, 2021) ("data on when and how often an Android Smartphone user opens and runs non-Google apps and the amount of time spent on the apps" is not content). Taken together, this body of caselaw suggests that CIPA § 631(a) [ii] protects only the internal, user-generated material of a message, not routine identifiers, whether automatically generated or not.
"The analysis for a violation of CIPA is the same as that under the federal Wiretap Act." Brodsky v. Apple Inc. , 445 F. Supp. 3d 110, 127 (N.D. Cal. 2020).
Yoon alleges that Quantum Metric recorded her "keystrokes, mouse clicks, pages viewed, and shipping and billing information ... [and] the date and time of the visit, the duration of the visit, Plaintiff's IP address, her location at the time of the visit, her browser type, and the operating system on her device." None of these pieces of data constitutes message content in the same way that the words of a text message or an email do. Thus, because she has not alleged that Quantum Metric intercepted "content," Yoon's Amended Complaint as currently pleaded does not state a claim for violation of CIPA § 631(a) [ii].
Amended Complaint ¶ 46.
The final portion of Yoon's CIPA § 631(a) claim to consider is her allegation that Lululemon violated § 631(a) [iv] by abetting Quantum Metric's alleged wiretapping. Courts disagree over whether conversation participants can be liable under § 631(a) [iv] for aiding in wiretapping if they allow a third party to access the communication. Compare Moosejaw , 2019 WL 5485330, at *2 (conversation participants may be liable for conspiracy because § 631 "was designed to protect a person placing or receiving a call from a situation where the person on the other end of the line permits an outsider to tap his telephone or listen in on the call") (citing Ribas v. Clark , 38 Cal. 3d 355, 363, 212 Cal.Rptr. 143, 696 P.2d 637 (1985) ) with Powell v. Union Pac. R. Co. , 864 F. Supp. 2d 949, 955 (E.D. Cal. 2012) (conversation participants may not be liable for conspiracy to eavesdrop because a party may record its own conversation) (collecting cases). This Court agrees with the court's reasoning in Moosejaw : a conversationalist is betrayed equally by a wiretapper and by the willing conversation participant who surreptitiously allows that third party to wiretap. Yoon has therefore stated a claim against Lululemon for violation of § 631(a) [iv].
The Court GRANTS-IN-PART the Motion as summarized above, DISMISSES the portion of Yoon's Amended Complaint that alleges that Quantum Metric "willfully and without the consent of all parties to the communication, or in any unauthorized manner, read[ ], or attempt[ed] to read[ ], or to learn the contents or meaning of any message, report, or communication," and otherwise DENIES the Motion with respect to Yoon's first claim for relief.
Amended Complaint ¶¶ 74 & 78.
Defendants contend that Yoon's "§ 631 claim rests on the allegation that Defendants[ ] surreptitiously recorded her interactions with Lululemon's website." Motion at 15:13-21:10 (emphasis in original). However, in making that argument, Defendants cite only to her fourth claim for relief for violation of the Federal Wiretap Act. Id. (citing Amended Complaint ¶¶ 105 & 108). The Court therefore understands Defendants’ contention to be connected to the fourth claim for relief, not the first. Because the Court grants the Motion with respect to the fourth claim for relief on other grounds, it need not engage in this question here. Defendants later contend that because there is "nothing surreptitious about their actions," Yoon has no § 631 claim. Motion at 19:4-5. The word "surreptitious" appears in the federal statute but not in CIPA § 631. The standard for CIPA § 631 is not whether a wiretapper's actions were "surreptitious." Rather, as discussed above, the inquiry focuses upon consent. And, under controlling Ninth Circuit law, Yoon did not consent to the Privacy Policy on the first page of Lululemon's website. The Court therefore DENIES Defendants’ Motion without prejudice with respect to their arguments pertaining to the Privacy Policy.
2. Second and Fourth Claims for Relief: Violations of CIPA § 635 and Federal Wiretap Act, 18 U.S.C. § 2512
In her second and fourth claims for relief, Yoon alleges that both Defendants violated CIPA § 635 and the Federal Wiretap Act, 18 U.S.C. § 2512, respectively. Defendants contend that there is no private right of action for violations of either statute. Because those two statutes are analogous, the Court considers them together. For clarity, the Court discusses the federal statute first.
Amended Complaint ¶¶ 85-92, 102-111.
Motion at 22:7-23:20. The Court need not reach Defendants’ other arguments concerning the Second and Fourth claims for relief.
a. Federal Statute
Section 2512(1) of the Federal Wiretap Act provides for a fine or imprisonment of "any person who intentionally ... (b) manufactures, assembles, possesses, or sells any electronic, mechanical, or other device, knowing or having reason to know that the design of such device renders it primarily useful for the purpose of the surreptitious interception of wire, oral, or electronic communications ...." 18 U.S.C. § 2512(1). If Session Replay is a device that surreptitiously intercepted Yoon's communications, then Yoon adequately alleges facts to support a claim that Quantum Metric "manufactures, assembles, possesses, or sells" devices used to intercept her communications with Lululemon. However, there are no facts in the Amended Complaint to support a claim that Lululemon manufactured, assembled, possessed, or sold Session Replay; rather, the gravamen of Yoon's lawsuit is that Quantum Metric possessed Session Replay and thereby possessed Yoon's data.
However, Yoon's 18 U.S.C. § 2512(1) claim against Quantum Metric does not necessarily stand. By its plain terms, § 2512(1) of the Wiretap Act does not provide for a private right of action. That procedural vehicle is found in § 2520(a) of the Wiretap Act: "any person whose wire, oral, or electronic communication is intercepted, disclosed, or intentionally used in violation of this chapter may in a civil action recover from the person or entity ... which engaged in that violation ...." 18 U.S.C. § 2520(a). Defendants argue that § 2512(1) of the Wiretap Act criminalizes the manufacturing, assembly, sale , or advertisement of wiretap technology, while § 2520(a) is a civil vehicle available only to people injured by the interception, disclosure , or use of wiretapped communications; § 2520(a) does not provide a private right of action for violations of § 2512(1).
The Ninth Circuit has not considered whether § 2520(a) of the Wiretap Act provides a private right of action for § 2512(1). However, the three circuit courts that have considered the question have all concluded that " § 2520 provides a cause of action against only those defendants whose violation of the Wiretap Act consists of an intercept, disclosure, or intentional use of a communication ." Luis v. Zang , 833 F.3d 619, 636 (6th Cir. 2016) (emphasis added) (citing DirecTV, Inc. v. Treworgy , 373 F.3d 1124, 1127 (11th Cir. 2004) ; DIRECTV Inc. v. Robson , 420 F.3d 532, 539 & n.31 (5th Cir. 2005) ). Thus, a private citizen such as Yoon cannot sue Quantum Metric merely for its manufacture, assembly, sale, or advertising of Session Replay. Quantum Metric contends that Yoon's fourth claim for relief ends here.
The Sixth Circuit in Luis , however, found that § 2520(a) of the Wiretap Act may support a § 2512(1) claim against a defendant "when that defendant also plays an active role in the use of the relevant device to intercept, disclose, or intentionally use a plaintiff's electronic communications." Luis , 833 F.3d at 637. Javier Luis, the plaintiff in that case, alleged that his female friend's husband installed a software program called WebWatcher on her computer that intercepted Mr. Luis's communications to his female friend. WebWatcher then forwarded copies of Mr. Luis's emails to a server run by the defendant, the technology company that had manufactured WebWatcher. Id. at 623-24. The Sixth Circuit held that because the defendant had continuously operated the device that intercepted Mr. Luis's communications, Mr. Luis could assert a § 2512(1) claim through § 2520(a) of the Wiretap Act. Yoon urges us to apply the same logic in the instant case. That analysis, however, strains the language of § 2520(a) and § 2512(1) too far. Section 2512(1) provides for fines or imprisonment; it is therefore a criminal statute. Section 2520(a) provides a civil right of action for persons whose communications are "intercepted, disclosed, or intentionally used in violation of this chapter." But the "manufacturing, assembly, possession, or sale" activities that are criminalized in § 2512(1) are distinct from "interception, disclosure, or use" activities. Moreover, § 2520(a) allows recovery "from the person or entity ... which engaged in that violation ..."—"that violation" referring to "interception, disclosure, or use." The two provisions speak past each other; one criminalizes the manufacturing of wiretap technology, while the other allows for private civil lawsuits stemming from the use of that technology. The Court therefore finds that there is no private right of action for the violation of § 2512(1) of the Wiretap Act.
b. California Statute
Defendants argue that CIPA § 635, the analogous state statute, similarly provides for no private right of action. CIPA § 635(a) penalizes "[e]very person who manufactures, assembles, sells, offers for sale, advertises for sale, possesses, transports, imports, or furnishes to another any device which is primarily or exclusively designed or intended for eavesdropping upon the communication of another ...." Cal. Penal Code § 635(a). As discussed above, Yoon cannot make out a claim against Lululemon for violation of CIPA § 635(a). Yoon has, however, alleged sufficient facts to make out a CIPA § 635(a) claim against Quantum Metric if she has a private right of action. She does not.
Motion at 23:11-20.
CIPA § 637.2 provides the private right of action for CIPA violations: "Any person who has been injured by a violation of this chapter may bring an action against the person who committed the violation ...." Cal. Penal Code § 637.2(a). The parties do not cite, and the Court could not find, authority on whether § 637.2(a) provides a private right of action for claims arising under § 635. Happily, however, the language of the CIPA is far more straightforward than the analogous language of the Wiretap Act: only a person "who has been injured by a violation of this chapter" may assert a civil claim. Quantum Metric's manufacture, assembly, sale, advertisement, transportation, import, or furnishing of Session Replay did not directly injure Yoon. Rather, Yoon alleges that Lululemon's use of Session Replay injured her. For that reason, CIPA § 637.2 does not provide Yoon with a private right of action to enforce CIPA § 635 against Quantum Metric.
The Court therefore GRANTS Defendants’ Motion with respect to the second and fourth claims for relief and DISMISSES those portions of Yoon's Amended Complaint.
3. Third Claim for Relief: Invasion of Privacy
Yoon's third claim for relief is for invasion of privacy under the California Constitution against both Defendants. Article I, section 1 of the California Constitution declares privacy an inalienable right of the people of California. Cal. Const. Art. I, § 1. The California state law right is broader than the federal privacy right, because it protects individuals from invasion of privacy by private parties as well as state actors. Leonel v. Am. Airlines, Inc. , 400 F.3d 702, 711–12 (9th Cir. 2005), opinion amended on denial of reh'g , No. 0315890, 2005 WL 976985 (9th Cir. Apr. 28, 2005). To establish a claim under the California Constitution's right to privacy, a plaintiff must demonstrate three elements: (1) a legally protected privacy interest; (2) a reasonable expectation of privacy under the circumstances; and (3) conduct by the defendant that amounts to a serious invasion of the protected privacy interest. Hernandez v. Hillsides, Inc. , 47 Cal. 4th 272, 287, 97 Cal.Rptr.3d 274, 211 P.3d 1063 (2009) ; Hill v. Nat'l Collegiate Athletic Ass'n , 7 Cal. 4th 1, 35–37, 26 Cal.Rptr.2d 834, 865 P.2d 633 (1994). Defendants attack all three prongs of Yoon's third claim for relief.
Defendants allege that Yoon has no legally protected privacy interest in her browsing data: keystrokes and clicks; pages viewed; shipping and billing information; date, time, and duration of visit; IP address and physical location; and browser type and operating system. Under the California Constitution, "[l]egally recognized privacy interests are generally of two classes: (1) interests in precluding the dissemination or misuse of sensitive and confidential information (‘informational privacy’); and (2) interests in making intimate personal decisions or conducting personal activities without observation, intrusion, or interference (‘autonomy privacy’)." Hill , 7 Cal.4th at 35, 26 Cal.Rptr.2d 834, 865 P.2d 633. Yoon contends that Defendants violated her right to autonomy privacy. But autonomy privacy protects bodily autonomy; courts have not extended the concept to data autonomy. See In re Google Location Hist. Litig. , 428 F. Supp. 3d 185, 198 (N.D. Cal. 2019). The Court therefore considers whether Yoon has an informational privacy interest in the data collected during her visit to Lululemon's website.
Motion at 27:13-29:16.
Opposition at 28:22-23.
The Ninth Circuit recently held that Facebook users had a cognizable privacy interest in browsing data surreptitiously collected by Facebook across the internet after the user had logged out of his Facebook account. In re Facebook, Inc. Internet Tracking Litig. , 956 F.3d 589, 602–03 (9th Cir. 2020), cert. denied sub nom. Facebook, Inc. v. Davis , ––– U.S. ––––, 141 S.Ct. 1684, 209 L.Ed.2d 464 (2021) ; see also Rodriguez v. Google LLC , 2021 WL 2026726, at *8 (N.D. Cal. May 21, 2021) (applying Facebook to find that users have a privacy interest in their internet-wide browsing history). But courts have been less willing to find that users have a cognizable privacy interest in browsing data collected only while users interact with the website of the defendant company. See, e.g., In re Google Location Hist. Litig. , 428 F. Supp. 3d 185, 198 (N.D. Cal. 2019) (no privacy interest where Google "only tracked and collected data during use of Google services"); In re Yahoo Mail Litig. , 7 F. Supp. 3d 1016, 1041 (N.D. Cal. 2014) (users had only a cognizable privacy interest in "sensitive" and "confidential" portions of emails sent to Yahoo users, rather than in contents of emails broadly). Yoon cites no cases that contradict this dichotomy, nor does she allege facts to suggest that Defendants track her data outside of the Lululemon website. The Court therefore finds that she has not alleged a privacy interest sufficient to state a claim under the California Constitution.
IV. CONCLUSION
Generally, a "district court should grant leave to amend even if no request to amend the pleading was made, unless it determines that the pleading could not possibly be cured by allegation of other facts." Lopez v. Smith , 203 F.3d 1122, 1127 (9th Cir. 2000) (en banc ) (internal quotation marks and citation omitted). Here, the Court identifies specific factual deficiencies that may be cured by amendment. Thus, the Court hereby ORDERS as follows:
1. Portions of Yoon's first claim for relief, as discussed above, and all of Yoon's second, third, and fourth claims for relief are DISMISSED with leave to amend .
2. Yoon is DIRECTED to file her amended pleading (if at all) no later than July 29, 2021.