Hubbard v. Google LLC

1

2

3 UNITED STATES DISTRICT COURT

4 NORTHERN DISTRICT OF CALIFORNIA

5 SAN JOSE DIVISION

6

7 NICHOLE HUBBARD, et al., Case No. 19-cv-07016-BLF

8 Plaintiffs,

ORDER GRANTING MOTION TO

9 v. DISMISS WITH LEAVE TO AMEND

10 GOOGLE LLC, et al., [Re: ECF 125]

11 Defendants.

12

13 For the second time, this Court must decide whether Plaintiffs in this action have alleged

14 illegal behavior on the part of Defendants that goes beyond what Congress has regulated under the

15 Children’s Online Privacy Protection Act, 15 U.S.C. §§ 6501–6506 (“COPPA”). For the second

16 time, this Court finds that they have not.

17 Minor Plaintiffs C.H., by and through their guardian ad litem Nichole Hubbard; E.J., N.J.,

18 A.J., and L.J., by and through their guardian ad litem Cara Jones; J.A.E. and J.R.E., by and

19 through their guardian ad litem Justin Efros; M.W., by and through their guardian ad litem Renee

20 Gilmore; A.G., by and through their guardian ad litem Jay Goodwin; and C.D., by and through

21 their guardian ad litem Bobbi Dishman, (“Plaintiffs”) bring this suit against Defendants Google

22 LLC and YouTube LLC (collectively “Google”) and Cartoon Network, Inc., Cartoon Network

23 Studios, Inc., ChuChu TV Studios, DreamWorks Animation LLC, DreamWorks Animation

24 Television, LLC, Hasbro, Inc., Hasbro Studios LLC, Mattel, Inc., Remka, Inc., RTR Production,

25 LLC, RFR Entertainment, Inc., and Pocketwatch, Inc. (collectively “Channel Owners”). Plaintiffs

26 allege Defendants unlawfully violated the right to privacy and reasonable expectation of privacy

27 of their children, who are all under thirteen years of age and subject to COPPA’s protections. See

1 Defendants. Id.

2 On December 21, 2020, this Court granted Defendants’ motion to dismiss and held that

3 Plaintiffs’ claims were preempted under COPPA. See Order (“Prior Order”) ECF 117. Now,

4 Defendants have filed another motion to dismiss, maintaining that the claims in Plaintiffs’ third

5 amended complaint are still preempted by COPPA. See Mot., ECF 125. Plaintiffs oppose, arguing

6 that they have sufficiently alleged deceptive conduct on the part of Defendants that goes beyond

7 the conduct regulated by COPPA. See Opp’n, ECF 127. The Court agrees with Defendants and

8 finds Plaintiffs’ claims remain preempted by COPPA. Accordingly, the Court GRANTS

9 Defendants’ motion. As further explained below, because Plaintiffs could potentially cure the

10 defects in their complaint with named plaintiffs in the 13-16 age range, the Court dismisses the

11 complaint with leave to amend.

12

13 I. BACKGROUND

14 Google operates the video sharing-platform YouTube (“YouTube platform”). 3AC ¶ 2.

15 The YouTube platform is accessible as a website, mobile application, or via an application on a

16 set-top streaming device that can connect to a television. Id. Any individual or organization

17 registered with YouTube, through a Google account, may upload videos they have created. Id.

18 These videos are uploaded to that individual’s or organization’s “channel.” Id. Individuals do not

19 have to register or sign in to view videos uploaded to the YouTube platform. Id. There is no age

20 verification required to view videos. Id.

21 The YouTube platform is “the #1 website regularly visited by kids.” 3AC ¶ 4. Defendants

22 Mattel and Hasbro, classic toy brands, are among the Channel Owners who maintain and create

23 content aimed at children. Id. Other Channel Owners do the same: for example, Defendant

24 ChuChuTV’s channel features cartoons and nursery rhymes. Id. ¶ 101. Defendants Remka, RTR

25 Production, RFR Entertainment, and Pocketwatch together operate a channel, Ryan’s World,

26 featuring a nine-year-old boy unboxing toys and other children’s products. Id. ¶ 106. This is the

27 second-most popular YouTube channel, with approximately 22.5 million subscribers and over 33

1 billion views. Id. ¶ 107. Plaintiffs detail the child-aimed content of the other Channel Owner

2 Defendants as well. Id. ¶¶ 112-13; 119, 122, 126, 130-31.

3 Google and the Channel Owners generate revenue from the YouTube platform through

4 advertising, with Google placing ads on the channels and keeping 45% of the ad revenue. 3AC ¶

5 5. The Channel Owners retain 55% of the ad revenue. Id. Plaintiffs allege that Google, with the

6 authorization and consent of the channel owners, impermissibly “knowingly and purposefully

7 tracked, profiled, and targeted minors on the YouTube Platform for advertising revenue.” Id. ¶ 81.

8 Plaintiffs allege that Google tracked Plaintiffs’ personal data and information, such as internet

9 protocol addresses and device serial numbers, and that allowed Google to develop profiles of

10 individuals over time by tracking their activities across multiple websites. Id. ¶ 9. While Google

11 maintained in the YouTube terms of service and the Google Privacy Policy that the YouTube

12 Platform was not for children under thirteen, id. at ¶ 85, the Channel Owners intentionally created

13 content aimed at children under thirteen so that Google could target and track young children for

14 ad revenue, id. ¶ 99.

15 Through COPPA, Congress has regulated the amount of data Google is legally able to

16 collect from children without parental consent. TAC ¶ 72. COPPA provides, in pertinent part, that,

17

It is unlawful for an operator of a website or online service directed to children, or any

18

operator that has actual knowledge that it is collecting personal information from a child,

19 to collect personal information from a child in a manner that violates the regulations

prescribed [by the Federal Trade Commission].

20

21 15 U.S.C. § 6502(a). TAC ¶ 72. COPPA applies to any operator of a commercial website or online

22 service directed to children under thirteen years of age that collects, uses, and/or discloses personal

23 information from children. Id. ¶ 73. The Federal Trade Commission (“FTC”) has interpreted

24 COPPA’s definition of “website or online service” to include individual channels on a general

25 audience platform—according to the FTC, “content creators and channel owners” are both

26 “standalone ‘operators’ under COPPA, subject to strict liability for COPPA violations.” Id.;

27 Statement of Joseph J. Simons & Christine S. Wilson, Federal Trade Commission, Regarding FTC

1 https://www.ftc.gov/system/files/documents/public_statements/1542922/simons_wilson_google_y

2 outube_statement.pdf. The FTC also considers third parties with actual knowledge that they are

3 collecting personal information from users of a child-directed site or service as operators under

4 COPPA. Id. ¶ 73.

5 In order to determine whether a website or online service is “directed to children” the FTC

6 is to:

[C]onsider [the website’s or online service’s] subject matter, visual content, use of

7

animated characters or child-oriented activities and incentives, music or other audio

8 content, age of models, presence of child celebrities or celebrities who appeal to children,

language or other characteristics of the Web site or online service, as well as whether

9 advertising promoting or appearing on the Web site or online service is directed to

children.

10

16 CFR § 312.2. TAC ¶ 74. COPPA defines a “child” as an individual under the age of thirteen.

11

15 U.S.C. § 6501(a). TAC ¶ 76. The FTC regulations require an operator to disclose information

12

collection practices and “obtain verifiable parental consent for [any] collection, use, or disclosure

13

of personal information from children.” 15 U.S.C. § 6502(b)(1)(A); 16 C.F.R. § 312.5(a); TAC ¶

14

76. Among the types of personal information under COPPA that may only be collected from

15

children with parental consent are “persistent identifier[s] that can be used to recognize a user over

16

time and across different sites, including a cookie number, an IP address, a processor or device

17

serial number, or a unique device identifier.” TAC ¶ 77.

18

Google has been subject to COPPA enforcement previously. TAC ¶ 66. In Fall 2019,

19

Google reached a settlement with the FTC and New York Attorney General, and Google

20

announced it would start treating data from anyone watching children’s content on the YouTube

21

Platform as coming from a child, regardless of the age of the user, which brought it into

22

compliance with COPPA. Id.

23

Plaintiffs allege that Google did its tracking, profiling, and targeting of children while

24

feigning compliance with applicable federal and state laws. 3AC ¶¶ 81, 164. Plaintiffs cite

25

Google’s then-Code of Conduct, which read, in relevant part:

26

27 “Don’t be evil.” Googlers generally apply those words to how we serve our users. But “Don’t

can. But it’s also about doing the right thing more generally – following the law, acting

1

honorably and treating co-workers with courtesy and respect.

2 3AC ¶ 164. Plaintiffs also cite Google’s then-Privacy Policy (“Our goal is to be clear about what

3 information we collect, so that you can make meaningful choices about how it is used”) and Terms

4 of Service (“We want to maintain a respectful environment for everyone, which means you must

5 follow these basic rules of conduct” including “comply[ing] with applicable laws”) and allege that

6 these corporate policies created an expectation of privacy with respect to the YouTube Platform.

7 Id. ¶¶ 161-167. Despite this alleged expectation of privacy, Google tracked and collected the

8 personal information of children under the allegedly false pretense that Google would be

9 “transparent” with parents about what information was being collected from child viewers and

10 compliant with applicable legal requirements and prohibitions, including COPPA. Id. ¶ 166.

11 Plaintiffs further allege that Google’s Privacy Policy deceptively conceals that the purpose of its

12 tracking and assimilating information from the YouTube Platform is to enable it to target the

13 vulnerabilities of children through behavioral advertising for profit. Id. ¶ 9.

14 Plaintiffs also acknowledge that Google’s Privacy Policy discloses that it collects personal

15 information from individuals who access the YouTube Platform, including persistent identifiers

16 such as a user’s IP address. TAC ¶ 55. Plaintiffs also allege that Google discloses that it tracks any

17 individuals’ activity on any webpage that uses Google’s advertising services, and this tracking

18 activity allows Google to deliver more relevant search results and ads to YouTube video viewers.

19 TAC ¶¶ 62-63.

20 Plaintiffs also allege deception on Google’s part through the creation of the YouTube Kids

21 application, which they allege was “guise to generate content for children on the YouTube

22 Platform. TAC ¶ 89. Google did not track users or serve targeted behavior ads on the YouTube

23 Kids app. Id. ¶ 90 Every video available on the YouTube Kids app was also uploaded to the

24 YouTube Platform. Id. ¶ 89. The YouTube Kids app was only available as a mobile application

25 until 2019, so when children searched for their favorite show on a web browser, they would be

26 shown links to child-directed content hosted on the YouTube Platform and not the YouTube Kids

27 app, which allowed Google to employ its tracking and behavioral advertising scheme on the

1 In this lawsuit, Plaintiffs, who are all under the age of thirteen, TAC ¶¶ 26-31, purport to

2 represent “all persons . . . who were sixteen or younger when they used YouTube,” TAC ¶¶ 224-

3 231. Plaintiffs allege violations of the following claims: intrusion upon seclusion; California’s

4 Unfair Competition Law; unjust enrichment under the laws of California, Colorado, Indiana,

5 Massachusetts, New Jersey, and Tennessee; the consumer protection acts of Massachusetts,

6 Colorado, Indiana, New Jersey, and Tennessee; and the California constitutional right to privacy.

7 SAC ¶¶ 204-356. Defendants bring this motion to dismiss on several grounds, with preemption as

8 a threshold issue. See Mot.

9

10 II. LEGAL STANDARD

11 “To survive a motion to dismiss, a complaint must contain sufficient factual matter,

12 accepted as true, to ‘state a claim to relief that is plausible on its face.’” Ashcroft v. Iqbal, 556 U.S.

13 662, 678 (2009) (quoting Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 570 (2007)). When

14 considering such a motion, the Court “accept[s] factual allegations in the complaint as true and

15 construe[s] the pleadings in the light most favorable to the nonmoving party.” Manzarek v. St.

16 Paul Fire & Marine Ins. Co., 519 F.3d 1025, 1031 (9th Cir. 2008). However, the Court need not

17 “accept as true allegations that contradict matters properly subject to judicial notice” or

18 “allegations that are merely conclusory, unwarranted deductions of fact, or unreasonable

19 inferences.” In re Gilead Scis. Sec. Litig., 536 F.3d 1049, 1055 (9th Cir. 2008) (internal quotation

20 marks and citations omitted). “Threadbare recitals of the elements of a cause of action, supported

21 by mere conclusory statements, do not suffice.” Iqbal, 556 U.S. at 678 (citing Twombly, 550 U.S.

22 at 555).

23

24 III. DISCUSSION

25 Defendants argue that, just as the Court found last time, Plaintiffs’ claims are preempted

26 by COPPA. Mot. 4-10. Plaintiffs argue that they have alleged deceptive conduct that goes beyond

27 what COPPA regulates, just like the Third Circuit found in In re Nickelodeon Consumer Privacy

1 plausibly alleged deceptive conduct, as Plaintiffs admit they did not view any of the disclosures

2 they allege are deceptive, making allegations that these disclosures created a false expectation of

3 privacy implausible.

4 As the Court detailed in its prior order, COPPA contains the following clause:

5

No State or local government may impose any liability for commercial activities or actions

6

by operators in interstate or foreign commerce in connection with an activity or action

7 described in this chapter that is inconsistent with the treatment of those activities or actions

under this section.

8

15 U.S.C. § 6502(d). (emphasis added). Congress specified the FTC would have enforcement

9

authority, 15 U.S.C. §§ 6502(c), 6505(d), with certain other federal agencies retaining authority

10

over entities they oversee, id. §§ 6505(a), (b). Congress also gave an enforcement role to states via

11

parens patriae actions brought by their attorneys general, 15 U.S.C. § 6504(a)(1). Before

12

proceeding with any such lawsuits, a state attorney general must give the FTC notice, 15 U.S.C. §

13

6504(a)(2), and the FTC has a statutory right to intervene, id. § 6504(b). If the FTC has already

14

instituted an action, no State may institute a second action against the same Defendants while the

15

first action is pending, 15 U.S.C. § 6504(d). Congress did not include a private right of action in

16

the statute.

17

The Court found that the plain text of the statute clearly indicates Congress’s desire to

18

expressly preempt Plaintiffs’ state law claims. Prior Order 9-12. Allowing private plaintiffs to

19

bring suits for violations of conduct regulated by COPPA, even styled in the form of state law

20

claims, with no obligation to cooperate with the FTC, is inconsistent with the treatment of COPPA

21

violations as outlined in the COPPA statute. Prior Order 10 (citing Howard v. Blue Ridge Bank,

22

371 F. Supp. 2d 1139, 1143-44 (N.D. Cal. 2005) (rejecting argument that state law claim is not

23

inconsistent with the Fair Credit Reporting Act (“FCRA”) and simply provides an additional state

24

remedy for the unlawful conduct giving rise to the FCRA claim)).

25

Plaintiffs core allegations, and state law causes of action, remain the same in the third

26

amended complaint: Google, together with the Channel Owners, knowingly and purposely

27

tracked, profiled, and targeted minors on the YouTube platform for advertising revenue through

1 deceptive collection of personal information; Google did this while feigning compliance with the

2 law; Google did not disclose the full extent of the information it collected from the children;

3 Google used this information to manipulate and exploit children by extending their time on the

4 YouTube platform, which increased the number of targeted advertisements shown to them, which

5 increased the revenue earned by Google and the Channel Owners. See Prior Order 5; TAC ¶¶ 8-9,

6 81-82, 86, 142-43, 158, 164. The Court advised Plaintiffs in its prior order that they had not

7 alleged deceptive behavior beyond what was regulated by COPPA—the allegations failed to

8 “explain what is deceptive about Google’s collecting of data or grapple with whether Google’s

9 data collection policies have been properly disclosed.” Prior Order 13. The Court finds that

10 Plaintiffs have still failed to allege deception beyond what is regulated by COPPA.

11 In attempt to plead deceptive conduct that falls outside of COPPA regulation, Plaintiffs

12 argue that “Google publicly created the impression of adhering with societal expectations

13 regarding children’s privacy as well as with related laws and guidelines such as COPPA through

14 its Privacy Policy for the YouTube platform.” Opp’n 4-5; see also TAC ¶¶ 166-67. Plaintiffs also

15 highlight Google’s previous Code of Conduct, which stated “Don’t be evil” and “Obey the Law:

16 Google takes its responsibilities to comply with laws and regulations very seriously and each of us

17 is expected to comply with applicable legal requirements and prohibitions.” Opp’n 5; see also

18 TAC ¶¶ 168-69. This, according to Plaintiffs, created an expectation of privacy for children

19 viewing of the Channel Owners’ child-directed content on the YouTube Platform. Opp’n 5; see

20 also TAC ¶ 16. According to Plaintiffs, Google tracked and collected personal information from

21 children “under the alleged false pretense that that it would be ‘transparent’ with parents about

22 what information was being collected from child viewers, and would comply with applicable legal

23 requirements and prohibitions—including COPPA—in doing so.” Opp’n 5; see also TAC ¶ 16.

24 Critically, Plaintiffs also allege that Google’s Privacy Policy discloses that it collects the following

25 types of information from YouTube users: videos watched; browsing history; activity on third-

26 party sites and apps that use Google services, which includes Google’s advertising services; GPS;

27 IP address; and unique identifiers such as cookies and device IDs. TAC ¶ 52. Plaintiffs do not

1 Conduct. See Opp’n 18-19 (“Plaintiffs allege that Defendants’ conduct was deceptive, they do not,

2 as Defendants note, claim that their parents read or saw purported misrepresentations or claim that

3 the Channel Owners made any misrepresentations to them. They also do not allege that their

4 parents would have stopped them from using YouTube with different disclosures.”) (internal

5 citation omitted).

6 With regards to the Plaintiffs in this case—all children under thirteen years old—the Court

7 finds this alleged conduct squarely covered, and preempted, by COPPA and its exclusive remedial

8 scheme that vests enforcement authority in the FTC and state attorneys general. See 15 U.S.C. §§

9 6502(a)-(d), 6505(a)-(d); 16 C.F.R. § 312.5(a). Plaintiffs invite the Court to reconsider its prior

10 ruling on preemption, arguing that preemption should only apply in situations where the state law

11 claims are “inconsistent” with COPPA. Opp’n 2. However, as explained previously, the Court

12 must read the rest of that sentence in the statute, which establishes that state laws are preempted if

13 they impose liability “inconsistent with the treatment of those activities or actions under this

14 section.” 15 U.S.C. § 6502(d). The treatment Congress has provided for COPPA violations is

15 enforcement by the FTC and state attorneys general, and Plaintiffs’ attempt to run an end-around

16 the scheme with state law liability is “inconsistent with the treatment” and thus preempted.

17 The only new case Plaintiffs cite in support of their preemption argument is In re Zoom

18 Video Communications Inc. Privacy Litig., No. 20-CV-02155-LHK, 2021 WL 930623, *23-24

19 (N.D. Cal. Mar. 11, 2021).1 Opp’n 1. In re Zoom is a 58-page opinion that references COPPA in

20 one paragraph and does not address preemption at all. 2021 WL 930623 at *23. The Court finds

21 Plaintiffs’ description of In re Zoom as having “declined to dismiss actions based on preemption

22 grounds” a gross mischaracterization.

23 Plaintiffs argue that they have alleged deceptive conduct like the plaintiffs in Nickelodeon.

24

25

1 The Court reiterates is previous opinion distinguishing New Mexico ex rel. Balderas v. Tiny Lab

Prods., 457 F. Supp. 3d 1103, 1121, 1127 (D.N.M. 2020), on reconsideration, 2021 WL 354003

26

(D.N.M. Feb. 2, 2021): “The Court finds Tiny Lab distinguishable from this case because Tiny

Lab was brought by the New Mexico Attorney General, who can enforce violations of COPPA

27

under the statute’s remedial scheme. Further, while not the basis of the preemption decision, it

1 Opp’n 1-3. Not so. In Nickelodeon, the registration form for defendants’ child-focused website

2 included the message, “HEY GROWN-UPS: We don’t collect ANY personal information about

3 your kids. Which means we couldn’t share it even if we wanted to!” and this apparently was not

4 true. Nickelodeon, 827 F.3d at 268-69, 291. The court applied a presumption against preemption

5 under Third Circuit law and found that the plaintiffs’ intrusion upon seclusion claim was not

6 preempted by COPPA, and the court rested its finding on the fact that “the wrong at the heart of

7 the plaintiffs’ intrusion claim is not that Viacom and Google collected children’s personal

8 information, or even that they disclosed it. Rather, it is that Viacom created an expectation of

9 privacy on its websites and then obtained the plaintiffs’ personal information under false

10 pretenses.” Nickelodeon, 827 F.3d at 292. “Understood this way,” the Third Circuit stated, “there

11 is no conflict between the plaintiffs’ intrusion claim and COPPA.” Id.

12 The disclosure in this case is quite different. Most notably, while Viacom lied about

13 collecting data, Google disclosed the fact that it collected data from YouTube users. TAC ¶ 52. A

14 user of the Viacom website could not miss the HEY GROWN-UPS disclosure; here, Plaintiffs

15 concede that they did not see the purported misrepresentations. Opp’n 18-19. Statements such as

16 “Don’t do evil” and “Obey the Law” are not actionable. See Veal v. LendingClub Corp., 423 F.

17 Supp. 3d 785, 804 (N.D. Cal. 2019) (“The Court agrees with Defendants that the statements

18 touting LendingClub's focus on compliance, building trust with various stakeholders, and

19 transparency are examples of corporate optimism and puffery.”), Allergan USA Inc. v. Imprimis

20 Pharm., Inc., 2018 WL 5919210, at *7 (C.D. Cal. Apr. 30, 2018) (statement about “complying

21 with all applicable laws and regulations” not actionable). It is unclear what type of disclosure

22 Plaintiffs would view as adequate—HEY GROWN-UPS: We are collecting personal information

23 about your kids to MANIPULATE them! —but it is clear that Plaintiffs have not adequately

24 alleged deceptive conduct that places Defendants’ behavior outside of what is regulated by

25 COPPA.

26 Plaintiffs attempt to expand their proposed classes to “all persons . . . who were sixteen or

27 younger when they used YouTube,” TAC ¶¶ 224-231. The Court does find adding persons in the

1 Proper Am., ECF 119 (“Plaintiffs have only been granted leave to amend the existing claims of

2 the current parties”). Since all named Plaintiffs are under thirteen, and their claims are thus

3 preempted by COPPA, they cannot seek relief on behalf of a proposed class when they are not

4 eligible to bring the claim in their own right. Sandoval v. Ali, 34 F. Supp. 3d 1031, 1039 (N.D.

5 Cal. 2014) (“in short, a predicate to a plaintiff’s right to represent a class is his eligibility to sue in

6 his own right; what he may not achieve himself, he may not accomplish as a representative of a

7 class”). The Court will grant Plaintiffs leave to amend their complaint if they can substitute proper

8 plaintiffs to represent persons in the 13-16 age range. See Intri-Plex Techs., Inc. v. Crest Group,

9 Inc., 499 F.3d 1048, 1056 (9th Cir. 2007) (finding dismissal without leave to amend proper only if

10 it is clear that “the complaint could not be saved by any amendment”).

11 The Court also notes the following for Plaintiffs’ potentially forthcoming fourth amended

12 complaint. Plaintiffs’ consumer protection claims sound in fraud and therefore need to meet the

13 heightened Rule 9(b) pleading standard for fraud. See Vess v. Ciba-Geigy Corp. USA, 317 F.3d

14 1097, 1103 (“Fraud can be averred by specifically alleging fraud, or by alleging facts that

15 necessarily constitute fraud (even if the word ‘fraud’ is not used)). Under the Rule 9(b) pleading

16 standard, claims of fraud must be accompanied by the “who, what, when, where, and how” of the

17 misconduct alleged. Cooper v. Pickett, 137 F.3d 616, 627 (9th Cir. 1997), superseded by statute

18 on other grounds (internal citation omitted). For the complaint to go forward, these deficiencies

19 must be addressed.

20 The Channel Owners have advanced separate arguments regarding why they should be

21 dismissed from this case, which relate to the underlying merits of Plaintiffs’ claims. Mot. 22-25.

22 Because the Court has found all of Plaintiffs’ claims preempted and granted leave to amend, the

23 Court finds it premature to dismiss the Channel Owners at this time.

24 //

25 //

26 //

27 //

IV. ORDER

For the foregoing reasons, IT IS HEREBY ORDERED that Defendants’ motion to dismiss is

2

GRANTED with leave to amend. Plaintiffs shall file an amended complaint no later than 30 days

3

after the filing of this order

4

5

IT IS SO ORDERED.

6

7

Dated: July 1, 2021 én)

fom Ln ham

9 BETH LABSON FREEMAN

10 United States District Judge

11

12

15

16

= 17

Z 18

19

20

21

22

23

24

25

26

27

28