holding that 23 “nonrestitutionary disgorgement of profits is not an available remedy” under the UCL
How later courts described this case
- holding that 23 “nonrestitutionary disgorgement of profits is not an available remedy” under the UCL
- “Although the [SRR] directs 25 readers to the Privacy Policy, Plaintiffs rely on the latest version of this document, titled ‘Data Use 26 Policy.’”
Written by the judges who cited it.
The opinion
1
2
3
4
5
6
7
8 UNITED STATES DISTRICT COURT
9
NORTHERN DISTRICT OF CALIFORNIA
10
SAN JOSE DIVISION
11
12 CHASOM BROWN, et al., Case No. 20-CV-03664-LHK
13 Plaintiffs,
ORDER DENYING MOTION TO
DISMISS
14 v.
Re: Dkt. No. 164
15 GOOGLE LLC,
16 Defendant.
17
18 Plaintiffs Chasom Brown, William Byatt, Jeremy Davis, Christopher Castillo, and
19 Monique Trujillo (collectively, “Plainitffs”), individually and on behalf of all others similarly
20 situated, bring the instant case against Defendant Google LLC (“Google”). Plaintiffs’ Second
21 Amended Complaint asserts seven claims against Google under federal and California law. ECF
22 No. 136-1 (“SAC”). Before the Court is Google’s motion to dismiss two of those claims. ECF
23 No. 164.1 Having considered the parties’ submissions, the relevant law, and the record in this
24 case, the Court DENIES Google’s motion to dismiss.
25
26 1 Google’s motion to dismiss contains a notice of motion that is separately paginated from the
points and authorities in support of the motion. Civil Local Rule 7-2(b) requires that the notice of
27 motion and the points and authorities in support of the motion be contained in one document with
the same pagination for a total of no more than 25 pages. See Civ. Loc. R. 7-2(b).
I. BACKGROUND
1
To access a website on the internet, an individual must use “web-browsing software” (a
2
“browser”). See SAC ¶¶ 2, 63. Specifically, the user must type the website’s Uniform Resource
3
Locator (“URL”) into the browser’s address bar. Id. ¶ 63. Entering a URL causes the browser to
4
send a “GET request” to the website’s server. Id. A GET request tells the server “what
5
information is being requested” and instructs the server “to send the information back.” Id. The
6
browser then displays the requested information for the user. Id.
7
Google provides services and products both to website publishers and to internet users.
8
Google provides advertising and data analytics services to website publishers. See id. ¶¶ 8, 67–83.
9
More than 70% of website publishers in the United States use at least one of these services. Id.
10
¶ 8. Google provides internet users with a browser called “Google Chrome” (“Chrome”). See id.
11
¶ 51. Chrome, like other popular browsers, offers a “private browsing mode.” Id. ¶ 52. Chrome’s
12
“private browsing mode” is called “Incognito Mode.” Id.
13
The instant case arises from Google’s practice of using its advertising and data analytics
14
services to collect data from internet users who visit websites while in “private browsing mode.”
15
See id. ¶¶ 5, 8. Plaintiffs are Google account holders “whose internet use was tracked by Google
16
. . . while browsing the internet from a browser in a private browsing mode.” Id. ¶ 11.
17
Specifically, each Plaintiff “visited several major websites using Chrome, in Incognito Mode,” and
18
Google “tracked . . . and intercepted [their] communications with [those] Websites.” See id.
19
¶¶ 168–69, 173–74, 178–79, 183–84, 188–89. Plaintiffs allege that Google’s data collection
20
practice was unlawful because, among other reasons, Google represented that using “private
21
browsing mode” would prevent Google from collecting Plaintiffs’ data. Id. ¶ 6.
22
In the following sections, the Court describes in turn: (1) Google’s practice of collecting
23
the data of internet users who visit Google affiliated websites; (2) Google’s representations
24
regarding “private browsing mode”; and (3) the procedural history of the instant case.
25
A. Google’s Data Collection Practices
26
Plaintiffs provide detailed allegations explaining how Google collects and monetizes
27
1 internet users’ data. The Court begins by describing Google’s techniques for collecting internet
2 users’ data. The Court then describes how Google monetizes that data.
3 1. Google’s Techniques for Collecting Data
4 Google offers two services that are used by more than 70% of websites: Google Analytics
5 and Google Ad Manager. See SAC ¶ 63. Google Analytics enables a website publisher to collect
6 information “about the origins of [the] Website’s traffic, demographics, frequency, browsing
7 habits on the Website, and other data about visitors.” Id. ¶ 67. Although the basic version of
8 Google Analytics is free, publishers may pay for “more specific and granular data about visitors.”
9 Id. ¶ 67 n.17. In turn, Google Ad Manager enables a website publisher to “display targeted
10 Google advertisements . . . . along with the Website’s actual content.” Id. ¶ 79. “Google’s
11 advertising customers” pay fees to display these advertisements, and the fees are split between
12 Google and the website publisher. Id. To use Google Analytics and Google Ad Manager,
13 publishers must “embed” customized Google code into their websites’ code. See id. ¶¶ 68, 79.
14 According to Plaintiffs, Google collects the data of all internet users who visit websites
15 that use Google Analytics and Google Ad Manager. As discussed, an internet user accesses a
16 website by causing a browser to send a “GET request” to the server that contains the website’s
17 information. Id. ¶ 63. When a browser sends a GET request to a website that uses either Google
18 Analytics or Google Ad Manager, the embedded Google code causes the browser to send a
19 duplicate GET request directly to Google. Id. Because the GET request describes “what
20 information is being requested” by the browser, obtaining the duplicate GET request “enables
21 Google to learn exactly what content the [browser] was asking the website to display.” Id. The
22 duplicate GET request also includes the “URL information of what the user has been viewing and
23 requesting from websites online.” Id.
24 Additionally, every website that uses Google Analytics or Google Ad Manager collects
25 each visitor’s Internet Protocol (“IP”) address. Id. An IP address is a unique identifier that an
26 Internet Service Provider (“ISP”) assigns to a device when the device uses an internet connection
27 provided by the ISP. See id. ¶ 63 n.16. Because most internet users access the internet using one
1 device and one internet connection, most internet users have one IP address. Id. ¶ 63 n.16. Thus,
2 obtaining an internet user’s IP address allows Google to track that user across the internet.
3 Google also uses “cookies” and “pixels” to obtain data. As a user browses the internet, the
4 user’s browser records “cookies,” which are “piece[s] of code” that contain “information
5 regarding the state of the user’s system . . . or information regarding the user’s browsing activity.”
6 Id. ¶ 70 n.19. When a user visits a website that has Google Analytics or Google Ad Manager, the
7 embedded Google code causes the browser to send Google cookies that contain information about
8 “the prior websites the user has viewed.” Id. ¶ 70. The embedded Google code also causes the
9 browser to display a “digital pixel.” Id. ¶ 102. This function allows Google to differentiate
10 between users because “digital pixels . . . display differently for every device and application.”
11 Id. ¶ 100. Thus, “[b]y tracking these pixels and the unique resulting displays, Google and its . . .
12 partners are able to track and ‘measure’ [users] across the web.” Id. ¶ 103.
13 Website publishers that use Google Analytics may pay “additional fees” for a feature
14 called “Google Analytics User-ID.” Id. ¶ 69. This feature “allows Websites to ‘generate [their]
15 own unique IDs, consistently assigns IDs to users, and include these IDs wherever [the Websites]
16 send data to Analytics.” Id. (alterations in original). These IDs are more useful to websites than
17 IP addresses because a user’s ID stays the same when the user accesses the website from different
18 devices. Id. Thus, the “‘same search on a phone, purchases on a laptop, and re-engagement on a
19 tablet that previously looked like three unrelated actions on unrelated devices can now be
20 understood as one user’s interactions with [the website’s] business.’” Id. (alteration in original).
21 Google can collect additional data if a user accesses the internet with certain Google
22 software applications. Most importantly, when a user installs Chrome on a device, Google assigns
23 the device a “unique digital string of characters called Google’s ‘X-Client-Data Header.’” Id.
24 ¶ 95. Then, whenever the user accesses Google affiliated websites with Chrome, Google will
25 receive the user’s “X-Client-Data Header.” Id. ¶ 98. Additionally, if a user has a cellular device
26 with Google’s Android operating system or any of Google’s mobile applications, the device will
27 “constantly send[] system and location data to Google.” Id. ¶ 106.
1 Generally, Google collects a user’s data regardless of whether the “user . . . enters ‘private
2 browsing mode’ on the user’s browser software.” Id. ¶ 84. However, Google does not receive a
3 Chrome user’s “X-Client-Data Header” if the user enters “Incognito Mode.” Id. ¶ 98.
4 2. Google’s Monetization of Data
5 Google monetizes internet users’ data by “creat[ing] ‘profiles’ for each individual user
6 and/or each individual device that accesses the Internet.” Id. ¶ 116. Website publishers purchase
7 these profiles from Google to learn about the browsing habits of the users who visit the publishers’
8 websites. Id. ¶¶ 116–17. Google also uses these profiles to create “targeted advertisements” for
9 “third-party advertisers.” See id. ¶¶ 118–19. Specifically, the Google Ad Manager service, which
10 is used by more than 70% of websites, receives the profiles of individuals who visit those websites
11 and uses algorithms to determine which advertisements to show to those individuals. Id. Google
12 demands “high prices for these targeted-advertising services.” Id.
13 According to Plaintiffs, the data that Google collects from internet users is “viewed as a
14 form of currency” in the “e-commerce industry.” Id. ¶ 123. Indeed, the “cash value” of this data
15 “can be quantified.” Id. ¶ 127. For example, a study of “180 internet users” found that users are
16 willing to pay $52.00/year to keep their browsing histories private. Id. ¶ 128. Similarly, Google
17 itself has set up a project called “Google Screenwise Trends” which pays internet users to “add a
18 browser extension that shares with Google the sites they visit and how they use them.” Id. ¶ 129.
19 Google pays participants “up to $3 per week to be tracked.” Id. ¶ 130 (emphasis in original).
20 Indeed, “a number of platforms have appeared where consumers can and do directly
21 monetize their own data.” Id. ¶ 135. For example, a company called Brave now offers a web
22 browser which “will pay users to watch online targeted ads, while blocking out everything else.”
23 Id. Several other companies have launched exchange platforms that allow internet users to sell
24 their data to applications and websites. See id.
25 B. Google’s Representations Regarding “Private Browsing Mode”
26 Plaintiffs allege that Google made numerous representations that, if Plaintiffs visited
27 websites while in “private browsing mode,” Google would not collect their data. Specifically,
1 Plaintiffs identify three Google documents that contain privacy-related representations: (1)
2 Google’s Privacy Policy; (2) Chrome’s Privacy Notice; and (3) the “Incognito
3 Splash Screen.” The Court discusses each document in turn.
4 1. Google’s Privacy Policy
5 The “Introduction” section of Google’s Privacy Policy informs internet users that they can
6 “choose to browse the web privately using Chrome in Incognito mode.” SAC ¶ 45. The following
7 sentence adds: “across [Google’s] services, you can adjust your privacy settings to control what
8 [Google] collect[s] and how your information is used.” Id.
9 To help users adjust their privacy settings, Google’s Privacy Policy includes a section
10 called “Your privacy controls.” Id. ¶ 46. The “Your privacy controls” section states that users
11 “have choices regarding the information [Google] collect[s] and how it’s used.” Id.
12 Additionally, the “Your privacy controls” section contains links to two pages that
13 encourage users to enter “private browsing mode”: (1) the “Search & Browse Privately” page and
14 (2) the “See & control your Web & App Activity” page. The “Search & Browse Privately” page
15 reiterates that users are “in control” of their information and states that, to control their
16 information, users can “enabl[e] ‘private browsing mode’ on their browsers,” which will “allow
17 [users] to ‘browse the web privately.’” Id. ¶ 48. In turn, the “See & control your Web & App
18 Activity” page informs users that “search and ad results may be customized using search-related
19 activity even if you’re signed out.” Id. ¶ 49. However, the page also states that a user can “turn
20 off this kind of search customization” by “search[ing] and brows[ing] privately” and provides a
21 link to “Learn how.” Id. Clicking on “Learn how” takes the user to the “Search & Browse
22 Privately” page which, as noted, encourages users to “enabl[e] ‘private browsing mode.’” Id.
23 2. Chrome Privacy Notice
24 The purpose of the Chrome Privacy Notice is to inform Chrome users “how to control the
25 information that’s collected, stored, and shared when [they] use the Google Chrome browser.”
26 ECF No. 165-22 at 1. The Chrome Privacy Notice directly incorporates Google’s Privacy Policy
27 and explains that “any personal information that is provided to Google or stored in your Google
1 Account will be used and protected in accordance with the Google Privacy Policy.” See id.
2 Additionally, the Chrome Privacy Notice lists the various “browser modes” that are
3 available in Chrome and states that “[p]rivacy practices are different depending on the mode that
4 || you’re using.” Id. at 3. Under the section labeled “Incognito mode and guest mode,” the Chrome
5 Privacy Notice states: “You can limit the information Chrome stores on your system by using
6 || incognito mode or guest mode.” Jd. at 11. The phrase “incognito mode or guest mode” has a
7 || hyperlink which directs users to a page titled “Browse in private.” Id. The “Browse in private”
8 || page provides instructions on how to open Chrome in Incognito Mode from any device. Id.
9 The Chrome Privacy Notice further states that, when Chrome is in Incognito Mode,
10 “Chrome won’t store certain information, such as”:
11 e Basic browsing history information like URLs, cached page text, or IP addresses of
12 pages linked from the websites you visit;
5 13 e Snapshots of pages that you visit; and
14 e Records of your downloads, although the files you download will still be stored
3 15 elsewhere on your computer or device.
16 || Id. Additionally, the Chrome Privacy Notice states that “Chrome won’t share existing cookies
3 17 || with sites you visit in incognito or guest mode.” Id.
Z 18 3. “Incognito Splash Screen”
19 When a user opens Chrome in Incognito Mode, Chrome displays the following message:
20
21
22
23 a COLEMAN te]a-Marecele] pT1Ke)
24 Re en pe get Bane eee nae eer ree ere
ee ea he ae
25 EY Mae □□ hate Seema eke
26 peti iri it ioapi bao
ties Se arate ih pe ea rar
28
Case No. 20-CV-03664-LHK
SAC ¶ 52. Plaintiffs refer to this display as the “Incognito Splash Screen.” See ECF No. 192 at 5.
1
C. Procedural History
2
On June 2, 2020, Plaintiffs filed a complaint against Alphabet, Inc. (“Alphabet”) and
3
Google alleging that Google had unlawfully collected Plaintiffs’ data while Plaintiffs used
4
“private browsing mode.” ECF No. 1. Plaintiffs asserted four claims: (1) unauthorized
5
interception under the Wiretap Act, 18 U.S.C. § 2510 et seq.; (2) violation of the California
6
Invasion of Privacy Act (“CIPA”), Cal. Penal Code §§ 631 and 632; (3) invasion of privacy; and
7
(4) intrusion upon seclusion. Id.
8
Additionally, the complaint sought class action relief on behalf of two alleged classes: (1)
9
“All Android device owners who accessed a website containing Google Analytics or Ad Manager
10
using such a device and who were (a) in ‘private browsing mode’ on that device’s browser and (b)
11
were not logged into their Google account on that device’s browser, but whose communications,
12
including identifying information and online browsing history, Google nevertheless intercepted,
13
received, or collected from June 1, 2016 through the present” and (2) “All individuals with a
14
Google account who accessed a website containing Google Analytics or Ad Manager using any
15
non-Android device and who were (a) in ‘private browsing mode’ in that device’s browser, and (b)
16
were not logged into their Google account on that device’s browser, but whose communications,
17
including identifying information and online browsing history, Google nevertheless intercepted,
18
received, or collected from June 1, 2016 through the present.” Id. ¶ 95.
19
On August 20, 2020, Plaintiffs and Alphabet stipulated to dismiss Alphabet from the case
20
without prejudice. ECF No. 51. On the same day, Google filed a motion to dismiss the complaint.
21
ECF No. 53. On August 24, 2020, the Court granted the parties’ stipulation to dismiss Alphabet,
22
leaving Google as the only defendant. ECF No. 57.
23
On September 21, 2020, Plaintiffs filed a first amended complaint (“FAC”) in lieu of
24
opposing the motion to dismiss. ECF No. 68 (“FAC”). In addition to the four claims from the
25
original complaint, the FAC asserted a claim for violation of the California Computer Data Access
26
and Fraud Act (“CDAFA”), Cal. Penal Code § 502. Id. On October 6, 2020, the Court denied as
27
1 moot the August 20, 2020 motion to dismiss. ECF No. 74.
2 On October 21, 2020, Google filed a motion to dismiss the FAC. ECF No. 82. Among
3 other arguments, Google argued that all of Plaintiffs’ claims should be dismissed because
4 Plaintiffs consented to Google’s collection of Plaintiffs’ data. Id. at 9–13. In connection with its
5 motion to dismiss, Google filed a request for judicial notice. ECF No. 84. Specifically, Google
6 requested that the Court take notice of twenty-seven documents, including Google’s Terms of
7 Service, fifteen versions of Google’s Privacy Policy, two versions of Google’s Chrome Privacy
8 Notice, and nine publicly available Google webpages. Id.
9 On November 18, 2020, Plaintiffs filed an opposition to Google’s motion to dismiss the
10 FAC. ECF No. 87. In connection with their opposition, Plaintiffs filed a response to Google’s
11 request for judicial notice, ECF No. 88, and filed their own request for judicial notice, ECF No.
12 89. Specifically, Plaintiffs requested that the Court take notice of Google’s Privacy Policy in
13 effect between March 31, 2020 and July 1, 2020. ECF No. 89.
14 On December 7, 2020, Google filed a reply in support of its motion to dismiss the FAC,
15 ECF No. 92 (“Reply”), and a filed reply in support of its request for judicial notice, ECF No. 93.
16 On February 25, 2021, the Court held a hearing on Google’s motion to dismiss the FAC.
17 ECF No. 103. At that hearing, Google raised for the first time arguments regarding the Court’s
18 website. See Tr. of Feb. 25, 2021 Hearing at 47:13–16, ECF No. 104. On February 26, 2021 and
19 March 1, 2021, Google filed affidavits further explaining the arguments regarding the Court’s
20 website. ECF Nos. 106, 107. On March 8, 2021, Plaintiffs filed a response addressing the
21 arguments raised in Google’s affidavits. ECF No. 111. On March 11, 2021, Google filed an
22 administrative motion for leave to file a reply in support of the arguments raised in Google’s
23 affidavits. ECF No. 112.
24 On March 12, 2021, the Court issued an order granting both parties’ requests for judicial
25 notice, denying Google’s administrative motion for leave to file a reply in support of the
26 arguments raised in Google’s affidavits, and denying Google’s motion to dismiss the FAC. Brown
27 v. Google LLC, 525 F. Supp. 3d 1049 (N.D. Cal. 2021). Among other holdings, the Court held
1 that Google failed to show that Plaintiffs consented to Google’s data collection practices. Id. at
2 1064. The Court explained that “Google’s representations regarding private browsing present
3 private browsing as a way that users can manage their privacy and omit Google as an entity that
4 can view users’ activity while in private browsing mode.” Id.
5 On April 14, 2021, the parties stipulated to allow Plaintiffs to file a second amended
6 complaint (“SAC”). ECF No. 136. In addition to the five claims asserted by the FAC, the SAC
7 asserts two new claims against Google: (1) breach of contract; and (2) violation of the California
8 Unfair Competition Law (“UCL”), Cal. Bus. & Prof. Code §§ 17200, et seq. ECF No. 136-1
9 (“SAC”). On April 15, 2021, the Court granted the parties’ stipulation. ECF No. 138.
10 On May 17, 2021, Google filed a motion to dismiss Plaintiffs’ claims for breach of
11 contract and violation of the UCL. ECF No. 165 (“Mot.”). In connection with its motion to
12 dismiss, Google filed a request for judicial notice. ECF No. 166.
13 On June 15, 2021, Plaintiffs filed an opposition to Google’s motion to dismiss Plaintiffs’
14 claims for breach of contract and violation of the UCL. ECF No. 192 (“Opp.”). In connection
15 with their opposition, Plaintiffs filed a request for judicial notice. ECF No. 193.
16 On June 29, 2021, Google filed a reply in support of its motion to dismiss Plaintiffs’
17 claims for breach of contract and violation of the UCL. ECF No. 208 (“Reply”).
18 II. REQUESTS FOR JUDICIAL NOTICE
19 Google requests that the Court take judicial notice of twenty-four documents, which
20 include three versions of Google’s Terms of Service, sixteen versions of Google’s Privacy Policy,
21 three versions of Google’s Chrome Privacy Notice, and two publicly available Google webpages.
22 ECF No. 166. Plaintiffs request that the Court take judicial notice of the current version of
23 Google’s Chrome Privacy Notice. ECF No. 193.
24 As the Court previously has explained, these documents appear on publicly available
25 websites and are thus proper subjects of judicial notice. See Brown, 525 F. Supp. 3d at 1061
26 (taking judicial notice of Google’s Terms of Service, Privacy Policy, Chrome Privacy Notice, and
27 webpages); see also, e.g., In re Google Assistant Privacy Litig., 457 F. Supp. 3d 797, 813–14
1 (N.D. Cal. 2020) (taking judicial notice of Google’s Terms of Service, Privacy Policy, and a
2 Google blog post); Matera v. Google, Inc., 2016 WL 5339806, at *7 (N.D. Cal. Sept. 23, 2016)
3 (taking judicial notice of Google’s Terms of Service, “various versions of Google’s Privacy
4 Policy,” and a Google webpage entitled “Updates: Privacy Policy”).
5 III. LEGAL STANDARD
6 A. Motion to Dismiss Under Rule 12(b)(6)
7 Rule 8(a) of the Federal Rules of Civil Procedure requires a complaint to include “a short
8 and plain statement of the claim showing that the pleader is entitled to relief.” Fed. R. Civ. P.
9 8(a). A complaint that fails to meet this standard may be dismissed pursuant to Federal Rule of
10 Civil Procedure 12(b)(6). Rule 8(a) requires a plaintiff to plead “enough facts to state a claim to
11 relief that is plausible on its face.” Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 570 (2007). “A
12 claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw
13 the reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal,
14 556 U.S. 662, 678 (2009). “The plausibility standard is not akin to a probability requirement, but
15 it asks for more than a sheer possibility that a defendant has acted unlawfully.” Id. (internal
16 quotation marks omitted). For purposes of ruling on a Rule 12(b)(6) motion, the Court “accept[s]
17 factual allegations in the complaint as true and construe[s] the pleadings in the light most
18 favorable to the nonmoving party.” Manzarek v. St. Paul Fire & Marine Ins. Co., 519 F.3d 1025,
19 1031 (9th Cir. 2008).
20 The Court, however, need not accept as true allegations contradicted by judicially
21 noticeable facts, see Shwarz v. United States, 234 F.3d 428, 435 (9th Cir. 2000), and it “may look
22 beyond the plaintiff’s complaint to matters of public record” without converting the Rule 12(b)(6)
23 motion into a motion for summary judgment, Shaw v. Hahn, 56 F.3d 1128, 1129 n.1 (9th Cir.
24 1995). Nor must the Court “assume the truth of legal conclusions merely because they are cast in
25 the form of factual allegations.” Fayer v. Vaughn, 649 F.3d 1061, 1064 (9th Cir. 2011) (per
26 curiam) (quoting W. Mining Council v. Watt, 643 F.2d 618, 624 (9th Cir. 1981)). Mere
27 “conclusory allegations of law and unwarranted inferences are insufficient to defeat a motion to
1 dismiss.” Adams v. Johnson, 355 F.3d 1179, 1183 (9th Cir. 2004).
2 B. Leave to Amend
3 If the Court determines that a complaint should be dismissed, it must then decide whether
4 to grant leave to amend. Under Rule 15(a) of the Federal Rules of Civil Procedure, leave to
5 amend “shall be freely given when justice so requires,” bearing in mind “the underlying purpose
6 of Rule 15 to facilitate decisions on the merits, rather than on the pleadings or technicalities.”
7 Lopez v. Smith, 203 F.3d 1122, 1127 (9th Cir. 2000) (en banc) (alterations and internal quotation
8 marks omitted). When dismissing a complaint for failure to state a claim, “'a district court should
9 grant leave to amend even if no request to amend the pleading was made, unless it determines that
10 the pleading could not possibly be cured by the allegation of other facts.” Id. at 1130 (internal
11 quotation marks omitted). Accordingly, leave to amend generally shall be denied only if allowing
12 amendment would unduly prejudice the opposing party, cause undue delay, or be futile, or if the
13 moving party has acted in bad faith. Leadsinger, Inc. v. BMG Music Publ’g, 512 F.3d 522, 532
14 (9th Cir. 2008).
15 IV. DISCUSSION
16 Google moves to dismiss Plaintiffs’ breach of contract claim and UCL claim. See Mot. at
17 4, 16. The Court begins with Google’s arguments regarding Plaintiffs’ breach of contract claim
18 and then discusses Google’s arguments regarding Plaintiffs’ UCL claim.
19 A. Plaintiffs Have Adequately Stated a Breach of Contract Claim Based on Google’s
Data Collection Practice
20
“The elements for breach of contract under California law are: (i) the existence of a
21
contract; (ii) the plaintiff’s performance or excuse for nonperformance of its side of the agreement;
22
(iii) the defendant’s breach; and (iv) resulting damage to the plaintiff.” In re Facebook, Inc.,
23
Consumer Priv. User Profile Litig., 402 F. Supp. 3d 767, 801 (N.D. Cal. 2019) (“Facebook
24
Consumer Privacy”). At the motion to dismiss stage, the Court must determine whether Google’s
25
contract with Plaintiffs is “reasonably susceptible” to Plaintiffs’ interpretation. Id. at 789.
26
Additionally, “the contract language must be assessed objectively, from the perspective of a
27
1 reasonable [Google] user.” Id.; see also Williams v. Apple, Inc., No. 19-cv-04700-LHK, 2021 WL
2 2186223, at *5 (N.D. Cal. May 28, 2021) (“‘[C]ourts in construing and applying a standardized
3 contract seek to effectuate the reasonable expectations of the average member of the public who
4 accepts it.” (quoting Restatement (Second) of Contracts § 211(2))).
5 Plaintiffs allege that their relationship with Google was governed by a contract consisting
6 of the “Google Terms of Service, the Google Chrome and Chrome OS Additional Terms of
7 Service, and the Chrome Privacy Notice.” SAC ¶ 268. Additionally, Plaintiffs allege that this
8 contract incorporated at least three additional documents—Google’s Privacy Policy, the “Search &
9 Browse Privately” page, and the Incognito Splash Screen—such that these additional documents
10 are part of the contract as well. Id.
11 According to Plaintiffs, the Chrome Privacy Notice, Google’s Privacy Policy, the “Search
12 & Browse Privately” page, and the Incognito Splash Screen promised that, if Plaintiffs visited
13 websites in “private browsing mode,” Google would not collect Plaintiffs’ data. Id. ¶¶ 269–272.
14 Thus, because Google collected Plaintiffs’ data when Plaintiffs were using “private browsing
15 mode,” Google breached this promise. Id. Plaintiffs further allege that they “fulfilled their
16 obligations under the relevant contracts,” that “Google was able to obtain the personal property of
17 Plaintiffs,” and that Plaintiffs “did not receive the benefit of the bargain for which they
18 contracted.” Id. ¶¶ 273–75.
19 Google concedes that the Chrome Privacy Notice governed, and continues to govern,
20 Google’s relationship with Plaintiffs. See Mot. at 13–16. Google also concedes that the Privacy
21 Policy and “Search & Browse Privately” page governed Google’s relationship with Plaintiffs until
22 March 31, 2020. See id. at 10–13.
23 However, Google argues that, because the Incognito Splash Screen was never part of
24 Google’s contract with Plaintiffs, Plaintiffs’ breach of contract claim may not rely on the
25 Incognito Splash Screen. See id. at 5–7. Additionally, Google argues that, because Google’s
26 Privacy Policy ceased being part of Google’s contract with Plaintiffs on March 31, 2020, Plaintiffs
27 “should not be permitted to state a contract claim based on the Privacy Policy after March 31,
1 2020.” Id. at 10. Finally, Google argues that the Incognito Splash Screen, Google’s Privacy
2 Policy, the “Search & Browse Privately” page, and the Chrome Privacy Notice do not contain
3 promises regarding Google’s collection of Plaintiffs’ data. See Mot. at 7–15. The Court discusses
4 these arguments in turn.
5 1. A Reasonable User Could Read Google’s Contract with Plaintiffs as
Incorporating the Incognito Splash Screen
6
Google contends that the Incognito Splash Screen is not part of Google’s contract with
7
Plaintiffs because “[n]either the Google Terms of Service, the Google Chrome Terms of Service,
8
the Chrome OS Additional Terms of Service, nor the Chrome Privacy Notice refer to or mention
9
the Incognito Screen.” Mot. at 5. For the reasons below, the Court rejects this contention.
10
Under California law, a “‘contract may validly include the provision of a document not
11
physically a part of the basic contract.’” Shaw v. Regents of University of California, 58 Cal. App.
12
4th 44, 54 (1997) (quoting Williams Constr. Co. v. Standard-Pacific Corp., 254 Cal. App. 2d 442,
13
454 (1967)). Indeed, another court in this District has stated that “California law makes it quite
14
easy to incorporate a document by reference.” See In re Facebook, Inc., Consumer Priv. User
15
Profile Litig., 402 F. Supp. 3d 767, 791 (N.D. Cal. 2019) (Chhabria, J.).
16
Whether parties have “incorporate[d] by reference into their contract the terms of some
17
other document” is a factual inquiry. Shaw, 58 Cal. App. 4th at 54. Specifically, “[f]or the terms
18
of another document to be incorporated into the document executed by the parties the reference
19
must be clear and unequivocal, the reference must be called to the attention of the other party and
20
he must consent thereto, and the terms of the incorporated document must be known or easily
21
available to the contracting parties.” Id. However, the “contract need not recite that it
22
‘incorporates’ another document, so long as it ‘guide[s] the reader to the incorporated document.’”
23
Id. (quoting Bakery v. Aubry, 216 Cal. App. 3d 1259, 1264 (1989)). Accordingly, if a contract
24
“directed” the parties to a document and the parties “received the document,” the document is part
25
of the contract. See Marchand v. Northrop Grumman, Case No. 16-cv-06825-BLF, 2017 WL
26
2633132, at *5 (N.D. Cal. Jun 19, 2017).
27
1 Under this standard, a reasonable user could conclude that Plaintiffs’ contract with Google
2 incorporated the Incognito Splash Screen. Google’s Privacy Policy, which Google concedes was
3 part of the contract, expressly stated in an “Introduction” section that Plaintiffs could “choose to
4 browse the web privately using Chrome in Incognito mode.” SAC ¶ 45. Similarly, the Chrome
5 Privacy Notice, which Google concedes was part of the contract, encouraged Plaintiffs to “us[e]
6 incognito mode.” See ECF No. 165-22 at 11. The Chrome Privacy Notice also directed Plaintiffs
7 to a page called “Browse in private,” which provided directions on how to open Chrome in
8 Incognito Mode. Id. Thus, because the Incognito Splash Screen “appear[ed] whenever a user
9 enters Incognito mode,” SAC ¶ 52, a reasonable user could read Google’s Privacy Policy and the
10 Chrome Privacy Notice as incorporating the Incognito Splash Screen by “guid[ing] the reader to”
11 enter Incognito Mode. See Shaw, 58 Cal. App. 4th at 54. Google itself has described the
12 Incognito Splash Screen as “conspicuous” and has stated that the Screen is “presented precisely to
13 ensure users understand what Incognito mode means.” See ECF No. 82 at 10; ECF No. 92 at 4.
14 Judge Chhabria’s decision in Facebook Consumer Privacy, which found that the 2012
15 version of Facebook’s “Statement of Rights and Responsibilities” (“SRR”) incorporated
16 Facebook’s “Data Use Policy,” is instructive. 402 F. Supp. 3d at 790. The “first section of the
17 SRR, entitled ‘Privacy,’ call[ed] out the Data Use Policy in the second sentence, provide[d] a link
18 to it, and encourage[d] the user to read it.” Id. at 791. Additionally, a different section of the SRR
19 told “users to read the Data Use Policy to learn about ‘how you can control what information other
20 people may share with applications.’” Id.
21 Although Google’s Privacy Policy and the Chrome Privacy Notice do not use the term
22 “Incognito Splash Screen,” those documents guided Plaintiffs to the Incognito Splash Screen in
23 the same way that Facebook’s SRR guided Facebook users to the Data Use Policy. Specifically,
24 Google’s Privacy Policy and the Chrome Privacy Notice encouraged Plaintiffs to use Incognito
25 Mode and provided express instructions on how to do so. See SAC ¶ 45; ECF No. 165-22 at 11.
26 Because the Incognito Splash Screen “appears whenever a user enters Incognito Mode,” the
27 combined effect of Google’s Privacy Policy and the Chrome Privacy Notice was to “provide[] a
1 link” to the Incognito Splash Screen and to “encourage the user to read it.” See Facebook
2 Consumer Privacy, 402 F. Supp. 3d at 791. Thus, California law “militates in favor of the
3 conclusion” that the Incognito Splash Screen was part of Google’s contract with Plaintiffs. Id.
4 Google’s arguments to the contrary are unconvincing. Google argues that, because
5 Google’s Privacy Policy and the Chrome Policy Notice do not expressly “refer to or mention” the
6 Incognito Splash Screen, those documents do not incorporate the Incognito Splash Screen. Mot. at
7 5. However, California law is clear that the contract need only “guide[],” Shaw, 58 Cal. App. 4th
8 at 54, or “direct,” Marchand, 2017 WL 2633132, at *5, the parties to a document in order to
9 incorporate that document. Whatever the precise scope of the terms “guide” and “direct,” the
10 California Supreme Court’s use of those terms means that parties are not required to reference a
11 document by name to incorporate the document. Indeed, California law “makes it quite easy to
12 incorporate a document by reference.” Facebook Consumer Privacy, 402 F. Supp. 3d at 790.
13 Thus, the fact that Google’s Privacy Policy and the Chrome Policy Notice do not use the phrase
14 “Incognito Splash Screen” does not alter the Court’s conclusion.
15 Additionally, although Google relies heavily on In re Facebook, Inc. Internet Tracking
16 Litigation, 956 F.3d 589, 610 (9th Cir. 2020) (“Facebook Internet Tracking”), that case does not
17 provide Google with any support. Like the plaintiffs in Facebook Consumer Privacy, the
18 plaintiffs in Facebook Internet Tracking alleged that Facebook’s “Statement of Rights and
19 Responsibilities” (“SRR”) incorporated Facebook’s “Data Use Policy.” 956 F.3d at 610.
20 However, unlike the plaintiffs in Facebook Consumer Privacy, 402 F. Supp. 3d at 790, who relied
21 on the 2012 version of the SRR, the plaintiffs in Facebook Internet Tracking, 956 F.3d at 610,
22 relied on the April 2011 version of the SRR. The April 2011 version of the SRR contained no
23 references to the Data Use Policy, and instead referred users to an older document called the
24 “Privacy Policy.” Facebook Internet Tracking, 956 F.3d at 610 (“Although the [SRR] directs
25 readers to the Privacy Policy, Plaintiffs rely on the latest version of this document, titled ‘Data Use
26 Policy.’”). Indeed, as Judge Chhabria explained in Facebook Consumer Privacy, it was not until
27 “mid-2012” that Facebook updated the SRR to reference the “Data Use Policy.” 402 F. Supp. 3d
1 at 790 n.11. Thus, because the Facebook Internet Tracking plaintiffs relied on the April 2011
2 version of the SRR, which guided users to the “Privacy Policy” instead of the “Data Use Policy,”
3 the Ninth Circuit concluded that the “SRR d[id] not reference a Data Use Policy.” 956 F.3d at
4 610. That conclusion has no bearing on the instant case.
5 For all these reasons, a reasonable user could read Google’s contract with Plaintiffs as
6 incorporating the Incognito Splash Screen. Accordingly, the Court need not address Plaintiffs’
7 alternative argument that, even if the Incognito Splash Screen was not part of the contract, the
8 Screen should be used to interpret the contact. See Opp. at 7.
9 2. A Reasonable User Could Read Google’s Contract with Plaintiffs as
Incorporating Google’s Privacy Policy After March 30, 2020
10
Although Google concedes that Google’s contract with Plaintiffs incorporated Google’s
11
Privacy Policy before March 31, 2020, Google asserts that Google’s Privacy Policy ceased to be
12
part of the contract on March 31, 2020. Mot. at 10. Accordingly, Google contends that Plaintiffs
13
“should not be permitted to state a contract claim based on the Privacy Policy after March 31,
14
2020.” Id. For the reasons below, the Court disagrees.
15
During the “Class Period,” which Plaintiffs define as “June 1, 2016 through the present,”
16
SAC ¶ 192, there have been three versions of Google’s “Terms of Service.” The first two versions
17
stated: “By using our Services, you agree that Google can use such data in accordance with our
18
privacy policies.” See ECF No. 165-17 at 3; ECF No. 165-18 at 2. The current version, which has
19
been in place since March 31, 2020, instead states: “Besides these terms, we also publish a Privacy
20
Policy. Although it’s not part of these terms, we encourage you to read it to better understand how
21
you can update, manage, export, and delete your information.” ECF No. 165-19 at 1.
22
Relying on this Court’s decision in Calhoun v. Google LLC, 526 F. Supp. 3d 605 (N.D.
23
Cal. 2021), Google contends that, because the current version of the Terms of Service states that
24
Google’s Privacy Policy is “not part of these terms,” Google’s Privacy Policy has not been part of
25
Google’s contract with Plaintiffs since March 31, 2020. Mot. at 10. In Calhoun, the plaintiffs
26
were “users of Google’s Chrome browser” who “chose not to ‘Sync’ their [Chrome] browsers
27
1 with their Google accounts while browsing the web.” Id. at 613. The Calhoun plaintiffs brought
2 claims against Google alleging that Google had collected the plaintiffs’ data despite Google’s
3 representation that it would only collect the data of Chrome users who chose to “Sync” their
4 browsers with their Google Accounts. See id. at 613–615. In its motion to dismiss, Google
5 argued that the Calhoun plaintiffs had consented to Google’s data collection by agreeing to
6 Google’s Privacy Policy, which disclosed the data collection. Id. at 621.
7 The Court rejected Google’s consent argument in Calhoun because, among other reasons,
8 Google’s latest Terms of Service “explicitly excluded Google’s Privacy Policy” and thus a
9 “reasonable user consenting to Google’s Terms of Service on or after March 31, 2020 might have
10 concluded that she was not consenting to Google’s Privacy Policy.” Id. In the instant case,
11 Google argues that, because the Court concluded that the Calhoun plaintiffs were not bound by
12 Google’s Privacy Policy after March 2020, it would be inconsistent for the Court to conclude that
13 Google was bound by Google’s Privacy Policy after March 2020. Mot. at 10.
14 However, the Chrome Privacy Notice, which Google concedes is part of the contract,
15 independently references Google’s Privacy Policy. Specifically, each version of the Chrome
16 Privacy Notice that has been in effect since March 30, 2020 has stated: “[A]ny personal
17 information that is provided to Google or stored in your Google Account will be used and
18 protected in accordance with the Google Privacy Policy.” See ECF Nos. 165-21, 165-22, 192-2.
19 Moreover, Google’s Terms of Service instruct Chromes users to follow the Chrome
20 Privacy Notice in the event that the Terms of Service and the Chrome Privacy Notice conflict with
21 each other. Specifically, the version of Google’s Terms of Service that has been in effect since
22 March 30, 2020 states that users must follow “service-specific additional terms” and that, “[i]f the
23 [Terms of Service] conflict with the service-specific additional terms, the additional terms will
24 govern for that service.” ECF No. 165-19 at 3, 13.
25 Thus, a reasonable Chrome user could conclude that Google’s Privacy Policy continued to
26 be part of Google’s contract with Plaintiffs after March 30, 2020. Because the Chrome Privacy
27 Notice “call[ed] out” Google’s Privacy Policy, “provide[d] a link to it,” and “encourage[d] the
1 user to read it,” a reasonable user could conclude that the Chrome Privacy Notice incorporates
2 Google’s Privacy Policy. Facebook Consumer Privacy, 402 F. Supp. 3d at 791. In turn, because
3 the Terms of Service direct users to follow “service-specific additional terms” in the event of a
4 conflict, a reasonable user could conclude that the Chrome Privacy Notice, not the Terms of
5 Service, is binding with respect to Google’s Privacy Policy. ECF No. 165-19.
6 This conclusion is not inconsistent with Calhoun. As discussed, the Court’s task at the
7 motion to dismiss stage is to determine whether Google’s contract with Plaintiffs is “reasonably
8 susceptible” to Plaintiffs’ interpretation. See Facebook Consumer Privacy, 402 F. Supp. 3d at
9 789. In Calhoun, the Court held that a “reasonable user consenting to Google’s Terms of Service
10 on or after March 31, 2020 might have concluded that she was not consenting to Google’s Privacy
11 Policy.” Calhoun, 526 F. Supp. 3d at 621 (emphasis added). Accordingly, Calhoun does not
12 preclude Plaintiffs’ interpretation, which is that a reasonable user might have concluded that
13 Google’s Privacy Policy continued to be part of the contract after March 31, 2020. Indeed, the
14 fact that a contract is “reasonably susceptible” to one interpretation does not mean that the contract
15 is not “reasonably susceptible” to a competing interpretation.
16 Thus, Plaintiffs may rely on the March 31, 2020 version of Google’s Privacy Policy to
17 support their breach of contract claim.
18 3. A Reasonable User Could Read the Contract as Promising that “Private Browsing
Mode” Would Prevent Google from Collecting Users’ Data
19
Google also contends that Plaintiffs’ breach of contract claim must be dismissed because
20
Google did not promise Plaintiffs that using “private browsing mode” would prevent Google from
21
collecting Plaintiffs’ browsing data. For the reasons below, the Court rejects this contention.
22
Under California law, the “most important[]” principle of contract interpretation is that the
23
“‘whole of a contract is to be taken together, so as to give effect to every part, if reasonably
24
practicable, each clause helping to interpret the other.’” International Brotherhood of Teamsters
25
v. NASA Services, Inc., 957 F.3d 1038, 1042 (9th Cir. 2020). Indeed, California courts have
26
“consistently reaffirm[ed]” that “‘the intention of the parties is to be collected from the entire
27
1 instrument and not detached portions thereof, it being necessary to consider all of the parts to
2 determine the meaning of any particular part as well as of the whole.’” Id. (quoting Ajax
3 Magnolia One Corp. v. S. Cal. Edison Co., 167 Cal. App. 2d 743, 748 (1959)). “‘[I]ndividual
4 clauses and particular words must be considered in connection with the rest of the agreement, and
5 all of the writing and every word of it will, if possible, be given effect.’” Id. (quoting Ajax, 167
6 Cal. App. 2d at 748).
7 The Court already has determined that a reasonable user could read statements from the
8 Incognito Splash Screen, Google’s Privacy Policy, the “Search & Browse Privately” page, and the
9 Chrome Privacy Notice as promising that “private browsing mode” prevents Google from
10 collecting users’ browsing data. In Google’s motion to dismiss the FAC, Google argued that
11 Plaintiffs “expressly consented to Google’s alleged data collection while they were in private
12 browsing mode.” Brown, 525 F. Supp. 3d at 1063. Specifically, Google argued that Plaintiffs
13 “expressly consented to Google’s Terms of Service, which incorporated Google’s Privacy Policy,
14 and Google’s Privacy Policy disclosed that Google would receive the data from its third-party
15 services.” Id.; see also ECF No. 82 at 10–11. In rejecting this argument, the Court stated that the
16 portion of Google’s Privacy Policy which explains Google’s data collection practices “never
17 mentions private browsing” and does not “explain that Google collects this data from users in
18 private browsing.” Brown, 525 F. Supp. 3d at 1064. By contrast, other portions of Google’s
19 Privacy Policy, as well as other Google documents, “present private browsing as a way that users
20 can manage their privacy and omit Google as an entity that can view users’ activity while in
21 private browsing mode.” Id. at 1064.
22 Specifically, in the Court’s order denying Google’s motion to dismiss the FAC, the Court
23 highlighted the following portions of the Incognito Screen, the Privacy Policy, the “Search &
24 Browse privately” page, and the Chrome Privacy Notice:
25 • The Incognito Splash Screen’s “list of entities that can view a user’s activity in
26 private browsing mode,” which “omits Google” and instead lists: “Websites
27 you visit[;] Your employer or school[;] Your internet service provider.”
1 • The Incognito Splash Screen’s statement that: “Now you can browse privately,
2 and other people who use this device won’t see your activity.”
3 • The Incognito Splash Screen’s statement that: “Chrome won’t save . . . [y]our
4 browsing history [or] [c]ookies and site data.”
5 • The “Search & Browse privately” page’s statement that: “You’re in control of
6 what information you share with Google when you search. To browse the web
7 privately, you can use private browsing.”
8 • The Chrome Privacy Notice’s statement that: “You can limit the information
9 Chrome stores on your system by using incognito mode or guest mode. In
10 these modes, Chrome won’t store certain information, such as: . . . Basic
11 browsing history information like URLs, cached paged text, or IP addresses of
12 pages linked from the websites you visit [and] Snapshots of pages that you
13 visit.”
14 • Google’s Privacy Policy’s statement that: “You can . . . choose to browse the
15 web privately using Chrome in Incognito mode. And across our services, you
16 can adjust your privacy settings to control what we collect and how your
17 information is used.”
18 Id. at 1065–66 (internal quotations and citations omitted). The Court concluded that a reasonable
19 internet user could reach each of these statements as representing that “private browsing mode”
20 prevents Google from collecting users’ data. Id.
21 Given the Court’s previous conclusion regarding each of these individual statements, a
22 reasonable user, reading Google’s contract with Plaintiffs as a whole, could easily conclude that
23 Google promised Plaintiffs that using “private browsing mode” would prevent Google from
24 collecting Plaintiffs’ data. Indeed, even if some of the individual statements in the contract are
25 ambiguous, reading the contract as a whole, with “each clause helping to interpret the other,”
26 clarifies any ambiguities. International Brotherhood of Teamster, 957 F.3d at 1042. A reasonable
27 user could conclude that Google’s repeated affirmative assertions that “private browsing mode”
1 provides internet users with “privacy” and “control” were meant to emphasize to users that Google
2 would provide users with the maximum amount of data privacy.
3 Google does not attempt to read the contract as a whole. Instead, Google isolates each
4 provision and attempts to explain why that provision does not support Plaintiffs’ claim. See Mot.
5 at 7–15. However, because “the intention of the parties is to be collected from the entire
6 instrument and not detached portions thereof, it being necessary to consider all of the parts to
7 determine the meaning of any particular part as well as of the whole,” Google’s method is
8 misguided. International Brotherhood of Teamster, 957 F.3d at 1042 (internal citations omitted).
9 Regardless, the Court previously has rejected almost all of Google’s arguments regarding
10 individual provisions of the contract. For example, Google highlights a statement from Google’s
11 Privacy Policy—“across our services, you can adjust your privacy settings to control what we
12 collect and how your information is used”—and contends that this statement is “too generalized to
13 support [Plaintiffs’] breach of contract claim.” Mot. at 11 (internal citations omitted). However,
14 Google omits the preceding sentence of Google’s Privacy Policy, which states that users can
15 “choose to browse the web privately using Chrome in Incognito mode.” SAC ¶ 45. As the Court
16 previously concluded, a reasonable user could read these two sentences as promising that
17 “Incognito mode [i]s a way that users can control the information that Google collects.” Brown,
18 525 F. Supp. 3d at 1066. Google provides no reason for the Court to revisit this conclusion, or its
19 conclusions regarding Google’s other representations.
20 Additionally, although Google argues that contract interpretation principles compel a
21 different interpretation of the Chrome Privacy Notice than the Court previously reached, this
22 argument is unconvincing. The Chrome Privacy Notice states: “You can limit the information
23 Chrome stores on your system by using incognito mode or guest mode. In these modes, Chrome
24 won’t store . . . [b]asic browsing history information like URLs, cached page text, or IP addresses
25 of pages linked from the websites you visit [and] Snapshots of pages that you visit.” ECF No.
26 165-22 at 11. The Court previously concluded that “a reasonable user could read this statement to
27 mean that their browsing history and cookies and site data would not be saved” by Chrome and
1 that “a user might reasonably associate Chrome with Google because Chrome is Google’s
2 browser.” Brown, 525 F. Supp. 3d at 1065–66. Google acknowledges this conclusion. Mot. at 14
3 n.8. However, Google contends that the Court’s analysis should be different “in the context of a
4 breach of contract analysis.” Id. Specifically, Google contends that the “alleged contract
5 separately defines ‘Chrome’ and ‘Google’”; that it is a rule of contract interpretation that “defined
6 terms must be given their defined meaning”; and that because “Chrome” and “Google” are given
7 separate definitions, “Chrome” cannot be read as referring to “Google.” Mot. at 14 (internal
8 citations omitted). This argument ignores that, although “Google” and “Chrome” are not
9 synonymous, Google has complete control over Chrome’s functionality and Google obtains
10 internet users’ data by causing Chrome to send Google the data. Accordingly, a reasonable user
11 could read Google’s representations about Chrome to mean that Google designed Chrome not to
12 send Google data while in “private browsing mode.”
13 Finally, the Court rejects Google’s argument that Plaintiffs’ interpretation improperly
14 relies on subjective intent. Citing Plaintiffs’ allegation that Plaintiffs “‘reasonably expected that
15 Google would not collect their data while in Incognito mode,’” Mot. at 8 (citing SAC ¶ 51),
16 Google contends that “Plaintiffs’ allegations . . . fail to state a contract claim because: ‘It is not the
17 parties’ subjective intent that matters, but rather their objective intent, as evidenced by the words
18 of the contract,’” id. (citing Block v. eBay, Inc., 747 F.3d 1135, 1138 (9th Cir. 2014)). Although
19 Google is correct that the contract must be interpreted objectively, the objective meaning of a
20 contract is determined by reading the contract “from the perspective of a reasonable [Google]
21 user.” See Facebook Consumer Privacy, 402 F. Supp. 3d at 789. By offering an interpretation
22 about what Plaintiffs “reasonably expected,” Plaintiffs provide that perspective. SAC ¶ 51.
23 Thus, the Court DENIES Google’s motion to dismiss Plaintiffs’ breach of contract claim.
24 B. Plaintiffs Have Adequately Stated a UCL Claim Based on Google’s Data Collection
Practice
25
The California Unfair Competition Law (“UCL”) provides a cause of action against
26
persons who engage in “unfair competition,” which includes business practices that are “(1)
27
1 unlawful, (2) unfair, or (3) fraudulent.” Backhaut v. Apple, Inc., 74 F. Supp. 3d 1033, 1050 (N.D.
2 Cal. 2014) (citing Cal. Bus. & Prof. Code § 17200). This cause of action is available to any
3 “person who has suffered injury in fact and has lost money or property as a result of the unfair
4 competition.” Cal. Bus. & Prof. Code § 17204.
5 Plaintiffs allege that Google’s business practice of collecting Plaintiffs’ data while
6 Plaintiffs were using “private browsing mode” was “unlawful” and “unfair” because it constituted
7 a “violation of the Federal Wiretap Act, 18 U.S.C. § 2510, et seq.; the California Invasion of
8 Privacy Act, Cal. Penal Code §§ 631 and 632; the California Computer Data Access and Fraud
9 Act, Cal. Penal Code § 502, eq seq.; Invasion of Privacy; Intrusion Upon Seclusion; Breach of
10 Contract; and California Business & Professions Code § 22576.” SAC ¶¶ 279, 281. Plaintiffs
11 further allege that they “have suffered injury-in-fact, including the loss of money and/or property
12 as a result of . . . the unauthorized disclosure and taking of their personal information which has
13 value as demonstrated by its use and sale by Google.” Id. ¶ 282. Specifically, Plaintiffs “have
14 suffered harm in the form of diminution of the value of their private and personally identifiable
15 data and content.” Id.
16 Google argues that Plaintiffs’ UCL claim should be dismissed for two reasons and argues
17 that, even if Plaintiffs’ UCL claim is not dismissed, Plaintiffs should be limited to seeking
18 injunctive relief. First, Google contends that the UCL claim should be dismissed because
19 Plaintiffs have not “plausibly alleged that they ‘lost money or property’ as a result of Google’s
20 conduct.” Mot. at 16 (quoting Cal. Bus. & Prof. Code § 17204). Second, Google contends that
21 the UCL claim should be dismissed because Plaintiffs have not adequately alleged that they relied
22 on Google’s statements. Mot. at 24. Finally, Google contends that Plaintiffs should be limited to
23 injunctive relief because Plaintiffs “do not allege that Google took any money from them.” Mot.
24 at 23. The Court addresses each contention in turn.
25 1. Plaintiffs Have Plausibly Alleged that Google’s Data Collection Practice Caused
Plaintiffs to Lose “Money or Property”
26
As noted, Plaintiffs must show that they “ha[ve] suffered injury in fact and ha[ve] lost
27
1 money or property as a result of the unfair competition.” Cal. Bus. & Prof. Code § 17204.
2 Google argues that, because Plaintiffs’ data is not “property” and because Plaintiffs did not pay to
3 use “private browsing mode,” Google’s practice of collecting Plaintiffs’ data when Plaintiffs used
4 “private browsing mode” cannot have caused Plaintiffs to lose “money or property.” Mot. at 17–
5 23. For the reasons below, the Court rejects Google’s argument.
6 The California Supreme Court has explained that the phrase “‘[i]njury in fact’ is a legal
7 term of art” that comes from the “requirements for federal standing under [A]rticle III, section 2 of
8 the United States Constitution.” Kwikset Corp. v. Superior Court, 51 Cal. 4th 310, 322 (2011).
9 “Under federal law, injury in fact is ‘an invasion of legally protected interest which is (a) concrete
10 and particularized; and (b) actual or imminent, not conjectural or hypothetical.’” Id. (quoting
11 Lujan v. Defenders of Wildlife, 504 U.S. 555, 560 (1992)). The UCL “incorporate[s] the
12 established federal meaning” of “injury in fact.” Id.
13 To show that they have “lost money or property,” Plaintiffs “must demonstrate some form
14 of economic injury,” which “is itself a classic form of injury in fact.” Id. at 323. Thus, because
15 federal standing “may be predicated on a broader range of injuries,” the effect of the “lost money
16 or property” requirement is to “render[] standing under [the UCL] substantially narrower than
17 federal standing.” Id. at 324.
18 However, the California Supreme Court has held that “[t]here are innumerable ways in
19 which economic injury from unfair competition may be shown.” Id. at 323. For example, a
20 “plaintiff may (1) surrender in a transaction more, or acquire in a transaction less, than he or she
21 otherwise would have; (2) have a present or future property interest diminished; (3) be deprived of
22 money or property to which he or she has a cognizable claim; or (4) be required to enter into a
23 transaction, costing money or property, that would otherwise have been unnecessary.” Id.
24 Plaintiffs allege that the “cash value” of the data which Google collected “can be
25 quantified” and that there is an active market for such data. See SAC ¶¶ 123, 127. For example, a
26 recent study found that internet users are willing to pay up to $52.00/year to keep their browsing
27 histories private. Id. ¶ 128. Google itself has set up a project called “Google Screenwise Trends”
1 which pays internet users “up to $3 per week” to “add a browser extension that shares with Google
2 the sites they visit and how they use them.” Id. ¶ 129–30. Indeed, “a number of platforms have
3 appeared where consumers can and do directly monetize their own data.” Id. ¶ 135. For example,
4 a company called Brave now offers a web browser which “will pay users to watch online targeted
5 ads, while blocking out everything else.” Id. Several other companies, including a company
6 called Killi, have launched exchange platforms that allow individuals to sell their data to third-
7 party applications and websites. See id.
8 These detailed allegations establish at least two cognizable theories of economic injury.
9 First, because Google previously has paid individuals for browsing histories, it is plausible that,
10 had Plaintiffs been aware of Google’s data collection, they would have demanded payment for
11 their data. Thus, by inducing Plaintiffs to give Google their data without payment, Google caused
12 Plaintiffs to “acquire in a transaction less[] than [they] otherwise would have.” Kwikset, 51 Cal.
13 4th at 324. Second, because there are several browsers and platforms willing to pay individuals
14 for data, it is plausible that Plaintiffs will decide to sell their data at some point. Indeed, each
15 named Plaintiff has alleged that he or she is aware of these browsers and platforms. See SAC
16 ¶¶ 170, 175, 180, 185, 190. Accordingly, by obtaining Plaintiffs’ data and selling it to advertisers,
17 Google “diminished” Plaintiffs’ “future property interest.” Kwikset, 51 Cal. 4th at 324.
18 Indeed, in Calhoun, this Court found economic injury in almost identical circumstances.
19 As discussed, the Calhoun plaintiffs were “users of Google’s Chrome browser” who “chose not to
20 ‘Sync’ their [Chrome] browsers with their Google accounts while browsing the web.” Id. at 613.
21 The plaintiffs brought a UCL claim against Google based on an allegation that Google had
22 collected the plaintiffs’ data despite Google’s representation that it would only collect the data of
23 Chrome users who chose to “Sync” their browsers. See id. at 613–615, 636.
24 The Court rejected Google’s argument that the Calhoun plaintiffs “lack[ed] statutory
25 standing under the UCL because they fail[ed] to allege that Google caused them to lose ‘money or
26 property.’” Id. (internal citations omitted). The Court explained that the “Ninth Circuit and a
27 number of district courts, including this Court, have concluded that plaintiffs who suffered a loss
1 of their personal information suffered economic injury and had standing.” See id.; see also In re
2 Marriott Int’l, Inc., Cust. Data Sec. Breach Litig., 440 F. Supp. 3d 447, 461 (D. Md. 2020) (“[T]he
3 growing trend across courts that have considered this issue is to recognize the lost property value
4 of this information.”); In re Yahoo! Inc. Cust. Data Sec. Breach Litig., 2017 WL 3727318, at *13
5 (N.D. Cal. Aug. 30, 2017) (holding that plaintiffs had adequately alleged injury in fact based on
6 the loss of value of their personal information); In re Anthem Inc. Data Breach Litig., 2016 WL
7 3029783, at *14 (N.D. Cal. May 17, 2016) (concluding that the plaintiffs had plausibly alleged
8 injury from the loss of value of their personal information).
9 Although Google acknowledges Calhoun, Google asks the Court to reconsider that
10 decision. Mot. at 16. Specifically, Google argues that data does not fit the UCL’s definition of
11 “property,” that Calhoun improperly relied on cases addressing Article III standing, and that
12 Calhoun improperly relied on cases in which the plaintiffs had paid money to the defendants. See
13 Mot. at 17–21. The Court sees no reason to revisit Calhoun. Regardless, the Court addresses
14 Google’s primary arguments below.
15 As an initial matter, Google’s argument that data does not fit within the UCL’s definition
16 of “property” ignores the California Supreme Court’s guidance that a UCL claim may be based on
17 any kind of “economic injury.” Google cites the Ninth Circuit’s three-part test for determining
18 “whether an intangible property rights exists”: “‘First there must be an interest capable of precise
19 definition; second, it must be capable of exclusive possession or control; and third, the putative
20 owner must have established a legitimate claim to exclusivity.’” Mot. at 17 (quoting Kremen v.
21 Cohen, 337 F.3d 1024, 1030 (9th Cir. 2003)). Google contends that an internet user’s data does
22 not satisfy this test because data is “not capable of ‘exclusive possession or control’ by the user.”
23 Id. However, the California Supreme Court has explained that the UCL only requires a plaintiff
24 to “demonstrate some form of economic injury” and that there are “innumerable ways in which
25 economic injury from unfair competition may be shown.” Kwikset, 51 Cal. 4th at 323. As
26 discussed, Plaintiffs have plausibly alleged that Google’s conduct caused Plaintiffs to “acquire in a
27 transaction less[] than [they] otherwise would have” and have “diminished” Plaintiffs’ “future
1 property interest.” Id. at 324. These injuries fall well within the categories of economic injury
2 recognized by the California Supreme Court. Id. Thus, the Court need not determine whether
3 data constitutes property under the UCL.
4 Next, in arguing that cases discussing Article III standing are irrelevant, Google misreads
5 governing precedent. Citing Cottle v. Plaid Inc., Case No. 20-cv-3056-DMR, 2021 WL 1721177
6 (N.D. Cal. Apr. 30, 2021), which disagreed with Calhoun, Google contends that Calhoun was
7 wrongly decided because “Calhoun ‘rests on four cases that address Article III standing, which is
8 different from UCL standing.’” Mot. at 20 (quoting Cottle, 2021 WL 1721177, at *14 n.8).
9 Additionally, Google quotes the California Supreme Court’s statement that UCL standing is
10 “‘substantially narrower than federal standing under [A]rticle III.’” Id. at 20–21 (citing Kwikset,
11 51 Cal. 4th at 324). Both Google and Cottle misread the California Supreme Court’s precedent.
12 As discussed, UCL standing is narrower than Article III standing because Article III standing
13 “may be predicated on a broader range of injuries” than UCL standing. Kwikset, 51 Cal. 4th at
14 324. However, the “economic injury” required by the UCL is a “classic form of injury in fact”
15 under Article III and there is no precedent which suggests that “economic injury” has a different
16 meaning in the UCL context than it does in the Article III context. Id. at 323. Indeed, the Ninth
17 Circuit has stated that the “UCL’s “economic injury-in-fact requirement . . . demands no more
18 than the corresponding requirement under Article III of the U.S. Constitution.” Reid v. Johnson &
19 Johnson, 780 F.3d 952, 958 (9th Cir. 2015) (emphasis added). Thus, cases discussing economic
20 injury in the context of Article III have full application to a court’s analysis of UCL standing.
21 Finally, although Google points out that the cases cited in Calhoun involved plaintiffs that
22 had paid the defendants money, Google fails to explain why this difference is significant. For
23 example, Google points out that the plaintiffs in Marriott alleged that, but for Marriott’s conduct,
24 “‘they would not have stayed at a Marriott Property, purchased products or services at a Marriott
25 Property, and/or would have paid less.’” Mot. at 21 (citing Marriott, 440 F. Supp. 3d at 492).
26 Similarly, Google highlights that, in Anthem, “‘[e]ach California Plaintiff state[d] they paid money
27 for health insurance premiums, which were used to pay for services offered by Defendants.’” Id.
1 at 22 (quoting Anthem, 2016 WL 3029783, at *30 (emphasis added)). Google contends that,
2 because Plaintiffs do not allege that they paid to use “private browsing mode,” Marriott and
3 Anthem are not relevant to the instant case. Mot. at 21. However, as discussed, the California
4 Supreme Court has stated that a plaintiff has suffered economic injury if the plaintiff “acquire[d]
5 in a transaction less . . . than he or she otherwise would have.” Kwikset, 51 Cal. 4th at 324. Under
6 this standard, a party who has provided goods or services in a transaction and has not been paid
7 the fair value of those goods or services has suffered an economic injury even though the party has
8 received money instead of paying money. Id. The same logic would apply to parties like
9 Plaintiffs, who have provided valuable data to Google and have received no money in return.
10 Thus, the fact that Marriott and Anthem involved plaintiffs who paid too much money for goods
11 and services does not diminish their general conclusion that “plaintiffs who suffered a loss of their
12 personal information suffered economic injury.” Calhoun, 526 F. Supp. 3d at 636.
13 Thus, Plaintiffs have adequately alleged that they “lost money or property as a result of the
14 unfair competition.” Cal. Bus. & Prof. Code § 17204.
15 2. Google Fails to Explain Why Plaintiffs Were Required to Allege Reliance
16 Google also contends that Plaintiffs’ UCL claim must be dismissed because Plaintiffs
17 failed to allege reliance. Mot. at 24. For the reasons below, the Court rejects this argument.
18 Under California law, “a plaintiff ‘proceeding on a claim of misrepresentation as the basis
19 of his or her UCL action must demonstrate actual reliance on the allegedly deceptive or
20 misleading statements, in accordance with well-settled principles regarding the element of reliance
21 in ordinary fraud actions.’” Kwikset, 51 Cal. 4th at 326 (quoting In re Tobacco II Cases, 46 Cal.
22 4th 298, 306 (2009)). Accordingly, plaintiffs that bring UCL claims based on alleged
23 misrepresentations must “specif[y] which statements any of them saw or relied on.” Ahern v.
24 Apple Inc., 411 F. Supp. 3d 541, 564 (N.D. Cal. 2019).
25 Plaintiffs have not alleged that their UCL claim relies on misrepresentations or omissions.
26 Plaintiffs allege only that their UCL claim is based on Google’s “violation of the Federal Wiretap
27 Act, 18 U.S.C. § 2510, et seq.; the California Invasion of Privacy Act, Cal. Penal Code §§ 631 and
1 632; the California Computer Data Access and Fraud Act, Cal. Penal Code § 502, eq seq.;
2 Invasion of Privacy; Intrusion Upon Seclusion; Breach of Contract; and California Business &
3 Professions Code § 22576.” SAC ¶¶ 279, 281.
4 Moreover, Google provides no legal or factual support for its conclusory argument that an
5 allegation of reliance is required for Plaintiffs’ UCL claim. Indeed, Google’s only argument on
6 this issue is a summary assertion in its reply brief that “[a]ll of Plaintiffs’ claims indisputably are
7 based on Google’s alleged ‘misrepresentation[s] or omission[s]’ in the Incognito Screen and other
8 disclosures.” Reply at 15.
9 However, as one example, the Wiretap Act, as amended by the Electronic Communications
10 Privacy Act (“ECPA”), generally prohibits the interception of “wire, oral, or electronic
11 communications” and makes no mention of fraud, misrepresentation, or reliance. 18 U.S.C.
12 § 2511(1). Thus, on this record, the Court cannot conclude that Plaintiffs were required to allege
13 reliance. Kwikset, 51 Cal. 4th at 326. Accordingly, the Court DENIES Google’s motion to
14 dismiss Plaintiffs’ UCL claim.
15 3. Plaintiffs May Seek Restitution
16 Google contends that Plaintiffs may not seek damages for their UCL claim because
17 “Plaintiffs do not allege that Google took any money from them” and do not “identify any
18 ‘property’ that could be ‘returned’ to them.” Mot. at 23. Accordingly, Google contends,
19 “Plaintiffs seek only nonrestitutionary disgorgement,” which is ‘not available’ under the UCL.”
20 Id. (quoting Madrid v. Perot Sys. Corp., 130 Cal. App. 4th 440, 460–62 (2005)).
21 The Court agrees with Google that Plaintiffs may not seek disgorgement as a remedy. See
22 Korea Supply Co. v. Lockheed Martin Corp., 29 Cal. 4th 1134, 1148 (2003) (holding that
23 “nonrestitutionary disgorgement of profits is not an available remedy” under the UCL). However,
24 the Court cannot conclude at this stage that Plaintiff does not have a cognizable theory of
25 restitution. Indeed, Plaintiffs have alleged that Google’s conduct caused a “diminution of the
26 value of [Plaintiffs’] private and personally identifiable data and content.” SAC ¶ 282. Google
27 fails to explain why, if Plaintiffs can quantify this diminution in value, Plaintiffs would not be
1 entitled to restitution.
2 Thus, as in Calhoun, the “only monetary remedy Plaintiffs may seek is restitution.”
3 Calhoun, 526 F. Supp. 3d at 637.
4 || V. CONCLUSION
5 For the foregoing reasons, the Court DENIES Google’s motion to dismiss.
6 || ITISSO ORDERED.
4
8 Dated: December 22, 2021
9 K. beh
LUCY MH. KOH
10 United States District Judge
11
12
15
16
= 17
Z 18
19
20
21
22
23
24
25
26
27
28 31
Case No. 20-CV-03664-LHK