Yockey v. Salesforce, Inc.

1

2

3

4 UNITED STATES DISTRICT COURT

5 NORTHERN DISTRICT OF CALIFORNIA

6

7 PATRICK YOCKEY, et al., Case No. 22-cv-09067-JST

8 Plaintiffs,

ORDER GRANTING IN PART AND

9 v. DENYING IN PART MOTION TO

DISMISS

10 SALESFORCE, INC.,

Re: ECF No. 23

Defendant.

11

12

13 Before the Court is Defendant Salesforce, Inc.’s motion to dismiss. ECF No. 23. The

14 Court will grant the motion in part and deny it in part.

15 I. BACKGROUND

16 Salesforce is a software-as-a-service provider that offers a service called Chat. ECF No.

17 22 ¶¶ 6, 11. Chat is an application programming interface (“API”), id. ¶ 12, which is “a tool that

18 ‘allow[s] programmers to use . . . prewritten code to build certain functions into their own

19 programs, rather than write their own code to perform those functions from scratch,” Google LLC

20 v. Oracle Am., Inc., 141 S. Ct. 1183, 1191 (2021) (quoting Oracle Am., Inc. v. Google, Inc., 750

21 F.3d 1339, 1349 (2014)). “An API divides and organizes the world of computing tasks in a

22 particular way.” Id. at 1192. Id. Chat operates from Salesforce’s web servers, but its

23 functionality can be implemented on the website of a company that contracts with Salesforce to

24 use the service, thereby allowing that company’s customers to interact with the company directly

25 on the website. ECF No. 22 ¶ 12–13. When a customer sends a chat message to a company’s

26 customer service agent, “it is first routed through a Salesforce server.” Id. ¶ 13. Transcripts of

27 communications over Chat are automatically created in real time and subsequently transmitted to

1 to view the contents of a customer’s message while the customer types the message, i.e., before

2 the customer sends the message to the agent. Id. ¶ 22–23.

3 Rite Aid and Kaiser Permanente utilize Chat on their websites. Id. ¶ 13. Plaintiff Pearl

4 Magpayo is a California resident and used the chat function on the Kaiser Permanente website to

5 discuss her insurance and medical information with Kaiser’s customer service agents. Id. ¶ 4.

6 Plaintiff Patrick Yockey is a Pennsylvania resident and used the chat function on the Rite Aid

7 website to discuss his prescription history and customer rewards with Rite Aid’s customer service

8 agents. Id. ¶ 3. Plaintiffs subsequently brought suit, alleging that Chat’s functions constitute

9 wiretapping in violation of California and Pennsylvania law. As individuals and on behalf of a

10 putative class, they bring claims for violations of the California Invasion of Privacy Act (“CIPA”),

11 Cal. Penal Code §§ 631 & 632; and violation of Pennsylvania’s Wiretapping and Electronic

12 Surveillance Control Act (“WESCA”), 18 Pa. Cons. Stat. § 5701, et seq. ECF No. 22 ¶¶ 48–80.

13 Salesforce moved to dismiss the complaint on April 24, 2023. ECF No. 23. The Court

14 took the motion under submission without a hearing on July 17, 2023. ECF No. 33.

15 II. JURISDICTION

16 The Court has jurisdiction pursuant to 28 U.S.C. § 1332(d)(2)(A).

17 III. LEGAL STANDARD

18 To survive a motion to dismiss under Federal Rule of Civil Procedure 12(b)(6), a

19 complaint must contain “a short and plain statement of the claim showing that the pleader is

20 entitled to relief.” Fed. R. Civ. P. 8(a)(2). Dismissal “is appropriate only where the complaint

21 lacks a cognizable legal theory or sufficient facts to support a cognizable legal theory.”

22 Mendiondo v. Centinela Hosp. Med. Ctr., 521 F.3d 1097, 1104 (9th Cir. 2008). “[A] complaint

23 must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible

24 on its face.’” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly,

25 550 U.S. 544, 570 (2007)). Factual allegations need not be detailed, but facts must be “enough to

26 raise a right to relief above the speculative level.” Twombly, 550 U.S. at 555.

27 “A claim has facial plausibility when the plaintiff pleads factual content that allows the

1 alleged.” Iqbal, 556 U.S. at 678. While this standard is not “akin to a ‘probability

2 requirement,’ . . . it asks for more than a sheer possibility that a defendant has acted unlawfully.”

3 Id. (quoting Twombly, 550 U.S. at 556). “Where a complaint pleads facts that are ‘merely

4 consistent with’ a defendant’s liability, it ‘stops short of the line between possibility and

5 plausibility of entitlement to relief.’” Id. (quoting Twombly, 550 U.S. at 557). In determining

6 whether a plaintiff has met the plausibility requirement, a court must “accept all factual allegations

7 in the complaint as true and construe the pleadings in the light most favorable” to the

8 plaintiff. Knievel v. ESPN, 393 F.3d 1068, 1072 (9th Cir. 2005). A plaintiff may “plead[] facts

9 alleged upon information and belief where the facts are peculiarly within the possession and

10 control of the defendant or where the belief is based on factual information that makes the

11 inference of culpability plausible.” Soo Park v. Thompson, 851 F.3d 910, 928 (9th Cir. 2017)

12 (quoting Arista Records, LLC v. Doe 3, 603 F.3d 110, 120 (2d Cir. 2010)).

13 IV. DISCUSSION

14 Salesforce argues that Plaintiffs lack standing, that Plaintiffs fail to state a claim under

15 either statute, and that Plaintiffs otherwise consented to Salesforce’s collection of their

16 information.

17 A. Article III Standing

18 “Article III of the Constitution confines the federal judicial power to the resolution of

19 ‘Cases’ and ‘Controversies.’” TransUnion LLC v. Ramirez, 141 S. Ct. 2190, 2203 (2021). “For

20 there to be a case or controversy under Article III, the plaintiff must have a ‘personal stake’ in the

21 case—in other words, standing.” Id. (quoting Raines v. Byrd, 521 U.S. 811, 819 (1997)). “[T]o

22 establish standing, a plaintiff must show (i) that he suffered an injury in fact that is concrete,

23 particularized, and actual or imminent; (ii) that the injury was likely caused by the defendant, and

24 (iii) that the injury would likely be redressed by judicial relief.” Id. at 2203. “The party invoking

25 federal jurisdiction bears the burden of establishing these elements.” Lujan v. Defenders of

26 Wildlife, 504 U.S. 555, 561 (1992). “Where, as here, a case is at the pleading stage, the plaintiff

27 must ‘clearly . . . allege facts demonstrating’ each element.” Spokeo, Inc. v. Robins, 578 U.S. 330,

1 Salesforce argues that Plaintiffs have not suffered a concrete injury because they have not

2 alleged that Salesforce “shared, disclosed, or sold chat transcripts to third parties.” ECF No. 23 at

3 16. The Court is not persuaded. “[V]arious intangible harms can . . . be concrete. Chief among

4 them are injuries with a close relationship to harms traditionally recognized as providing a basis

5 for lawsuits in American courts.” TransUnion, 141 S. Ct. at 2204. An “exact duplicate” is not

6 required, and the Supreme Court has recognized that “intrusion upon seclusion” is included among

7 those traditionally recognized harms. Id. at 2204; see Restatement (Second) of Torts § 652B cmt.

8 b. (1977) (including “tapping . . . telephone wires” as an example of intrusion upon seclusion). In

9 that vein, the Ninth Circuit has written that “[v]iolations of the right to privacy have long been

10 actionable at common law,” and that “[a] right to privacy ‘encompass[es] the individual’s control

11 of information concerning his or her person.’” In re Facebook, Inc. Internet Tracking Litigation,

12 956 F.3d 589, 598 (9th Cir. 2020) (first quoting Patel v. Facebook, 932 F.3d 1264, 1272 (9th Cir.

13 2019); and then quoting Eichenberger v. ESPN, Inc., 876 F.3d 979, 983 (9th Cir. 2017)); see also

14 Restatement (Second) of Torts § 652B cmt. a. (explaining that intrusion upon seclusion “does not

15 depend upon any publicity given to the person whose interest is invaded or to his affairs” but

16 rather “consists solely of an intentional interference with his interest in solicitude or seclusion”).

17 Statutes such as CIPA and WESCA thus “codify a substantive right to privacy, the

18 violation of which gives rise to a concrete injury sufficient to confer standing.” Id.; accord In re

19 Google Inc. Cookie Placement Consumer Privacy Litig., 934 F.3d 316, 325 (3d Cir. 2019)

20 (“History and tradition reinforce that a concrete injury for Article III standing purposes occurs

21 when Google, or any other third party, tracks a person’s internet browser activity without

22 authorization.” (emphasis added)). Both Plaintiffs allege that they disclosed personal health

23 information over Chat and that Salesforce collected the communications containing that

24 information. ECF No. 22 ¶¶ 3, 4. These allegations give rise to a concrete injury because

25 Salesforce’s collection of those communications necessarily deprived Plaintiffs of their control of

26 their information contained therein. See Mastel v. Miniclip SA, 549 F. Supp. 3d 1129, 1138 (E.D.

27 Cal. 2021); see also Licea v. Cinmar, LLC, --- F. Supp. 3d ----, No. CV 22-6454-MWF (JEM),

1 Plaintiffs have standing to bring their claims.

2 B. CIPA

3 1. Section 631

4 Salesforce argues that Magpayo fails to state a Section 631 claim because Salesforce was

5 “acting merely as an extension of . . . Kaiser’s communications” such that it was a party to those

6 communications. ECF No. 23 at 22. Plaintiffs argue that Salesforce’s interpretation of Section

7 631 runs afoul of the statute’s text and corresponding caselaw. ECF No. 28 at 11.

8 Section 631 creates four avenues for relief:

9 (1) where a person “by means of any machine, instrument, or

contrivance, or in any other manner, intentionally taps, or

10 makes any unauthorized connection ... with any telegraph or

telephone wire, line, cable, or instrument”;

11

(2) where a person “willfully and without consent of all parties

12 to the communication, or in any unauthorized manner, reads,

or attempts to read, or to learn the contents or meaning of any

13 message, report, or communication while the same is in

transit”;

14

(3) where a person “uses, or attempts to use, in any manner,

15 or for any purpose, or to communicate in any way, any

information so obtained”; and

16

(4) where a person “aids, agrees with, employs, or conspires

17 with any person or persons to unlawfully do, or permit, or

cause to be done any of the acts or things mentioned above.”

18

19 Javier v. Assurance IQ, LLC, --- F. Supp. 3d ----, No. 20-cv-02860-CRB, 2023 WL 114225, at *4

20 (N.D. Cal. Jan. 5, 2023) (quoting Cal. Penal Code § 631). Magpayo’s Section 631 claim arises

21 under the second prong.

22 Recent Section 631 jurisprudence stems from two seminal cases: Ribas v. Clark, 38 Cal. 3d

23 355 (1985), and Rogers v. Ulrich, 52 Cal. App. 3d 894 (1975). In Ribas, Ribas and his former

24 wife had reached a settlement agreement during divorce proceedings. 38 Cal. 3d at 358. The wife

25 used Clark’s phone to call Ribas and asked Clark to listen to the conversation on an extension

26 telephone. Id. Ribas relayed to the wife the details of a conversation with the spouse’s lawyer

27 while Clark listened. Id. Ribas subsequently sued Clark for eavesdropping under Section 631.

1 draws a distinction between “the secondhand repetition of the contents of a conversation and its

2 simultaneous dissemination to an unannounced second auditor, whether that auditor be a person or

3 mechanical device.” Id. at 361. The Court wrote that “such secret monitoring denies the speaker

4 an important aspect of privacy of communication—the right to control the nature and extent of the

5 firsthand dissemination of his statements.” Id.

6 In Rogers, Ulrich used a tape recorder jack installed on his telephone to record a

7 conversation with Rogers without Rogers’ knowledge. 52 Cal. App. 3d at 897. The Court of

8 Appeal held that Ulrich’s conduct did not violate Section 631 because Ulrich was a party to the

9 conversation and thus could not eavesdrop under the statute. Id. at 899. The Court wrote that “[i]t

10 is never a secret to one party to a conversation that the other party is listening to the conversation;

11 only a third party can listen secretly to a private conversation.” Id.

12 Thus, as the court observed in Javier v. Assurance IQ, LLC, the question for purposes of

13 determining whether Salesforce was a party to the communications is whether Chat “is more akin

14 to the tape recorder in Rogers, held by [Kaiser], or [to] the friend in Ribas (in which case, [Kaiser]

15 is the wife who allowed [Salesforce] to listen in).” 2023 WL 114225, at *5; accord Yoon v.

16 Lululemon USA, Inc., 549 F. Supp. 3d 1073, 1081 (C.D. Cal. 2021). In analogous circumstances,

17 courts have arrived at two different answers.

18 In the first set of cases, courts concluded that software providers are third parties. The

19 Ninth Circuit in In re Facebook, Inc. Internet Tracking Litigation held that Facebook was not a

20 party to communications between a user’s browser and a third-party website. 956 F.3d 589, 608

21 (9th Cir. 2020). On websites with Facebook plug-ins, Facebook’s code copied a header containing

22 a user’s personally identifiable URL information that was transmitted from the user’s web browser

23 to the website. Id. at 607. This enabled Facebook to compile users’ browsing histories for its

24 own purposes. Id. The Ninth Circuit concluded that “unknown duplication and communication

25 of” information in this manner “do not exempt a defendant from liability under the party

26 exception.” Id. at 608. Similarly, in Revitch v. New Moosejaw, Inc., the court held that NaviStone

27 was not a party to the communications between a website visitor and Moosejaw.com because

1 that tracked interactions between users and the website. No. 18-cv-06827-VC, 2019 WL 5485330,

2 at *1 (N.D. Cal. Oct. 2023). The court emphasized that “it cannot be that anyone who receives a

3 direct signal escapes liability by becoming a party to the communication,” id. at *2, and further

4 wrote,

5 Revitch began each communication by pressing a button on his

mouse or a key on his keyboard, causing one signal to travel to his

6 computer and then through his browser to Moosejaw’s server. Even

if the browser caused a parallel signal to be sent to NaviStone, that

7 intervention happened while the signal was already in transit from

Revitch’s device. Section 631’s protections extend explicitly to the

8 beginnings and ends of communications, so there is no reason to

consider the first part of an electronic communication beyond the

9 statute’s reach.

10 Id.

11 And in Javier, the court held that ActiveProspect was not a party to communications

12 between Assurance IQ and users of its website. 2023 WL 114225, at *5. ActiveProspect

13 implemented “a piece of code that can be pasted into a form page to record keystrokes, mouse

14 clicks, data entry, and other electronic communications of visitors to websites.” Id. at *1 (internal

15 quotation marks omitted). The website owner would subsequently obtain “a record of a users’

16 entire interaction with its website.” Id. Because Javier alleged “that ActiveProspect monitors,

17 analyzes, and stores information about visits to assurance’s websites, and that ActiveProspect can

18 use that information for other purposes,” ActiveProspect was not a party to the communication.

19 Id. at *6; see also Yoon, 549 F. Supp. 3d at 1081 (“Yoon’s first claim for relief survives Quantum

20 Metric’s participant exception challenge because she alleges that QM captures, stores, and

21 interprets her real-time data—which extends beyond the ordinary function of a tape recorder.”); cf.

22 Saleh v. Nike, Inc., 562 F. Supp. 3d 503, 521 (C.D. Cal. 2021) (“FullStory did not become a

23 ‘party’ to the communication simply because it was providing recording and transmission services

24 for Nike.”).

25 In the second set of cases, courts have held that software providers are “extension[s]” that

26 “provide[] a tool” allowing a company “to record and analyze its own data in aid of [its] business.”

27 Graham v. Noom, Inc., 533 F. Supp. 3d 823, 832 (N.D. Cal. 2021). In Graham, FullStory

1 allows the clients to analyze their data.” Id. The court likened this software to the tape recorder in

2 Rogers and held that the software did not constitute eavesdropping because the plaintiffs had not

3 alleged that FullStory “intercepted and used the data itself.” Id. In Williams v. What If Holdings,

4 LLC, the court held that ActiveProspect’s software—the same software at issue in Javier—did not

5 constitute wiretapping because there “were no facts . . . to suggest that ActiveProspect ‘intercepted

6 and used the data itself.’” No. C 22-03780 WHA, 2023 WL 114225, at *3 (N.D. Cal. Dec. 22,

7 2022) (quoting Graham, 533 F. Supp. 3d at 832); see also Johnson v. Blue Nile, Inc., No. C 20-

8 08183 LB, 2021 WL 1312771, at *3 (N.D. Cal. Apr. 8, 2021); Yale v. Clicktale, Inc., No. C 20-

9 07575 LB, 2021 WL 1428400, at *3 (N.D. Cal. Apr. 15, 2021).

10 The Javier court partially disagreed with the reading of Section 631 adopted by this second

11 set of cases for two reasons. First, the reading “interprets the second prong of the statute . . . based

12 on the intentions and usage of the prospective third party,” “[b]ut the third prong of the statute

13 already penalizes ‘use.’” Javier, 2023 WL 114225, at *6. As a result, “reading a use requirement

14 into the second prong would add requirements that are not present (and swallow the third prong in

15 the process).” Id.; see Henson v. Santander Consumer USA Inc., 582 U.S. 79, 86 (2017) (“[W]hen

16 we’re engaged in the business of interpreting statutes we presume differences in

17 language . . . convey differences in meaning.”); United States v. Jicarilla Apache Nation, 564 U.S.

18 162, 185 (2011) (“[W]e are hesitant to adopt an interpretation of a congressional enactment which

19 renders superfluous another portion of that same law.” (quoting Mackey v. Lanier Collection

20 Agency & Serv., Inc., 468 U.S. 825, 837 (1988)). Second, the California Supreme Court in Ribas

21 did not consider the intention of the eavesdropper or the use of the obtained information, but rather

22 “emphasized the privacy concerns at issue with having an ‘unannounced second auditor’ listening

23 in on the call,” which implicates an individual’s “right to control the nature and extent of the

24 firsthand dissemination of [their] statements.” Id.

25 The Court agrees with the Javier court that Graham and its progeny are based on a

26 misinterpretation of Section 631 and Ribas, both of which compel the conclusion that the third

27 party’s intentions with respect to the use of the collected information are irrelevant. Rather, the

1 its record of the interaction for any other purpose.” Javier, 2023 WL 114225, at *6 (emphasis

2 altered). If Salesforce can use its records of the communications for any purpose other than to

3 furnish information relating to those communications to Kaiser, then it is more like the wife in

4 Ribas who allowed Clark to eavesdrop. By contrast, if Salesforce “has no independent ability to

5 divulge its recording for any other purpose but for that of” Kaiser, then it is more like the tape

6 recorder in Rogers. Id.

7 Plaintiffs allege that Chat “is run from Salesforce web servers,” ECF No. 22 ¶ 12, that

8 communications over Chat are “routed through a Salesforce server,” id. ¶ 13, that Salesforce

9 “directly receives the electronic communications of visitors, id. ¶ 20, that Salesforce “analyzes the

10 customer-support agent interactions in real time to create live transcripts of communications,” id.

11 ¶ 14, and that “supervisors can view transcripts in real time,” id. ¶ 16. These allegations do not

12 support a reasonable inference that Salesforce has the capability to use these communications for

13 any purpose other than furnishing them to Kaiser. Chat, as alleged, is therefore more akin the tape

14 recorder in Rogers, and Plaintiffs have thus failed to state a claim pursuant to Section 631.

15 2. Section 632

16 a. Confidentiality of Communication

17 “Section 632 provides that ‘(a) every person who, intentionally and without the consent of

18 all parties to a confidential communication, by means of any electronic amplifying or recording

19 device, eavesdrops upon or records such confidential communication . . . shall be punished by

20 fine . . . or by imprisonment.’” Rattray v. City of National City, 51 F.3d 793, 797 (9th Cir. 1994)

21 (quoting Cal. Penal Code § 632). “A communication is confidential under Section 632 if a party

22 ‘has an objectively reasonable expectation that the conversation is not being overheard or

23 recorded.’” Brown v. Google LLC, 525 F. Supp. 3d 1049, 1073 (N.D. Cal. 2021) (quoting

24 Flanagan v. Flanagan, 27 Cal. 4th 766, 776–77 (2002)). “California appeals courts have

25 generally found that Internet-based communications are not ‘confidential’ within the meaning of

26 [S]ection 632, because such communications can easily be shared by, for instance, the recipient(s)

27 of the communications.” Campbell v. Facebook Inc., 77 F. Supp. 3d 836, 849 (N.D. Cal. 2014)

1 do not give rise to the requisite expectation. Revitch, 2019 WL 5485330, at *3.

2 Salesforce argues that Magpayo did not have a reasonable expectation of confidentiality

3 because “chat communications are by their very nature non-confidential.” ECF No. 23 at 27

4 (citing Campbell, 77 F. Supp. 3d at 849). Plaintiffs respond that Magpayo maintained a

5 reasonable expectation of confidentiality because she communicated information related to her

6 prescription history, medical conditions, and insurance information to the customer service agents

7 in a healthcare context. ECF No. 28 at 23. The Court agrees with Plaintiffs that the context of

8 these communications renders them confidential.

9 A recent case from this district is instructive. In In re Meta Pixel Healthcare Litig., No.

10 22-CV-03580-WHO, 2022 WL 17869218 (N.D. Cal. Dec. 22, 2022), the plaintiffs alleged that a

11 Meta software product called Pixel, when installed on the patient portal of the plaintiffs’

12 healthcare providers, intercepted “data relating to patient portal logins and logouts alongside

13 identifiers for each patient,” which was then transmitted to Meta. Id., 2022 WL 17869218, at *8.

14 The plaintiffs further alleged that following login, “the Meta Pixel allegedly continue[d] to

15 transmit information to Meta, including information about doctors, medical conditions, and

16 appointments associated with a patient’s session.” Id., 2022 WL 17869218, at *3. Meta allegedly

17 then “monetize[d] the information that it receive[d] through the Meta Pixel by using it to generate

18 highly-profitable targeted advertising on-and off-Facebook.” Id. The plaintiffs brought several

19 claims against Meta in connection with these practices, including claims under sections 631(a) and

20 632(a). Id., 2022 WL 17869218, at *13.

21 As Salesforce does here, Meta argued that the plaintiffs had no reasonable expectation of

22 privacy because the communications occurred over the internet, but the court rejected that

23 argument:

24 Communications made in the context of a patient-medical provider

relationship are readily distinguishable from online communications

25 in general for at least two reasons. First, patient-status and medical-

related communications between patients and their medical

26 providers are protected by federal law . . . . Second, unlike

communications made while inquiring about items of clothing on a

27 retail website, Revitch, 2019 WL 5485330, at *3, health-related

more likely to implicate privacy interests than that of one’s health or

1 genetic make-up.” Norman-Bloodsaw v. Lawrence Berkeley Lab'y,

135 F.3d 1260, 1269 (9th Cir. 1998).

2

3 Id., 2022 WL 17869218, at *14–15 (additional citations omitted). The same is true of the

4 communications at issue in the present case.

5 Salesforce does not meaningfully engage with this authority. Instead, it suggests that the

6 operative complaint can be read so as to suggest that Plaintiffs were “merely using publicly-

7 available customer support chats [and therefore] they had no objectively reasonable expectation

8 that their communications were ‘confidential’ under the facts alleged.” ECF No. 31 at 18.

9 Salesforce cites no authority for the proposition that communications with a health care provider

10 must occur with only certain of its agents or employees to be confidential, or that such

11 communications are not confidential if conducted with a customer support worker. The Court

12 therefore rejects Salesforce’s argument and concludes that Magpayo’s communications were

13 “confidential” within the meaning of Section 632.

14 b. Consent

15 Salesforce argues that Kaiser’s privacy policies “put [Magpayo] on prior notice, disclosing

16 that [Kaiser] (i) collect[s] Plaintiffs’ PHI and (ii) use[s] service providers that aid in this collection

17 and subsequent customer service functions,” such that Magpayo consented to Salesforce’s

18 monitoring and recording. ECF No. 23 at 29. Plaintiffs respond that Magpayo accessed the chat

19 function using a Kaiser web page that did not require Magpayo’s consent. ECF No. 28 at 31.

20 Salesforce then replies that Plaintiffs make inconsistent allegations about which web pages

21 Magpayo actually viewed, and that the only page that did not require a user’s consent before

22 chatting “applies only to federal employees, which Magpayo does not allege she is or was.” ECF

23 No. 31 at 20 (citing ECF No. 22 ¶ 19).

24 Salesforce’s arguments do not appear to be based on the operative complaint, which says

25 nothing regarding whether the web page(s) Magpayo visited apply only to federal employees, or

26 whether Magpayo is or was a federal employee. Nor need the Court resolve the parties’

27 disagreements about how to construe the allegations that Plaintiffs actually do make. Because

1 Magpayo used that portal, Salesforce has not established that Magpayo consented to the

2 monitoring and recording of her communications. Salesforce’s motion to dismiss Plaintiffs’

3 section 632 claim is therefore denied.

4 C. WESCA

5 WESCA “operates in conjunction with and as a supplement to the Federal Wiretap Act, 18

6 U.S.C. § 2150 et seq.” Popa v. Harriet Carter Gifts, Inc., 52 F.4th 121, 125–126 (3d Cir. 2022).

7 The statute “offers a private civil cause of action to ‘[a]ny person whose wire, electronic or

8 communication is intercepted, disclosed, or used’ . . . against ‘any person who intercepts,

9 discloses, or procures any other person to intercept, disclose or use, such communication.” Id. at

10 125 (quoting 18 Pa. Cons. Stat. § 5725(a)). WESCA defines “intercept” as “[a]ural or other

11 acquisition of the contents of any wire, electronic or oral communication through the use of any

12 electronic, mechanical, or other device.” 18 Pa. Const. Stat. § 5702. WESCA further defines

13 “electronic, mechanical or other device” as “[a]ny apparatus . . . that can be used to intercept a

14 wire, electronic or oral communication.” Id. That definition expressly excludes, in relevant part,

15 “[a]ny telephone or telegraph instrument, equipment, or facility, or any component thereof

16 furnished to the subscriber or user by a provider of wire or electronic communication service in

17 the ordinary course of its business.” Id.

18 Salesforce first argues that Yockey has failed to allege that Salesforce intercepted his chat

19 communications. The Third Circuit has written that “WESCA”s use of ‘intercept’ . . . reduces to

20 acquiring certain communications using a device. And based on just that definition, anyone could

21 ‘intercept’ communications, including people who ‘acquire’ a text message or chat sent to them.”

22 Popa, 52 F.4th at 126. Thus, even if the communications at issue were sent directly through the

23 Chat interface, Salesforce has nonetheless intercepted those communications within the meaning

24 of WESCA to the extent that Salesforce received and stored those communications on its servers.

25 Salesforce next argues that WESCA exempts Chat from its definition of “electronic,

26 mechanical or other device.” However, the definition exempts only instruments, equipment,

27 facilities, or components appropriately characterized as “telephon[ic] or telegraph[ic].” 18 Pa.

1 telephone is” insufficient to bring that device within this “telephone exception.” Commonwealth

2 v. Diego, 119 A.3d 370, 375 (Pa. Super. Ct. 2015). One court held, for example, that “telephone”

3 in Section 5702 did not include an iPad because such an interpretation would “radically expand

4 the definition of ‘telephone’ under [WESCA]” and run contrary to the requirement that WESCA’s

5 provisions are to be “strictly construed.” Id. (quoting Commonwealth v. Spangler, 809 A.2d 234,

6 237 (Pa. 2002)). Therefore, Chat does not qualify as a “telephone or telegraph” even though it

7 may be said to share features with such devices.

8 Third, Salesforce argues that Yockey’s allegations do not establish that his

9 communications were rerouted contemporaneously with transmission. WESCA does not impose a

10 rerouting requirement; rather, it requires that communications be intercepted. See 18 Pa. Cons.

11 Stat. § 5725(a). Salesforce’s argument relies on a case in which the Third Circuit wrote,

12 “Electronic communications are . . . ‘intercepted’ when software reroutes communications to an

13 interceptor.” Popa, 52 F.4th at 130. The Third Circuit did not articulate such rerouting as a

14 requirement of interception, but rather described the act of rerouting according to the facts of the

15 case for purposes of determining where an interception occurs geographically. And while

16 Salesforce is correct that an intercept must occur “contemporaneously with transmission” under

17 WESCA, see Fraser v. Nationwide Mut. Ins. Co., 352 F.3d 107, 113 & n.6 (3d Cir. 2003), Yockey

18 plausibly alleges that Salesforce, in real time, directly receives Chat communications, creates live

19 transcripts of those communications, and permits Rite Aid supervisors to view those transcripts.

20 ECF No. 22 ¶¶ 13, 14, 16, 20. Yockey also plausibly alleges that Salesforce begins to obtain the

21 contents of a user’s message before the user sends it via the Sneak Peek feature. Id. ¶ 23.

22 Salesforce protests that the complaint is devoid of allegations that Salesforce personnel read or

23 could read the messages before RiteAid, but Yockey alleges misconduct on the part of Salesforce

24 as the provider, not on the part of its personnel.

25 Fourth, Salesforce argues that two of WESCA’s exceptions to liability apply to

26 Salesforce’s conduct. The first exception provides that “[i]t shall not be unlawful . . . for:”

27 An officer, agent or employee of a provider of wire or electronic

communication in the normal course of his employment while

1 engaged in any activity which is a necessary incident to the rendition

of his service or to the protection of the rights or property of the

2 provider of wire or electronic communication service. However, no

provider of wire or electronic communication service shall utilize

3 service observing or random monitoring except for mechanical or

service quality control checks.

4

5 18 Pa. Const. Stat. § 5704(1). Salesforce argues that any interception is a “necessary incident to

6 its rendition of [its] service.”

7 There are two problems with this argument. First, it is not clear that “provider” as that

8 term is used in section 5704(1) refers to any entity other than Rite Aid, i.e., the only entity that is a

9 “provider” of services to the Plaintiff. Thus, Salesforce has not established that it is entitled to

10 invoke this protection. Next, the second sentence of the exception states that “no provider of wire

11 or electronic communication service shall utilize service observing or random monitoring except

12 for mechanical or service quality control checks.” 18 Pa. Const. Stat. § 5704(1). Whatever

13 Salesforce is doing, it goes well beyond “service observing or random monitoring . . . for

14 mechanical or service quality control checks.” See ECF No. 22 ¶¶ 21-23 (describing Salesforce’s

15 “Sneak Peek” feature, which enables an agent to view the contents of a customer’s message while

16 the customer types the message, i.e., before the customer sends the message to the agent. Id. ¶ 22–

17 23. For these reasons, the Court concludes that the exception set forth in section 5704(1) does not

18 apply.

19 The second exception provides that “[i]t shall not be unlawful . . . for . . . [a] person or

20 entity providing electronic communication service to the public to divulge the contents of any

21 such communication . . . with the lawful consent of the originator or intended recipient of the

22 communication.” 18 Pa. Const. Stat. § 5704(9). This provision “allows only one party [to]

23 consent to the recording and disclosure involved in computer communications, electronic mail and

24 voice mail.” Barash v. Penn. Public Utility Comm’n, 575 A.2d 79, 95 n.6 (1990) (Pellegrini, J.,

25 concurring in partt and dissenting in part), aff’d sub nom. Barash v. Bell Tel. Co. of Penn., 605

26 A.2d 1198 (Pa. 1992)). Salesforce does not directly provide Chat’s services to the public. Rather,

27 Salesforce provides Chat to companies that contract with it to use the service on their websites.

1 separation between Salesforce and the public that is absent typical from arrangements between

2 service providers and members of the public, such as that of an e-mail service to an e-mail user.

3 Cf. Diego, 119 A.3d at 376 (noting that “it is, at best, a dubious proposition that the authors of the

4 1978 [WESCA]” intended an exception to apply to technology “not invented until the late

5 1980’s”). And because the Pennsylvania Supreme Court has instructed that the WESCA’s

6 provisions are to be “strictly construed,” the Court cannot conclude, as a matter of law, that the

7 exception applies. Spangler, 809 A.2d at 23. Salesforce identifies no authority to the contrary,

8 and the Court is aware of none. Therefore, Yockey has stated a WESCA claim.

9 D. Consent

10 Salesforce argues that Yockey otherwise consented to Salesforce’s conduct. See 18 Pa.

11 Const. Stat. § 5704(1) (exempting from liability “[a] person . . . intercept[ing] a wire, electronic or

12 oral communication, where all parties to the communication have given prior consent to such

13 interpretation”). Salesforce points to Ride Aid’s privacy policy, which appears via a hyperlink

14 when using the “Chat With a Healthcare Professional” option. ECF No. 24-5 at 2.1 The privacy

15 policy discloses that Rite Aid “may share information about you with our service providers who

16 perform services on our behalf. In addition, we may also share your personal information . . . with

17 third parties who provide services that we offer through our Sites.” ECF no. 24-1 at 3. Yockey

18 argues that he used the “Chat With Customer Support” option, which did not feature the hyperlink.

19 Regardless of whether the hyperlink to the privacy policy appeared in the particular chat

20 window accessed by Yockey, the policy’s language does not encompass the conduct at issue.

21 “[P]ersonal information” is not synonymous with a word-for-word transcript of all

22 communications both as a matter of common sense and as defined by the policy. See ECF No. 24-

23

24

1 Because Yockey alleges that he did not consent to the communications at issue, the Court

considers the contents of the Rite Aid privacy policy under the incorporation by reference

25

doctrine. See Khoja v. Orexigen Therapeutics, Inc., 899 F.3d 988, 1002 (9th Cir. 2018).

Salesforce’s requests for judicial notice, ECF Nos. 24 & 32, are otherwise denied because the

26

Court need not rely on these materials to resolve the instant motion. The Court notes that judicial

notice and incorporation by reference are separate procedures that “permit district courts to

27

consider materials outside of a complaint . . . for different reasons and in different ways.” Id. at

1 1 at 2; Calhoun v. Google LLC, 526 F. Supp. 3d 605, 620 (N.D. Cal. 2021) (“Tn order for consent

2 || to be actual, the disclosures must ‘explicitly notify’ users of the practice at issue. (quoting in re

3 Google Inc., No. 13-MD-02430-LHK, 2013 WL 5423918, at *12 (N.D. Cal. Sept. 26, 2013))).

4 || And even if “personal information” encompassed a transcript of all communications, the policy

5 does not disclose that Salesforce, via the Sneak Peek feature, obtains those communications while

6 || users type them.

7 CONCLUSION

8 For the foregoing reasons, Salesforce’s motion is granted in part and denied in part.

9 || Dismissal of Magpayo’s CIPA Section 631 claim is with leave to amend because Salesforce has

10 || not shown that amendment would prejudice Salesforce, is sought in bad faith, would produce an

11 undue delay, or would be futile. See AmerisourceBergen Corp v. Dialyst West, Inc., 465 F.3d 946,

12 || 951 (9th Cir. 2006). Plaintiffs may file an amended complaint within twenty-one days of this

5 13 order solely to cure the deficiencies identified by this order. Failure to file a timely amended

14 || complaint will result in dismissal of Magpayo’s CIPA Section 631 claim with prejudice.

IT IS SO ORDERED.

16 Dated: August 25, 2023 .

& ‘

M | JON S. IS

18 United States District Judge

19

20

21

22

23

24

25

26

27

28