noting “a 27 culpable mind does not accompany every tortious act”
How later courts described this case
- noting “a 27 culpable mind does not accompany every tortious act”
- “No property interest is required.”
- finding third party, and not the plaintiffs, conferred the relevant benefit 16 where third party “bargained away” its rights to the benefit
Written by the judges who cited it.
The opinion
1
2
3
4
5
6
7 UNITED STATES DISTRICT COURT
8 NORTHERN DISTRICT OF CALIFORNIA
9
MICHAEL KATZ-LACABE, et al.,
10 Case No. 22-cv-04792-RS
Plaintiffs,
11
v. ORDER GRANTING IN PART AND
12 DENYING IN PART MOTION TO
ORACLE AMERICA, INC., DISMISS AND GRANTING IN PART
13 AND DENYING IN PART MOTION TO
Defendant. FILE UNDER SEAL
14
15
I. INTRODUCTION
16
On April 6, 2023, Defendant Oracle America, Inc.’s (“Oracle”) motion to dismiss
17
Plaintiffs’ initial complaint was granted in part and denied in part. See Order Granting in Part and
18
Denying in Part Defendant’s Motion to Dismiss (“4/6 Order”). Now, in their First Amended Class
19
Action Complaint (“FAC”), two individual Plaintiffs bring this putative class action against
20
Oracle, alleging the company violates internet users’ right to privacy as that right is enshrined
21
under the California Constitution and various state and federal privacy statutes. Defendant moves
22
to dismiss many of Plaintiffs’ claims under Federal Rules of Civil Procedure 12(b)(6) for failure to
23
state a claim or to comply with Federal Rule of Civil Procedure 8. Plaintiffs also filed a motion to
24
seal portions of the Offline Access Request Response Reports (OARRRs). For the reasons that
25
follow, both the motion to dismiss and motion to seal are granted in part and denied in part. These
26
motions are suitable for disposition without oral argument, and the motion hearing set for October
27
5, 2023, is vacated. See Civ. L.R. 7-1(b).
1 II. BACKGROUND1
2 Plaintiffs in this case are two named individuals—Michael Katz-Lacabe, a resident of San
3 Leandro, California, and Dr. Jennifer Golbeck, a resident of Sugarloaf Key, Florida—who purport
4 to represent six separate classes of individuals in a suit against Oracle. Despite taking precautions
5 to maintain privacy and prevent third-party collection of their data, Plaintiffs each received a
6 document from Oracle (an OARRR) indicating that Oracle had tracked, compiled, and analyzed
7 their web browsing and other activity, thereby creating an “electronic profile” of them. See Dkt. 54
8 at 2, 6. Further, Plaintiffs aver Oracle tracks their internet activity across numerous websites with
9 various technological tools, their location through partnership with the company PlaceIQ, and
10 their financial data, and then makes that information available to third parties without Plaintiffs’
11 consent.
12 Plaintiffs explain that Oracle collects data using a number of tools, including: (1) cookies
13 (pieces of software code stored on web browsers that collect users’ data, like IP addresses); (2) the
14 javascript code “bk-coretag.js” (proprietary code which copies and sends to Oracle what
15 information users are requesting from a website server, such as a URL, date and time of visit, and
16 webpage keywords); (3) tracking pixels (code embedded into webpages that track information
17 whenever the webpage is opened); (4) device identification; (5) cross-device tracking; (6) AddThis
18 widgets; and (7) Datalogix (an information broker specializing in profiles built from brick and
19 mortar purchases). As in their initial complaint, Plaintiffs take issue with Oracle’s extensive data
20 brokering business. In so doing, Plaintiffs focus on two key features of Defendant’s data
21 management platform (BlueKai Data Management Platform): (1) the Oracle Data Marketplace,
22 allegedly one of the world’s largest commercial data exchanges; and (2) the Oracle ID Graph.
23 Plaintiffs aver Defendant’s business model proceeds as follows: first, Oracle collects as many
24
25
1 The factual background of this case is based on the well-pled allegations in the First Amended
26 Class Action Complaint (“FAC”), which are taken as true for the purposes of this motion. This
background is presented in greater detail in the 4/6 Order given the substantial factual overlap
27 between the original complaint and the FAC.
1 types of personal information from internet users as possible. Then, Oracle synchronizes that data
2 to create individual profiles, analyzes the data, and monetizes the data by selling it on its Data
3 Marketplace. Plaintiffs argue that neither Oracle’s privacy policies, nor the privacy policies of
4 third-party publishers, provide a basis to conclude that Plaintiffs consented to this data collection,
5 curation, and monetization.
6 In the 4/6 Order, Plaintiffs’ Unfair Competition Law (UCL), Federal Wiretap Act, unjust
7 enrichment, and intrusion upon seclusion (on behalf of national and international sub-classes)
8 claims were dismissed, while Plaintiffs’ invasion of privacy, intrusion upon seclusion (for the
9 California sub-class), California Invasion of Privacy Act (CIPA), and declaratory judgment and
10 equitable relief claims survived. Plaintiffs filed their FAC on May 22, 2023, bringing some new
11 claims, dropping their UCL claim, and adding factual averments in support of other claims. Oracle
12 moved to dismiss most, but not all, of Plaintiffs’ claims. Additionally, Plaintiffs filed a motion to
13 seal portions of the OARRRs on September 19, 2023, which Defendant opposes.
14 III. MOTION TO DISMISS
15 A. Legal Standard
16 A complaint must contain “a short and plain statement of the claim showing that the
17 pleader is entitled to relief.” Fed. R. Civ. P. 8(a)(2). While “detailed factual allegations” are not
18 required, a complaint must have sufficient factual allegations to state a claim that is “plausible on
19 its face.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (citing Bell Atl. Corp. v. Twombly, 550 U.S.
20 544, 555, 570 (2007)). A claim is facially plausible “when the plaintiff pleads factual content that
21 allows the court to draw the reasonable inference that the defendant is liable for the misconduct
22 alleged.” Id. (citing Twombly, 550 U.S. at 556). This standard asks for “more than a sheer
23 possibility that a defendant has acted unlawfully.” Id. The determination is a context-specific task
24 requiring the court “to draw on its judicial experience and common sense.” Id. at 679.
25 A Rule 12(b)(6) motion to dismiss tests the sufficiency of the claims alleged in the
26 complaint. Dismissal under Rule 12(b)(6) may be based on either the “lack of a cognizable legal
27 theory” or on “the absence of sufficient facts alleged under a cognizable legal theory.” See
1 Conservation Force v. Salazar, 646 F.3d 1240, 1242 (9th Cir. 2011) (internal quotation marks and
2 citation omitted). When evaluating such a motion, the court must accept all material allegations in
3 the complaint as true and construe them in the light most favorable to the non-moving party. In re
4 Quality Sys., Inc. Sec. Litig., 865 F.3d 1130, 1140 (9th Cir. 2017). It must also “draw all
5 reasonable inferences in favor of the nonmoving party.” Usher v. City of Los Angeles, 828 F.2d
6 556, 561 (9th Cir. 1987).
7 B. Discussion
8 Plaintiffs claim to represent six different potential classes of plaintiffs: the United States
9 Class,2 the California Sub-Class,3 the California Invasion of Privacy Act (CIPA) Sub-Class,4 the
10 Florida Sub-Class,5 the Florida Security of Communications Act (FSCA) Sub-Class,6 and the
11 Electronic Communications Privacy Act (ECPA) Sub-Class.7
12 On behalf of these classes, the FAC alleges nine causes of action: (1) Invasion of Privacy
13 under the California Constitution (for the California Sub-Class); (2) Intrusion Upon Seclusion
14 under California Common Law (on behalf of the United States Class, or in the alternative, the
15 California Sub-Class); (3) Intrusion Upon Seclusion under Florida Common Law (in the
16
17
2 “All natural persons located in the United States whose personal information, or data derived
18 from their personal information, was used to create a profile and made available for sale or use
through Oracle’s ID Graph or Data Marketplace.”
19
3 “All natural persons located in California whose personal information, or data derived from their
20 personal information, was used to create a profile and made available for sale or use through
Oracle’s ID Graph or Data Marketplace.”
21
4 “All members of the California Sub-Class whose contents of their electronic communications
22 were intercepted by the use of Oracle’s bk-coretag.js functionality.”
23 5 “All natural persons located in Florida whose personal information, or data derived from their
personal information, was used to create a profile and made available for sale or use through
24 Oracle’s ID Graph or Data Marketplace.”
25 6 “All members of the Florida Sub-Class whose contents of their electronic communications were
intercepted by the use of Oracle’s bk-coretag.js functionality.”
26
7 “All members of the United States Sub-Class whose contents of their electronic communications
27 were intercepted by the use of Oracle’s bk-coretag.js functionality.”
1 alternative, for the Florida Sub-Class); (4) Violation of the California Invasion of Privacy Act (on
2 behalf of the CIPA Sub-Class); (5) Violation of the FSCA, under Fla. Stat. § 934.03 (for the FSCA
3 Sub-Class); (6) Violation of the Federal Wiretap Act, under 18 U.S.C. § 2510 (for the ECPA Sub-
4 Class); (7) Unjust Enrichment, under California Common Law (on behalf of the United States
5 Class, or in the alternative, the California Sub-Class); (8) Unjust Enrichment, under Florida
6 Common Law (in the alternative, for the Florida Sub-Class); and (9) Declaratory Judgment and
7 Injunctive Relief (on behalf of all classes).
8 Defendant moves to dismiss all claims—with the exception of Plaintiffs’ first and second
9 claims, to the extent the second claim is brought against the California Sub-Class—under Rule
10 12(b)(6).
11 1. Second Cause of Action: Intrusion Upon Seclusion
12 First, Oracle moves to dismiss Plaintiffs’ second cause of action to the extent Plaintiffs
13 attempt to assert a California state claim on behalf of a non-California resident (Golbeck) and a
14 class inclusive of non-California residents (the United States Class). The prior order found that
15 Plaintiffs failed to show why California law should be applied nationwide for its intrusion upon
16 seclusion claim. See 4/6 Order. Plaintiffs contend they have augmented that claim with averments
17 which justify applying California law to the nationwide class and that, to the extent Oracle
18 disputes those allegations, Oracle merely raises a factual dispute inappropriate for resolution at the
19 motion to dismiss stage.
20 Plaintiffs argue the “last acts” necessary to make Oracle liable on an intrusion upon
21 seclusion claim occurred in California because it was in California that Oracle compiled, analyzed,
22 and sold their data. Dkt. 67, at 19–20. Defendant persuasively points out, however, that Plaintiffs’
23 own allegations identify the last act necessary for liability to attach to be Oracle’s interception of
24 Plaintiffs’ data. See Dkt. 70, at 2; FAC ¶ 145. Plaintiffs’ theory of liability for intrusion upon
25 seclusion would make Oracle liable when it intercepted Plaintiffs’ data, and Plaintiffs do not offer
26 any reason to doubt that this interception of data, for non-California residents, occurs in those
27 residents’ home States. See Mazza v. Am. Honda Motor Co., 666 F.3d 581, 593 (9th Cir. 2012)
1 (“California considers the ‘place of the wrong’ to be the state where the last event necessary to
2 make the actor liable occurred.”), overruled on other grounds by Olean Wholesale Grocery Coop.
3 v. Bumble Bee Foods LLC, 31 F.4th 651 (9th Cir. 2022). Since the last act at which liability
4 attaches—here, interception of Plaintiff Golbeck’s data—occurred in Florida, this factor weighs
5 against applying California law nationwide. See, e.g., Hayden v. Retail Equation, Inc., No. 20-cv-
6 1203, 2022 WL 18397355, at *5 (C.D. Cal. Nov. 28, 2022) (finding California law inapplicable to
7 privacy claims where “collection and transmission” of data occurred outside California).
8 Plaintiffs’ amended averments in their FAC do not warrant a different conclusion than the
9 one reached in this Court’s 4/6 Order: namely, that California law does not apply nationwide for
10 Plaintiffs’ intrusion upon seclusion claim. Therefore, Plaintiffs’ intrusion upon seclusion claim—
11 to the extent it is brought on behalf of the United States Class under California law, as opposed to
12 solely on behalf of the California Sub-Class—is dismissed without leave to amend.
13 2. Third Cause of Action: Intrusion Upon Seclusion (Florida Common Law)
14 Plaintiffs, in the alternative, bring a claim for intrusion upon seclusion under Florida law
15 on behalf of the Florida-Class. To state a claim for intrusion upon seclusion under Florida law, a
16 plaintiff must show an intrusion onto a private place that would be highly offensive to a
17 reasonable person. Hammer v. Sorensen, 824 F. App’x 689, 695 (11th Cir. 2020). Intrusions can
be either physical or electronic. See Spilfogel v. Fox Broadcasting Co., 724, 726 (11th Cir. 2011).
18
The requirement in Florida that a plaintiff must “show an intrusion into a private place and not
19
merely a private activity” goes beyond the Restatement (Second) of Torts, which has no such
20
“private place” requirement. Id. (citing Allstate Ins. Co. v. Ginsberg, 863 So. 2d 156, 161 n.3, 162
21
(Fla. 2003)).
22
As a general matter, courts have declined to extend Florida’s protections against the
23
invasion of privacy tort (of which intrusion upon seclusion is a subtype) to instances in which a
24
party accesses digital files. See Celestine v. Capital One, No. 17-cv-20237, 2017 WL 2838185, at
25
*3 (S.D. Fla. June 30, 2017) (accessing a credit report does not constitute intrusion into a “place”);
26
Bradley v. City of St. Cloud, No. 12-cv-1348, 2013 WL 3270403, at *5 (M.D. Fla. June 26, 2013)
27
1 (similar, for medical records). In the FAC, Plaintiff Golbeck avers Oracle’s data collection
2 constitutes an intrusion into her home and her computer. FAC ¶ 163. Additionally, Plaintiffs cite
3 Hammer for the proposition that “private quarters” can include “electronic space.” Dkt. 67, at 22.
4 Defendant responds that Hammer’s reference to a potentially private email address is not
analogous to “open conduct on the web.” Dkt. 70, at 5 n.11. Defendant argues non-private internet
5
activity does not occur in a “private place,” id., and Plaintiff Golbeck seems to acknowledge the
6
lack of cases finding collection of browsing data constitutes an intrusion into a private quarter,
7
Dkt. 67, at 23 (“No Florida case addresses any fact pattern that comes close to resembling the one
8
at bar.”). See, e.g., Rebalko v. City of Coral Springs, 552 F. Supp. 3d 1285, 1333 (S.D. Fla. 2020)
9
(noting Florida courts have said “precious little” about what places, beyond a home, constitute a
10
private quarter).
11
Oracle has the better of this dispute. Accepting that an electronic space may constitute a
12
“private quarter,” see Spilfogel v. Fox Broadcasting Co., No. 9-cv-80813, 2010 WL 11504189, at
13
*5 (S.D. Fla. May 4, 2010), Plaintiffs do not plausibly point to any particular “electronic space”
14
where Plaintiff Golbeck had a reasonable expectation of privacy into which Oracle intruded. Nor
15
do Plaintiffs plausibly aver Oracle intruded into Plaintiff Golbeck’s home. Thus, Plaintiffs have
16
not alleged sufficient facts to state a claim for intrusion upon seclusion under Florida law because
17
they have not alleged an intrusion into a “private place” or “private quarter.” For this reason,
18
Plaintiffs’ intrusion upon seclusion claim brought under Florida law must be dismissed with leave
19
to amend.
20
3. Fourth, Fifth, and Sixth Causes of Action: CIPA (California), FSCA (Florida),
21
and ECPA (Federal Wiretap Act)
22
i. CIPA
23
Defendant argues Plaintiffs’ CIPA claim should be dismissed (1) because Plaintiffs do not
24
sufficiently allege Defendant had the requisite intent to violate CIPA or, in the alternative, (2) to
25
the extent the claim is premised on collection of the seven types of information this Court
26
27
1 previously determined do not qualify as “contents.”8
2 First, Oracle points to California Penal Code § 631(a)’s requirement that contents subject
3 to CIPA be read (or attempted to be read) “willfully and without the consent of all parties to the
4 communication” and argues Plaintiffs have not pled sufficient facts Oracle had the requisite intent
5 here. Dkt. 63, at 16. Recording a confidential communication is intentional where the recording
6 entity has the “purpose or desire” of recording the communication or the “knowledge to a
7 substantial certainty” the communication will be recorded. People v. Sup. Ct. (Smith), 449 P.2d
8 230, 238 (Cal. 1969). Defendant cites Lozano v. City of Los Angeles, 73 Cal. App. 5th 711, 727–
9 28 (Cal. Ct. App. 2022), as support for its position that the recording tool at issue here (the bk-
10 coretag.js) would not necessarily record the content of communications as opposed to record
11 information. Dkt. 63, at 17. Oracle further contends the causal chain of intention is broken by the
12 fact that its customers “choose what portion of the collected data they wish to share with Oracle”
13 and to obtain consent to collect the information from users. See id. at 17–18.9
14 Plaintiffs, however, have sufficiently alleged Oracle had “knowledge to a substantial
15 certainty” that deployment of the bk-coretag.js would record confidential communications. See,
16 e.g., Lopez v. Apple, Inc., 519 F. Supp. 3d 672, 690 (N.D. Cal. 2021) (finding intent requirement
17 satisfied given Apple’s knowledge “accidental Siri triggers” would, with substantial certainty,
18 “occur in confidential contexts”). Plaintiffs aver Oracle’s products—such as the bk-coretag.js—are
19 implemented by websites and collect vast quantities of personal information that eventually makes
20 its way back to Oracle. See, e.g., FAC ¶¶ 44–46. Plaintiffs further claim this data collection occurs
21 despite Oracle’s knowledge that many users do not consent to it. See, e.g., id. ¶¶ 59, 107–108.
22 Such averments, like those in Lopez, are sufficient at this stage to satisfy the intent requirement.
23
24
8 Those categories are webpage titles, webpage keywords, the date and times of website visits, IP
25 addresses, page visits, purchase intent signals, and add-to-cart actions. These categories of data are
not “content” regardless of whether Plaintiffs actually conceded the issue. See, e.g., Dkt. 67, at 5.
26
9 This “chain of causation” argument echoes the Article III standing arguments Oracle made in its
27 previous motion to dismiss.
1 Second, solely to the extent Plaintiffs’ CIPA claim avers referrer URLs and data entered into
2 forms are “content,” Plaintiffs have met their burden (as they did on Defendant’s first motion to
3 dismiss) to plead sufficient facts to withstand dismissal. Therefore, Plaintiffs’ CIPA claim
4 survives.
5 ii. FSCA
6 Oracle moves to dismiss Plaintiffs’ FSCA claim for failure to state a claim on two primary
7 grounds: (1) information obtained by the bk-coretag.js is not “electronic communication” as
8 defined by the statute and (2) Plaintiffs lack a reasonable expectation of privacy in the
9 information. Dkt. 63, at 18–21. Neither argument persuades.
10 The histories of the FSCA and the Federal Wiretap Act are instructive regarding what
11 constitutes electronic communication. As Oracle acknowledges, the Florida Legislature amended
12 the FSCA (extending the statute to cover “electronic communication”) in tandem with Congress’s
13 similar modification of the Federal Wiretap Act. See Dkt. 63, at 20; see also State v. Jackson, 650
14 So.2d 24, 27 (Fla. 1995) (similar). The Federal Wiretap Act and FSCA appear to define
15 “electronic communication” identically. Compare 18 U.S.C. § 2510(12) with Fla. Stat.
16 § 934.02(12). While Defendant is correct that both statutes exclude any device which “permits the
17 tracking of the movement of a person or an object,” see, e.g., Fla. Stat. § 934.02(12)(c), the cases
18 Defendant cites relate primarily to the use of session replay software. See, e.g., Jacome v. Spirit
19 Airlines Inc., No. 2021-947, 2021 WL 3087860, at *3 (Fla. Cir. Ct. June 17, 2021). Plaintiffs
20 respond that the bk-coretag.js is script not analogous to such software, see Dkt. 67, at 21, a
21 contention Oracle disputes on the grounds the two tools capture the same types of information, see
22 Dkt. 70, at 10.
23 Plaintiffs have the better of this disagreement. Fla. Stat. § 934.02(12)(c) specifically
24 excludes from its definition of electronic communications any communications from a “device
25 which permits the tracking of the movement of a person or an object” (emphasis added). Oracle
26 does not claim the bk-coretag.js literally tracks “movement” within the meaning of the statute.
27 Second, Oracle’s argument that what matters is whether the bk-coretag.js captures the “same
1 information” as session replay software goes too far. The First Circuit, for instance, has already
2 interpreted the Federal Wiretap Act’s definition of electronic communication to include
3 “[t]ransmissions of completed online forms.” In re Pharmatrak, Inc., 329 F.3d 9, 18 (1st Cir.
4 2003). In so doing, it noted the Act “adopts a ‘broad, functional’ definition of an electronic
5 communication.” Id. (quoting Brown v. Waddell, 50 F.3d 285, 289 (4th Cir. 1995)). This
6 definition of “electronic communication” is sufficiently broad to encompass referrer URLs.
7 Therefore, to the extent the FSCA tracks the Federal Wiretap Act, at least some of the
8 transmissions the bk-coretag.js allegedly captured—transmissions containing “data entered by the
9 user into forms” on various websites, FAC ¶¶ 183, and referrer URLs—constitute electronic
10 communications under the FSCA.
11 Second, assuming (without deciding) Defendant is correct Plaintiffs must have a
12 reasonable expectation of privacy in electronic communications under the FSCA,10 Plaintiffs have
13 met this burden. One of Plaintiffs’ central contentions is that users do not actually consent to either
14 Defendant’s or third-party websites’ collection of information about their internet browsing and
15 that they had a corresponding privacy interest in that information. Plaintiffs have sufficiently pled
16 a reasonable expectation of privacy in at least some of the information they aver Defendant
17 compiled through an extensive data collection and profiling scheme. Thus, Plaintiffs’ FSCA claim
18 survives.
19 iii. ECPA
20 Plaintiffs add averments to their FAC, see FAC ¶¶ 226–230, in a renewed attempt to
21
22
10 Plaintiffs persuasively argue the FSCA does not require a reasonable expectation of privacy in
23 electronic communications. In Brevard Extraditions, Inc. v. Fleetmatics, USA, LLC, the court
noted the different definitions of “wire communication” and “oral communication” in the FSCA,
24 the explicit reference to privacy expectations in the statute’s definition of the latter, see Fla. Stat.
§ 934.02(2), and the fact that wire communications are “generally protected regardless of whether
25 the person making or receiving the communication has an expectation of privacy.” No. 12-cv-
2079, 2013 WL 5437117, at *4 (M.D. Fla. Sept. 27, 2013) (citing PBA Local No. 38 v.
26 Woodbridge Police Dep’t, 832 F. Supp. 808 (D.N.J. 1993)). Section 934.02(12) of the FSCA,
which defines “electronic communication”—like the definition of “wire communication” and
27 unlike the definition of “oral communication”—contains no reference to expectations of privacy.
1 demonstrate “the primary motivation or a determining factor in [Oracle’s] actions” in the context
2 of intercepting communications “has been to injure plaintiffs tortiously.” See Rodriguez v. Google
3 LLC, No. 20-cv-04688-RS, 2021 WL 2026726, at *6 n.8 (N.D. Cal. May 21, 2021) (declining to
4 apply crime-fraud exception where company did not intend to injure plaintiffs tortiously) (citing In
5 re Google Inc. Gmail Litig., No. 13-md-02430, 2014 WL 1102660, at *18 n.13 (N.D. Cal. Mar.
6 18, 2014)). As support for their claim, Plaintiffs (1) cite Oracle CEO Larry Ellison’s comments
7 about how the company’s data-collection abilities were “scaring the lawyers” and (2) argue the
8 goal of “making money” cannot sanitize tortious conduct. FAC ¶¶ 227-28. Without more,
9 Plaintiffs have not alleged sufficient facts that Oracle intercepted data with the primary motivation
10 or purpose of committing torts on internet users.11
11 Plaintiffs cite Brown v. Google, LLC, 525 F. Supp. 3d 1049, 1067 (N.D. Cal. 2021)—a
12 case where the crime-fraud exception was found to apply—and argue this case is analogous.
13 Defendant effectively distinguishes this case and Brown; for instance, Defendant points out how
14 the plaintiffs in Brown had identified internal Google communications referring to the company’s
15 privacy practices as problematic. Dkt. 70, at 11; Brown, 525 F. Supp. 3d at 1079; see also In re
16 Google Inc. Gmail Litig., 2014 WL 1102660, at *18 n.13 (finding failure to show necessary
17 wrongful intent). Plaintiffs have not pled sufficient facts here to show Oracle had tortious
18 motivation. Thus, for the reasons discussed in this Court’s prior order dismissing Plaintiffs’ ECPA
19 claim in light of Defendant’s consent defense, Plaintiffs’ ECPA claim must be dismissed. See 4/6
20 Order, at 16.
21 4. Seventh & Eighth Causes of Action: Unjust Enrichment
22 i. Unjust enrichment under California law
23 Plaintiffs’ FAC successfully pleads an unjust enrichment cause of action under California
24
25
11 The mere possibility Oracle’s data collection activities could at some future date be deemed
26 tortious does not justify application of the crime-fraud exception in these circumstances. See, e.g.,
In re DoubleClick Inc. Privacy Litig., 154 F. Supp. 2d 497, 518–19 (S.D.N.Y. 2001) (noting “a
27 culpable mind does not accompany every tortious act”).
1 law. In order “[t]o allege unjust enrichment as an independent cause of action, a plaintiff must
2 show that the defendant received and unjustly retained a benefit at the plaintiff’s expense.” ESG
3 Cap. Partners, LP v. Stratos, 828 F.3d 1023, 1038 (9th Cir. 2016). The benefit Plaintiffs claim
4 Oracle received and retained here is information—both from third-party websites and
5 independently collected—about Plaintiffs’ online and real-world lives.
6 Plaintiffs now aver they “were not aware of Oracle’s conduct while browsing websites”
7 (ostensibly websites incorporating the bk-coretag.js or other Oracle technology), and “would not
8 have visited those websites” or, in the alternative, would have taken steps while visiting the
9 websites “to avoid being tracked and profiled by Oracle.”12 FAC ¶ 249(a). Oracle’s collection of
10 data from third-party websites, Plaintiffs argue, conferred a benefit upon Oracle at the expense of
11 the privacy of their data. Id. ¶ 248–249. Plaintiffs also allege Defendant has collected their real-
12 world location information, and then compiled and sold that information, without their consent. Id.
13 ¶ 249(b)-(c). With their added averments, Plaintiffs have done just enough for their unjust
14 enrichment cause of action under California law to survive.
15 ii. Choice of law
16 Defendant argues Plaintiffs cannot assert an unjust enrichment claim under California state
17 law on behalf of non-California residents—on behalf of either a named plaintiff, Golbeck (a
18 Florida resident), or classes inclusive of non-residents, such as the United States class—and seeks
19 dismissal of Plaintiffs’ claims to that extent.
20 As before, both parties agree “[a] federal court sitting in diversity must look to the forum
21 state's choice of law rules,” thus requiring the court to apply California’s “governmental interest
22 approach” to determine questions of choice of law. Zinser v. Accufix Rsch. Inst., Inc., 253 F.3d
23 1180, 1187 (9th Cir. 2001). This is a three-step process. The first task is to determine whether the
24
25 12 Plaintiffs also cite Brooks v. Thomson Reuters Corp. as persuasive authority for allowing an
unjust enrichment claim to proceed in the context of a data broker’s alleged violation of privacy
26 rights. No. 21-cv-1418, 2021 WL 3621837, at *11–12 (N.D. Cal. Aug. 16, 2021). There, however,
the court merely rejected defendant’s argument regarding whether unjust enrichment can be
27 asserted as a standalone cause of action. Id. at *11.
1 laws of the affected jurisdictions are “the same or different.” Mazza, 666 F.3d at 590 (quoting
2 McCann v. Foster Wheeler LLC, 48 Cal. 4th 68, 81-82 (2010)). If the laws are different, the
3 second step requires an examination of “each jurisdiction’s interest in the application of its own
4 law” to determine whether a true conflict exists. Id. If it does, then the final step involves
5 analyzing “which state’s interest would be more impaired if its policy were subordinated to the
6 policy of the other state.” Id.
7 First, Oracle persuasively contends California and Florida have significantly different
8 standards for unjust enrichment claims on the grounds that Florida—but not California—requires
9 (1) the recipient of a benefit to have “knowledge” of and to “accept” the benefit and (2) that the
10 benefit be directly conferred on the defendant. See Dkt. 63, at 7; see also Kopel v. Kopel, 229
11 So.3d 812, 818 (Fla. 2017) (“the plaintiff must directly confer a benefit to the defendant”). It is
12 possible an unjust enrichment claim could succeed in California but fail in Florida on the grounds
13 the conferred benefit was insufficiently direct. See Gustafson v. BAC Home Loans Servicing, LP,
14 294 F.R.D. 529, 548 (C.D. Cal. 2013); see also Virgilio v. Ryland Group, Inc., 680 F.3d 1329,
15 1337 (11th Cir. 2012) (finding third party, and not the plaintiffs, conferred the relevant benefit
16 where third party “bargained away” its rights to the benefit). As Oracle notes, the Ninth Circuit
17 has held the “elements necessary to establish a claim for unjust enrichment also vary materially
18 from state to state.” Mazza v. Am. Honda Motor Co., 666 F.3d 581, 591 (9th Cir. 2012). Though
19 Plaintiffs represent they will offer the same proof under either California’s or Florida’s test, this
20 does not alter the fact that the two States have materially different standards.
21 Next, a true conflict exists. Florida has a strong interest in determining how to balance
22 protecting consumers and attracting business. See, e.g., Mazza, 66 F.3d at 591–93. Florida
23 indisputably has an interest in applying its own consumer protection laws to its own residents.
24 Third, California’s interest in applying its unjust enrichment law to non-California residents is
25 attenuated. See In re Toyota RAV4 Hybrid Fuel Tank Litig., 534 F. Supp. 3d 1067, 1122 (N.D.
26 Cal. 2021) (applying Mazza). As in Mazza and In re Toyota, the States in which relevant
27 transactions occur have the stronger interest in policing those transactions. For these reasons,
1 Plaintiffs’ unjust enrichment claim under California law on behalf of the United States Class
2 cannot stand. Plaintiffs’ unjust enrichment claim under California law on behalf of the United
3 States Class is dismissed with leave to amend.
4 iii. Florida law (eighth cause of action)
5 Given the survival of Plaintiffs’ unjust enrichment claim under California law and the fact
6 California law cannot be applied to the United States Class, it is necessary to assess Plaintiffs’
7 unjust enrichment cause of action pled, in the alternative, under Florida law. Plaintiffs bring this
8 cause of action on behalf of the Florida Sub-Class. To state a claim for unjust enrichment in
9 Florida, a plaintiff must show the plaintiff directly conferred a benefit on the defendant. Kopel,
10 229 So.3d at 818. Further, the plaintiff must show the defendant voluntarily accepted and retained
11 the benefit and that it would be inequitable for the defendant to retain the benefit without
12 compensating the plaintiff. Peoples Nat. Bank of Commerce v. First Union Nat. Bank of Fla., 667
13 So.2d 876, 879 (Fla. Dist. Ct. App. 1996).
14 Oracle first contends Plaintiffs received the benefit of their bargain because they were able
15 to access third-party websites despite the collection of their data. Plaintiffs, as they did for their
16 unjust enrichment claim under California law, have added sufficient averments to the FAC to
17 explain why the access they gained to third-party websites does not defeat their claim. Oracle also
18 posits that Plaintiffs have failed to show any direct conferral of a benefit because Oracle’s
19 customers are “necessary intermediaries between Golbeck and Oracle.” Dkt. 63, at 24–25.
20 Plaintiffs correctly point out that the mere existence of an intermediary through which a benefit
21 travels does not doom an unjust enrichment claim under Florida law. Dkt. 67, at 24; see, e.g.,
22 Weinberg v. Advanced Data Processing, Inc., 147 F. Supp. 3d 1359, 1368 (S.D. Fla. 2015). In its
23 reply papers, Oracle contends there was no direct conferral of a benefit because its third-party
24 customers merely transmit data to Oracle which Oracle then must process into interest segments
25 and sell to advertisers. Dkt. 70, at 14.
26 One complication at this stage is that Plaintiffs refer both to the “personal and sensitive
27 data” Oracle receives, FAC ¶ 251, as well as Oracle’s revenue from selling such data, id. ¶ 249, in
1 explaining how Oracle was unjustly enriched. Oracle, though, does not seem to contest that “data”
2 transferred from one party to another can constitute a benefit.13 It comes closest to doing so in its
3 reply papers when it insinuates the benefit must have been revenue earned from data rather than
4 data itself. Dkt. 70, at 14. Even had this issue been squarely addressed by the parties, Florida
5 courts evaluating unjust enrichment claims have found a benefit need not be a clearly defined
6 property interest. See Cohen v. Kravit Estate Buyers, Inc., 843 So.2d 989, 992 (Fla. Dist. Ct. App.
7 2003) (“No property interest is required.”); F.H. Paschen, S.N. Nielsen & Assocs. LLC v. B&B Site
8 Dev., Inc., 311 So.3d 39, 50 (Fla. Dist. Ct. App. 2021) (asphalt removal and replacement
9 constitutes benefit).
10 Given that personal data would appear to qualify as a benefit under Florida law, Plaintiffs
11 have a persuasive argument that the presence of intermediaries—here, third-party websites—poses
12 no obstacle to the requirement a benefit be directly conferred. Plaintiffs have averred sufficient
13 facts at this stage that they conferred a direct benefit on Oracle,14 and, thus, their unjust
14 enrichment claim under Florida law survives.
15 5. Ninth Cause of Action: Declaratory and Injunctive Relief
16 Finally, Defendant seeks to dismiss Plaintiffs’ cause of action for declaratory judgment and
17 injunctive relief. This cause of action rises and falls with Plaintiffs’ other claims: if Plaintiffs fail
18 to allege facts sufficient to state a claim under any other cause of action, the claim for declaratory
19 judgment and injunctive relief will be dismissed. Since not all of Plaintiffs’ claims have been
20 dismissed, this cause of action moves forward at this stage.
21
22
23
24 13 At least one court has struggled with what constitutes a “benefit”—where the claimed benefit is
not money—in an unjust enrichment claim brought under Florida law in the context of eventually-
25 monetized data. See Muy v. Int’l Bus. Mach. Corp., No. 19-cv-14, 2019 WL 8161745, at *1 (N.D.
Fla. July 19, 2019).
26
14 It is conceivable further factual development might reveal, for instance, that raw personal data
27 lacks any commercial value before it is “transform[ed].” See Dkt. 70, at 14 n.26.
1 IV. MOTION TO SEAL
2 Plaintiffs also have a pending administrative motion to seal the OARRRs. See Dkt. 75.
3 There is a strong presumption in favor of allowing public access when deciding whether materials
4 should be sealed. See Apple Inc. v. Psystar Corp., 658 F.3d 1150, 1162 (9th Cir. 2011). A request
5 to seal must be narrowly tailored. Civ. L.R. 79-5(c)(3). To overcome the presumption in favor of
public access to a judicial record, there generally must be “compelling reasons supported by
6
specific factual findings.” Kamakana v. City & Cty. of Honolulu, 447 F.3d 1172, 1178 (9th Cir.
7
2006) (“The mere fact that the production of records may lead to a litigant's embarrassment,
8
incrimination, or exposure to further litigation will not, without more, compel the court to seal its
9
records.”). Where a litigant presents compelling reasons to seal material, the court must then
10
balance the interests of the public and the party seeking sealing. Ctr. for Auto Safety v. Chrysler
11
Grp., LLC, 809 F.3d 1092, 1096–97 (9th Cir. 2016). This balancing test involves such factors as
12
the public’s interest in understanding the functioning of the judicial process and the volume of
13
material sought to be sealed. See Zakinov v. Ripple Labs, Inc., No. 18-cv-6753, 2023 WL
14
5280193, at *1 (N.D. Cal. Aug. 15, 2023).
15
Plaintiffs have offered two sets of potential redactions15 to the OARRRs in response to the
16
direction for more narrowly tailored sealing requests. They argue redactions are necessary to
17
protect Plaintiffs’ privacy because the OARRRs reveal many details about Plaintiffs’ private lives.
18
See, e.g., Dkt. 75, at 5 (listing the types of information the OARRRs reveal). Plaintiffs explain the
19
OARRRs implicate privacy interests in part through the unique “totality of the segments
20
categories attributed” to an individual. Id. at 3. In other words, Plaintiffs argue the OARRRs need
21
to be considered both at a micro- (e.g., values for specific categories) and macro-level. Though
22
Defendants did not previously oppose Plaintiffs’ motion to seal, they now argue the information
23
Plaintiffs seek to seal is insufficiently sensitive and that Plaintiffs do not explain how its
24
25
26 15 Exhibits A and B to the Maher Declaration contain more extensive redactions as compared to
Exhibits E and F. Plaintiffs offer the second set of more tailored redactions in case the first set is
27 deemed overly broad. See Dkt. 75, at 1.
1 publication could lead to harm. See Dkt. 76, at 2–5. Defendants appear to contest the idea that any
2 of the contested information in the OARRRs is sealable.
3 On one hand, Plaintiffs’ argument about the privacy interests implicated by the “totality”
4 of attributed segments categories goes too far in that it—if taken to its logical conclusion—would
5 seem to require sealing the OARRRs in their entirety (encompassing terms like “Ad Occurrence”).
6 On the other hand, Plaintiffs’ larger point that the release of a detailed dossier of information
7 about an individual that, by virtue of its comprehensiveness, implicates privacy concerns is
8 compelling. It would be perverse to hold an individual entitled to no protection where a company
9 amalgamates many pieces of information about that individual’s preferences on the grounds that
10 revealing any one preference is no big deal. Plaintiffs clearly have a privacy interest in their “likes,
11 dislikes, interests, and habits over a significant amount of time.” In re Facebook, Inc. Internet
12 Tracking Litig., 956 F.3d 589, 599 (9th Cir. 2020). Many pieces of information in the OARRRs
13 indicate more than simple likes or dislikes and instead communicate intimate details of Plaintiffs’
14 daily lives.
15 For the foregoing reasons, Plaintiffs’ proposed redactions to Exhibits E and F to the Maher
16 Declaration are sufficiently tailored, and Plaintiffs’ motion to seal the OARRRs will be granted to
17 reflect those redactions. Plaintiffs’ privacy interest in the redacted portions of the OARRRs
18 outweighs the public’s interest in fully-disclosed documents in this instance. This is so in part
19 given that the OARRRs, even with redactions, still communicate to the public the types of
20 information that are at issue in this action. Of course, reasonable minds might disagree on
21 distinguishing between which entries in the “Segment Category” column merit sealing and which
22 do not, but Plaintiffs have, at this stage, met their burden to propose a narrowly tailored set of
23 redactions.
24 V. CONCLUSION
25 In light of the above, Plaintiffs’ intrusion upon seclusion claim on behalf of the Florida
26 Sub-Class under Florida law is dismissed with leave to amend. To the extent Plaintiffs bring an
27 intrusion upon seclusion claim under California law on behalf of the United States Class, that
1 claim is dismissed without leave to amend. To the extent Plaintiffs bring an unjust enrichment
2 claim under California law on behalf of the United States Class, that claim is dismissed with leave
3 to amend. Additionally, Plaintiffs’ ECPA claim is dismissed with leave to amend. Plaintiffs’
4 || remaining claims—intrusion upon seclusion under California law on behalf of the California Sub-
5 Class, invasion of privacy, CIPA, FSCA, unjust enrichment, declaratory judgment, and injunctive
6 || relief—survive. Plaintiffs are given 20 days to file an amended complaint.
7 Plaintiffs’ motion to seal as reflected in the category-by-category redactions in Exhibits E
8 and F to the Maher Declaration is granted. Plaintiffs are ordered to file public versions of both
9 exhibits consistent with this order, no later than October 20, 2023.
10
11 IT IS SO ORDERED.
12
€& 1 Dated: October 3, 2023
RICHARD SEEBORG
15 Chief United States District Judge
16
= 17
Z 18
19
20
21
22
23
24
25
26
27
28 ORDER GRANTING IN PART AND DENYING IN PART MOTION TO DISMISS
CASE No. 22-cv-04792-RS