# Rodriguez v. Google LLC

> District Court, N.D. California · April 5, 2024

URL: https://www.frixlaw.com/law-library/cases/10078650

## Case

- **Court:** District Court, N.D. California
- **Decided:** April 5, 2024
- **Opinion:** 100trialcourt
- **Cited by:** 0 later opinions in the Frix Law Library

## Citator (automated)

- No negative treatment found by the automated citator. That is not the same as a confirmation that the case is good law; read the citing cases.
- Full citator and citing cases: https://www.frixlaw.com/law-library/cases/10078650

## Opinion text

1
2
3
4
5
6
7 UNITED STATES DISTRICT COURT
8 NORTHERN DISTRICT OF CALIFORNIA
9
ANIBAL RODRIGUEZ, et al.,
10 Case No. 20-cv-04688-RS
Plaintiffs,
11
v. ORDER GRANTING IN PART
12 MOTION TO “CLARIFY” CLASS
GOOGLE LLC, DEFINITION
13
Defendant.
14

15 I. INTRODUCTION
16 This a privacy class action against Google with three claims: intrusion upon seclusion,
17 invasion of privacy, and violation of the Comprehensive Computer Data Access and Fraud Act
18 (CDAFA), Cal. Penal Code § 502 et seq. Plaintiffs represent class members who had certain
19 Google privacy settings, referred to as Webb App & Activity (WAA) and supplemental Web App
20 & Activity (sWAA), turned off during the class period. Two classes were certified on January 3,
21 2024, and the parties now seek to disseminate class notice. Accordingly, Plaintiffs filed a motion
22 to direct notice to class members, seeking approval of the proposed notice plan. However, during
23 the parties’ meet and confer regarding class notice, a dispute arose about whether certain
24 categories of Google accounts are part of the class. This threshold issue, which was not briefed by
25 either side at class certification, must be resolved before notice may be issued. Supplemental
26 briefing was consequently ordered, and Google subsequently filed the instant motion for
27 clarification of the class definition.
1 II. BACKGROUND
2 The two classes certified in this case are defined as:
3 Class 1: All individuals who, during the period beginning July 1, 2016
and continuing through the present (the “Class Period”), (a) had their
4 “Web & App Activity” and/or “supplemental Web & App Activity”
setting turned off and (b) whose activity on a non-Google-branded
5 mobile app was still transmitted to Google, from (c) a mobile device
running the Android operating system, because of the Firebase
6 Software Development Kit (“SDK”) and/or Google Mobile Ads SDK.
7 Class 2: All individuals who, during the Class Period (a) had their
“Web & App Activity” and/or “supplemental Web & App Activity”
8 setting turned off and (b) whose activity on a non-Google-branded
mobile app was still transmitted to Google, from (c) a mobile device
9 running a non-Android operating system, because of the Firebase
SDK and/or Google Mobile Ads SDK.
10
11 At the most recent case management conference, the parties agreed to submit their
12 proposed class notice plan on February 29, 2024. That motion was timely filed, however the
13 parties identified two lingering issues that required resolution before class notice could be
14 disseminated. The first issue pertained to directing notice via email to class members and the
15 security of that data, and on March 8, 2024, the parties submitted a joint letter brief stating that
16 issue was resolved.
17 The second dispute is the subject of the instant order. The parties disagree whether two
18 categories of Google accounts are included in the class definition: Enterprise Dasher (“Dasher”)
19 accounts, or accounts created by businesses or organizations for their employees or other
20 members, and Supervised Unicorn (“Unicorn”) accounts, i.e., accounts created for children under
21 thirteen by their parents. Dasher accounts are managed by an enterprise administrator, who
22 controls both the initial account settings, including the WAA and sWAA settings, and the range of
23 Google services available to a user. Monsees Decl. ¶ 5-7. A Dasher user does not set the Google
24 privacy settings, including WAA and sWAA, when creating the account. Id. at ¶ 7. However, if a
25 Dasher user turns WAA off, an enterprise administrator may not necessarily override that
26 decision. Ruemmler Tr. at 173:18-23. Similarly, a Unicorn account is designed for children under
27 the age of thirteen, created and supervised by their parents or guardians. Id. at ¶ 8. A separate
1 Google account belonging to the parent or guardian is necessary to create and manage the Unicorn
2 account’s settings, including privacy-related settings. Id. Some Unicorn accounts do not even have
3 associated Google email addresses. Like Dasher accounts, Unicorn users do not see or set WAA or
4 sWAA settings at account creation. Id. at ¶ 11. The parent or guardian has the authority to decide
5 whether the Unicorn user can modify their activity controls at all. Id. at ¶ 9. The account
6 disclosures for Unicorn accounts are identical to those of regular Google accounts, except they
7 replace “your data” with “your child’s data.” Fair Tr. at 172:21-23; Dkt. 377-6. Google suggests it
8 did not raise this issue in opposition to class certification because it assumed that individuals “who
9 cannot enable or disable sWAA should [not] be in the classes defined by Plaintiffs.” Plaintiffs, on
10 the other hand, charge Google with raising these objections belatedly, risking prejudice to
11 individuals who thought this case included their account types, and maintains that including these
12 account types is consistent with the aims of this litigation.
13 III. LEGAL STANDARD
14 A court retains jurisdiction to rescind, alter, or amend the class certification order prior to
15 final judgment in “light of subsequent developments in the litigation,” for the order is “inherently
16 tentative.” Gen. Tel. Co. of Southwest v. Falcon, 457 U.S. 147, 160 (1982); Fed. R. Civ. P.
17 23(c)(1)(C). “Any amendment must, however, satisfy the requirements of Rule 23.” Peel v.
18 Brooksam Mortg. Corp., No. SACV1100079JLSRNBX, 2014 WL 12589317, at *3 (C.D. Cal.
19 Nov. 13, 2014) (citation omitted); see also Ms. L. v. U.S. Immigration & Customs Enf't, 330
20 F.R.D. 284, 287 (S.D. Cal. 2019) (“In considering the appropriateness of [modification or]
21 decertification, the standard of review is the same as a motion for class certification: whether the
22 Rule 23 requirements are met.”) (alteration in original) (citation omitted).
23 IV. DISCUSSION
24 A. Procedural Issues
25 Google first insists that its motion is procedurally appropriate because it is merely seeking
26 to clarify the class definition, and “[c]ourts routinely clarify ambiguities in class definitions.” To
27 be sure, where true ambiguities exist in class definitions, clarification may be useful in
1 determining what is and is not in the bounds of the class definition. Here, however, no such
2 ambiguity exists. The plain language of the certified classes clearly identifies, with particularity,
3 class members as “all individuals” who had their WAA and sWAA settings turned off. It does not
4 limit the class to all individuals who by themselves turned those settings off. This unambiguous
5 language was unopposed at class certification. Moreover, Google’s insistence that it had no way of
6 knowing that Plaintiffs meant to include Dasher and Unicorn accounts in the class definition is
7 untenable based on even its own attached exhibit, which shows a discussion between counsel for
8 both sides during the deposition of Google’s rebuttal expert, John Black, that raised, at the very
9 least, ambiguity regarding this issue. See Dkt. 375-2 at 6. Likewise, Plaintiffs’ expert Jonathan
10 Hochman discussed both Dasher and Unicorn accounts in his expert reports, and the fact that
11 Black excluded those accounts in his technical analysis is inapposite here. Further, Michael
12 Lasinski, who was the subject of Google’s Daubert motion that was briefed concurrently to class
13 certification, also included Dasher and Unicorn accounts in his analysis.
14 On this basis, Lasinski’s calculations were not challenged in the Daubert motion or related
15 filings. Google was therefore on notice at class certification that Plaintiffs were contemplating
16 including those accounts in the certified classes, evidenced by their proposed definition of the
17 classes consisting of “all individuals” who had disabled their WAA/sWAA settings. Accordingly,
18 Google’s artful attempt to portray the instant motion as one seeking merely to clarify the class
19 definition to align with the class certification order is unavailing. It is more fitting to characterize
20 the instant motion as a request to modify the class certification order to exclude Dasher and
21 Unicorn accounts. Nonetheless, while Plaintiffs are correct that Google’s objections should have
22 been raised at class certification, the “inherently tentative” nature of the class certification order,
23 “particularly during the period before any notice is sent to the members of the class,” permits
24 review of Google’s motion for modification so as to ensure the class, as defined, comports with
25 the stringent requirements of Rule 23. See Falcon, 457 U.S. at 160.
26 B. Commonality, Typicality, Adequacy
27 Plaintiffs’ proposed classes were certified because they met the 23(a) requirements of
1 commonality, numerosity, typicality, and adequacy as well as the requirements of both 23(b)(3)
2 and 23(b)(2). Google insists that the inclusion of Dasher and Unicorn accounts in the certified
3 classes disturbs the commonality, typicality, and adequacy requirements under 23(a). 23(a)(2)
4 requires that “questions of law or fact” be common to the class, (a)(3) mandates that the “claims or
5 defenses of the representative parties [be] typical of the claims or defenses of the class,” and (a)(4)
6 requires the class representatives to “fairly and adequately protect the interests of the class.”
7 Commonality is met because Google’s representations and conduct as to the WAA and
8 sWAA settings are common to the class, even with Dasher and Unicorn accounts included.
9 Google conflates the predominance inquiry of 23(b)(3) and the commonality question of 23(a)(2).
10 To satisfy 23(a)(2), “even a single common question will do,” whereas the 23(b)(3) inquiry
11 requires common questions to predominate over individual ones. Wal-Mart Stores, Inc. v. Dukes,
12 564 U.S. 338, 359 (2011) (internal quotes omitted). The class representatives of the two classes
13 are also typical and adequate representatives of the class, inclusive of Dasher and Unicorn
14 accounts. Named Plaintiffs’ claims “are typical of those of the class members” because “each class
15 member’s claim arises from the same course of events, and each class member makes similar legal
16 arguments to prove the defendant’s liability.” Rodriguez v. Hayes, 591 F.3d 1105, 1124 (9th Cir.
17 2010) (quoting Armstrong v. Davis, 275 F.3d 849, 868 (9th Cir. 2001)). “Like the commonality
18 requirement, the typicality requirement is permissive and requires only that the representative’s
19 claims are ‘reasonably co-extensive with those of absent class members.’” Id. (quoting Hanlon v.
20 Chrysler Corp., 150 F.3d 1011, 1020 (9th Cir. 1998)).
21 Here, Plaintiffs satisfy that standard even as to Dasher or Unicorn users who had WAA or
22 sWAA off during the class period as that conduct is typical of all class members. Further, named
23 plaintiffs’ claims are typical of the class members, arising from the same course of events, alleging
24 the same injury, and carrying the same legal arguments. The adequacy requirement is also met
25 because Google has failed to show how class counsel or named Plaintiffs’ claims or interests
26 conflict with those of Dasher or Unicorn users, or that they will fail to prosecute this action
27 vigorously on behalf of those users. See Hanlon v. Chrysler Corp., 150 F.3d 1011, 1020 (9th Cir.
1 1998); Falcon, 457 U.S. at 158 n.13. Accordingly, the classes, inclusive of Dasher and Unicorn
2 accounts, meet the 23(a) requirements.
3 C. Predominance1
4 23(b)(3) requires a finding that questions of law and fact common to class members
5 predominate over individual ones, as well as a finding that a class action is the superior method of
6 adjudicating the controversy. Fed. R. Civ. P. 23(b)(3). “Implicit in the satisfaction of the
7 predominance test is the notion that the adjudication of common issues will help achieve judicial
8 economy.” Zinser v. Accufix Rsch. Inst., Inc. 253 F.3d 1180 (9th Cir. 2001) (quoting Valentino v.
9 Carter-Wallace, Inc., 97 F.3d 1227, 1234 (9th Cir. 1996)). For the certified classes, the
10 predominance condition was met, in part, because Plaintiffs established that Google’s
11 representations about the WAA and sWAA settings and its alleged misconduct are uniform across
12 the class, and because Plaintiffs’ averred claims are “subject to common proof.” Pertinently, the
13 predominance inquiry also rested on the notion that the relevant, uniform conduct here is the
14 proposed class members’ decisions affirmatively to turn off the WAA and sWAA buttons. Cf.
15 Hart v. TWC, No. 20-cv-03842-JST, 2023 WL 3568078 (N.D. Cal. Mar. 30, 2023).
16 A predominance inquiry necessitates analysis of what individual and common questions
17 exist as to the proposed class and averred claims. The intrusion upon seclusion and invasion of
18 privacy claims are frequently discussed together because they raise similar elements, whether “(1)
19 there exists a reasonable expectation of privacy, and (2) the intrusion was highly offensive.” In re
20 Facebook, Inc. Internet Tracking Litigation, 956 F.3d 589, 601 (9th Cir. 2020). Whether a
21 reasonable expectation of privacy exists is an objective question, evidenced by Google’s uniform
22 disclosures about the WAA and sWAA settings and the class members’ corresponding choices
23 affirmatively to switch those settings off. The second prong questions whether Google’s intrusion
24

25
1 Google focuses its motion on the deficiencies of the class as currently defined under 23(b)(3) and
26 does not touch on any deficiencies of the class under 23(b)(2). Having determined that typicality
and adequacy are, in fact, met even with Dasher and Unicorn users, the instant order applies only
27 to the classes to the extent they were certified under 23(b)(3).
1 is offensive to a reasonable person. While these elements may be proven class-wide as to standard
2 Google users, these considerations break in the other direction vis-à-vis Dasher and Unicorn
3 accounts. Unlike the remaining class members, these users do not necessarily turn off the WAA or
4 sWAA settings themselves, nor do they always know if those settings are turned off. For Dasher
5 accounts, an enterprise administrator chooses the account settings, including whether to turn WAA
6 or sWAA off, at account creation. If the enterprise administrator turns WAA or sWAA on, an
7 employee might subsequently choose to turn those settings off, and this choice may not be
8 necessarily overridden by the enterprise administrator. Similarly, Unicorn accounts are managed
9 by parents or guardians who control the user’s privacy settings and decide whether the user can
10 even alter those settings. The configurations of these accounts necessarily raise individualized
11 factual questions of who actually engaged in the pertinent conduct for the purposes of class
12 certification; that is, switching off WAA or sWAA. Put differently, whether WAA or sWAA is off
13 for a Dasher or Unicorn account may represent the choice of someone distinct from the user (i.e.,
14 class member), raising individualized inquiries about reasonable expectations of privacy, which
15 would unavoidably undermine the predominance prong of Rule 23(b)(3).
16 Despite Plaintiffs’ insistence otherwise, it does matter whether it is the administrator or
17 parent who chose to turn WAA or sWAA off or whether the actual user did so, because this
18 inquiry reflects the meaningfulness of the user’s choice and, therefore, whether they maintained a
19 reasonable expectation of privacy throughout the class period.2 It similarly signifies whether the
20 user or the enterprise administrator/parent actually saw Google’s disclosures and policies about the
21 WAA and sWAA settings, as this raises individual questions about whether users (as opposed to
22 their parents or administrators) consented to the complained about conduct. Plaintiffs’ argument
23 that a parent’s choice to switch WAA or sWAA off is no reason to “exclude children from this
24

25 2 Plaintiffs argue that Google must have information about the number of Dasher accounts for
which sWAA was switched off by the user instead of the enterprise administrator, because Google
26 maintains records of when all users turned sWAA off or on. Even accepting that these records give
Google this information, individualized inquiries would still exist as to whether it was the
27 enterprise administrator or the employee who switched sWAA off.
1 important privacy case” fails to persuade. The relevant inquiry here is not whether Unicorn users’
2 privacy interests should be litigated at all, but whether common questions as to those accounts
3 predominate over individual ones.3 The need to investigate Dasher and Unicorn accounts’ conduct
4 as to these privacy settings necessarily raises individual questions that make class treatment
5 unmanageable and defeat predominance.
6 Inclusion of Dasher and Unicorn users in the classes does not, however, raise
7 individualized inquiries for the CDAFA claim. CDAFA makes it unlawful to “knowingly access[]
8 and without permission take…any data from a computer.” Cal. Penal Code § 502(c)(2). Whether
9 Google had “permission” to collect the data turns on what words or conduct were communicated
10 to Google, in this case, the status of the sWAA setting. California courts have yet to define what
11 “without permission” means in the CDAFA context, but courts in this district often suggest that a
12 defendant acts without permission when it circumvents “technical or code-based barriers.” See In
13 re Carrier IQ., Inc. 78 F. Supp. 3d 1051, 1100 (N.D. Cal. 2015) (collecting cases) (citations
14 omitted). Here, the relevant technical barrier is the WAA or sWAA settings. Plaintiffs insist that
15 “consent” was communicated to Google based on the status of the sWAA button, i.e., if it was
16 toggled off, Google took that to mean they had no permission to collect the data. Indeed, CDAFA
17 does not mandate that “consent” be given by the user and not the parent or enterprise
18 administrator. The other elements of CDAFA–whether Google knowingly accessed the data;
19 whether Google took, copied, or made use of any data from a computer; or whether class members
20 suffered any damage or loss–are unaddressed by Google and are also subject to common proof of
21 Google’s conduct. Therefore, as to the CDAFA claim, Dasher and Unicorn accounts are included
22 in the classes as defined.
23 D. Feasibility
24 While Google points out that not all Dasher and Unicorn accounts have associated email
25

26
3 Indeed, even accepting this argument, Dasher and Unicorn accounts remain part of the classes as
27 certified under 23(b)(2), discussed further below.
1 addresses, which makes it challenging to send class notice, Plaintiffs are correct that the Class
2 Administrator can undertake publication notice to reach those individuals without associated email
3 addresses through other methods. This might be enough for the transmission of notice, but
4 Plaintiffs have not provided a solution to the inevitable challenge that the notice language will
5 inevitably be different as to the Dasher and Unicorn accounts to identify which individual belongs
6 in the class.
7 E. Prejudice
8 The notion that excluding Dasher and Unicorn users from the 23(b)(3) classes will risk
9 unfair prejudice to them is questionable. Dasher users have personal Google accounts which,
10 provided the WAA or sWAA settings are off during the class period, would be included in the
11 class. Likewise, Unicorn accounts require parents to have their own Google accounts, and those
12 parents’ Google accounts would also be included in the classes provided the class definitions are
13 met. Plaintiffs suggest that excluding Dasher and Unicorn accounts from the certified classes
14 would require a separate action to litigate the interests of those users. This is not necessarily true.
15 In fact, those users may remain in the classes certified under 23(b)(2). For purposes of 23(b)(3),
16 however, predominance is a prerequisite that warrants exclusion of Dasher and Unicorn accounts
17 as to the intrusion upon seclusion and invasion of privacy claims. Dasher and Unicorn users may
18 attempt to bring these claims as individuals should they wish to do so.
19 Plaintiffs raise concerns that class members who thought they would be part of the classes
20 would be unfairly prejudiced if the applicable statute of limitations is no longer suspended upon
21 modification. See Am. Pipe & Const. Co. v. Utah, 414 U.S. 538, 554 (1978); Newberg &
22 Rubenstein on Class Action § 7.40. While tolling may be appropriate, Plaintiffs are to submit a
23 stipulated tolling agreement within two weeks or provide a proposed tolling order to which
24 Google may respond.
25 Plaintiffs also seek to direct notice to all Dasher and Unicorn accounts so they may be
26 made aware of their change in status. See Newberg & Rubenstein on Class Action § 7.40 (“If a
27 class certification order is modified to exclude some previous members of the class, these newly
1 excluded class members… should receive notice of this action”). In the interest of fairness to the
2 Dasher and Unicorn users, notice of their change in status is warranted.
3 Lastly, Plaintiffs seek permission to proceed on a Rule 23(b)(2) basis as to the Dasher and
4 Unicorn users even if the instant motion is granted so that injunctive relief may apply equally,
5 regardless of account type. Given that any declaratory or injunctive relief regarding Google’s
6 WAA or sWAA settings would impact all users, and because Google has failed to establish that
7 any of the 23(a) factors are deficient, inclusive of Dasher and Unicorn users, this request is also
8 granted. See Ellis v. Costco Wholesale Corp., 657 F.3d 970, 988 (9th Cir. 2011) (“the court [may]
9 certify a Rule 23(b)(2) class for equitable relief and a separate Rule 23(b)(3) class for damages”)
10 (internal citation omitted).
11 Accordingly, the classes certified under 23(b)(3) for the invasion of privacy and intrusion
12 upon seclusion claims are modified as follows:
13 Class 1: All “non-Enterprise” and “non-Unicorn” individuals who,
during the period beginning July 1, 2016 and continuing through the
14 present (the “Class Period”), (a) had their “Web & App Activity”
and/or “supplemental Web & App Activity” setting turned off and
15 (b) whose activity on a non-Google-branded mobile app was still
transmitted to Google, from (c) a mobile device running the Android
16 operating system, because of the Firebase Software Development Kit
(“SDK”) and/or Google Mobile Ads SDK.
17
Class 2: All “non-Enterprise” and “non-Unicorn” individuals who,
18 during the Class Period (a) had their “Web & App Activity” and/or
“supplemental Web & App Activity” setting turned off and (b) whose
19 activity on a non-Google-branded mobile app was still transmitted to
Google, from (c) a mobile device running a non-Android operating
20 system, because of the Firebase SDK and/or Google Mobile Ads
SDK.
21

22 For the CDAFA claim, the 23(b)(3) classes as certified in the original class certification
23 order, Dkt. 352, see supra section II, remain the same (i.e., the CDAFA subclasses under 23(b)(3)
24 include Dasher and Unicorn users). Likewise, the 23(b)(2) classes follow the class definition as set
25 forth in the original class certification order and include Dasher and Unicorn users.
26 V. CONCLUSION
27 Google’s motion to modify the class certification order is granted in part. The hearing set
1 for April 11, 2024 is vacated per L.R. 7-1(b). The parties must inform the Court whether they plan
2 || on withdrawing and resubmitting a modified class notice plan in accordance with this order and
3 provide a briefing schedule as to the notice plan within one week. If the parties do not plan on
4 || filing a new motion, an order will be issued based on the class notice plan currently filed, Dkt.
5 370, without a hearing. Additionally, as stated above, Plaintiffs must file within two weeks a
6 stipulated tolling agreement or a proposed tolling order to which Defendants may respond. Finally,
7 Plaintiffs filed a motion to seal exhibits containing Google employee email addresses, internal
8 || code names, and commercially sensitive business information. The information sought to be
9 sealed is narrowly tailored, and the motion to seal is granted. Public, redacted versions of the
10 || exhibits must be filed within two weeks of this order.
11
12 || ITISSO ORDERED.

14 |] Dated: April 5, 2024 VLA
15
RICHARD SEEBORG
= 16 Chief United States District Judge
= 17
18
19
20
21
22
23
24
25
26
27
98 ORDER GRANTING MOTION TO “CLARIFY” CLASS DEFINITION
CASE No. 20-cv-04688-RS

---

Source: Frix Law Library, https://www.frixlaw.com/law-library/cases/10078650. Public record. Not legal advice.