Kauffman v. Papa John's International, Inc.

1

2

3

4

5

6

7

8 UNITED STATES DISTRICT COURT

9 SOUTHERN DISTRICT OF CALIFORNIA

10

11 DAVID KAUFFMAN, et al., Case No.: 22-cv-1492-L-MSB

12 Plaintiff,

ORDER GRANTING IN PART AND

13 v. DENYING IN PART MOTION TO

DISMISS [ECF NO. 30 ]

14 PAPA JOHN’S INTERNATIONAL,

INC.,

15

Defendant.

16

17 Pending before the Court in this putative class action asserting violations of the

18 California Invasion of Privacy Act (“CIPA”), Cal. Pen. Code §§ 631 and 632.7, is

19 Defendant Papa John’s International’s Motion to Dismiss. [ECF No. 30.] The Court

20 decides the matter on the papers submitted and without oral argument. See Civ. L. R.

21 7.1(d.1). For the reasons stated below, the Court grants in part and denies in part the

22 Motion to Dismiss.

23 I. FACTUAL BACKGROUND1

24 Defendant owns and operates the following website: www.papajohns.com. Over

25 the past year, David Kauffman (“Plaintiff”) and Class Members visited Defendant’s

26

27

28

1 website from cell phones and other mobile devices to purchase pizzas. Plaintiff and Class

2 Members were in California during each visit to Defendant’s website. Plaintiff used

3 Defendant’s mobile website to order pizza sold by Defendant from its location at 4089

4 Genesee Avenue, San Diego, California. Plaintiff placed the order(s) by entering

5 information on Defendant’s website, customizing his order, adding the order to his cart,

6 and making payment by entering his credit card information to complete his purchase.

7 Defendant and FullStory used session replay software which enabled it to see the

8 screens of Plaintiff and Class Members while they were on Defendant’s website. The

9 “sessions” were recorded and shared with or by FullStory. Defendant installed

10 FullStory’s session replay onto its servers and inserted the JavaScript into the HTML

11 code of its website. When consumers visit Defendant’s website, the JavaScript

12 immediately loads onto their device, from Defendant’s site, and is stored in their device’s

13 cache or temporary internet files. As soon as Defendant’s site loaded on Plaintiff’s cell

14 phone, Plaintiff’s phone began sending and receiving electronic communications in the

15 form of instructions to and from Defendant’s computer servers utilized to operate its

16 website. The commands were sent as messages indicating to Defendant what words and

17 text were typed, credit card number, CVV, billing zip code, first name, last name, phone

18 number, address, email address, any search terms entered, and what content was being

19 clicked, requested, and inputted by Plaintiff including what food he was ordering to be

20 delivered to his home in California from the Genesee Avenue Papa John’s location.

21 II. PROCEDURAL BACKGROUND

22 On October 3, 2022, Plaintiff filed a Complaint asserting violations of the Federal

23 Wiretap Act, 18 U.S.C. §2510 et seq (the “Wiretap Act”) and the California Invasion of

24 Privacy Act (“CIPA”), Cal. Pen. Code § 631, in relation to the unauthorized interception,

25 collection, recording, and dissemination of Plaintiff’s and Class Members’

26 communications and data. [ECF No. 1.] On January 26, 2023, Plaintiffs filed a First

27 Amended Complaint asserting violations of the Federal Wiretap Act, 18 U.S.C. §2510 et

28 seq and CIPA, Cal. Pen. Code §§ 631 and 632. [ECF No. 22.] On April 10, 2023,

1 Plaintiffs filed a Second Amended Complaint asserting violations of CIPA, Cal. Pen.

2 Code §§ 631 and 632.7. [ECF No. 29.]

3 On April 24, 2023, Defendant filed the present Motion to Dismiss. (Motion [ECF

4 No. 30.]) On May 8, 2023, Plaintiffs filed a response in opposition. (Opposition [ECF

5 No. 31.]) On May 15, 2023, Defendants filed a Reply. [ECF No. 32.])

6 III. DISCUSSION

7 Defendant seeks dismissal of this action for lack of personal jurisdiction and

8 failure to state a claim.

9 A. Personal Jurisdiction

10 Where a defendant moves to dismiss for lack of personal jurisdiction, it “is the

11 plaintiff’s burden to establish the court’s personal jurisdiction over a defendant.” Doe v.

12 Unocal, 248 F.3d 915, 922 (9th Cir. 2001)(abrogated on other grounds) (citing Cubbage

13 v. Merchent, 744 F.2d 665, 667 (9th Cir. 1984), cert. denied 470 U.S. 1005 (1985)). To

14 withstand a motion to dismiss under Fed. R. Civ. P. 12(b)(2), the plaintiff need only

15 demonstrate facts that if true, would support jurisdiction over the defendant. Id.

16 Although the plaintiff cannot “simply rest on the bare allegations of the complaint,”

17 uncontroverted allegations contained in the complaint must be taken as true.

18 Schwarzenegger v. Fred Martin Motor Co., 374 F.3d 797, 800 (9th Cir. 2004).

19 A district court has personal jurisdiction over a defendant only if a statute

20 authorizes jurisdiction and the assertion of jurisdiction does not offend due process.

21 Unocal, 248 F.3d at 922. “Where . . . there is no applicable federal statute governing

22 personal jurisdiction, the district court applies the law of the state in which the district

23 court sits.” Yahoo! Inc., v. La Ligue Contre Le Racisme Et L’Antisemitisme, 433 F.3d

24 1199, 1205 (9th Cir. 2006); see also Fed. R. Civ. P. 4(k)(1)(a). Because California’s

25 long-arm statute is coextensive with federal due-process requirements, the jurisdictional

26 analyses under state and federal law are the same. Yahoo!, Inc., 433 F.3d at 1205; Cal.

27 Civ. Proc. Code § 410.10.

28

1 Absent traditional bases for personal jurisdiction (i.e. physical presence, domicile,

2 and consent), the Due Process Clause requires that a nonresident defendant have certain

3 minimum contacts with the forum state such that the exercise of personal jurisdiction

4 does not offend traditional notions of fair play and substantial justice. Int’l Shoe Co. v.

5 Washington, 326 U.S. 310, 316 (1945). Depending upon the level of contacts with the

6 forum state, personal jurisdiction can be “general” or “specific”. See Helicopteros

7 Nacionales de Colombia, S.A. v. Hall, 466 U.S. 408, 414 n. 8 (1984). A court may assert

8 general personal jurisdiction over a corporation "when their affiliations with the State are

9 so 'continuous and systematic' as to render them essentially at home in the forum State."

10 Goodyear Dunlop Tires Operations, S.A. v. Brown, 564 U.S. 915, 919 (2011). “[I]n the

11 paradigmatic circumstance for exercising general jurisdiction, the corporate defendant is

12 incorporated or has its principal place of business in the forum state.” Williams v.

13 Yamaha Motor Co., 851 F.3d1015, 1020 (9th Cir. 2017). The Second Amended

14 Complaint implicates only specific, not general jurisdiction because Papa John’s is a

15 Delaware corporation with its principal place of business in Kentucky. See Williams, 851

16 F.3d at 1020.

17 For specific jurisdiction to apply:

18 (1) The non-resident defendant must purposefully direct his activities or

consummate some transaction with the forum or resident thereof; or perform

19

some act by which he purposefully avails himself of the privilege of

20 conducting activities in the forum, thereby invoking the benefits and

protections of its laws;

21

22 (2) the claim must be one which arises out of or relates to the defendant's

forum-related activities; and

23

24 (3) the exercise of jurisdiction must comport with fair play and substantial

justice, i.e. it must be reasonable.

25

26 Schwarzenegger, 374 F.3d at 802.

27 Plaintiff bears the burden of satisfying the first two prongs of the test. Id. If

28 plaintiff succeeds in satisfying both prongs, the burden shifts to the defendant to present a

1 “compelling case” that the exercise of jurisdiction would not be reasonable. Id. “If the

2 plaintiff fails to satisfy either of these prongs, personal jurisdiction is not established in

3 the forum state.” Id.

4 1. Purposeful Availment/Direction

5 The phrase “purposeful availment” includes both purposeful availment, which is

6 most often used in contract suits, and purposeful direction, which is most often used in

7 tort causes of action such as the present claims. Schwarzenegger, 674 F.3d at 802. “A

8 showing that a defendant purposefully directed his conduct toward a forum state . . .

9 usually consists of evidence of the defendant's actions outside the forum state that are

10 directed at the forum, such as the distribution in the forum state of goods originating

11 elsewhere.” Id. at 803. Purposeful direction is evaluated under the three-part “effects”

12 test originating with Calder v. Jones, 465 U.S. 783 (1984). Id. Under Calder, the

13 defendant must “have 1) committed an intentional act, (2) expressly aimed at the forum

14 state, (3) causing harm that the defendant knows is likely to be suffered in the forum

15 state.” Dole Foods Co., Inc., v. Watts, 303 F.3d 1104, 1111 (9th Cir. 2002).

16 According to Defendant, Plaintiff fails to show that Papa John’s “operation of a

17 nationally accessible website and its alleged use of session replay technology on that

18 website” are expressly aimed at California or distinguish California from other states

19 where the website is accessible. (Mot. at 6). In addition, Defendant contends that the

20 automatic location services on Papa John’s website and California-specific provisions in

21 the Privacy Statement do not indicate that Papa John’s specifically aimed its conduct at

22 California residents. (Id. at 7). According to Defendant, the complaint lacks allegations

23 that show any of Papa John’s acts were more likely to cause harm in California than any

24 other forum. (Id. at 8).

25 Plaintiff counters that all three of the “purposeful direction” elements are satisfied

26 here: (1) Defendant committed an intentional act by operating numerous restaurants in

27 conjunction with its website to sell pizza to individuals in California and imbedded the

28 website with session replay code; (2) Defendant expressly aimed conduct at California by

1 using a website that was integrated with the operation of retail outlets and franchises; and

2 (3) Defendant knew that harm was likely to be suffered in California by the collection of

3 personal data via FullStory’s session replay code. (Oppo. at 6-8).

4 Plaintiff has satisfied the first element because the Complaint sufficiently alleges

5 that Defendant committed an intentional act by operating restaurants in California from

6 which customers purchase food via the website, and that Papa John’s intentionally

7 embedded the website with session replay technology See Schwarzenegger, 374 F.3d at

8 806 (For purposes of Calder test, “intent” is construed as “an intent to perform an actual,

9 physical act in the real world, rather than an intent to accomplish a result or consequence

10 of that act.”)

11 Turning to the “express aiming” prong, “[n]ot all material placed on the Internet is,

12 solely by virtue of its universal accessibility, expressly aimed at every state in which it is

13 accessed.” Mavrix Photo, Inc. v. Brand Technologies, Inc., 647 F.3d 1218, 1231 (9th Cir.

14 2011). While the operation of “a passive website alone cannot satisfy the express aiming

15 prong,” the operation of a website in conjunction with “something more” including the

16 “interactivity of the defendant’s website [and] the geographic scope of the defendant’s

17 commercial ambitions” can satisfy this prong. Id. at 1229. It is undisputed that Defendant

18 operates the interactive website www.papajohns.com, that allows California users to

19 peruse menus, place orders, and pay for food from Papa John retail stores as part of its

20 regular course of business. The Complaint claims that “Defendant chose to benefit from

21 marketing and doing business in California” and cites to the website to illustrate that

22 California residents were targeted by Defendant. (SAC at ¶¶ 33, 41 n. 7). The landing

23 page notes “Menu, Special Offers and Pricing may vary for each Papa Johns location.”2

24 Papa John’s website https://www.papajohns.com/order/stores-near-me (last visited

25

26

2 “A court may … consider certain materials—documents attached to the complaint, documents

27 incorporated by reference in the complaint, or matters of judicial notice—without converting the motion

to dismiss into a motion for summary judgment.” United States v. Ritchie, 342 F.3d 903, 908 (9th Cir.

28

1 January 8, 2024). Plaintiff also claims that Defendant “included California-specific

2 provisions in its Privacy Statement in recognition that California citizens would be using

3 Defendant’s website” which subjects Defendant to California law. (SAC ¶ 35).

4 These assertions sufficiently allege that Defendant operates an interactive website

5 which is integrated with retail outlets in California, therefore Papa John’s is carrying on

6 part of its general business in California by marshaling the market via its website. This

7 satisfies the “something more” requirement to demonstrate that Defendant “expressly

8 aimed” its conduct at California. See Mavrix, 647 F.3d at 1231 (“where, as here, a

9 website with national viewership and scope appeals to, and profits from, an audience in a

10 particular state, the site's operators can be said to have ‘expressly aimed’ at that state.”)

11 The final element requires Plaintiff to show that Papa John’s was aware that the

12 alleged harm was likely to be suffered in California. To show that Papa John’s knew its

13 conduct was likely to cause harm in California, Plaintiff must show that Papa John’s

14 knew of his connection to California. See generally, Bergstein v. Parmar, 2014 WL

15 12586073, at * 3-4 (C.D. Cal. June 23, 2014)(Plaintiff satisfied third element where

16 defendant was aware that plaintiff “lived and worked in California” and that plaintiff

17 suffered harm in California as a result of defendant’s conduct.) In the Complaint, Plaintiff

18 asserts that Defendant knew the harm caused by the session replay recording would be

19 suffered by Californians because

20 [m]any Californians purchase items on Defendant’s site and enter their California

addresses. Another way Defendant knows a consumer is located in California is

21

through location-determining tools that track and analyze users’ IP addresses,

22 without requiring the user to manually input a physical address. The employment

of automatic location services in this way means that Defendant is continuously

23

aware that its website is being visited by people located in California to buy

24 Defendant’s products in California, and that such website visitors are being tapped

and recorded in violation of California statutory law, causing privacy harm to

25

California citizens.

26 (SAC ¶ 34).

27

28

1 Defendant claims that auto-location functionalities are insufficient to meet Plaintiff’s

2 burden under AMA Multimedia, LLC v. Wanat, 970 F.3d 1201, 1211 (9th Cir. 2020), but

3 the issue in AMA was “geo-located advertisements” which did not operate in the same

4 manner as the Papa John’s session replay technology which employs geo-tracking to

5 target specials to California residents and find the nearest restaurant for delivery

6 purposes. Accordingly, the Court finds that Plaintiff has sufficiently alleged for purposes

7 of this motion that California residents were the focal point of Papa John’s target

8 marketing via its website and that they knew Californians would suffer the alleged harm.

9 2. Arise out of or Relate to Defendant’s Conduct

10

The Ninth Circuit distinguishes between “passive” and “interactive” websites when

11

determining whether a claim arises out of a Defendant’s operation of a nationally

12

accessible internet cite. See Cybersell, Inc., v. Cybersell, Inc., 130 F.3d 414, 418 (9th Cir.

13

1997). “Courts that have addressed interactive sites have looked to the ‘level of

14

interactivity and commercial nature of the exchange of information that occurs on the

15

Web site’ to determine if sufficient contacts exist to warrant the exercise of jurisdiction.”

16

Id.

17

Defendant claims that Plaintiff has failed to establish that his claims arise out of or

18

relate to Papa John’s contacts with the forum because the complaint lacks any factual

19

detail specifically linking Plaintiff’s claim to California, except for the allegation that

20

Plaintiff chose to access the website from within California. (Mot. at 9). Instead,

21

Defendant argues that the “relevant conduct” is Papa John’s operation of a nationally

22

accessible website and alleged use of session replay technology on that website but that

23

conduct did not occur within California and is therefore insufficient to authorize

24

jurisdiction. (Id.)

25

In response, Plaintiff contends that Defendant uses its website to systematically

26

serve the California market by directing “California customers to its numerous

27

restaurants in the state and offers specific menus and offers to California residents” which

28

1 forms the basis for specific jurisdiction under Ford Motor Company v. Montana Eighth

2 Judicial District Court, 141 S.Ct. 1017, 1026 (2021). (Oppo. at 9).

3 Plaintiff has alleged facts demonstrating that Defendant’s website is interactive

4 because it allows customers to obtain information about Defendant’s menu, order

5 products, and receive delivery of those products in California at a restaurant closest to the

6 customer’s location. In the Complaint, Plaintiff asserts that Defendant directed

7 “purposeful and tortious acts toward the citizens of California” by doing business and

8 engaging in commercial activity with California citizens via the website which was

9 viewing and collecting information from California residents. (SAC at ¶ 33). Under

10 Cybersell, these facts support Plaintiff’s argument that his claims “arise out of or relate

11 to” Defendant’s deployment of session replay technology on its website.

12 Defendant’s argument that the “relevant conduct” is the “operation of a nationally

13 accessible website and alleged use of ‘session replay’ technology on that website” too

14 narrowly frames the scope of the inquiry. In Ford Motor Company, the Supreme Court

15 emphasized that the “arises out of or relates to” test “contemplates that some

16 relationships will support jurisdiction without a causal showing.” Although doctrinal

17 questions bearing on the applicability of the “related to” test with regard to internet

18 transactions were left for another day, nothing in the Ford opinion bars application of the

19 general proposition to these facts. Id. at 1028, n. 4. For purposes of the motion to dismiss,

20 Plaintiff has sufficiently alleged that the claims “arise out of or relate to” Defendant’s

21 conduct.

22 Plaintiff has successfully satisfied both prongs of the personal jurisdiction test, and

23 Defendant has not presented a “compelling case” that the exercise of jurisdiction would

24 not be reasonable. Schwarzenegger, 374 F.3d at 802. Accordingly, the Court denies

25 Defendant’s motion to dismiss for lack of personal jurisdiction.

26 B. Failure to State a Claim

27 A 12(b)(6) motion to dismiss tests the sufficiency of the complaint. Navarro v.

28 Block, 250 F.3d 729, 732 (9th Cir. 2001). A pleading must contain, in part, “a short and

1 plain statement of the claim showing that the pleader is entitled to relief.” Fed. R. Civ. P.

2 8(a)(2). But plaintiffs must also plead “enough facts to state a claim to relief that is

3 plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007); see also

4 Fed. R. Civ. P. 12(b)(6). The plausibility standard demands more than “a formulaic

5 recitation of the elements of a cause of action,” or “ ‘naked assertions’ devoid of ‘further

6 factual enhancement.’ ” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Twombly,

7 550 U.S. at 557). Instead, the complaint “must contain allegations of underlying facts

8 sufficient to give fair notice and to enable the opposing party to defend itself effectively.”

9 Starr v. Baca, 652 F.3d 1202, 1216 (9th Cir. 2011).

10 In reviewing a 12(b)(6) motion to dismiss, “[a]ll allegations of material fact are

11 taken as true and construed in the light most favorable to the nonmoving party.” Cahill v.

12 Liberty Mut. Ins. Co., 80 F.3d 336, 337–38 (9th Cir. 1996). However, a court need not

13 take legal conclusions as true merely because they are cast in the form of factual

14 allegations. See Roberts v. Corrothers, 812 F.2d 1173, 1177 (9th Cir. 1987). Similarly,

15 “conclusory allegations of law and unwarranted inferences are not sufficient to defeat a

16 motion to dismiss.” Pareto v. FDIC, 139 F.3d 696, 699 (9th Cir. 1998).

17 1. Consent

18 Defendant argues that Plaintiff cannot state a claim under either provision of the

19 CIPA because he fails to plead facts establishing lack of consent to Defendant’s actions.

20 (Mot. at 10 [ECF No. 30.]) Specifically, Defendant argues that each time Plaintiff placed

21 an order on the website, he checked a box that confirmed he understood and agreed that

22 his information would be collected and used as described in the Privacy Policy. (Id. at 10-

23 11). That Privacy Policy was hyperlinked on every page of the website and disclosed

24 Papa John’s data collection practice along with use of vendors. (Reply at 5). According to

25 Defendant, Plaintiff must do more than merely allege lack of consent such as alleging

26 additional facts showing Plaintiff did not have actual or constructive knowledge of the

27 Privacy Policy. (Id.) Defendant claims that Plaintiff did not elect to have his data deleted

28 despite being presented with that option in the Privacy Policy, and he continued to use the

1 website, showing at a minimum his implied consent. (Id. at 11). Defendant further

2 contends that Plaintiff’s prior complaints suggested he placed orders online before

3 October 3, 2022, outside CIPA’s one-year statute of limitations period, making it

4 implausible that he did not consent to any data collection that occurred after October 3,

5 2022. (Id. at 12 n. 4).

6 In response, Plaintiff argues that Defendant's consent defense turns on the outcome

7 of multiple factual disputes which defeat dismissal at this stage, such as whether Plaintiff

8 actually saw the privacy policy link on the website pages, what the link looked like, and

9 whether the privacy policy adequately discloses that it uses session replay recording

10 code. (Oppo. at 11). In addition, Plaintiff claims that reliance on the Privacy Policy is

11 insufficient to show consent because it appears as a “browsewrap” agreement which does

12 not require the user to expressly “manifest assent to the terms and conditions.” (Id.)

13 In the Complaint, Plaintiff clearly states that “Defendant never sought consent, and

14 Plaintiff and Class Members never provided consent, for the unauthorized access and

15 reading and recording of their electronic communications prior to it occurring.” (SAC at ¶

16 76). This is sufficient to meet his burden to plead that he did not provide prior consent to

17 the recording. See Javier v. Assurance IQ, LLC, No. 21-16351, 2022 WL 1744107, at *2

18 (9th Cir. May 31, 2022) (holding that the plaintiff met his pleading burden by alleging

19 that he did not provide express consent.) Moreover, the factual disputes regarding

20 whether Plaintiff actually saw the Privacy Policy and consented to it are not suitable for

21 resolution at this stage in the proceedings. See In re Tracht Gut, LLC, 836 F.3d 1146,

22 1150 (9th Cir. 2016) (“At the motion to dismiss phase, the trial court must accept as true

23 all facts alleged in the complaint and draw all reasonable inferences in favor of the

24 plaintiff.”) As a result, the Court declines to dismiss Plaintiff's CIPA claims based on

25 consent.

26 //

27 //

28

1 2. First Cause of Action- Violation of the California Invasion of Privacy Act,

2 Cal Penal Code § 631

3 Section 631(a) of the California Penal Code provides for civil and criminal liability

4 where:

5 Any person who, by means of any machine, instrument, or contrivance, or

any other matter, intentionally taps, or makes any unauthorized connection,

6

whether physically, electrically, acoustically, inductively, or otherwise, with

7 any telegraph or telephone wire, line, cable, or instrument, including the

wire, line, cable. Or instrument of any internal telephonic communication

8

system, or who willfully and without consent of all parties to the

9 communication, or in any unauthorized manner, reads, or attempts to read,

or to learn the contents or meaning of any message, report, or

10

communication while the same is in transit or passing over any wire, line, or

11 cable, or is being sent from, or received at any place within this state; or who

uses, or attempts to use, in any manner, or for any purpose, or to

12

communicate in any way, any information so obtained, or who aids, agrees

13 with, employs, or conspires with any person or persons to unlawfully do, or

permit, or cause to be done any of the acts or things mentioned above in this

14

section” [violates this section].

15

Cal. Penal Code § 631(a).

16

17 a) Party Exception

18 Defendant argues that Plaintiff cannot state a claim under section 631 because

19 Papa John’s was a party to the communication and any alleged interception is permitted

20 under the “party exception”. (Mot. at 13). Plaintiff asserts that the party exception does

21 not apply because the claim is based on derivative liability alleging that Defendant aided

22 and abetted FullStory, who is not a party to the communications. (Oppo. at 14).

23 “Courts perform the same analysis for both the Wiretap Act and CIPA regarding

24 the party exemption.” In re Facebook, Inc., v Internet Tracking Litigation, 956 F.3d 589,

25 607 (9th Cir. 2020). Only a third party can “eavesdrop” on a conversation, therefore a

26 party to the communication is exempt from liability under section 631. See Warden v.

27 Kahn, 99 Cal.App.3d 805, 811 (Ct. App. 1979). “The party exception must be considered

28 in the technical context of [a] case.” In re Facebook, 956 F.3d at 607. District courts in

1 California addressing the party exception have disagreed with Papa John’s argument:

2 “[I]t cannot be that anyone who receives a direct signal escapes liability by becoming a

3 party to the communication. Someone who presses up against a door to listen to a

4 conversation is no less an eavesdropper just because the sound waves from the next room

5 reach his ears directly.” Revitch v. New Moosejaw, LLC, 2019 WL 5485330, at *2 (N.D.

6 Cal. Oct. 23, 2019). In contrast, another Northern District of California court held that a

7 tracking service provider was considered a participant in the conversation under § 631(a)

8 because that defendant only stored user’s data and did not use or resell that data, unlike

9 the Moosejaw defendant. See Graham v. Noom, Inc., 533 F.Supp.3d 823, 833–34 (N.D.

10 Cal. Apr. 8, 2021). In Graham, the court reasoned that the tracking defendant provided a

11 tool, like a tape recorder, and therefore was not an eavesdropper. Id. at 833. Whether

12 FullStory acts akin to a tape recorder or whether its actions are closer to “an eavesdropper

13 standing outside the door” is a question of fact which is better answered after discovery

14 into the session replay technical context of the case. See In re Facebook, 956 F.3d at 607;

15 Yoon v. Lululemon USA, Inc., 1081 (C.D. Cal. 2021).

16 b) Intentional Wiretapping

17 According to Defendant, Plaintiff has not alleged that Defendant engaged in

18 intentional wiretapping under the first clause of section 631(a) because online

19 communications between a website and a visitor do not qualify. (Id. at 16). Plaintiff

20 counters that the second prong of section 631(a) applies to internet communication, citing

21 Javier, 2022 WL 1744107. (Oppo. at 16-17).

22 For Plaintiff to invoke the first clause of Section 631(a) which addresses

23 intentional wiretapping, he must allege facts plausibly showing that Papa John’s or its

24 vendor made an unauthorized connection with a “telegraph or telephone wire, line, cable,

25 or instrument.” Cal. Penal Code § 631(a). In an unpublished decision, the Ninth Circuit

26 has indicated that “Section 631(a) applies to Internet communications” despite being

27 written in terms of wiretapping. Javier, 2022 WL 1744107 at 1. In contrast, some district

28 courts in the Ninth Circuit have found that the first clause of Section 631(a) does not

1 apply to internet communications because the clause states that it applies only to

2 telegraphic or telephone wire communications. See Byars v. Hot Topic, Inc., 656

3 F.Supp.3d 1051, 1065 n.8 (C.D. Cal. Feb. 14, 2023).

4 In Javier, the Court initially addressed the second clause of Section 631(a) but

5 included language indicating that the holding applied to both clauses when it stated that

6 “[t]hough written in terms of wiretapping, §631(a) applies to internet communications.”

7 Javier, 2022 WL 1744107 at 1. Reading the first clause of Section 631 to apply only to

8 communications through a wire ignores the fact that a statute may be read to apply to new

9 technologies “where such a reading would not conflict with the statutory scheme.”

10 Matera v. Google, Inc., 2016 WL 8200619 (N.D. Cal. Aug. 12, 2016)(citing Apple Inc.,

11 v. Superior Court, 56 Cal.4th 128, 137 (2013)(“Fidelity to legislative intent does not

12 ‘make it impossible to apply a legal text to technologies that did not exist when the text

13 was created.... Drafters of every era know that technological advances will proceed apace

14 and that the rules they create will one day apply to all sorts of circumstances they could

15 not possibly envision.”) For purposes of the present motion, the Court finds that Plaintiff

16 has plausibly alleged a cause of action under the first clause of Section 631(a) and denies

17 Defendant’s motion to dismiss on this ground.

18 c) Contents of Communication

19 Finally, Defendant argues that the claim must be dismissed because Papa John’s

20 did not acquire the “contents” of a communication, as required under the second clause of

21 section 631. (Id. at 17-18).

22 For purposes of Section 631(a)’s second clause Plaintiff must allege that Papa

23 John’s or its vendor “read, or attempts to read, or to learn the contents or meaning of any

24 message, report, or communication.” Cal. Penal Code § 631(a). Courts analyzing CIPA

25 claims apply the same definitions for the federal Wiretap Act where appropriate. Saleh v.

26 Nike, Inc., 562 F.Supp.3d 503, 517 (C.D. Cal. 2021). “The Ninth Circuit has held that the

27 ‘contents’ of an online communication under federal wiretap law ‘refers to the intended

28 message conveyed by the communication, and does not include record information

1 regarding the characteristics of the message that is generated in the course of the

2 communication.’” Yoon, 549 F.Supp.3d at 1082 (citing In re Zynga Priv. Litig., 750 F.3d

3 1098, 1106 (9th Cir. 2014).

4 Here, Plaintiff asserted in the Complaint that:

5

[b]y using the spyware, Defendant and FullStory were able to learn much

6 more about Plaintiff and class members including the pages and content they

viewed, their scroll movements, words and text typed even if not fully

7

entered, copy and paste actions, search terms (including what pizza sold by

8 Defendant were available at the Genesee Avenue location in San Diego,

California) even if not fully entered, mouse clicks and movements,

9

keystrokes, and all other information related to the visit. Defendant tracked

10 and recorded similar communications of other Class Members.

11

(SAC at ¶ 42.)

12

Taking these allegations as true, the Court finds that Plaintiff has sufficiently

13

alleged that Defendant intercepts the contents of internet communication rather than

14

simply “record” information for purposes of the present motion. See Cahill, 80 F.3d 336,

15

337–38. For the above reasons, Plaintiff’s Complaint is sufficient to state a cause of

16

action under the second clause of Section 631(a) and the Court denies Defendant’s

17

motion to dismiss on this ground.

18

3. Second Cause of Action- Violation of California Invasion of Privacy Act-

19

California Penal Code 632.7

20

Defendant moves to dismiss Plaintiff’s second cause of action claiming that

21

Plaintiff does not allege the communication involved two telephones as required under

22

section 632.7. Further, Defendant argues that it is not clear whether the cell phone

23

Plaintiff used can be considered a “phone” within the meaning of Section 632.7 because

24

he used it as a smartphone with mobile browsing functionality to access the website.

25

(Mot. at 19).

26

Section 632.7 imposes liability on anyone who aids in the interception and

27

intentional recording of “a communication transmitted between two cellular radio

28

1 telephones, a cellular radio telephone and a landline telephone, two cordless telephones, a

2 cordless telephone and a landline telephone, or a cordless telephone and a cellular radio

3 telephone.” In interpreting a California statute, the Court “first looks to the language of

4 the statute, giving effect to the words’ plain meaning; ‘if the language is unambiguous,

5 the plain meaning controls.’” Gonzales v. CarMax Auto Superstores, LLC, 840 F.3d 644,

6 650 (9th Cir. 2016) (quoting Voices of the Wetlands v. State Water Res. Control Bd., 257

7 P.3d 81, 93 (2011)). “A statute's plain meaning, however, cannot be determined without

8 reference to the context in which the words are used.” Id.

9 The Court finds that the plain language of section 632.7 limits the applicability of

10 the statute to communications between certain types of telephones, not the internet, and

11 Plaintiff did not allege that the communication was between two telephones as required

12 by statute. See Garcia v. Build.com, Inc., No. 22-CV-01985-DMS-KSC, 2023 WL

13 4535531, at *6 (S.D. Cal. July 13, 2023) (dismissing a section 632.7 claim where

14 “Plaintiff makes no persuasive argument that the statute contemplates internet

15 communications between a smart phone and an unspecified device on Defendant's end”

16 (quotation omitted)). Indeed, “[t]ransmission by internet through a device called ‘phone’

17 is not sufficient.” Id. Accordingly, Defendant's motion to dismiss Plaintiff's second cause

18 of action is granted with leave to amend. See Knappenberger v. City of Phoenix, 566 F.3d

19 936, 942 (9th Cir. 2009) (“Leave to amend should be granted unless the district court

20 determines that the pleading could not possibly be cured by the allegation of other facts.”

21 (quotation omitted)).

22 C. Standing for Injunctive Relief

23 Defendant argues that Plaintiff lacks standing to seek injunctive relief because he

24 does not and cannot allege he will again visit the Papa John’s website without knowing

25 about its use of session replay technology, therefore he cannot be wronged again in the

26 manner alleged in the SAC. (Mot. at 20).

27

28

1 To successfully assert a claim for injunctive relief, a plaintiff must contend that,

2 despite knowledge of the asserted violative conduct, he or she may suffer an “actual and

3 imminent” threat of future harm. See Graham, 533 F.Supp.3d at 836.

4 [A] previously deceived consumer may have standing to seek an injunction

against false advertising or labeling, even though the consumer now knows

5

or suspects that the advertising was false at the time of the original purchase,

6 because the consumer may suffer an “actual and imminent, not conjectural

or hypothetical” threat of future harm. Knowledge that the advertisement or

7

label was false in the past does not equate to knowledge that it will remain

8 false in the future. In some cases, the threat of future harm may be the

consumer's plausible allegations that she will be unable to rely on the

9

product's advertising or labeling in the future, and so will not purchase the

10 product although she would like to.

11

Davidson v. Kimberley-Clark Corporation, 889 F.3d 956, 969 (9th Cir. 2018)(internal

12

citations omitted).

13

Plaintiff has not sufficiently alleged that he and the class he seeks to represent

14

intend to visit the site in the future. The Complaint merely avers that “The past invasions

15

were actual and future invasions are imminent and will occur next time Plaintiff visits

16

Defendant’s website.” (SAC at ¶ 92). Plaintiff’s request for injunctive relief is dismissed

17

with leave to amend.

18

//

19

//

20

//

21

//

22

//

23

//

24

//

25

//

26

//

27

//

28

1 IV. CONCLUSION AND ORDER

2 For the forgoing reasons, Defendant's motion to dismiss Plaintiff's complaint for

3 || lack of personal jurisdiction is DENIED. Further, Defendant’s motion to dismiss the first

4 || cause of action for violation of section 631 of the California Penal Code is DENIED.

5 || Defendant's motion to dismiss Plaintiff's second cause of action for violation of section

6 || 632.7 of the California Penal Code is GRANTED with leave to amend. Defendant’s

7 motion to dismiss Plaintiff's request for injunctive relief is GRANTED and the claim is

8 || dismissed with leave to amend.

9 IT IS SO ORDERED.

10 || Dated: January 12, 2024

fee Soop

12 H . James Lorenz,

3 United States District Judge

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

1°