# A.B., a minor, by and through his guardian JEN TURNER v. GOOGLE LLC

> District Court, N.D. California · June 18, 2024

URL: https://www.frixlaw.com/law-library/cases/10638544

## Case

- **Court:** District Court, N.D. California
- **Decided:** June 18, 2024
- **Opinion:** 100trialcourt
- **Cited by:** 0 later opinions in the Frix Law Library

## Citator (automated)

- No negative treatment found by the automated citator. That is not the same as a confirmation that the case is good law; read the citing cases.
- Full citator and citing cases: https://www.frixlaw.com/law-library/cases/10638544

## How later opinions describe it (automated extraction)

- noting that a plaintiff must “establish a loss or deprivation of money or property 12 sufficient to qualify as injury in fact, i.e., economic injury” to assert a UCL claim

## Opinion text

1
2
3
4 UNITED STATES DISTRICT COURT
5 NORTHERN DISTRICT OF CALIFORNIA
6
7 A.B., A MINOR, BY AND THROUGH HIS Case No. 23-cv-03101-PCP
GUARDIAN JEN TURNER, et al.,
8
Plaintiffs, ORDER DENYING MOTION TO
9 DISMISS
v.
10 Re: Dkt. No. 27
GOOGLE LLC, et al.,
11
Defendants.

12
13 Plaintiffs, six minors under the age of 13 domiciled in California, Florida, and New York,
14 allege that defendants Google LLC, AdMob Google Inc., and AdMob Inc. unlawfully invaded
15 their privacy by collecting their personal information through various mobile apps without
16 parental consent. The defendants now move to dismiss plaintiffs’ complaint pursuant to Federal
17 Rule of Civil Procedure 12(b)(6). For the following reasons, the defendants’ motion is denied.
18 BACKGROUND
19 Google maintains a marketplace for Android mobile phone apps called the Google Play
20 Store, where AdMob Google and AdMob (both owned by Google) show advertisements to users
21 of such apps.1 The AdMob software development kit (SDK) purportedly enables Google to collect
22 data from Android app users and show them targeted advertisements based on this data. AdMob
23 allegedly pays Android app developers to integrate its SDK into their mobile apps to make this
24 data collection and targeted advertising possible.
25 In April 2015, Google developed a Designed for Families (DFF) program for children’s
26
1 The following facts are drawn from the complaint. In considering a Rule 12(b)(6) motion
27
contending that a complaint fails to state a claim, the Court must “accept all factual allegations in
1 apps, which purportedly imposed requirements set by the federal Children’s Online Privacy
2 Protection Act (COPPA) to protect children under the age of 13 from having their personal
3 information collected without parental consent. COPPA states: “It is unlawful for an operator of a
4 website or online service directed to children, or any operator that has actual knowledge that it is
5 collecting personal information from a child, to collect personal information from a child in a
6 manner that violates the regulations prescribed [by the Federal Trade Commission].” 15 U.S.C. §
7 6502(a). The FTC has interpreted “website or online service” to include mobile apps as well as
8 individual channels like the Google Play Store that serve as the platform for such apps. 16 C.F.R.
9 § 312.2. The relevant FTC rule has interpreted “directed to children” to mean that data cannot be
10 collected through apps that are primarily child-directed or for mixed audiences but not properly
11 age-gated.
12 In 2018, security researchers from the University of California, Berkeley purportedly
13 informed defendants of surreptitious tracking and data collection in violation of COPPA by
14 developers of apps included in Google’s DFF program. Specifically, the researchers found that
15 2,667 apps were potentially incorrectly characterized by developers as directed to “mixed
16 audiences” or “not primarily directed to children,” allowing developers to engage in defective age-
17 gating and thus participate in prohibited behavioral advertising to children. Dkt. No. 1, at 36.
18 Based on the results of this study, Google banned the app developer Tiny Lab Productions from its
19 Play Store in September 2018. The New Mexico Attorney General’s Office then brought a lawsuit
20 against Tiny Lab Productions, various advertising networks including AdMob, and Google as the
21 operator of the Play Store. N.M. ex rel. Balderas v. Tiny Lab Prods., 457 F. Supp. 3d 1103
22 (D.N.M. 2020). On December 10, 2021, as part of a settlement agreement and without admitting
23 any liability, Google and AdMob agreed to implement policy changes to prevent the
24 mischaracterization of DFF apps. Dkt. No. 27, at 12.
25 Plaintiffs here allege that defendants obtained personal information from children under
26 the age of 13 through Android apps in violation of COPPA and other common law privacy
27 protections. Google purportedly accepted children’s apps (including 86 from the app developer
1 categorized as for a “mixed audience” or “not primarily intended for children” without proper age-
2 gating, thereby enabling developers to skirt COPPA’s prohibitions on collecting data from minors
3 under the age of 13. Dkt. No. 1, at 30. Plaintiffs further allege that defendants knew about the
4 collection of personal data from children through DFF program apps. Plaintiffs assert the
5 following causes of action: (1) violation of California’s Unfair Competition Law (UCL); (2)
6 violation of common law intrusion upon seclusion; (3) unjust enrichment under California law; (4)
7 violation of California’s constitutional right to privacy; (5) violation of Florida’s Deceptive and
8 Unfair Trade Practices Act (FDUTPA); (6) unjust enrichment under Florida law; (7) violation of
9 New York’s General Business Law (NYGBL); and (8) unjust enrichment under New York law.
10 Plaintiffs’ claims under the UCL, FDUTPA, and NYGBL are all premised on an underlying
11 COPPA violation.
12 Defendants now move to dismiss plaintiffs’ complaint, contending that the purported
13 unlawful conduct only pertains to developer Tiny Lab Productions, which was banned from the
14 Google Play Store in September 2018. Defendants also argue that plaintiffs: (1) fail to provide fair
15 notice under Rule 8 because they do not allege when the supposed misconduct occurred and most
16 of the state law claims have statutes of limitations between 2 to 4 years; (2) lack standing to seek
17 prospective injunctive relief because they do not demonstrate a threat of being harmed again; (3)
18 cannot assert any state law claims because they are preempted by COPPA; (4) fail to state a claim
19 under the UCL because they have not established an economic injury, do not allege wrongful
20 conduct under any of the three prongs, and are not entitled to equitable relief; (5) fail to state a
21 claim under New York and Florida’s consumer protection laws because Google’s Terms of
22 Service contain a California choice-of-law provision and plaintiffs do not plead claims with
23 particularity or provide a sufficient nexus to New York and Florida; (6) fail to state claims for
24 common law and constitutional right to privacy violations under California law because they do
25 not allege egregious conduct violating a reasonable expectation of privacy; and (7) fail to state a
26 claim for unjust enrichment because this cause of action does not exist.
27
1 LEGAL STANDARDS
2 The Federal Rules require a complaint to include only a “short and plain statement of the
3 claim showing that the pleader is entitled to relief.” Fed. R. Civ. P. 8(a)(2). In considering a Rule
4 12(b)(6) motion contending that a complaint fails to state a claim, the Court must “accept all
5 factual allegations in the complaint as true and construe the pleadings in the light most favorable”
6 to the non-moving party. Rowe v. Educ. Credit Mgmt. Corp., 559 F.3d 1028, 1029 (9th Cir. 2009).
7 Dismissal is required if the plaintiff fails to allege facts allowing the Court to “draw the reasonable
8 inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662,
9 663 (2009). While legal conclusions “can provide the complaint’s framework,” the Court will not
10 assume they are correct unless adequately “supported by factual allegations.” Id. at 664.
11 On a Rule 12(b)(6) motion, materials outside the complaint can be considered only if they
12 are incorporated by reference therein or otherwise judicially noticeable. See United States v.
13 Ritchie, 342 F.3d 903, 908 (9th Cir. 2003) (“A [district] court may … consider certain materials—
14 documents attached to the complaint, documents incorporated by reference in the complaint, or
15 matters of judicial notice—without converting the motion to dismiss into a motion for summary
16 judgment.”). Incorporation by reference is permitted if the complaint “refers extensively to the
17 document” or if “the document forms the basis” of the claim. Khoja v. Orexigen Therapeutics,
18 Inc., 899 F.3d 988, 1002 (9th Cir. 2018). Federal Rule of Evidence 201 permits judicial notice of
19 “a fact that is not subject to reasonable dispute” because it is “generally known.”
20 Fraud-based claims are subject to the heightened pleading requirements established by
21 Federal Rule of Civil Procedure 9(b) instead of the more lenient Rule 8 standard. When “alleging
22 fraud or mistake, a party must state with particularity the circumstances constituting fraud or
23 mistake.” Fed. R. Civ. P. 9(b). The pleading of fraud must be “specific enough to give defendants
24 notice of the particular misconduct … so that they can defend against the charge and not just deny
25 that they have done anything wrong.” Vess v. Ciba-Geigy Corp. USA, 317 F.3d 1097, 1106 (9th
26 Cir. 2003). Malice, intent, and knowledge may be alleged generally, however. Fed. R. Civ. P. 9(b).
27
1 ANALYSIS
2 I. Plaintiffs’ Claims Are Not Time-Barred.
3 Defendants argue that because Tiny Lab was banned from the Google Play Store in
4 September 2018, more than 4 years before this complaint was filed on June 6, 2023, plaintiffs’
5 claims are time-barred.2 Plaintiffs respond that while the AdMob SDK was discovered in DFF
6 program children’s apps in 2018, Google did not remedy this conduct until December 10, 2021,
7 when it reached a settlement agreement with the New Mexico Attorney General’s Office to
8 prevent further mischaracterization of child-targeted DFF apps as apps for “mixed audiences.”
9 Dkt. No. 33, at 14. Accordingly, plaintiffs argue, the COPPA violations that form the primary
10 basis for their claims continued through 2021 in apps by developers other than Tiny Lab. Plaintiffs
11 also contend that even if Tiny Lab was banned from the Google Play Store in September 2018,
12 apps by Tiny Lab were not deleted from children’s phones so tracking and data collection through
13 such apps could have continued past 2018. Id. at 15 (noting that collection of plaintiffs’
14 information through AdMob’s SDK also occurs “during the use of the already-downloaded DFF
15 AdMob Apps”).
16 In the Ninth Circuit, the statute of limitations is generally an affirmative defense rather
17 than an element of the plaintiff’s claim. See Lasko v. Caliber Home Loans, 2022 WL 728820, at
18 *1 (9th Cir. Mar. 10, 2022) (noting that “a statute of limitations is an affirmative defense, not a
19 cause of action”) (citing United States v. Allahyari, 980 F.3d 684, 686 (9th Cir. 2020)). As a
20 result, the defense generally cannot be asserted on a Rule 12(b)(6) motion. “If the running of the
21 statute is apparent on the face of the complaint,” however, “the defense may be raised by a motion
22 to dismiss.” Jablon v. Dean Witter & Co., 614 F.2d 677, 682 (9th Cir. 1980). “When a motion to
23 dismiss is based on the running of the statute of limitations, it can be granted only if the assertions
24 of the complaint, read with the required liberality, would not permit the plaintiff to prove that the
25 statute was tolled” or that the claims were timely. Id. Thus, to survive a motion to dismiss,
26
2 The fact that Google banned Tiny Lab from its Play Store in September 2018 is judicially
27
noticeable because plaintiffs explicitly reference a news article saying as much in their complaint.
1 plaintiffs “simply need to plead facts demonstrating a potential factual dispute that could affect
2 whether the defense applies.” Rabin v. Google LLC, 2024 WL 1269313, at *2 (N.D. Cal. Mar. 26,
3 2024). “Only when the plaintiff pleads itself out of court—that is, admits all the ingredients of an
4 impenetrable defense—may a complaint that otherwise states a claim be dismissed under Rule
5 12(b)(6).” Durnford v. MusclePharm Corp., 907 F.3d 595, 604 (9th Cir. 2018).
6 Plaintiffs’ complaint here, when construed liberally, pleads facts demonstrating a potential
7 factual dispute by sufficiently alleging that defendants’ purportedly unlawful conduct continued
8 within the relevant statute-of-limitations period. Specifically, the complaint alleges that minors
9 were tracked through various Android apps in Google’s DFF program, not just Tiny Lab’s apps.
10 The fact that Tiny Lab was removed from the Google Play Store in 2018 therefore does not on its
11 own render plaintiffs’ claims time-barred. Further, plaintiffs allege that unlawful tracking
12 continued to occur through 2021 on the devices of children who had downloaded Tiny Lab apps
13 before its 2018 removal from the Google Play Store because the apps were not deleted from their
14 devices.
15 Because plaintiffs allege that unlawful tracking and advertising was occurring through
16 Android apps at least until 2021, defendants cannot establish, from the face of the complaint, that
17 plaintiffs’ claims are time-barred.3
18 II. Plaintiffs Have Standing To Seek Injunctive Relief.
19 Defendants argue that plaintiffs lack standing to seek injunctive relief because they fail to
20 establish a “real or immediate threat that [they] will again be wronged in a similar way.” Mayfield
21 v. United States, 599 F.3d 964, 970 (9th Cir. 2010). “Past exposure to illegal conduct does not in
22 itself show a present case or controversy regarding injunctive relief … if unaccompanied by any
23 continuing, present adverse effects.” O’Shea v. Littleton, 414 U.S. 488, 495–96 (1974). Because
24 Google purportedly altered its policies concerning the characterization of apps in the DFF program
25

26
3 Defendants cite statutes of limitations ranging between 2 and 4 years for the various causes of
action. Dkt. No. 27, at 15 n.5. Because the settlement with the New Mexico Attorney General’s
27
Office occurred in December 2021 and the complaint was filed in June 2023, even claims with a
1 through its settlement with the New Mexico Attorney General’s Office in 2021, defendants
2 contend that plaintiffs fail to allege any continuing harm to warrant injunctive relief.
3 The defendants may be correct that plaintiffs lack standing to seek prospective changes to
4 Google’s DFF program policies. But plaintiffs also request that defendants “permanently delete,
5 destroy or otherwise sequester the Personal Information collected without parental consent.” Dkt.
6 No. 1, at 63. Notwithstanding any change in defendants’ DFF policies, defendants have not
7 provided evidence that the information purportedly collected from minors before the 2021
8 settlement has been deleted. Dkt. No. 33, at 33. Because the harm from defendants’ alleged
9 possession and use of plaintiffs’ information purportedly continues, plaintiffs have standing to
10 seek injunctive relief to remedy that harm.
11 III. Plaintiffs’ State Law Claims Are Not Preempted by COPPA.
12 Defendants argue that plaintiffs’ state law claims are preempted by COPPA because those
13 claims are inconsistent with the federal statute. The FTC’s COPPA Rule requires a defendant to
14 have “actual knowledge” that data is being collected from apps that are primarily child-directed or
15 relevant to mixed audiences but not properly age-gated. 16 C.F.R. § 312.2. Defendants argue that
16 plaintiffs fail to meet this actual knowledge requirement because they only allege in a conclusory
17 manner that “Google had actual knowledge that every DFF App was ‘child directed’ as defined
18 under COPPA.” Dkt. No. 1, at 33. Defendants also contend that plaintiffs’ state law claims are too
19 broad because the fact that DFF apps were deemed “appropriate for children” per Google’s
20 policies did not mean that they were “directed to children” under COPPA’s statutory definition.
21 The Ninth Circuit recently held in a similar case that the same causes of action being
22 pursued here were not preempted by COPPA because they did not “stand as an obstacle to
23 COPPA in purpose or effect” and were “consistent with COPPA.” Jones v. Google LLC, 73 F.4th
24 636, 643 (9th Cir. 2023). The Jones Court found that COPPA does not preempt “state-law causes
25 of action that are parallel to, or proscribe the same conduct forbidden by, COPPA.” Id. The Court
26 explained that COPPA does not preempt “state law claims based on underlying conduct that also
27 violates COPPA’s regulations.” Id. at 640–41.
1 because plaintiffs fail to sufficiently plead that defendants had actual knowledge about data
2 collection through apps that were directed to children, and thus do not allege an underlying
3 COPPA violation but instead seek to hold the defendants liable for conduct that does not violate
4 COPPA’s regulations.
5 Defendants may or may not be right that state law claims permitting liability to be
6 established absent actual knowledge are preempted by COPPA.4 Contrary to the defendants’
7 contentions, however, plaintiffs have adequately pleaded actual knowledge. As noted already,
8 plaintiffs specifically allege that “Google had actual knowledge that every DFF App was ‘child
9 directed’ as defined under COPPA.” Dkt. No. 1, at 33; see Fed. R. Civ. P. 9(b) (noting that
10 knowledge may be alleged generally). They have also pleaded facts plausibly supporting this
11 allegation. Plaintiffs allege that defendants were made aware by security researchers at Berkeley
12 that 2,667 DFF apps (~51% of the apps in their sample) were incorrectly listed as directed to
13 “mixed audiences” and “not primarily directed to children.” Dkt. No. 1, at 36. The researchers
14 noted that developers were miscategorizing their apps and then engaging in defective age-gating,
15 thereby collecting data from minors under the age of 13 in violation of COPPA. The researchers
16 used 84 Tiny Lab apps as a case study to show evidence of this behavior. Because plaintiffs allege
17 that Google was informed of this study, plaintiffs at the very least adequately plead that Google
18 had actual knowledge of Tiny Lab’s purportedly unlawful behavior (which, as previously noted,
19 allegedly continued to permit tracking and data collection until 2021).
20 Plaintiffs also allege that Google “reviewed each DFF App submission to ensure that the
21 App provided a specific benefit to children under thirteen or was relevant to children under
22 thirteen.” Dkt. No. 1, at 32. As plaintiffs note, Google’s 2015 DFF program policy stated that
23 “[g]eneral audience apps that have no specific benefit or relevance for audiences under the age of
24 thirteen will not be accepted into the program. To participate, there are specific guidelines your
25 apps need to meet, which are assessed in an app content review.” Dkt. No. 1, at 27–28 (emphasis
26

27
4 Because plaintiffs have adequately pleaded actual knowledge, the Court will not decide that issue
1 added). Assuming that Google reviewed every app for compliance with COPPA before accepting
2 it into the DFF program, plaintiffs sufficiently allege that Google had actual knowledge that
3 certain apps were being mischaracterized as for “mixed audiences” when they were in fact child-
4 directed.
5 Taken together, plaintiffs’ allegations about the Berkeley study and Google’s
6 individualized review of each app submitted to the DFF program adequately plead that defendants
7 had actual knowledge of the purported misconduct. The District of New Mexico held as much in
8 its related 2020 case:

9 Putting it all together, these facts state that: Google reviews the
content of apps submitted to its Designed for Families program with
10 a particular eye toward whether the apps are relevant for children;
Tiny Lab’s apps, replete with characteristics revealing their child-
11 directed content, were submitted to and accepted by Google into that
program; and, after being contacted by concerned [Berkeley]
12 researchers, Google reviewed the content of Tiny Lab’s apps with the
specific goal of determining whether they were primarily directed to
13 children. The reasonable inference to be drawn from these facts is that
Google conducted not one but two reviews of the content of Tiny
14 Lab’s apps, during which Google gained (and gained again) a first-
hand awareness or understanding of the child-directed nature of those
15 apps. The Complaint thus plausibly claims that, first through its
review process in connection with the submission of Tiny Lab’s apps
16 to its Designed for Families program and again through its
investigation of those apps to determine whether they were primarily
17 child-directed, Google obtained actual knowledge that Tiny Lab’s
apps are directed to children.
18
19 Balderas, 457 F. Supp. 3d at 1107.5 Similarly here, plaintiffs sufficiently allege that defendants
20 had actual knowledge, generated through its internal review process and the Berkeley study, that
21 apps directed to children in the DFF program had been instead characterized as for mixed
22 audiences and were using the AdMob SDK to track and collect data. Because plaintiffs adequately
23 plead an underlying COPPA violation, their state law claims proscribing the same conduct are not
24

25
5 Google moved for reconsideration, but the Court denied its motion in 2021. See N.M. ex rel.
Balderas v. Tiny Lab Prods, 516 F. Supp. 3d 1293, 1301 (D.N.M. 2021) (“Reading these
26
allegations together, the factual content of the Complaint plausibly alleges that, first through its
review process in connection with the submission of Tiny Lab’s apps to its Designed for Families
27
program and again through its investigation of those apps to determine whether they were
1 preempted by COPPA.
2 IV. Plaintiffs Adequately Plead a UCL Claim.
3 California’s Unfair Competition Law (UCL) prohibits unfair competition, which means
4 “any unlawful, unfair, or fraudulent business act or practice and unfair, deceptive, untrue, or
5 misleading advertising.” Cal. Bus. & Prof. Code § 17200. When assessing a UCL claim, courts
6 consider each of three prongs—unlawful, fraudulent, and unfair—to determine whether a practice
7 constitutes unfair competition, and “a claim that sufficiently pleads any of these prongs survives a
8 motion to dismiss.” MacDonald v. Ford Motor Co., 37 F. Supp. 3d 1087, 1097 (N.D. Cal. 2014).
9 Defendants first contend that plaintiffs lack standing to bring a UCL claim because they
10 have not alleged an economic injury. See Turner v. Wells Fargo Bank NA, 859 F.3d 1145, 1151
11 (9th Cir. 2017) (noting that a plaintiff must “establish a loss or deprivation of money or property
12 sufficient to qualify as injury in fact, i.e., economic injury” to assert a UCL claim). In their view,
13 the misappropriation of personal information does not qualify. Pruchnicki v. Envision Healthcare
14 Corp., 845 F. App’x 613, 615 (9th Cir. 2021) (holding that “mere misappropriation of personal
15 information does not establish compensable damages”); see also In re Google, Inc. Privacy Pol’y
16 Litig., 2015 WL 4317479, at *5 n.63 (N.D. Cal. Jul. 15, 2015) (finding the misappropriation of
17 personal information without a resultant economic harm to be neither damage nor injury-in-fact).
18 There is a split of authority in this District on this issue and no binding Ninth Circuit
19 precedent. Compare In re Facebook Privacy Litig., 791 F. Supp. 2d 705, 714 (N.D. Cal. 2011),
20 aff’d 572 F. App’x 494 (9th Cir. 2014) (“[P]ersonal information does not constitute property for
21 purposes of a UCL claim.”) and M.K. v. Google LLC, 2023 WL 2671381, at *5 (N.D. Cal. Mar.
22 27, 2023) (same) with Calhoun v. Google LLC, 526 F. Supp. 3d 605, 636 (N.D. Cal. 2021)
23 (concluding that “plaintiffs who suffered a loss of their personal information suffered economic
24 injury and had standing”) and Brown v. Google LLC, 2021 WL 6064009, at *15 (N.D. Cal. Dec.
25 22, 2021) (finding the loss of personal information through Google’s data collection as sufficient
26 to qualify as the diminution of a future property interest).
27 Notwithstanding decisions in this District holding otherwise, see, e.g., Katz-Lacabe v.
1 with the rationale of Calhoun and Brown and concludes that plaintiffs have adequately pleaded the
2 economic injury needed to establish UCL standing. As the Court has previously held, “Privacy
3 harms involving personal data can constitute an injury to money or property sufficient to provide
4 standing under the UCL.” In re Meta Pixel Tax Filing Cases, 2024 WL 1251350, at *24 (N.D.
5 Cal. Mar. 25, 2024) (noting that privacy harms can constitute economic injury to confer UCL
6 standing under three theories: unfair benefit-of-the-bargain to businesses who violate user
7 expectations about how their data will be used, diminished value of personal information, and
8 reduced right to exclude others from accessing personal data).
9 In Brown, the Court noted it was plausible that plaintiffs would “decide to sell their data at
10 some point,” and because Google obtained the data and sold it to advertisers, Google diminished
11 plaintiffs’ “future property interest.” 2021 WL 6064009, at *15. Similarly, plaintiffs here
12 recognize that there is a market for their data, alleging in their complaint that “there is a market for
13 consumers to monetize Personal Information and the behavioral preferences that Defendants have
14 usurped.” Dkt. No. 1, at 47 (citing studies placing a value of $200 on an individual’s personal
15 information). Because plaintiffs allege that they can “no longer realize the full economic value of
16 their Personal Information” due to the data collection by defendants, they adequately plead an
17 economic injury resulting from defendants’ purported misconduct. Id. at 48. Accordingly, they
18 have sufficiently alleged that they “lost money or property as the result of the unfair competition,”
19 as is required to establish standing under the UCL. Cal. Bus. & Prof. Code § 17204.
20 Defendants separately argue that plaintiffs fail to adequately plead a UCL violation under
21 either of the three prongs. Because the Court finds that plaintiffs sufficiently alleged an underlying
22 COPPA violation, however, they have adequately pleaded a UCL claim under at least the unlawful
23 prong.
24 V. Plaintiffs Adequately Plead Violations of New York and Florida Statutes.
25 The New York General Business Law (NYGBL) states, “Deceptive acts or practices in the
26 conduct of any business, trade or commerce or in the furnishing of any service in this state are
27 hereby declared unlawful.” N.Y. Gen. Bus. Law § 349(a). An NYGBL claim consists of three
1 misleading in a material way; and third, that the plaintiff suffered injury as a result of the
2 deceptive act.” Boris v. Wal-Mart Stores, Inc., 35 F. Supp. 1163, 1173 (C.D. Cal. 2014). “Whether
3 a representation or omission is a deceptive act or practice depends on the likelihood that it will
4 mislead a reasonable consumer acting reasonably under the circumstances.” Id. (citation omitted).
5 The Florida Deceptive and Unfair Trade Practices Act (FDUTPA) prohibits “[u]nfair
6 methods of competition, unconscionable acts or practices, and unfair or deceptive acts or practices
7 in the conduct of any trade of commence.” Fla. Stat. § 501.204(1). “A consumer claim for
8 damages under FDUTPA has three elements: (1) a deceptive act or unfair practice; (2) causation;
9 and (3) actual damages.” Parziale v. HP, Inc., 445 F. Supp. 3d 435, 442 (N.D. Cal. 2020). “An
10 unfair practice is one that offends established public policy and one that is immoral, unethical,
11 oppressive, unscrupulous or substantially injurious to consumers.” In re Carrier IQ, Inc., 78 F.
12 Supp. 3d 1051, 1119 (N.D. Cal. 2015). A deceptive act “occurs if there is a representation,
13 omission, or practice that is likely to mislead consumers acting reasonably in the circumstances, to
14 the consumer’s detriment.” Id. (citations and internal quotations omitted).
15 Defendants argue that plaintiffs’ causes of action under the NYGBL and FDUTPA must
16 fail because Google’s Terms of Service contain a California choice-of-law provision. They also
17 contend that the claims are not pleaded with particularity and lack a sufficient nexus to New York
18 and Florida. The Court disagrees.
19 First, the Court cannot hold at this stage that the California choice-of-law provision applies
20 because defendants’ argument depends upon Google’s Terms of Service, which are not properly
21 cognizable on this Rule 12(b)(6) motion. Dkt. No. 29-4. Those Terms of Service are neither
22 incorporated by reference in the complaint nor judicially noticeable. See Urban v. Tesla, Inc.,
23 2023 WL 6796021, at * 3 (N.D. Cal. Oct. 13, 2023) (holding that defendant’s evidence of a
24 choice-of-law provision in a purported purchase agreement “outside the four corners of the
25 complaint” “must be disregarded” under Rule 12(b)(6)). And even if the Terms of Service were
26 judicially noticeable, defendants fail to show that plaintiffs actually agreed to these specific Terms
27 when downloading Android apps from the Google Play Store. The Terms presented by defendants
1 consented to these Terms when they downloaded apps through the DFF program in 2021 and
2 before. See, e.g., Weizman v. Talkspace, Inc., 2023 WL 8461173, at *5 (N.D. Cal. Dec. 6, 2023)
3 (holding that defendants’ undated screenshot showing its Terms as clickwrap at the sign up page
4 fails to establish that plaintiffs consented to those Terms). Because defendants cannot introduce
5 Google’s Terms of Service at this juncture and fail to show that plaintiffs agreed to those Terms,
6 the California choice-of-law provision therein does not bar plaintiffs’ New York and Florida
7 claims for purposes of this Rule 12(b)(6) motion.
8 Second, plaintiffs adequately plead their NYGBL and FDUTPA claims, even under Rule
9 9(b)’s heightened pleading standard.6 Both the NYGBL and FDUTPA require a deceptive act that
10 misleads consumers and causes them to suffer an injury. As discussed above in the context of
11 UCL standing, plaintiffs have adequately pleaded that they suffered an economic injury. The
12 remaining question, therefore, is whether plaintiffs have pleaded with particularity that defendants
13 engaged in a deceptive act that resulted in said injury. Plaintiffs specifically allege that “Google
14 broadly promoted, marketed, and represented in numerous ways that the DFF program and the
15 Apps included in the program [were] suitable and safe and designed for children and legally
16 compliant,” citing relevant provisions from Google’s 2015 DFF policy and 2018 DFF eligibility
17 requirements. Dkt. No. 1, at 70, 78. By pointing out specific statements made by defendants about
18 the suitability of DFF apps for children, and adequately pleading with circumstantial evidence that
19 defendants had actual knowledge about the mischaracterization of child-directed apps on the
20 platform, plaintiffs sufficiently allege that defendants made representations likely to mislead
21 reasonable consumers. By making consumers feel as though children’s personal information was
22
6 Defendants argue that plaintiffs must plead their consumer protection statute claims with
23
particularity because they sound in fraud. Dkt. No. 27, at 26. The Second Circuit, however, has
held that “an action under § 349 is not subject to the pleading-with-particularity requirements of
24
Rule 9(b) … but need only meet the bare bones notice-pleading requirements of Rule 8(a).”
Pelman ex rel. Pelman v. McDonald’s Corp., 396 F.3d 508, 511 (2d Cir. 2005). And “[f]ederal
25
district courts are split as to whether FDUTPA claims are subject to the heightened pleading
requirements of Rule 9(b).” Parziale, 445 F. Supp. 3d at 442; see also Griffey v. Magellan Health
26
Inc., 562 F. Supp. 3d 34, 54 (N.D. Cal. 2021) (“There is a district split about whether Rule 9(b)
applies to the Florida DUTPA. But … where the gravamen of the claims sounds in fraud … Rule
27
9(b) applies.”). Because the Court concludes that plaintiffs satisfy Rule 9(b), it need not decide
1 not being collected through DFF program apps, defendants encouraged plaintiffs to download and
2 use the DFF apps, which resulted in the purportedly unlawful collection of data and subsequent
3 advertising targeted toward minors.
4 Third, defendants argue that plaintiffs did not plead a sufficient nexus to New York or
5 Florida. But plaintiffs residing in New York and Florida allege that they used the DFF apps while
6 in those states and they were presumably injured by the alleged misconduct in those states. Dkt.
7 No. 1, at 69 (alleging that plaintiffs C.D.1, C.D.2, and C.D.3 “are or were residents of Florida
8 and/or used the Apps in Florida”); id. at 77 (alleging that plaintiffs E.F.1 and E.F.2 “are or were
9 residents of New York and/or used the Apps in New York”). This provides a sufficient nexus for
10 the purposes of Rule 12(b)(6).
11 VI. Plaintiffs Adequately Plead California Privacy Claims.
12 To state a claim for invasion of privacy under California law, a plaintiff must allege (1) a
13 legally protected privacy interest; (2) a reasonable expectation of privacy under the circumstances;
14 and (3) a serious invasion of the protected privacy interest. Hill v. Nat’l Collegiate Athletic Assn.,
15 7 Cal. 4th 1, 6 (1994). Stating a claim for intrusion upon seclusion in California requires a
16 showing that the defendant (1) intruded into a private place, conversation or matter, (2) in a
17 manner highly offensive to a reasonable person. Taus v. Loftus, 40 Cal. 4th 683, 725 (2007). As
18 summarized by the Ninth Circuit, both claims are plausibly alleged where (1) there exists a
19 reasonable expectation of privacy, and (2) the intrusion was highly offensive. In re Facebook, Inc.
20 Internet Tracking Litig., 956 F.3d 589, 601 (9th Cir. 2020).
21 Defendants first argue that plaintiffs fail to allege that they have a legally protected interest
22 in their personal information. But as discussed above, plaintiffs have a property interest in their
23 data.
24 Defendants also argue that Google’s Privacy Policy discloses that Google engages in
25 interest-based advertising and shares non-personally identifiable information with advertising
26 partners, undermining any expectation of privacy. Dkt. No. 27, at 28. As already discussed,
27 however, defendants cannot establish, for purposes of this motion, that plaintiffs actually saw or
1 guidelines, which state that ads “displayed to child audiences do not involve interest-based
2 advertising.” Dkt. No. 1, at 4, 23. Given the legal bar on interest-based advertising for the
3 narrower class of DFF children’s apps, the minor plaintiffs have adequately pleaded that they had
4 a reasonable expectation of privacy in their personal information notwithstanding any general
5 disclosure by Google about potential interest-based advertising and data collection they might
6 have seen. These facts stand in contrast to cases cited by defendants that only involve a general
7 disclosure provision. See, e.g., Smith v. Facebook, Inc., 745 F. App’x 8, 9 (9th Cir. 2018)
8 (dismissing intrusion upon seclusion claim given users’ acquiescence to policies disclosing data
9 collection practices).
10 Defendants also argue that the purported intrusion into plaintiffs’ reasonable expectation of
11 privacy was not highly offensive. Under California law, an intrusion must constitute “an egregious
12 breach of the social norms underlying the privacy right” to be actionable. Folgelstrom v. Lamps
13 Plus, Inc., 195 Cal. App. 4th 986, 992 (Cal. Ct. App. 2011). By surreptitiously collecting data
14 from minors under the age of 13 after representing that DFF apps were child-directed, defendants
15 allegedly engaged in the specific conduct proscribed by COPPA. A violation of federal law is
16 generally considered egregious, and because COPPA prohibits such data collection from minors to
17 protect their privacy, plaintiffs have adequately pleaded an egregious intrusion into the minors’
18 expectation of privacy. See, e.g., In re Facebook, Inc. Internet Tracking Litig., 956 F.3d at 602–03
19 (finding privacy violations when “the online entity represented to the plaintiffs that their
20 information would not be collected, but then proceeded to collect it anyway”). No matter how un-
21 sensitive or un-intimate the personal information collected here was, the allegation that defendants
22 collected the data in violation of federal law despite representing that their DFF program apps did
23 not engage in interest-based advertising suffices to show that defendants’ intrusion upon plaintiffs’
24 expectation of privacy was highly offensive.
25 VII. Plaintiffs Adequately Plead Unjust Enrichment Claims.
26 Defendants finally argue that plaintiffs’ unjust enrichment claim under California law
27 should be dismissed because “there is no cause of action in California labeled unjust enrichment.”
1 under New York and Florida law should fail because the purported contracts at issue (Google’s
2 || Terms of Service and Privacy Policy) cover the same subject matter as the dispute. Jd.
3 The Ninth Circuit has recently acknowledged (albeit in a nonprecedential opinion) that
4 || unjust enrichment may constitute a standalone cause of action under California law. Bruton v.
5 Gerber Products Co., 703 F. App’x 468, 470 (9th Cir. 2017). To adequately allege unjust
6 || enrichment as an independent cause of action, “a plaintiff must show that the defendant received
7 and unjustly retained benefit at the plaintiff's expense.” ESG Capital Partners, LP v. Stratos, 828
8 F.3d 1023, 1038 (9th Cir. 2016). Here, plaintiffs have adequately pleaded that defendants were
9 || unjustly enriched by collecting plaintiffs’ personal information and employing it to target
10 advertisements to children. See In re Facebook, Inc., Consumer Priv. User Profile Litig., 402 F.
11 Supp. 3d 767, 808 (N.D. Cal. 2019) (“And even if the plaintiffs suffered no economic loss from
12 || the disclosure of their information, they may proceed at this stage on a claim for unjust enrichment
13 || to recover the gains that Facebook realized from its allegedly improper conduct.”’).
14 As to the unjust enrichment claims under New York and Florida law, defendants fail to
3 15 establish the existence of a contract between plaintiffs and defendants because the Court cannot
a 16 || consider defendants’ extrinsic evidence of Google’s Terms of Service and Privacy Policy on this
3 17 Rule 12(b)(6) motion. The Court therefore denies defendants’ motion to dismiss these unjust
S 18 || enrichment claims as well.
19 CONCLUSION
20 For the foregoing reasons, the Court denies the defendants’ motion to dismiss.
21 IT IS SO ORDERED.
22 Dated: June 18, 2024
23 2 Qe
24
P. Casey Pitts
25 United States District Judge
26
27
28

---

Source: Frix Law Library, https://www.frixlaw.com/law-library/cases/10638544. Public record. Not legal advice.