Yockey v. Salesforce, Inc.

1

2

3

4 UNITED STATES DISTRICT COURT

5 NORTHERN DISTRICT OF CALIFORNIA

6

7 PATRICK YOCKEY, et al., Case No. 22-cv-09067-JST

8 Plaintiffs,

ORDER DENYING DEFENDANT’S

9 v. MOTION TO DISMISS

10 SALESFORCE, INC., Re: ECF No. 44

Defendant.

11

12

13 Before the Court is Defendant Salesforce, Inc.’s motion to dismiss Plaintiffs’ second

14 amended complaint. ECF No. 44. The Court will deny the motion.

15 I. BACKGROUND

16 Salesforce offers a service called Chat that operates from Salesforce’s web servers but is

17 functionally implemented on Rite Aid’s and Kaiser Permanente’s websites, allowing Rite Aid’s

18 and Kaiser Permanente’s customers to interact with the company directly on the website. ECF

19 No. 43 ¶¶ 11–13. Chat “is a combination of a basic customer service chat function and backend

20 analytics tools to ostensibly improve a company’s customer service experience.” Id. ¶ 11.1

21 Chat works as follows. When a customer sends a chat message to a company’s customer

22 service agent, “it is first routed through a Salesforce server.” Id. ¶ 13. Transcripts of

23 communications over Chat are automatically created in real time and subsequently transmitted to

24 the contracting company. Id. ¶ 15. Chat also includes a “Sneak Peek” feature, which enables an

25

26

1 Specifically, Chat is an application programming interface (“API”), id. ¶ 12, which is a tool that

allows programmers to use “pre-written code to build certain functions into their own programs,

27

rather than write their own code to perform those functions from scratch.” Google LLC v. Oracle

1 agent to view the contents of a customer’s message while the customer types the message, i.e.,

2 before the customer sends the message to the agent. Id. ¶ 22–23. Plaintiffs, users of Rite Aid’s

3 and Kaiser Permanente’s websites, now bring this putative class action against Salesforce for

4 violations of the California Invasion of Privacy Act (“CIPA”) Sections 631 and 632 and violation

5 of Pennsylvania’s Wiretapping and Electronic Surveillance Control Act (“WESCA”). Id. ¶¶ 38–

6 83 (citing Cal. Penal Code §§ 631–632; 18 Pa. Cons. Stat. §§ 5701, et seq.).

7 Salesforce previously moved to dismiss Plaintiffs’ complaint for failure to state a claim

8 under either statute. ECF No. 23. The Court largely denied the motion, finding that Plaintiffs had

9 standing to bring their statutory claims; rejecting Salesforce’s argument regarding Section 632 that

10 the communications were not confidential and that Plaintiffs had consented to the recording of

11 their communications; and rejecting Salesforce’s arguments concerning WESCA that Salesforce

12 had not intercepted Plaintiff Yockey’s communications, that it had not used a “device” to intercept

13 them, that WESCA imposed a requirement that Yockey’s communications be rerouted

14 contemporaneously with transmission, that the alleged interception was a “necessary incident to

15 the rendition of [Salesforce’s] service, and that (again) Yockey had consented to Salesforce’s

16 conduct.” ECF No. 35. The Court did grant the motion in part, however, finding that Plaintiffs’

17 “allegations [did] not support a reasonable inference that Salesforce has the capability to use these

18 communications for any purpose other than furnishing them to Kaiser” in order to state a claim

19 pursuant to Section 631. Id. at 9. The Court granted leave to Plaintiffs to amend their complaint

20 only with respect to their CIPA Section 631 claim. Id. at 16.

21 Plaintiffs then filed a second amended complaint (“SAC”). ECF No. 43. The SAC

22 contains new allegations regarding how Salesforce can use the intercepted communications for its

23 own purposes. Id. ¶ 26. Specifically, Plaintiffs allege that the “Chat communications are sent to

24 Salesforce’s Einstein data intelligence platform” which are then used to “train the AI models that

25 form the basis of some of its services.” Id. Plaintiffs add that “Salesforce has the capability to use

26 Chat communications to (i) improve Salesforce’s own products and services; (ii) develop new

27 Salesforce products and services; and (iii) analyze Chat communications to assist with customer

1 Salesforce now moves to dismiss the SAC. ECF No. 44. Plaintiffs have filed an

2 opposition, ECF No. 45, and Salesforce has filed a reply, ECF No. 46.

3 II. JURISDICTION

4 The Court has jurisdiction pursuant to 28 U.S.C. § 1332(d)(2)(A).

5 III. LEGAL STANDARD

6 To survive a motion to dismiss under Federal Rule of Civil Procedure 12(b)(6), a

7 complaint must contain “a short and plain statement of the claim showing that the pleader is

8 entitled to relief.” Fed. R. Civ. P. 8(a)(2). Dismissal “is appropriate only where the complaint

9 lacks a cognizable legal theory or sufficient facts to support a cognizable legal theory.”

10 Mendiondo v. Centinela Hosp. Med. Ctr., 521 F.3d 1097, 1104 (9th Cir. 2008). “[A] complaint

11 must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible

12 on its face.’” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly,

13 550 U.S. 544, 570 (2007)). Factual allegations need not be detailed, but facts must be “enough to

14 raise a right to relief above the speculative level.” Twombly, 550 U.S. at 555.

15 “A claim has facial plausibility when the plaintiff pleads factual content that allows the

16 court to draw the reasonable inference that the defendant is liable for the misconduct

17 alleged.” Iqbal, 556 U.S. at 678. While this standard is not “akin to a ‘probability

18 requirement,’ . . . it asks for more than a sheer possibility that a defendant has acted unlawfully.”

19 Id. (quoting Twombly, 550 U.S. at 556). “Where a complaint pleads facts that are ‘merely

20 consistent with’ a defendant’s liability, it ‘stops short of the line between possibility and

21 plausibility of entitlement to relief.’” Id. (quoting Twombly, 550 U.S. at 557). In determining

22 whether a plaintiff has met the plausibility requirement, a court must “accept all factual allegations

23 in the complaint as true and construe the pleadings in the light most favorable” to the

24 plaintiff. Knievel v. ESPN, 393 F.3d 1068, 1072 (9th Cir. 2005). A plaintiff may “plead[] facts

25 alleged upon information and belief where the facts are peculiarly within the possession and

26 control of the defendant or where the belief is based on factual information that makes the

27 inference of culpability plausible.” Soo Park v. Thompson, 851 F.3d 910, 928 (9th Cir. 2017)

1 IV. DISCUSSION

2 Salesforce argues that (1) Plaintiffs fail to state a claim under the CIPA; (2) the WESCA’s

3 distinct mutual consent exception applies to the Pennsylvania Plaintiffs and Salesforce’s collection

4 of their information; and (3) Plaintiffs cannot apply the CIPA extraterritorially to Pennsylvania

5 residents. ECF No. 44. Plaintiffs maintain that they have sufficiently alleged violations of the

6 CIPA and the WESCA. ECF No. 45 at 11–23.

7 A. Motion to Dismiss CIPA § 632 and WESCA Claims

8 As a threshold issue, Plaintiffs contend that Salesforce’s new and previously rejected

9 arguments regarding the CIPA and the WESCA should be treated as a “de facto motion for

10 reconsideration” and denied on that basis. Id. at 8–11.

11 In addition to other challenges, Salesforce’s motion to dismiss once again argues that

12 Plaintiffs have failed to state a claim under CIPA Section 632 and WESCA. ECF No. 44 at 15–

13 23. Plaintiffs object to these arguments because the Court already found that the Plaintiffs stated a

14 claim under CIPA Section 632 and WESCA. ECF No. 45 at 7; ECF No. 35. Plaintiffs contend

15 that “it is improper to file a motion to dismiss an amended complaint where the amended

16 complaint asserts no new causes of action.” ECF No. 45 at 8. Salesforce responds that “an

17 amended complaint supersedes the prior one, rendering it ‘without legal effect.’” ECF No. 46 at 9

18 (citing Lacey v. Maricopa Cnty., 693 F.3d 896, 927 (9th Cir. 2012)).

19 The Court largely agrees with Salesforce. “It is well-established in our circuit that an

20 amended complaint supersedes the original, the latter being treated thereafter as non-existent.”

21 Ramirez v. County of San Bernardino, 806 F.3d 1002, 1008 (9th Cir. 2015) (internal citation and

22 quotation marks omitted). A motion to dismiss an amended complaint “is not a motion for

23 reconsideration of the Court’s prior order, but, rather, a new motion addressing a newly filed

24 complaint.” Turner v. Tierney, No. 12-cv-6231-MMC, 2013 WL 2156264, at *1 (N.D. Cal. May

25 17, 2013). “In the interest of judicial economy,” courts in this circuit will consider arguments

26 under a Rule 12(b)(6) motion that otherwise could be brought in a later Rule 12(c) motion. W.

27 Digit. Techs., Inc. v. Viasat, Inc., No. 22-cv-04376-HSG, 2023 WL 7739816, at *2 (N.D. Cal.

1 The cases cited by Plaintiffs do not compel a different result because these cases involve

2 defendants who filed a motion to dismiss on an amended complaint after answering the original

3 complaint. See Pascal v. Concentra, Inc., No. 19-cv-02559-JCS, 2020 WL 4923974, at *2 (N.D.

4 Cal. Aug. 21, 2020) (rejecting defendant’s 12(b)(6) challenges because defendant answered the

5 complaint); Brooks v. Caswell, No. 14-cv-01232-AC, 2016 WL 866303, at *3 (D. Or. Mar. 2,

6 2016) (same); Townsend Farms v. Goknur Gida Madderleri Enerji Imalat Ithalat Ihracat Ticaret

7 Ve Sanayi A.S., No. 15-cv-0837-DOC-JCGx, 2016 WL 10570248, at *1 (C.D. Cal. Aug. 17, 2016)

8 (same); Best Fresh LLC v. Vantaggio Farming Corp., No. 21-cv-00131-BEN-WVG, 2022 WL

9 4112231, at *10 (S.D. Cal. Sept. 8, 2022)2 (same). Here, no answer has been filed, Plaintiffs have

10 filed an amended complaint, and Salesforce raises new arguments it didn’t previously raise.

11 Salesforce may assert these new defenses not previously presented to the Court.3

12 B. CIPA

13 1. Section 631

14 CIPA Section 631 creates liability in four circumstances:

15 (1) where a person “by means of any machine, instrument, or

contrivance, or in any other manner, intentionally taps, or makes

16 any unauthorized connection . . . with any telegraph or

telephone wire, line, cable, or instrument”;

17

(2) where a person “willfully and without consent of all parties to

18 the communication, or in any unauthorized manner, reads, or

attempts to read, or to learn the contents or meaning of any

19 message, report, or communication while the same is in transit

or passing over any wire, line, or cable, or is being sent from, or

20 received at any place within this state”;

21 (3) where a person “uses, or attempts to use, in any manner, or for

any purpose, or to communicate in any way, any information so

22 obtained”; and

23 (4) where a person “aids, agrees with, employs, or conspires with

24

2 Furthermore, certain district courts have entertained post-answer motions to dismiss amended

25

complaints for the purpose of judicial economy or based on distinguishing factors. Best Fresh

LLC v. Vantaggio Farming Corp., No. 21-cv-00131-BEN-WVG, 2022 WL 4112231, at *6 (S.D.

26

Cal. Sept. 8, 2022).

27

3 What the Court says here should not be construed as license simply to reassert arguments the

any person or persons to unlawfully do, or permit, or cause to be

1 done any of the acts or things mentioned above.”

2 Javier v. Assurance IQ, LLC, 649 F. Supp. 3d 891, 897 (N.D. Cal. 2023) (quoting Cal. Penal Code

3 § 631(a)). In addition, a plaintiff must show that the third party “ha[s] the capability to use its

4 record of the interaction for any other purpose.” Id. at 900.

5 Salesforce’s motion to dismiss challenges whether Plaintiffs have shown that (1)

6 Salesforce has the “capability to use its record of the interaction for any other purpose”; and (2)

7 Salesforce reads the messages “in transit” under Section 631(a)(2).

8 a. Capability To Use Communications for Other Purposes

9 The Court previously dismissed Plaintiffs’ Section 631 claim because Plaintiffs’

10 “allegations [did not] support a reasonable inference that Salesforce ha[d] the capability to use

11 these communications for any purpose other than furnishing them to [customer websites].” ECF

12 No. 35 at 9.

13 Plaintiffs have now amended their complaint to allege that Salesforce sends the chat

14 communications to “Salesforce’s Einstein data intelligence platform” to “train the AI models that

15 form the basis of some of its services.” ECF No. 43 ¶ 26. Plaintiffs add that “Salesforce has the

16 capability to use Chat communications to (i) improve Salesforce’s own products and services; (ii)

17 develop new Salesforce products and services; and (iii) analyze Chat communications to assist

18 with customer service interactions and data analytics.” Id. ¶ 28. Salesforce disagrees with

19 Plaintiffs’ characterization of these tools as a factual matter, but concedes that Plaintiffs have now

20 sufficiently alleged that Salesforce “has the capability to use [Chat] communications for []

21 purpose[s] other than furnishing them to Kaiser.” ECF No. 44 at 15.

22 Because Plaintiffs have properly alleged that Salesforce has the ability to use its record of

23 the interaction for other purposes beyond just furnishing them to customer websites, the Court

24 finds that Plaintiffs have alleged sufficient facts to meet the plausibility requirement. Knievel, 393

25 F.3d at 1072 (9th Cir. 2005).

26 b. Interception of Communications “In Transit”

27 Every clause of Section 631(a) has three requirements in common: “(1) the absence of

1 Keurig Green Mountain, Inc., 674 F. Supp. 3d 751, 756 (N.D. Cal. 2023) (citing Cal. Penal Code

2 § 631(a)). Salesforce asserts that Plaintiffs fail to state a claim because the communications “are

3 not read ‘in transit’ and are by definition outside the scope of [S]ection 631(a).” ECF No. 44 at

4 14. That is, Salesforce argues that the “data transmitted (containing the typed Chat text) can be

5 read only after arriving at Salesforce’s servers—not while they are in transmission.” Id.

6 (emphasis in original). Plaintiffs respond that Salesforce’s servers provide “transient electronic

7 storage that is intrinsic to the communication,” but such transient storage still means that

8 communications are intercepted “in transit.” ECF No. 45 at 13–15. Salesforce replies that

9 electronic signals sent over the internet must arrive on Salesforce’s server before computer

10 systems can interpret and display the typed text and therefore cannot be intercepted “in transit.”

11 ECF No. 46 at 12–13. At its core, Salesforce’s argument is that it has not “intercepted”

12 communications because it was both the intended destination server of the communications and

13 the transient server “before computer systems [could] interpret and display the typed text.”4 Id.

14 The cases cited by Salesforce, however, do not support its argument. In the first set of

15 cases, the messages were clearly in digital storage and therefore were not simultaneously or

16 contemporaneously intercepted. See Konop v. Hawaiian Airlines, Inc., 302 F.3d 868, 878 (9th

17 Cir. 2002) (finding no interception where messages were retrieved from bulletins and postings on

18 a secure website); see also Theofel v. Farey-Jones, 359 F.3d 1066, 1077 (9th Cir. 2004)

19 (addressing copies of e-mails transmitted in the past retained by the internet service provider). In

20 the second set of cases, the communications were considered not “in transit” because the

21 defendant gained access after receipt by the intended recipient. See Adler v. Community.com, Inc.,

22 No. 2:21-cv-02416-SBJPR, 2021 WL 4805435, at *4 (C.D. Cal. Aug. 2, 2021) (finding that CIPA

23 Section 631 claim failed because plaintiff alleged defendant gained access to plaintiff’s text “upon

24

25

4 Although Plaintiffs respond that chat messages are in transient storage, ECF No. 45 at 14–15,

this argument is not responsive to Salesforce’s contention. Salesforce’s argument is that

26

regardless of whether the chat messages are transient (i.e., incidental to the sending of the

message) or permanent, the Salesforce server is the only server that is used in the transmission of

27

these chats, and therefore Salesforce could not intercept such communications. However, as the

1 the completion of its transmission to the proper number”); Swarts v. Home Depot, Inc., 689 F.

2 Supp. 3d 732, 746 (N.D. Cal. 2023) (finding that plaintiffs allegations that “online traffic occurs

3 between the customer’s browser and several liveperson.net subdomains” “does not indicate when

4 the interception occurs . . . [and] does not dispel the notion that LivePerson receives the

5 information after the chat reaches Home Depot.”); see also Martin v. Sephora USA, Inc., No. 22-

6 cv-01355-JLT-SAB, 2023 WL 2717636, at *10 (E.D. Cal. Mar. 30, 2023), report and

7 recommendation adopted, No. 22-cv-01355-JLT-SAB, 2023 WL 3061957 (E.D. Cal. Apr. 24,

8 2023) (dismissing plaintiffs’ Section 631(a) claim because the allegations in the complaint stated

9 that defendant (Sephora) “records and creates transcripts of the chats, which Hubspot/Salesforce is

10 then permitted to access,” and plaintiffs failed to make any non-conclusory allegations about how

11 the transcripts are intercepted simultaneously by Hubspot/Salesforce.)

12 Those are not the allegations here. First, Salesforce does not argue that chat messages to

13 and from Rite-Aid and Kaiser websites reside in long-term storage on Salesforce’s servers.

14 Second, notwithstanding Salesforce’s arguments to the contrary, Salesforce is not the intended

15 recipient. Salesforce conflates Section 631(a)’s requirement of receipt by the intended recipient

16 with receipt by the destination server. These are not the same thing. “[T]he crucial question under

17 § 631(a)’s second clause is whether [a plaintiff] has plausibly alleged that [the defendant] read one

18 of his communications while it was still in transit, i.e., before it reached its intended recipient.”

19 Mastel v. Miniclip SA, 549 F. Supp. 3d 1129, 1137 (E.D. Cal. 2021) (emphasis added).

20 Salesforce’s argument is identical to one recently rejected in Lopez v. Apple, Inc., 519 F.

21 Supp. 3d 672, 683 (N.D. Cal. 2021). In Lopez, plaintiffs brought a putative consumer class action

22 against Apple for violating the CIPA when Siri intercepted and disclosed “private discussions

23 between doctors and patients, confidential business deals, and sexual encounters.” Id. at 679.

24 Plaintiffs alleged “that they did not intend Apple to receive their private communications, but that

25 Apple ‘captured’ such communications using the software in their devices.” Id. at 683. Like

26 Salesforce, Apple argued “that it ha[d] not ‘intercepted’ communications because it was the

27 intended recipient of the communications.” Id. The Court disagreed and held that plaintiffs

1 Here too, Plaintiffs have alleged that the intended recipient of communications concerning

2 medical conditions, insurance information, and prescription history, ECF No. 43 ¶¶ 31–34, are

3 Plaintiffs’ doctors and pharmacists, respectively—not Salesforce. Lopez, 519 F. Supp. 3d at 683.

4 While the information was routed through Salesforce’s server, the “intended recipients” were Rite

5 Aid and Kaiser. Id. The reasonable inference here, because Salesforce “apparently receives the

6 chat messages either before or simultaneously with” its clients––the intended recipients, is that

7 Salesforce intercepts these messages. D’Angelo v. Penny OpCo, LLC, No. 23-cv-0981-BAS-

8 DDL, 2023 WL 7006793, at *8 (S.D. Cal. Oct. 24, 2023).5

9 Salesforce’s motion to dismiss Plaintiffs’ Section 631 claim is therefore denied.

10 2. Section 632

11 CIPA Section 632 imposes liability against a “person who, intentionally and without the

12 consent of all parties to a confidential communication, uses an electronic amplifying or recording

13 device to eavesdrop upon or record the confidential communication, whether the communication

14 is carried on among the parties in the presence of one another or by means of a telegraph,

15 telephone, or other device, except a radio.” Cal. Pen. Code § 632(a).

16 Salesforce argues that Plaintiffs fail to allege a Section 632 claim for two reasons: (1)

17 Plaintiffs cannot show that their communications are confidential; and (2) Plaintiffs cannot show

18 that the software in this case is a “device” under the statutory language. ECF No. 44 at 16–18.

19 a. Confidentiality of Communication

20 Salesforce argues that its “previous argument against CIPA § 632 focused on the

21 likelihood chats would be ‘shared’ or ‘disclosed,’” whereas now, it argues that Plaintiffs’ Section

22 632 claim must fail because the communications are not “confidential” under the plain text of the

23 statute because they can be recorded by others. ECF No. 46 at 15 (citing Cal. Pen. Code

24 § 632(c)). There is little daylight between these arguments, and the new argument fares no better

25 than the old.

26

5 In light of this conclusion, the Court need not reach Plaintiffs’ alternative argument that

27

Salesforce could satisfy the “in transit” requirement of Section 631(a) by “caus[ing] Plaintiff

1 The CIPA defines a “confidential communication” as “any communication carried on in

2 circumstances as may reasonably indicate that any party to the communication desires it to be

3 confined to the parties thereto, but excludes a communication made . . . in any other circumstance

4 in which the parties to the communication may reasonably expect that the communication may be

5 overheard or recorded.” Cal. Pen. Code § 632(c).

6 The Court determines the meaning of “confidential communication” using traditional tools

7 of statutory interpretation. “The first and most important canon of statutory construction is the

8 presumption ‘that a legislature says in a statute what it means and means in a statute what it says

9 there.’” In re Pangang Grp. Co., Ltd., 901 F.3d 1046, 1056 (9th Cir. 2018) (quoting Conn. Nat’l

10 Bank v. Germain, 503 U.S. 249, 253–254 (1992)). The Court “starts with the plain

11 statutory text and, ‘when deciding whether the language is plain, . . . must read the words in their

12 context and with a view to their place in the overall statutory scheme.’” Altera Corp. &

13 Subsidiaries v. Comm’r of Internal Revenue, 926 F.3d 1061, 1075 (9th Cir. 2019) (quoting King v.

14 Burwell, 576 U.S. 473, 486 (2015)).

15 The California Supreme Court has interpreted the language of Section 632 as follows:

16 the first clause includes within the statutory protection any

conversation under circumstances showing that a party desires it not

17 to be overheard or recorded. The second clause then excludes a

conversation under circumstances where the party reasonably

18 believes it will be overheard or recorded. Under this construction,

the two clauses of section 632 do not conflict nor leave any

19 uncertainty; they act together in harmony to prohibit unconsented-to

eavesdropping or recording of conversations regardless of whether

20 the party expects that the content of the conversation may later be

conveyed to a third party.

21

Flanagan v. Flanagan, 27 Cal. 4th 766, 774–775 (2002) (citing Cal. Pen. Code § 632(c)).

22

Following this holding, the question then becomes, what were the parties’ reasonable expectations

23

about confidentiality? See Brown v. Google LLC, 685 F. Supp. 3d 909, 937 (N.D. Cal. 2023) (“the

24

inquiry is whether ‘any party to the communication desires it to be confined to the parties thereto.’

25

[This] is a fact-intensive inquiry.”) (internal citation omitted).

26

In California, courts have developed a presumption that Internet communications do not

27

reasonably give rise to an expectation of confidentiality, and plaintiffs must “show[] that there is

1 something unique about these particular internet communications which justify departing from the

2 presumption.” In re Meta Pixel Healthcare Litig., 647 F. Supp. 3d 778, 799 (N.D. Cal. 2022). In

3 its prior order, however, the Court determined that Plaintiffs did “show something unique”, which

4 was the context of the communications:

5 Plaintiffs respond that Magpayo maintained a reasonable

expectation of confidentiality because she communicated

6 information related to her prescription history, medical conditions,

and insurance information to the customer service agents in a

7 healthcare context. ECF No. 28 at 23. The Court agrees with

Plaintiffs that the context of these communications renders them

8 confidential.

9 ECF No. 35 at 10.

10 Nothing has changed since the Court’s prior order. Once again, “Salesforce cites no

11 authority for the proposition that communications with a health care provider must occur with

12 only certain of its agents or employees to be confidential, or that such communications are not

13 confidential if conducted with a customer support worker.” Id. at 11. Accordingly, “[t]he Court

14 [again] rejects Salesforce’s argument and concludes that Magpayo’s communications were

15 ‘confidential’ within the meaning of Section 632.” Id.

16 b. Chat API Software is a “Device”

17 Salesforce next argues that Plaintiffs’ Section 632 claim fails because Plaintiffs do not

18 sufficiently allege that Salesforce used a “device” to intercept Plaintiffs’ communications. ECF

19 No. 44 at 17–18.

20 “CIPA does not define ‘device,’ and few courts have squarely addressed the issue.”

21 Gladstone v. Amazon Web Servs., Inc., No. 2:23-CV-00491-TL, 2024 WL 3276490, at *7 (W.D.

22 Wash. July 2, 2024). The Court agrees with those Ninth Circuit district court decisions that have

23 found that software qualifies as a device under Section 632. Id. at *8 (“‘device,’ as used in

24 Section 632, can include software”); Doe v. Meta Platforms, Inc., 690 F. Supp. 3d 1064, 1080

25 (N.D. Cal. 2023) (holding that “Pixel software is a device under Section 632(a)”).6

26

6 The Court is aware of Doe v. Microsoft Corp., No. C23-0718-JCC, 2023 WL 8780879 (W.D.

27

Wash. Dec. 19, 2023), which held that “[b]ecause software does not constitute a ‘device’ under the

1 The Court finds these cases persuasive for at least two reasons. First, where the

2 Legislature has failed to define a term specifically, and the parties offer no legislative history that

3 would shed light on the question, “our best approach is to construe the statutory language in

4 accordance with its purpose.” Burroughs v. Operating Engineers Loc. Union No. 3, 686 F.2d 723,

5 727 (9th Cir. 1982). “In enacting [CIPA], the Legislature declared in broad terms its intent ‘to

6 protect the right of privacy of the people of this state’ from what it perceived as ‘a serious threat to

7 the free exercise of personal liberties [that] cannot be tolerated in a free and civilized society.’”

8 Ribas v. Clark, 38 Cal. 3d 355, 359 (1985) (citing Cal. Pen. Code § 630). In so doing, the

9 Legislature recognized “that advances in science and technology have led to the development of

10 new devices and techniques for the purpose of eavesdropping upon private communications and

11 that the invasion of privacy resulting from the continual and increasing use of such devices and

12 techniques has created a serious threat to the free exercise of personal liberties and cannot be

13 tolerated in a free and civilized society.” Cal. Pen. Code § 630. Thus, the Legislature itself

14 evinced a desire that the CIPA’s statutory protections should extend across the developing field of

15 technology. Furthermore, “the California Supreme Court has also emphasized that all CIPA

16 provisions are to be interpreted in light of the broad privacy-protecting statutory purposes of

17 CIPA.” Javier v. Assurance IQ, LLC, No. 21-16351, 2022 WL 1744107, at *2 (9th Cir. May 31,

18 2022)7 (first citing Ribas, 38 Cal. 3d at 359–62; then Smith v. LoanMe, Inc., 11 Cal. 5th 183, 199–

19 200 (2021)).

20 Second, the Court looks to cases construing the word “device” in the federal Wiretap Act,

21 18 U.S.C. § 2510 et seq., because “[t]he analysis for a violation of CIPA is the same as that under

22 the federal Wiretap Act.” Brodsky v. Apple Inc., 445 F. Supp. 3d 110, 127 (N.D. Cal. 2020)

23 (citation and quotation omitted). “The majority of courts to consider this issue have entertained

24 the notion that software may be considered a device for the purposes of the Wiretap Act.” United

25

26

2019) and Moreno v. San Francisco Bay Area Rapid Transit Dist., 2017 WL 6387764 (N.D. Cal.

2017). Those cases both involved Penal Code Section 637.7 and are distinguishable on that basis.

27

Doe v. Meta Platforms, 690 F. Supp. 3d at 1080.

1 States v. Hutchins, 361 F. Supp. 3d 779, 795 (E.D. Wis. 2019) (citing cases). That includes courts

2 within this district. See In re Carrier IQ, Inc., 78 F. Supp. 3d 1051, 1087 (N.D. Cal. 2015)

3 (“Carrier IQ Software is an ‘[e]lectronic, mechanical, or other device’ which ‘can be used to

4 intercept a wire, oral, or electronic communication” pursuant to the federal Wiretap Act).

5 The Court therefore denies Salesforce’s motion to dismiss Plaintiffs’ CIPA Section 632

6 claims and finds that Plaintiffs have plausibly alleged that Chat API software is a “device.”

7 C. WESCA

8 In its first motion to dismiss, Salesforce raised four WESCA arguments: (1) that Plaintiff

9 Yockey failed to allege that Salesforce intercepted his chat; (2) that the WESCA exempts Chat

10 from its definition of “electronic, mechanical or other device”; (3) that Yockey’s allegations do

11 not establish that his communications were rerouted contemporaneously with transmission; and

12 (4) that two of WESCA’s exceptions to liability apply to Salesforce’s conduct. ECF No. 23. The

13 Court rejected all four arguments. ECF No. 35 at 12–15.

14 Salesforce now brings a different argument challenging Yockey’s WESCA claim.

15 Salesforce argues that Yockey “impliedly consented to the recording of his chat conversation”

16 because he knew or should have known the conversation was being recorded, defeating his

17 wiretap claim under WESCA. ECF No. 44 at 23. That is, Salesforce argues that it is the “chat

18 box user’s expectation of recording that matters––not who allegedly does the recording.” ECF

19 No. 46 at 21. Plaintiffs respond that “Defendant has cited no case that stands for the proposition

20 that users who send written communications impliedly consent to interceptions and use of their

21 communications by third parties other than the intended recipient.” ECF No. 45 at 21.

22 The WESCA permits interception “where all parties to the communication have given

23 prior consent to such interception.” 18 Pa. Cons. Stat. § 5704(4). “Prior consent, including

24 implied consent, can be demonstrated when the person being recorded knew or should have

25 known [ ] that the conversation was being recorded.” Popa v. Harriet Carter Gifts, Inc., 52 F.4th

26 121, 132 (3d Cir. 2022) (internal citation and quotation marks omitted). In the case of websites,

27 this turns on whether the website’s communications with the user—for example, by displaying its

1 recorded communications. Oliver v. Noom, Inc., No. 2:22-CV-1857, 2023 WL 8600576, at *9

2 (W.D. Pa. Aug. 22, 2023) (finding that Defendants did not show that Plaintiffs “knew or should

3 have known” that their activity on Noom’s website was being recorded prior to allegedly being

4 wiretapped.); see also Vonbergen v. Liberty Mut. Ins. Co., No. CV 22-4880, 2023 WL 8569004, at

5 *13 (E.D. Pa. Dec. 11, 2023) (finding that although plaintiff “may have consented to Liberty

6 Mutual recording her personal information inputted into the website, she has plausibly alleged that

7 she was not aware Liberty Mutual had procured an undisclosed third party to intercept that

8 information too.”). Here, there is no allegation that Rite Aid or Kaiser tells website users that

9 Salesforce might record their communications.

10 Salesforce’s authority is distinguishable. First, Salesforce relies on Commonwealth v.

11 Proetto for the principle that “there is no expectation of privacy in written electronic

12 communications, because it is understood that any such message, is by its very nature, recorded.”

13 ECF No. 44 at 22; see also ECF No. 46 at 21. However, as the Proetto court explains, “[a]ny

14 reasonably intelligent person, savvy enough to be using the Internet, however, would be aware of

15 the fact that messages are received in a recorded format, by their very nature, and can be

16 downloaded or printed by the party receiving the message.” Com. v. Proetto, 771 A.2d 823, 829

17 (Pa. Super. Ct. 2001), aff’d, 575 Pa. 511 (Pa. 2003) (emphasis added). Proetto is distinguishable

18 from the instant case because while Plaintiffs may have been aware that the “party receiving the

19 message”––i.e., Rite Aid and Kaiser Permanente were receiving the communications in a

20 “recorded format”—they had not consented to an undisclosed third party intercepting the message.

21 None of Salesforce’s other Pennsylvania cases involve an undisclosed third-party. Proetto,

22 771 A.2d at 826 (finding that where the messages were sent directly to a minor, and the minor

23 then forwarded the messages to a detective, there was no interception because the detective’s

24 acquisition of the communications was not contemporaneous with their transmission)8; Com. v.

25

26

8 With regard to communications received directly by the detective when he posed as an underage

female, the Proetto court found no violation of the Wiretap Act because he was party to the

27

conversation. Proetto, 771 A.2d at 832. Furthermore, under the WESCA, the term interception,

1 Diego, 119 A.3d 370, 380–81 (Pa. Super. Ct. 2015) (where the recipient of a text message relayed

2 the message to the police, court concluded that there was no interception because the recipient

3 “control[ed] the destiny of the content of that message once it [was] received.”); Com. v.

4 Cruttenden, 619 Pa. 123, 132 (Pa. 2012) (finding no interception even where “officer shields or

5 misrepresents his or her identity, because the caller elects to talk to the officer who answered the

6 phone” and so the officer was the intended recipient of the communications).

7 The remaining question is whether Yockey sufficiently alleges a lack of consent. Plaintiffs

8 allege that Salesforce’s recording “begins the moment a user accesses or interacts with the Chat

9 feature on the Website, prior to a user consenting to any sort of privacy policy or the wiretaps

10 generally,” and that users are not told “prior to being wiretapped, that their electronic

11 communications are being simultaneously directed to Salesforce, as opposed to just the Website

12 customer service agent.” ECF No. 43 ¶ 31 (emphasis added). Yockey also alleges that “users,

13 including Plaintiffs, are thus not on notice of any wiretapping when they begin a Chat interaction,

14 nor do they provide their prior consent to the same.” Id. ¶ 32. Furthermore, Pennsylvania district

15 courts have held that “whether Plaintiffs gave consent to disclosure under the PA Wiretapping Act

16 would appear to be factual in nature––involving issues of factual dispute and interpretation,” and

17 accordingly this Court finds that it is “appropriate to defer ruling on questions about whether

18 Plaintiffs gave consent until after the Parties engage in discovery and develop the factual record.”

19 Braun v. Philadelphia Inquirer, LLC, No. 22-CV-4185-JMY, 2023 WL 7544160, at *5 (E.D. Pa.

20 Nov. 13, 2023).

21 The Court denies Salesforce’s motion to dismiss Plaintiffs’ WESCA claims because

22 Plaintiffs have plausibly alleged that they did not consent to interceptions by an undisclosed third

23 party.

24 D. Extraterritorial Application of CIPA

25 The CIPA contains express geographical limitations. Cal. Pen. Code § 631. Section 631

26 provides for liability where a person “willfully and without the consent of all parties to the

27 communication, or in any unauthorized manner, reads, or attempts to read, or to learn the contents

1 any wire, line, or cable, or is being sent from, or received at any place within this state.” Id.

2 (emphasis added).

3 In its motion, Salesforce argued that the CIPA does not apply to Plaintiff Yockey and non-

4 resident members of the putative nationwide class because: (i) non-residents fall outside the

5 CIPA’s stated legislative purpose of protecting the privacy interests of California citizens; (ii)

6 Yockey fails to allege a sufficient California nexus; and (iii) California’s choice-of-law rules

7 preclude application of California law to Yockey and other non-residents. ECF No. 44 at 18–21.

8 In their opposition, Plaintiffs voluntarily withdrew their CIPA Sections 631(a) and 632 claims on

9 behalf of the Nationwide Website Class without prejudice but did not withdraw Plaintiff

10 Magpayo’s individual claims or those of the California website class and Kaiser subclass. ECF

11 No. 45 at 8 n.1. Salesforce argues that these remaining CIPA claims still impermissibly require

12 extraterritorial application because “the California subclass—unlike the Kaiser subclass—is not

13 limited to use of websites at issue while putative subclass members were ‘in California.’” ECF

14 No. 46 at 8 n.1.

15 The California Website Class is “a class of all California residents who used Salesforce’s

16 Chat function on any Website,” and the Kaiser Subclass is “a subclass of all California residents

17 who used Salesforce’s Chat function on Kaiser Permanente’s website while in California.” ECF

18 No. 43 ¶¶ 40, 43. Plaintiffs have also pleaded that “each communication by Plaintiff Magpayo

19 and California Website Class and Kaiser Subclass Members was sent from California and received

20 by Salesforce in California.” Id. ¶ 68. These allegations are sufficient to establish a prima facie

21 case that the communication falls within the ambit of Section 632. Knievel, 393 F.3d at 1072 (9th

22 Cir. 2005). Accordingly, the Court denies Salesforce’s motion to dismiss on extraterritoriality

23 because Plaintiffs have plausibly alleged that the conduct at issue occurred in California.

24 / / /

25 / / /

26 / / /

27 / / /

1 CONCLUSION

2 For the foregoing reasons, Salesforce’s motion to dismiss is denied.

3 IT IS SO ORDERED.

4 Dated: August 16, 2024

° JON S. TIGAR

6 nited States District Judge

7

8

9

10

11

15

16

it

4 18

19

20

21

22

23

24

25

26

27

28