“With respect to a 9 corporation, the place of incorporation and principal place of business are ‘paradig[m] . . . 10 bases for general jurisdiction.’” (quoting Goodyear Dunlop Tires Operations, S.A. v. 11 Brown, 564 U.S. 915, 924 (2011))
How later courts described this case
- “With respect to a 9 corporation, the place of incorporation and principal place of business are ‘paradig[m] . . . 10 bases for general jurisdiction.’” (quoting Goodyear Dunlop Tires Operations, S.A. v. 11 Brown, 564 U.S. 915, 924 (2011))
- finding the trapping of police 10 emergency lines did not reveal the content of any communication, but “instead only 11 disclosed the telephone numbers of the callers”
- “[W]arrantless installation of pen 28 1 registers, which capture only the telephone numbers that are dialed and not the calls 2 themselves, does not violate the Fourth Amendment.”
- explaining justification of voluntary cessation 16 doctrine
Written by the judges who cited it.
The opinion
1
2
3
4
5
6
7
8 UNITED STATES DISTRICT COURT
9 SOUTHERN DISTRICT OF CALIFORNIA
10
11 DAVID GREENLEY, Case No. 22-cv-01327-BAS-AHG
12 Plaintiff,
ORDER:
13 v.
1. GRANTING IN PART AND
14 KOCHAVA, INC.,
DENYING IN PART
15 Defendant. DEFENDANT’S MOTION TO
DISMISS (ECF No. 11); AND
16
17 2. DENYING DEFENDANT’S
MOTION FOR VENUE
18
TRANSFER (ECF No. 21)
19
20
21 Pending before the Court are two motions. First, Defendant moves to dismiss the
22 action pursuant to Federal Rule of Civil Procedure (“Rule”) 12(b)(1), asserting a lack of
23 standing, and Rule 12(b)(6), asserting a failure to state a claim upon which relief may be
24 granted. (MTD, ECF No. 11.) Second, Defendant moves to transfer venue pursuant to 28
25 U.S.C. § 1404(a). (Mot. Venue, ECF No. 21.) Having considered the parties’ filings, the
26 Court GRANTS IN PART and DENIES IN PART Defendant’s Motion to Dismiss
27 (ECF No. 11) and DENIES Defendant’s Motion for Venue Transfer (ECF No. 21).
28
1 BACKGROUND
2 I. Factual Background
3 Defendant is a “data broker[]” that provides a software developer kit (“SDK”) to
4 software application (“app”) developers “to assist them in developing their apps.” (Am.
5 Compl. ¶ 6, ECF No. 10.)1 In return, the app developers allow Defendant to
6 “surreptitiously intercept location data” from an app user (“user”) via its SDK. (Id.)
7 Defendant then sells “customized data feeds to its clients”—such as Airbnb, Disney+,
8 and Kroger—to “assist in advertising and analyzing foot traffic at stores or other
9 locations.” (Id. ¶¶ 7, 83.) In other words, Defendant coded its SDK for data collection
10 and embedded it in third-party apps; the SDK secretly collected app users’ data; and then
11 Defendant packaged that data and sold it to clients for advertising purposes.
12 Defendant is “able to deliver targeted advertising . . . by in essence ‘fingerprinting’
13 each unique device and user, as well as connecting users across devices and devices
14 across users.” (Id. ¶ 75.) The data links longitude and latitude coordinates with these
15 fingerprints, which can be “easily de-anonymized.” (Id. ¶¶ 7–8.) In addition to
16 geolocation, Defendant collects “search terms, click choices, purchase decisions and/or
17 payment methods.” (Id. ¶ 125.) This data collection allows Defendant to deliver “targeted
18 advertising . . . while tracking [users’] locations, spending habits, and personal
19 characteristics” and share this “rich personal data simultaneously with untold numbers of
20 third-party companies.” (Id. ¶ 75.)
21 Plaintiff is a California resident filing a putative class action suit on behalf of
22 similarly situated California residents. (Id. ¶¶ 1, 35.) Plaintiff has installed and used apps
23 that have integrated Defendant’s SDK. (Id. ¶¶ 36–37.) As a result, Defendant has
24 collected “personal information,” geolocation data, and communications from his cellular
25 telephone. (Id. ¶ 23.) This geolocation data includes visits to “sensitive locations.” (Id.
26
27 1 These facts are taken from the Amended Complaint. The Court accepts as true all
nonconclusory allegations set forth therein for the purpose of the Motion to Dismiss. See Safe Air for
28
1 ¶ 24.) Other data includes advertisement clicks; “specific communications from [] SDK-
2 installed apps such as consumer’s usernames, customer emails and customer IDs on their
3 Apple or Android cellular telephone devices”; “search terms used by a device user”; and
4 “a user’s activities within an app after it has been installed.” (Id. ¶¶ 76, 78–80.)
5 Plaintiff avers Defendant’s own conduct and statements demonstrate its
6 wrongdoing. In response to pressure from the Federal Trade Commission (“FTC”),
7 Defendant announced a “new feature that allegedly now blocks the gathering of private,
8 sensitive, location data related to health care facilities.” (Id. ¶ 105.) This “Privacy Block”
9 removes “health services location data from the Kochava Collective marketplace.” (Id.)
10 Plaintiff claims this new feature evidences that “Defendant recognizes the damage it has
11 done to California consumers.” (Id.)
12 In addition, Plaintiff alleges that Defendant has circumvented attempts to safeguard
13 users’ privacy. (Id. ¶¶ 71–73.) For example, Apple, Inc. (“Apple”), in response to
14 growing privacy concerns, created a framework that requires users to “affirmatively opt-
15 in to allowing Defendant and others to track their device unique identification number for
16 advertisers on their iPhones.” (Id. ¶¶ 68–69.) After Apple implemented this framework,
17 Defendant advertised that it collects identifying data “even after a consumer thinks [he
18 has] disabled all tracking by apps on an iPhone.” (Id. ¶ 73.)
19 II. Litigation Background
20 On August 12, 2022, Defendant filed a federal lawsuit against the FTC in the
21 District of Idaho. (Ex. A to Mariam Decl., ECF No. 21-4.) Defendant sought declaratory
22 relief that it did not violate any laws. (Id.) On August 29, 2022, the FTC filed a
23 Complaint against Defendant also in the District of Idaho. (Ex. B to Mariam Decl., ECF
24 No 21-5.) One week later, Plaintiff filed this lawsuit against Defendant. (ECF No. 1.)
25 Plaintiff alleges violations of the California Constitution, California Computer Data
26 Access and Fraud Act (“CDAFA”), California Invasion of Privacy Act (“CIPA”),
27 California Unfair Competition Law (“UCL”), and common law principles of unjust
28 enrichment. (Am. Compl.) Defendant then filed the present Motion to Dismiss. (MTD.)
1 Five months after Plaintiff filed his Complaint in this district, Cindy Murphy, a
2 Washington resident, filed a putative class action against Defendant in the District of
3 Idaho alleging unjust enrichment and violations of the Washington Consumer Protection
4 Act. (Ex. C to Mariam Decl., ECF No. 21-6.) After Ms. Murphy filed her lawsuit,
5 Defendant filed the present Motion to Change Venue in this action. (Mot. Venue.)
6 STANDING
7 I. Legal Standard
8 Article III of the Constitution limits federal courts’ jurisdiction to the “resolution
9 of ‘Cases’ and ‘Controversies.’” TransUnion LLC v. Ramirez, 141 S. Ct. 2190, 2203
10 (2021). This limitation means the plaintiff must have standing to sue. Id. A plaintiff
11 establishes standing by showing (i) that he suffered an injury in fact that is concrete,
12 particularized, and actual or imminent; (ii) that the injury was likely caused by the
13 defendant; and (iii) that the injury would likely be redressed by judicial relief. Id. (citing
14 Lujan v. Defenders of Wildlife, 504 U.S. 555, 560–61 (1992)).
15 Under Rule 12(b)(1), a party may move to dismiss a claim based on lack of subject
16 matter jurisdiction, including the absence of standing. Chandler v. State Farm Mut. Auto.
17 Ins. Co., 598 F.3d 1115, 1123 (9th Cir. 2010). A Rule 12(b)(1) challenge to jurisdiction
18 may be facial or factual. Safe Air for Everyone v. Meyer, 373 F.3d 1035, 1039 (9th Cir.
19 2004). Defendant’s Motion to Dismiss is facial, positing the allegations in the complaint
20 itself are insufficient to invoke federal jurisdiction. See id. at 1039; (MTD.) As a result,
21 the presumption of truthfulness attaches to the allegations in the complaint, and the court
22 is limited to the four corners of the pleading in determining whether it has jurisdiction
23 over the matter. Thornhill Publ’g Co. v. Gen. Tel. Elec., 594 F.2d 730, 733 (9th Cir.
24 1979). To survive a Rule 12(b)(1) facial challenge, “the plaintiff must ‘clearly . . . allege
25 facts demonstrating’ each element [of standing].” Spokeo, Inc. v. Robins, 578 U.S. 330,
26 338 (2016) (quoting Warth v. Seldin, 422 U.S. 490, 518 (1975)).
27
28
1 II. Analysis
2 Defendant asserts Plaintiff fails to plausibly allege any of the standing
3 requirements—injury in fact, causation, and redressability. The Court analyzes each
4 prong and concludes that Plaintiff has adequately pled all three.
5 A. Injury in Fact
6 “To establish injury in fact, a plaintiff must show that he or she suffered ‘an
7 invasion of a legally protected interest’ that is ‘concrete and particularized’ and ‘actual or
8 imminent, not conjectural or hypothetical.’” Spokeo, 578 U.S. at 339 (quoting Lujan, 504
9 U.S. at 560). A “concrete” injury “must be ‘de facto’; that is, it must actually exist.” Id. at
10 340 (citing Black’s Law Dictionary 479 (9th ed. 2009)). Although “the most obvious”
11 concrete harms are tangible—e.g., physical or monetary, “various intangible harms can
12 also be concrete.” TransUnion, 141 S. Ct. at 2204. These include injuries “with a close
13 relationship to harms traditionally recognized as providing a basis for lawsuits in
14 American courts,” such as “reputational harms, disclosure of private information, and
15 intrusion upon seclusion.” Id.
16 “A right to privacy ‘encompass[es] the individual’s control of information
17 concerning his or her person.’” In re Facebook, Inc. Internet Tracking Litig., 956 F.3d
18 589, 598 (9th Cir. 2020) (quoting Eichenberger v. ESPN, Inc., 876 F.3d 979, 983 (9th
19 Cir. 2017)). Violations of this right fall into the category of traditionally recognized
20 harms. Patel v. Facebook, Inc., 932 F.3d 1264, 1272 (9th Cir. 2019) (recognizing the
21 “common law roots of the right to privacy”). As a result, intrusions into privacy can
22 constitute an injury in fact.
23 The Ninth Circuit’s recent opinion in In re Facebook is instructive. 956 F.3d 589.
24 The issue was whether Facebook-users had standing to sue Facebook, Inc. (“Facebook”)
25 for tracking their browsing histories after they had logged out of Facebook. Id. at 595–96.
26 The Ninth Circuit reasoned that Facebook’s practices enable it to “amass a great degree
27 of personalized information . . . without affording users a meaningful opportunity to
28 control or prevent the unauthorized exploration of their private lives.” Id. at 599. Quoting
1 the Third Circuit, the Ninth Circuit conclusively rejected the argument that the collection
2 of private data is not an injury in fact: “In an era when millions of Americans conduct
3 their affairs increasingly through electronic devices, the assertion . . . that federal courts
4 are powerless to provide a remedy when an internet company surreptitiously collected
5 private data . . . is untenable.” Id. (quoting In re: Google Inc. Cookie Placement
6 Consumer Priv. Litig., 934 F.3d 316, 325 (3d Cir. 2019)). For this reason, the Ninth
7 Circuit upheld standing. Id. at 598–99.
8 Here, Plaintiff alleges Defendant collected his personal information in violation of
9 the California Constitution and various California statutes. (Am. Compl. ¶ 1.) Among the
10 collected data are his “geolocation, . . . communications related to his personal
11 characteristics, mode of living, purchase decisions, personal choices, app selections,
12 spending habits, and click choices.” (Id. ¶ 38.) As in In re Facebook, Plaintiff’s inability
13 to “control or prevent the unauthorized exploration” of his private affairs is the root of the
14 alleged injury. See 959 F.3d at 599. Thus, on first blush, the Court finds no pleading
15 deficiencies.
16 Defendant counters with three arguments: the Amended Complaint fails to allege
17 (1) that Defendant’s actions affected Plaintiff in particular, (2) that the collection of data
18 diminished the economic value of Plaintiff’s data, and (3) that there was a lack of consent
19 to data collection. (MTD 19–23.) None is persuasive.
20 First, the Complaint plausibly alleges Defendant collected Plaintiff’s data. To be
21 sure, Plaintiff’s injury must be “specific to [him].” See Gaos v. Google Inc., No. 5:10-cv-
22 4809 EJD, 2012 WL 1094646, at *3 (N.D. Cal. Mar. 29, 2012). There is, in other words,
23 no standing if Plaintiff fails to allege that Defendant collected his data. But in this case,
24 the Complaint adequately pleads an injury specific to him. The Complaint alleges,
25 “Defendant openly acknowledges that its software development kit (SDK), made
26 available to and inserted by other companies as a plug-in to their own smartphone
27 applications, intercepts and reads massive amounts of consumer data using its technology
28 in order to identify unique consumers and report on their travel and habits for marketing,
1 verification, and other purposes.” (Am. Compl. ¶ 67.) Plaintiff further alleges that he
2 “owns, carries, and regularly uses a cellular device that contains Defendant’s Kochava
3 monitoring and intercepting SDK” embedded in apps (id. ¶ 36); “regularly uses his cell
4 phone to access these application(s) in which Defendant utilizes its embedded SDK to
5 track his geolocation, and to monitor and intercept communications” (id. ¶ 38); and “did
6 not know until recently that his purchase decisions, his movements, and his locations,
7 were being tracked by Defendant to market, sell, and advertise to him” (id. ¶ 40). This is
8 enough for the Court to reasonably infer that Defendant collected and sold Plaintiff’s
9 data.
10 Second, there is no constitutional requirement that Plaintiff demonstrate lost
11 economic value. Indeed, the Ninth Circuit explicitly rejected this argument in In re
12 Facebook, reversing the lower court’s holding to the contrary. 959 F.3d at 599. The Ninth
13 Circuit reasoned, “California law recognizes a right to disgorgement of profits resulting
14 from unjust enrichment, even where an individual has not suffered a corresponding loss.”
15 Id. Because California law recognizes “an entitlement to unjustly earned profits,” to
16 establish standing, plaintiffs must only establish a stake in the profits garnered from their
17 personal data and that it is unjust for the defendant to retain those profits. Id. at 600.
18 Plaintiff here does so. The Amended Complaint alleges, “Plaintiff and members of the
19 Class conferred a benefit on Defendant through the use and dissemination of Plaintiff’s
20 and Class members’ personal information, geolocation data, and communications . . .
21 which Defendant used and disseminated for its own monetary benefit.” (Am. Compl. ¶¶
22 237–38.) Thus, under Ninth Circuit precedent, Plaintiff has carried his pleading burden.2
23
24
2 Some of Plaintiff’s claims may require an economic injury as an element of the claim, but such
25 a “statutory standing” requirement does not eliminate constitutional standing. See Salmon Spawning &
Recovery All. v. Gutierrez, 545 F.3d 1220, 1225 (9th Cir. 2008) (“If a plaintiff has shown sufficient
26
injury to satisfy Article III, but has not been granted statutory standing, the suit must be dismissed under
27 Federal Rule of Civil Procedure 12(b)(6), because the plaintiff cannot state a claim upon which relief
can be granted.”). As a result, statutory standing elements are not relevant to Defendant’s Rule 12(b)(1)
28
1 Third, Plaintiff alleges he did not consent to Defendant’s collection of his data.
2 Defendant argues that users consented to its data practices in two ways: (1) they
3 consented to sharing their location with a third-party app developer when they
4 downloaded the application and (2) they failed to opt-out by contacting Defendant and
5 requesting data deletion. (MTD 18, 23.) Neither constitutes consent.
6 To begin, Defendant’s argument requires the Court to make inferences in its favor.
7 The Amended Complaint does not directly allege that Plaintiff consented to sharing his
8 location with a third-party app developer or that he had the opportunity to opt out of
9 location sharing. Rather, Plaintiff copies and pastes FAQ-type information from
10 Defendant’s website into the Amended Complaint:
11 Can data be deleted upon request?
User data may be deleted from Kochava, so long as the request comes
12
directly from the user.
13
14 (Id. ¶ 67.) And Plaintiff includes a section of Defendant’s complaint against the FTC:
15 Even if an injury to the consumer did indeed occur, it is reasonably
avoidable by the consumer themselves by way the opt-out provision to allow
16
the data collection. In other words, the consumer agreed to share its location
17 data with an app developer. As such, the consumer should reasonably expect
that this data will contain the consumer’s locations, even locations which the
18
consumer deems is sensitive.
19
(Id. ¶ 104.) On a facial challenge to standing, the Court must draw all reasonable
20
inferences in favor of the non-moving party. See Wolfe v. Strankman, 392 F.3d 358, 362
21
22
23
24
25
26
points out that CIPA allows “[a]ny person who has been injured” to recover damages and suggests that
27 this language requires economic loss. (MTD 20.) But Defendant cherry-picks the language. The statute
specifically provides, “It is not a necessary prerequisite to an action pursuant to this section that the
28
1 (9th Cir. 2004). Thus, the Court accepts that, as alleged in the Amended Complaint,
2 Defendant made these statements; but the Court cannot rely on the substance of the
3 statements to grant a facial standing challenge.3
4 Even if the Court accepts that Plaintiff consented to a third-party app developer
5 collecting his data and that he could have contacted Defendant to request the deletion of
6 his data, Defendant’s argument is still deficient. “Consent is . . . generally limited to the
7 specific conduct authorized.” Javier v. Assurance IQ, LLC, No. 4:20-cv-02860-JSW,
8 2021 WL 940319, at *2 (N.D. Cal. Mar. 9, 2021); see also In re Google Assistant Priv.
9 Litig., 457 F. Supp. 3d 797, 824 (N.D. Cal. 2020) (finding that consent to data collection
10 does not extend to data disclosure). Plaintiff gave consent for data collection to app
11 developers, but not to Defendant. Defendant then “surreptitiously intercepts and collects
12 Plaintiff’s and Class Members’ activity while using smartphone applications that have
13 installed its SDK.” (Am. Compl. ¶ 76.) Even if Plaintiff gave full consent to third-party
14 app developers to collect his data, consent to that specific conduct does not extend to
15 Defendant’s collection of Plaintiff’s data through backdoors built into apps or to
16 Defendant’s dissemination of that information for profit.
17 Likewise, the failure to opt-out does not demonstrate consent, particularly when
18 users are unaware of the data collection practices. Again, the Amended Complaint quotes
19 from Defendant’s own statements that it deletes user data “so long as the request comes
20 directly from the user.” (Id. ¶ 67.) Defendant latches onto this allegation to argue that
21 Plaintiff’s failure to request the deletion of his data constitutes consent. But the SDK
22 siphons data “unbeknownst to consumers,” who have “no way of discovering that
23 Defendant intercepted and recorded [their] telephonic digital communications without
24 Class Members’ knowledge or consent.” (Id. ¶¶ 5, 148.) In short, without disclosure, the
25
26
27 3 Based on the Court’s experience and common sense, it may assume that third-party apps
included privacy policies or terms of service, but it will not assume the content of those policies or
28
1 opportunity to opt-out cannot create consent. Here, Plaintiff was not only unaware of his
2 ability to opt-out, but also unaware of Defendant’s data collection altogether.
3 Thus, Defendant’s arguments are unavailing, and the Court finds that Plaintiff
4 plausibly pleads an injury in fact.
5 B. Causation
6 To establish standing, plaintiffs must also show “a causal connection between the
7 injury and the conduct complained of—the injury has to be ‘fairly . . . trace[able] to the
8 challenged action of the defendant, and not . . . th[e] result [of] the independent action of
9 some third party not before the court.” Lujan, 504 U.S. at 560 (quoting Simon v. E. Ky.
10 Welfare Rts. Org., 426 U.S. 26, 40–42 (1976)). The Ninth Circuit has instructed that the
11 “Article III causation threshold” is “less rigorous” than proximate causation. Canyon
12 Cnty. v. Syngenta Seeds, Inc., 519 F.3d 969, 974 n.7 (9th Cir. 2008). Plaintiff need not
13 demonstrate that Defendants were the “sole source” of his injury. Barnum Timber Co. v.
14 E.P.A., 633 F.3d 894, 901 (9th Cir. 2011). Rather, he must only “establish a line of
15 causation’ between [D]efendants’ action and [his] alleged harm that is more than
16 ‘attenuated.’” See Maya v. Centex Corp., 658 F.3d 1060, 1070 (9th Cir. 2011).
17 Defendant suggests it is third-party app developers’ actions, and not Defendant’s
18 actions, that caused Plaintiff’s alleged injury. (MTD 23.) But it is Defendant’s
19 interception, packaging, and reselling of Plaintiff’s data that constitute the privacy
20 violations in this case. Third-party apps are merely the vessel for Defendant’s SDK to
21 collect data. (Am. Compl. ¶ 5 (“App developers embed SDKs into their app [] and may
22 not know the full extent and functions of the code in the SDK.”).) Moreover, even if
23 third-party app developers were the primary cause of the collection of data, Defendant is
24 the sole cause of the repackaging and sale of the data. (Id. ¶ 170.) Thus, the third-party
25 app developers’ actions do not sever the causal connection between Defendant’s actions
26 and Plaintiff’s alleged injury.
27
28
1 C. Redressability
2 Finally, a plaintiff must sufficiently plead a likelihood that the injury will be
3 “redressed by a favorable decision.” Simon, 426 U.S. at 38. Plaintiff has done so here. He
4 alleges Defendant’s data collection practices are ongoing and consumers are “unable to
5 take reasonable steps to avoid” the resulting intrusions to privacy. (Am. Compl. ¶ 102.)
6 The data collection is “opaque to consumers, who typically do not know who has
7 collected their data and how it is being used,” and Defendant sells the data to companies
8 with which the consumers have never interacted. (Id. ¶¶ 101–102.)
9 Defendant argues that injunctive relief cannot redress the alleged harm because
10 Defendant’s own actions have already provided relief. (MTD 23–24.) Defendant
11 introduced a new “Privacy Block” capability, “which removes health services location
12 data from the Kochava Collective marketplace.” (Am. Compl. ¶ 105.) Generally, a
13 defendant’s “voluntary cessation” of the challenged conduct does not moot the case or
14 eliminate standing. See Friends of the Earth, Inc. v. Laidlaw Environmental Servs.
15 (TOC), Inc., 528 U.S. 167, 189 (2000) (explaining justification of voluntary cessation
16 doctrine). As a result, the “Privacy Block” does not necessarily shield Defendant from
17 suit. Moreover, even if this new capability partially redressed the harm, its coverage is
18 limited. The “Privacy Block” protects only health services location data. Plaintiff
19 complains of a broader injury, including tracking consumers to “sensitive locations,” like
20 places of worship, domestic abuse shelters, temporary housing shelters, and “places
21 inferring LGBTQ+ identification.” (Id. ¶ 86.) Therefore, the “Privacy Block” does not
22 eliminate redressability.
23 For these reasons, the Court concludes Plaintiff plausibly alleges standing and
24 accordingly DENIES Defendant’s Motion to Dismiss pursuant to Rule 12(b)(1).
25 VENUE TRANSFER
26 Defendant also moves to transfer this action to the United States District Court for
27 the District of Idaho, Northern Division, under 28 U.S.C. § 1404(a).
28
1 I. Legal Standard
2 “For the convenience of parties and witnesses, in the interest of justice, a district
3 court may transfer any civil action to any other district . . . where it might have been
4 brought[.]” 28 U.S.C. § 1404(a). Section 1404 “place[s] discretion on the district court to
5 adjudicate motions for transfer according to an individualized, case-by-case consideration
6 of convenience and fairness.” Stewart Org., Inc. v. Ricoh Corp., 487 U.S. 22, 29 (1988).
7 District courts employ a two-step framework to resolve a transfer motion. A court first
8 asks whether the plaintiff could have originally brought the action in the proposed
9 transferee forum. See Hoffman v. Blaski, 363 U.S. 335, 344 (1960). If the action could
10 have been brought there, then the court weighs “a number of case-specific factors” based
11 in convenience and fairness. Stewart Org., 487 U.S. at 29–30.
12 II. Analysis
13 A. Availability of Alternative Forum
14 The parties do not dispute that this action “might have been brought” in the District
15 of Idaho, but the Court must nonetheless address the issue. See In re Bozic, 888 F.3d
16 1048, 1053 (9th Cir. 2018) (requiring courts to consider the issue sua sponte). “The
17 phrase where an action ‘could have been brought’ is interpreted to mean that the
18 proposed transferee court would have subject matter jurisdiction, proper venue, and
19 personal jurisdiction.” Peregrine Semiconductor Corp. v. RF Micro Devices, Inc., No.
20 12-cv-911-IEG-WMC, 2012 WL 2068728, at *2 (S.D. Cal. June 8, 2012).
21 Subject Matter Jurisdiction: The Class Action Fairness Act (“CAFA”), 28 U.S.C.
22 § 1332(d)(2), provides the Court with subject matter jurisdiction. CAFA requires that the
23 “matter in controversy exceeds the sum or value of $5,000,000, exclusive of interest and
24 costs” and that at least one member of the class is “a citizen of a State different from any
25 defendant.” Id. Plaintiff’s allegations account for an amount in controversy exceeding
26 $5,000,000 (Am. Compl. ¶ 31), and Plaintiff is a citizen of California, while Defendant is
27 a citizen of Idaho and Delaware (id. ¶ 30). Thus, based on the pleadings, the federal court
28 in the District of Idaho has subject matter jurisdiction.
1 Venue: Venue is proper in “a judicial district in which any defendant resides, if all
2 defendants are residents of the State in which the district is located.” 28 U.S.C.
3 § 1391(b)(1). Here, there is only one Defendant, and its principal place of business and
4 registered agent are in Idaho. (Am. Compl. ¶¶ 40–41.) Therefore, venue is proper in the
5 District of Idaho.
6 Personal Jurisdiction: Idaho courts have personal jurisdiction over this matter. For
7 corporations, general jurisdiction exists where the Defendant’s principal place of business
8 sits. See Daimler AG v. Bauman, 571 U.S. 117, 137 (2014) (“With respect to a
9 corporation, the place of incorporation and principal place of business are ‘paradig[m] . . .
10 bases for general jurisdiction.’” (quoting Goodyear Dunlop Tires Operations, S.A. v.
11 Brown, 564 U.S. 915, 924 (2011))). Because Defendant’s principal place of business sits
12 in Idaho, the Idaho courts have personal jurisdiction over the matter.
13 Accordingly, the transfer rests on the case-specific factors and the Court’s
14 discretion.
15 B. Convenience and Fairness Factors
16 When an action could have been brought in the potential transferee court, a district
17 court must decide whether transfer is appropriate. Williams v. Bowman, 157 F. Supp. 2d
18 1103, 1105–06 (N.D. Cal. 2001). Section 1404(a) expressly identifies the following
19 considerations: “convenience of the parties,” “convenience of . . . witnesses,” and “the
20 interest of justice.” 28 U.S.C. § 1404(a). Although the statute identifies only these
21 factors, courts deem “forum non conveniens considerations [to be] helpful in deciding a
22 § 1404 transfer motion.” Decker Coal Co. v. Commonwealth Edison Co., 805 F.2d 834,
23 843 (9th Cir. 1986). District courts, therefore, consider the following factors to decide a
24 transfer motion: (1) the plaintiff’s choice of forum, (2) convenience of the parties,
25 (3) convenience of the witnesses, (4) ease of access to the evidence, (5) familiarity of
26 each forum with the applicable law, (6) feasibility of consolidation of other claims,
27 (7) any local interest in the controversy, and (8) relative court congestion and time to trial
28 in each forum. See Jones v. GNC Franchising, Inc., 211 F.3d 495, 498–99 (9th Cir.
1 2000); Barnes & Noble, Inc. v LSI Corp., 823 F. Supp. 2d 980, 993 (N.D. Cal. 2011).
2 “This list is non-exclusive, and courts may consider other factors, or only those factors
3 which are pertinent to the case at hand.” Martin v. Glob. Tel*Link Corp., No. 15-cv-
4 00449-YGR, 2015 WL 2124379, at *2 (N.D. Cal. May 6, 2015).
5 1. Plaintiff’s Choice of Forum
6 A court may afford “great weight” to the plaintiff’s choice of forum, especially
7 “when the plaintiff has chosen to file the lawsuit in its home forum.” Lou v. Belzberg,
8 834 F.2d 730, 739 (9th Cir. 1987). The deference to the plaintiff’s choice is reduced
9 (1) in a class action spanning multiple states and (2) when the plaintiff does not reside in
10 or have significant connections to the forum. See id. at 739 (class action); Llevat v. True
11 N. Brands, LLC, No. 21-cv-656-BAS-AGS, 2021 WL 5449033, at *7 (S.D. Cal. Nov. 22,
12 2021) (plaintiff’s out-of-forum residence); Heredia v. Sunrise Senior Living LLC, No. 18-
13 cv-00616-HSG, 2018 WL 5734617, at *5 (N.D. Cal. Oct. 31, 2018) (significant
14 connections). Finally, when there is no evidence of forum-shopping, courts generally
15 afford at least some deference to the plaintiffs’ choice of forum. See Urista v. Wells
16 Fargo & Co., No. 20-cv-01689-H-AHG, 2020 WL 7385847, at *2–3 (S.D. Cal. Dec. 16,
17 2020) (“[E]ven though this is a class action, [the plaintiff’s] choice is entitled to
18 deference because there is no evidence that [the plaintiff] engaged in forum shopping and
19 both [the plaintiff] and [the defendants] have significant contacts with the [forum],
20 including those that gave rise to this action.”).
21 Here, Plaintiff and all putative Class Members reside in California, and a
22 substantial part of the injury occurred in the Southern District of California. (Am. Compl.
23 ¶¶ 35, 138.) Although Plaintiff does not reside in this district, on balance, the Court does
24 not discern evidence of forum shopping. As such, Plaintiff’s choice of forum deserves
25 significant weight, only slightly reduced by the class action status and Plaintiff’s out-of-
26 district residence.
27
28
1 2. Convenience of the Witnesses
2 “In determining the convenience of the witnesses, the Court must examine the
3 materiality and importance of the anticipated witnesses’ testimony and then determine
4 their accessibility and convenience to the forum.” Gherebi v. Bush, 352 F.3d 1278, 1304
5 n.33 (9th Cir. 2003), vacated on other grounds, 542 U.S. 952 (2004). In considering the
6 convenience factor, courts should consider “not only the number of witnesses located in
7 the respective districts, but also the nature and quality of their testimony in relationship to
8 the issues in the case.” Kannar v. Alticor, Inc., No. C-08-5505 MMC, 2009 WL 975426,
9 at *2 (N.D. Cal. Apr. 9, 2009). Indeed, “to show inconvenience to witnesses, the moving
10 party should state the witnesses’ identities, locations, and content and relevance of their
11 testimony.” Meyer Mfg. Co. v. Telebrands Corp., No. CIV. S-11-3153 LKK/DAD, 2012
12 WL 1189765, at *6 (E.D. Cal. Apr. 9, 2012) (citing Florens Container v. Cho Yang
13 Shipping, 245 F. Supp. 2d 1086, 1092–93 (N.D. Cal. 2002)); see also Cochran v. NYP
14 Holdings, Inc., 58 F. Supp. 2d 1113, 1119 (C.D. Cal. 1998). Further, not all witnesses are
15 treated equal: “[I]n balancing the convenience of the witnesses, primary consideration is
16 given to third part[ies], as opposed to employee witnesses.” Hawkins v. Gerber Prod.
17 Co., 924 F. Supp. 2d 1208, 1215 (S.D. Cal. 2013) (quoting Kannar, 2009 WL 975426, at
18 *2).
19 Here, Defendant, the moving party, fails to provide the “witnesses’ identities,
20 locations, and content and relevance of their testimony.” See Meyer Mfg. Co., 2012 WL
21 1189765, at *6. The Court accepts the contention that the “majority” of Defendant’s
22 officers and employers are “based and/or located in Sandpoint, Idaho.” (Manning Decl.
23 ¶ 9, ECF No. 21-2.) But Defendant also has offices in Dublin, Ireland and Portland,
24 Oregon. (Id. ¶ 6.) It is not clear how many witnesses are in Idaho or what the “nature and
25 quality” of their testimony would be. See Kannar, 2009 WL 975426, at *2. Moreover,
26 Defendant does not name or indicate any inconvenience to third-party witnesses, and it is
27 not Plaintiff’s burden to do so. As a result, the Court discerns no inconvenience to non-
28
1 party witnesses, and Defendant does not provide enough information for the Court to
2 estimate the inconvenience to employee-witnesses.
3 Accordingly, Defendant has not carried its burden to establish this factor weighs in
4 favor of transfer.
5 3. Familiarity of Each Forum with Applicable Law
6 Plaintiff alleges violations of California law. Although courts within the District of
7 Idaho are competent to apply California law, “[a] California district court is more familiar
8 with California law than district courts in other states.” In re Ferrero Litig., 768 F. Supp
9 2d 1074, 1081 (S.D. Cal. 2011). In some cases, the application of law is “not especially
10 complex or specialized.” See Barnstormers, Inc. v. Wing Walkers, LLC, No. 09-cv-2367
11 BEN (RBB), 2010 WL 2754249, *3 (S.D. Cal. July 9, 2010). But the Court cannot
12 conclude that California’s data privacy statutory regime is “not especially complex or
13 specialized.” As demonstrated in the analysis below on Defendant’s Motion to Dismiss
14 pursuant to Rule 12(b)(6), the issues are a tangle of law and fact. This factor, therefore,
15 weighs against transfer.
16 4. Local Interest in the Controversy
17 “[T]his factor takes into account the current and transferee forum’s interest ‘in
18 having localized controversies decided at home[.]’” Hangzhou Chic Intelligent Tech. Co.
19 v. Swagway, LLC, No. 16-cv-04804-HSG, 2017 WL 1425915, at *4 (N.D. Cal. Apr. 21,
20 2017) (quoting Decker Coal Co., 805 F.2d at 843).
21 California has a demonstrated interest in the privacy of its residents. To begin,
22 Article I, Section 1 of the California Constitution provides: “All people are by nature free
23 and independent and have inalienable rights. Among these are enjoying and defending
24 life and liberty, acquiring, possessing, and protecting property, and pursuing and
25 obtaining safety, happiness, and privacy.” Cal. Const. art. I, § 1 (emphasis added). The
26 words “and privacy” were added by California voters via ballot initiative on November 7,
27 1972. See Hill v. Nat’l Collegiate Athletic Ass’n, 7 Cal. 4th 1, 15 (1994). With respect to
28 the amendment, the California Supreme Court concluded: “The principal focus of the
1 Privacy Initiative is readily discernible. The Ballot Argument warns of unnecessary
2 information gathering, use, and dissemination by public and private entities—images of
3 ‘government snooping,’ computer stored and generated ‘dossiers’ and ‘“cradle-to-grave”
4 profiles on every American’ dominate the framers’ appeal to the voters.” Id. at 21. The
5 initiative’s “primary purpose” was “to afford individuals some measure of protection
6 against this most modern threat to personal privacy.” Id.4
7 Moreover, the California Legislature has demonstrated the forum’s interest in
8 consumer protection and data privacy. California’s privacy statutes have both breadth and
9 depth. Indeed, the statutes at issue in this case exemplify this complex regime. For
10 instance, California’s UCL, a consumer protection statute, has expansive scope:
11 [T]he Legislature . . . intended by this sweeping language to permit tribunals
to enjoin on-going wrongful business conduct in whatever context such
12
activity might occur. Indeed, . . . the section was intentionally framed in its
13 broad, sweeping language, precisely to enable judicial tribunals to deal with
the innumerable new schemes which the fertility of man’s invention would
14
contrive.
15
16 Cel-Tech Commc’ns, Inc. v. L.A. Cellular Tel. Co., 20 Cal. 4th 163, 181 (1999) (internal
17 quotation marks omitted). Other statutes are narrower but carry a bigger stick. For
18 instance, CDAFA applies only to “computers, computer systems, and computer data,” but
19 allows for compensatory damages, punitive damages, and attorneys’ fees. Cal. Penal
20 Code § 502(a), (e). Even more severe, persons injured by, inter alia, the electronic
21 collection of confidential communications are entitled to $5,000 per violation or treble
22 damages (if any actual damages were sustained). Cal. Penal Code §§ 632, 637.2(a). These
23 statutes evidence California’s serious concern with consumer protection and data
24 privacy.5
25
26
4 By contrast, a constitutional amendment adding a “right to privacy” was rejected by Idaho
27 voters in 1970. See Planned Parenthood Great Nw. v. State, 522 P.3d 1132, 1148 (Idaho 2023).
5 Other statutes further highlight the forum’s interest. In 2018, California passed “the nation’s
28
1 Thus, California’s strong interest in these issues is readily apparent, and the local
2 interests in the controversy weigh against transfer.
3 5. Feasibility of Consolidation of Other Claims
4 The main countervailing weight against transfer is judicial economy. “An
5 important consideration in determining whether the interests of justice dictate a transfer
6 of venue is the pendency of a related case in the transferee forum.” Hawkins, 924 F.
7 Supp. 2d at 1214 (quoting Callaway Golf Co. v. Corp. Trade, Inc., No. 09-cv-384
8 L(POR), 2010 WL 743829, at *7 (S.D. Cal. Mar. 1, 2010)). In such cases, transfer is
9 preferable because of “the positive effects it might have in possible consolidation of
10 discovery and convenience to witnesses and parties.” Id. (quoting Callaway Golf, 2010
11 WL 743829, at *7).
12 A court in the District of Idaho is hearing three related cases: Defendant’s suit
13 against the FTC, the FTC’s suit against Defendant, and Washington residents’ class
14 action against Defendant. (Mariam Decl. ¶¶ 4–6.) Although the FTC cases may be
15 distinguishable by their administrative nature, the Washington residents’ class action
16 largely resembles the issues here. The Court acknowledges that judicial economy may be
17 served by consolidating discovery in these cases. Although the governing law at issue is
18 distinct, the factual issues will largely overlap.
19 Several considerations, however, detract from the weight of this factor. First,
20 Plaintiff filed his case before the Washington class action commenced. In the cases cited
21 by Defendant, the transferee court transferred the later-filed case to the court with the
22 first-to-file plaintiffs. (Mot. Venue 13.) Second, the Court cannot be certain that the later-
23
24
25
26
27
Sanford Shatz & Susan E. Chylik, The California Consumer Privacy Act of 2018: A Sea Change in the
28
1 filed class action will reach discovery or that the FTC suits can feasibly be consolidated.
2 Third, the risk of inconsistent judgments is low. The Court has ruled on Defendant’s
3 standing challenge—a necessary step to continuing to exercise jurisdiction. All other
4 judgments will be specific to the claims at issue, which almost exclusively fall under
5 California law. The Idaho court, by contrast, will be applying Washington law and
6 federal regulations and statutes. As a result, differing judgments would be less
7 inconsistent than distinguishable. Thus, this factor favors transfer but has diminished
8 weight.
9 6. Other Factors
10 The Court finds the other factors to be neutral or insignificant in this case. The
11 convenience of the parties cancels—Idaho is more convenient for Defendant, while
12 California is more convenient for Plaintiff and Class Members. The evidence likely is
13 predominantly electronic and, therefore, easily transported. And finally, the relative court
14 congestion and time of trial in each forum does not significantly move the needle.
15
16 * * *
17
18 In conclusion, the Court gives significant credence to argument for judicial
19 economy but ultimately finds that the fairness and public policy arguments win the day.
20 The Plaintiff’s choice of forum, this Court’s familiarity with California law, and
21 California’s interest in data privacy and consumer protection outweigh the potential
22 convenience of consolidating the cases in the District of Idaho. Accordingly, the Court
23 DENIES Defendant’s Motion for Transfer.
24 FAILURE TO STATE A CLAIM
25 I. Legal Standard
26 A motion to dismiss pursuant to Rule 12(b)(6) tests the legal sufficiency of the
27 claims asserted in the complaint. Navarro v. Block, 250 F.3d 729, 731 (9th Cir. 2001). “A
28 Rule 12(b)(6) dismissal may be based on either a ‘lack of cognizable legal theory’ or ‘the
1 absence of sufficient facts alleged under a cognizable legal theory.’” Johnson v. Riverside
2 Healthcare Sys., LP, 534 F.3d 1116, 1121 (9th Cir. 2008) (quoting Balistreri v. Pacifica
3 Police Dep’t, 901 F.2d 696, 699 (9th Cir. 1990)).
4 A complaint must plead sufficient factual allegations to “state a claim to relief that
5 is plausible on its face.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (cleaned up). The
6 court must accept all factual allegations pleaded in the complaint as true and must
7 construe them and draw all reasonable inferences in favor of the nonmoving party. Cahill
8 v. Liberty Mut. Ins. Co., 80 F.3d 336, 337–38 (9th Cir. 1996). The court, however, need
9 not accept conclusory allegations as true. Rather, it must “examine whether conclusory
10 allegations follow from the description of facts as alleged by the plaintiff.” Holden v.
11 Hagopian, 978 F.2d 1115, 1121 (9th Cir. 1992) (citations omitted). “A claim has facial
12 plausibility when the plaintiff pleads factual content that allows the court to draw the
13 reasonable inference that the defendant is liable for the misconduct alleged.” Iqbal, 556
14 U.S. at 678.
15 II. Analysis
16 The Amended Complaint alleges violations of the California Constitution,
17 CDAFA, CIPA, UCL, and common law principles of unjust enrichment. Defendant now
18 moves to dismiss each of these causes of action.
19 A. Invasion of Privacy
20 Plaintiff’s first cause of action alleges invasion of privacy, inter alia, under the
21 California Constitution. Defendant argues Plaintiff’s allegations do not sustain the cause
22 of action—that is, they do not amount to a “sufficiently serious” invasion of privacy “to
23 constitute an egregious breach of the social norms underlying the privacy right.” See Hill,
24 7 Cal. 4th at 37. Plaintiff counters that the seriousness of the invasion is a question for the
25 finder of fact, not appropriate for the pleadings stage. The Court agrees with Plaintiff.
26 The right to privacy is neither static nor objective. “[A]dvances in technology can
27 increase the potential for unreasonable intrusions into personal privacy.” Patel v.
28 Facebook, Inc., 932 F.3d 1264, 1272 (9th Cir. 2019). In this way, the right is dynamic
1 against new threats to privacy. It is also measured against the social norms of the day:
2 “questions of whether conduct is ‘egregious,’ ‘offensive,’ or violates ‘social norms’ tend
3 by their very nature to be subjective determinations about which reasonable jurists may
4 differ.” See Mastel v. Miniclip SA, 549 F. Supp. 3d 1129, 1139 (E.D. Cal. 2021).
5 Intrusions on privacy exist on a spectrum: “Courts have been hesitant to extend the
6 tort of invasion of privacy to the routine collection of personally identifiable information
7 as part of electronic communications. . . . By contrast, collection of intimate or sensitive
8 personally identifiable information may amount to a highly offensive intrusion.” In re
9 Vizio, Inc., Consumer Priv. Litig., 238 F. Supp. 3d 1204, 1233 (C.D. Cal. 2017). The
10 seriousness of a privacy invasion “requires a holistic consideration of factors such as the
11 likelihood of serious harm to the victim, the degree and setting of the intrusion, the
12 intruder’s motives and objectives, and whether countervailing interests or social norms
13 render the intrusion inoffensive.” In re Facebook, 956 F.3d at 606. For this reason, courts
14 hesitate to decide the issue at the pleadings stage. See id. (“The ultimate question of
15 whether Facebook’s tracking and collection practices could highly offend a reasonable
16 individual is an issue that cannot be resolved at the pleading stage.”); Mastel, 549 F.
17 Supp. 3d at 1139 (“[T]hese questions are typically more appropriately resolved by a
18 jury.”).
19 Here, the Court finds an egregious breach plausible. Far from the “routine
20 collection of personally identifiable information,” Plaintiff alleges the surreptitious
21 collection information that could reveal, for instance, a person’s religious affiliation,
22 sexual orientation, and medical condition. (Am. Compl. ¶ 11.) The Ninth Circuit’s
23 decision in In re Facebook is, again, instructive. The In re Facebook plaintiffs were
24 Facebook users alleging common law and statutory privacy violations.6 956 F.3d at 596.
25
26 6 In re Facebook primarily examines common law invasion of privacy. The common law tort of
invasion of privacy is distinct from invasion of privacy under the California Constitution. But in
27 articulating the test for invasion of privacy under the California Constitution, the California Supreme
Court borrowed from common law to define “serious violations” of the expectation of privacy. See Hill,
28
1 They alleged that Facebook surreptitiously “tracked their browsing histories after they
2 had logged out of the Facebook application.” Id. Facebook collected the Uniform
3 Resource Locator (“URL”) accessed by the users and the search terms used to find the
4 URL. Id. The Ninth Circuit emphasized, “Facebook’s tracking practices allow it to amass
5 a great degree of personalized information.” Id. at 599.
6 Similarly, in this case, the Amended Complaint outlines a data collection system
7 that compiles “rich personal data,” including the “[i]dentification of sensitive and private
8 characteristics of consumers from the location data sold.” (Am. Compl. ¶¶ 75, 99.) In
9 both cases, the defendants “fingerprinted” users and correlated a vast amount of personal
10 information without users’ knowledge. (Id. ¶ 75 (“Defendant is able to deliver targeted
11 advertising . . . by in essence ‘fingerprinting’ each unique device and user, as well as
12 connecting users across devices and devices across users.”)); In re Facebook, 956 F.3d at
13 599 (“Facebook gained a cradle-to-grave profile without users’ consent.”). Thus, the type
14 of information amassed is similarly revealing, and the method is similarly secretive.
15 These factors allow the Court to plausibly infer Defendant’s data-collection practices
16 amount to an egregious breach of social norms.
17 At this stage, Plaintiff has alleged enough to survive the Motion to Dismiss.
18 Accordingly, the Court DENIES Defendant’s Motion to Dismiss with respect to
19 Plaintiff’s invasion of privacy claim.
20 B. CDAFA
21 Under CDAFA, a person who knowingly accesses a computer system or computer
22 data may be guilty of a public offense. Section 502(c) states in relevant part:
23
24
25
26
27
956 F.3d at 601. Thus, the logic of In re Facebook extends to both common law invasion of privacy and
28
1 [A]ny person who commits any of the following acts is guilty of a public
offense:
2
3 (1) Knowingly accesses and without permission . . . uses any data,
computer, computer system, or computer network in order to . . . wrongfully
4
control or obtain money, property, or data.
5
(2) Knowingly accesses and without permission takes, copies, or makes use
6
of any data from a computer, computer system, or computer network, or
7 takes or copies any supporting documentation, whether existing or residing
internal or external to a computer, computer system, or computer network.
8
9 * * *
10
(7) Knowingly and without permission accesses or causes to be accessed any
11 computer, computer system, or computer network.
12
Cal. Penal Code § 502(c)(1)–(2), (7).
13
Each of these subsections requires a plaintiff to demonstrate that the defendant
14
acted “without permission.” Defendant argues the Amended Complaint fails to do so in
15
two ways: (i) Plaintiff and Class Members consented to Defendant’s data collection and
16
(ii) “without permission” means the circumvention of a computer’s barrier to access,
17
which is not alleged. (MTD 17–19.) The Court disagrees.
18
First, Plaintiff and Class Members did not “consent” to Defendant’s data collection
19
so as to grant “permission” under CDAFA. Defendant argues that Plaintiff consented
20
through voluntarily installing the SDK-embedded third-party apps on their phones,
21
receiving a “disclaimer or warning,” and bypassing the opportunity to opt-out of data
22
collection. Just as Defendant’s standing consent argument failed, its CDAFA consent
23
argument likewise fails. Defendant’s consent argument rests on allegations in the
24
Amended Complaint which quote from Defendant’s own statements. Like a facial
25
challenge under Rule 12(b)(1), a Rule 12(b)(6) challenges requires the Court to make all
26
reasonable inferences in Plaintiff’s favor. Cahill, 80 F.3d at 337–38. As a result, the
27
Court cannot assume that the content of Defendant’s quotes is true.
28
1 Moreover, the Defendant carries the ultimate burden of proving a consent defense.
2 Brown v. Google LLC, 525 F. Supp. 3d 1049, 1063 (N.D. Cal. 2021). To establish
3 consent under CDAFA, a defendant must “explicitly notify users of the practice at issue.”
4 Id. As a result, consent is limited to the specific disclosures provided to the user, and the
5 disclosures must have “only one plausibly interpretation for a finding of consent.” Id. In
6 other words, if the disclosure does not specifically and unambiguously inform the user of
7 the data collection practices, then the consent defense fails.
8 Even if the Court assumes that the “consumer agreed to share its location data with
9 an app developer,” (MTD 27 (quoting Am. Compl. ¶ 104)), the limitations of the
10 disclosures are fatal to Defendant’s argument. Nowhere does the Amended Complaint
11 suggest that consumers were aware of Defendant’s involvement, when they purportedly
12 consented to data collection. Indeed, Plaintiff alleges the opposite: “Plaintiff and Class
13 members were not aware and could not have reasonably expected that [an] unknown third
14 party would install software on their mobile devices that would track and transmit their
15 physical location and communications, and share Plaintiff’s and Class members’ personal
16 information with other parties.” (Am. Compl. ¶ 157.) To reiterate, “[c]onsent is . . .
17 generally limited to the specific conduct authorized.” Javier, 2021 WL 940319, at *2. As
18 such, a user’s consent to a third-party app developer collecting location data does not
19 extend to Defendant’s undisclosed collection of data.
20 To be clear, Defendant is not arguing that (1) Plaintiff consented to third-party app
21 developers collecting and disseminating his data and (2) Defendant received the data
22 from the third-party app developers. Nor could it. The Amended Complaint specifically
23 alleges that Defendant’s hidden software collected Plaintiff’s data directly, skipping the
24 middleman. Indeed, the app developers “may not know the full extent and functions of
25 the code in the SDK.” (Am. Compl. ¶ 5.) Thus, consent to third-party app developers
26 does not confer consent to Defendant. From these allegations, Plaintiff has plausibly
27 stated a lack of consent.
28
1 Second, the phrase “without permission” is not limited to conduct that circumvents
2 a device barrier or “hacks” a computer system. Defendant relies on Facebook, Inc. v.
3 Power Ventures, Inc. to support its narrow reading of “without permission.” No. C08-
4 05780 JW, 2010 WL 3291750, at *11 (N.D. Cal. July 20, 2010). But California courts
5 have more recently broadened their interpretation of “without permission”: “Nothing in
6 the Power Ventures decision held that overcoming ‘technical or code-based barriers’
7 designed to prevent access was the only way to establish that the Defendant acted without
8 permission.” In re Carrier IQ, Inc., 78 F. Supp. 3d 1051, 1099 (N.D. Cal. 2015)
9 (emphasis in original); see also Synopsys, Inc. v. Ubiquiti Networks, Inc., 313 F. Supp. 3d
10 1056, 1073 (N.D. Cal. 2018). The In re Carrier IQ, Inc. court reasoned that the plain
11 meaning of “without permission” should govern a consent defense and rejected the
12 Power Ventures court’s narrower reading of the statute. 78 F. Supp. 3d at 1099. The
13 Court is persuaded by the reasoning of In re Carrier IQ. The plain meaning of “without
14 permission” does not require the circumvention of computer barriers. Code hidden in
15 embedded software may plausibly use or take computer data “without permission.”
16 Moreover, even if the narrower interpretation of “without permission” did apply,
17 the Amended Complaint plausibly alleges the circumvention of a device barrier. Apple,
18 Inc. introduced an iPhone Application Tracking Transparency (ATT) framework, which
19 allows an iPhone user to turn off tracking. (Am. Compl ¶¶ 68, 69, 71.) But Defendant
20 boasts an end-run around Apple’s privacy framework: it “actively collects [device
21 tracking data], even after a consumer thinks [he has] disabled all tracking by apps on an
22 iPhone.” (Id. ¶ 73.) Plaintiff is himself an iPhone user. (Id. ¶ 72.) At this stage, the Court
23 can plausibly infer that this end-run constitutes “access that circumvents technical or
24 code-based barriers.” See Power Ventures, 2010 WL 3291750, at *12. Thus, even under
25 Defendant’s preferred statutory construction, Plaintiff has carried his pleading burden.
26 Accordingly, the Court DENIES Defendant’s Motion to Dismiss with respect to
27 Plaintiff’s CDAFA claim.
28
1 C. CIPA
2 Plaintiff alleges violations of three provisions under CIPA. The Court analyzes
3 each below.
4 As a preliminary matter, Defendant argues that all CIPA claims fail because
5 Plaintiff fails to identify a specific “communication” that was intercepted. But Defendant
6 misunderstands Plaintiff’s pleading burden. To survive a 12(b)(6) motion, a plaintiff must
7 plead factual content that “allows the court to draw the reasonable inference that the
8 defendant is liable for the misconduct alleged.” Iqbal, 556 U.S. at 678. Therefore,
9 pleading a CIPA violation does not require identifying a specific communication that was
10 intercepted. Such an inference is reasonable given the detailed allegations of Defendant’s
11 practices and Plaintiff’s alleged use of SDK-embedded apps.
12 1. Section 638.51
13 California law prohibits the installation of a pen register without first obtaining a
14 court order. Cal. Penal Code § 638.51 (“Section 638.51”). The statute defines a “pen
15 register” as “a device or process that records or decodes dialing, routing, addressing, or
16 signaling information transmitted by an instrument or facility from which a wire or
17 electronic communication is transmitted, but not the contents of a communication.” Id.
18 § 638.50(b).
19 Defendant argues that its SDK is not a “pen register” but provides no caselaw in
20 support. Indeed, it seems no court has interpreted this provision of CIPA. Traditionally,
21 law enforcement used “pen registers” in investigations to record all numbers called from
22 a particular telephone, and “pen registers” required physical machines. Today, pen
23 registers take the form of software.7 As a result, private companies and persons have the
24 ability to hack into a person’s telephone and gather the same information as law
25
26
7 See In re Order Authorizing Prospective & Continuous Release of Cell Site Location Recs., 31
27 F. Supp. 3d 889, 898 n.46 (S.D. Tex. 2014) (citing Susan Freiwald, Uncertain Privacy: Communication
Attributes After the Digital Telephony Act, 69 S. Cal. L. Rev. 949, 982–89 (1996) (describing the
28
1 enforcement. Perhaps for this reason, the California legislature does not limit its
2 prohibition on installing pen registers to law enforcement. Compare Cal. Penal Code
3 § 638.51 (“[A] person may not install or use a pen register . . .” (emphasis added)), with
4 id. § 638.52 (“A peace officer may make an application to a magistrate for an order . . .
5 authorizing . . . the installation and use of a pen register . . .” (emphasis added)).
6 Moreover, the Court cannot ignore the expansive language in the California
7 Legislature’s chosen definition. The definition is specific as to the type of data a pen
8 register collects—“dialing, routing, addressing, or signaling information transmitted by
9 an instrument or facility from which a wire or electronic communication is transmitted,”
10 but it is vague and inclusive as to the form of the collection tool—“a device or process.”
11 See Cal. Penal Code § 538.50(b). This indicates courts should focus less on the form of
12 the data collector and more on the result. Thus, the Court applies the plain meaning of a
13 “process” to the statute. A process can take many forms. Surely among them is software
14 that identifies consumers, gathers data, and correlates that data through unique
15 “fingerprinting.” (Am. Compl. ¶¶ 67, 74.) Thus, the Court rejects the contention that a
16 private company’s surreptitiously embedded software installed in a telephone cannot
17 constitute a “pen register.”
18 The Court is perplexed by Defendant’s second argument. Defendant argues,
19 “Plaintiff fails to show that the type of data purportedly collected by Kochava requires a
20 court order or a warrant.” (MTD 32.) Defendant then cites to In re Zynga Privacy
21 Litigation to show that email and IP addresses are often collected without a warrant. (Id.)
22 But Defendant misunderstands the elements of Plaintiff’s claim. CIPA extends civil
23 liability to the installation of a pen register without a court order. Cal. Penal Code
24 § 638.51. Plaintiff has alleged each necessary element of this claim: Defendant installed a
25 pen register without a court order. The fact that law enforcement can install a warrantless
26 pen register without offending the Fourth Amendment is immaterial. See In re Zynga
27 Priv. Litig., 750 F.3d 1098, 1108 (9th Cir. 2014) (“[W]arrantless installation of pen
28
1 registers, which capture only the telephone numbers that are dialed and not the calls
2 themselves, does not violate the Fourth Amendment.”).
3 As such, Plaintiff has alleged enough to survive the Motion to Dismiss.
4 Accordingly, the Court DENIES Defendant’s Motion to Dismiss with respect to
5 Plaintiff’s Section 638.51 claim.
6 2. Section 631
7 Another CIPA subsection, titled the Wiretapping Act, prohibits surreptitious
8 eavesdropping. It reads:
9 Any person who, by means of any machine, instrument, or contrivance, or in
any other manner, intentionally taps, or makes any unauthorized
10
connection . . . with any telegraph or telephone wire, line, cable, or
11 instrument, or who willfully and without the consent of all parties to the
communication, or in any unauthorized manner, reads, or attempts to read,
12
or to learn the contents or meaning of any . . . communication while the
13 same is in transit or passing over any wire, line, or cable . . . is punishable
[by fine or imprisonment].
14
15 Cal. Penal Code § 631(a) (“Section 631”).
16 Section 631 has two clauses: It punishes (1) persons who tap telegraph or
17 telephone wires, lines, cables, and instruments and (2) persons who attempt to learn in an
18 unauthorized manner the contents of communications passing over any wires, lines, and
19 cables. See id.; In re Google Inc., No. 13-MD-02430-LHK, 2013 WL 5423918, at *20
20 (N.D. Cal. Sept. 26, 2013). The first clause applies only to “telegraph and telephone”
21 wires, lines, cables or instruments, while the second clause applies to “any wire, line, or
22 cable.” As a result, courts have concluded that the first clause does not apply to internet
23 connections, while the second clause does. See Licea v. Am. Eagle Outfitters, Inc., No.
24 EDCV 22-1702-MWF (JPR), 2023 WL 2469630, at *5 (C.D. Cal. Mar. 7, 2023)
25 (rejecting the argument that the first clause of Section 631 applies to smart phones); In re
26 Google, 2013 WL 5423918, at *20 (“[T]he Court finds no reason to conclude that the
27 limitation of ‘telegraphic or telephone’ on ‘wire, line, cable, or instrument’ in the first
28 clause of the statute should be imported to the second clause of the statute.”). Because
1 Plaintiff’s claim relates to data collected from smartphone apps, only the second clause
2 can sustain the cause of action. With respect to the second clause, Defendant’s only
3 argument is that Plaintiff fails to allege that Defendant obtained the “contents” of a
4 communication.
5 The statute does not provide clarity on the definition of “contents,” and so courts
6 have penciled in a dividing line. On one hand, courts have found that the contact
7 information of the communicating parties and the geolocation of the communicating
8 parties are not the “contents” of a communication under Section 631. See People v. Suite,
9 101 Cal. App. 3d 680, 686 (Cal. Ct. App. 1980) (finding the trapping of police
10 emergency lines did not reveal the content of any communication, but “instead only
11 disclosed the telephone numbers of the callers”); cf. In re iPhone Application Litig., 844
12 F. Supp. 2d 1040, 1061 (N.D. Cal. 2012) (finding that mere geolocation data is not the
13 “contents” of a communication under the federal Wiretap Act). On the other hand,
14 information about particular activity conducted and search terms used on an app qualify
15 as the “contents” of communication. See Hammerling v. Google LLC, No. 21-cv-09004-
16 CRB, 2022 WL 17365255, at *10 (N.D. Cal. Dec. 1, 2022) (finding information
17 regarding “when and how often [users] interact” with third-party apps is not “contents” of
18 communication, but “particular activity on those apps, including products they searched
19 for and services they used within the application,” is the “contents” of communication);
20 In re Meta Pixel Healthcare Litig., No. 22-cv-03580-WHO, 2022 WL 17869218, at *11
21 (N.D. Cal. Dec. 22, 2022) (finding that search terms entered into a website constitute the
22 “contents” of a communication).
23 The allegations in this case fall on the “contents” of communication side of the
24 line. Plaintiff alleges that Defendant “monitor[s] and intercept[s] communications related
25 to his personal characteristics, mode of living, purchase decisions, personal choices, app
26 selections, spending habits, and click choices, amongst others.” (Am. Compl. ¶ 38.)
27 Defendant collects users’ “activity while using smartphone applications” (id. ¶ 76),
28 “search terms used by a device user which resulted in that user clicking on a particular
1 advertisement” (id. ¶ 78), and “a list of all interactions that user took within the app” (id.
2 ¶ 80). Based on these allegations, this case aligns better with Hammerling and In re Meta
3 than Suite and In re iPhone Application Litigation. Thus, Plaintiff has adequately pled
4 that Defendant intercepted the “contents” of a communication.
5 Accordingly, the Court DENIES Defendant’s Motion to Dismiss with respect to
6 Plaintiff’s Section 631 claim.
7 3. Section 632
8 “A person who, intentionally and without the consent of all parties to a confidential
9 communication, uses an electronic amplifying or recording device to eavesdrop upon or
10 record the confidential communication, whether the communication is carried on among
11 the parties in the presence of one another or by means of a telegraph, telephone, or other
12 device” violates California Penal Code § 632 (“Section 632”). In other words, to prevail
13 on a Section 632 claim, “a plaintiff must prove (1) an electronic recording of or
14 eavesdropping on (2) a ‘confidential communication’ (3) to which all parties did not
15 consent.” In re Google Inc., 2013 WL 5423918, at *22.
16 Defendant contends Plaintiff fails to allege the second element—the existence of a
17 “confidential” communication. The statute defines a “confidential communication” as a
18 communication “carried on in circumstances as may reasonably indicate that any party to
19 the communication desires it to be confined to the parties thereto . . . .” Cal. Penal Code
20 § 632(c). The California Supreme Court has further clarified, “[A] conversation is
21 confidential if a party to that conversation has an objectively reasonable expectation that
22 the conversation is not being overheard or recorded.” Flanagan v. Flanagan, 27 Cal. 4th
23 766, 768 (2002). The statutes “protects against intentional, nonconsensual recording of
24 telephone conversations regardless of the content of the conversation or the type of
25 telephone involved.” Id. at 776. As such, the plaintiff need not show an “additional belief
26 that the information would not be divulged at a later time to third parties.” Mirkarimi v.
27 Nevada Prop. 1 LLC, No. 12-cv-2160-BTM-DHB, 2013 WL 3761530, at *2 (S.D. Cal.
28 July 15, 2013).
1 California courts have generally applied “a presumption that Internet
2 communications do not reasonably give rise to” an objectively reasonable expectation
3 that the conversation is not being overheard or recorded. See Revitch v. New Moosejaw,
4 LLC, No. 18-cv-06827-VC, 2019 WL 5485330, *3 (N.D. Cal. Oct. 23, 2019); see also
5 Rodriguez v. Google LLC, No. 20-cv-04688-RS, 2021 WL 2026726, at *7 (N.D. Cal.
6 May 21, 2021) (applying the same presumption and noting “plaintiffs must plead unique,
7 definite circumstances rebutting California’s presumption against online
8 confidentiality”). Moreover, the Ninth Circuit has noted in dicta, “Analogously, e-mail
9 and Internet users have no expectation of privacy in the to/from addresses of their
10 messages or the IP addresses of the websites they visit because they should know that this
11 information is provided to and used by Internet service providers for the specific purpose
12 of directing the routing of information.” United States v. Forrester, 512 F.3d 500, 510
13 (9th Cir. 2008).
14 One court, however, has pushed back on this presumption. Brown v. Google LLC
15 concerned Google’s alleged collection of data while plaintiffs used their browsers in
16 “private browsing mode.” 525 F. Supp. 3d 1049, 1055 (N.D. Cal. 2021). The court
17 pointed out that the presumption rested on cases concerning internet messaging services
18 or emails. Id. at 1074. It distinguished these cases for two reasons. First, browsing
19 information “does not involve messages going to another person, who could share the
20 communication with others.” Id. And second, whereas the defendant’s policies in
21 previous cases disclosed that messages could be shared, Google’s policies did not. Id.
22 Therefore, the Court applied no presumption and concluded that the communications at
23 issue were confidential.
24 Brown, however, is distinguishable in part. Similar to the Brown-plaintiffs,
25 Plaintiff here alleges Defendant collected his “search terms” and other communications.
26 (Am. Compl. ¶ 78.) But unlike the Brown-plaintiffs, Plaintiff here fails to allege any
27 representations that his search terms would be kept private. In Brown, the defendant
28 indicated to users that searches in “incognito” or “private” mode would be protected. 525
1 F. Supp. 3d at 1057. For instance, the defendant’s privacy notice advised users concerned
2 with data collection to browse the web “privately using Chrome in Incognito mode” to
3 “manage your privacy.” Id. at 1058. No such allegations exist in this case. Thus, Brown is
4 distinguishable.
5 The Amended Complaint does not allow the Court to infer that Plaintiff had an
6 objectively reasonable expectation of privacy, and therefore, the Court cannot conclude
7 Plaintiff has plausibly stated a claim. Accordingly, the Court GRANTS Defendant’s
8 Motion to Dismiss with respect to Plaintiff’s Section 632 claim and GRANTS Plaintiff
9 leave to amend.
10 D. UCL
11 Under the UCL, civil remedies are available to any “person who has suffered
12 injury in fact and has lost money or property as a result of the unfair competition.” Cal.
13 Bus. & Prof. Code § 17204. Defendant argues Plaintiff fails to allege a cognizable injury
14 under the UCL. The Court agrees.8
15 In essence, the UCL stipulates two injury requirements: (1) an injury in fact and
16 (2) lost money or property. The first injury requirement is coextensive with the
17 constitutional minimum for standing. See Kwikset Corp. v. Superior Ct., 51 Cal. 4th 310,
18 323 (2011). The second demands more: a plaintiff must show “economic injury.” Id.
19 Thus, the UCL narrows the class of plaintiffs who may sue to those who suffered
20 economic injury.
21 To establish “economic injury,” a plaintiff may “(1) surrender in a transaction
22 more, or acquire in a transaction less, than he or she otherwise would have; (2) have a
23 present or future property interest diminished; (3) be deprived of money or property to
24 which he or she has a cognizable claim; or (4) be required to enter into a transaction,
25 costing money or property, that would otherwise have been unnecessary.” Id. In his
26 Opposition, Plaintiff offers three theories of economic loss: the value of his personal data,
27
8 Because the Court concludes Plaintiff failed to allege a UCL injury, it does not reach
28
1 the future value of his personal data, and the surrender of more in a transaction. (ECF No.
2 16 at 26–30.) None is persuasive.
3 First, Plaintiff “is claiming the economic value of the information that was
4 intercepted by Defendant.” (Id. at 26.) This economic value, he argues, satisfies the injury
5 requirement. But this argument misses the mark. Courts have consistently found that
6 alleging the economic value of data is not enough, if a plaintiff fails to allege the
7 economic value to him. See Bass v. Facebook, Inc., 394 F. Supp. 3d 1024, 1040 (N.D.
8 Cal. 2019) (finding that “to merely say the information was taken and therefore it has lost
9 value” does not confer UCL standing); Ji v. Naver Corp., No. 21-cv-05143-HSG, 2022
10 WL 4624898, at *9 (N.D. Cal. Sept. 30, 2022) (“Courts in this District have held that to
11 proceed on an economic injury theory, data privacy plaintiffs must allege the existence of
12 a market for their data and the impairment of the ability to participate in that market.”).
13 The relevant inquiry is not whether Defendants can profit from Plaintiff’s personal
14 information, but whether Plaintiff himself can profit from his own data. The Amended
15 Complaint does not allege any opportunity through which Plaintiff might do so. See Hart
16 v. TWC Prod. & Tech. LLC, 526 F. Supp. 3d 592, 603 n.4 (N.D. Cal. 2021) (noting that
17 the plaintiff’s “location data may have economic value to others but not to him,” which
18 “reflects a peculiar feature of the current information economy”).
19 Plaintiff cites only one case to support his theory: Brown v. Google LLC. But
20 Brown is distinguishable. The plaintiffs in Brown alleged not only that the value of the
21 data collected could be “quantified,” but also that there was “an active market for such
22 data.” 2021 WL 6064009, *15. Indeed, the complaint in Brown alleged the defendant,
23 Google, paid internet users “up to $3 per week to add a browser extension that shares
24 with Google the sites they visit and how they use them.” Id. (internal quotation marks
25 omitted). By contrast, the Amended Complaint here includes no such allegations.
26 Plaintiff contends Defendant’s conduct was “more outrageous” than the defendant in
27 Brown, but the outrageousness of a defendant’s conduct is immaterial to whether Plaintiff
28
1 could have profited from his collected data. Without plausibly alleging that the data
2 Defendant collected had value to Plaintiff, the theory fails.
3 Second, Plaintiff argues that he lost “future property interests.” (ECF No. 16 at 28.)
4 For the same reasons that Plaintiff’s first theory failed, his second theory likewise fails.
5 Whether alleging present or future economic loss, Plaintiff must allege how his data is
6 economically profitable to him.
7 Third, Plaintiff posits losing the “benefit of the bargain”—acquiring less in the
8 transaction than he otherwise would have—satisfies the UCL’s economic injury element.
9 To be sure, “[c]ourts in California have consistently held that benefit of the bargain
10 damages represents economic injury for purposes of the UCL.” In re Solara Med.
11 Supplies, LLC Customer Data Sec. Breach Litig., No. 3:19-cv-2284-H-KSC, 2020 WL
12 2214152, at *9 (S.D. Cal. May 7, 2020). But this theory of UCL injury requires the
13 parties to have transacted. When a plaintiff never transacted with a defendant, there can
14 be no benefit-of-the-bargain injury under the UCL. See In re Google Assistant Priv.
15 Litig., 546 F. Supp. 3d at 971 (finding that plaintiffs who did not directly transact with the
16 defendant Google, but rather interacted with non-Google smartphones, did not have a
17 benefit-of-the-bargain injury under the UCL).
18 Courts are split as to whether plaintiffs must have paid money to a defendant to
19 sustain their benefit of the bargain theory. Compare id. (concluding that when a plaintiff
20 “fail[s] to allege that [he] paid any money” to defendants, he “cannot have been injured
21 by overpayment”), and Cottle v. Plaid Inc., 536 F. Supp. 3d 461, 484 (N.D. Cal. 2021)
22 (similar), with Brown, 2021 WL 6064009, at *17 (“A party who has provided goods or
23 services in a transaction and has not been paid the fair value of those goods or services
24 has suffered an economic injury even though the party has received money instead of
25 paying money.”), and Calhoun v. Google LLC, 526 F. Supp. 3d 605, 636 (N.D. Cal.
26 2021) (similar).
27 But the Court need not to resolve this split today. In this case, Plaintiff did not
28 transact with Defendant at all. Indeed, the Amended Complaint emphasizes the
| ||“surreptitious” nature of Defendant’s data collection. (Am. Compl. J§ 6, 8, 12.) By
2 contrast, Brown, on which Defendant relies entirely, was a dispute between Google users
3 |jand Google. 2021 WL 6064009, at *17. Thus, the facts in the Brown case are
4 || distinguishable from those alleged in this case.
5 In sum, Plaintiff has “failed to demonstrate how such privacy violation translates
6 ||into a loss of money or property.” Archer v. United Rentals, Inc., 195 Cal. App. 4th 807,
7 (Cal. Ct. App. 2011). Accordingly, the Court GRANTS Defendant’s Motion to
8 Dismiss with respect to Plaintiff's two UCL claims and GRANTS Plaintiff leave to
9 |}amend.
10 E. Unjust Enrichment
11 Plaintiff's final cause of action is for “unjust enrichment,” which is not a stand-
12 ||alone cause of action. See Hill v. Roll Internat. Corp., 195 Cal. App. 4th 1295, 1307
13 }}(2011) (Unjust enrichment is not a cause of action, just a restitution claim.”).
14 Accordingly, the Court GRANTS Defendant’s Motion to Dismiss with respect to
15 || Plaintiff's unjust enrichment claim.
16 CONCLUSION
17 For the reasons stated, Defendant’s Motion for Transfer (ECF No. 21) is DENIED.
18 || Defendant’s Motion to Dismiss (ECF No. 11) is GRANTED IN PART and DENIED
19 || IN PART. The Court dismisses Plaintiffs fifth, sixth, seventh, and eighth causes of
20 |jaction. The Court GRANTS Plaintiff leave to amend. If Plaintiff wishes to file an
21 Amended Complaint, he must do so on or before August 11, 2023. If Plaintiff elects not
22 ||to amend by August 11, 2023, Defendant’s response to the remaining counts shall be due
23 or before September 1, 2023.
24 IT IS SO ORDERED.
25 ,
/ □□
26 || DATED: July 27, 2023 (ypillg (Haphan 6
27 United States District Judge
28
Qa]