incorporating privacy policy referenced in the plaintiffs’ complaint
How later courts described this case
- incorporating privacy policy referenced in the plaintiffs’ complaint
- “Even if Plaintiff’s use of Papa John’s website creates 1 a potential cause of action … Plaintiff fails to allege facts that support this court’s exercise 2 of personal jurisdiction over Papa John’s.”
- The Court is not “required to accept as true…allegations 2 that are merely conclusory, unwarranted deductions of fact, or unreasonable inferences 3 ….”
- The Court 28 is “not bound to accept as true a legal conclusion couched as a factual allegation.”
Written by the judges who cited it.
The opinion
1
2
3
4
5
6
7
8 UNITED STATES DISTRICT COURT
9 SOUTHERN DISTRICT OF CALIFORNIA
10
11 A.S., individually and on behalf of all Case No.: 3:23-cv-02258-RBM-MSB
others similarly situated, et al.,
12
ORDER GRANTING DEFENDANT’S
Plaintiffs,
13 MOTION TO DISMISS
v.
14
[Doc. 6]
SELECTQUOTE INSURANCE
15
SERVICES,
16
Defendant.
17
18
19 Pending before the Court is Defendant SelectQuote Insurance Services’
20 (“Defendant”) Motion to Dismiss Plaintiffs A.S., D.G., M.F., and T.M.’s (“Plaintiffs”)
21 Class Action Complaint (“Motion”), which was filed on February 12, 2024. (Doc. 6.) On
22 March 25, 2024, Plaintiffs filed an Opposition to Defendant’s Motion (“Opposition”).
23 (Doc. 7.) On April 1, 2024, Defendant filed a Reply Brief in Support of Defendant’s
24 Motion (“Reply”). (Doc. 8.)
25 The Court finds this matter suitable for determination without oral argument
26 pursuant to Civil Local Rule 7.1(d)(1). For the reasons set forth below, Defendant’s
27 Motion is GRANTED.
28
1 I. BACKGROUND
2 A. Plaintiffs’ Complaint
3 On December 11, 2023, Plaintiffs filed a Class Action Complaint (“Complaint”)
4 against Defendant, alleging causes of action for (1) violations of the California Invasion of
5 Privacy Act (“CIPA”), California Penal Code § 631 (Count I); (2) violations of the CIPA,
6 California Penal Code § 632 (Count II); (3) violations of the Maryland Wiretapping and
7 Electronic Surveillance Act, Maryland Code, Courts and Judicial Proceedings § 10-401, et
8 seq. (Count III); (4) violations of the Massachusetts Wiretapping Statute, Massachusetts
9 General Laws chapter 272 § 99 (Count IV); (5) violations of the Massachusetts Unfair and
10 Deceptive Business Practices Act, Massachusetts General Laws chapter 93A, et seq.
11 (Count V); and (6) violations of the Florida Security of Communications Act, Florida
12 Statute § 934.01, et seq. (Count VI).1 (Doc. 1 (“Compl.”) ¶¶ 46–110.)
13 B. General Allegations
14 In their Complaint, Plaintiffs allege that “[t]his is a class action suit brought on behalf
15 of all persons who [visited Defendant’s website] and received a quote for a life insurance
16 policy.” (Compl. ¶ 1.) Plaintiffs allege that Defendant lets prospective customers receive
17 a life insurance quote by completing a questionnaire that asks for sensitive information,
18 including personal identifying information (e.g., name, email, mailing address, zip code,
19 and phone number), demographic information (e.g., date of birth, gender, state of
20 residency), medical diagnoses and conditions (e.g., cancer, high blood pressure, and
21 diabetes), social habits (e.g., smoking), height, weight, family health history, and financial
22 information (e.g., annual individual income). (Id. ¶¶ 3, 5, 16, 18, 20–24.) Prospective
23 customers communicate their answer by inputting the information and then pressing
24
25
26
27 1 In their Opposition, Plaintiffs withdraw their claim for violations of the Massachusetts
Unfair and Deceptive Business Practices Act (Count V). (Doc. 7 at 9 n.2.) Therefore, the
28
1 “next.” (Id. ¶ 26.) Plaintiffs allege that Defendant’s website promises that its site and these
2 entries are “100% secure” and that it will “never sell your information.” (Id. ¶¶ 3, 26.)
3 Plaintiffs then allege that Defendant has “built its website to allow third parties to
4 surreptitiously intercept the information they input.” (Id. ¶ 16.) Plaintiffs also allege that
5 “[Defendant] assists third parties with intercepting every[ ]one of those communications”
6 (id. ¶ 27); that “Defendant shares highly sensitive information with several third parties”
7 (id. ¶ 4); that Defendant “commoditizes and trades” Plaintiffs’ health information (id. ¶ 6);
8 and that “[Defendant] aided, agreed with, and conspired with third parties to track and
9 intercept Plaintiffs’ and Class member’s internet communications while receiving a quote
10 through [Defendant] website” (id. ¶ 51). Plaintiffs appear to allege that the third parties,
11 including LeadID and Facebook, use computer codes, programs, web, ad-servers, and/or
12 tracking technology to intercept Plaintiffs’ communications. (Id. ¶¶ 53, 85, 110.) In
13 support of these allegations, Plaintiffs purport to attached figures showing “network traffic
14 to Facebook and LeadID when a user clicks the button on Defendant’s website indicating
15 that they have issues with alcohol or substance abuse[.]” (Id. ¶ 28.) Plaintiffs then allege
16 that “Facebook and LeadID then leverage this information to target advertisements.” (Id.
17 ¶ 29.)
18 Plaintiffs allege that Facebook allows companies like Defendant to integrate
19 software into their websites that track user activity, like the buttons they click or the forms
20 they complete. (Id. ¶ 30.) The software then relays the information to Facebook, who
21 “assimilates it into existing datasets that Defendant can then use to target advertisements.”
22 (Id.) Likewise, Plaintiffs allege that LeadID is an “interactive direct marketing company,”
23 touting its ability to “target audience[s] effectively.” (Id. ¶ 31 (citations omitted.) “Once
24 LeadID intercepts Plaintiffs’ communications, the company assimilates that information
25 into audiences that Defendant then uses to run advertisements.” (Id.)
26 Plaintiffs allege that they have suffered broken promises, intrusions into their
27 privacy, violations of their rights of privacy, and the loss of value in their personally
28
1 identifiable information. (Id. ¶¶ 7, 54, 72.) Plaintiffs seek an injunction preventing
2 Defendant from perpetrating these abuses on future unsuspecting consumers.2 (Id. ¶ 7.)
3 C. Subclass-Specific Allegations
4 1. Plaintiff A.S. and the California Subclass (Counts I and II)
5 “Plaintiff A.S. seeks to represent a subclass of all Class members in California who
6 accessed [Defendant’s website] and received a quote for life insurance (the ‘California
7 Subclass’).” (Id. ¶ 36.) “Plaintiff A.S. is domiciled in Sylmar, California. While in
8 California, in November 2022, Plaintiff applied for life insurance through [Defendant’s]
9 website. While applying for life insurance, Plaintiff provided [Defendant] with his name,
10 date of birth, gender, and email address. Plaintiff also provided [Defendant] with health
11 information, including that he was diagnosed with depression and anxiety. Unbeknownst
12 to Plaintiff, [Defendant] assisted third parties with intercepting this sensitive information.”
13 (Id. ¶ 10.)
14 2. Plaintiff D.G. and the Maryland Subclass
15 “Plaintiff D.G. seeks to represent a subclass of all Class members in Maryland who
16 accessed [Defendant’s website] and received a quote for life insurance (the ‘Maryland
17 Subclass’).” (Id. ¶ 33.) “Plaintiff D.G. is domiciled in Elkridge, Maryland. While in
18 Maryland, in August 2023, Plaintiff applied for life insurance through [Defendant’s]
19 website. While applying for life insurance, Plaintiff provided [Defendant] with his name,
20 date of birth, gender, and email address. Plaintiff also provided [Defendant] with health
21 information, including that he has been diagnosed with cancer, diabetes, and high blood
22 pressure. Unbeknownst to Plaintiff, [Defendant] assisted third parties with intercepting
23 this sensitive information.” (Id. ¶ 8.)
24
25
2 Although Plaintiffs suggest that they are requesting a preliminary injunction in the
26
introduction of their Complaint, they do not include any cause of action for preliminary
27 injunction and do not allege any facts in support of such a request. Plaintiffs also have not
filed a motion for preliminary injunction. Therefore, the Court will not address Plaintiffs’
28
1 3. Plaintiff M.F. and the Massachusetts Subclass
2 “Plaintiff M.F. seeks to represent a subclass of all Class members in Massachusetts
3 who accessed [Defendant’s website] and received a quote for life insurance (the
4 ‘Massachusetts Subclass’).” (Id. ¶ 34.) “Plaintiff M.F. is domiciled in Winthrop,
5 Massachusetts. While in Massachusetts, in or around February 2023, Plaintiff accessed
6 [Defendant’s] website to complete an application for life insurance. While applying for
7 life insurance, Plaintiff provided [Defendant] with her name, date of birth, gender, and
8 email address. Plaintiff also provided [Defendant] with health information, including that
9 she has been diagnosed with diabetes. Unbeknownst to Plaintiff, [Defendant] assisted third
10 parties with intercepting this sensitive information.” (Id. ¶ 9.)
11 4. Plaintiff T.M. and the Florida Subclass
12 “Plaintiff T.M. seeks to represent a subclass of all Class members in Florida who
13 accessed [Defendant’s website] and received a quote for life insurance (the ‘Florida
14 Subclass’).” (Id. ¶ 35.) “Plaintiff T.M. is domiciled in Orlando, Florida. While in Florida,
15 in or around April 2023, Plaintiff applied for life insurance through [Defendant’s] website.
16 While applying for life insurance, Plaintiff provided [Defendant] with his name, date of
17 birth, gender, and email address. Plaintiff also provided [Defendant] with health
18 information, including that he has high blood pressure. Unbeknownst to Plaintiff,
19 [Defendant] assisted third parties with intercepting this sensitive information.” (Id. ¶ 11.)
20 II. DISCUSSION
21 A. Defendant’s Privacy Policy
22 In its Motion, Defendant explains that “[i]ncluded on each page of the [Defendant’s
23 website] is a hyperlink to [Defendant’s] Privacy Policy to inform visitors that: (1) by using
24 the Site and submitting information to obtain a life insurance policy quote, the user thus
25 ‘explicitly agree[s] to the terms and conditions of the Privacy Policy;’ (2) information users
26 provide to the Site is voluntary and is only collected if a user agrees to voluntarily provide
27 it, such as through the ‘Get Your Free Quote’ or similar pages; and (3) information
28 collected includes personal information.” (Doc. 6-1 at 9–10.) Defendant contends that
1 “[t]he Privacy Policy clearly informs visitors that [Defendant] uses analytics technologies
2 to collect users’ information … [and] … further informs customers that their information
3 may be shared with third parties for various purposes, including marketing services.” (Id.
4 at 10.) Defendant then argues that “[g]iven the Complaint repeatedly references and relies
5 on [Defendant’s] website as the basis for the claims, going so far as to include purported
6 screen shots from the website, it is entirely appropriate that the Court consider the website
7 as a whole, including [Defendant’s] Privacy Policy.” (Id. (citing Copeland v. Techtronics
8 Indus. Co., Ltd., 95 F. Supp. 3d 1230, 1236–37 (S.D. Cal. 2015)).)
9 In their Opposition, Plaintiffs respond that Defendant’s Privacy Policy is not
10 properly before the Court. (Doc. 7 at 8 (citing Copeland, 95 F. Supp. 3d at 1236–37).)
11 Plaintiffs contend that they “are aware of several changes made to [Defendant’s] [w]ebsite
12 since the filing of this lawsuit” and that they “cannot be sure that changes were not also
13 made to Defendant’s [P]rivacy [P]olicy.” (Id.) Plaintiffs also assert that the Court cannot
14 assume the facts contained in the Privacy Policy are true. (Id. at 8–9 (citing Watkins v.
15 MGA Ent., Inc., 550 F. Supp. 3d 815, 829 (N.D. Cal. 2021)).)3
16 The Court construes Defendant’s arguments regarding its privacy policy as a request
17 for incorporation by reference or, alternatively, a request for judicial notice. (See Doc. 6-
18 1 at 10 n.2.)
19 Defendant then argues that “[c]onsent is a complete defense to Plaintiffs’
20 Wiretapping Acts claims” and that “[a] reasonable website user would have been aware of
21 the [webs]ite’s Privacy Policy[] and understood that by entering information on the
22 [webs]ite, … such information may be shared with third parties.” (Id. at 27.) Plaintiffs
23 respond that Defendant’s privacy policy was not “sufficient to put consumers on notice of
24 the disclosures at issue.” (Doc. 7 at 14–15 (citing Nguyen v. Barnes & Noble Inc., 763
25 F.3d 1171, 1179 (9th Cir. 2014).)
26
27
3 Defendant replies that case law “amply supports” the consideration of Defendant’s
28
1 The Court addresses each issue in turn.
2 1. Incorporation by Reference
3 “Generally, courts may not consider material outside the complaint when ruling on
4 a motion to dismiss” unless the material is incorporated into the complaint by reference or
5 is subject to judicial notice under Federal Rule of Evidence 201. Copelan v. Techtronics
6 Indus. Co., 95 F. Supp. 3d 1230, 1236 (S.D. Cal. 2015) (citing Hal Roach Studios, Inc. v.
7 Richard Feiner & Co., Inc., 896 F.2d 1542, 1555 n.19 (9th Cir. 1990) and Branch v.
8 Tunnell, 14 F.3d 449, 453 (9th Cir. 1994)); see also D’Angelo v. FCA US, LLC, Case No.
9 3:23-cv-00982-WQH-MMP, 2024 WL 1625771, at *4 (S.D. Cal. Mar. 28, 2024)
10 (“Generally, district courts may not consider material outside the pleadings when assessing
11 the sufficiency of a complaint under Rule 12(b)(6) of the Federal Rules of Civil Procedure.
12 … [T]here are two exceptions to this rule: the incorporation-by-reference doctrine, and
13 judicial notice under Federal Rule of Evidence 201.”) (internal quotation marks and
14 citations omitted). Under the incorporation-by-reference doctrine, “‘material which is
15 properly submitted as part of the complaint may be considered.’” Copelan, 95 F. Supp. 3d
16 at 1236 (quoting Hal Roach Studios, Inc., 896 F.2d at 1555, n.19). “Documents specifically
17 identified in the complaint whose authenticity is not questioned by the parties may also be
18 considered.” Id. at 1236–37 (citing Fecht v. Price Co., 70 F.3d 1078, 1080 n.1 (9th Cir.
19 1995)). “Such documents may be considered, so long as they are referenced in the
20 complaint, even if they are not physically attached to the pleading.” Id. (citations omitted).
21 “Moreover, the court may consider the full text of those documents even when the
22 complaint quotes only selected portions.” Id. (citation omitted). In other words, “‘[t]he
23 [incorporation-by-reference] doctrine prevents plaintiffs from selecting only portions of
24 documents that support their claims, while omitting portions of those very documents that
25 weaken—or doom—their claims.’” Stark v. Patreon, Inc., 635 F. Supp. 3d 841, 850 (N.D.
26 Cal. 2022) (quoting Khoja v. Orexigen Therapeutics, Inc., 899 F.3d 988, 1002 (9th Cir.
27 2018)).
28
1 Here, Plaintiffs reference Defendant’s website throughout their Complaint. (See
2 e.g., Compl. ¶¶ 3, 8–12, 16.) In fact, Plaintiffs incorporate numerous screen shots from
3 Defendant’s website into their Complaint. (See id. ¶¶ 17–26.) As stated above, the Court
4 is permitted to consider “[d]ocuments specifically identified in the complaint whose
5 authenticity is not questioned by the parties[,]” including a website’s privacy policy when
6 the website is referenced in the complaint. Copelan, 95 F. Supp. 3d at 1236–37; see also
7 Stark v. Patreon, Inc., 656 F. Supp. 3d 1018, 1023 (N.D. Cal. 2023) (incorporating privacy
8 policy by reference for the purpose of showing what the defendant’s website disclosed to
9 its users); Yoon v. Lululemon USA, Inc., 549 F. Supp. 3d 1073, 1079 (C.D. Cal. 2021)
10 (taking judicial notice of privacy policy in privacy case because the amended complaint
11 discussed it extensively); In re Adobe Sys., Inc. Priv. Litig., 66 F. Supp. 3d 1197, 1207
12 (N.D. Cal. 2014) (incorporating privacy policy referenced in the plaintiffs’ complaint).
13 Therefore, the Court will incorporate Defendant’s privacy policy by reference.4
14 2. Judicial Notice
15 Courts are also permitted to take judicial notice of privacy policies that appear on
16 publicly available websites because their authenticity cannot reasonably be questioned.
17 See e.g., D’Angelo v. FCA US, LLC, 2024 WL 1625771, at *4 (taking judicial notice of
18 privacy policy); Brown v. Google, LLC, 525 F. Supp. 3d 1049, 1061 (N.D. Cal. 2021)
19 (taking judicial notice of a Google’s privacy policies because they are publicly available
20 on websites); Calhoun v. Google LLC, 526 F. Supp. 3d 605, 617 (N.D. Cal. 2021) (finding
21 that privacy policies that appear on publicly available websites and are proper subjects for
22 judicial notice); Javier v. Assurance IQ, LLC, Case No. 4:20-cv-02860-JSW, 2021 WL
23
24
25 4 Plaintiffs attempt to dispute the authenticity of the privacy policy by claiming that
Defendant has made several changes to its website since the filing of this lawsuit and that
26
“Plaintiffs cannot be sure that changes were not also made to Defendant’s privacy policy.”
27 (Doc. 7 at 8.) However, Plaintiffs do not submit any evidence supporting this theory, and
the privacy policy itself states that its effective date is May 26, 2020, years before the filing
28
1 940319, at *2 (N.D. Cal. Mar. 9, 2021) (taking judicial notice of privacy policy publicly
2 disclosed on defendant’s website); Opperman v. Path, Inc., 205 F. Supp. 3d 1064, 1068
3 n.3 (N.D. Cal. 2016) (taking judicial notice of Yelp’s privacy policy publicly disclosed on
4 their website); In re Toll Roads Litig., Case No. SACV 16-00262 AG (JCGx), 2018 WL
5 6131178, at *2 (C.D. Cal. Jan. 12, 2018) (taking judicial notice of privacy policy publicly
6 available on website). Here, Defendant’s privacy policy is publicly available on its
7 website. (See Doc. 6-1 at 10 n.2.) Thus, even if the Court could not incorporate the privacy
8 policy by reference, the Court could still take judicial notice of Defendant’s privacy policy.
9 3. Consent
10 As stated above, Defendant contends that “[i]ncluded on each page of the
11 [Defendant’s website] is a hyperlink to [Defendant’s] Privacy Policy” and “[t]he Privacy
12 Policy clearly informs visitors that [Defendant] uses analytics technologies to collect users’
13 information … [and] … further informs customers that their information may be shared
14 with third parties for various purposes, including marketing services.” (Doc. 6-1 at 9–10.)
15 However, “[t]he Ninth Circuit has held … that such privacy policies do not bind users:
16 ‘where a website makes its terms of use available via a conspicuous hyperlink on every
17 page of the website but otherwise provides no notice to users nor prompts them to take any
18 affirmative action to demonstrate assent, even close proximity of the hyperlink to relevant
19 buttons users must click on—without more—is insufficient to give rise to constructive
20 notice.’” Yoon, 549 F. Supp. 3d at 1081 (quoting Nguyen, 763 F.3d at 1178–79); see also
21 James v. Allstate Ins. Co., Case No. 3:23-cv-01931-JSC, 2023 WL 8879246, at *5–6 (N.D.
22 Cal. Dec. 22, 2023) (“[E]ven if the Court were to consider the Privacy Policy under the
23 incorporation by reference doctrine, drawing all inferences in Plaintiff’s favor, the website
24 hyperlink failed to disclose a third party’s capture of the Personally Identifiable
25 Information and Personal Health Information. To conclude otherwise would improperly
26 draw inferences in Defendants’ favor.”) (citations omitted); Valenzuela v. Keurig Green
27 Mountain, Inc., 674 F. Supp. 3d 751, 757 (N.D. Cal. 2023) (“Defendant cites no case in
28 which merely hyperlinking to a privacy policy at the bottom of a webpage is sufficient to
1 establish consent under CIPA.”). Additionally, Plaintiffs have alleged Defendant’s website
2 also promises that its site and these entries are “100% secure” and that it will “never sell
3 your information.” (Compl. ¶¶ 3, 26.) Therefore, the Court finds that there is conflicting
4 evidence establishing a question of fact that cannot be resolved at this stage.
5 B. Standing
6 1. Parties’ Arguments
7 Defendant argues that Plaintiffs cannot establish standing. (Doc. 6-1 at 17–18.)
8 Specifically, Defendant argues that “Plaintiffs’ FSCA, MACPA, MAWS, and CIPA …
9 claims do not hint at injury beyond a mere statutory violation,” which is insufficient to
10 establish injury-in-fact. (Id. at 13–14 (citing TransUnion LLC v. Ramirez, 594 U.S. 413,
11 427 (2021)).) Defendant explains that intangible harms, like the loss of privacy Plaintiffs
12 allege here, only rise to the level of Article III injury if they bear a close relationship to
13 harms traditionally recognized by American courts. (Id. at 16.) Defendant then asserts
14 that Plaintiffs’ allegations regarding loss of privacy are not comparable to the common law
15 torts of intrusion upon seclusion because there is no reasonable expectation of privacy
16 when you transmit information over the internet. (Id. at 16–17.)
17 Plaintiffs respond that they have standing because Defendant captured their highly
18 sensitive personal information. (Doc. 7 at 10.) Plaintiffs assert that, prior to the Supreme
19 Court’s decision in TransUnion, the prevailing view was that a plaintiff need not allege
20 harm beyond the invasion of a privacy right conferred by statute. (Id. at 11–12 (citing In
21 re Facebook, Inc., Internet Tracking Litig., 956 F.3d 589, 598 (9th Cir. 2020) (“In re
22 Facebook”)).) Plaintiffs also assert that recent courts applying TransUnion have held that
23 wiretapping is sufficient to establish Article III standing so long as the communications
24 contain private or personal information. (Id. (citing Lightoller v. Jetblue Airways Corp.,
25 Case No. 23-cv-00361-H-KSC, 2023 WL 3963823, at *4 (S.D. Cal. June 12, 2023)).)
26 2. Legal Standard—Federal Rule of Civil Procedure 12(b)(1)
27 “The Court evaluates challenges to Article III standing under Rule 12(b)(1), which
28 governs motions to dismiss for lack of subject matter jurisdiction.” I.C. v. Zynga, Inc., 600
1 F. Supp. 3d 1034, 1046 (N.D. Cal. 2022) (citing Maya v. Centex Corp., 658 F.3d 1060,
2 1067 (9th Cir. 2011)). “Rule 12(b)(1) motions may be either facial, where the inquiry is
3 confined to the allegations in the complaint, or factual, where the court is permitted to look
4 beyond the complaint to extrinsic evidence.” Id. (citing Leite v. Crane Co., 749 F.3d 1117,
5 1121 (9th Cir. 2014) and Safe Air For Everyone v. Meyer, 373 F.3d 1035, 1039 (9th Cir.
6 2004)).
7 “When a defendant challenges jurisdiction ‘facially,’ all material allegations in the
8 complaint are assumed true, and the court determines whether the factual allegations are
9 sufficient to invoke the court’s subject matter jurisdiction. When a defendant makes a
10 factual challenge ‘by presenting affidavits or other evidence properly brought before the
11 court, the party opposing the motion must furnish affidavits or other evidence necessary to
12 satisfy its burden of establishing subject matter jurisdiction.’ The court need not presume
13 the truthfulness of the plaintiff’s allegations under a factual attack. The plaintiff must show
14 by a preponderance of the evidence each requirement for subject-matter jurisdiction ….”
15 Id. (internal citations omitted).
16 Additionally, “[i]n a class action, at least one named plaintiff must have standing.”
17 Id. at 1046 (citing Frank v. Gaos, 586 U.S. 485, 492 (2019) and Ollier v. Sweetwater Union
18 High Dist., 768 F.3d 843, 865 (9th Cir. 2014)). “Thus, ‘if none of the named plaintiffs
19 purporting to represent a class establishes the requisite of a case or controversy with the
20 defendant[], none may seek relief on behalf of himself or any other member of the class.’”
21 Id. at 1046–47 (quoting O’Shea v. Littleton, 414 U.S. 488, 494 (1974)). “Moreover,
22 standing must be established ‘for each claim that they press and for each form of relief that
23 they seek (for example, injunctive relief and damages).’” Id. at 1047 (quoting TransUnion
24 LLC, 594 U.S. at 431). Plaintiffs bear the burden of establishing standing. Id. (citations
25 omitted). In the absence of standing, there is no subject matter jurisdiction. Id. (citations
26 omitted).
27
28
1 Here, Defendant appears to pose a facial attack on Article III standing. Therefore,
2 the Court accepts all the allegations alleged in Plaintiffs’ Complaint as true. See I.C., 600
3 F. Supp. 3d at 1046.
4 3. Case Law
5 To establish Article III standing, Plaintiffs “must have (1) suffered an injury in fact,
6 (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely
7 to be redressed by a favorable judicial decision.” Spokeo, Inc. v. Robins, 578 U.S. 330,
8 338 (2016). “[Plaintiffs], as the party invoking federal jurisdiction, bear[] the burden of
9 establishing these elements.” Id. “Where, as here, a case is at the pleading stage, the
10 plaintiff must ‘clearly ... allege facts demonstrating’ each element.” Id. (quoting Warth v.
11 Seldin, 422 U.S. 490, 518 (1975)). Here, Defendants’ arguments concern the “injury in
12 fact” element, the “first and foremost” of standing’s three elements. Id. at 338–39
13 (quotation omitted).
14 “Injury in fact is a constitutional requirement, and ‘it is settled that Congress cannot
15 erase Article III’s standing requirements by statutorily granting the right to sue to a plaintiff
16 who would not otherwise have standing.’” Id. at 339 (quoting Raines v. Byrd, 521 U.S.
17 811, 820 n.3 (1997)) (additional citations omitted). “To establish injury in fact, a plaintiff
18 must show that he or she suffered ‘an invasion of a legally protected interest’ that is
19 ‘concrete and particularized’ and ‘actual or imminent, not conjectural or hypothetical.’”
20 Id. (quoting Lujan v. Defs. of Wildlife, 504 U.S. 555, 560 (1992)). Thus, “an injury in fact
21 must be both concrete and particularized.” Id. at 340. This case concerns the “concrete”
22 aspect of injury in fact.
23 “A ‘concrete’ injury must be ‘de facto’; that is, it must actually exist. When we have
24 used the adjective ‘concrete,’ we have meant to convey the usual meaning of the term
25 ‘real,’ and not ‘abstract.’” Id. (dictionary citations omitted). “‘Concrete’ is not, however,
26 necessarily synonymous with ‘tangible.’ Although tangible injuries are perhaps easier to
27 recognize, we have confirmed in many of our previous cases that intangible injuries can
28 nevertheless be concrete.” Id. (citations omitted).
1 In Spokeo, the Supreme Court explained, “[i]n determining whether an intangible
2 harm constitutes injury in fact … it is instructive to consider whether an alleged intangible
3 harm has a close relationship to a harm that has traditionally been regarded as providing a
4 basis for a lawsuit in English or American courts.” Id. at 340–341 (citation omitted). “In
5 addition, because Congress is well positioned to identify intangible harms that meet
6 minimum Article III requirements, its judgment is also instructive and important.” Id. at
7 341. However, “Congress’ role in identifying and elevating intangible harms does not
8 mean that a plaintiff automatically satisfies the injury-in-fact requirement whenever a
9 statute grants a person a statutory right and purports to authorize that person to sue to
10 vindicate that right. Article III standing requires a concrete injury even in the context of a
11 statutory violation.” Id. “[A plaintiff] could not, for example, allege a bare procedural
12 violation, divorced from any concrete harm, and satisfy the injury-in-fact requirement of
13 Article III.” Id. (citations omitted).
14 Following Spokeo, the Ninth Circuit held that the violation of statutory provisions
15 codifying the substantive right to privacy gives rise to a concrete injury sufficient to confer
16 standing. See In re Facebook, 956 F.3d 589, 598 (9th Cir. 2020). The Ninth Circuit
17 reasoned that the “‘[v]iolations of the right to privacy have long been actionable at common
18 law[,]’” id. (quoting Patel v. Facebook, 932 F.3d 1264, 1272 (9th Cir. 2019)), and “[a]
19 right to privacy ‘encompasses the individual’s control of information concerning his or her
20 person[,]’” id. (quoting Eichenberger v. ESPN, Inc., 876 F.3d 979, 983 (9th Cir. 2017)).
21 Shortly thereafter, in TransUnion, the Supreme Court elaborated that “[v]arious
22 intangible harms can also be concrete. Chief among them are injuries with a close
23 relationship to harms traditionally recognized as providing a basis for lawsuits in American
24 courts. Those include, for example, reputational harms, disclosure of private information,
25 and intrusion upon seclusion.” TransUnion LLC, 594 U.S. at 425 (citation omitted)
26 (emphasis added). “Spokeo does not require an exact duplicate in American history and
27 tradition. But Spokeo is not an open-ended invitation for federal courts to loosen Article
28 III based on contemporary, evolving beliefs about what kinds of suits should be heard in
1 federal courts.” Id. at 424–25. “Congress’s creation of a statutory prohibition or obligation
2 and a cause of action does not relieve courts of their responsibility to independently decide
3 whether a plaintiff has suffered a concrete harm under Article III ….” Id. at 426. “[W]e
4 cannot treat an injury as ‘concrete’ for Article III purposes based only on Congress’s say-
5 so.” Id. (quotation omitted). “Congress may enact legal prohibitions and obligations. And
6 Congress may create causes of action for plaintiffs to sue defendants who violate those
7 legal prohibitions or obligations. But under Article III, an injury in law is not an injury in
8 fact. Only those plaintiffs who have been concretely harmed by a defendant’s statutory
9 violation may sue that private defendant over that violation in federal court.” Id. at 426–
10 27.
11 The question now facing California district courts handling class action lawsuits
12 similar to the present case is whether the Supreme Court’s decision in TransUnion
13 overruled the Ninth Circuit’s holding in In re Facebook. District courts are split as to
14 whether a plaintiff needs to allege the interception of personal or sensitive information to
15 establish injury-in-fact or whether a violation of CIPA, which codifies the substantive right
16 to privacy, is sufficient.
17 For example, in Lightoller v. Jetblue Airways Corp., the plaintiff alleged that the
18 defendants procured and embedded code in its website to track and analyze her interactions
19 with the website. Case No. 23-cv-00361-H-KSC, 2023 WL 3963823, at *1 (S.D. Cal. June
20 12, 2023). The plaintiff alleged that she visited the defendant’s website to obtain
21 information on flight pricing, but, during her visit, her communications were captured and
22 sent to various software providers. Id. The plaintiff asserted that the defendant’s conduct
23 violated CIPA and constituted the tort of invasion of privacy rights and intrusion upon
24 seclusion. Id. In deciding whether the plaintiff had standing, the district court found that
25 standing based solely on a violation of CIPA was “untenable in light of the Supreme
26 Court’s holding in TransUnion[.]” Id. at *3. The court found that the plaintiff’s allegations
27 were “insufficient to allege a concrete harm that bears a close relationship to the substantive
28 right of privacy (i.e., an individual’s right to control information concerning his or her
1 person)” because the plaintiff did “not allege that she disclosed any personal information
2 when she visited the website.” Id. at *4; see also Byars v. Sterling Jewelers, Inc., No. 5:22-
3 CV-01456-SB-SP, 2023 WL 2996686, at *3 (C.D. Cal. Apr. 5, 2023) (“Plaintiff does not
4 allege that she disclosed any sensitive information to Defendant, much less identify any
5 specific personal information she disclosed that implicates a protectable privacy interest.
6 She therefore has not identified any harm to her privacy.”); I.C., 600 F. Supp. 3d at 1049–
7 50 (finding the disclosure of basic contact information, e.g., email address, phone number,
8 and username, inadequate to establish Article III standing). Thus, applying the first line of
9 cases, whether Plaintiffs have adequately alleged facts establishing standing hinges on
10 whether plaintiff has alleged the interception of personal or sensitive information.
11 Conversely, in D’Angelo v. FCA US, LLC, the class plaintiffs alleged that the
12 defendant allowed third parties to wiretap and eavesdrop on the chat conversations of all
13 its website visitors by embedding a third-party’s code into its chat feature that records and
14 creates transcripts of all such conversations. Case No. 3:23-cv-00982-WQH-MMP, 2024
15 WL 1625771, at *1 (S.D. Cal. Mar. 28, 2024). The plaintiff alleged that one such third
16 party collected certain data about users and their chat messages, including the user’s
17 account name, the duration of the chat, the user’s geographic location, the user’s network
18 provider, the number of messages sent, the site the user was on before they came to the
19 website, and the amount of time between messages. Id. In deciding whether the class
20 plaintiffs had standing, the district court recognized “that there is a disagreement in this
21 District about whether TransUnion undermined In re Facebook’s holding that a violation
22 of CIPA is sufficient to allege an injury-in-fact.” Id. at *7. However, the district court
23 found that, in the absence of further indication that In re Facebook is overruled,
24 TransUnion did not undermine the Ninth Circuit’s holding in Facebook. Id.; see also
25 Garcia v. Build.com, Inc., Case No. 22-cv-01985-DMS-KSC, 2023 WL 4535531, at *3
26 (S.D. Cal. July 13, 2023) (finding that, unlike a bare procedural violation, a CIPA violation
27 is a violation of substantive privacy rights); id. (reasoning that TransUnion’s holding was
28 not new; it was a reiteration of the Supreme Court’s holding in Spokeo, decided in 2016,
1 before In re Facebook); Licea v. Am. Eagle Outfitters, Inc., 659 F. Supp. 3d 1072, 1078
2 (C.D. Cal. 2023) (same). Thus, applying the second line of cases, Plaintiffs need not allege
3 that the information intercepted was of a personal or sensitive nature.
4 4. Analysis
5 The question now before the Court is whether each named plaintiff suffered an
6 injury-in-fact sufficient to establish Article III standing for his or her subclass. See I.C.,
7 600 F. Supp. 3d at 1046. Because each named plaintiff has alleged the interception of
8 personal or sensitive information, including his or her name, date of birth, gender, email
9 address, and health information, under either avenue of decision, the class plaintiffs have
10 alleged facts sufficient to establish standing at this stage. In other words, even under the
11 more stringent requirements set forth in Lightoller, Plaintiffs have established standing,
12 and the Court need not decide whether Plaintiffs need to allege the interception of personal
13 or sensitive information to establish injury-in-fact at this time.5
14 C. Failure to State a Claim
15 1. Legal Standard—Federal Rule of Civil Procedure 12(b)(6)
16 Pursuant to Rule 12(b)(6), an action may be dismissed for failure to allege “enough
17 facts to state a claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly, 550
18 U.S. 544, 570 (2007). “A claim has facial plausibility when the plaintiff pleads factual
19 content that allows the court to draw the reasonable inference that the defendant is liable
20 for the misconduct alleged. The plausibility standard is not akin to a
21 probability requirement, but it asks for more than a sheer possibility that a defendant acted
22 unlawfully.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (internal quotation marks and
23 citations omitted). For purposes of ruling on a Rule 12(b)(6) motion, the Court “accept[s]
24 factual allegations in the complaint as true and construe[s] the pleadings in the light most
25
26
27 5 In their Motion, Defendant also requests that discovery in this case be stayed until the
Court finds that Plaintiffs can proceed with their claims. (Doc. 6 at 2.) Having founds that
28
1 favorable to the nonmoving party.” Manzarek v. St. Paul Fire & Marine Ins. Co., 519 F.3d
2 1025, 1031 (9th Cir. 2008).
3 However, the Court is “not bound to accept as true a legal conclusion couched as a
4 factual allegation.” Ashcroft, 556 U.S. at 678 (quoting Twombly, 550 U.S. at 555). Nor is
5 the Court “required to accept as true allegations that contradict exhibits attached to the
6 Complaint or matters properly subject to judicial notice, or allegations that are merely
7 conclusory, unwarranted deductions of fact, or unreasonable inferences.” Daniels-Hall v.
8 Nat’l Educ. Ass’n, 629 F.3d 992, 998 (9th Cir. 2010). “In sum, for a complaint to survive
9 a motion to dismiss, the non-conclusory factual content, and reasonable inferences from
10 that content, must be plausibly suggestive of a claim entitling the plaintiff to relief.” Moss
11 v. U.S. Secret Serv., 572 F.3d 962, 969 (9th Cir. 2009) (quotation marks omitted).
12 When a Rule 12(b)(6) motion is granted, “a district court should grant leave to amend
13 even if no request to amend the pleading was made, unless it determines that the pleading
14 could not possibly be cured by the allegation of other facts.” Cook, Perkiss & Liehe v. N.
15 Cal. Collection Serv., 911 F.2d 242, 247 (9th Cir. 1990) (citations omitted).
16 2. Parties’ Arguments
17 Defendant argues that Plaintiffs have failed to state claims under the wiretapping
18 acts referenced in Plaintiffs’ Complaint—CIPA, the Maryland Wiretapping and Electronic
19 Surveillance Act (“MWESA”), the Massachusetts Wiretapping Statute, and the Florida
20 Security of Communications Act (“FSCA”)—which have similar elements and can be
21 addressed together. (Doc. 6-1 at 19–20.) Specifically, Defendant argues that Plaintiffs
22 have not adequately alleged the “interception” of communication, the interception of the
23 “contents” of communications, and that a “device” was used to intercept their
24 communications. (Id. at 21–27.) Plaintiffs respond that they have adequately alleged the
25 “interception” of the “contents” of communications using a “device.” (Doc. 7 at 15–19.)
26
27
28
1 As a preliminary matter, the Court does not agree with Defendants that each statute,
2 which have distinct elements and interpretations thereof, can be addressed together.6
3 Therefore, the Court will address each cause of action in turn.
4 3. CIPA Section 631 (Count I)
5 CIPA section 631(a) states:
6 any person…
7 [1] who, by means of any machine, instrument, or contrivance, or in
any other manner, intentionally taps, or makes any unauthorized
8
connection, whether physically, electrically, acoustically, inductively,
9 or otherwise, with any telegraph or telephone wire, line, cable, or
instrument, including the wire, line, cable, or instrument of any internal
10
telephonic communication system, or
11
[2] who willfully and without the consent of all parties to the
12
communication, or in any unauthorized manner, reads, or attempts to
13 read, or to learn the contents or meaning of any message, report, or
communication while the same is in transit or passing over any wire,
14
line, or cable, or is being sent from, or received at any place within this
15 state;
16
[3] or who uses, or attempts to use, in any manner, or for any purpose,
17 or to communicate in any way, any information so obtained,
18
[4] or who aids, agrees with, employs, or conspires with any person or
19 persons to unlawfully do, or permit, or cause to be done any of the acts
or things mentioned above in this section,
20
21 is punishable by a fine….
22 Cal. Pen. Code § 631(a) (number and line breaks added). “The California Supreme Court
23 has explained that this lengthy provision contains three operative clauses covering ‘three
24 distinct and mutually independent patterns of conduct’: (1) ‘intentional wiretapping,’ (2)
25 ‘willfully attempting to learn the contents or meaning of a communication in transit over a
26
27
6 The Court is also not persuaded by the parties’ frequent citations to Pennsylvania law
28
1 wire,’ [i.e., eavesdropping] and (3) ‘attempting to use or communicate information
2 obtained as a result of engaging in either of the two previous activities.’” Mastel v. Miniclip
3 SA, 549 F. Supp. 3d 1129, 1134 (E.D. Cal. 2021) (quoting Tavernetti v. Superior Court, 22
4 Cal. 3d 187, 192 (1978)) (citing In re Google Inc., Case No. 13-MD-02430-LHK, 2013
5 WL 5423918, at *15 (N.D. Cal. Sept. 26, 2013)). In addition, “Section 631(a) … contains
6 a fourth basis for liability, for anyone ‘who aids, agrees with, employs, or conspires with
7 any person or persons to unlawfully do, or permit, or cause to be done any of the’ other
8 three bases for liability.” Id. (quoting Cal. Pen. Code § 631(a)).
9 The Court construes Plaintiffs’ allegations against Defendant as a claim for “aiding
10 and abetting” a third party’s violation of one or all of the first three clauses in violation of
11 the fourth operative clause. (See Compl. ¶ 49 (emphasizing “who aids, agrees with,
12 employs, or conspires”); id. ¶¶ 51–52.) Therefore, “[t]o state a claim under [the fourth]
13 clause, Plaintiff[s] must allege [that a third party] has violated one of the first three clauses
14 of section 631(a), and that Defendant aided, agreed with, employed, or conspired with that
15 person or entity to commit those unlawful acts.” Esparza v. UAG Escondido A1 Inc., Case
16 No. 23cv0102 DMS(KSC), 2024 WL 559241, at *2 (S.D. Cal. Feb. 12, 2024). The Court
17 finds that Plaintiffs have failed to state such a claim for the reasons set forth below.
18 First, Plaintiffs allege that Defendant assists and allows “several third parties,”
19 including LeadID and Facebook, to intercept Plaintiffs’ sensitive personal information.
20 (See Compl. ¶¶ 8–11, 16, 27.) In support of these allegations, Plaintiffs include two figures
21 purportedly showing network traffic from Defendant’s website to LeadID and Facebook.
22 (See Compl. ¶ 28.) However, the text of these figures does not indicate any connection to
23 LeadID or Facebook. (See id.) In fact, the figures appear to show that the “destination” is
24 Defendant’s website. (Id.) Without further support or explanation, the Court finds that
25 Plaintiffs’ conclusory allegation that Defendant assists and allows “several third parties,”
26 including LeadID and Facebook, to “intercept” Plaintiffs’ sensitive personal information
27 is unsupported by sufficient factual allegations. See Ashcroft, 556 U.S. at 678 (The Court
28 is “not bound to accept as true a legal conclusion couched as a factual allegation.”);
1 Daniels-Hall, 629 F.3d at 998 (The Court is not “required to accept as true…allegations
2 that are merely conclusory, unwarranted deductions of fact, or unreasonable inferences
3 ….”).
4 Second, it is not apparent to the Court whether the interceptor—whether it be
5 Facebook, LeadID, or some other third party—is alleged to have violated clauses one, two,
6 three, or some combination thereof. Plaintiffs appear to include allegations pertaining to
7 clause one (see id. ¶ 53), but, at the same time, Plaintiffs do not quote the entirety of clause
8 one in their Complaint (see id. ¶ 49). The Court also notes that California district courts
9 have held that clause one does not apply to internet communications like the ones alleged
10 here. See also UAG Escondido A1 Inc., 2024 WL 559241, at *2 (“[C]lause one does not
11 apply to internet connections.”); Esparza v. Gen Digital Inc., Case No. CV 23-8223-KK-
12 AGRx, 2024 WL 655986, at *3 (C.D. Cal. Jan. 16, 2024) (“[B]ecause Section 631(a)
13 concerns telephonic wiretapping, it does not apply to the context of the internet[.]”)
14 (internal quotation marks and citation omitted); Heiting v. Taro Pharms. USA, Inc., Case
15 No. 2:23-cv-08002-SPG-E, 2023 WL 9319049, at *2 (C.D. Cal. Dec. 26, 2023)
16 (“[B]ecause Plaintiff alleges interception of a chat communication on Defendant’s website,
17 instead of over the phone, Plaintiff cannot state a claim under the first clause of section
18 631(a).”).
19 Relatedly, as written, it is not apparent to the Court whether the alleged software,
20 code, or tracking technology is owned and operated by Facebook or LeadID, or whether a
21 third-party software provider “relays” the sensitive personal information to Facebook or
22 LeadID. (See Compl. ¶ 30 (“Facebook allows those companies to integrate software into
23 their websites, software that tracks user activity, like the buttons they click or the forms
24 they complete. That software then relays that information to Facebook, and once that
25 information is received, the social media site assimilates it into existing databases that
26 Defendant can then use to target advertisements.”).) This distinction informs whether
27 Facebook or LeadID is alleged to have violated clause two or clause three.
28
1 Because Plaintiffs have not adequately alleged that any third party unlawfully
2 wiretapped or eavesdropped on Plaintiffs’ communications in violation of CIPA section
3 631(a)—whether it be clause one, clause two, or clause three—the Court cannot find that
4 Plaintiffs adequately alleged that Defendant aided and abetted any such violation. See
5 UAG Escondido A1 Inc., 2024 WL 559241, at *2. Thus, Plaintiffs’ claim for violations of
6 CIPA section 631(a) is DISMISSED WITH LEAVE TO AMEND.
7 4. CIPA Section 632 (Count II)
8 Section 632.7(a) prohibits the interception or recording of communications between
9 two phones:
10 Every person who, without the consent of all of the parties to a
communication, intercepts or receives and intentionally records, or assists in
11
the interception or reception and intentional recordation of, a communication
12 transmitted between two cellular radio telephones, a cellular radio telephone
and a landline telephone, two cordless telephones, a cordless telephone and
13
a landline telephone, or a cordless telephone and a cellular radio telephone,
14 shall be punished by a fine …, or by imprisonment in a county jail ….
15 Cal. Pen Code § 632.7(a) (emphasis added). The majority of district courts addressing this
16 issue have held that section 632.7(a) applies only to communications between two
17 telephones and not to internet communications. See e.g., Keurig Green Mountain, Inc.,
18 674 F. Supp. 3d at 760 (“[Section] 632.7 unambiguously limits its reach to communications
19 between various types of telephones.”); Am. Eagle Outfitters, Inc., 659 F. Supp. 3d at 1112
20 (“The Court determines that section 632.7 only applies to the five types of calls enumerated
21 ….”); Byars v. Hot Topic, Inc., 656 F. Supp. 3d 1051, 1069 (C.D. Cal. 2023) (“The
22 unambiguous meaning of the statute is thus that it only applies to communications
23 involving two telephones. Plaintiff’s allegations all relate to text-based web
24 communications regarding a chat feature on a website, which virtually by definition cannot
25 involve two telephones.”); Build.com, Inc., Case No. 22-cv-01985-DMS-KSC, 2023 WL
26 4535531, at *6 (S.D. Cal. July 13, 2023) (“A plain reading of the text makes clear that the
27 statute only applies to communications transmitted by telephone, not internet. Plaintiffs
28 seem to argue that Defendant’s conduct violated Section 632.7 because Plaintiffs’
1 communications with Defendant through the website chat function on her smart phone
2 amounted to ‘communication ... transmitted via telephony.’ This stretches the statutory
3 language too far.”); Martin v. Sephora USA, Inc., Case No. 1:22-cv-01355-JLT-SAB, 2023
4 WL 2717636, at *17 (E.D. Cal. Mar. 30, 2023) (“[T]he Court concludes that § 632.7 only
5 applies to the five types of calls previously enumerated.”); but see Licea v. Old Navy, LLC,
6 669 F. Supp. 3d 941, 947 (C.D. Cal. 2023) (finding that only one party need be using a
7 telephone to bring it in the purview of section 632.7 and that smartphones fall within the
8 cellular phone category); Byars v. Goodyear Tire & Rubber Co., 654 F. Supp. 3d 1020,
9 1027–28 (C.D. Cal. 2023) (same).
10 The Court joins the majority of California district courts in finding that section 632
11 does not apply to internet communications. See Rodriguez v. Ford Motor Co., Case No.
12 3:23-cv-00598-RBM-JLB, 2024 WL 1223485, at *17 (S.D. Cal. Mar. 21, 2024) (R.
13 Montenegro). Therefore, Plaintiffs have not adequately alleged violations of CIPA section
14 632. Because amendment would be futile, the Court DISMISSES this claim WITHOUT
15 LEAVE TO AMEND. See Cook, Perkiss & Liehe, 911 F.2d at 247.
16 5. Maryland Wiretapping and Electronic Surveillance Act
17 “[I]t is unlawful for any person to: (1) Willfully intercept, endeavor to intercept, or
18 procure any other person to intercept or endeavor to intercept, any wire, oral, or electronic
19 communication; (2) Willfully disclose, or endeavor to disclose, to any other person the
20 contents of any wire, oral, or electronic communication, knowing or having reason to know
21 that the information was obtained through the interception of a wire, oral, or electronic
22 communication in violation of this subtitle; or (3) Willfully use, or endeavor to use, the
23 contents of any wire, oral, or electronic communication, knowing or having reason to know
24 that the information was obtained through the interception of a wire, oral, or electronic
25 communication in violation of this subtitle.” Md. Code Ann., Cts. & Jud. Proc. § 10-402.
26 Maryland federal courts have had limited opportunity to apply MWESA to internet
27 communications like the ones alleged here. See e.g., Curd v. Papa John’s Int’l, Inc., 692
28 F. Supp. 3d 525, 531 (D. Md. 2023) (“Even if Plaintiff’s use of Papa John’s website creates
1 a potential cause of action … Plaintiff fails to allege facts that support this court’s exercise
2 of personal jurisdiction over Papa John’s.”). Nevertheless, it is clear from the statute’s text
3 that violations of MWESA depend upon the “willful” “interception” of “any wire, oral, or
4 electronic communication[.]” See Md. Code Ann., Cts. & Jud. Proc. § 10-402.
5 Defendant argues that Plaintiffs have not plausibly alleged “interception” of a
6 communication, an essential element under each wiretapping act. (Id. at 21–23.)
7 Specifically, Defendant argues that Plaintiffs allege “interception” “in conclusory terms
8 that do not satisfy Iqbal or Twombly” and that using the word “intercept” throughout the
9 Complaint is not enough without the addition of specific facts supporting Plaintiffs’ theory
10 that Defendant is “intercepting” Plaintiffs’ data. (Id. at 21–22.) Defendant also contends
11 that Plaintiffs’ passing references to “tracking technologies” and “software” is insufficient
12 to explain how Defendant is allegedly intercepting Plaintiffs’ data. (Id. at 22.)
13 Plaintiffs respond that they have adequately alleged that Defendant allows third
14 parties, like LeadID and Facebook, to intercept Plaintiffs’ electronic communications, such
15 as the buttons that they click and the forms they complete. (Doc. 7 at 16.) Plaintiffs
16 contend that they illustrate the interceptions occurring in real time by providing an example
17 showing network traffic to Facebook and LeadID when a website user clicks the button on
18 Defendant’s website indicating that they have issues with alcohol or substance abuse. (Id.)
19 Plaintiffs contend that “[s]uch interceptions occur for every communication with the
20 website.”7
21 For the same reasons set forth above (see Section II.C.2.a), the Court agrees with
22 Defendants that, without further support or explanation, Plaintiffs’ conclusory allegations
23 regarding “interception” are insufficient at this stage. See Ashcroft, 556 U.S. at 678;
24 Daniels-Hall, 629 F.3d at 998. Thus, Plaintiffs have not stated a claim under MWESA,
25 and the Court DISMISSES this claim WITH LEAVE TO AMEND.
26
27
7 Defendant’s Reply re-states its position that Plaintiffs do not adequately allege
28
1 a) Massachusetts Wiretapping Statute
2 “[A]ny person who—willfully commits an interception, attempts to commit an
3 interception, or procures any other person to commit an interception or to attempt to
4 commit an interception of any wire or oral communication shall be fined not more than ten
5 thousand dollars, or imprisoned in the state prison for not more than five years, or
6 imprisoned in a jail or house of correction for not more than two and one half years, or both
7 so fined and given one such imprisonment.” Mass. Gen. Laws Ann. ch. 272, § 99. “The
8 term ‘interception’ means to secretly hear, secretly record, or aid another to secretly hear
9 or secretly record the contents of any wire or oral communication through the use of any
10 intercepting device by any person other than a person given prior authority by all parties to
11 such communication[.]” Id. As in Maryland, Massachusetts federal courts have had
12 limited opportunity to apply the Massachusetts Wiretapping Statute to internet
13 communications. See e.g., Rosenthal v. Bloomingdale’s, Inc., 686 F. Supp. 3d 36, 40 (D.
14 Mass. 2023) (dismissing similar case for lack of personal jurisdiction); Alves v. Goodyear
15 Tire & Rubber Co., 683 F. Supp. 3d 111, 120 (D. Mass. 2023) (same). However, it is clear
16 from the statutory text that, at a minimum, Plaintiffs must allege the “willful” “interception
17 of any wire or oral communication[.]” Mass. Gen. Laws Ann. ch. 272, § 99.
18 For the same reasons set forth above (see Section II.C.2.a), the Court agrees with
19 Defendants that, without further support or explanation, Plaintiffs’ conclusory allegations
20 regarding “interception” are insufficient at this stage. See Ashcroft, 556 U.S. at 678;
21 Daniels-Hall, 629 F.3d at 998. Thus, Plaintiffs have not stated a claim under the
22 Massachusetts Wiretapping Statute, and the Court DISMISSES this claim WITH LEAVE
23 TO AMEND.
24 b) Florida Security of Communications Act
25 “Any person whose wire, oral, or electronic communication is intercepted, disclosed,
26 or used in violation of ss. 934.03-934.09 shall have a civil cause of action against any
27 person or entity who intercepts, discloses, or uses, or procures any other person or entity
28 to intercept, disclose, or use, such communications ….” Fla. Stat. Ann. § 934.10. Put
1 simply, “[t]he FSCA provides a cause of action against parties that intercept or use private
2 communications without the speaker’s consent.” Goldstein v. Costco Wholesale Corp.,
3 559 F. Supp. 3d 1318, 1319–20 (S.D. Fla. 2021). Thus, for the same reasons set forth
4 above (see Section II.C.2.a), the Court agrees with Defendants that, without further support
5 or explanation, Plaintiffs’ conclusory allegations regarding “interception” are insufficient
6 at this stage. See Ashcroft, 556 U.S. at 678; Daniels-Hall, 629 F.3d at 998.
7 Further, Florida district courts have found that the FSCA does not apply to session
8 replay software, software that records a website users’ mouse clicks, keystrokes, search
9 terms, and information inputted into the website. See Cardoso v. Whirlpool Corp., Case
10 No. 21-CV-60784-WPD, 2021 WL 2820822, at *2 (S.D. Fla. July 6, 2021) (finding that
11 FSCA does not apply to the plaintiff’s claims regarding session replay technology software
12 on a commercial website and that, even so, the plaintiff failed to adequately allege
13 sufficient facts supporting the elements of an FSCA violation); Goldstein v. Luxottica of
14 Am., Inc., Case No. 21-80546-CIV-CANNON/REINHART, 2021 WL 4093295, at *3
15 (S.D. Fla. Aug. 23, 2021) (“[T]he FSCA does not extend to the session replay software.”);
16 Swiggum v. EAN Servs., LLC, Case No. 8:21-cv-493-TPB-CPT, 2021 WL 3022735, at *2
17 (M.D. Fla. July 16, 2021) (“Because the Court has concluded that the FSCA does not apply
18 to Plaintiff’s session replay technology claims, it appears that amendment is futile.
19 However, in an abundance of caution, the Court will grant leave for Plaintiff to file an
20 amended complaint, if she may do so in good faith.”). This session replay software appears
21 similar in kind to the software, code, or tracking technology Plaintiffs allege here. (See
22 Compl. ¶ 30 (alleging “software that tracks user activity, like the buttons they click”).)
23 Therefore, Plaintiffs have failed to state a claim under FSCA, and the Court DISMISSES
24 this claim WITH LEAVE TO AMEND.
25 ///
26 ///
27 ///
28 ///
1 it. CONCLUSION
2 Based on the foregoing, Defendant’s Motion to Dismiss is GRANTED. Plaintiffs
3 file an amended complaint on or before September 2, 2024.
4 ISSO ORDERED.
5 ||DATE: August 19, 2024
7 ONY RUTH BERMUBEZ MONTENEGRO
UNITED STATES DISTRICT JUDGE
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28