“For purposes of ruling on a motion to dismiss for 6 want of standing, [courts] must accept as true all material allegations of the complaint and must 7 construe the complaint in favor of the complaining party.”
How later courts described this case
- “For purposes of ruling on a motion to dismiss for 6 want of standing, [courts] must accept as true all material allegations of the complaint and must 7 construe the complaint in favor of the complaining party.”
- “[S]ection 631 . . . has been held to apply only 19 to eavesdropping by a third party and not to recording by a participant to a conversation.”
Written by the judges who cited it.
The opinion
THE HONORABLE JOHN C. COUGHENOUR
1
2
3
4
5
6
UNITED STATES DISTRICT COURT
7
WESTERN DISTRICT OF WASHINGTON
8 AT SEATTLE
9 JANE DOE, individually and on behalf of all CASE NO. C23-0718-JCC
others similarly situated,
10
ORDER
11 Plaintiff,
v.
12
MICROSOFT CORPORATION, et al.,
13
Defendants.
14
15
16 This matter comes before the Court on motions to dismiss by Defendants Qualtrics
17 International Inc. and Qualtrics LLC (together “Qualtrics”) and Defendant Microsoft
18 Corporation (Dkt. Nos. 37, 43). Having thoroughly considered the parties’ briefing and the
19 relevant record, the Court finds oral argument unnecessary and hereby GRANTS in part and
20 DENIES in part the motions for the reasons explained herein.
21 I. BACKGROUND
22 Plaintiff is a California resident who obtains healthcare from Kaiser Permanente
23 (“Kaiser”). (Dkt. No. 1 at 2–3.) She has been a Kaiser member for at least 10 years and has used
24 its website throughout her membership. (Id. at 3.) Unbeknownst to Plaintiff, code within the
25 Kaiser website includes software development kits (“SDKs”) offered by Defendants Qualtrics
26 and Microsoft. (Id. at 9.) Plaintiff alleges that Qualtrics and Microsoft, through these SDKs,
1 “repeatedly and systematically [] violated [her and other Kaiser members’] legally-protected
2 privacy interest by extracting private healthcare and other information from Kaiser Members’
3 communications with the Kaiser Website.” (Id. at 2.) This includes Kaiser members’ “medical
4 conditions, immunizations, prescriptions, physician information, and other private data,
5 including healthcare search terms, videos watched, and links accessed.” (Id.) Plaintiff further
6 alleges that Defendants used this data together with unique identifiers to identify the Kaiser
7 member associated with the data. (Id. at 2, 9.) According to Plaintiff, Kaiser members had no
8 indication this information is transmitted to Defendants. (Id. at 9.)
9 Plaintiff brings nine causes of action against both Qualtrics and Microsoft: (1) violations
10 of the California Invasion of Privacy Act (“CIPA”) (two counts); (2) violation of the right to
11 privacy under the California Constitution; (3) intrusion upon seclusion under California law;
12 (4) violation of the U.S. Computer Fraud and Abuse Act (“CFAA”), 18 U.S.C. § 1030, et seq.;
13 (5) unjust enrichment; (6) violation of the California Unfair Competition Law (“UCL”);
14 (7) statutory larceny; and (8) conversion under California law. (Dkt. No. 1 at 33–46.) In
15 response, Qualtrics and Microsoft each move to dismiss the complaint (Dkt. Nos. 37, 43) and, in
16 doing so, seek judicial notice of several exhibits (Dkt. Nos. 38 at 3–5; 43 at 9, 12–13, 24).
17 II. DISCUSSION
18 A. Judicial Notice
19 As an initial matter, Qualtrics asks the Court to consider four exhibits under either the
20 doctrine of judicial notice or the doctrine of incorporation: (1) a Qualtrics webpage titled “How
21 to collect website feedback” (Exhibit 1); (2) a Qualtrics webpage titled “Step 4: Setting Up Your
22 Intercept” (Exhibit 2); (3) Kaiser’s log-in page (Exhibit 3); and (4) Kaiser’s privacy statement
23 (Exhibit 4). (Dkt. No. 38 at 4.) Microsoft similarly asks the Court to take judicial notice of
24 (1) Microsoft’s advertising agreement (Exhibit A), (2) Microsoft’s privacy statement (Exhibit B),
25 (3) Kaiser’s privacy statement (Exhibit C), (4) a Microsoft webpage titled “Universal Event
26
1 Tracking” (Exhibit E),1 and (5) a bulletin on the U.S. Health & Human Services website titled,
2 “Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates”
3 (Exhibit F). (Dkt. No. 43 at 9, 12–13, 24.)
4 Generally, courts may not consider material outside of the pleadings when ruling on a
5 motion to dismiss. Lee v. City of Los Angeles, 250 F.3d 668, 688 (9th Cir. 2001). There are two
6 exceptions to this rule. First, incorporation-by-reference allows courts to treat certain documents
7 as though they are part of the complaint itself. Khoja v. Orexigen Therapeutics, Inc., 899 F.3d
8 988, 1002 (9th Cir. 2018). Second, courts may take judicial notice of facts that are “not subject to
9 reasonable dispute because [they] . . . can be accurately and readily determined from sources
10 whose accuracy cannot reasonably be questioned.” U.S. v. Ritchie, 342 F.3d 903, 908–09 (9th
11 Cir. 2003) (citing Fed. R. Evid. 201(b)). Judicial notice should be taken with reserve, however,
12 as its function is to deprive a party of the opportunity to attack opposing evidence through
13 rebuttal and cross-examination. Rivera v. Philip Morris, Inc., 395 F.3d 1142, 1151 (9th Cir.
14 2005). Furthermore, “[j]ust because the document itself is susceptible to judicial notice does not
15 mean that every assertion of fact within that document is judicially noticeable for its truth.”
16 Khoja, 899 F.3d at 999. The same is true for websites, which may be judicially noticed for their
17 existence and content, but not for the content’s truth. Threshold Enterprises Ltd. v. Pressed
18 Juicery, Inc., 445 F. Supp. 3d 139, 146 (N.D. Cal. 2020); see 2Die4Kourt v. Hillair Cap. Mgmt.,
19 LLC, 2016 WL 4487895, slip op. at 1 n.1 (C.D. Cal. 2016) (taking judicial notice of thirty-four
20 online news articles and social media posts “solely for their existence and content, and not for
21 the truth of any statements in the documents”).
22 Here, judicial notice is appropriate with respect to Qualtrics’ Exhibit 3 and Microsoft’s
23 Exhibits E and F. Exhibit 3 is Kaiser’s log-in page, and there is no reasonable dispute as to its
24 authenticity or accuracy. (See generally Dkt. Nos. 52, 55.) Exhibits E and F are public webpages,
25 and Plaintiff does not oppose Microsoft’s request that they be judicially noticed. (See generally
26 1 Microsoft’s motion (Dkt. No. 43) appears to incorrectly refer to this as Exhibit D.
1 Dkt. No. 55.) Furthermore, the complaint incorporates Exhibit F by reference. (See Dkt. No. 1 at
2 6.) For those reasons, the Court GRANTS Defendants’ requests for judicial notice with respect to
3 Exhibits 3, E, and F.
4 Judicial notice is also appropriate with respect to Qualtrics’ Exhibits 1 and 4, and
5 Microsoft Exhibits A, B, and C. Public terms of service and privacy policies are proper subjects
6 of judicial notice. See, e.g., In re Zoom Video Commc’ns Inc. Priv. Litig., 525 F. Supp. 3d 1017,
7 1026 (N.D. Cal. 2021); Coffee v. Google, LLC, 2021 WL 493387, slip op. at 3–4 (N.D. Cal.
8 2021); Matera v. Google Inc., 2016 WL 8200619, slip op. at 5 (N.D. Cal. 2016). Furthermore,
9 Plaintiff does not meaningfully dispute the authenticity or accuracy of these exhibits. (See
10 generally Dkt. Nos. 52, 55.) Accordingly, the Court GRANTS Defendants’ requests for judicial
11 notice with respect to Exhibits 1, 4, A, B, and C.2
12 With respect to Qualtrics’ Exhibit 2, Qualtrics appears to be asking the Court to take
13 judicial notice of the truth of its contents, not merely its existence. (See Dkt. No. 37 at 2) (citing
14 Exhibit 2 for the assertion that “[t]he Site Intercept function does not ‘intercept’
15 anything . . .”). Such a request is not appropriate under Federal Rule of Evidence 201. See Ang v.
16 Bimbo Bakeries USA, Inc., 2013 WL 5407039, slip op. at 6 (N.D. Cal. 2013) (declining to take
17 judicial notice of American Heart Association website pages because the defendant requested
18 judicial notice of the truth of the contents of those pages). Accordingly, the Court DENIES
19 Qualtrics’ request for judicial notice with respect to Exhibit 2.
20 B. Standing
21 In general, to establish standing, “a plaintiff must show (i) that [s]he suffered an injury in
22 fact that is concrete, particularized, and actual or imminent; (ii) that the injury was likely caused
23
2 However, the Court only takes “judicial notice of the fact that these documents exist, ‘not
24 whether, for example, the documents are valid or binding [].’” Opperman v. Path, Inc., 84 F.
Supp. 3d 962, 975 (N.D. Cal. 2015) (quoting Datel Holdings Ltd. v. Microsoft Corp., 712 F.
25 Supp. 2d 974, 984 (N.D. Cal. 2010)). The Court further notes that while these disclosures appear
to be the most recent terms and policies, there is no indication that they existed throughout the
26
last 10 years (during which Plaintiff allegedly used the Kaiser website).
1 by the defendant; and (iii) that the injury would likely be redressed by judicial relief.”
2 TransUnion LLC v. Ramirez, 141 S. Ct. 2190, 2203 (2021). This must be shown “for each claim
3 that they press and for each form of relief that they seek.” Id. at 2208. At the pleading stage,
4 “general factual allegations of injury resulting from the defendant’s conduct may suffice.” Lujan
5 v. Defenders of Wildlife, 504 U.S. 555, 561 (1992) (internal citations omitted). This is not an
6 onerous burden, though, “for on a motion to dismiss we presum[e] that general allegations
7 embrace those specific facts that are necessary to support the claim.” Id.
8 Qualtrics contends that Plaintiff lacks standing because (a) she relies on group
9 allegations, rather than alleging conduct traceable to Qualtrics (versus Microsoft); (b) she fails to
10 allege the collected data is identifying of her (rather than anonymized), thereby failing to allege
11 an injury in fact for her privacy claims (counts I–IV); and (c) she fails to allege any economic
12 loss, as required to assert her remaining claims (counts V–IX). (Dkt. No. 37 at 14–17.) None of
13 these arguments are persuasive.
14 First, Plaintiff adequately alleges conduct traceable to Qualtrics. Indeed, the complaint
15 specifically identifies how Qualtrics’ SDK intercepts Kaiser members’ private data and the types
16 of data it intercepts. (See Dkt. No. 1 at 9, 16–23.)3 This is sufficient to allege conduct traceable
17 to Qualtrics. See In re Static Random Access Memory (SRAM) Antitrust Litig., 580 F. Supp. 2d
18 896, 904 (N.D. Cal. 2008) (“Although Plaintiffs will need to provide evidence of each
19 Defendants’ participation in any conspiracy, they now only need to make allegations that
20 plausibly suggest that each Defendant participated in the alleged conspiracy.”). That the
21 complaint also alleges conduct equally traceable to Microsoft does not render those allegations
22 improper “group allegations.” See Tivoli LLC v. Sankey, 2015 WL 12683801, slip op. at 3 (C.D.
23 Cal. 2015) (“Group pleading is not fatal to a complaint if the complaint still gives defendants fair
24 notice of the claims against them.”).
25
3 Separately, the complaint also discusses Microsoft’s allegedly unlawful conduct. (See id. at 9–
26
16).
1 Second, Plaintiff repeatedly alleges that “the unique user identifiers allow Qualtrics to
2 link” a Kaiser member’s private data “to a specific user and identify the user.” (Dkt. No. 1 at 17–
3 23) (emphasis added). Construing the complaint liberally, as the Court must, this is sufficient to
4 allege that Qualtrics collects non-anonymized data, thereby giving rise to an injury in fact. See
5 Warth v. Seldin, 422 U.S. 490, 501 (1975) (“For purposes of ruling on a motion to dismiss for
6 want of standing, [courts] must accept as true all material allegations of the complaint and must
7 construe the complaint in favor of the complaining party.”).4
8 Third and finally, Plaintiff alleges economic loss in two ways: (a) the unlawful taking and
9 use of her private data, which is inherently valuable; and (b) the diminution of the value of that
10 data. (See Dkt. No. 1 at 25, 28, 42, 45.) Qualtrics argues that such losses are insufficient to
11 confer standing, and that Plaintiff must instead allege that she planned to sell her data, or that her
12 data was made less valuable due to Qualtrics’ use of it. (Dkt. No. 37 at 16–17.) Although the
13 Court disagrees, this argument merits further discussion.
14 “[S]tate law can create interests that support standing in federal courts.” Cantrell v. City
15 of Long Beach, 241 F.3d 674, 684 (9th Cir. 2001). As relevant here, California law recognizes a
16 right to disgorgement of profits resulting from unjust enrichment, even where an individual has
17 not suffered a corresponding loss. In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589,
18 599 (9th Cir. 2020) [hereinafter Facebook Tracking]. Thus, to establish standing, Plaintiff must
19 allege she retains a stake in the profits garnered from her personal data because “the
20
4 Relatedly, Microsoft notified this Court of a recent decision in Adams v. PSP Group, LLC,
21 2023 WL 5951784 (E.D. Mo. 2023), asserting that it addresses various issues raised in
Microsoft’s motion to dismiss. (Dkt. No. 59.) In Adams, the court dismissed a case challenging
22
the use of Microsoft session replay software for failure to plead a concrete injury sufficient to
confer Article III standing. 2023 WL 5951784, slip op. at 1. But this case is clearly
23
distinguishable. Whereas the plaintiff in Adams “[did] not allege or describe what information
24 Plaintiff provided to Defendant while she was visiting its website,” (id. at 16), Plaintiff here does
so extensively. (See Dkt. No. 1 at 9–16) (alleging that Microsoft collected Kaiser members’
25 search terms, visited webpages, viewed videos, prescriptions, medical conditions, immunization
records, and allergies to link each member to a specific user and identify the user). Accordingly,
26
Adams does not change the Court’s conclusion.
1 circumstances are such that, as between the two [parties], it is unjust for [Qualtrics] to retain it.”
2 Id. at 600 (citing McBride v. Boughton, 20 Cal. Rptr. 3d 115, 122 (2004)) (emphasis in original).
3 Here, Plaintiff adequately pleads an entitlement to Qualtrics’ profits from users’ personal
4 data. Specifically, she alleges that her personal data carries financial value and cites to numerous
5 articles and studies describing the growing market for personal data, including personal health
6 data. (Dkt. No. 1 at 23–28.) Furthermore, Plaintiff alleges that Qualtrics profited from this data
7 and, in fact, used the data for targeted advertising, generating revenue and profits. (Id. at 42–45.)
8 And according to Plaintiff, Qualtrics’ actions diminished the value of her data. (Id. at 28.)
9 Combined, these allegations are sufficient to confer standing under Facebook Tracking. See Ji v.
10 Naver Corp., 2023 WL 6466211, slip op. at 6 (N.D. Cal. 2023) (finding the plaintiffs’
11 “diminution of value” theory of economic injury sufficient to confer standing).
12 Accordingly, the Court FINDS that Plaintiff has sufficiently pleaded an injury to support
13 standing for the relief sought.
14 C. Failure to State a Claim
15 Next, Defendants challenge the factual sufficiency of the complaint as a whole, as well as
16 each of Plaintiff’s individual claims. The Court considers each in turn.
17 1. Legal Standard
18 Dismissal is proper when a plaintiff “fails to state a claim upon which relief can be
19 granted.” Fed. R. Civ. P. 12(b)(6). To survive a motion to dismiss, a complaint must contain
20 sufficient factual matter, accepted as true, to state a claim for relief that is plausible on its face.
21 Ashcroft v. Iqbal, 556 U.S. 662, 677–78 (2009). A plaintiff is obligated to provide grounds for
22 their entitlement to relief that amount to more than labels and conclusions or a formulaic
23 recitation of the elements of a cause of action. Bell Atl. Corp. v. Twombly, 550 U.S. 544, 545
24 (2007). A claim has facial plausibility when the plaintiff pleads factual content5 that allows the
25
5 Although the Court must accept as true a complaint’s well-pleaded facts, conclusory allegations
26 of law and unwarranted inferences will not defeat an otherwise proper Rule 12(b)(6) motion. See,
1 court to draw the reasonable inference that the defendant is liable for the misconduct alleged.
2 Iqbal, 556 U.S. at 678. “[T]he pleading standard Rule 8 announces does not require ‘detailed
3 factual allegations,’ but it demands more than an unadorned, the-defendant-unlawfully-harmed-
4 me accusation.” Id. (citing Twombly, 550 U.S. at 555). Dismissal under Rule 12(b)(6) “can [also]
5 be based on the lack of a cognizable legal theory.” Balistreri v. Pacifica Police Dep’t, 901 F.2d
6 696, 699 (9th Cir. 1988).
7 2. Factual Sufficiency
8 Qualtrics and Microsoft challenge the adequacy of the complaint’s factual allegations
9 under Rule 8. Specifically, Qualtrics argues that Plaintiff fails to plead when she used the Kaiser
10 website and thus was exposed to Qualtrics’ alleged data collection. (Dkt. No. 37 at 18.)
11 Microsoft similarly argues that Plaintiff fails to allege facts plausibly showing she was
12 personally affected by Microsoft’s alleged conduct, including the dates she used the Kaiser
13 website and facts showing Kaiser disclosed her data in a manner that allowed Microsoft to
14 identify her personally. (Dkt. No. 43 at 15–16.) Neither argument is convincing.
15 Rule 8 requires that a complaint “contain sufficient allegations of underlying facts to give
16 fair notice and to enable the opposing party to defend itself effectively.” Starr v. Baca, 652 F.3d
17 1202, 1216 (9th Cir. 2011). Courts do at times “dismiss claims under Rule 8 when plaintiffs fail
18 to allege approximately when the actionable misconduct occurred.” Brodsky v. Apple Inc., 445 F.
19 Supp. 3d 110, 135 (N.D. Cal. 2020). But “a failure to plead when any alleged misconduct
20 occurred will not necessarily be fatal under Rule 8.” Id. Instead, a plaintiff’s “repeated failure to
21 plead the approximate date of alleged misconduct fails to satisfy Rule 8” in certain
22 circumstances, such as “where . . . an applicable statute of limitations defense has been raised
23 and is non-frivolous” Id.
24 Here, Plaintiff alleges she “has been a Kaiser Member for at least 10 years and has used
25
e.g., Vasquez v. Los Angeles Cnty., 487 F.3d 1246, 1249 (9th Cir. 2007); Sprewell v. Golden
26
State Warriors, 266 F.3d 979, 988 (9th Cir. 2001).
1 the Kaiser Website throughout her membership.” (Dkt. No. 1 at 3, 28.) She claims that while
2 logged into that account, “she used the search function; accessed immunization and medical
3 records; made appointments; reviewed physical information; reviewed medical conditions; and
4 watched videos,” and that when she did, “Defendants unlawfully intercepted and collected such
5 data along with her personal identifiers.” (Id.) This is sufficient under Rule 8, particularly in light
6 of Defendants’ failure to raise a non-frivolous statute of limitations defense.6 Accordingly, the
7 Court DENIES Defendants’ motions on these grounds.7
8 3. Consent
9 Qualtrics next argues Plaintiff’s claims must be dismissed because she consented to
10 Qualtrics’ collection of her data. (Dkt. No. 37 at 19–20.) Consent “can be explicit or implied, but
11 any consent must be actual.” Calhoun v. Google LLC, 526 F. Supp. 3d 605, 620 (N.D. Cal.
12 2021). For consent to be actual, the disclosures must “explicitly notify” users of the practice at
13 issue. Id.; see also Campbell v. Facebook, Inc., 77 F. Supp. 3d 836, 847–48 (N.D. Cal. 2014)
14 (explaining that, for a finding of consent, the disclosures must have given users notice of the
15 “specific practice” at issue). And the disclosures must have only one plausible interpretation. In
16
6 In arguing factual insufficiency under Rule 8, Qualtrics raises the possibility of a statute of
17
limitations defense. (Dkt. No. 37 at 18.) Generally, the statute of limitations commences when a
18 cause of action “accrues.” Bernson v. Browning-Ferris Indus., 871 P.2d 613, 615 (Cal. 1994).
But under the common law “discovery rule,” the accrual date may be “delayed until the plaintiff
19 is aware of her injury.” Id. (citation omitted). A plaintiff is held to her actual knowledge as well
as knowledge that could reasonably be discovered through investigation of sources open to her.
20
Jolly v. Eli Lilly & Co., 751 P.2d 923, 927 (Cal. 1988). Here, Plaintiff alleges that she and class
21 members “could not with due diligence have discovered the full scope of Defendants’ conduct”
because Defendants’ SDKs were highly technical and there was no indication that would alert a
22 reasonable consumer of Defendants’ data collection and interception. (Dkt. No. 1 at 29.)
According to the complaint, “[t]he earliest Plaintiff and Class Members could have known about
23 Defendants’ conduct was shortly before the filing of this Complaint.” (Id.) Accepting Plaintiff’s
allegations as true, the delayed discovery rule tolls the statute of limitations, making the specific
24
timing of alleged misconduct irrelevant to the analysis.
25 7 As for Microsoft’s argument that Plaintiff fails to allege facts showing Microsoft could identify
her personally: this is another iteration of Qualtrics’ standing argument, and the Court denies it
26
for the same reasons. See supra Part II.B.
1 re Facebook, Inc., Consumer Privacy User Profile Litig., 402 F. Supp. 3d 767, 794 (N.D. Cal.
2 2019).8 Finally, Qualtrics bears the burden of showing consent. See Calhoun, 526 F. Supp. 3d at
3 620.
4 Qualtrics asserts the Kaiser website “advises users that by logging in, they accept
5 Kaiser’s Term & Conditions and Privacy Statement.” (Dkt. No. 37 at 19.) The privacy statement,
6 in turn, informs users that Kaiser may “disclose your personal information to third parties who
7 provide services on our behalf to help with our business activities,” and that Kaiser and its
8 “service providers may place Internet ‘cookies’ or similar technologies . . . on the computer hard
9 drives of visitors to the Site.” (Id. at 19–20.) This, according to Qualtrics, shows that any logged-
10 in Kaiser user consented to the data collection at issue in this case. (Id. at 20.)
11 But Plaintiffs’ claims do not hinge on a Kaiser user being logged in to her account, as
12 Plaintiff expressly alleges that Qualtrics collects certain categories of data “regardless of whether
13 the user is logged in to her Kaiser Account.” (Dkt. No. 1 at 19.) Thus, even if Kaiser’s
14 disclosures at log-in indicate consent to some of the allegedly unlawful data collection, they do
15 not indicate consent to all of it.
16 Moreover, the Court is skeptical that a reasonable user who viewed Kaiser’s policies
17 would have understood that Qualtrics was collecting protected health information. In In re Meta
18 Pixel Healthcare Lit., for example, the court found no consent where Meta’s policies indicated
19 that Meta collects users’ personal data, but “do not . . . specifically indicate that Meta may
20 acquire health data obtained from Facebook users’ interactions with their medical providers’
21 websites.” 647 F. Supp. 3d 778, 793 (N.D. Cal. 2022) (emphasis in original). Such notice, the
22 court concluded, was too generalized to establish consent. Id. The same holds true here.
23 Although Kaiser informed users that it may disclose “personal information to third parties,” a
24
8 “[I]f a reasonable . . . user could have plausibly interpreted the contract language as not
25 disclosing that [the defendant] would engage in particular conduct, then [the defendant] cannot
obtain dismissal of a claim about that conduct (at least not based on the issue of consent).” Id. at
26
789–90.
1 reasonable user would not have understood this to include personal health information. (See Dkt.
2 No. 37 at 19.) That this case involves Kaiser (a health care provider) rather than Meta (a tech
3 company) does not persuade the Court otherwise, particularly in light of the sensitive nature of
4 the data at issue (which includes Plaintiff’s prescriptions, medical conditions, immunizations,
5 allergies, search queries, and unique identifiers). (See Dkt. No. 1 at 16–23.)
6 Accordingly, Qualtrics’ motion to dismiss based on consent is DENIED.
7 D. Privacy Claims
8 1. California Invasion of Privacy Act
9 Plaintiff claims Defendants violated two provisions of CIPA: § 631(a) (the wiretapping
10 provision) and § 632 (the recording provision).
11 a. Section 631(a)
12 CIPA § 631(a) prohibits “three distinct and mutually independent patterns of conduct”:
13 (1) intentional wiretapping; (2) willfully attempting to learn the contents or meaning of a
14 communication in transit over a wire; and (3) attempting to use or communicate information
15 obtained as a result of engaging in either of the two previous activities. Mastel v. Miniclip SA,
16 549 F. Supp. 3d 1129, 1134 (E.D. Cal. 2021). Under the participant exception, however, parties
17 to a communication are exempt from liability. Facebook Tracking, 956 F.3d at 607; see also
18 Warden v. Kahn, 160 Cal. Rptr. 471, 475 (1979) (“[S]ection 631 . . . has been held to apply only
19 to eavesdropping by a third party and not to recording by a participant to a conversation.”).
20 Qualtrics argues it acted merely as an extension of Kaiser, and therefore, was a
21 participant rather than an eavesdropper. (Dkt. No 37 at 20–22.) Lower courts are split as to
22 whether a software provider falls within the party exception. Compare Revitch v. New Moosejaw,
23 LLC, 2019 WL 5485330, slip op. at 1 (N.D. Cal. 2019) (holding that defendant “acted as a third
24 party” for CIPA purposes), with Graham v. Noom, 533 F. Supp. 3d 823, 832 (N.D. Cal. 2021)
25 (holding that software vendors are extensions of the websites that employ them, and thus not
26
1 third parties for CIPA purposes).9 But even if the Court were to adopt the Graham approach, as
2 Qualtrics urges, Plaintiff adequately alleges that Qualtrics used her data for its own benefit. (Dkt.
3 No. 1 at 42–43) (“[Defendants’] benefits include . . . the revenue and profits resulting from the
4 targeted advertising and other uses of such data by Defendants.”). Accordingly, Qualtrics’
5 argument that it is a mere “extension” of Kaiser does not provide a basis for dismissal at this
6 stage.
7 Microsoft argues Plaintiff’s § 631(a) claim fails because she does not claim Microsoft
8 tapped or intercepted her communications with “any telegraph or telephone wire, line, cable, or
9 instrument.” (Dkt. No. 43 at 20–21); see Cal. Penal Code § 631(a). To the extent Plaintiff alleges
10 intentional wiretapping under the first clause of § 631(a), the Court agrees. As Microsoft
11 correctly notes, courts have strictly construed the “telegraph or telephone” component of
12 § 631(a)’s intentional wiretapping clause. See, e.g., In re Google Assistant Privacy Litig., 457 F.
13 Supp. 3d 797, 825 (N.D. Cal. 2020) (“The first clause expressly requires that the unauthorized
14 connection be made with any telegraph or telephone wire, line, cable, or instrument.”)
15 (quotations omitted); Matera v. Google Inc., 2016 WL 8200619, slip op. at 18 (N.D. Cal. 2016)
16 (same). Here, Plaintiff does not suggest that Defendants tapped her communications using
17 telegraph or telephone wires, besides a conclusory statement that “Defendants . . . intercept[ed]
18 [her] Private Data . . . while the same was in transit or passing over any wire, line, or cable . . . .”
19 (Dkt. No. 1 at 34.)
20 Thus, Plaintiff fails to state a § 631(a) claim against both Defendants, but only to the
21 extent she bases her claim on intentional wiretapping.
22
23
9 Although in Graham, Judge Beeler distinguished the Moosejaw line of cases, explaining that
24 those involved third parties who allegedly used the data for their own benefit (rather than for the
sole benefit of the party to the communication). Id. But as Judge Breyer later explained in Javier
25 v. Assurance IQ, LLC, “reading a use requirement into the second prong would add requirements
that are not present (and swallow the third prong in the process).” 649 F. Supp. 3d 891, 900
26
(N.D. Cal. 2023).
1 b. Section 632
2 CIPA § 632 imposes liability on “[a] person who, intentionally and without the consent
3 of all parties to a confidential communication, uses an electronic amplifying or recording device
4 to eavesdrop upon or record the confidential communication” of another. Cal. Penal Code
5 § 632(a). Defendants each argue for dismissal of Plaintiff’s § 632(a) claim.
6 Microsoft argues the claim fails because Plaintiff does not allege that Microsoft used any
7 “electronic amplifying or recording device” to record her information. (Dkt. No. 43 at 21–22.)
8 The Court agrees, to some extent. “Software like Google Maps, Chrome, etc. are not ‘devices’
9 within the meaning of CIPA because they are not ‘equipment.’” In re Google Location Hist.
10 Litig., 428 F. Supp. 3d 185, 193 (N.D. Cal. 2019) (citing Moreno v. San Francisco Bay Area
11 Rapid Transit Dist., 2017 WL 6387764, slip op. at 5 (N.D. Cal. 2017)). But servers are distinct.
12 See, e.g., Brown v. Google LLC, 525 F.Supp.3d 1049, 1064, 1073–74 (N.D. Cal. 2021). And
13 although Plaintiff asserts that “Defendants violated CIPA by using their SDKs and receiving
14 servers,” the complaint alleges that only Qualtrics used such servers (whereas Microsoft used
15 software). (Dkt. No. 1 at 17–18.)10 Because software does not constitute a “device” under the
16 CIPA, Plaintiff’s § 632 claim against Microsoft is deficient.
17 Qualtrics argues Plaintiff’s § 632 claim fails because (i) it was Kaiser (not Qualtrics) that
18 “used” the recording device, and (ii) Qualtrics did not intend to record confidential
19 communications without consent. (Dkt. No. 37 at 22–23.) The first argument is unpersuasive
20 because Plaintiff adequately pleads Qualtrics’ use of a recording device. (See Dkt. No. 1 at 17–
21
22
10 The Court has permitted Plaintiff’s references to “Defendants” rather than Microsoft and
23
Qualtrics individually throughout the complaint, see supra Part II.B. However, it will not go as
24 far as to assume such allegations apply to both Defendants equally where the factual allegations
specific to Microsoft and Qualtrics diverge. Here, only the “Qualtrics” section of the complaint
25 contains an explicit reference to “servers” (Dkt. No. 1 at 17–18), whereas the “Microsoft”
section refers only to “software” (Id. at 9). Accordingly, the Court interprets this to mean only
26
Qualtrics is alleged to have used a server.
1 18) (detailing Qualtrics’ use of servers to collect user data).11 As for the second argument,
2 Qualtrics’ reliance on Federated Univ. Police Officers’ Ass’n v. Regents of the Univ. of Cal. is
3 inapposite. 2015 WL 13273308 (C.D. Cal. 2015). There, the court dismissed a CIPA claim
4 against a retailer that did little more than “sell and install [a] recording system” at a police
5 department. Id. at 10. Such minimal involvement, the court held, was insufficient to suggest the
6 retailer “acted intentionally in eavesdropping . . . .” Id. In contrast, Plaintiff here alleges far more
7 involvement by Qualtrics, including that Qualtrics’ SDK collected and forwarded Plaintiff’s
8 personal health information to Qualtrics’ servers. (Dkt. No. 1 at 17–18.) This is sufficient to
9 show intent to record confidential communications at the dismissal stage.
10 c. Microsoft’s Remaining CIPA Arguments
11 Finally, Microsoft argues both of Plaintiff’s CIPA claims fail because she does not allege
12 facts showing Microsoft intercepted the contents of her communications with Kaiser, as is
13 required under CIPA. (Dkt. No. 43 at 17–19.) Microsoft points to In re Zynga Privacy Litigation,
14 where the Ninth Circuit found that URLs which merely included basic identification and address
15 information did not constitute contents of a communication. 750 F.3d 1098, 1109 (9th Cir.
16 2014).12 But Zynga itself distinguishes such URLs from those that disclose contents because they
17 “show[] the specific search terms the user had communicated . . . .” Id. at 1108–09. And here,
18 Plaintiff alleges Microsoft collects URLs containing search queries that could divulge a user’s
19 medical conditions, allergies, and immunizations. (Dkt. No. 1 at 10, 13–16.) Accordingly,
20 Plaintiff has adequately pled that Microsoft intercepted the contents of her communication with
21
22
11 Notably, “[Qualtrics] identif[ies] no authority suggesting that [it] cannot be held liable for
23 eavesdropping because a third party . . . participated in the installation of [Qualtrics’] code that
sends information to [Qualtrics].” Griffith v. Tiktok, Inc., 2023 WL 7107262, slip op. at 7 (C.D.
24
Cal. 2023).
25 12 Although Zynga analyzed communication under the federal Wiretap Act, 18 U.S.C. § 2511(3),
the same analysis applies under CIPA. See Cline v. Reetz-Laiolo, 329 F. Supp. 3d 1000, 1051
26
(N.D. Cal. 2018).
1 Kaiser for purposes of CIPA.13
2 In summary, the Court DISMISSES Plaintiff’s CIPA § 632 claim against Microsoft, as
3 well as her CIPA § 631(a) claim against both Defendants (but only to the extent she bases thon
4 intentional wiretapping. Plaintiff’s remaining CIPA claims survive.
5 2. California Constitution & Common Law Intrusion Upon Seclusion
6 To state a claim for intrusion upon seclusion under California common law, a plaintiff
7 must plead that (1) the defendant intentionally intruded into a place, conversation, or matter as to
8 which the plaintiff has a reasonable expectation of privacy, and (2) the intrusion occurred in a
9 manner highly offensive to a reasonable person. Facebook Tracking, 956 F.3d at 601 (citing
10 Hernandez v. Hillsides, Inc., 211 P.3d 1063, 1072 (2009)). A claim for invasion of privacy under
11 the California Constitution involves similar elements: a plaintiff must show that (1) they possess
12 a legally protected privacy interest, (2) they maintain a reasonable expectation of privacy, and (3)
13 the intrusion is “so serious . . . as to constitute an egregious breach of the social norms” such that
14 the breach is “highly offensive.” Id. Because the tests are similar, courts typically consider the
15 claims together and ask (1) whether there exists a reasonable expectation of privacy, and (2)
16 whether the intrusion was highly offensive. Id. Qualtrics and Microsoft raise various arguments
17 in support of their motions to dismiss each claim, which the Court discusses in turn.
18 a. Qualtrics
19 Two of Qualtrics’ arguments are foreclosed by the rulings above. First, Qualtrics asserts
20 that Plaintiff’s invasion of privacy and intrusion upon seclusion claims fail “because Qualtrics is
21 merely an extension of Kaiser.” (Dkt. No. 37 at 24, 26.) The Court has already rejected this
22
13 Separately, Microsoft asks the Court to dismiss Plaintiff’s CIPA, UCL, and unjust enrichment
23
claims as to non-California residents, arguing these claims do not apply extraterritorially and the
24 alleged conduct occurred outside of California. (Dkt. No. 43 at 22, 29.) Because this request is
premature, the Court will not address it at this juncture. Clancy v. The Bromley Tea Co., 308
25 F.R.D. 564, 572 (N.D. Cal. 2013) (“[A] detailed choice-of-law analysis is not appropriate at this
stage of litigation. Rather, such a fact-heavy inquiry should occur during the class certification
26
stage, after discovery.”).
1 argument and will not readdress it here. See supra Part II.D(1)(a). Second, Qualtrics argues
2 Plaintiff lacked a reasonable expectation of privacy “because she consented to Kaiser’s Privacy
3 Policy, which disclosed that data is shared with third-party partners . . . .” (Dkt. No. 37 at 24, 26.)
4 Again, the Court has rejected this consent-based argument. See supra Part II.C(3).
5 Qualtrics also argues Plaintiff had no legally protected privacy interest “where defendant
6 has only collected browsing data from one site, as opposed to across the Internet.” (Dkt. No. 37
7 at 24.) But the cases Qualtrics cites for this proposition are inapposite. Those courts’ refusal to
8 find a privacy interest did not hinge on the defendants collecting data from only a single site;
9 rather, it hinged on the defendants’ role as operators of the site through which they allegedly
10 collected data. See Yoon v. Lululemon USA, Inc., 549 F. Supp. 3d 1073, 1086 (C.D. Cal. 2021);
11 In re Google Location Hist. Litig., 428 F. Supp. 3d 185, 198 (N.D. Cal. 2019). As the Yoon court
12 explained, “courts have been less willing to find that users have a cognizable privacy interest in
13 browsing data collected only while users interact with the website of the defendant company.”
14 549 F. Supp. 3d at 1086 (emphasis added). And here, Qualtrics is not the website owner; Kaiser
15 is.14 Accordingly, the Court rejects this argument.
16 Qualtrics next argues that the data collection at issue was not highly offensive because
17 (i) it involved only anonymized data, (ii) it was merely routine, and (iii) there was no improper
18 use of the data. (Dkt. No. 37 at 25–26) (citing Folgelstrom v. Lamps Plus, Inc., 125 Cal. Rptr. 3d
19 260 (2011)). The Court has already concluded that Plaintiff adequately alleges non-anonymized
20 data collection, see supra Part II.B, and Qualtrics’ remaining arguments are unpersuasive.
21 Qualtrics’ relies on Folgestrom, a case that other courts have distinguished where “the data at
22 issue [] is more private than a person’s mailing address and this kind of intrusion is not routine
23 commercial behavior.” Opperman v. Path, Inc., 205 F. Supp. 3d 1064, 1078 (N.D. Cal. 2016).
24 And here, the data at issue is Plaintiff’s personal health information. Fundamentally, “[t]he
25 ultimate question of whether [Defendants’] tracking and collection practices could highly offend
26 14 Had Plaintiff brought this suit against Kaiser, the cited cases may have been more persuasive.
1 a reasonable individual is an issue that cannot be resolved at the pleading stage.” Facebook
2 Tracking, 956 F.3d at 606.
3 b. Microsoft
4 Microsoft’s first argument15 puts at issue the contents of Plaintiff’s communications.
5 (See Dkt. No. 43 at 17–19.) This is a regurgitation of its prior argument, which the Court rejects
6 for the same reasons it did above. See supra Part II.D(1).
7 Microsoft next argues Plaintiff lacked a reasonable expectation of privacy before logging
8 into the Kaiser website (because the data collected is not protected health information) and after
9 logging in (because Kaiser’s Privacy Statement discloses data collection). (Dkt. No. 43 at 24.) As
10 previously stated, the Court is not convinced that Kaiser’s Privacy Statement indicates full
11 consent to Defendants’ alleged data collection. See supra Part II.C(3).16
12 Finally, Microsoft argues Plaintiff’s claims fail because she “does not allege that any
13 privacy invasion was ‘sufficiently serious’” such that it evidences an “intent of committing
14 theft,” nor does she plead “facts showing Microsoft used the data in a highly offensive manner.”
15 (Dkt. No. 43 at 24–25.) Again, the Court is unpersuaded. First, Microsoft’s cited legal authority
16 does not support its assertion that Plaintiff must plead Microsoft “intended to steal her data.” See
17 generally, Razuki v. Caliber Home Loans, Inc., 2018 WL 2761818, slip op. at 2 (S.D. Cal. 2018).
18 Second, “[t]he ultimate question of whether [Defendants’] tracking and collection practices could
19 highly offend a reasonable individual is an issue that cannot be resolved at the pleading stage.”
20 15 Microsoft also contends Plaintiff’s claims lack specificity and are set in conclusory terms.
21 (Dkt. No. 43 at 23–24.) But the Ninth Circuit has not required more than Plaintiff has alleged.
See Facebook Tracking, 956 F.3d at 603 (rejecting Facebook’s claim that “Plaintiffs need to
22 identify specific, sensitive information that Facebook collected, and that their more general
allegation that Facebook acquired ‘an enormous amount of individualized data’ is insufficient”).
23 The Court therefore rejects that argument.
24 16 Because Plaintiff plausibly alleges a constitutional violation and intrusion upon seclusion, it is
unnecessary for the Court to decide at the pleading stage whether Plaintiff had a reasonable
25 expectation of privacy prior to logging into the Kaiser website. Rule 12(b)(6) “does not provide
a mechanism for dismissing only a portion of a claim.” Franklin v. Midwest Recovery Sys., LLC,
26
2020 WL 3213676, slip op. at 1 (C.D. Cal. 2020) (collecting cases).
1 Facebook Tracking, 956 F.3d at 606. At this stage, Plaintiff’s allegations that Defendants
2 intercepted and collected Plaintiff’s protected health information and personally identifiable
3 information are sufficient to survive dismissal.
4 In sum, Plaintiff has sufficiently pleaded the “reasonable expectation of privacy” and
5 “highly offensive” elements necessary to state a claim for intrusion upon seclusion and invasion
6 of privacy. The Court thus DENIES Defendants’ motions to dismiss these claims.
7 3. CFAA
8 “[T]he CFAA is an anti-hacking statute, not an expansive misappropriation statute.”
9 Andrews v. Sirius XM Radio Inc., 932 F.3d 1253, 1263 (9th Cir. 2019) (quotations omitted). The
10 statute makes it unlawful to, among other things, “intentionally access[] a computer without
11 authorization” and obtain “information from any protected computer.” 18 U.S.C. § 1030(a)(2).
12 For civil liability to attach, a plaintiff must allege a violation involving one of the five factors
13 listed in § 1030(a)(5)(B). Id. § 1030(g). Here, Plaintiff relies on two of the factors: that the
14 offense caused “loss to 1 or more persons during any 1-year period . . . aggregating at least
15 $5,000 in value,” see id. § 1030(a)(4)(A)(i)(I), and that the offense caused “a threat to public
16 health or safety,” see id. § 1030(a)(4)(A)(i)(IV). (Dkt. No. 1 at 42).
17 Defendants argue that Plaintiff has not alleged sufficient loss to maintain her CFAA
18 claim under the first factor. (Dkt. Nos. 37 at 28–29, 43 at 26–27.) The Court agrees. A “loss”
19 under the CFAA is “any reasonable cost to any victim, including the cost of responding to an
20 offense, conducting a damage assessment, and restoring the data, program, system, or
21 information to its condition prior to the offense, and any revenue lost, cost incurred, or other
22 consequential damages incurred because of interruption of service.” 18 U.S.C. § 1030(e)(11).
23 Here, Plaintiff’s sole alleged loss is based on “diminution in value” of her private data. (Dkt. No.
24 1 at 42.) This is insufficient under the CFAA, which “clearly limits [‘loss’] to harms caused by
25 computer intrusions, not general injuries unrelated to the hacking itself.” Andrews, 932 F.3d at
26 1263; see Cottle v. Plaid, Inc., 536 F. Supp. 3d 461, 486 (N.D. Cal. 2021) (concluding that
1 Andrews forecloses the diminution of value theory for CFAA claims). Furthermore, Plaintiff’s
2 reference to the “damage” she allegedly suffered is misplaced, as § 1030(a)(4)(A)(i)(I) refers
3 only to “loss” (which is distinct from “damage” under the CFAA). Compare 18 U.S.C.
4 § 1030(e)(8) (defining “damage”), with 18 U.S.C. § 1030(e)(11) (defining “loss”). Accordingly,
5 Plaintiff fails to state a CFAA claim based on the first factor.17
6 As to the second factor, Plaintiff makes a conclusory allegation that Defendants’ conduct
7 “constitutes ‘a threat to public health or safety’ under 18 U.S.C. § 1030(c)(4)(A)(i)(IV),” but
8 fails to include specific factual allegations to support that theory of CFAA liability.
9 Because Plaintiff has not plausibly alleged a “loss” under the CFAA, Defendants’
10 motions to dismiss these claims are GRANTED.
11 E. Remaining Claims
12 1. Unjust Enrichment
13 California18 courts are divided as to whether a plaintiff can assert unjust enrichment as a
14 standalone cause of action (as opposed to an alternative mechanism for relief). ESG Cap.
15 Partners, LP v. Stratos, 828 F.3d 1023, 1038 (9th Cir. 2016) (comparing cases); see also Grausz
16 v. Hershey Co., 2023 WL 6206449, slip op. at 8 (S.D. Cal. 2023) (collecting Ninth Circuit
17 decisions demonstrating the uncertainty). However, the most recently published Ninth Circuit
18
17 As an alternative theory, Plaintiff also asserts she and class members “suffered loss of at least
19 $5,000 in the form of retaining a technical expert to investigate Microsoft’s surreptitious
interception and collection of their data in order to ‘respond[] to an offense’ and to ‘to restor[e]
20
the data . . . to its condition prior to the offense.” (Dkt. Nos. 54 at 26–27, 55 at 24.) There are two
21 problems with this theory. First, Plaintiff failed to raise it in the complaint. (See generally Dkt.
No. 1.) Second, even if Plaintiff had included it in the complaint, the Court is not convinced that
22 this theory would meet the CFAA’s “loss” requirement. As the Supreme Court explained in Van
Buren v. United States, 141 S. Ct. 1648, 1659–60 (2021), “the statutory definition[] of . . . ‘loss’
23 [] focus[es] on technological harms—such as the corruption of files—of the type unauthorized
users cause to computer systems and data.” Plaintiff’s hiring of a “technical expert” for
24
investigation purposes does not fit this definition.
25 18 Because the complaint asserts that “California substantive law applies to every member of the
Class,” (Dkt. No. 1 at 32), the Court treats the unjust enrichment claim as one brought under
26
California common law.
1 case on the issue noted that an unjust enrichment claim may proceed “as an independent cause of
2 action or as a quasi-contract claim for restitution.” ESG Cap. Partners, 828 F.3d at 1038. To
3 allege unjust enrichment as an independent cause of action, a plaintiff must show the defendant
4 received and unjustly retained a benefit at the plaintiff’s expense. Id. at 1038–39 (citing
5 Lectrodryer v. SeoulBank, 91 Cal. Rptr. 2d 881, 883 (2000)). Here, Plaintiff alleges Defendants
6 intercepted and collected her private data without her consent, that Defendants benefitted from
7 the “revenues and profits resulting from targeted advertising and other uses of such data,” and
8 that this “diminished the value of that Private Data.” (Dkt. No. 1 at 28, 42–43.) This is sufficient
9 to plead that Defendants received and unjustly retained a benefit at Plaintiff’s expense.
10 Accordingly, Defendants’ motions to dismiss Plaintiff’s unjust enrichment claim are DENIED.19
11 2. UCL
12 The UCL prohibits “any unlawful, unfair or fraudulent business act or practice.” Cal.
13 Bus. & Prof. Code § 17200. Each of the three UCL prongs provides a “separate and distinct
14 theory of liability” and an independent basis for relief. Rubio v. Capital One Bank, 613 F.3d
15 1195, 1203 (9th Cir. 2010) (internal quotation marks and citations omitted). Plaintiff asserts
16 Defendants’ conduct violates the “unlawful” and “unfair” prongs. (Dkt. No. 1 at 44–45.)
17 Defendants respond that Plaintiff lacks standing to assert a UCL claim, or alternatively, that the
18 claim fails on the merits. (Dkt. Nos. 37 at 29–30, 43 at 28–29.) The Court disagrees.
19 To have standing to assert a UCL claim, a plaintiff needs to have “suffered injury in fact
20 and . . . lost money or property as a result of the unfair competition.” Rubio, 613 F.3d at 1203.
21 “To show that they have lost money or property, Plaintiff[] must demonstrate some form of
22
19 Defendants further argue Plaintiff’s unjust enrichment claim fails because she has not pled an
23
inadequate remedy at law. (See Dkt. Nos. 37 at 31, 43 at 28.) The Court rejects this argument in
24 light of “clearly established circuit practice allowing plaintiffs to plead in the alternative at the
earliest stages of litigation.” Haas v. Travelex Ins. Servs. Inc., 555 F. Supp. 3d 970, 980 (C.D.
25 Cal. 2021); see also Cabrales v. Castle & Cooke Mortg., LLC, 2015 WL 3731552, slip op. at 3
(E.D. Cal. 2015) (collecting cases and noting the “ampl[e] support[]” for this proposition in the
26
Ninth Circuit).
1 economic injury, which is itself a classic form of injury in fact.” Brown v. Google LLC, 2021
2 WL 6064009, slip op. at 15 (N.D. Cal. 2021) (citing Kwikset Corp. v. Superior Court, 246 P.3d
3 877, 886 (Cal. 2011)) (internal quotations omitted). Thus, because federal standing “may be
4 predicated on a broader range of injuries,” the effect of the “lost money or property” requirement
5 is to “render[] standing under [the UCL] substantially narrower than federal standing.” Id.
6 Here, Plaintiff asserts she has “suffered an injury in fact, including lost consideration for
7 provision of access to [her private data] and diminished value of that data.” (Dkt. No. 1 at 45.)
8 “[S]everal courts have held that the unauthorized release of ‘personal information’ does not
9 constitute a loss of money or property for purposes of establishing standing under the UCL.”
10 Fraley v. Facebook, Inc., 830 F. Supp. 2d 785, 811 (N.D. Cal. 2011) (collecting cases).
11 However, “the growing trend across courts . . . is to recognize the lost property value of this
12 information.” In re Marriott Int’l, Inc., Cust. Data Sec. Breach Litig., 440 F. Supp. 3d 447, 461
13 (D. Md. 2020); see also Brown, 2021 WL 6064009, slip op. at 15 (plaintiffs had UCL standing
14 where they alleged the “cash value” of the data which Google collected “can be quantified” and
15 “there is an active market for such data”); Calhoun v. Google LLC, 526 F. Supp. 3d 605, 636
16 (N.D. Cal. 2021) (“[T]he Ninth Circuit and a number of district courts . . . have concluded that
17 plaintiffs who suffered a loss of their personal information suffered economic injury and had
18 standing.”). Like in Brown, Plaintiff cites several studies and reports showing an active market
19 for users’ private data. (See Dkt. No. 1 at 23–28.) Given this allegation, as well as the increasing
20 recognition of the value of private data, the Court concludes Plaintiff has asserted an injury in
21 fact and a loss of money or property sufficient to state a UCL claim. See Klein v. Facebook, Inc.,
22 580 F. Supp. 3d 743, 803 (N.D. Cal. 2022) (“[N]umerous courts have recognized that plaintiffs
23 who lose personal information have suffered an economic injury.”) (collecting cases).20
24
20 Qualtrics and Microsoft further argue that because Plaintiff’s UCL claim rests on statutory
25 claims that fail, the “unlawful” UCL claim also fails. (Dkt. Nos. 37 at 29, 43 at 29.) But since
Plaintiff has successfully stated claims under CIPA and the California Constitution, see supra
26
Part II.D(1)–(2), Defendants’ argument fails.
1 Accordingly, Defendants’ motions to dismiss Plaintiff’s UCL claim are DENIED.
2 3. Statutory Larceny
3 Three elements are required to show a violation of California Penal Code § 496(a): that
4 “(i) property was stolen or obtained in a manner constituting theft, (ii) [that] the defendant knew
5 the property was so stolen or obtained, and (iii) [that] the defendant received or had possession
6 of the stolen property.” Switzer v. Wood, 247 Cal. Rptr. 3d 114, 121 (2019), as modified (May
7 10, 2019); see also Cal. Penal Code § 496(c) (authorizing a civil action for treble damages, costs,
8 and fees for those injured by a violation of subdivision (a)). California Penal Code § 484(a), in
9 turn, provides that a person is guilty of theft if they “feloniously steal, take, carry, lead, or drive
10 away the personal property of another,” or obtain property “by any false or fraudulent
11 representation or pretense.” Qualtrics and Microsoft argue, among other things, that Plaintiff
12 fails to show the first element: that Defendants stole or obtained Plaintiff’s property in a manner
13 constituting theft. (Dkt. Nos. 37 at 30, 43 at 30.) The Court agrees.
14 In her response, Plaintiff asserts Defendants obtained her data through misrepresentation
15 (i.e., in a manner constituting theft under § 496(a)). (Dkt. No. 55 at 30.) Specifically, she points
16 to the Kaiser Privacy Statement and states that it “misrepresents that third parties will not be able
17 to identify individuals by their data,” and that “she lacked notice of the collection of her personal
18 information.” (Id.) But the complaint lacks any allegation of misrepresentation. (See generally
19 Dkt. No. 1.) Moreover, the Kaiser Privacy Statement is a representation made by Kaiser, not by
20 Qualtrics or Microsoft. Accordingly, it cannot serve as the basis for a statutory larceny claim
21 against Qualtrics or Microsoft.
22 For those reasons, the Court DISMISSES Plaintiff’s statutory larceny claim.
23 4. Conversion
24 California law defines conversion as “any act of dominion wrongfully asserted over
25 another’s personal property in denial of or inconsistent with his rights therein.” In re Bailey, 197
26 F.3d 997, 1000 (9th Cir. 1999). To establish conversion, a plaintiff must show “ownership or
1 right to possession of property, wrongful disposition of the property right and damages.” Kremen
2 v. Cohen, 337 F.3d 1024, 1029 (9th Cir. 2003). Courts apply a three-part test to determine
3 whether a property right exists for these purposes: “First, there must be an interest capable of
4 precise definition; second, it must be capable of exclusive possession or control; and third, the
5 putative owner must have established a legitimate claim to exclusivity.” Id. at 1030. Here,
6 Plaintiff fails to assert that her interest in the collected data is capable of exclusive possession or
7 control. See Taylor v. Google LLC, 2021 WL 4503459, slip op. at 7 (N.D. Cal. 2021) (dismissing
8 conversion claim where plaintiffs fail to allege “facts demonstrating that their cellular data
9 allowances are ‘personal property’ capable of exclusive possession or control”).
10 Accordingly, the Court DISMISSES Plaintiff’s conversion claim.
11 5. Punitive Damages
12 Finally, Microsoft asks the Court to dismiss Plaintiff’s request for punitive damages
13 because Plaintiff fails to allege facts showing “Microsoft is guilty of ‘oppression, fraud, or
14 malice,’ or “evil motive’ against her,” as is required to obtain punitive damages under California
15 law. (Dkt. No. 43 at 31) (citing Grieves v. Sup. Court, 203 Cal. Rptr. 556, 560 (1984); Scott v.
16 Phoenix Schools, Inc., 96 Cal. Rptr. 3d 159, 170 (2009)). In response, Plaintiff contends that a
17 “request for punitive damages is not a ‘claim’ and is not the proper subject of a motion to dismiss
18 under Fed. R. Civ. P. 12(b)(6).” (Dkt. No. 55 at 31) (quoting Shimy v. Wright Med. Tech., Inc.,
19 2014 WL 3694140, slip op. at 4 (C.D. Cal. 2014)). But as Microsoft correctly notes, numerous
20 courts have found a motion to dismiss to be the proper vehicle for removing punitive damages
21 from a complaint. (Dkt. No. 56 at 17) (citing Panoyan v. Regalo Int’l LLC, 2019 WL 8758897,
22 slip op. at 3–4 (C.D. Cal. 2019); Agape Family Worship Center, Inc. v. Gridiron, 2016 WL
23 633864, slip op. at 6 (C.D. Cal. 2016)). Furthermore, the Court agrees that Plaintiff fails to allege
24 any facts showing Microsoft is guilty of oppression, fraud, or malice. (See generally Dkt. No. 1.)
25 Therefore, the Court DISMISSES Plaintiff’s request for punitive damages without prejudice and
26 with leave to amend.
1 III. CONCLUSION
2 For the foregoing reasons, the Court GRANTS in part and DENIES in part Defendants’
3 motions to dismiss (Dkt. Nos. 37, 43) and GRANTS in part and DENIES in part Qualtrics’
4 motion for judicial notice (Dkt. No. 38). Specifically, the following claims are dismissed with
5 prejudice:21
6 • Plaintiff’s CFAA claim against both Defendants; and
7 • Plaintiff’s statutory larceny claim against both Defendants.
8 The following claims are dismissed without prejudice:22
9 • Plaintiff’s CIPA § 631(a) claim against both Defendants (but only to the extent she
10 bases her claim on intentional wiretapping);
11 • Plaintiff’s CIPA § 632 claim against Microsoft; and
12 • Plaintiff’s conversion claim against both Defendants.
13 All remaining claims survive.
14 DATED this 19th day of December 2023.
A
15
16
17
John C. Coughenour
18 UNITED STATES DISTRICT JUDGE
19
20
21
22
23
24 21 Given the deficiencies described above, the Court finds that further amendment would not
25 save these claims. See Lopez v. Smith, 203 F.3d 1122, 1127 (9th Cir. 2000).
22 If Plaintiff seeks leave to amend the pleading deficiencies described above for these claims,
26
she shall so move pursuant to Rule 15.