HOWARD v. LABORATORY CORPORATION OF AMERICA

IN THE UNITED STATES DISTRICT COURT

FOR THE MIDDLE DISTRICT OF NORTH CAROLINA

CONNIE HOWARD, YADIRA )

YAZMIN HERNANDEZ, and )

DEBORAH REYNOLDS, on behalf of — )

themselves and all others similarly )

situated, ) Case No. 1:23-CV-00758

)

Plaintiffs, )

)

v. )

)

LABORATORY CORPORATION OF _ )

AMERICA and LABORATORY )

CORPORATION OF AMERICA )

HOLDINGS, )

)

Defendants. )

ORDER AND RECOMMENDATION OF

UNITED STATES MAGISTRATE JUDGE

This case atises from Defendants Laboratory Corporation of America’s and Laboratory

Corporation of America Holdings’ (hereinafter “Defendants”) use of “Meta Pixel” and

“Google Analytics” on the Labcorp website. Plaintiffs Connie Howard, Yadira Yazmin

Hernandez, and Deborah Reynolds (hereinafter “Plaintiffs”) bring this proposed class action

against Defendants alleging violations of the California Information Privacy Act and the

Pennsylvania Wiretapping and Electronic Surveillance Control Act. This matter is before the

Court on Defendants’ Motion to Dismiss Plaintiffs’ Amended Complaint [Doc. #78].

Defendants seek to dismiss Plaintiffs’ claims against them for lack of subject matter

jurisdiction pursuant to Federal Rule of Crvil Procedure 12(b)(1) and failure to state a claim

upon which relief may be granted pursuant to Federal Rule of Crvil Procedure 12(b)(6). For

the reasons set forth below, the Court recommends that Defendants’ Motion be denied.

I. FACTS, BACKGROUND, AND PROCEDURAL HISTORY

Plaintiffs Howard and Hernandez are residents of California who have had

Meta/Facebook and Google online accounts during all times relevant to Defendants’ conduct

in this case. (Am. Compl. [Doc. #67] {| 7-8, 83, 85, 89, 91.) Plaintiff Reynolds is a resident

of Pennsylvania who likewise has had Meta/Facebook and Google accounts during all relevant

times. (Am. Compl. {ff 9, 95, 97.) Defendants maintain a website that “permits individuals to

access their medical testing results, book medical testing appointments, request medical testing

supplies, and pay for Labcorp services they have tecetved.” (Am. Compl. 54.) The Labcorp

website also allows usets to use its “search bar to look for medical information, including

information concerning specific medical tests.” (Am. Compl. 4 55.) As alleged in the

Complaint, all three Plaintiffs used the Labcorp website to conduct text searches for sensitive

medical issues at some point between approximately May 2021 and February 2023. (Am.

Compl. J] 83-84, 89-90, 95-96.) ‘The Complaint alleges that during the time that Plaintiffs

conducted these searches, Defendants had deployed the Meta Pixel, Google Analytics, and

other third-party tracking tools on their website. (Am. Compl. {[] 2, 27, 47-48, 56, 58, 75.)!

The Complaint alleges that, when deployed on a website, the Meta Pixel and Google

Analytics tracking tools act as business tools that allow Meta and Google, respectively, to use

customers’ identity, data, metadata, and search history to better target ads to them and similar

' While the exact date that Defendants placed these tracking tools on their website is unclear from the Amended

Complaint, Plaintiffs allege that, at a minimum, these tracking tools were deployed during the time period that

Plaintiffs interacted with Defendants’ website. (Am. Compl. {ff 2, 54-56.)

individuals based on the information obtained about them. (Am. Compl. {[f] 2-3, 13, 22-25,

28-34, 38-39, 42-45, 49-53, 59-74.) “In all websites where the Pixel operates, when a user

exchanges information with the host of that site—such as through a search query—Meta’s

softwate script surreptitiously directs the uset’s browser to send a separate message to Meta’s

setvets” containing the content that was sent to the host site along with personal identifiers

allowing Meta to link the information to a particular Facebook account and then use that

information for advertising and other purposes, including sale to other third parties. (Am.

Compl. Jf 28, 29, 32-37.) “Like the Meta Pixel, when a user exchanges information with the

host of a website—such as through a seatch quety—Google Source Code operates to

sutteptitiously direct[] the user’s browser to send a separate message to Google’s servers”

containing the content that was sent to the host site along with personal identifiers allowing

Google to link the information to a specific Google account and then use that information for

advettising and other purposes. (Am. Compl. {fj 45, 49-53.)

As a tesult of Defendants’ deploying these tracking tools on their website, each time

Plaintiffs searched the Labcorp website for their “sensitive medical issues,” Defendants

petmitted Meta and Google to receive the content of the searches as well. (Am. Compl. □□□

83-84, 86-87, 89-90, 92-93, 95-96, 98-99.) A fair reading of these allegations at the Motion to

Dismiss stage is that the transmission of search queries by the tracking tools is not selective

but rather automatic and occurred during each search conducted by Plaintiffs while the

tracking tools were deployed on the Labcorp website. ‘These tracking tools would explicitly

link and identify the users’ Facebook ID or Google ID with their search terms, and examples

of these searches are ones performed for “cancer colorectal patient,” “billing,” “colon cancer,”

and “pregnancy.” (Am. Compl. Jj 60, 64, 66, 74.)

Plaintiffs allege that, in part because of how the tracking tools ate embedded, they were

not awate that the tracking tools were present on the Labcorp website and therefore did not

consent to the collection or automatic forwarding of any of their information or search queries

to Meta or Google. (Am. Compl. 3, 25, 41, 76-77, 88, 94, 100.)

Plaintiffs originally brought a Complaint against Defendants and Meta Platforms, Inc.,

in the Northern District of California. Plaintiffs then consented to Meta’s motion to sever,

and the claims against it were joined to a related consolidated action in that same District, In

re Meta Pixel Healthcare Litigation, No. 3:22-cv-03580-WHO (N.D. Cal. June 17, 2022) [Doc.

#33, #52]. Because Meta was no longer a Party to the action, Plaintiffs and Defendants filed

a joint stipulation to transfer the matter to this District, where Defendants are based [Doc.

#54]. When the matter was transferred to this District, Defendants had a pending motion to

dismiss [Doc. #53]. After the transfer, Plaintiffs filed an Amended Complaint against

Defendants [Doc. #67], thereby rendering Defendants’ prior motion to dismiss moot.

Plaintiffs’ Amended Complaint brings two claims based on the above-alleged conduct:

(1) a violation of the California Invasion of Privacy Act, Cal. Penal Code §{ 630-638; and (2)

a violation of the Pennsylvania Wiretapping and Electronic Surveillance Control Act, 18 Pa.

Cons. Stat. § 5701, e¢ seg. Defendants have now moved to dismiss Plaintiffs’ Amended Class

Action Complaint for lack of standing and failure to state a claim.

II. STANDARDS OF REVIEW

A. Rule 12(b)(1)

Federal courts ate courts of limited jurisdiction. Exxon Mobil Corp. v. Allapattah

Servs. Inc., 545 U.S. 546, 552 (2005). Under Federal Rule of Civil Procedure 12(b)(1), a patty

may seek dismissal based on the court’s “lack of subject-matter jurisdiction.” Subject matter

jutisdiction is a threshold question that raises the issue of “whether [the plaintiff] has a right

to be in the district court at all and whether the court has the power to hear and dispose of

[the] claim.” Holloway v. Pagan River Dockside Seafood, Inc., 669 F.3d 448, 452 (4th Cir.

2012); see also Constantine v. Rectors & Visitors of George Mason Univ., 411 F.3d 474, 479-

80 (4th Cir. 2005).

A patty invoking a federal court’s jurisdiction must demonstrate standing. ‘To

ovetcome the standing threshold, and thereby survive a 12(b)(1) motion to dismiss, a plaintiff

must demonsttate “a personal stake in the outcome of the controversy” that is sufficient to

warrant the “invocation of federal court jurisdiction.” Summers v. Earth Island Inst., 555 U.S.

488, 493 (2009). “To establish standing at the motion to dismiss stage a plaintiff must plausibly

allege that: (1) it has suffered an injury in fact that is (a) concrete and particularized and (b)

actual or imminent, not conjectural or hypothetical; (2) the injury is fairly traceable to the

challenged action of the defendant; and (3) it is likely, as opposed to merely speculative, that

the injuty will be redressed by a favorable decision.” Liberty Univ., Inc. v. Lew, 733 F.3d 72,

89 (4th Cir. 2013) (internal quotation omitted). Further, the plaintiff must establish standing

for each claim and each form of telief she seeks. TransUnion LLC v. Ramirez, 594 U.S. 413,

431 (2021).

Parties bring what is called a facial challenge under Rule 12(b)(1) when they assert, as

Defendants do hete, that a complaint alleges facts that, even if taken as true, do not establish

subject matter jurisdiction. See Kerns v. United States, 585 F.3d 187, 192 (4th Cir. 2009); Doe

v. United States, 381 F. Supp. 3d 573, 590 (M.D.N.C. 2019). In reviewing a facial challenge

under Rule 12(b)(1), a district court should afford plaintiffs the same procedural protection as

they would receive under Rule 12(b)(6) consideration. Kerns, 585 F.3d at 192-93; see also

Willner v. Dimon, 849 F.3d 93, 99 (4th Cir. 2017); Wikimedia Found. v. Nat'l Sec. Agency,

857 F.3d 193, 208 (4th Cir. 2017) (“A defendant may challenge standing at the motion-to-

dismiss stage in one of two ways: facially or factually. In a facial challenge, the defendant

contends that the complaint fails to allege facts upon which standing can be based, and the

plaintiff is afforded the same procedural protection that exists on a motion to dismiss.”

(internal quotations, citations, and brackets omitted)). This means both that “the facts alleged

in the complaint are taken as true, and the motion must be denied if the complaint alleges

sufficient facts to invoke subject matter jurisdiction,” Kerns, 585 F.3d at 192-93, and that the

district court should “construe all reasonable inferences in the manner most favorable to the

plaintiff,’ Dodge v. VT Inc., No. Civ.1:02CV00706, 2003 WL 203167, at *2 (M.D.N.C. Jan.

27, 2003) (citing Robinson v. Overseas Mil. Sales Corp., 21 F.3d 502, 507 (2d Cir. 1994));

Kirkcaldy v. Richmond Cnty. Bd. of Educ., 212 F.R.D. 289, 294 (M.D.N.C. 2002) (same);

accotd Ctr. for Env’t Health v. Regan, No. 7:22-CV-00073-M, 2023 WL 3192322, at *7

(E.D.N.C. Mar. 30, 2023) (court should draw all reasonable inference in the plaintiffs favor

in a facial 12(b)(1) challenge).

B. Rule 12(b)(6)

Defendants also move to dismiss pursuant to Federal Rule of Civil Procedure 12(b)(6),

contending that Plaintiffs have failed to state a claim upon which relief can be granted. “To

sutvive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as

true, to ‘state a claim to relief that is plausible on its face.”’ Ashcroft v. Iqbal, 556 U.S. 662,

678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). This standard

does not require “detailed factual allegations,” but it demands more than “an unadorned, the-

defendant-unlawfully-harmed-me accusation.” Id. A claim is facially plausible when the

plaintiff provides enough factual content to enable the court to reasonably infer that the

defendant is liable for the misconduct alleged. Id. “The plausibility standard is not akin to a

‘probability requitement,’ but it asks for more than a sheer possibility that a defendant has

acted unlawfully.” Id. In this way, Rule 12(b)(6) protects against meritless litigation by

requiring sufficient factual allegations “to raise a tight to relief above the speculative level” so

as to “nudge|] the[] claims across the line from concetvable to plausible.” ‘Twombly, 500 U.S.

at 555, 570; see Iqbal, 556 U.S. at 680. The Court “must accept all well-pleaded allegations in

the complaint as true and draw all reasonable inferences in the plaintiffs favor.” Langford v.

Joyner, 62 F.4th 122, 124 (4th Cir. 2023). However, the Court is not bound to accept legal

conclusions. Iqbal, 556 U.S. at 678. Thus, “when there ate well-pleaded factual allegations, a

coutt should assume their veracity and then determine whether they plausibly give tise to an

entitlement to relief.” Id. at 679.

II. DISCUSSION

A. Defendants’ 12(b)(1) Arguments

Because “standing is a threshold jurisdictional question” courts should address it first

before moving on to the merits. See Garey v. James S. Fartin, P.C., 35 F.4th 917, 921 (4th

Cir. 2022) (internal brackets and quotation omitted).

Here, Defendants argue that Plaintiffs fail to allege a sufficient injury in fact to

demonstrate standing and that neither of the two statutes under which Plaintiffs bring suit—

information privacy and wiretapping laws from California and Pennsylvania—can alone grant

standing.

The California Information Privacy Act (hereinafter “CIPA”) punishes by fine or

imprisonment the following conduct:

Any person [1] who, by means of any machine, instrument, or contrivance, or

in any other manner, intentionally taps, or makes any unauthorized connection,

whether physically, electrically, acoustically, inductively, or otherwise, with any

telegraph or telephone wite, line, cable, or instrument, including the wire, line,

cable, or instrument of any internal telephonic communication system, or

[2] who willfully and without the consent of all parties to the communication,

ot in any unauthorized manner, reads, or attempts to read, or to learn the

contents ot meaning of any message, report, of communication while the same

is in transit or passing over any wire, line, or cable, or is being sent from, or

received at any place within this state; or [3] who uses, or attempts to use, in any

manner, ot for any purpose, or to communicate in any way, any information so

obtained, or [4] who aids, agrees with, employs, or conspites with any person

ot petsons to unlawfully do, or permit, or cause to be done any of the acts or

things mentioned above in this section... .

Cal. Penal Code § 631(a). Courts analyzing this statute have broken it down into its four

constituent clauses, as indicated by the bracketed numbers above. See, e,g., Garcia □□□

Build.com, Inc., No. 22-cv-01985-DMS-KSC, 2023 WL 4535531, at *4-5 (S.D. Cal. July 13,

2023). As is relevant here, the second clause applies to anyone “who willfully and without the

consent of all parties to the communication, of in any unauthorized manner, reads, or attempts

to read, or to leatn the contents or meaning of any message, report, or communication while

the same is in transit or passing over any wite, line, or cable, or is being sent from, or recetved

at any place within this state.” The fourth clause imposes liability on a defendant who, even

if a patty to the communication at issue, “aids, agrees with, employs, or conspires with any

person of persons to unlawfully do, or permit, or cause to be done any of the acts or things

mentioned above in this section,” including aiding in a thitd party’s violation of the second

clause. Licea v. Cinmar, LLC, No. CV 22-6454-MWF JEM), 2023 WL 2415592, at *7 (C.D.

Cal. Mar. 7, 2023).

The Pennsylvania Wiretapping and Electronic Surveillance Control Act (hereinafter

‘WESCA”), similarly punishes anyone who, among other things, “intentionally intercepts,

endeavots to intercept, or procures any other person to intercept or endeavor to intercept any

wire, electronic or oral communication.” 18 Pa. Cons. Stat. § 5703(1). The statute defines

“fntercept” as the “acquisition of the contents of any wite, electronic or oral communication

through the use of any electronic, mechanical or other device.” Id. § 5702. “[T]here is no

sweeping ditect-patty exception to civil liability under the WESCA” and thus, where a plaintiff

communicates with a defendant and a third party intercepts that communication on the

defendant’s behalf, the defendant cannot avoid liability by showing that the plaintiff

intentionally communicated with the defendant. See Popa v. Harriet Carter Gifts, Inc., 52

F.4th 121, 126-29 3d Cir. 2022).

Both CIPA and WESCA provide private rights of action. Cal. Penal Code § 637.2(a)

(“Any petson who has been injured by a violation of this chapter may bring an action against

the person who committed the violation ... .”); 18 Pa. Cons. Stat. § 5725(a) (“Any person

whose wire, electronic or oral communication is intercepted, disclosed or used in violation of

WESCA] shall have a civil cause of action against any person who intercepts, discloses ot uses

ot ptocutes any other person to intercept, disclose or use, such communication ... .”).

Moteovet, neither CIPA nor WESCA is a mere procedural statute that dictates how a person

ot entity should handle an individual’s private information. Rather, each statute punishes a

violation of a pre-existing, de facto, and substantive tight to privacy in communications and

does not merely regulate how someone should attempt to safeguard that privacy. Cf.

TransUnion, 594 U.S. at 427-28 (“An uninjured plaintiff who sues [without suffering any

physical, monetary, or cognizable intangible harm] is, by definition, not seeking to remedy any

harm to herself but instead is merely seeking to ensure a defendant’s ‘compliance with

regulatory law’ (and, of course, to obtain some money via the statutory damages). ‘Those are

not grounds for Article III standing.” (internal citations omitted)).

By nature of the fact that Plaintiffs’ causes of action ate based on state statutes from

outside of this circuit, there ate few Fourth Circuit decisions analyzing them at all, let alone in

the standing context. A decision from a district court in the Fourth Circuit has noted a split

in authority over whether alleging a violation of CIPA alone satisfies the injury-in-fact

requirement for standing:

Even in the context of CIPA, which . . . is a state-law analogue to the Federal

Wiretap Act, there is far from a consensus regarding whether statutory

violations automatically give rise to concrete harm. Compare, e.g., Licea v. Am.

Eagle Outfitters, Inc., No. 22-cv-1702-MWF, 2023 WL 2469630, at *3 (C.D.

Cal. Mar. 7, 2023) (holding that a bate violation of CIPA is a cognizable

violation of privacy rights sufficient to establish standing), Licea v. Cinmar,

LLC, No. 22-cv-6454-MWF, 2023 WL 2415592, at *3 (C.D. Cal. Mar. 7, 2023)

(same), Gatcia_v. Build.com, Inc., No. 22-CV-01985-DMS-KSC, 2023 WL

10

4535531, at *4 (S.D. Cal. July 13, 2023) (same), with Byars v. Sterling Jewelers

Inc., No. 22-cv-1456-SB, 2023 WL 2996686, at *4 (C.D. Cal. Apr. 5, 2023)

(holding that CIPA violations do not constitute an injury in fact without an

additional showing of harm); Lightoller, 2023 WL 3963823, at *5 (S.D. Cal. June

12, 2023) (same), and Massie v. Gen. Motors LLC, No. CV 21-787-RGA, 2022

WL 534468, at *2, 5 (D. Del. Feb. 17, 2022) (same). Neither is there a consensus

that violations of the Federal Wiretap Act alone give rise to an injury in fact.

Compare In re Vizio, Inc. Consumer Privacy Litig., 238 F. Supp.3d 1204, 1215-

16 (C.D. Cal 2017) (finding concrete harm from Federal Wiretap Act violations

due to “the close similarity between the conduct proscribed under the [Federal]

Wiretap Act and the tort of intrusion upon seclusion”), with Lopez v. Apple,

Inc., 519 F. Supp.3d 672, 681 (N.D. Cal 2021) (finding that plaintiffs asserting

Federal Wiretap Act violations lacked standing because they did not allege non-

speculative, concrete injury beyond a statutory privacy harm).

Straubmuller v. Jetblue Airways Corp., No. DKC 23-384, 2023 WL 5671615, at *3 (D. Md.

Sept. 1, 2023) (internal footnote omitted). However, the United States Court of Appeals for

the Ninth Circuit in analyzing CIPA’s relationship to the common-law right to privacy has

held:

As to the statutory claims, the legislative history and statutory text demonstrate

that .. . the California legislature intended to protect these historical privacy

tights when they passed... CIPA. See... Cal. Pen. Code § 630 (noting that

CIPA was passed “to protect the right of privacy of the people of this state”).

Thus, these statutory provisions codify a substantive right to privacy, the

violation of which gives tise to a concrete injury sufficient to confer standing.

In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 598 (th Cir. 2020); accord Yockey

v. Salesforce, Inc., No. 22-cv-09067-JST, 2023 WL 5519323, at *3 (N.D. Cal. Aug. 25, 2023)

(“Statutes such as CIPA and WESCA thus codify a substantive tight to privacy, the violation

of which gives rise to a concrete injuty sufficient to confer standing.” (internal quotation

omitted)); see also Doe v. Microsoft Corp., No. C23-0718-JCC, 2023 WL 8780879, at *3 (W.D.

Wash. Dec. 19, 2023) (collection of non-anonymized data without consent gave tise to an

injury in fact for a CIPA claim); Cinmar, 2023 WL 2415592, at *3 (““However, violations of

11

plaintiffs’ statutory rights under CIPA, even without more, constitute injury in fact because

instead of a bate technical violation of a statute, a CIPA violation involves a violation of

ptivacy rights.” (internal brackets, ellipses, and quotation omitted)).

Violations of WESCA also generally provide a basis for standing because they

necessarily involve violations of a privacy interest. See James v. Walt Disney Co., No. 23-cv-

02500-EMC (EMC), 2023 WL 7392285, at *2-5 (N.D. Cal. Nov. 8, 2023) (standing established

in case based on CIPA and WESCA where plaintiffs alleged that their right to control

information concerning his or her person was violated); Mulder v. Wells Fargo Bank, N.A.,

No. 2:18-cv-00029, 2018 WL 3750627, at *4 (W.D. Pa. July 10, 2018) (plaintiff had standing

to bring claims for violation of his rights under WESCA by adequately pleading witetap claim),

report and recommendation adopted, No. 18-29, 2018 WL 3744821 (W.D. Pa. Aug. 7, 2018).

These analyses of standing under CIPA and WESCA comport with recent guidance

from the Fourth Circuit on standing for statutory violations.

Plaintiffs who do not have a legally cognizable injury lack standing to bring suit

in federal court. Congress may, of course, “elevate to the status of legally

cognizable injuries concrete, de facto injuries that were previously inadequate in

law.” Lujan v. Defs. of Wildlife, 504 U.S. 555, 578, 1128S. Ct. 2130, 119 L.Ed.2d

351 (1992). But as the Defendants correctly point out, plaintiffs cannot

establish a cognizable injury simply by pleading a statutory violation. See

Spokeo, Inc. v. Robins, 578 U.S. 330, 341, 136 S. Ct. 1540, 194 L.Ed.2d 635

(2016) (“Article IIT standing requires a concrete injury even in the context of a

statutory violation.”).

Balancing these two rules has in the past caused some confusion, but the

Supreme Coutt recently clarified when a statutory cause of action identifies an

injuty sufficient for standing purposes. In ‘TransUnion LLC v. Ramirez, the

Court explained that plaintiffs proceeding under a statutory cause of action can

establish a cognizable injury by “identifying a close historical or common-law

analogue for theit asserted injury” for which courts have “traditionally”

provided a remedy. —— U.S. ——, 141 S. Ct. 2190, 2204, 210 L.Ed.2d 568

(2021) (citing Spokeo, 578 U.S. at 341, 136 S. Ct. 1540). A plaintiff who does

12

so has standing even if the precise injury would not, absent the statute, be

sufficient for Article III standing purposes.

Garey, 35 F.4th at 921 (internal brackets and footnote omitted). As such, the Fourth Circuit

has recognized an injury in fact that is sufficient to establish standing where the alleged harms

atising from a statutory violation “are closely related to the invasion of privacy, which has long

provided a basis for recovery at common law.” Id. (internal quotation omitted); also

TransUnion, 594 U.S. at 425 (“Various intangible harms can also be concrete. Chief among

them ate injuries with a close relationship to harms traditionally recognized as providing a

basis for lawsuits in American courts. Those include, for example, reputational harms,

disclosure of private information, and intrusion upon seclusion.” (internal citation omitted));

Witt v. Corelogic Saferent, LLC, No. 3:15-cv-386, 2016 WL 4424955, at *13 (E.D. Va. Aug.

18, 2016) (“Similarly, it is well-settled that Congress may create a statutory right to privacy in

certain information that strengthens or replaces the common law, and citizens whose statutory

tight to informational privacy has been invaded may bring suit under the statute to vindicate

that right.”).

In conjunction with the statutory violations of CIPA and WESCA, Plaintiffs have

sufficiently alleged that these violations were premised upon and resulted in unconsented-to

invasions of their privacy and disclosure of their private information. (Am. Compl. {[] 2-3, 25,

41, 76-77, 83-84, 86-90, 92-96, 98-100.) ‘Taking the facts alleged in the Complaint as true, and

drawing all inferences in Plaintiffs’ favor, the Court reads the Complaint as alleging that the

three named Plaintiffs each conducted searches on the Labcorp website regarding their own

sensitive medical issues, and that as a result of Defendants’ deliberate choice to install certain

code on the Labcorp website, this sensitive medical information was then intercepted and

13

linked with their personal identifying information and transmitted to Meta and Google, where

it was linked to their Facebook ID/Google ID and then used or sold for commercial purposes,

all without Plaintiffs’ knowledge or consent. Given these allegations, and given that Plaintiffs

adequately allege violations of these privacy-protecting statutes, they have alleged a sufficiently

concrete injuty to bring federal suit.

In support of dismissal, Defendants argue, in essence, that invasion of privacy cannot

be a basis for standing in this case because Plaintiffs have not separately alleged the elements

of such a common-law tort. (Defs.’s Br. [Doc. #79] at 9-12.) The Fourth Circuit, with the

Supreme Court’s decision in TransUnion in mind, has rejected just such an argument.

[Floreshadowing ‘TransUnion, we recently rebuffed a nearly identical standing

challenge in a case arising under [a statutory cause of action that] provides a

private right of action against offenders. . . .

We acknowledged [in Krakauer v. Dish Network, L.L.C., 925 F.3d 643 (4th Cir.

2019)] that although [a statutory cause of action] provides claims that differ

from common law privacy torts, [Supreme Court precedent] does not require

us to import the elements of common law torts, piece by piece, into any scheme

Congress may devise. Rather, we concluded that our inquiry focuses on types

of hatms protected at common law, not the precise point at which those harms

become actionable. .. .

Applying the same analysis as Krakauer, we teach the same result. The Plaintiffs

have alleged a legally cognizable privacy injury. See, e.g., Garey Second Am.

Compl. {| 127 (Each Plaintiff sustained actual damages by having his or her

ptivacy invaded by Defendants’ knowingly obtaining his or her name and

address from a motor vehicle record for an impermissible purpose in violation

of law.”). The Defendants point out some differences between the common

law privacy torts and the [statutory cause of action], but our inquity does not

tequite an exact duplicate in American history and tradition. At bottom, the

[statute] is aimed squarely at the right of the plaintiff, in the phrase coined by

Judge Cooley, to be let alone. Therefore, the Plaintiffs have Article III standing

to pursue claims for damages.

Garey, 35 F.4th at 922 (internal brackets, citation, and quotation omitted).

14

Because CIPA and WESCA provide for liability for facilitating third-party invasion of

ptivacy, and because Plaintiffs have sufficiently alleged that they did not consent to their

private information being diverted by Defendants to third patties, Plaintiffs have adequately

alleged a conctete invasion-of-privacy harm arising from Defendants’ alleged violation of these

California and Pennsylvania statutes. For these reasons, Defendants’ motion to dismiss for

lack of standing should be denied.

B. Failure to State a Claim

i. Rule of lenity

Defendants contend that the Amended Complaint should be dismissed because, under

the rule of lenity, it is not clear that CIPA and WESCA should apply to their alleged conduct.

Where, as here, a coutt’s “analysis involves a statute whose provisions have both civil

and criminal application, [the] task merits special attention” because the court’s “interpretation

applies uniformly in both contexts.” WEC Carolina Energy Sols. LLC v. Miller, 687 F.3d 199,

204 (4th Cir. 2012) (citing Leocal v. Ashcroft, 543 U.S. 1, 11 n. 8 (2004)). In this situation, a

coutt should follow “the canon of strict construction of criminal statutes, or rule of lenity.”

Id. (quoting United States v. Lanier, 520 U.S. 259, 266 (1997)). “In other words, in the interest

of providing fair warning of what the law intends to do if a certain line is passed, [a court] will

construe this criminal statute strictly and avoid interpretations not clearly warranted by the

text.” Id. (internal quotations omitted). However, “the rule of lenity is a last resort, not a

ptimaty tool of construction and to invoke the rule, we must conclude that there is a grievous

ambiguity or uncertainty in the statute.” Hosh v. Lucero, 680 F.3d 375, 383 (4th Cir. 2012)

(internal brackets and quotations omitted).

15

As noted above, CIPA applies to anyone “who aids, agrees with, employs, ot conspires

with any person or persons to unlawfully do, or permit, or cause to be done” the act of

“willfully and without the consent of all parties to the communication, or in any unauthorized

mannet, readline], or attempt[ing] to read, or to learn the contents or meaning of any message,

report, ot communication while the same is in transit or passing over any wire, line, or cable.”

WESCA similarly applies to anyone who intentionally “procures any other person to intercept

ot endeavor to intercept any wire, electronic or oral communication.” While this language

may be broad, it is not as a result ambiguous. The statutes prohibit aiding anyone in reading

ot learning the contents or meaning of any wire or electronic message while in transit without

consent. Plaintiffs allege that Defendants aided Meta and Google in reading and learning the

contents and meaning of their electronic messages to Defendants, via interception of the

messages while in transit over the internet, without consent.

Defendants have pointed to no specific ambiguities, let alone grievous ones, in the

statutes at issue here and have not raised any specific doubts about the applicability of CIPA

ot WESCA to the conduct in this case. (Defs.’s Br. at 13-14.) Rather, Defendants merely

allege that “Plaintiffs have not shown that either statute ‘plainly’ imposes penalties for

[Defendants’] alleged conduct.” (Defs.’s Br. at 14.) Without a more specific argument from

Defendants with legal support, the Court declines to proactively search for an ambiguity in

the statutes.

At this stage, the statutes appear to apply, at least facially, to the conduct alleged, when

the allegations in the Amended Complaint are accepted as true. In any event, as Plaintiffs

point out (Pls.’s Br. [Doc. #85] at 23), federal courts have routinely applied CIPA and WESCA

16

to similar scenarios or, at a minimum, have engaged with the statutes under the assumption

that they applied to private parties in civil suits. See, e.g., In re Facebook, 956 F.3d at 598-99,

601, 606-08; Doe v. Microsoft Corp., 2023 WL 8780879, at *7-9; Vonbergen v. Liberty Mutual

Ins. Co., No. 22-4880, 2023 WL 8569004, at *9-10 (E.D. Pa. Dec. 11, 2023); James, 2023 WL

7392285, at *14; Doe v. DLP Conemaugh Mem’! Med. Ctr., LLC, No. 3:23-CV-110, 2023 WL

5993016, at *1, *3-4 (W.D. Pa. Sept. 15, 2023); Oliver v. Noom, No. 2:22-cv-1857, 2023 WL

8600576, at *6 (W.D. Pa. Aug. 22, 2023); Popa, 52 F.4th at 131; Ades v. Omni Hotels Mgmt.

Corp., 46 F. Supp. 3d 999, 1018 (C.D. Cal. 2014). Thus, for purposes of a Motion to Dismiss,

Plaintiffs’ similar allegations fall, at least facially, within the reasonable scope of the statutes

and there is therefore no teason to find that the rule of lenity categorically bars such private

causes of action.

For these reasons, and “[b]ecause there are no doubts to resolve at this stage, the Court

declines to review [Defendants’] additional argument regarding the rule of lenity,” without

prejudice to Defendants’ raising this issue again at a later stage. See Branca v. Ocwen Loan

Servicing, LLC, No. CV 13-7502 BRO (Ex), 2013 WL 12120261, at *12 (C.D. Cal. Dec. 27,

2013) (CIPA case); see also James, 2023 WL 7392285, at *14 (“Assuming the rule of lenity

applies to this civil action [raising CIPA and WESCA clatms] because the predicate statute

imposes criminal liability, this argument is not particularly compelling [because] WESCA uses

broad language and engaging in a ‘hyper-technical reading of the statute’ is inconsistent with

what is presumably the purpose of the statute, z2¢, to ‘prohibit unauthorized artificial

interception of communication in an era of changing technologies.” (quoting United States v.

Hutchins, No. 17-CR-124, 2018 WL 5313772, at *12-37 (E.D. Wisc. Oct. 26, 2018))).

17

it. Contents of communications

Defendants next argue that dismissal is appropriate because Plaintiffs have not

adequately alleged that the contents of their communications were intercepted. (Defs.’s Br. at

14-16.) In support of this argument, Defendants cite legal authority for the proposition that

“webpage titles, webpage keywords, the date and times of website visits, IP addresses, page

visits, putchase intent signals, and add-to-cart actions” do not amount to the contents of any

communication. (Defs.’s Br. at 14 (quoting Katz-Lacabe v. Oracle Am., Inc., No. 22-cv-

04792-RS, 2023 WL 2838118, at *9 n.9 (N.D. Cal. Apr. 6, 2023)).) Importantly however,

Defendants do not allege that the content of search queries do not constitute communications.

Rather, Defendants argue that Plaintiffs have failed to adequately allege that the contents of

these searches were in fact intercepted. (Defs.’s Br. at 15-16; Defs.’s Reply Br. [Doc. #91] at

5-7.) However, whether Plaintiffs are ultimately able to prove that the contents of their search-

based communications were sent to third parties without their consent, they have adequately

alleged so.

Unlike the situation Defendants point to in Cousin v. Sharp Healthcare, No. 22-CV-

2040-MMA (DDL), 2023 WL 4484441, at *3 (S.D. Cal. July 12, 2023), Plaintiffs here allege

that they accessed the Labcorp website at the time that the tracking tools were deployed and

entered seatch terms regarding their sensitive medical issues—some of which are given as

examples—that the tracking tools then surreptitiously rerouted to Meta and Google with

Plaintiffs’ personal identifiers. Because the Amended Complaint, fairly read in Plaintiffs’

favor, alleges that these transmissions were automatic and not selective during the relevant

times described, the allegation that Plaintiffs entered search terms necessarily means that the

18

content of these seatch queties were sent to Meta and Google. Thus, the Amended Complaint

reasonably alleges that Plaintiffs entered search terms on the website and that all searches

telated to their “sensitive medical issues” wete rerouted to Meta and Google with their

personal identifiers as a result. (Am. Compl. {J 83-84, 86-87, 89-90, 92-93, 95-96, 98-99.)

Any further issues regarding the nature of the sensitive medical issues and the specific

seatch terms, the full nature of how these searches were conducted, and what role Defendants

played in receiving or responding to them will be developed more fully during discovery, after

which this issue can be better addressed. See Doe v. Meta Platforms, Inc., No. 22-CV-03580-

WHO, 2023 WL 5837443, at *3 (N.D. Cal. Sept. 7, 2023) (“[W]hile a URL that includes ‘basic

identification and address information’ is not ‘content,’ a URL disclosing a ‘search term or

similar communication made by the uset’ ‘could constitute a communication’ under [a

wiretapping] statute.” (quoting In re Zynga Priv. Litig., 750 F.3d 1098, 1108-09 (9th Car.

2014))).

itl. Defendants’ intent

Defendants next argue that the Amended Complaint does not adequately allege that

they intended that Meta and Google would be able to intercept the contents of any

communications with the Labcorp website. (Defs.’s Br. at 16-18.) Defendants appear to argue

that an allegation that they “implemented” Meta’s and Google’s respective computer code in

a way that then “permitted” these third parties “to intercept and use” Plaintiffs’ search terms

is insufficient to show that Defendants “intended to facilitate the transmission of the contents

of Plaintiffs’ communications.” (Defs.’s Br. at 17.) While it may be true that a company does

not intend a third party’s wrongs when the third party merely exploits the company’s system

19

to allow the third party’s subsequent unrelated wrongs, that is not what is alleged in this case.

As alleged in the Complaint, Defendants did not simply place computer code on its website

which then gave rise to the possibility that Meta and Google could ultimately access

information from that website. As alleged in the Amended Complaint, Defendants

deliberately placed proprietary Meta and Google code on its website which by design

automatically redirected all relevant information at issue in this case to those third parties.

(Am. Compl. {ff 2-3, 13, 22-25, 27-34, 38-39, 42-45, 47-53, 56, 58-75.) Moreover, the

Complaint alleges that in both instances, Defendants intentionally placed the code on its

website and modified it to target even more information than the default parameters

programmed by Meta and Google, thus showing that the tracking tools’ appearance on the

website was a result of Defendants’ active choice to place them there and not as a potentially

inadvertent mistake while being unaware of what the code did. (Am. Compl. {[f 27, 46.) Under

these citcumstances, and taking all allegations as true and making all reasonable inferences in

Plaintiffs’ favor, the Amended Complaint has plausibly alleged that Defendants intended for

the tracking tools to function as they were designed and to relay any search terms, with

identifiers, to Meta and Google.

iv. Plaintiffs’ purported consent

Defendants’ next argument for dismissal is based on information outside of the

Amended Complaint which purportedly shows that Plaintiffs consented to the dissemination

of theit search queries to Meta and Google. (Defs.’s Br. at 18-22.) In particular, Defendants

allege that “Labcorp informs Website visitors, such as Plaintiffs, that it uses Google Analytics

and other analytics technologies. What is more, both Google and Meta expressly disclose how

20

these technologies operate and require Plaintiffs’ and other account holders’ consent to these

ptactices.” (Defs.’ Br. at 18.) In support of this argument, Defendants invite the Court to

teview Labcorp’s, Meta’s, and Google’s privacy policies (Defs.’ Br. at 19-22), and have filed a

sepatate motion asking the Court to consider these policies as integral to the Amended

Complaint or to otherwise take judicial notice of them (Defs.’s Mot. for Judicial Notice [Doc.

#75)).

Additionally, Defendants argue that at least Meta’s privacy and cookies policies are

integral to the Amended Complaint because Plaintiffs cited to them in footnotes. (Defs.’s

Mot. for Judicial Notice Br. [Doc. #76] at 4 (citing Am. Compl. 29, 33).)

Even if the Court wete to assume that these policies were integrally related to the

Amended Complaint and even if they were all dated within the relevant time period of this

case—which they ate not—consideration of them on a motion to dismiss for the purpose

Defendants propose would still be inappropriate.? Considering these privacy policies—which

as presented merely show a snapshot in time of what the policies were on certain dates—

would resolve neither what, if any, privacy policies were in place at the time Plaintiffs visited

Defendants’ websites nor, crucially, how or if Plaintiffs even saw or interacted with them, let

alone affirmatively consented to their conditions. To the extent Plaintiffs necessarily had to

2 Defendants have included and rely on seven documents which ate vatiously dated between January 5, 2022,

and July 1, 2023:

Meta’s privacy policy, dated January 1, 2023 [Doc. #77-1];

Meta’s cookies policy, dated October 5, 2022 [Doc. #77-2];

Google’s privacy policy, dated July 1, 2023 [Doc. #77-3];

Google’s tech policy, undated [Doc. #77-4];

Labcotp’s website privacy policy, dated April 7, 2023 [Doc. #77-5];

Meta’s terms of setvice, dated July 26, 2022 [Doc. #77-6]; and

Google’s terms of service, dated January 5, 2022 [Doc. #77-7].

21

have accepted these policies as a prerequisite to using any given website, any facts supporting

this conclusion ate entitely outside of the Amended Complaint and ate not properly

considered on the pending Motion to Dismiss. Moreover, Labcorp’s privacy policy is not

referenced in the Amended Complaint at all and thus there would be no basis for the Court

to consider it here.

The Court has no doubt that the content of these policies and the nature in which they

were, of were not, presented to and accepted by Plaintiffs will be crucial to this case going

forwatd. However, discovery and future motions practice will be necessary to fully develop

the record in order to consider and resolve any disputes about Plaintiffs’ potential consent in

this case. Therefore, the Court should deny Defendants’ Motion for Judicial Notice [Doc.

#75] and not consider these privacy policies, without prejudice to Defendants’ later raising the

issue of consent, on a motion for summary judgment.

In the absence of these policies, the Amended Complaint as written reasonably and

affirmatively alleges that Plaintiffs did not consent to the conduct complained of here. (Am.

Compl. §§ 3, 25, 41, 76-77, 88, 94, 100.) Because these facts must be accepted as true,

Defendants’ Motion to Dismiss on the basis of consent should be dented.

v. Computer code as a device

Finally, Defendants move to dismiss the WESCA claim on the basis that the tracking

tools in dispute in this case do not constitute “devices” because they are “intangible software

code” and not a “physical object” as required by the statute. (Defs.’s Br. at 22-24.)° In support

of this position Defendants cite state- and federal-court decisions from Florida for the

3 These arguments are raised only as to the WESCA claim, not the CIPA claim.

22

ptoposition that computer code is not a device. (Defs.’s Br. at 23-24.) However, federal courts

from Pennsylvania, analyzing the Pennsylvania statute, have assumed, at least at the pleading

stage, that computer code interacting with a server may constitute a device, and have thus

permitted discovery to further develop the issue.

The use of the word “any” before the phrase “device or appatatus” in Section

5702 implies that the class of technology contemplated by WESCA ts broad. . . .

While the statutory definitions of “device” and “electronic communication” are

broad, they are not limitless. They may or may not include the type of electronic

data collection complained of by Popa. To prevail on a claim under WESCA,

it is Popa’s burden to prove that the allegedly actionable conduct falls under the

purview of the statute. The nature of the conduct involved makes it less than

clear at this stage. Indeed, whether the interplay between Defendants’ servers

and Navistone’s code qualifies as a “device” or “appatatus” is a fact intensive

inquity that implicates novel questions. The discovety process will give the

patties an opportunity to develop a record that contextualizes the conduct at

issue in light of this statutory language.

Popa v. Harriet Carter Gifts, Inc., 426 F. Supp. 3d 108, 117, 123 (W.D. Pa. 2019) (denying

motion to dismiss WESCA claim), case subsequently vacated on appeal on separate grounds,

Popa, 52 F.4th at 131 n.8 (assuming that code directing communications to a server is a

“device” under WESCA); see also Vonbergen, 2023 WL 8569004, at *9-10 (finding, at motion

to dismiss stage, that plaintiff had sufficiently alleged that tracking software was a “device”

under WESCA); Noom, 2023 WL 8600576, at *6 (finding, at motion to dismiss stage, that

plaintiffs had sufficiently alleged that computer code which directed information to a server

was a “device” under WESCA).

The Amended Complaint alleges that the tracking tools at issue in this case function as

computer codes that send information, including the contents of search queries and personal

23

identifiers, to servers. (Am. Compl. {[f] 28, 45.) With the case law from the Third Circuit

interpreting the Pennsylvania WESCA law in mind, the Court finds that Plaintiffs have

sufficiently alleged that a device was used to intercept their communications here. As in Popa,

whether Plaintiffs will be able to prove that these interactions between code and server

occutted in a way to constitute a device will be discovery-dependent, but Plaintiffs’ allegations

ate sufficient to survive a motion to dismiss.

IV. INTIAL PRETRIAL CONFERENCE

Plaintiffs have also filed a Motion [Doc. #97] requesting that the case be set for Initial

Pretrial Conference. In light of this Recommendation, that request will be granted and the

case will be set for Initial Pretrial Conference on Thursday, September 26, 2024 in Winston-

Salem. The Parties’ Rule 26(f) Report(s) should include a schedule for briefing the request for

class certification and a proposal for how that will fit into the discovery schedule.

V. CONCLUSION

IT IS THEREFORE RECOMMENDED that Defendants’ Motion to Dismiss [Doc.

#78] be denied, and that Defendants’ Motion for Judicial Notice [Doc. #75] be denied.

IT IS ORDERED that Plaintiff's Motion for Initial Pretrial Conference [Doc. #97] is

GRANTED, and this case is set for Initial Pretrial Conference on Thursday, September 26,

2024, at 9:30 a.m. at the Federal Courthouse in Winston-Salem, North Carolina.

This, the 8 day of August, 2024.

ods?

United States Magistrate Judge

24