holding that 16 “contents” under CIPA does not include customer record information such as name or address
How later courts described this case
- holding that 16 “contents” under CIPA does not include customer record information such as name or address
Written by the judges who cited it.
The opinion
1
2
3
4
5
6
7
8 UNITED STATES DISTRICT COURT
9 FOR THE EASTERN DISTRICT OF CALIFORNIA
10
11 CHRISTINA KING, No. 2:24-cv-01119-DC-CKD
12 Plaintiff,
13 v. ORDER GRANTING DEFENDANT’S
MOTION TO DISMISS PLAINTIFF’S FIRST
14 HARD ROCK CAFE INTERNATIONAL AMENDED COMPLAINT
(USA), INC.,
15 (Doc. No. 18)
Defendant.
16
17 This matter is before the court on Defendant’s motion to dismiss Plaintiff’s first amended
18 class action complaint. (Doc. No. 18.) Pursuant to Local Rule 230(g), the pending motion was
19 taken under submission to be decided on the papers. (Doc. No. 26.) For the reasons explained
20 below, the court will grant Defendant’s motion to dismiss.
21 BACKGROUND
22 On March 4, 2024, Plaintiff Christina King filed a complaint initiating this class action
23 against Defendant Hard Rock Cafe International (USA), Inc. for allegedly aiding Meta Platforms,
24 Inc. (“Meta”), formerly known as Facebook,1 in intercepting her sensitive and confidential
25 communications via a hidden tracking tool known as Meta Pixel (“Pixel”), that was installed on
26
27 1 Plaintiffs refer to Meta as both “Meta” and “Facebook” throughout their complaint. For clarity
in this order, the court uses “Meta” to refer to the corporation and “Facebook” to refer only to
28 Meta’s social media platform.
1 Defendant’s website at hardrockhotel[destination].com (“Website”). (Doc. No. 1-3 at 3.)
2 Defendant filed a motion to dismiss that original complaint, which the court denied as moot
3 because Plaintiff timely filed a first amended complaint as a matter of course pursuant to Federal
4 Rule of Civil Procedure 15(a)(1). (Doc. Nos. 10, 15.)
5 That is, on May 20, 2024, Plaintiff filed the operative first amended class action complaint
6 (“FAC”), bringing two claims against Defendant: (1) violation of the California Invasion of
7 Privacy Act (“CIPA”), California Penal Code § 631(a); and (2) violation of CIPA, California
8 Penal Code § 632. (Doc. No. 14 at 30–35.) Plaintiff brings these claims on behalf of herself and a
9 putative class consisting of “all California residents who have a Facebook account and accessed
10 and navigated the Website while in California.” (Id. at 28.)
11 Plaintiff alleges the following facts in her FAC.
12 Defendant is a Florida corporation that operates several hotels throughout the state of
13 California. (Id. at ¶ 4.) Defendant embedded Pixel, a “piece of code” that “tracks [] people and the
14 types of actions they take,” on its Website. (Id. ¶¶ 30, 42.) Pixel is one of many business tools
15 developed by Meta to “help website owners and publishers . . . integrate with Meta, understand
16 and measure their products and services, and better reach and serve people who might be
17 interested in their products and services.” (Id. at ¶ 27.) Pixel functions by tracking events on the
18 Website, such as when a user visits a webpage or clicks on a button to browse offerings. (Id. at ¶¶
19 29–32). When an event occurs, Pixel causes the Website user’s browser “to secretly and
20 simultaneously duplicate the communication with Defendant[], transmitting it to [Meta’s] servers
21 alongside additional information that transcribe the communication’s content and the individual’s
22 identity.” (Id. at ¶ 31.)
23 The data intercepted by Meta via Pixel consists of “‘guest records’ identifying Website
24 users as [Defendant’s] guests, boarders, occupants, lodgers, customers, or invitees (i.e., name,
25 address, telephone number, credit card number, email address, ZIP code, and user-specific values
26 contained in [Meta] cookies).” (Id. at ¶ 44.) Meta also intercepts “Website users’ button clicks
27 selecting the destination to which they wish to travel, the desired dates for their trip, the number
28 of rooms they require, the numbers of adults and children who will be traveling, and the particular
1 hotel section or tower in which they wish to stay.” (Id. at ¶ 116.) In addition, Meta “intercepts the
2 URL of webpages visited by Website users,” allowing Meta “to track Website users’ actions or
3 conversions funneling them from one portion of the Website to another.” (Id.) The information
4 intercepted by Meta is not anonymized because Meta “collects users’ email addresses” and
5 “Defendant enables [Meta] to link users’ communications with [the Website to] their Facebook
6 IDs, which reveal their identities.” (Id. at ¶ 72.)
7 Plaintiff is a resident of Sacramento, California. (Id. at ¶ 3.) In or around 2010, Plaintiff
8 created a Facebook account. (Id.) Plaintiff visited Defendant’s Website “[s]everal times,
9 including on or around March 29, 2023 and June 6, 2023,” using the same web browser she used
10 to access her Facebook account. (Id.) On the Website, Plaintiff “browsed and booked a Hard
11 Rock hotel.” (Id.) Plaintiff alleges each of her communications, including confidential “guest
12 records,” was intercepted by Meta, enabled by Defendant. (Id.) Plaintiff did not consent to Meta’s
13 interception of her communications with Defendant’s Website. (Id.)
14 On July 3, 2024, Defendant filed the pending motion to dismiss Plaintiff’s claims pursuant
15 to Federal Rule of Civil Procedure 12(b)(6) for failure to state a claim upon which relief can be
16 granted. (Doc. No. 18.) On August 5, 2024, Plaintiff filed an opposition to the pending motion.
17 (Doc. No. 23.) On August 19, 2024, Defendant filed its reply thereto. (Doc. No. 24.) On October
18 10, 2024, Plaintiff filed a notice of supplemental authority in support of her opposition to
19 Defendant’s motion to dismiss. (Doc. No. 27.)
20 LEGAL STANDARD
21 A motion to dismiss pursuant to Federal Rule of Civil Procedure 12(b)(6) is a challenge to
22 the sufficiency of the allegations set forth in the complaint. Navarro v. Block, 250 F.3d 729, 732
23 (9th Cir. 2001). “Dismissal under Rule 12(b)(6) is proper when the complaint either (1) lacks a
24 cognizable legal theory or (2) fails to allege sufficient facts to support a cognizable legal theory.”
25 Somers v. Apple, Inc., 729 F.3d 953, 959 (9th Cir. 2013). In determining whether a complaint
26 states a claim upon which relief can be granted, the court accepts as true the allegations in the
27 complaint and construes the allegations in the light most favorable to the plaintiff. Manzarek v. St.
28 Paul Fire & Marine Ins. Co., 519 F.3d 1025, 1031 (9th Cir. 2008). However, the court is not
1 required to accept as true “allegations that are merely conclusory, unwarranted deductions of fact,
2 or unreasonable inferences.” In re Gilead Scis. Sec. Litig., 536 F.3d 1049, 1055 (9th Cir. 2008).
3 Under Federal Rule of Civil Procedure Rule 8(a), a complaint must include “a short and
4 plain statement of the claim showing that the pleader is entitled to relief,” in order to “give the
5 defendant fair notice of what the . . . claim is and the grounds upon which it rests.” Bell Atl. Corp.
6 v. Twombly, 550 U.S. 544, 570 (2007). A complaint must allege enough facts to state a claim to
7 relief that is plausible on its face. Id. at 570. “A claim has facial plausibility when the plaintiff
8 pleads factual content that allows the court to draw the reasonable inference that the defendant is
9 liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). “The plausibility
10 standard is not akin to a ‘probability requirement,’ but it asks for more than a sheer possibility
11 that a defendant has acted unlawfully.” Id. (quoting Twombly, 550 U.S. at 556). If a claim is
12 dismissed for failure to comply with these requirements, “[l]eave to amend should be granted
13 unless the district court ‘determines that the pleading could not possibly be cured by the
14 allegation of other facts.’” Knappenberger v. City of Phoenix, 566 F.3d 936, 942 (9th Cir. 2009)
15 (quoting Lopez v. Smith, 203 F.3d 1122, 1127 (9th Cir. 2000)).
16 ANALYSIS
17 Defendant contends that Plaintiff’s complaint should be dismissed in its entirety because
18 Plaintiff fails to state a claim under Section 631(a) and Section 632 of CIPA.2 (Doc. No. 18.) The
19 court addresses each argument in turn.
20 A. California Invasion of Privacy Act: Section 631(a)
21 The CIPA “broadly prohibits the interception of wire communications and disclosure of
22 the contents of such intercepted communications.” Tavernetti v. Superior Ct. of San Diego Cnty.,
23 22 Cal. 3d 187 (1978). Section 631(a) of CIPA creates four avenues for relief:
24 (1) where a person “by means of any machine, instrument, or
25 2 Defendant also argues Plaintiff’s CIPA claims fail because she expressly consented to
Defendant’s terms and policies that allowed Meta to obtain her information. (Doc. No. 18-1 at
26
20–25.) Because the court finds Plaintiff has failed to state a claim under Sections 631 and 632,
27 the court does not address Defendant’s arguments regarding consent. Accordingly, the court will
deny as moot Defendant’s request for judicial notice of relevant terms and conditions. (Doc. No.
28 18-15.)
1 contrivance, or in any other manner, intentionally taps, or makes any
unauthorized connection . . . with any telegraph or telephone wire,
2 line, cable, or instrument”;
3 (2) where a person “willfully and without consent of all parties to the
communication, or in any unauthorized manner, reads, or attempts to
4 read, or to learn the contents or meaning of any message, report, or
communication while the same is in transit”;
5
(3) where a person “uses, or attempts to use, in any manner, or for
6 any purpose, or to communicate in any way, any information so
obtained”; and
7
(4) where a person “aids, agrees with, employs, or conspires with any
8 person or persons to unlawfully do, or permit, or cause to be done
any of the acts or things mentioned above.”
9
Javier v. Assurance IQ, LLC, 649 F. Supp. 3d 891, 897 (N.D. Cal. 2023). Plaintiff invokes the
10
fourth avenue of relief, alleging Defendant has violated Section 631(a) of the CIPA by “enabling
11
[Meta’s] wrongdoing.” (Doc. Nos. 14 at ¶¶ 105, 107; 23 at 10.)
12
Defendant contends that Plaintiff’s Section 631(a) claim should be dismissed because
13
Plaintiff (1) fails to allege Meta “read or attempted” to read the “contents” of Plaintiff’s
14
communications that were allegedly intercepted and (2) fails to allege facts showing that
15
Defendant “aided” or “conspired” with Meta. (Doc. No. 18-1 at 12–16.) Because the court finds
16
dismissal of Plaintiff’s Section 631(a) claim is warranted due to her failure to allege the
17
“contents” of her communications, the court need not and will not address Defendant’s remaining
18
argument.
19
A violation of CIPA is analyzed under the same standards applied to a violation of the
20
federal wiretap act, Electronic Communications Privacy Act (“ECPA”), 18 U.S.C § 2510 et seq.;
21
Hammerling v. Google LLC, 615 F. Supp. 3d 1069, 1092 (N.D. Cal. 2022). The ECPA defines
22
the term “contents” as “any information concerning the substance, purport, or meaning of that
23
communication.” 18 U.S.C. § 2510. “Contents” means “the intended message conveyed by the
24
communication” as opposed to “record information regarding the characteristics of the message
25
that is generated in the course of the communication.” In re Zynga Priv. Litig., 750 F.3d 1098,
26
1106 (9th Cir. 2014); Yoon v. Lululemon USA, Inc., 549 F. Supp. 3d 1073, 1083 (C.D. Cal. 2021)
27
(noting that Section 631(a) “protects only the internal, user-generated material of a message, not
28
1 routine identifiers, whether automatically generated or not”). “Courts employ a contextual ‘case-
2 specific’ analysis hinging on ‘how much information would be revealed’ by the information’s
3 tracking and disclosure.” Hammerling, 615 F. Supp. 3d at 1092. While a URL that includes
4 “basic identification and address information” is not “content,” a website “user’s request to a
5 search engine for specific information could constitute a communication such that divulging a
6 URL containing that search term to a third party could amount to disclosure of the contents of a
7 communication.” Id. at 1108–09.
8 In its motion, Defendant argues the information Plaintiff alleges that Defendant enabled
9 Meta to obtain constitutes only “record information,” not the “contents” of any communication.
10 (Doc. No. 18-1 at 14.) In Defendant’s view, Plaintiff alleges Meta intercepted only the following
11 information: “her name, email, address, phone number, and room-selection information.” (Id.)
12 Defendant further argues that the URLs Plaintiff alleges were intercepted contain “room-related
13 selections and other (record) information” as opposed to the “intended message conveyed by the
14 communication.” (Id. at 13–14.)
15 In her opposition to the pending motion, Plaintiff argues that she has pled the “contents”
16 of her communications were intercepted because she alleges Meta received information regarding
17 her “button clicks.” (Doc. No. 23 at 13.) Specifically, Plaintiff alleges “button clicks” convey “the
18 destination to which [Website users] wish to travel, the desired dates for their trip, the number of
19 rooms they require, the number of adults and children who will be traveling, and the particular
20 hotel section or tower in which they wish to stay. (Doc. No. 14 at ¶ 20.) Plaintiff further argues
21 Defendant intercepted “full-string URLs of the Website pages she visited,” which convey
22 “individualized search terms and booking information.” (Doc. No. 23 at 7, 13.)
23 As an initial matter, the court notes that Plaintiff’s FAC does not identify with specificity
24 what information she provided on Defendant’s Website that was intercepted by Meta. Plaintiff’s
25 FAC dedicates only one short paragraph to describing her personal interactions with Defendant’s
26 Website. (Doc. No. 14 at ¶ 3.) Plaintiff alleges that she used Defendant’s Website “[s]everal
27 times” to “browse[] and book a Hard Rock hotel” (id.), but she does not describe her browsing
28 activity, such as what webpages she viewed, what buttons she clicked, what search terms she
1 used, what destinations she searched for, or what her desired dates of travel were. Nor does
2 Plaintiff describe the hotels she allegedly booked. Instead, Plaintiff’s FAC vaguely alleges that
3 her communications with Defendant’s Website included “guest records” that were intercepted by
4 Meta, as enabled by Defendant. See, e.g., Cousin v. Sharp Healthcare, 681 F. Supp. 3d 1117,
5 1123 (S.D. Cal. 2023) (finding the plaintiffs’ complaint lacked sufficient factual support for a
6 CIPA claim because it only provided hypothetical examples and failed to specify what
7 information plaintiffs provided defendants through their browsing history).
8 In any event, Plaintiff’s FAC falls short of alleging that the “contents” of communications,
9 as opposed to “record information,” were intercepted. To the extent Plaintiff alleges Meta
10 intercepted “guest records” including the address, telephone number, email address, or zip code
11 of Website users, those allegations are insufficient because that information constitutes “record
12 information.” (Doc. No. 14 at ¶¶ 44, 68, 115); see Hammerling, 615 F. Supp. 3d at 1092–93
13 (“Generally, customer information such as a person’s name, address, and subscriber number or
14 identity is record information, but it may be contents when it is part of the substance of the
15 message conveyed to the recipient.”); In re Zynga Priv. Litig., 750 F.3d at 1106 (holding that
16 “contents” under CIPA does not include customer record information such as name or address).
17 Likewise, “button clicks” are “more akin to the ‘record’ information that the Ninth Circuit has
18 held not to be contents of a communication.” Mikulsky v. Bloomingdale’s, LLC, 713 F. Supp. 3d
19 833, 845 (S.D. Cal. 2024) (citing In re Zynga Priv. Litig., 750 F.3d at 1106); see also Yoon v.
20 Lululemon USA, Inc., 549 F. Supp. 3d 1073, 1082–83 (C.D. Cal. 2021) (explaining that “mouse
21 clicks” do not constitute “message content in the same way that the words of a text message or an
22 email do” for purposes of CIPA). Finally, although “descriptive URLs that reveal specific
23 information about a user’s queries” may reflect the “contents” of communications under CIPA,
24 St. Aubin v. Carbon Health Techs., Inc., No. 4:24-cv-00667-JST, 2024 WL 4369675, at *4 (N.D.
25 Cal. Oct. 1, 2024), as discussed above, Plaintiff’s FAC is devoid of any allegation describing her
26 search queries, if any. Notably, Plaintiff’s FAC provides examples of the types of “full-string
27 URLs” allegedly intercepted by Meta, but Plaintiff does not allege she conducted the searches or
28 visited the webpages provided in the examples. (Doc. No. 14 at ¶¶ 47–52.) Thus, Plaintiff has not
1 alleged that the “contents” of her communications were intercepted.
2 Therefore, the court will grant Defendant’s motion to dismiss Plaintiff’s claim brought
3 under Section 631(a) of CIPA. Because alleging additional facts could cure this pleading
4 deficiency, the court will grant Plaintiff leave to amend this claim.
5 B. California Invasion of Privacy Act: Section 632
6 Section 632 of CIPA imposes liability against a “person who, intentionally and without
7 the consent of all parties to a confidential communication, uses an electronic amplifying or
8 recording device to eavesdrop upon or record the confidential communication, whether the
9 communication is carried on among the parties in the presence of one another or by means of a
10 telegraph, telephone, or other device, except a radio.” Cal. Penal Code § 632(a). The CIPA
11 defines a “confidential communication” as “any communication carried on in circumstances as
12 may reasonably indicate that any party to the communication desires it to be confined to the
13 parties thereto, but excludes a communication made . . . in any other circumstance in which the
14 parties to the communication may reasonably expect that the communication may be overheard or
15 recorded.” Cal. Penal Code § 632(c).
16 “Courts generally find that internet communications do not have an objectively reasonable
17 expectation of confidentiality, especially if those communications can be easily shared by the
18 recipients of the communications.” Yoon v. Meta Platforms, Inc., No. 5:24-cv-02612-NC, 2024
19 WL 5264041, at *6 (N.D. Cal. Dec. 30, 2024) (citing Brown v. Google LLC, 685 F. Supp. 3d 909,
20 938 (N.D. Cal. 2023)). A plaintiff must plead “something unique about [] particular internet
21 communications” to demonstrate those communications are confidential. In re Meta Pixel
22 Healthcare Litig., 647 F. Supp. 3d 778, 799 (N.D. Cal. 2022) (finding that communications made
23 in the context of a patient-medical provider relationship were considered distinguishable from
24 typical online communications because they are protected by federal law and are uniquely
25 personal).
26 In its motion, Defendant argues Plaintiff has failed to allege that her communications were
27 “confidential” for purposes of a Section 632 claim. (Doc. No. 18-1 at 17.) Specifically, Defendant
28 argues that Plaintiff has not alleged facts “sufficient to overcome any presumption that the
1 information in her ‘internet-based’ communications” with Defendant’s Website are not
2 confidential. (Id.) Defendant contends Plaintiff has not plausibly alleged that she had a reasonable
3 expectation of privacy that booking information such as her “name, email address, phone number,
4 and/or room-related selections” would not be shared. (Id. at 18.) In her opposition, Plaintiff
5 counters that her communications were “confidential” and she “reasonably expected that her
6 communications would be confined” to her and Defendant because California Civil Code Section
7 53.5(a) mandates that “guest records” are confidential. (Doc. No. 23 at 16) (citing Cal. Civ. Code
8 § 53.5(a)). In response, Defendant argues California Civil Code Section 53.5(a) permits the
9 sharing of information by business entities with third parties for business-related purposes, and
10 there is no authority for the proposition that a “guest record” as defined by California Civil Code
11 Section 53.5(a) is per se confidential under Section 632 of CIPA. (Doc. Nos. 18-1 at 17–19, 24 at
12 10.)
13 Regardless of whether “guest records” under California Civil Code Section 53.5(a) qualify
14 as “confidential” communications under Section 632 of CIPA, Plaintiff has not alleged that her
15 communications with Defendant’s Website constitute guest records. As discussed above, because
16 the extent of Plaintiff’s allegations are that she used Defendant’s Website “[s]everal times” to
17 “browse[] and book a Hard Rock hotel,” (Doc. No. 14 at ¶ 3), Plaintiff’s FAC lacks sufficient
18 factual information regarding her interactions with Defendant’s Website, as required to state a
19 cognizable Section 632 claim. In light of Plaintiff’s bare allegations regarding her interactions
20 with Defendant’s Website, a reasonable inference cannot be drawn that Plaintiff had a reasonable
21 expectation of privacy in the communications Meta intercepted. Thus, Plaintiff has not pled that
22 her communications were “confidential” as required for a claim under Section 632.
23 Therefore, the court will grant Defendant’s motion to dismiss Plaintiff’s claim under
24 Section 632 of CIPA. Because alleging additional facts could cure this pleading deficiency, the
25 court will grant Plaintiff leave to amend this claim as well.
26 CONCLUSION
27 For the reasons explained above:
28 1. Defendant’s request for judicial notice (Doc. No. 18-15) is DENIED;
1 2. Defendant’s motion to dismiss (Doc. No. 18) is GRANTED, with leave to amend;
2 3. Within twenty-one (21) days of the date of entry of this order, Plaintiff shall file a
3 second amended complaint, or alternatively, file a notice of her intent not to file a
4 second amended complaint; and
5 4. Plaintiff is warned that her failure to comply with this order may result in an order
6 dismissing this case.
7
IT IS SO ORDERED. □
9 | Dated: _ June 9, 2025 LY Os
Dena Coggins
10 United States District Judge
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
10